dsh-mindmap 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -25,6 +25,12 @@ All notable changes to this project are documented here. Release-specific notes
 
 - The panel now reliably auto-opens when the AI completes `mindmap_open` / `mindmap_create`. A structural fingerprint of the session nodes (`nodesFingerprint`) feeds a second `useSession` selector; its value comparison bypasses the reference-equality short-circuit that starved the auto-open effect whenever the host store mutated the nodes array in place.
 - The "AI 正在打开脑图…" loading state is no longer a dead end. Snapshot documents whose path differs from the tree-click key only by letter case (macOS case-insensitive filesystem) now merge automatically; errored mindmap tool results (`isError` or `ok !== true`) surface as an inline error; a ~30s watchdog switches to a timeout state. Both failure states offer a one-click retry that re-sends the open request.
+- A code-review sweep (`_issues/002`) landed 11 fixes, each with a failing regression test first:
+  - **Markdown parsing**: an unclosed `---` frontmatter fence at the top no longer swallows the whole document into an empty tree; the root-title echo merge (`firstTopH1Seen`) is set only by a top-level H1 so an earlier H2 or a heading inside a quote block no longer suppresses it; GFM table column count is pinned to the **separator row** (short rows padded, extra cells dropped) instead of the header; fenced code blocks close only on a matching fence type (`~~~` is no longer ended by a ``` line) and `parseTableRow` honors an escaped `\|` preceded by an escaped backslash (`\\|`).
+  - **Document snapshots**: `mergeDocuments` only deletes a dropped local entry when no live snapshot owns the same path, so a recreated file that a snapshot also references keeps its panel openable.
+  - **Link rendering**: the bare-URL pattern no longer swallows CJK punctuation/full-width characters (`https://a.com，然后…` stops at the comma); `[text](url)` and bare links render as plain text unless the scheme is http/https/mailto (blocking `javascript:`/`data:`), and `openLink` calls `preventDefault` only when `window.open` actually succeeds, so host-blocked popups fall back to default navigation instead of a dead click.
+  - **Host safety & approval**: the tree route and all mindmap path resolutions now reject symlink escapes out of the working directory via a `realpath` walk-up (`resolvesInsideBase`); `requireApproval` gates `mindmap_create` as well as `mindmap_update`; and `listDirectoryLevel` stops iterating once it hits the entry cap (perf) while still flagging truncation.
+  - **PNG export**: wide tables measure their box height using the same clamped per-column width the renderer uses, so wrapped cell text no longer overflows the measured box bottom.
 
 ## [0.4.1] - 2026-08-24
 

package/README.md

@@ -23,9 +23,9 @@ A DeepSeek Harness plugin that turns a plain Markdown file into a live mindmap.
 - **Single-mindmap mode** — two tabs only: 目录 (tree) and 脑图 (the current mindmap); opening another `.md` replaces the previous one.
 - **"What you see is what the AI edits"** — when the visible mindmap differs from the AI's working document, the panel automatically asks the AI to open it, keeping the chat focus in sync.
 - **MarkGrove-style mapping** — heading hierarchy, nested lists (empty items become placeholder nodes), code blocks as leaf nodes, paragraphs as node notes, stable structural IDs, and orthogonal connector lines between nodes.
-- **Centered canvas with zoom** — the mindmap opens centered in the canvas (scrollable without edge clipping when larger); a floating zoom bar at the canvas top-right (zoom out / percent / zoom in / fit) applies auto fit-to-view on open (small maps stay at 100%), steps through 25%–300% with a stable view center, and keeps re-fitting as the AI edits — until you zoom manually. Click any node to zoom in on it and its whole subtree, with the node pinned at the left-center of the canvas.
+- **Centered canvas with zoom and pan** — the mindmap opens centered in the canvas (scrollable without edge clipping when larger); a floating zoom bar at the canvas top-right (zoom out / percent / zoom in / fit) applies auto fit-to-view on open (small maps stay at 100%), steps through 25%–300% with a stable view center, and keeps re-fitting as the AI edits — until you zoom manually. Click any node to zoom in on it and its whole subtree, with the node pinned at the left-center of the canvas. The canvas also pans by drag: the **middle button** anywhere (even over a node), the **left button on blank canvas** (the Mac trackpad「click and drag」path), or **Space + left button** when the drag must start on a card. Content follows the pointer 1:1, blank space shows a grab hand, and a 4px threshold separates drag from click — so clicking blank space still clears the selection and clicking a node still focuses it, while a real drag never wipes the selection ring.
 - **PNG export** — one click on 导出图片 exports the current mindmap.
-- **Safety** — `mindmap_update` is approval-free by default (files are git-managed) with a `requireApproval` switch as an escape hatch; the client has **no write path** to the filesystem — every edit goes through the AI tools.
+- **Safety** — `mindmap_create` / `mindmap_update` are approval-free by default (files are git-managed) with a `requireApproval` switch as an escape hatch (when on, both write tools ask); the client has **no write path** to the filesystem — every edit goes through the AI tools.
 
 ## Requirements
 

package/README.zh-CN.md

@@ -23,9 +23,9 @@
 - **单脑图模式**——面板只有「目录」和「脑图」两个 tab，打开新脑图替换旧的那颗。
 - **「所见即所编」焦点同步**——可见脑图与 AI 工作文档不一致时，面板自动让 AI 打开它，聊天焦点始终跟随你的眼睛。
 - **MarkGrove 同款映射与连线**——标题层级挂树、列表缩进（空项 = 占位节点）、代码块叶节点、段落挂节点说明、稳定结构 ID、节点间直角折线。
-- **画布居中与缩放**——脑图打开后居中呈现（超出画布时可滚动、无边缘裁剪）；画布右上角浮动缩放条（缩小 / 比例 / 放大 / 适配），打开时自动适配合适比例（小图保持 100%），25%–300% 逐级缩放且视图中心不跳变，AI 编辑后持续自动再适配，直到你手动缩放。点击任意节点即可聚焦：节点滚到画布左侧居中，视图放大到它和整棵子树完整可见（上限 100%）。
+- **画布居中、缩放与平移**——脑图打开后居中呈现（超出画布时可滚动、无边缘裁剪）；画布右上角浮动缩放条（缩小 / 比例 / 放大 / 适配），打开时自动适配合适比例（小图保持 100%），25%–300% 逐级缩放且视图中心不跳变，AI 编辑后持续自动再适配，直到你手动缩放。点击任意节点即可聚焦：节点滚到画布左侧居中，视图放大到它和整棵子树完整可见（上限 100%）。画布还能拖着走：**中键**随处拖（含节点上）、**空白处左键拖**（Mac 触控板「点按并拖移」）、或 **Space + 左键拖**（必须从节点上起手时）；内容跟手 1:1，空白处呈抓手光标，4px 阈值把拖与点分开——点空白仍取消选中、点节点仍聚焦，真拖不会误清选中圈。
 - **PNG 导出**——面板右上角「导出图片」一键导出当前脑图。
-- **安全**——`mindmap_update` 默认免原生审批（文件受 git 管控），留 `requireApproval` 开关作后悔药；客户端**没有任何写文件通道**，一切编辑都经 AI 工具。
+- **安全**——`mindmap_create`/`mindmap_update` 默认免原生审批（文件受 git 管控），留 `requireApproval` 开关作后悔药（开启后两个写工具都走审批）；客户端**没有任何写文件通道**，一切编辑都经 AI 工具。
 
 ## 环境要求
 

package/client.js

@@ -287,11 +287,12 @@ window.__ModuleLoader__.load({
 		}
 		
 		/** 表格行 → 单元格数组（去首尾空段，保留中间空单元格）。
-		 * 支持 GFM 转义：`\|` 是字面竖线（占位符避位，剥标记后还原），不切单元格。 */
+		 * 支持 GFM 转义：`\|` 是字面竖线（占位符避位，剥标记后还原），不切单元格；
+		 * `\\|` 则是已转义的反斜杠 + 真分隔符，照常切开。 */
 		function parseTableRow(line) {
 			return String(line ?? "").trim()
 				.replace(/^\|/, "").replace(/\|$/, "")
-				.replace(/\\\|/g, "\u0000")
+				.replace(/(?<!\\)((?:\\\\)*)\\\|/g, "$1\u0000")
 				.split("|")
 				.map((c) => c.replace(/\u0000/g, "|").trim());
 		}
@@ -333,13 +334,16 @@ window.__ModuleLoader__.load({
 				data: {},
 			};
 			// 根标题回声标记：记录文档常以文件名作首行 H1（如 "# 002-spike结论.md"），
-			// 而根节点标题就是文件名——首个 H1 与根标题一致（或仅多 .md 后缀）时
-			// 并入根节点，避免标题显示两次。仅文档顶层参与回声（引用内不算）。
-			let firstHeadingSeen = false;
+			// 而根节点标题就是文件名——首个顶层 H1 与根标题一致（或仅多 .md 后缀）
+			// 时并入根节点，避免标题显示两次。只有顶层 H1 参与回声：H2 等低级标题
+			// 不消耗名额，引用块递归（echoRoot=false）也不触碰本标记。
+			let firstTopH1Seen = false;
 			const lines = String(markdown ?? "").split(/\r?\n/);
 		
 			let start = 0;
-			// 跳过 YAML frontmatter（--- ... ---）
+			// 跳过 YAML frontmatter（--- ... ---）：找不到闭合行说明不是
+			// frontmatter（如以水平线开头的合法文档），回退普通解析，
+			// 否则整篇会被吞成空树。
 			if (lines.length > 0 && /^\s*---\s*$/.test(lines[0])) {
 				for (start = 1; start < lines.length; start++) {
 					if (/^\s*---\s*$/.test(lines[start])) {
@@ -347,6 +351,7 @@ window.__ModuleLoader__.load({
 						break;
 					}
 				}
+				if (start >= lines.length) start = 0;
 			}
 		
 			/**
@@ -393,12 +398,16 @@ window.__ModuleLoader__.load({
 		
 					// 围栏代码块：整块成为一个叶节点，标题 = [语言] 首行摘要（盒内紧凑，
 					// 悬停浮层看全文——003 §5.3；data.code 全量保存）。
-					if (/^\s*(```|~~~)/.test(line)) {
+					// GFM：闭合围栏须同字符且不少于开启长度——``` 块里的 ~~~、
+					// ```` 块里的 ``` 都是代码内容，不是围栏。
+					const fence = /^\s*(`{3,}|~{3,})/.exec(line);
+					if (fence) {
 						flushParagraph();
 						listStack = [];
-						const lang = line.trim().slice(3).trim();
+						const lang = line.trim().slice(fence[1].length).trim();
+						const fenceClose = new RegExp(`^\\s*${fence[1][0]}{${fence[1].length},}\\s*$`);
 						const buf = [];
-						for (i += 1; i < lineList.length && !/^\s*(```|~~~)/.test(lineList[i]); i++) buf.push(lineList[i]);
+						for (i += 1; i < lineList.length && !fenceClose.test(lineList[i]); i++) buf.push(lineList[i]);
 						const code = buf.join("\n");
 						const firstLine = (code.split("\n")[0] || "").trim();
 						const summary = firstLine.length > 40 ? `${firstLine.slice(0, 40)}…` : firstLine;
@@ -419,12 +428,15 @@ window.__ModuleLoader__.load({
 						listStack = [];
 						const level = heading[1].length;
 						const text = heading[2].trim() || "（无标题）";
-						// 首个 H1 与根标题一致（或仅多 .md 后缀）→ 并入根节点，不另建节点。
-						if (echoRoot && !firstHeadingSeen && level === 1 && (text === root.topic || text === `${root.topic}.md`)) {
-							firstHeadingSeen = true;
-							continue;
+						// 首个顶层 H1 与根标题一致（或仅多 .md 后缀）→ 并入根节点，不另建节点。
+						// 名额只属于顶层 H1：低级标题先行、引用块内出现标题都不影响回声。
+						if (echoRoot && level === 1) {
+							if (!firstTopH1Seen && (text === root.topic || text === `${root.topic}.md`)) {
+								firstTopH1Seen = true;
+								continue;
+							}
+							firstTopH1Seen = true;
 						}
-						firstHeadingSeen = true;
 						while (headingStack.length > 0 && headingStack[headingStack.length - 1].level >= level) headingStack.pop();
 						const basePath = parentRec() ? parentRec().path : "";
 						const node = {
@@ -475,19 +487,20 @@ window.__ModuleLoader__.load({
 							flushParagraph();
 							listStack = [];
 							i = j - 1;
-							const header = parseTableRow(rows[0]);
-							// GFM 对齐契约：列数钉死在分隔行（=表头）。少列补空、
-							// 多列截断——未转义竖线切碎的行顶多内容错位，网格永不参差。
+							// GFM 对齐契约：列数钉死在分隔行。表头与数据行同等待遇：
+							// 少列补空、多列截断——未转义竖线切碎的行顶多内容错位，网格永不参差。
+							const cols = parseTableRow(rows[1]).length;
 							const toCols = (cells) => {
-								if (cells.length >= header.length) return cells.slice(0, header.length);
-								return cells.concat(new Array(header.length - cells.length).fill(""));
+								if (cells.length >= cols) return cells.slice(0, cols);
+								return cells.concat(new Array(cols - cells.length).fill(""));
 							};
+							const header = toCols(parseTableRow(rows[0]));
 							const body = rows.slice(2).map((row) => toCols(parseTableRow(row)));
 							const tableRows = [header].concat(body);
 							appendNode({
 								id: idOf("table", tableRows.map((r) => r.join("\u0001")).join("\u0002"), parentPathOf()),
 								kind: "table",
-								topic: `${tableRows.length}×${header.length} 表格`,
+								topic: `${tableRows.length}×${cols} 表格`,
 								children: [],
 								data: { rows: tableRows },
 							});
@@ -807,7 +820,9 @@ window.__ModuleLoader__.load({
 				const lower = p.toLowerCase();
 				if (snapPaths.some((sp) => sp.toLowerCase() === lower)) dropped.add(p);
 			}
-			for (const p of dropped) delete byPath[p];
+			// 只删本地条目；若该路径同时是存活快照文档
+			// （改名后又重建），快照保留，面板照常打开。
+			for (const p of dropped) if (!snapByPath[p]) delete byPath[p];
 			const order = [...(snapshot?.order ?? [])];
 			for (const p of Object.keys(localDocs)) {
 				if (!snapByPath[p] && !dropped.has(p)) order.push(p);
@@ -997,14 +1012,16 @@ window.__ModuleLoader__.load({
 			return { text: stripInlineForExport(node.topic), lines: null };
 		}
 
-		/** 019 盒尺寸估算：文本按折行行数生长；表格按行列数算网格尺寸。 */
+		/** 019 盒尺寸估算：文本按折行行数生长；表格按行列数算网格尺寸。
+		 * 022：测量与渲染必须共用钳制后的列宽——先算盒宽再按 w/cols 折行，
+		 * 否则宽表（钳到 tableMaxW）按 110px 估行、渲染按更窄列宽折行，盒高不足。 */
 		function measureExportBox(node) {
 			if (node.kind === "table") {
 				const rows = (node.data && node.data.rows) || [];
 				const cols = rows.reduce((mx, row) => Math.max(mx, row.length), 0) || 1;
-				const cellInner = EXPORT.tableCellW - EXPORT.tableCellPad * 2;
-				const rowLines = rows.map((row) => row.reduce((mx, cell) => Math.max(mx, wrapExportText(stripInlineForExport(cell), cellInner, EXPORT.fontSize - 1).length), 1));
 				const w = Math.min(EXPORT.tableMaxW, Math.max(EXPORT.tableMinW, cols * EXPORT.tableCellW));
+				const cellInner = w / cols - EXPORT.tableCellPad * 2;
+				const rowLines = rows.map((row) => row.reduce((mx, cell) => Math.max(mx, wrapExportText(stripInlineForExport(cell), cellInner, EXPORT.fontSize - 1).length), 1));
 				const h = Math.max(EXPORT.lineHeight, rowLines.reduce((a, b) => a + b, 0) * EXPORT.lineHeight);
 				return { w, h };
 			}
@@ -1541,18 +1558,25 @@ window.__ModuleLoader__.load({
 		//#region 019 血肉渲染：行内格式 + 大一统链接 + 表格块（规范源：003）
 		// 行内格式统一扫描序：图片/链接 → 行内代码 → 粗体 → 删除线 → 斜体 → 裸链接。
 		// 先命中先生效，裸链接放最后，避免吞掉已被 [文字](url) 消费的 URL。
-		const INLINE_PATTERN = /(!?\[[^\]]*\]\([^)]*\))|(`[^`]+`)|(\*\*[^*]+\*\*)|(~~[^~]+~~)|(\*[^*\s][^*]*\*)|(https?:\/\/[^\s)]+)/g;
+		// 裸链接字符类排除 CJK 标点与全角符号（，。、；（）……），
+		// 否则中文句读被吞进 URL；ASCII 括号放行，由配平裁剪兜底。
+		const INLINE_PATTERN = /(!?\[[^\]]*\]\([^)]*\))|(`[^`]+`)|(\*\*[^*]+\*\*)|(~~[^~]+~~)|(\*[^*\s][^*]*\*)|(https?:\/\/[^\s\u3000-\u303f\uff00-\uffef]+)/g;
 
 		/** 大一统链接点击：在机器浏览器打开（新标签页），不触发画布聚焦缩放。 */
 		function openLink(event, url) {
-			event.preventDefault();
 			event.stopPropagation();
+			// 只在 window.open 成功后 preventDefault：宿主拦截（返回 null 或
+			// 抛错）时不拦，锚点自带的 target=_blank 原生导航接管——链接永远可达。
+			// （旧版 catch 里给只读属性 defaultPrevented 赋值是死代码，拦了默认
+			// 行为又开不了窗，链接彻底点不开。）
+			let opened = null;
 			try {
-				window.open(url, "_blank", "noopener");
+				opened = window.open(url, "_blank", "noopener");
 			} catch {
-				// 宿主环境拦截时退化为浏览器默认行为（不静默吞链接）。
-				event.defaultPrevented = false;
+				opened = null;
 			}
+			if (!opened) return;
+			event.preventDefault();
 		}
 
 		/**
@@ -1575,20 +1599,26 @@ window.__ModuleLoader__.load({
 					// [文字](url) 或 ![alt](url)。图片块暂缓（003 §9）：图语法退化为
 					// 指向原图的链接，同时把 alt 与原图地址都完整呈现（不缩减）。
 					const parsed = /^(!?)\[([^\]]*)\]\(([^)]*)\)$/.exec(token);
-					// 普通链接标签取文字（无文字显地址）；图语法带 alt 时两者都完整呈现。
-					const label = parsed[1]
-						? (parsed[2] ? `${parsed[2]} (${parsed[3]})` : parsed[3])
-						: (parsed[2] || parsed[3]);
-					out.push((0, react_jsx_runtime.jsx)("a", {
-						key,
-						href: parsed[3],
-						target: "_blank",
-						rel: "noopener noreferrer",
-						style: S.inlineLink,
-						title: parsed[3],
-						onClick: (e) => openLink(e, parsed[3]),
-						children: label,
-					}, key));
+					// scheme 白名单：只放行 http/https/mailto。javascript:/data:
+					// 等不进 href，整串原样退化为纯文本（不缩减，也不可执行）。
+					if (!/^\s*(https?:|mailto:)/i.test(parsed[3])) {
+						out.push(token);
+					} else {
+						// 普通链接标签取文字（无文字显地址）；图语法带 alt 时两者都完整呈现。
+						const label = parsed[1]
+							? (parsed[2] ? `${parsed[2]} (${parsed[3]})` : parsed[3])
+							: (parsed[2] || parsed[3]);
+						out.push((0, react_jsx_runtime.jsx)("a", {
+							key,
+							href: parsed[3],
+							target: "_blank",
+							rel: "noopener noreferrer",
+							style: S.inlineLink,
+							title: parsed[3],
+							onClick: (e) => openLink(e, parsed[3]),
+							children: label,
+						}, key));
+					}
 				} else if (m[2]) {
 					out.push((0, react_jsx_runtime.jsx)("code", { key, style: S.inlineCode, children: token.slice(1, -1) }, key));
 				} else if (m[3]) {
@@ -1598,17 +1628,30 @@ window.__ModuleLoader__.load({
 				} else if (m[5]) {
 					out.push((0, react_jsx_runtime.jsx)("em", { key, children: token.slice(1, -1) }, key));
 				} else {
-					// 裸链接：完整显示、可点击。
+					// 裸链接：完整显示、可点击。维基式配平括号属于 URL；未配平的
+					// 尾 ) 退回正文当纯文本——href 干净，可见文本不丢字符。
+					let url = token;
+					let opens = 0;
+					let closes = 0;
+					for (const ch of url) {
+						if (ch === "(") opens += 1;
+						else if (ch === ")") closes += 1;
+					}
+					while (closes > opens && url.endsWith(")")) {
+						url = url.slice(0, -1);
+						closes -= 1;
+					}
 					out.push((0, react_jsx_runtime.jsx)("a", {
 						key,
-						href: token,
+						href: url,
 						target: "_blank",
 						rel: "noopener noreferrer",
 						style: S.inlineLink,
-						title: token,
-						onClick: (e) => openLink(e, token),
-						children: token,
+						title: url,
+						onClick: (e) => openLink(e, url),
+						children: url,
 					}, key));
+					if (url.length < token.length) out.push(token.slice(url.length));
 				}
 				last = m.index + token.length;
 			}
@@ -3352,6 +3395,8 @@ window.__ModuleLoader__.load({
 			parseTableRow,
 			nodeFullText,
 			renderInline,
+			// 链接点击：供测试验证开窗成功才拦默认行为（宿主拦截时退回原生导航）。
+			openLink,
 			stripInlineForExport,
 			wrapExportText,
 			COLOR_THEMES,

package/index.js

@@ -9,12 +9,12 @@
 // - 四工具都带 path/name 参数（决策 3：多脑图并存，作用于指定那颗）。
 // - 结果 JSON {ok, op, path, rootTitle, content, renamedFrom?}：content 全文
 //   供模型续编辑，client 用同一份重放面板（工具结果即实时通道，002 第二节）。
-// - requireApproval 配置（决策 6）：默认 false 免审批；置 true 时 mindmap_update
-//   走原生 ask（tools/pre-execute，照 dsh-grafana 的钩子模式）。015 起经 settings
-//   namespace 可在设置面板运行时切换（见 SETTINGS_NAMESPACE/Config）。
+// - requireApproval 配置（决策 6）：默认 false 免审批；置 true 时 mindmap_create
+//   与 mindmap_update 走原生 ask（tools/pre-execute，照 dsh-grafana 的钩子模式）。
+//   015 起经 settings namespace 可在设置面板运行时切换（见 SETTINGS_NAMESPACE/Config）。
 // - 依赖：仅 @deepseek-ai/schemastery（settings schema；发布包正常解析，
 //   link 开发需先 npm i）。工具参数 schema 仍手写 JSON Schema（003 偏差 1）。
-import { access, opendir, readFile, rename, stat, writeFile } from 'node:fs/promises'
+import { access, opendir, readFile, realpath, rename, stat, writeFile } from 'node:fs/promises'
 import { dirname, isAbsolute, join, relative, resolve as resolvePath, sep } from 'node:path'
 import Schema from '@deepseek-ai/schemastery'
 
@@ -26,7 +26,7 @@ export const inject = ['tools', 'systemPrompt', 'webServer', 'sessions']
 // defaultPanelWidth 供客户端面板取默认宽度（20-80 钳制由客户端执行）。
 export const SETTINGS_NAMESPACE = 'mindmap'
 export const Config = Schema.object({
-  requireApproval: Schema.boolean().default(false).description('Require native DSH approval for every mindmap_update (including renameRoot). Files are git-managed, so it defaults to off. Hidden from the settings panel; still honored at runtime.'),
+  requireApproval: Schema.boolean().default(false).description('Require native DSH approval for every mindmap_create and mindmap_update (including renameRoot). Files are git-managed, so it defaults to off. Hidden from the settings panel; still honored at runtime.'),
   defaultPanelWidth: Schema.number().default(42).description('Default floating-panel width as a percentage of the viewport (clamped 20-80 on the client).'),
   lineStyle: Schema.union(['curve', 'elbow']).default('elbow').description('Connector line style between nodes: curve (bezier) or elbow (orthogonal).'),
   cardStyle: Schema.union(['rounded', 'square']).default('rounded').description('Node card corner style.'),
@@ -113,15 +113,44 @@ function escapesBase(rel) {
   return rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)
 }
 
-/** 请求路径校验：缺省 = 根 cwd；显式路径必须绝对且落在 cwd 内。 */
-function resolveTreePath(cwd, input) {
+/**
+ * realpath 包含性校验（#5）：字符串规范化只挡字面 `..`，cwd 内指向外部
+ * 的符号链接能骗过它。尾部不存在的段（待建文件）向上走最近的存在祖先
+ * 逐个 realpath——符号链接只能藏在已存在的段里。解析后仍在 base 内返回
+ * true；base 自身不存在或越界返回 false。
+ */
+async function resolvesInsideBase(resolved, base) {
+  let realBase
+  try {
+    realBase = await realpath(base)
+  } catch {
+    return false
+  }
+  let probe = resolved
+  for (;;) {
+    try {
+      const real = await realpath(probe)
+      if (real === realBase) return true
+      return !escapesBase(relative(realBase, real))
+    } catch (error) {
+      if (error?.code !== 'ENOENT' && error?.code !== 'ENOTDIR') throw error
+      const parent = dirname(probe)
+      if (parent === probe) return false
+      probe = parent
+    }
+  }
+}
+
+/** 请求路径校验：缺省 = 根 cwd；显式路径必须绝对、落在 cwd 内，
+ *  且解析符号链接后仍在内（#5）。 */
+async function resolveTreePath(cwd, input) {
   if (!cwd) throw httpError(400, 'no-cwd', 'session has no working directory')
   if (input === undefined || input === null || String(input).trim() === '') return cwd
   const p = String(input).trim()
   if (!isAbsolute(p)) throw httpError(400, 'bad-request', `path must be absolute: ${JSON.stringify(p)}`)
   const resolved = resolvePath(p)
   const rel = relative(cwd, resolved)
-  if (escapesBase(rel)) {
+  if (escapesBase(rel) || !(await resolvesInsideBase(resolved, cwd))) {
     throw httpError(400, 'bad-request', `path must stay inside the session working directory (${cwd})`)
   }
   return resolved
@@ -140,8 +169,10 @@ async function listDirectoryLevel(path, maxEntries = MAX_TREE_ENTRIES) {
   try {
     for await (const dirent of dir) {
       if (rows.length >= maxEntries) {
-        overflow += 1
-        continue
+        // 022：到达上限即停（旧实现 continue 会把巨型目录整个遍历一遍）。
+        // truncated 只取布尔语义，无需精确计数剩余条目。
+        overflow = 1
+        break
       }
       rows.push({
         name: dirent.name,
@@ -204,7 +235,7 @@ function sanitizeStem(input) {
  * 且必须以 .md 结尾。cwd 缺失时仅接受绝对路径。
  * @returns 绝对规范化路径。
  */
-function resolveMindmapPath(cwd, input) {
+async function resolveMindmapPath(cwd, input) {
   if (typeof input !== 'string' || !input.trim()) throw new Error('path is required.')
   const p = input.trim()
   if (!/\.md$/i.test(p)) throw new Error(`mindmap path must end with .md: ${JSON.stringify(p)}.`)
@@ -214,7 +245,8 @@ function resolveMindmapPath(cwd, input) {
   }
   const resolved = resolvePath(cwd, p)
   const rel = relative(cwd, resolved)
-  if (rel === '' || escapesBase(rel)) {
+  // realpath 兜底（#5）：写路径经符号链接越狱是安全敏感操作。
+  if (rel === '' || escapesBase(rel) || !(await resolvesInsideBase(resolved, cwd))) {
     throw new Error(`mindmap path must stay inside the session working directory (${cwd}).`)
   }
   return resolved
@@ -288,10 +320,18 @@ export function apply(ctx, config = {}) {
 
   // 后悔药开关（决策 6）：钩子常驻注册，运行时读 activeConfig().requireApproval
   // ——设置面板切换立即生效；关闭时直接放行（默认 false 免审批）。
+  // 022：create 同为写路径，一并纳入审批（CONTRIBUTING：所有写路径安全敏感）。
   ctx.on('tools/pre-execute', async (exec, next) => {
     const decision = await next()
     if (decision.kind !== 'allow') return decision
     if (!activeConfig().requireApproval) return decision
+    if (exec.name === 'mindmap_create') {
+      const args = exec.arguments ?? {}
+      return {
+        kind: 'ask',
+        reason: `Create mindmap ${JSON.stringify(String(args.name ?? '?'))}. dsh-mindmap is configured with requireApproval.`,
+      }
+    }
     if (exec.name !== 'mindmap_update') return decision
     const args = exec.arguments ?? {}
     const renameNote = typeof args.renameRoot === 'string' && args.renameRoot ? `, rename root to "${args.renameRoot}"` : ''
@@ -318,7 +358,7 @@ export function apply(ctx, config = {}) {
       const cwd = sessionCwd(exec)
       if (!cwd) throw new Error('The session has no working directory; cannot create a mindmap.')
       const stem = sanitizeStem(args?.name)
-      const path = resolveMindmapPath(cwd, `${stem}.md`)
+      const path = await resolveMindmapPath(cwd, `${stem}.md`)
       // wx = 不存在才创建：原子拒绝已存在（含并发竞态）与同名目录，无 TOCTOU 窗口。
       try {
         await writeFile(path, '', { encoding: 'utf8', flag: 'wx' })
@@ -345,7 +385,7 @@ export function apply(ctx, config = {}) {
     output: { schema: { type: 'string' }, render: (_args, value) => textOut(value) },
     timeoutMs: TOOL_TIMEOUT_MS,
     async execute(args, exec) {
-      const path = resolveMindmapPath(sessionCwd(exec), args?.path)
+      const path = await resolveMindmapPath(sessionCwd(exec), args?.path)
       const content = await readFile(path, 'utf8')
       return buildResult('open', path, { content })
     },
@@ -364,7 +404,7 @@ export function apply(ctx, config = {}) {
     output: { schema: { type: 'string' }, render: (_args, value) => textOut(value) },
     timeoutMs: TOOL_TIMEOUT_MS,
     async execute(args, exec) {
-      const path = resolveMindmapPath(sessionCwd(exec), args?.path)
+      const path = await resolveMindmapPath(sessionCwd(exec), args?.path)
       const content = await readFile(path, 'utf8')
       return buildResult('get', path, { content })
     },
@@ -386,7 +426,7 @@ export function apply(ctx, config = {}) {
     timeoutMs: TOOL_TIMEOUT_MS,
     async execute(args, exec) {
       const cwd = sessionCwd(exec)
-      const path = resolveMindmapPath(cwd, args?.path)
+      const path = await resolveMindmapPath(cwd, args?.path)
       const hasContent = typeof args?.content === 'string'
       if (!hasContent && typeof args?.renameRoot !== 'string') {
         throw new Error('mindmap_update requires content (or renameRoot alone for a pure rename).')
@@ -453,7 +493,7 @@ export function apply(ctx, config = {}) {
           sendJson(res, 400, { ok: false, error: { code: 'no-cwd', message: 'session has no working directory' } })
           return
         }
-        const dir = resolveTreePath(cwd, payload.path)
+        const dir = await resolveTreePath(cwd, payload.path)
         const listing = await listDirectoryLevel(dir)
         sendJson(res, 200, { ok: true, value: { ...listing, cwd } })
       } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mindmap",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Mindmap plugin for DeepSeek Harness: a plain markdown file in the working directory IS the mindmap; the chat edits it step by step and the right-side panel follows live.",
   "repository": {
     "type": "git",