deepseek-harness-background 0.3.1 → 0.3.2

package/lib/index.js

@@ -45,6 +45,12 @@ const OPACITY_MIN = 0;
 const OPACITY_MAX = 1;
 /** Default panel opacity (0..1); 1 = fully opaque official surfaces, 0 = fully transparent glass. */
 const DEFAULT_PANEL_OPACITY = .15;
+/**
+* Session-projection key this plugin owns in the client-visible value map —
+* the host fold registers it (src/projection.ts) and the rail reads it
+* (src/client/timeline.tsx); one shared constant so the two can never drift.
+*/
+const TIMELINE_PROJECTION_KEY = "bgTimeline";
 /** Default background rendering mode. */
 const DEFAULT_FIT = "cover";
 /** Image positioning modes. `cover` fills the frame (cropping as needed); `contain` fits the whole image inside the frame (letterboxing). */
@@ -190,9 +196,11 @@ function sniffImage(bytes) {
 }
 /** Per-upload size cap (20 MiB). */
 const MAX_UPLOAD_BYTES = 20971520;
-/** A stored upload id is `<up-` + hex + `>`; the on-disk file appends its extension. */
+/** A stored upload id is `<up-` + hex + `>`; the on-disk file appends its extension.
+* Length-capped (ids are 'up-' + 24 hex chars today): the cap keeps the
+* path-escape fence from admitting absurdly long filesystem probes. */
 function isUploadId(id) {
-	return /^up-[a-f0-9]+$/.test(id);
+	return /^up-[a-f0-9]{1,64}$/.test(id);
 }
 /** One JSON response. */
 function json(res, status, body) {
@@ -450,6 +458,13 @@ function makeBackgroundRoutes(settings, opts = {}) {
 							...pickKnown(readSection()),
 							...pickKnown(body)
 						};
+						if (merged.uploadId !== "" && merged.url !== "") {
+							json(res, 400, {
+								ok: false,
+								error: "mutually-exclusive-source"
+							});
+							return;
+						}
 						await settings.replace(BACKGROUND_SETTINGS_NAMESPACE, merged);
 						const after = readSection();
 						if (before.uploadId !== "" && before.uploadId !== after.uploadId) deleteUploadFile(before.uploadId, opts.home);
@@ -565,6 +580,98 @@ function makeBackgroundRoutes(settings, opts = {}) {
 	];
 }
 //#endregion
+//#region src/projection.ts
+/** Preview cap so projection payloads stay small (~1-2 lines per row). */
+const MAX_TEXT_CHARS = 80;
+/** Join the text blocks of a host-side ContentBlock list. */
+function textOf(content) {
+	if (!Array.isArray(content)) return "";
+	let out = "";
+	for (const block of content) if (block !== null && typeof block === "object" && block.type === "text") {
+		const text = block.text;
+		if (typeof text === "string") out += text;
+	}
+	return out.trim().slice(0, MAX_TEXT_CHARS);
+}
+/**
+* A surface replace cuts nodes out of the model-visible surface so indexed
+* user messages whose seq is cited in sourceEventSeqs must leave the index.
+* SurfaceOp.replace is the OBJECT form `{ op: 'replace', start, end }`
+* (core/session types) — never the bare string 'replace'; matching the whole
+* value against a string can never fire.
+*/
+function dropShadowedMessages(state, event) {
+	const op = event.surfaceOp;
+	if (op === null || typeof op !== "object" || op.op !== "replace") return state;
+	const shadowed = event.sourceEventSeqs;
+	if (!Array.isArray(shadowed) || shadowed.length === 0) return state;
+	const hide = /* @__PURE__ */ new Set();
+	for (const seq of shadowed) if (typeof seq === "number" && Number.isFinite(seq)) hide.add(seq);
+	if (hide.size === 0) return state;
+	const next = state.messages.filter((m) => !hide.has(m.seq));
+	return next.length === state.messages.length ? state : { messages: next };
+}
+/** Validate the persisted-state shape before a cache row seeds the fold. */
+const stateSchema = { parse(value) {
+	if (value === null || typeof value !== "object" || !Array.isArray(value.messages)) throw new Error("bgTimeline: persisted state is not a message index");
+	return value;
+} };
+/**
+* The projection definition in the runtime shape the registry drives (key /
+* stateSchema / init / apply / wire / stateVersion). Typed loosely here and
+* registered through a structural face: the typed contract lives behind
+* @deepseek-ai/dsh-session-projection, which the shell provides at runtime
+* but this package deliberately does not build against.
+*/
+const timelineProjectionDefinition = {
+	key: TIMELINE_PROJECTION_KEY,
+	stateSchema,
+	init: () => ({ messages: [] }),
+	apply: (state, event) => {
+		const e = event ?? {};
+		let next = state;
+		if (e.type === "user/message") {
+			const source = e.data?.source;
+			const seq = typeof e.seq === "number" ? e.seq : void 0;
+			if (source !== null && typeof source === "object" && source.kind === "user" && seq !== void 0 && Number.isFinite(seq)) {
+				const last = state.messages[state.messages.length - 1];
+				if (!(last !== void 0 && last.seq === seq)) {
+					const rawTime = typeof e.time === "number" ? e.time : typeof e.data?.time === "number" ? e.data.time : 0;
+					const id = typeof e.data?.id === "string" && e.data.id !== "" ? e.data.id : void 0;
+					const entry = {
+						seq,
+						time: rawTime,
+						text: textOf(e.data?.content),
+						...id === void 0 ? {} : { id }
+					};
+					next = { messages: [...state.messages, entry] };
+				}
+			}
+		}
+		return dropShadowedMessages(next, e);
+	},
+	wire: {
+		viewSchema: stateSchema,
+		view: (state) => state
+	},
+	stateVersion: 1
+};
+/**
+* Register the timeline projection with the host registry (when mounted).
+* Safe to call from the plugin root apply; the inject waits for the service
+* and never throws when the deployment has none.
+* @param ctx - Host context.
+*/
+function registerTimelineProjection(ctx) {
+	ctx.inject(["sessionProjections"], (hostCtx) => {
+		try {
+			hostCtx.sessionProjections?.register(timelineProjectionDefinition);
+		} catch (error) {
+			console.error("[deepseek-harness-background] timeline projection registration failed:", error);
+		}
+	});
+}
+//#endregion
 //#region src/index.ts
 const BACKGROUND_NAMESPACE = settingsNamespace(BACKGROUND_SETTINGS_NAMESPACE);
 /**
@@ -574,6 +681,7 @@ const BACKGROUND_NAMESPACE = settingsNamespace(BACKGROUND_SETTINGS_NAMESPACE);
 * @param ctx - Host context that may acquire the settings and webServer services.
 */
 function apply(ctx) {
+	registerTimelineProjection(ctx);
 	ctx.inject(["settings", "webServer"], (hostCtx) => {
 		if (!hostCtx.settings.describe().some((descriptor) => descriptor.ns === "ui-background")) hostCtx.settings.register(BACKGROUND_NAMESPACE, BackgroundSettingsSchema, { applies: "live" });
 		try {
@@ -584,4 +692,4 @@ function apply(ctx) {
 	});
 }
 //#endregion
-export { BACKGROUND_API_PREFIX, BACKGROUND_SETTINGS_NAMESPACE, BackgroundSettingsSchema, DEFAULT_FIT, DEFAULT_OPACITY, DEFAULT_PANEL_OPACITY, DEFAULT_SCRIM, FIT_MODES, OPACITY_MAX, OPACITY_MIN, PLUGIN_HOME_REL, SCRIM_MAX, SCRIM_MIN, apply, makeBackgroundRoutes, resolveHarnessHome };
+export { BACKGROUND_API_PREFIX, BACKGROUND_SETTINGS_NAMESPACE, BackgroundSettingsSchema, DEFAULT_FIT, DEFAULT_OPACITY, DEFAULT_PANEL_OPACITY, DEFAULT_SCRIM, FIT_MODES, OPACITY_MAX, OPACITY_MIN, PLUGIN_HOME_REL, SCRIM_MAX, SCRIM_MIN, TIMELINE_PROJECTION_KEY, apply, makeBackgroundRoutes, resolveHarnessHome, timelineProjectionDefinition };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "deepseek-harness-background",
   "description": "Custom background image plugin for the DeepSeek Harness web GUI: upload a local picture or paste an image URL, and render it behind the whole app surface with adjustable opacity, scrim, panel transparency and frosted-glass blur.",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "keywords": [
     "deepseek-harness",
     "dsh",