dsh-mindmap 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -23,8 +23,19 @@ All notable changes to this project are documented here. Release-specific notes
 
 ### Fixed
 
+- Compatibility with dsh 0.1.2-rc.1 (statically verified, docs/023), while keeping 0.1.1-rc.2 working — all fixes are dual-path with the old path first:
+  - **Host tools**: `Agent` no longer carries a live `session` (it is reduced to `{ id }`), so `sessionCwd` now falls back from `exec.agent.session.header.cwd` (dsh ≤0.1.1) to looking the session up via `ctx.sessions.get(exec.agent.id).header.cwd` (0.1.2-rc.1). Without this, every tool failed with "the session has no working directory" on 0.1.2-rc.1.
+  - **Live panel data**: the session snapshot no longer carries a flat `nodes` array (conversation content moved to the Chat view), so the panel now reads nodes via `useChat → ChatSnapshot.legacy.nodes` (0.1.2-rc.1+) first and falls back to `useSession → SessionSnapshot.nodes` (dsh ≤0.1.1). `ToolResultNode` field names are unchanged across both, so document replay, auto-open, and error surfacing work as before.
+  - **Settings panel**: `settings.describe` over the client connection now returns the descriptor array directly (0.1.2-rc.1+) instead of an aggregate `result.value.namespaces` (dsh ≤0.1.1); both envelope shapes are parsed.
+  - **Hygiene**: `dsh.client.inject` additionally lists `@deepseek-ai/dsh-cordis-client-runner` (the 0.1.2-rc.1 browser runtime module id; `@deepseek-ai/dsh-client-runtime` is kept for 0.1.1-rc.2 — a missing id is silently skipped by the loader, so both coexist safely).
 - The panel now reliably auto-opens when the AI completes `mindmap_open` / `mindmap_create`. A structural fingerprint of the session nodes (`nodesFingerprint`) feeds a second `useSession` selector; its value comparison bypasses the reference-equality short-circuit that starved the auto-open effect whenever the host store mutated the nodes array in place.
 - The "AI 正在打开脑图…" loading state is no longer a dead end. Snapshot documents whose path differs from the tree-click key only by letter case (macOS case-insensitive filesystem) now merge automatically; errored mindmap tool results (`isError` or `ok !== true`) surface as an inline error; a ~30s watchdog switches to a timeout state. Both failure states offer a one-click retry that re-sends the open request.
+- A code-review sweep (`_issues/002`) landed 11 fixes, each with a failing regression test first:
+  - **Markdown parsing**: an unclosed `---` frontmatter fence at the top no longer swallows the whole document into an empty tree; the root-title echo merge (`firstTopH1Seen`) is set only by a top-level H1 so an earlier H2 or a heading inside a quote block no longer suppresses it; GFM table column count is pinned to the **separator row** (short rows padded, extra cells dropped) instead of the header; fenced code blocks close only on a matching fence type (`~~~` is no longer ended by a ``` line) and `parseTableRow` honors an escaped `\|` preceded by an escaped backslash (`\\|`).
+  - **Document snapshots**: `mergeDocuments` only deletes a dropped local entry when no live snapshot owns the same path, so a recreated file that a snapshot also references keeps its panel openable.
+  - **Link rendering**: the bare-URL pattern no longer swallows CJK punctuation/full-width characters (`https://a.com，然后…` stops at the comma); `[text](url)` and bare links render as plain text unless the scheme is http/https/mailto (blocking `javascript:`/`data:`), and `openLink` calls `preventDefault` only when `window.open` actually succeeds, so host-blocked popups fall back to default navigation instead of a dead click.
+  - **Host safety & approval**: the tree route and all mindmap path resolutions now reject symlink escapes out of the working directory via a `realpath` walk-up (`resolvesInsideBase`); `requireApproval` gates `mindmap_create` as well as `mindmap_update`; and `listDirectoryLevel` stops iterating once it hits the entry cap (perf) while still flagging truncation.
+  - **PNG export**: wide tables measure their box height using the same clamped per-column width the renderer uses, so wrapped cell text no longer overflows the measured box bottom.
 
 ## [0.4.1] - 2026-08-24
 

package/README.md

@@ -23,9 +23,9 @@ A DeepSeek Harness plugin that turns a plain Markdown file into a live mindmap.
 - **Single-mindmap mode** — two tabs only: 目录 (tree) and 脑图 (the current mindmap); opening another `.md` replaces the previous one.
 - **"What you see is what the AI edits"** — when the visible mindmap differs from the AI's working document, the panel automatically asks the AI to open it, keeping the chat focus in sync.
 - **MarkGrove-style mapping** — heading hierarchy, nested lists (empty items become placeholder nodes), code blocks as leaf nodes, paragraphs as node notes, stable structural IDs, and orthogonal connector lines between nodes.
-- **Centered canvas with zoom** — the mindmap opens centered in the canvas (scrollable without edge clipping when larger); a floating zoom bar at the canvas top-right (zoom out / percent / zoom in / fit) applies auto fit-to-view on open (small maps stay at 100%), steps through 25%–300% with a stable view center, and keeps re-fitting as the AI edits — until you zoom manually. Click any node to zoom in on it and its whole subtree, with the node pinned at the left-center of the canvas.
+- **Centered canvas with zoom and pan** — the mindmap opens centered in the canvas (scrollable without edge clipping when larger); a floating zoom bar at the canvas top-right (zoom out / percent / zoom in / fit) applies auto fit-to-view on open (small maps stay at 100%), steps through 25%–300% with a stable view center, and keeps re-fitting as the AI edits — until you zoom manually. Click any node to zoom in on it and its whole subtree, with the node pinned at the left-center of the canvas. The canvas also pans by drag: the **middle button** anywhere (even over a node), the **left button on blank canvas** (the Mac trackpad「click and drag」path), or **Space + left button** when the drag must start on a card. Content follows the pointer 1:1, blank space shows a grab hand, and a 4px threshold separates drag from click — so clicking blank space still clears the selection and clicking a node still focuses it, while a real drag never wipes the selection ring.
 - **PNG export** — one click on 导出图片 exports the current mindmap.
-- **Safety** — `mindmap_update` is approval-free by default (files are git-managed) with a `requireApproval` switch as an escape hatch; the client has **no write path** to the filesystem — every edit goes through the AI tools.
+- **Safety** — `mindmap_create` / `mindmap_update` are approval-free by default (files are git-managed) with a `requireApproval` switch as an escape hatch (when on, both write tools ask); the client has **no write path** to the filesystem — every edit goes through the AI tools.
 
 ## Requirements
 

package/README.zh-CN.md

@@ -23,9 +23,9 @@
 - **单脑图模式**——面板只有「目录」和「脑图」两个 tab，打开新脑图替换旧的那颗。
 - **「所见即所编」焦点同步**——可见脑图与 AI 工作文档不一致时，面板自动让 AI 打开它，聊天焦点始终跟随你的眼睛。
 - **MarkGrove 同款映射与连线**——标题层级挂树、列表缩进（空项 = 占位节点）、代码块叶节点、段落挂节点说明、稳定结构 ID、节点间直角折线。
-- **画布居中与缩放**——脑图打开后居中呈现（超出画布时可滚动、无边缘裁剪）；画布右上角浮动缩放条（缩小 / 比例 / 放大 / 适配），打开时自动适配合适比例（小图保持 100%），25%–300% 逐级缩放且视图中心不跳变，AI 编辑后持续自动再适配，直到你手动缩放。点击任意节点即可聚焦：节点滚到画布左侧居中，视图放大到它和整棵子树完整可见（上限 100%）。
+- **画布居中、缩放与平移**——脑图打开后居中呈现（超出画布时可滚动、无边缘裁剪）；画布右上角浮动缩放条（缩小 / 比例 / 放大 / 适配），打开时自动适配合适比例（小图保持 100%），25%–300% 逐级缩放且视图中心不跳变，AI 编辑后持续自动再适配，直到你手动缩放。点击任意节点即可聚焦：节点滚到画布左侧居中，视图放大到它和整棵子树完整可见（上限 100%）。画布还能拖着走：**中键**随处拖（含节点上）、**空白处左键拖**（Mac 触控板「点按并拖移」）、或 **Space + 左键拖**（必须从节点上起手时）；内容跟手 1:1，空白处呈抓手光标，4px 阈值把拖与点分开——点空白仍取消选中、点节点仍聚焦，真拖不会误清选中圈。
 - **PNG 导出**——面板右上角「导出图片」一键导出当前脑图。
-- **安全**——`mindmap_update` 默认免原生审批（文件受 git 管控），留 `requireApproval` 开关作后悔药；客户端**没有任何写文件通道**，一切编辑都经 AI 工具。
+- **安全**——`mindmap_create`/`mindmap_update` 默认免原生审批（文件受 git 管控），留 `requireApproval` 开关作后悔药（开启后两个写工具都走审批）；客户端**没有任何写文件通道**，一切编辑都经 AI 工具。
 
 ## 环境要求
 

package/client.js

@@ -7,9 +7,10 @@
 // - 脑图面板：014 起注册在 shell.overlay（list 槽、root scope、点击穿透层），
 //   右缘贴边全高悬浮、左缘拖拽调宽（280~80% 视口，localStorage 持久化）；
 //   details 槽已归还官方（原生「工具详情」栏恢复，003 的顶替方案退役）。
-// - 实时数据通路：消费会话快照（useSession → nodes）里 mindmap_* 工具的
-//   ToolResultNode，重放出各文档的最新内容并渲染（002/003：无自定义事件通道，
-//   工具调用本身就是事件流）。
+// - 实时数据通路：消费会话快照里 mindmap_* 工具的 ToolResultNode，重放出各文档
+//   的最新内容并渲染（002/003：无自定义事件通道，工具调用本身就是事件流）。
+//   023 双代：useChat → ChatSnapshot.legacy.nodes（dsh 0.1.2-rc.1+）优先，
+//   useSession → SessionSnapshot.nodes（dsh ≤0.1.1）兜底。
 // - markdown→脑图树：本文件内置零依赖解析器（MarkGrove mdastConverter 的映射
 //   语法移植：标题栈→树、列表→子节点、空列表项=占位节点、代码块→首行摘要叶
 //   节点、段落→挂标题的正文说明、结构路径稳定 ID）。
@@ -287,11 +288,12 @@ window.__ModuleLoader__.load({
 		}
 		
 		/** 表格行 → 单元格数组（去首尾空段，保留中间空单元格）。
-		 * 支持 GFM 转义：`\|` 是字面竖线（占位符避位，剥标记后还原），不切单元格。 */
+		 * 支持 GFM 转义：`\|` 是字面竖线（占位符避位，剥标记后还原），不切单元格；
+		 * `\\|` 则是已转义的反斜杠 + 真分隔符，照常切开。 */
 		function parseTableRow(line) {
 			return String(line ?? "").trim()
 				.replace(/^\|/, "").replace(/\|$/, "")
-				.replace(/\\\|/g, "\u0000")
+				.replace(/(?<!\\)((?:\\\\)*)\\\|/g, "$1\u0000")
 				.split("|")
 				.map((c) => c.replace(/\u0000/g, "|").trim());
 		}
@@ -333,13 +335,16 @@ window.__ModuleLoader__.load({
 				data: {},
 			};
 			// 根标题回声标记：记录文档常以文件名作首行 H1（如 "# 002-spike结论.md"），
-			// 而根节点标题就是文件名——首个 H1 与根标题一致（或仅多 .md 后缀）时
-			// 并入根节点，避免标题显示两次。仅文档顶层参与回声（引用内不算）。
-			let firstHeadingSeen = false;
+			// 而根节点标题就是文件名——首个顶层 H1 与根标题一致（或仅多 .md 后缀）
+			// 时并入根节点，避免标题显示两次。只有顶层 H1 参与回声：H2 等低级标题
+			// 不消耗名额，引用块递归（echoRoot=false）也不触碰本标记。
+			let firstTopH1Seen = false;
 			const lines = String(markdown ?? "").split(/\r?\n/);
 		
 			let start = 0;
-			// 跳过 YAML frontmatter（--- ... ---）
+			// 跳过 YAML frontmatter（--- ... ---）：找不到闭合行说明不是
+			// frontmatter（如以水平线开头的合法文档），回退普通解析，
+			// 否则整篇会被吞成空树。
 			if (lines.length > 0 && /^\s*---\s*$/.test(lines[0])) {
 				for (start = 1; start < lines.length; start++) {
 					if (/^\s*---\s*$/.test(lines[start])) {
@@ -347,6 +352,7 @@ window.__ModuleLoader__.load({
 						break;
 					}
 				}
+				if (start >= lines.length) start = 0;
 			}
 		
 			/**
@@ -393,12 +399,16 @@ window.__ModuleLoader__.load({
 		
 					// 围栏代码块：整块成为一个叶节点，标题 = [语言] 首行摘要（盒内紧凑，
 					// 悬停浮层看全文——003 §5.3；data.code 全量保存）。
-					if (/^\s*(```|~~~)/.test(line)) {
+					// GFM：闭合围栏须同字符且不少于开启长度——``` 块里的 ~~~、
+					// ```` 块里的 ``` 都是代码内容，不是围栏。
+					const fence = /^\s*(`{3,}|~{3,})/.exec(line);
+					if (fence) {
 						flushParagraph();
 						listStack = [];
-						const lang = line.trim().slice(3).trim();
+						const lang = line.trim().slice(fence[1].length).trim();
+						const fenceClose = new RegExp(`^\\s*${fence[1][0]}{${fence[1].length},}\\s*$`);
 						const buf = [];
-						for (i += 1; i < lineList.length && !/^\s*(```|~~~)/.test(lineList[i]); i++) buf.push(lineList[i]);
+						for (i += 1; i < lineList.length && !fenceClose.test(lineList[i]); i++) buf.push(lineList[i]);
 						const code = buf.join("\n");
 						const firstLine = (code.split("\n")[0] || "").trim();
 						const summary = firstLine.length > 40 ? `${firstLine.slice(0, 40)}…` : firstLine;
@@ -419,12 +429,15 @@ window.__ModuleLoader__.load({
 						listStack = [];
 						const level = heading[1].length;
 						const text = heading[2].trim() || "（无标题）";
-						// 首个 H1 与根标题一致（或仅多 .md 后缀）→ 并入根节点，不另建节点。
-						if (echoRoot && !firstHeadingSeen && level === 1 && (text === root.topic || text === `${root.topic}.md`)) {
-							firstHeadingSeen = true;
-							continue;
+						// 首个顶层 H1 与根标题一致（或仅多 .md 后缀）→ 并入根节点，不另建节点。
+						// 名额只属于顶层 H1：低级标题先行、引用块内出现标题都不影响回声。
+						if (echoRoot && level === 1) {
+							if (!firstTopH1Seen && (text === root.topic || text === `${root.topic}.md`)) {
+								firstTopH1Seen = true;
+								continue;
+							}
+							firstTopH1Seen = true;
 						}
-						firstHeadingSeen = true;
 						while (headingStack.length > 0 && headingStack[headingStack.length - 1].level >= level) headingStack.pop();
 						const basePath = parentRec() ? parentRec().path : "";
 						const node = {
@@ -475,19 +488,20 @@ window.__ModuleLoader__.load({
 							flushParagraph();
 							listStack = [];
 							i = j - 1;
-							const header = parseTableRow(rows[0]);
-							// GFM 对齐契约：列数钉死在分隔行（=表头）。少列补空、
-							// 多列截断——未转义竖线切碎的行顶多内容错位，网格永不参差。
+							// GFM 对齐契约：列数钉死在分隔行。表头与数据行同等待遇：
+							// 少列补空、多列截断——未转义竖线切碎的行顶多内容错位，网格永不参差。
+							const cols = parseTableRow(rows[1]).length;
 							const toCols = (cells) => {
-								if (cells.length >= header.length) return cells.slice(0, header.length);
-								return cells.concat(new Array(header.length - cells.length).fill(""));
+								if (cells.length >= cols) return cells.slice(0, cols);
+								return cells.concat(new Array(cols - cells.length).fill(""));
 							};
+							const header = toCols(parseTableRow(rows[0]));
 							const body = rows.slice(2).map((row) => toCols(parseTableRow(row)));
 							const tableRows = [header].concat(body);
 							appendNode({
 								id: idOf("table", tableRows.map((r) => r.join("\u0001")).join("\u0002"), parentPathOf()),
 								kind: "table",
-								topic: `${tableRows.length}×${header.length} 表格`,
+								topic: `${tableRows.length}×${cols} 表格`,
 								children: [],
 								data: { rows: tableRows },
 							});
@@ -807,7 +821,9 @@ window.__ModuleLoader__.load({
 				const lower = p.toLowerCase();
 				if (snapPaths.some((sp) => sp.toLowerCase() === lower)) dropped.add(p);
 			}
-			for (const p of dropped) delete byPath[p];
+			// 只删本地条目；若该路径同时是存活快照文档
+			// （改名后又重建），快照保留，面板照常打开。
+			for (const p of dropped) if (!snapByPath[p]) delete byPath[p];
 			const order = [...(snapshot?.order ?? [])];
 			for (const p of Object.keys(localDocs)) {
 				if (!snapByPath[p] && !dropped.has(p)) order.push(p);
@@ -997,14 +1013,16 @@ window.__ModuleLoader__.load({
 			return { text: stripInlineForExport(node.topic), lines: null };
 		}
 
-		/** 019 盒尺寸估算：文本按折行行数生长；表格按行列数算网格尺寸。 */
+		/** 019 盒尺寸估算：文本按折行行数生长；表格按行列数算网格尺寸。
+		 * 022：测量与渲染必须共用钳制后的列宽——先算盒宽再按 w/cols 折行，
+		 * 否则宽表（钳到 tableMaxW）按 110px 估行、渲染按更窄列宽折行，盒高不足。 */
 		function measureExportBox(node) {
 			if (node.kind === "table") {
 				const rows = (node.data && node.data.rows) || [];
 				const cols = rows.reduce((mx, row) => Math.max(mx, row.length), 0) || 1;
-				const cellInner = EXPORT.tableCellW - EXPORT.tableCellPad * 2;
-				const rowLines = rows.map((row) => row.reduce((mx, cell) => Math.max(mx, wrapExportText(stripInlineForExport(cell), cellInner, EXPORT.fontSize - 1).length), 1));
 				const w = Math.min(EXPORT.tableMaxW, Math.max(EXPORT.tableMinW, cols * EXPORT.tableCellW));
+				const cellInner = w / cols - EXPORT.tableCellPad * 2;
+				const rowLines = rows.map((row) => row.reduce((mx, cell) => Math.max(mx, wrapExportText(stripInlineForExport(cell), cellInner, EXPORT.fontSize - 1).length), 1));
 				const h = Math.max(EXPORT.lineHeight, rowLines.reduce((a, b) => a + b, 0) * EXPORT.lineHeight);
 				return { w, h };
 			}
@@ -1481,20 +1499,35 @@ window.__ModuleLoader__.load({
 			] });
 		}
 
+		/**
+		 * 会话内容节点的双代快照选择（023）：dsh ≤0.1.1 的 useSession 快照带
+		 * 平铺 nodes；0.1.2-rc.1 起 SessionSnapshot 拆成纯控制状态，会话内容
+		 * 迁入 useChat 的 ChatSnapshot.legacy.nodes（官方兼容面，ToolResultNode
+		 * 字段同名）。legacy 优先、旧 nodes 兜底，两代通吃。
+		 */
+		function conversationNodesOf(s) {
+			if (!s) return EMPTY_NODES;
+			const legacy = s.legacy;
+			if (legacy && Array.isArray(legacy.nodes)) return legacy.nodes;
+			return Array.isArray(s.nodes) ? s.nodes : EMPTY_NODES;
+		}
+
 		/**
 		 * 「思维脑图」槽位组件（014）：同一槽位渲染 M 按钮 + 悬浮面板宿主层。
 		 * session scope 的 useSession/sessionId/inputActions 直给，经 props 传给
 		 * MindmapDetailsPanel（无桥、无 useSyncExternalStore——shell.overlay 跨槽
-		 * 方案实测未渲染，弃用后顺手把桥也删了）。
+		 * 方案实测未渲染，弃用后顺手把桥也删了）。023：内容钩子改为
+		 * useChat（0.1.2-rc.1+）优先、useSession（≤0.1.1）兜底。
 		 */
 		function MindmapSlot(props) {
-			const { useSession, sessionId, inputActions, mindmapFace } = props;
-			const nodes = useSession ? useSession((s) => (s && s.nodes) || EMPTY_NODES) : EMPTY_NODES;
+			const { useSession, useChat, sessionId, inputActions, mindmapFace } = props;
+			const nodesHook = useChat ?? useSession;
+			const nodes = nodesHook ? nodesHook(conversationNodesOf) : EMPTY_NODES;
 			// 016 可靠性加固：结构指纹作第二 selector。store 原地改数组（引用
 			// 不变）时，nodes prop 不换、memo 命中缓存、auto-open effect 永不
 			// 重跑——「AI 打开了脑图但面板不展开」的根因。指纹是原始值字符串，
-			// 值比较天然绕过引用相等短路；useSession 不可用时回退空串。
-			const nodesVersion = useSession ? useSession((s) => nodesFingerprint((s && s.nodes) || EMPTY_NODES)) : "";
+			// 值比较天然绕过引用相等短路；内容钩子不可用时回退空串。
+			const nodesVersion = nodesHook ? nodesHook((s) => nodesFingerprint(conversationNodesOf(s))) : "";
 			const [open, setOpen] = react.useState(false);
 			return (0, react_jsx_runtime.jsxs)(react.Fragment, { children: [
 				(0, react_jsx_runtime.jsxs)("button", {
@@ -1541,18 +1574,25 @@ window.__ModuleLoader__.load({
 		//#region 019 血肉渲染：行内格式 + 大一统链接 + 表格块（规范源：003）
 		// 行内格式统一扫描序：图片/链接 → 行内代码 → 粗体 → 删除线 → 斜体 → 裸链接。
 		// 先命中先生效，裸链接放最后，避免吞掉已被 [文字](url) 消费的 URL。
-		const INLINE_PATTERN = /(!?\[[^\]]*\]\([^)]*\))|(`[^`]+`)|(\*\*[^*]+\*\*)|(~~[^~]+~~)|(\*[^*\s][^*]*\*)|(https?:\/\/[^\s)]+)/g;
+		// 裸链接字符类排除 CJK 标点与全角符号（，。、；（）……），
+		// 否则中文句读被吞进 URL；ASCII 括号放行，由配平裁剪兜底。
+		const INLINE_PATTERN = /(!?\[[^\]]*\]\([^)]*\))|(`[^`]+`)|(\*\*[^*]+\*\*)|(~~[^~]+~~)|(\*[^*\s][^*]*\*)|(https?:\/\/[^\s\u3000-\u303f\uff00-\uffef]+)/g;
 
 		/** 大一统链接点击：在机器浏览器打开（新标签页），不触发画布聚焦缩放。 */
 		function openLink(event, url) {
-			event.preventDefault();
 			event.stopPropagation();
+			// 只在 window.open 成功后 preventDefault：宿主拦截（返回 null 或
+			// 抛错）时不拦，锚点自带的 target=_blank 原生导航接管——链接永远可达。
+			// （旧版 catch 里给只读属性 defaultPrevented 赋值是死代码，拦了默认
+			// 行为又开不了窗，链接彻底点不开。）
+			let opened = null;
 			try {
-				window.open(url, "_blank", "noopener");
+				opened = window.open(url, "_blank", "noopener");
 			} catch {
-				// 宿主环境拦截时退化为浏览器默认行为（不静默吞链接）。
-				event.defaultPrevented = false;
+				opened = null;
 			}
+			if (!opened) return;
+			event.preventDefault();
 		}
 
 		/**
@@ -1575,20 +1615,26 @@ window.__ModuleLoader__.load({
 					// [文字](url) 或 ![alt](url)。图片块暂缓（003 §9）：图语法退化为
 					// 指向原图的链接，同时把 alt 与原图地址都完整呈现（不缩减）。
 					const parsed = /^(!?)\[([^\]]*)\]\(([^)]*)\)$/.exec(token);
-					// 普通链接标签取文字（无文字显地址）；图语法带 alt 时两者都完整呈现。
-					const label = parsed[1]
-						? (parsed[2] ? `${parsed[2]} (${parsed[3]})` : parsed[3])
-						: (parsed[2] || parsed[3]);
-					out.push((0, react_jsx_runtime.jsx)("a", {
-						key,
-						href: parsed[3],
-						target: "_blank",
-						rel: "noopener noreferrer",
-						style: S.inlineLink,
-						title: parsed[3],
-						onClick: (e) => openLink(e, parsed[3]),
-						children: label,
-					}, key));
+					// scheme 白名单：只放行 http/https/mailto。javascript:/data:
+					// 等不进 href，整串原样退化为纯文本（不缩减，也不可执行）。
+					if (!/^\s*(https?:|mailto:)/i.test(parsed[3])) {
+						out.push(token);
+					} else {
+						// 普通链接标签取文字（无文字显地址）；图语法带 alt 时两者都完整呈现。
+						const label = parsed[1]
+							? (parsed[2] ? `${parsed[2]} (${parsed[3]})` : parsed[3])
+							: (parsed[2] || parsed[3]);
+						out.push((0, react_jsx_runtime.jsx)("a", {
+							key,
+							href: parsed[3],
+							target: "_blank",
+							rel: "noopener noreferrer",
+							style: S.inlineLink,
+							title: parsed[3],
+							onClick: (e) => openLink(e, parsed[3]),
+							children: label,
+						}, key));
+					}
 				} else if (m[2]) {
 					out.push((0, react_jsx_runtime.jsx)("code", { key, style: S.inlineCode, children: token.slice(1, -1) }, key));
 				} else if (m[3]) {
@@ -1598,17 +1644,30 @@ window.__ModuleLoader__.load({
 				} else if (m[5]) {
 					out.push((0, react_jsx_runtime.jsx)("em", { key, children: token.slice(1, -1) }, key));
 				} else {
-					// 裸链接：完整显示、可点击。
+					// 裸链接：完整显示、可点击。维基式配平括号属于 URL；未配平的
+					// 尾 ) 退回正文当纯文本——href 干净，可见文本不丢字符。
+					let url = token;
+					let opens = 0;
+					let closes = 0;
+					for (const ch of url) {
+						if (ch === "(") opens += 1;
+						else if (ch === ")") closes += 1;
+					}
+					while (closes > opens && url.endsWith(")")) {
+						url = url.slice(0, -1);
+						closes -= 1;
+					}
 					out.push((0, react_jsx_runtime.jsx)("a", {
 						key,
-						href: token,
+						href: url,
 						target: "_blank",
 						rel: "noopener noreferrer",
 						style: S.inlineLink,
-						title: token,
-						onClick: (e) => openLink(e, token),
-						children: token,
+						title: url,
+						onClick: (e) => openLink(e, url),
+						children: url,
 					}, key));
+					if (url.length < token.length) out.push(token.slice(url.length));
 				}
 				last = m.index + token.length;
 			}
@@ -3227,6 +3286,19 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 
+		/**
+		 * settings describe 应答的双代信封解析（023）：dsh ≤0.1.1 的远端把
+		 * 描述符聚合在 result.value.namespaces[]；0.1.2-rc.1 起直接返回描述符
+		 * 数组（每项 {ns, schema, value, …}，字段两代同名）。数组优先、
+		 * namespaces 兜底，两代通吃。
+		 */
+		function settingsNamespacesOf(res) {
+			const value = res?.result?.value;
+			if (Array.isArray(value)) return value;
+			const list = value?.namespaces;
+			return Array.isArray(list) ? list : [];
+		}
+
 		function apply(ctx) {
 			const face = {};
 
@@ -3288,7 +3360,7 @@ window.__ModuleLoader__.load({
 			face.readSettings = async () => {
 				if (!settingsApi || typeof settingsApi.settings?.describe !== "function") return null;
 				const res = await settingsApi.settings.describe({});
-				const namespaces = res?.result?.value?.namespaces ?? [];
+				const namespaces = settingsNamespacesOf(res);
 				const ns = namespaces.find((n) => n?.ns === "mindmap");
 				return ns?.value ?? null;
 			};
@@ -3352,6 +3424,8 @@ window.__ModuleLoader__.load({
 			parseTableRow,
 			nodeFullText,
 			renderInline,
+			// 链接点击：供测试验证开窗成功才拦默认行为（宿主拦截时退回原生导航）。
+			openLink,
 			stripInlineForExport,
 			wrapExportText,
 			COLOR_THEMES,
@@ -3368,6 +3442,9 @@ window.__ModuleLoader__.load({
 			isActivatable,
 			TOOL_NAMES,
 			OPENING_OPS,
+			// 023 双代兼容纯函数（供测试）：会话内容节点 / settings 信封。
+			conversationNodesOf,
+			settingsNamespacesOf,
 			// 021 画布组件：仅供测试驱动平移手势（不参与运行时契约）。
 			MindmapCanvas,
 		});

package/index.js

@@ -9,12 +9,12 @@
 // - 四工具都带 path/name 参数（决策 3：多脑图并存，作用于指定那颗）。
 // - 结果 JSON {ok, op, path, rootTitle, content, renamedFrom?}：content 全文
 //   供模型续编辑，client 用同一份重放面板（工具结果即实时通道，002 第二节）。
-// - requireApproval 配置（决策 6）：默认 false 免审批；置 true 时 mindmap_update
-//   走原生 ask（tools/pre-execute，照 dsh-grafana 的钩子模式）。015 起经 settings
-//   namespace 可在设置面板运行时切换（见 SETTINGS_NAMESPACE/Config）。
+// - requireApproval 配置（决策 6）：默认 false 免审批；置 true 时 mindmap_create
+//   与 mindmap_update 走原生 ask（tools/pre-execute，照 dsh-grafana 的钩子模式）。
+//   015 起经 settings namespace 可在设置面板运行时切换（见 SETTINGS_NAMESPACE/Config）。
 // - 依赖：仅 @deepseek-ai/schemastery（settings schema；发布包正常解析，
 //   link 开发需先 npm i）。工具参数 schema 仍手写 JSON Schema（003 偏差 1）。
-import { access, opendir, readFile, rename, stat, writeFile } from 'node:fs/promises'
+import { access, opendir, readFile, realpath, rename, stat, writeFile } from 'node:fs/promises'
 import { dirname, isAbsolute, join, relative, resolve as resolvePath, sep } from 'node:path'
 import Schema from '@deepseek-ai/schemastery'
 
@@ -26,7 +26,7 @@ export const inject = ['tools', 'systemPrompt', 'webServer', 'sessions']
 // defaultPanelWidth 供客户端面板取默认宽度（20-80 钳制由客户端执行）。
 export const SETTINGS_NAMESPACE = 'mindmap'
 export const Config = Schema.object({
-  requireApproval: Schema.boolean().default(false).description('Require native DSH approval for every mindmap_update (including renameRoot). Files are git-managed, so it defaults to off. Hidden from the settings panel; still honored at runtime.'),
+  requireApproval: Schema.boolean().default(false).description('Require native DSH approval for every mindmap_create and mindmap_update (including renameRoot). Files are git-managed, so it defaults to off. Hidden from the settings panel; still honored at runtime.'),
   defaultPanelWidth: Schema.number().default(42).description('Default floating-panel width as a percentage of the viewport (clamped 20-80 on the client).'),
   lineStyle: Schema.union(['curve', 'elbow']).default('elbow').description('Connector line style between nodes: curve (bezier) or elbow (orthogonal).'),
   cardStyle: Schema.union(['rounded', 'square']).default('rounded').description('Node card corner style.'),
@@ -65,9 +65,21 @@ function textOut(value) {
   return [{ type: 'text', text: String(value) }]
 }
 
-/** 会话工作目录：工具执行的 agent → session → header.cwd（dsh-session 契约）。 */
-function sessionCwd(exec) {
-  return exec?.agent?.session?.header?.cwd
+/**
+ * 会话工作目录：工具执行的 agent → session → header.cwd（dsh-session 契约）。
+ * 023 双路径：dsh ≤0.1.1 的 Agent 直挂 live session（agent.session.header.cwd）；
+ * 0.1.2-rc.1 起 Agent 只剩 { id }，改经 sessions 服务按 id 查 header.cwd
+ * （SessionStore.get / SessionHeader.cwd 两代同名）。旧链优先，新链兜底。
+ */
+function sessionCwd(exec, sessions) {
+  const direct = exec?.agent?.session?.header?.cwd
+  if (direct) return direct
+  const id = exec?.agent?.id
+  if (id && sessions?.get) {
+    const cwd = sessions.get(id)?.header?.cwd
+    if (cwd) return cwd
+  }
+  return undefined
 }
 
 //#region 013 目录树 API（host 自建只读 HTTP 路由；dsh-better-sidebar 同款机制）
@@ -113,15 +125,44 @@ function escapesBase(rel) {
   return rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)
 }
 
-/** 请求路径校验：缺省 = 根 cwd；显式路径必须绝对且落在 cwd 内。 */
-function resolveTreePath(cwd, input) {
+/**
+ * realpath 包含性校验（#5）：字符串规范化只挡字面 `..`，cwd 内指向外部
+ * 的符号链接能骗过它。尾部不存在的段（待建文件）向上走最近的存在祖先
+ * 逐个 realpath——符号链接只能藏在已存在的段里。解析后仍在 base 内返回
+ * true；base 自身不存在或越界返回 false。
+ */
+async function resolvesInsideBase(resolved, base) {
+  let realBase
+  try {
+    realBase = await realpath(base)
+  } catch {
+    return false
+  }
+  let probe = resolved
+  for (;;) {
+    try {
+      const real = await realpath(probe)
+      if (real === realBase) return true
+      return !escapesBase(relative(realBase, real))
+    } catch (error) {
+      if (error?.code !== 'ENOENT' && error?.code !== 'ENOTDIR') throw error
+      const parent = dirname(probe)
+      if (parent === probe) return false
+      probe = parent
+    }
+  }
+}
+
+/** 请求路径校验：缺省 = 根 cwd；显式路径必须绝对、落在 cwd 内，
+ *  且解析符号链接后仍在内（#5）。 */
+async function resolveTreePath(cwd, input) {
   if (!cwd) throw httpError(400, 'no-cwd', 'session has no working directory')
   if (input === undefined || input === null || String(input).trim() === '') return cwd
   const p = String(input).trim()
   if (!isAbsolute(p)) throw httpError(400, 'bad-request', `path must be absolute: ${JSON.stringify(p)}`)
   const resolved = resolvePath(p)
   const rel = relative(cwd, resolved)
-  if (escapesBase(rel)) {
+  if (escapesBase(rel) || !(await resolvesInsideBase(resolved, cwd))) {
     throw httpError(400, 'bad-request', `path must stay inside the session working directory (${cwd})`)
   }
   return resolved
@@ -140,8 +181,10 @@ async function listDirectoryLevel(path, maxEntries = MAX_TREE_ENTRIES) {
   try {
     for await (const dirent of dir) {
       if (rows.length >= maxEntries) {
-        overflow += 1
-        continue
+        // 022：到达上限即停（旧实现 continue 会把巨型目录整个遍历一遍）。
+        // truncated 只取布尔语义，无需精确计数剩余条目。
+        overflow = 1
+        break
       }
       rows.push({
         name: dirent.name,
@@ -204,7 +247,7 @@ function sanitizeStem(input) {
  * 且必须以 .md 结尾。cwd 缺失时仅接受绝对路径。
  * @returns 绝对规范化路径。
  */
-function resolveMindmapPath(cwd, input) {
+async function resolveMindmapPath(cwd, input) {
   if (typeof input !== 'string' || !input.trim()) throw new Error('path is required.')
   const p = input.trim()
   if (!/\.md$/i.test(p)) throw new Error(`mindmap path must end with .md: ${JSON.stringify(p)}.`)
@@ -214,7 +257,8 @@ function resolveMindmapPath(cwd, input) {
   }
   const resolved = resolvePath(cwd, p)
   const rel = relative(cwd, resolved)
-  if (rel === '' || escapesBase(rel)) {
+  // realpath 兜底（#5）：写路径经符号链接越狱是安全敏感操作。
+  if (rel === '' || escapesBase(rel) || !(await resolvesInsideBase(resolved, cwd))) {
     throw new Error(`mindmap path must stay inside the session working directory (${cwd}).`)
   }
   return resolved
@@ -288,10 +332,18 @@ export function apply(ctx, config = {}) {
 
   // 后悔药开关（决策 6）：钩子常驻注册，运行时读 activeConfig().requireApproval
   // ——设置面板切换立即生效；关闭时直接放行（默认 false 免审批）。
+  // 022：create 同为写路径，一并纳入审批（CONTRIBUTING：所有写路径安全敏感）。
   ctx.on('tools/pre-execute', async (exec, next) => {
     const decision = await next()
     if (decision.kind !== 'allow') return decision
     if (!activeConfig().requireApproval) return decision
+    if (exec.name === 'mindmap_create') {
+      const args = exec.arguments ?? {}
+      return {
+        kind: 'ask',
+        reason: `Create mindmap ${JSON.stringify(String(args.name ?? '?'))}. dsh-mindmap is configured with requireApproval.`,
+      }
+    }
     if (exec.name !== 'mindmap_update') return decision
     const args = exec.arguments ?? {}
     const renameNote = typeof args.renameRoot === 'string' && args.renameRoot ? `, rename root to "${args.renameRoot}"` : ''
@@ -315,10 +367,10 @@ export function apply(ctx, config = {}) {
     output: { schema: { type: 'string' }, render: (_args, value) => textOut(value) },
     timeoutMs: TOOL_TIMEOUT_MS,
     async execute(args, exec) {
-      const cwd = sessionCwd(exec)
+      const cwd = sessionCwd(exec, ctx.sessions)
       if (!cwd) throw new Error('The session has no working directory; cannot create a mindmap.')
       const stem = sanitizeStem(args?.name)
-      const path = resolveMindmapPath(cwd, `${stem}.md`)
+      const path = await resolveMindmapPath(cwd, `${stem}.md`)
       // wx = 不存在才创建：原子拒绝已存在（含并发竞态）与同名目录，无 TOCTOU 窗口。
       try {
         await writeFile(path, '', { encoding: 'utf8', flag: 'wx' })
@@ -345,7 +397,7 @@ export function apply(ctx, config = {}) {
     output: { schema: { type: 'string' }, render: (_args, value) => textOut(value) },
     timeoutMs: TOOL_TIMEOUT_MS,
     async execute(args, exec) {
-      const path = resolveMindmapPath(sessionCwd(exec), args?.path)
+      const path = await resolveMindmapPath(sessionCwd(exec, ctx.sessions), args?.path)
       const content = await readFile(path, 'utf8')
       return buildResult('open', path, { content })
     },
@@ -364,7 +416,7 @@ export function apply(ctx, config = {}) {
     output: { schema: { type: 'string' }, render: (_args, value) => textOut(value) },
     timeoutMs: TOOL_TIMEOUT_MS,
     async execute(args, exec) {
-      const path = resolveMindmapPath(sessionCwd(exec), args?.path)
+      const path = await resolveMindmapPath(sessionCwd(exec, ctx.sessions), args?.path)
       const content = await readFile(path, 'utf8')
       return buildResult('get', path, { content })
     },
@@ -385,8 +437,8 @@ export function apply(ctx, config = {}) {
     output: { schema: { type: 'string' }, render: (_args, value) => textOut(value) },
     timeoutMs: TOOL_TIMEOUT_MS,
     async execute(args, exec) {
-      const cwd = sessionCwd(exec)
-      const path = resolveMindmapPath(cwd, args?.path)
+      const cwd = sessionCwd(exec, ctx.sessions)
+      const path = await resolveMindmapPath(cwd, args?.path)
       const hasContent = typeof args?.content === 'string'
       if (!hasContent && typeof args?.renameRoot !== 'string') {
         throw new Error('mindmap_update requires content (or renameRoot alone for a pure rename).')
@@ -453,7 +505,7 @@ export function apply(ctx, config = {}) {
           sendJson(res, 400, { ok: false, error: { code: 'no-cwd', message: 'session has no working directory' } })
           return
         }
-        const dir = resolveTreePath(cwd, payload.path)
+        const dir = await resolveTreePath(cwd, payload.path)
         const listing = await listDirectoryLevel(dir)
         sendJson(res, 200, { ok: true, value: { ...listing, cwd } })
       } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mindmap",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Mindmap plugin for DeepSeek Harness: a plain markdown file in the working directory IS the mindmap; the chat edits it step by step and the right-side panel follows live.",
   "repository": {
     "type": "git",
@@ -42,6 +42,7 @@
     "client": {
       "inject": [
         "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-cordis-client-runner",
         "@deepseek-ai/dsh-client-ui-layout"
       ],
       "platform": "web",