dsh-pet 0.1.4 → 0.1.6

package/lib/index.js

@@ -1,135 +1,182 @@
-/**
- * ============================================================================
- * dsh-pet 宿主半侧（host half）—— 宠物插件的"后端"部分
- * ============================================================================
- *
- * 【这个文件是什么】
- *   本文件运行在 DSH 的 Node 服务端（不是浏览器）。它的唯一职责是：
- *   在 DSH 的 Web 服务器上注册一个 `/pet/` 前缀的 HTTP 路由，
- *   把插件包里的动画 WebM 文件流式返回给浏览器。
- *
- * 【为什么需要它】
- *   DSH 的 `/plugins/` 路由只服务"客户端 JS bundle"，不服务视频等静态资源。
- *   所以浏览器半侧（lib/client.js）要播放动画，必须有一个专门的路由来取文件。
- *   这正是 DSH 官方提供的扩展点：`ctx.webServer.register()`。
- *
- * 【路由结构】
- *   /pet/thumb/<动画名>.webm   → 读插件包内 assets/thumb/（360×360 播放变体）
- *   /pet/full/<动画名>.webm    → 读 $DSH_HOME/pet-assets/（原始 1200×1200，需先下载）
- *
- * 【安全性】
- *   路径做了"防穿越"校验（resolveAsset）：请求里的路径规范化后必须仍在
- *   assets 根目录内，否则返回 400。防止 /pet/../../etc/passwd 这类攻击。
- *
- * ============================================================================
- */
-import { createReadStream, existsSync } from 'node:fs';
-import { stat } from 'node:fs/promises';
-import { join, normalize, resolve, sep } from 'node:path';
-import { fileURLToPath } from 'node:url';
-// 官方 API：解析 DSH 主目录（$DSH_HOME，默认 ~/.dsh）——full 资源存放位置
-import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
-
-// 插件行 id（与 cordis.patch.yml 一致）
-const name = 'pet';
-/** 需要注入的服务：webServer（Web 服务器路由注册表） */
-const inject = ['webServer'];
-
-/** 本包目录（src 和安装后都适用——import.meta.url 指向 lib/，上一级即包根） */
-const PACKAGE_ROOT = resolve(fileURLToPath(new URL('..', import.meta.url)));
-
-/** 路由前缀：/pet/thumb/<name>.webm、/pet/full/<name>.webm */
-const ROUTE_PREFIX = '/pet';
+import { createReadStream, existsSync } from "node:fs";
+import { readFile, rm, stat, writeFile } from "node:fs/promises";
+import { join, normalize, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 
+//#region src/host/index.ts
+const name = "pet";
+const inject = ["webServer"];
+/** 本包目录：宿主构建产物位于 lib/，其上一级即包根。 */
+const PACKAGE_ROOT = resolve(fileURLToPath(new URL("..", import.meta.url)));
+/** 路由前缀 */
+const ROUTE_PREFIX = "/pet";
 /** 不同扩展名对应的 Content-Type 映射 */
 const MIME = {
-  '.webm': 'video/webm',
-  '.mp4': 'video/mp4',
-  '.png': 'image/png',
-  '.json': 'application/json; charset=utf-8',
+	".webm": "video/webm",
+	".mp4": "video/mp4",
+	".png": "image/png",
+	".json": "application/json; charset=utf-8",
+	".jsonc": "application/json; charset=utf-8"
 };
-
 /**
- * 规范化并校验请求路径，确保它在 assets 根目录内（防路径穿越）。
- * @param root - assets 根目录（绝对路径）
- * @param rel  - 解码后的、路由前缀之后的路径片段
- * @returns 规范化后的绝对文件路径；非法（穿越）时返回 undefined
- */
+* 规范化并校验请求路径，确保它在 assets 根目录内（防路径穿越）。
+* @returns 规范化后的绝对文件路径；非法（穿越）时返回 undefined
+*/
 function resolveAsset(root, rel) {
-  if (rel.length === 0) return undefined;
-  // join + normalize 得到规范化路径（处理 ..、./、多余分隔符）
-  const candidate = normalize(join(root, rel));
-  // 根目录带分隔符的前缀，用于判断候选路径是否真的在根目录内
-  const rootWithSep = root.endsWith(sep) ? root : root + sep;
-  // 候选路径必须等于根目录或以"根目录/"开头，否则是穿越（如 ../lib/index.js）
-  if (candidate !== root && !candidate.startsWith(rootWithSep)) return undefined;
-  return candidate;
+	if (rel.length === 0) return void 0;
+	const candidate = normalize(join(root, rel));
+	const rootWithSep = root.endsWith(sep) ? root : root + sep;
+	if (candidate !== root && !candidate.startsWith(rootWithSep)) return void 0;
+	return candidate;
+}
+/** 流式返回一个文件（带 Content-Type / 长度 / 缓存头）。 */
+async function sendFile(res, file, contentType) {
+	const { size } = await stat(file);
+	res.writeHead(200, {
+		"content-type": contentType,
+		"content-length": size,
+		"cache-control": "public, max-age=3600"
+	});
+	const stream = createReadStream(file);
+	stream.on("error", () => res.destroy());
+	stream.pipe(res);
+}
+/** 支持的角落白名单（与 client 端一致） */
+const CORNERS = [
+	"top-left",
+	"top-right",
+	"bottom-left",
+	"bottom-right"
+];
+/** 发送 JSON 响应 */
+function sendJson(res, status, obj) {
+	const body = JSON.stringify(obj);
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"content-length": Buffer.byteLength(body)
+	});
+	res.end(body);
+}
+/** 收集请求体（文本） */
+function readBody(req) {
+	return new Promise((resolve2, reject) => {
+		const chunks = [];
+		req.on("data", (c) => chunks.push(c));
+		req.on("end", () => resolve2(Buffer.concat(chunks).toString("utf8")));
+		req.on("error", reject);
+	});
+}
+/** 校验并归一化用户配置：只接受 { pets: [{ id, size, position }] } */
+function sanitizeUserConfig(raw) {
+	const o = raw && typeof raw === "object" ? raw : {};
+	const arr = Array.isArray(o.pets) ? o.pets : null;
+	if (!arr || !arr.length) return null;
+	const out = [];
+	for (const p of arr) {
+		if (!p || typeof p !== "object") return null;
+		const id = String(p.id ?? "");
+		if (!id || id.length > 64 || /[\\/:\x00-\x1f]/.test(id)) return null;
+		const size = Number(p.size);
+		if (!Number.isFinite(size) || size <= 0) return null;
+		const pos = p.position && typeof p.position === "object" ? p.position : {};
+		const corner = String(pos.corner ?? "");
+		if (!CORNERS.includes(corner)) return null;
+		const marginX = Number(pos.marginX);
+		const marginY = Number(pos.marginY);
+		if (!Number.isFinite(marginX) || !Number.isFinite(marginY)) return null;
+		out.push({
+			id,
+			size,
+			position: {
+				corner,
+				marginX,
+				marginY
+			}
+		});
+	}
+	return { pets: out };
 }
-
-/**
- * 宿主插件主体：注册 `/pet` 前缀路由。
- * @param ctx    - 插件上下文；ctx.webServer 是 Web 服务器服务
- * @param config - 本行的配置（来自 patch 树）
- */
 function apply(ctx, config) {
-  // 两个资源根：
-  // - thumbRoot：插件包内 assets/thumb/（360×360 播放变体，随包发布，一定存在）
-  // - fullRoot ：$DSH_HOME/pet-assets/（原始母版，需手动下载，可能不存在）
-  const thumbRoot = join(PACKAGE_ROOT, 'assets', 'thumb');
-  const fullRoot = config.fullRoot ?? join(resolveDshHome(), 'pet-assets');
-
-  // ctx.effect 包裹：插件卸载时自动注销路由（官方生命周期管理）
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'prefix',     // 前缀路由：匹配 /pet 以及 /pet/xxx
-    path: ROUTE_PREFIX,
-    handler: async (req, res) => {
-      const url = new URL(req.url ?? '/', 'http://localhost');
-      // 去掉 /pet/ 前缀并 URL 解码（中文文件名是编码后的）
-      const rest = decodeURIComponent(url.pathname.slice(ROUTE_PREFIX.length + 1));
-      // 第一段是 scope：thumb 或 full
-      const [scope, ...nameParts] = rest.split('/');
-      if (scope !== 'thumb' && scope !== 'full') {
-        res.writeHead(400, { 'content-type': 'text/plain; charset=utf-8' });
-        res.end('dsh-pet: expected /pet/{thumb|full}/<file>');
-        return;
-      }
-      // 剩余部分是文件名（可能含空格/中文，原样保留）
-      const fileName = nameParts.join('/');
-      const root = scope === 'thumb' ? thumbRoot : fullRoot;
-      // 防穿越校验
-      const file = resolveAsset(root, fileName);
-      if (file === undefined) {
-        res.writeHead(400, { 'content-type': 'text/plain; charset=utf-8' });
-        res.end('dsh-pet: invalid path');
-        return;
-      }
-      // 文件不存在：full 未下载 vs thumb 缺失给不同提示
-      if (!existsSync(file)) {
-        res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
-        res.end(scope === 'full'
-          ? `dsh-pet: original asset not downloaded yet — run the fetch-assets script to populate ${fullRoot}`
-          : 'dsh-pet: asset not found');
-        return;
-      }
-      // 按扩展名定 Content-Type，附 Content-Length（浏览器可显示进度）
-      const ext = file.slice(file.lastIndexOf('.')).toLowerCase();
-      const contentType = MIME[ext] ?? 'application/octet-stream';
-      const { size } = await stat(file);
-      res.writeHead(200, {
-        'content-type': contentType,
-        'content-length': size,
-        // 缓存 1 小时：动画是静态文件，重复播放直接命中缓存
-        'cache-control': 'public, max-age=3600',
-      });
-      // 流式返回（大文件不占内存）
-      const stream = createReadStream(file);
-      stream.on('error', () => {
-        res.destroy();
-      });
-      stream.pipe(res);
-    },
-  }), 'dsh-pet: /pet asset route');
+	const thumbRoot = join(PACKAGE_ROOT, "assets", "thumb");
+	const fullRoot = config.fullRoot ?? join(resolveDshHome(), "pet-assets");
+	const userConfigPath = join(resolveDshHome(), "pet-config.json");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "prefix",
+		path: ROUTE_PREFIX,
+		handler: async (req, res) => {
+			const url = new URL(req.url ?? "/", "http://localhost");
+			const rest = decodeURIComponent(url.pathname.slice(ROUTE_PREFIX.length + 1));
+			if (rest === "config") {
+				if (req.method === "GET") {
+					try {
+						const raw = await readFile(userConfigPath, "utf8");
+						sendJson(res, 200, JSON.parse(raw));
+					} catch {
+						sendJson(res, 200, {});
+					}
+					return;
+				}
+				if (req.method === "PUT") {
+					try {
+						const body = await readBody(req);
+						const parsed = JSON.parse(body);
+						const clean = sanitizeUserConfig(parsed);
+						if (!clean) {
+							sendJson(res, 400, { error: "invalid pet config: expected { pets:[{id,size,position:{corner,marginX,marginY}}] }" });
+							return;
+						}
+						await writeFile(userConfigPath, JSON.stringify(clean, null, 2), "utf8");
+						sendJson(res, 200, { ok: true });
+					} catch {
+						sendJson(res, 400, { error: "invalid JSON body" });
+					}
+					return;
+				}
+				if (req.method === "DELETE") {
+					try {
+						await rm(userConfigPath, { force: true });
+					} catch {}
+					sendJson(res, 200, { ok: true });
+					return;
+				}
+				sendJson(res, 405, { error: "method not allowed" });
+				return;
+			}
+			if (rest === "config.jsonc") {
+				const cfgFile = join(PACKAGE_ROOT, "assets", "config.jsonc");
+				if (!existsSync(cfgFile)) {
+					res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+					res.end("dsh-pet: config.jsonc not found");
+					return;
+				}
+				await sendFile(res, cfgFile, MIME[".jsonc"] ?? "application/octet-stream");
+				return;
+			}
+			const [scope, ...nameParts] = rest.split("/");
+			if (scope !== "thumb" && scope !== "full") {
+				res.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+				res.end("dsh-pet: expected /pet/{thumb|full}/<file>");
+				return;
+			}
+			const fileName = nameParts.join("/");
+			const root = scope === "thumb" ? thumbRoot : fullRoot;
+			const file = resolveAsset(root, fileName);
+			if (file === void 0) {
+				res.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+				res.end("dsh-pet: invalid path");
+				return;
+			}
+			if (!existsSync(file)) {
+				res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+				res.end(scope === "full" ? `dsh-pet: original asset not downloaded yet — run the fetch-assets script to populate ${fullRoot}` : "dsh-pet: asset not found");
+				return;
+			}
+			const ext = file.slice(file.lastIndexOf(".")).toLowerCase();
+			await sendFile(res, file, MIME[ext] ?? "application/octet-stream");
+		}
+	}), "dsh-pet: /pet asset route");
 }
 
-// 导出插件三件套（Cordis Loader 需要）
-export { apply, inject, name };
+//#endregion
+export { apply, inject, name };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-pet",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "A floating desktop pet for the DeepSeek Harness Web UI: idle breathing, occasional direction turns, random actions, and screen wandering.",
   "keywords": [
     "dsh",
@@ -45,16 +45,22 @@
       "types": "./lib/types/client/index.d.ts",
       "default": "./lib/client.js"
     },
+    "./src/*": "./src/*",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
   "files": [
     "lib",
+    "src",
     "assets/thumb",
+    "assets/config.jsonc",
     "cordis.patch.yml"
   ],
   "scripts": {
-    "prepack": "node scripts/prepack-check.js"
+    "bundle": "tsdown",
+    "watch": "tsdown --watch",
+    "prepare": "npm run bundle",
+    "prepack": "npm run bundle && node scripts/prepack-check.js"
   },
   "license": "MIT",
   "dsh": {
@@ -70,10 +76,18 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-home-paths": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-home-paths": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.1",
     "react": "^18.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "@types/react": "^18.2.0",
+    "@types/react-dom": "^18.2.0",
+    "rolldown": "^1.0.0-beta.7",
+    "tsdown": "^0.8.0",
+    "typescript": "^5.5.0"
   }
 }