dsh-agy-link 0.4.82 → 0.4.84

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.4.84 (2026-10-29)
+
+### English
+
+- **Perf(parser): parse a multi-line chunk in O(n) instead of O(n²).**
+  - `StreamJsonParser.feed()` walked the buffer with a `while` loop that re-sliced `this.buffer` on every newline — each slice copies the whole remainder, so a large chunk carrying many lines was quadratic in copied bytes. It now splits once (`split('\n')`, keep the torn tail), which is linear; behaviour (incl. `\r\n` stripping and torn-chunk buffering) is unchanged. Adds a large-single-chunk regression test.
+
+### 中文
+
+- **性能(parser)：多行 chunk 由 O(n²) 改为 O(n) 解析。**
+  - `StreamJsonParser.feed()` 原来用 `while` 循环逐行 `this.buffer = this.buffer.slice(...)`，每次 slice 都会复制整个剩余缓冲，含大量行的大 chunk 呈平方级复制。现改为一次性 `split('\n')` 并保留未完成的尾部（线性）；`\r\n` 去除与断块缓冲等行为不变。补充「单个大 chunk」回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.83...v0.4.84
+
+## 0.4.83 (2026-10-29)
+
+### English
+
+- **Fix(media): a malformed `file://` percent-escape no longer throws out of the media route.**
+  - `resolveLocalMediaPath()` called `decodeURIComponent()` unguarded on the `file://` path. A double-encoded query (`?path=file%3A%2F%2F%2F%25E0...`) decodes to the literal `file:///%E0%A4%A`, whose inner decode throws `URIError: URI malformed` straight out of `handleMediaRequest()` (unhandled). Malformed escapes are now decoded via a safe helper that returns `null`, so the route answers `404` instead of throwing. Adds a regression test.
+
+### 中文
+
+- **修复(media)：畸形的 `file://` 百分号转义不再把异常抛出媒体路由。**
+  - `resolveLocalMediaPath()` 对 `file://` 路径直接 `decodeURIComponent()`，未做保护。经双重编码的查询（`?path=file%3A%2F%2F%2F%25E0...`）解析出字面量 `file:///%E0%A4%A`，其内部解码抛出 `URIError: URI malformed` 并从 `handleMediaRequest()` 直接逃逸。现在改用安全解码助手，畸形转义返回 `null`，路由回 `404` 而非抛异常。补充回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.82...v0.4.83
+
 ## 0.4.82 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -2721,12 +2721,13 @@ var StreamJsonParser = class {
 	feed(chunk) {
 		this.buffer += chunk;
 		const out = [];
-		let nl;
-		while ((nl = this.buffer.indexOf("\n")) >= 0) {
-			const line = this.buffer.slice(0, nl).replace(/\r$/, "");
-			this.buffer = this.buffer.slice(nl + 1);
-			const ev = this.takeLine(line);
-			if (ev) out.push(ev);
+		if (this.buffer.indexOf("\n") >= 0) {
+			const parts = this.buffer.split("\n");
+			this.buffer = parts.pop() ?? "";
+			for (const part of parts) {
+				const ev = this.takeLine(part.replace(/\r$/, ""));
+				if (ev) out.push(ev);
+			}
 		}
 		if (this.buffer.length > 8388608) {
 			const dropped = this.buffer.length;
@@ -35029,6 +35030,14 @@ const MIME_MAP = {
 	".json": "application/json; charset=utf-8"
 };
 const IS_WIN = process.platform === "win32";
+/** decodeURIComponent that returns null instead of throwing on malformed input. */
+function safeDecodeUri(s) {
+	try {
+		return decodeURIComponent(s);
+	} catch {
+		return null;
+	}
+}
 /**
 * Normalize and resolve a raw path or file:// URL into a system file path.
 * Converts WSL /mnt/X/ and /home/ paths on Windows where possible.
@@ -35037,10 +35046,14 @@ function resolveLocalMediaPath(rawPath, workspaceRoot) {
 	if (!rawPath || typeof rawPath !== "string") return null;
 	let p = rawPath.trim();
 	if (p.startsWith("file:///")) {
-		p = decodeURIComponent(p.slice(8));
+		const decoded = safeDecodeUri(p.slice(8));
+		if (decoded === null) return null;
+		p = decoded;
 		if (IS_WIN && !/^[A-Za-z]:/.test(p) && /^\/[A-Za-z]:/.test(p)) p = p.slice(1);
 	} else if (p.startsWith("file://")) {
-		p = decodeURIComponent(p.slice(7));
+		const decoded = safeDecodeUri(p.slice(7));
+		if (decoded === null) return null;
+		p = decoded;
 		if (IS_WIN && p.startsWith("wsl.localhost/")) p = "\\\\" + p.replace(/\//g, "\\");
 	}
 	if (IS_WIN) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.82",
+  "version": "0.4.84",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",