dsh-media-converter 1.2.0 → 1.2.1

package/README.md

@@ -19,6 +19,12 @@ DeepSeek Harness 的本地多媒体工具箱插件：转换、裁剪、提取音
 
 界面是一个「动作面板」：选文件 → 搜索或点动作 → 参数就地展开 → 结果就地显示。支持 `⌘K` 聚焦搜索、回车执行第一个动作、Esc 收起。
 
+![媒体工具箱空状态：拖入文件或点击选择，下方显示输出目录](docs/screenshots/panel-empty.png)
+
+选中一张图片后：左侧原图、右侧实时预览，并排 / 滑块两种对比方式，下方是「转换 / 查看」分组的动作列表。
+
+![图片前后对比与动作列表](docs/screenshots/image-compare.png)
+
 ## 给 Agent 用的工具
 
 同一个引擎也注册成工具 `media_toolbox`，助手可以直接调用：
@@ -44,12 +50,14 @@ DeepSeek Harness 的本地多媒体工具箱插件：转换、裁剪、提取音
 
 ## 安装
 
-已发布到 npm（`dsh-media-converter`）。在 Harness 里用 `plugin_manager` 的 `install_bundle` 装，或在 profile 目录里：
+已发布到 npm（`dsh-media-converter`）。一行装完：
 
 ```sh
-dsh plugin add dsh-media-converter --profile <profile>
+dsh plugin --profile web add dsh-media-converter
 ```
 
+`web` 换成你自己的 profile 名即可。也可以在 Harness 里用 `plugin_manager` 的 `install_bundle` 装。
+
 从源码装（开发用）：`plugin_manager` 的 `install_bundle`，target 指向本仓库目录——它会在 profile 的 `package.json` 里登记包名，并在 `node_modules/` 下建一条软链指向本目录。
 
 从 GitHub 装（未发布 npm 时的退路）：

package/dist/index.js

@@ -1,8 +1,13 @@
 // DSH Host plugin: local media toolkit — convert, trim, extract tracks, and
 // move media to/from Base64 through ffmpeg.
 //
+// Security has one home: every route asks the composition's `connection`
+// service for a rejection first (the Host/Origin fence plus browser
+// authentication, the same guard the `/api` bridge applies). No connection
+// service means no trusted caller, so requests are refused rather than served.
+//
 // The Web page (client.js) never touches the filesystem: it uploads picked
-// files to this plugin's same-origin routes, the Host runs one ffmpeg process
+// files to this plugin's routes, the Host runs one ffmpeg process
 // per job, and the page polls the job for progress. Results land in
 // ~/Downloads/media-toolbox (config.outputDir overrides it) and are served back
 // for preview from that same directory only.
@@ -241,18 +246,17 @@ export function apply(ctx, config) {
         res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
         res.end(JSON.stringify(payload));
     };
-    // Mutating routes are same-origin only: a plain cross-origin POST is a
-    // "simple request" the browser sends without preflight.
-    const sameOrigin = (req) => {
-        const origin = req.headers.origin;
-        if (!origin)
-            return true;
-        try {
-            return new URL(origin).host === new URL(webServer.getOrigin()).host;
-        }
-        catch {
+    // Every route crosses the connection trust fence before it touches the body
+    // or the disk: 403 answers a foreign Host/Origin, 401 a caller without the
+    // browser-session cookie. 503 when the composition owns no connection
+    // service — fail closed, never serve an unauthenticated request.
+    const connection = ctx.get('connection');
+    const rejectUnauthenticated = (req, res) => {
+        const rejection = connection ? connection.requestRejection({ headers: req.headers }) : 503;
+        if (rejection === undefined)
             return false;
-        }
+        json(res, rejection, errorPayload('unauthorized'));
+        return true;
     };
     // The preview and the reveal may only reach into the output directory. The
     // check resolves both sides first: a plain prefix check is defeated by a
@@ -605,6 +609,8 @@ export function apply(ctx, config) {
                 handler: (req, res) => {
                     if (req.method !== 'GET')
                         return json(res, 405, errorPayload('GET only'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     json(res, 200, statusPayload(ffmpeg, outDir, Math.round(maxUploadBytes / 1048576), version, composerButton, groups));
                 },
             }),
@@ -614,8 +620,8 @@ export function apply(ctx, config) {
                 handler: async (req, res) => {
                     if (req.method !== 'POST')
                         return json(res, 405, errorPayload('POST only'));
-                    if (!sameOrigin(req))
-                        return json(res, 403, errorPayload('forbidden origin'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     try {
                         const body = await readJson(req);
                         // Only defined keys are merged; an empty string resets that key to
@@ -670,8 +676,8 @@ export function apply(ctx, config) {
                 handler: async (req, res) => {
                     if (req.method !== 'POST')
                         return json(res, 405, errorPayload('POST only'));
-                    if (!sameOrigin(req))
-                        return json(res, 403, errorPayload('forbidden origin'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     if (!ffmpeg)
                         return json(res, 200, noFfmpeg);
                     let file = '';
@@ -740,8 +746,8 @@ export function apply(ctx, config) {
                 handler: async (req, res) => {
                     if (req.method !== 'POST')
                         return json(res, 405, errorPayload('POST only'));
-                    if (!sameOrigin(req))
-                        return json(res, 403, errorPayload('forbidden origin'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     if (!ffmpeg)
                         return json(res, 200, noFfmpeg);
                     try {
@@ -763,8 +769,8 @@ export function apply(ctx, config) {
                 handler: async (req, res) => {
                     if (req.method !== 'POST')
                         return json(res, 405, errorPayload('POST only'));
-                    if (!sameOrigin(req))
-                        return json(res, 403, errorPayload('forbidden origin'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     try {
                         const body = await readJson(req);
                         const job = jobs.get(String(body.id || ''));
@@ -800,6 +806,8 @@ export function apply(ctx, config) {
                 handler: (req, res) => {
                     if (req.method !== 'GET')
                         return json(res, 405, errorPayload('GET only'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     const id = requestUrl(req).searchParams.get('id');
                     const job = id ? jobs.get(id) : undefined;
                     if (!job)
@@ -813,6 +821,8 @@ export function apply(ctx, config) {
                 handler: async (req, res) => {
                     if (req.method !== 'GET')
                         return json(res, 405, errorPayload('GET only'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     const file = requestUrl(req).searchParams.get('file');
                     if (!insideOutput(file))
                         return json(res, 403, errorPayload('只能预览输出目录里的文件'));
@@ -825,8 +835,8 @@ export function apply(ctx, config) {
                 handler: async (req, res) => {
                     if (req.method !== 'POST')
                         return json(res, 405, errorPayload('POST only'));
-                    if (!sameOrigin(req))
-                        return json(res, 403, errorPayload('forbidden origin'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     try {
                         const { file } = await readJson(req);
                         if (!insideOutput(file))
@@ -846,8 +856,8 @@ export function apply(ctx, config) {
                 handler: async (req, res) => {
                     if (req.method !== 'POST')
                         return json(res, 405, errorPayload('POST only'));
-                    if (!sameOrigin(req))
-                        return json(res, 403, errorPayload('forbidden origin'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     let upload;
                     let mime;
                     try {
@@ -887,8 +897,8 @@ export function apply(ctx, config) {
                 handler: async (req, res) => {
                     if (req.method !== 'POST')
                         return json(res, 405, errorPayload('POST only'));
-                    if (!sameOrigin(req))
-                        return json(res, 403, errorPayload('forbidden origin'));
+                    if (rejectUnauthenticated(req, res))
+                        return;
                     try {
                         const body = await readJson(req);
                         const payload = decodeBase64Payload(body.text);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-media-converter",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Local media toolbox for DeepSeek Harness: convert, trim, split tracks, export subtitles, compress images, edit metadata, and Base64 — all through local ffmpeg.",
   "keywords": [
     "dsh",