deepseek-harness-background 0.2.0 → 0.3.1

package/lib/index.js

@@ -1,8 +1,9 @@
 import { settingsNamespace } from "@deepseek-ai/dsh-settings";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { extname, join } from "node:path";
+import { existsSync, mkdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { extname, join, resolve } from "node:path";
 import { homedir } from "node:os";
 //#region src/settings.ts
 /** Durable background settings — pure constants/types shared by both halves. */
@@ -23,14 +24,17 @@ const BACKGROUND_SETTINGS_FIELDS = [
 	"panelOpacity",
 	"blur",
 	"wallpaperBlur",
-	"fit"
+	"fit",
+	"timeline"
 ];
 /** Browser-facing base path of the background API (shared with the host routes). */
 const BACKGROUND_API_PREFIX = "/api/bg-wallpaper";
 /** Minimum scrim opacity (0 = no veil at all). */
 const SCRIM_MIN = 0;
-/** Maximum scrim opacity (a nearly opaque veil keeps text legible over any art). */
-const SCRIM_MAX = .95;
+/** Maximum scrim opacity (1 = fully opaque veil — hides the wallpaper entirely).
+* Kept at 1 so every percent-unit slider shares one 0..1 domain: the same
+* displayed percentage puts every thumb at the same fraction of its track. */
+const SCRIM_MAX = 1;
 /** Default scrim strength applied over user art (a light readability veil). */
 const DEFAULT_SCRIM = .25;
 /** Default background image opacity (1 = fully opaque). */
@@ -61,35 +65,46 @@ const BackgroundSettingsSchema = z.object({
 	/** Image URL or empty (mutually exclusive with uploadId at runtime). */
 	url: z.string().default(""),
 	opacity: z.number().min(0).max(1).default(1),
-	scrim: z.number().min(0).max(SCRIM_MAX).default(DEFAULT_SCRIM),
+	scrim: z.number().min(0).max(1).default(DEFAULT_SCRIM),
 	panelOpacity: z.number().min(0).max(1).default(DEFAULT_PANEL_OPACITY),
 	blur: z.number().min(0).max(40).default(16),
 	wallpaperBlur: z.number().min(0).max(60).default(0),
-	fit: z.union([...FIT_MODES]).default(DEFAULT_FIT)
+	fit: z.union([...FIT_MODES]).default(DEFAULT_FIT),
+	timeline: z.boolean().default(true)
 });
 //#endregion
 //#region src/harness-home.ts
 /**
 * Harness-home resolution — where the uploaded wallpaper images live.
 *
-* Mirrors the dsh launcher's precedence (see apps/cli reference and the
-* skin-center harness-home.ts in dsh-web-ui): an explicit `--home`-formatted
-* override, else `$DSH_HOME`, else `<homedir>/.dsh`. Kept as a tiny pure
+* Mirrors the dsh launcher's precedence (see @deepseek-ai/dsh-home-paths'
+* resolveDshHome): `$DSH_HOME`, else `<homedir>/.dsh`. Kept as a tiny pure
 * function so the host half needs no out-of-tree dependency on the internal
-* home-paths package.
+* home-paths package. The semantics match the official resolver: an empty or
+* whitespace-only `$DSH_HOME` counts as unset, a leading `~` / `~/` / `~\`
+* expands against the OS home, and the result is normalized with
+* path.resolve().
 */
 /** First non-blank string in a candidate list, else undefined. */
 function firstNonBlank(...values) {
 	for (const value of values) if (typeof value === "string" && value.trim() !== "") return value.trim();
 }
+/** Expand supported tilde prefixes against the OS home (mirrors expandHomePath). */
+function expandHomePath(path) {
+	if (path === "~") return homedir();
+	if (path.startsWith("~/") || path.startsWith("~\\")) return join(homedir(), path.slice(2));
+	return path;
+}
 /**
-* Resolve the harness home (the directory containing `profiles/`): explicit
-* override wins, then `$DSH_HOME`, then `~/.dsh`.
+* Resolve the harness home (the directory containing `profiles/`): `$DSH_HOME`
+* first, then `~/.dsh`. An empty/whitespace `$DSH_HOME` counts as unset; a
+* leading tilde expands against the OS home; the result is absolute.
 * @param env - environment (defaults to process.env).
-* @returns the absolute harness home directory.
+* @returns the normalized absolute harness home directory.
 */
 function resolveHarnessHome(env = process.env) {
-	return firstNonBlank(env.DSH_HOME) ?? join(homedir(), ".dsh");
+	const selected = firstNonBlank(env.DSH_HOME) ?? join(homedir(), ".dsh");
+	return resolve(expandHomePath(selected));
 }
 /** Subdirectory under the harness home that this plugin owns. */
 const PLUGIN_HOME_REL = join("deepseek-harness-background");
@@ -122,7 +137,8 @@ const DEFAULTS = {
 	panelOpacity: DEFAULT_PANEL_OPACITY,
 	blur: 16,
 	wallpaperBlur: 0,
-	fit: DEFAULT_FIT
+	fit: DEFAULT_FIT,
+	timeline: true
 };
 /** Keep only the schema's known fields (see BACKGROUND_SETTINGS_FIELDS). */
 function pickKnown(section) {
@@ -149,7 +165,7 @@ const NUM_BOUNDS = {
 	},
 	scrim: {
 		min: 0,
-		max: SCRIM_MAX
+		max: 1
 	},
 	panelOpacity: {
 		min: 0,
@@ -198,19 +214,42 @@ function requireMethod(req, res, method) {
 * the request `Host` is rejected. Requests without either header (curl, node
 * http) pass — this is a local single-user tool, and the fence only targets
 * the cross-site browser vector.
+*
+* The `Host` itself must also be a loopback name: under a DNS-rebinding
+* attack the attacker's page resolves their own domain to 127.0.0.1, so both
+* `Origin` and `Host` carry the attacker's hostname and the self-consistency
+* check above alone would admit them. The web server binds loopback (or is
+* deliberately exposed on 0.0.0.0 by its operator), so accepting only
+* 127.0.0.1 / localhost / [::1] keeps every legitimate same-origin client
+* working while refusing rebounded ones.
 */
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]",
+	"::1"
+]);
+function isLoopbackHost(host) {
+	let bare = host;
+	if (host.startsWith("[")) {
+		const end = host.indexOf("]");
+		if (end !== -1) bare = host.slice(0, end + 1);
+	} else {
+		const colon = host.indexOf(":");
+		if (colon !== -1) bare = host.slice(0, colon);
+	}
+	return LOOPBACK_HOSTS.has(bare) || LOOPBACK_HOSTS.has(host);
+}
 function isSameOriginRequest(req) {
 	const site = req.headers["sec-fetch-site"];
 	if (typeof site === "string" && site === "cross-site") return false;
+	const host = req.headers.host;
+	if (typeof host !== "string" || !isLoopbackHost(host)) return false;
 	const origin = req.headers.origin;
-	if (typeof origin === "string" && origin !== "" && origin !== "null") {
-		const host = req.headers.host;
-		if (typeof host !== "string" || host === "") return false;
-		try {
-			return new URL(origin).host === host;
-		} catch {
-			return false;
-		}
+	if (typeof origin === "string" && origin !== "" && origin !== "null") try {
+		return new URL(origin).host === host;
+	} catch {
+		return false;
 	}
 	return true;
 }
@@ -292,6 +331,12 @@ function validateSectionBody(body, home) {
 		if (raw === void 0) continue;
 		if (typeof raw !== "number" || !Number.isFinite(raw) || raw < min || raw > max) return "invalid-range";
 	}
+	const enabled = body.enabled;
+	if (enabled !== void 0 && typeof enabled !== "boolean") return "invalid-enabled";
+	const timeline = body.timeline;
+	if (timeline !== void 0 && typeof timeline !== "boolean") return "invalid-timeline";
+	const fit = body.fit;
+	if (fit !== void 0 && fit !== "" && !FIT_MODES.includes(fit)) return "invalid-fit";
 	return null;
 }
 /**
@@ -324,13 +369,14 @@ function storeUpload(bytes, mime, homeOverride) {
 		url: `${BACKGROUND_API_PREFIX}/image/${id}`
 	};
 }
-/** Resolve an upload id to its on-disk path (or "" if invalid / missing). */
+/** Resolve an upload id to its on-disk path (or "" if invalid / missing).
+* Read-only: unlike the write path this never creates the plugin home, so a
+* GET cannot pay for (or race) a mkdirSync on every request. */
 function uploadPath(id, homeOverride) {
 	if (!isUploadId(id)) return "";
-	const dir = ensurePluginHome(homeOverride);
+	const dir = pluginHome(homeOverride);
 	for (const ext of [
 		"jpg",
-		"jpeg",
 		"png",
 		"webp",
 		"gif"
@@ -478,7 +524,7 @@ function makeBackgroundRoutes(settings, opts = {}) {
 		{
 			kind: "prefix",
 			path: `${BACKGROUND_API_PREFIX}/image`,
-			handler: (req, res) => {
+			handler: async (req, res) => {
 				if (!isSameOriginRequest(req)) {
 					json(res, 403, {
 						ok: false,
@@ -497,11 +543,12 @@ function makeBackgroundRoutes(settings, opts = {}) {
 					return;
 				}
 				try {
-					const data = readFileSync(abs);
+					const data = await readFile(abs);
 					const mime = mimeForPath(abs) ?? "application/octet-stream";
 					const stat = statSync(abs);
 					res.writeHead(200, {
 						"content-type": mime,
+						"x-content-type-options": "nosniff",
 						"content-length": String(data.length),
 						"last-modified": stat.mtime.toUTCString(),
 						"cache-control": "public, max-age=31536000, immutable"
@@ -528,7 +575,7 @@ const BACKGROUND_NAMESPACE = settingsNamespace(BACKGROUND_SETTINGS_NAMESPACE);
 */
 function apply(ctx) {
 	ctx.inject(["settings", "webServer"], (hostCtx) => {
-		hostCtx.settings.register(BACKGROUND_NAMESPACE, BackgroundSettingsSchema, { applies: "live" });
+		if (!hostCtx.settings.describe().some((descriptor) => descriptor.ns === "ui-background")) hostCtx.settings.register(BACKGROUND_NAMESPACE, BackgroundSettingsSchema, { applies: "live" });
 		try {
 			for (const route of makeBackgroundRoutes(hostCtx.settings)) hostCtx.effect(() => hostCtx.webServer.register(route), "deepseek-harness-background: settings route");
 		} catch (error) {

package/package.json

@@ -1,88 +1,86 @@
-{
-  "name": "deepseek-harness-background",
-  "description": "Custom background image plugin for the DeepSeek Harness web GUI: upload a local picture or paste an image URL, and render it behind the whole app surface with adjustable opacity, scrim, panel transparency and frosted-glass blur.",
-  "version": "0.2.0",
-  "keywords": [
-    "deepseek-harness",
-    "dsh",
-    "plugin",
-    "dsh-plugin",
-    "theme",
-    "wallpaper",
-    "background",
-    "web-ui"
-  ],
-  "author": "HaoyueQin",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/HaoyueQin/deepseek-harness-background.git"
-  },
-  "homepage": "https://github.com/HaoyueQin/deepseek-harness-background",
-  "packageManager": "pnpm@11.9.0",
-  "type": "module",
-  "main": "lib/index.js",
-  "exports": {
-    ".": "./lib/index.js",
-    "./client": "./lib/client.js",
-    "./src/*": "./src/*",
-    "./package.json": "./package.json"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "inject": [
-        "@deepseek-ai/dsh-client-runtime",
-        "@deepseek-ai/dsh-client-locale"
-      ],
-      "platform": "web"
-    }
-  },
-  "scripts": {
-    "build": "tsdown",
-    "prepare": "tsdown",
-    "watch": "tsdown --watch",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit -p tsconfig.json"
-  },
-  "license": "MIT",
-  "files": [
-    "lib",
-    "cordis.patch.yml",
-    "README.md",
-    "README.zh.md"
-  ],
-  "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.8",
-    "react": "^18.2.0"
-  },
-  "dependencies": {
-    "@deepseek-ai/dsh-settings": "^0.1.0-rc.8",
-    "@deepseek-ai/schemastery": "^3.18.1"
-  },
-  "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.8",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.8",
-    "@deepseek-ai/dsh-settings": "^0.1.0-rc.8",
-    "@deepseek-ai/schemastery": "^3.18.1",
-    "@testing-library/dom": "^10.4.1",
-    "@testing-library/react": "^16.3.0",
-    "@types/node": "^22.0.0",
-    "@types/react": "~18.3.1",
-    "@types/react-dom": "~18.3.0",
-    "clsx": "^2.1.1",
-    "jsdom": "^29.1.1",
-    "lightningcss": "^1.33.0",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0",
-    "tsdown": "^0.22.14",
-    "typescript": "^5.8.0",
-    "vitest": "^4.1.8"
-  }
-}
+{
+  "name": "deepseek-harness-background",
+  "description": "Custom background image plugin for the DeepSeek Harness web GUI: upload a local picture or paste an image URL, and render it behind the whole app surface with adjustable opacity, scrim, panel transparency and frosted-glass blur.",
+  "version": "0.3.1",
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "plugin",
+    "dsh-plugin",
+    "theme",
+    "wallpaper",
+    "background",
+    "web-ui"
+  ],
+  "author": "HaoyueQin",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/HaoyueQin/deepseek-harness-background.git"
+  },
+  "homepage": "https://github.com/HaoyueQin/deepseek-harness-background",
+  "packageManager": "pnpm@11.9.0",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-locale"
+      ],
+      "platform": "web"
+    }
+  },
+  "scripts": {
+    "build": "tsdown",
+    "prepare": "tsdown",
+    "watch": "tsdown --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.zh.md"
+  ],
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "react": "^18.2.0"
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@testing-library/dom": "^10.4.1",
+    "@testing-library/react": "^16.3.0",
+    "@types/node": "^22.0.0",
+    "@types/react": "~18.3.1",
+    "@types/react-dom": "~18.3.0",
+    "clsx": "^2.1.1",
+    "jsdom": "^29.1.1",
+    "lightningcss": "^1.33.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "tsdown": "^0.22.14",
+    "typescript": "^5.8.0",
+    "vitest": "^4.1.8"
+  }
+}