dsh-tiddlywiki 0.26.6 → 0.26.7

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-tiddlywiki",
   "description": "TiddlyWiki 5 as the DSH persistent knowledge base: fifteen tiddlywiki_* agent tools (filtered search/recent/tags/batch/rewrite/trash/lint + git sync & conflict resolve), a full TiddlyWiki editor embedded in the GUI center column (same-origin proxy, works over Tailscale/LAN/domain), a right-side wiki tab, a per-session summary tab, a quick-note card with draft auto-save behind a single knowledge FAB, an optional clip bookmarklet that also saves selected images as attachments, and git-based sync with auto-commit. Mounts via the official dsh plugin system — no DSH source changes.",
-  "version": "0.26.6",
+  "version": "0.26.7",
   "type": "module",
   "keywords": [
     "dsh",
@@ -86,7 +86,7 @@
     "smoke:client": "node scripts/smoke-client.mjs",
     "selftest": "node scripts/selftest.mjs",
     "verify:static": "node scripts/verify-send-to-agent-bundle.mjs && node scripts/verify-render-bundle.mjs && node scripts/verify-wechat-publish-bundle.mjs && node scripts/verify-package-contents.mjs && node scripts/verify-version-consistency.mjs && node scripts/verify-constants.mjs",
-    "verify:unit": "node scripts/verify-clip-bridge.mjs && node scripts/verify-seed-error-policy.mjs && node scripts/verify-render-sanitizer.mjs && node scripts/verify-secret-masking.mjs && node scripts/verify-write-policy.mjs && node scripts/verify-workspace.mjs && node scripts/verify-restart-drain.mjs && node scripts/verify-language-pin.mjs && node scripts/verify-prompt.mjs && node scripts/verify-conflict-config-guards.mjs && node scripts/verify-config-patch.mjs && node scripts/verify-tool-views.mjs && npx tsx scripts/verify-plugin-runtime.mjs && node scripts/verify-wechat-adapters.mjs && node scripts/verify-wechat-docs-seed.mjs && node scripts/verify-wechat-publish.mjs && node scripts/verify-frame-guards.mjs && npx tsx scripts/verify-ready-policy.mjs && npx tsx scripts/verify-frame-surface.mjs && npx tsx scripts/verify-editor-popup.mjs && npx tsx scripts/verify-status-cache.mjs",
+    "verify:unit": "node scripts/verify-clip-bridge.mjs && node scripts/verify-seed-error-policy.mjs && node scripts/verify-render-sanitizer.mjs && node scripts/verify-secret-masking.mjs && node scripts/verify-write-policy.mjs && node scripts/verify-workspace.mjs && node scripts/verify-restart-drain.mjs && node scripts/verify-language-pin.mjs && node scripts/verify-prompt.mjs && node scripts/verify-conflict-config-guards.mjs && node scripts/verify-config-patch.mjs && node scripts/verify-tool-views.mjs && npx tsx scripts/verify-plugin-runtime.mjs && node scripts/verify-wechat-adapters.mjs && node scripts/verify-wechat-docs-seed.mjs && node scripts/verify-wechat-publish.mjs && npx tsx scripts/verify-tw-origin.mjs && node scripts/verify-frame-guards.mjs && npx tsx scripts/verify-ready-policy.mjs && npx tsx scripts/verify-frame-surface.mjs && npx tsx scripts/verify-editor-popup.mjs && npx tsx scripts/verify-status-cache.mjs",
     "verify:e2e": "node scripts/verify-auth.mjs && node scripts/verify-anon-username.mjs && node scripts/verify-tools.mjs && node scripts/verify-audit-fixes.mjs && node scripts/verify-git-resolve.mjs && node scripts/verify-resilience.mjs && node scripts/verify-seed-send-to-agent.mjs && node scripts/verify-seeds-admin.mjs && node scripts/verify-wiki-switch.mjs",
     "verify:large": "node scripts/verify-large-wiki.mjs",
     "verify": "npm run verify:static && npm run verify:unit && npm run verify:e2e && npm run verify:large",

package/src/client/endpoints.ts

@@ -48,6 +48,33 @@ export const ADMIN_WIKI_LOCATION_ENDPOINT = `${ROUTE_PREFIX}/admin/wiki/location
 export const ADMIN_WIKI_SWITCH_ENDPOINT = `${ROUTE_PREFIX}/admin/wiki/switch`
 export const ADMIN_WIKI_RESET_ENDPOINT = `${ROUTE_PREFIX}/admin/wiki/reset`
 
+/**
+ * Resolve a TW proxy URL for THIS document (v0.26.7).
+ *
+ * On an http(s) page the relative proxy path is right — it keeps working behind
+ * whatever host/domain/HTTPS the user reached DSH on. But TiddlyWiki's own
+ * TiddlyWeb sync adaptor only loads when the DOCUMENT's protocol starts with
+ * `http` (`plugins/tiddlywiki/tiddlyweb/tiddlywebadaptor.js`:
+ * `if($tw.browser && document.location.protocol.substr(0,4) === "http")`), and
+ * the DSH **desktop** app serves its renderer from the custom `dsh-app:`
+ * scheme: framed from there the wiki had no sync adaptor at all, so
+ * `$:/status/IsReadOnly` was never written, TW's read-only stylesheet (which
+ * treats a missing status as read-only) hid 添加条目 / 编辑 / 导入 … and no edit
+ * could be saved.
+ *
+ * `absolute` is the host's own loopback HTTP base (`twProxyAbsolute` /
+ * `twUrlAbsolute`, built from the port it actually listens on); it is used only
+ * when this page is NOT on http(s), i.e. exactly the desktop case, so an
+ * http(s) embedder is never sent to a different origin than its own.
+ */
+export function resolveTwUrl(relative: string, absolute?: string): string {
+  const protocol = typeof location === 'undefined' ? '' : location.protocol
+  const origin = typeof location === 'undefined' ? undefined : location.origin
+  const notHttp = protocol !== 'http:' && protocol !== 'https:'
+  if (notHttp && typeof absolute === 'string' && absolute.length > 0) return absolute
+  return new URL(relative, origin).href
+}
+
 /** The subset of the `/sync` JSON body both client callers report on. */
 export interface SyncResultPayload {
   ok?: boolean

package/src/client/note-widget.ts

@@ -30,7 +30,7 @@ import { toast } from './toast.ts'
 import { openEditorPopup, isEditorPopupOpen, isEditorPopupBlank } from './editor-popup.ts'
 import { buildMarkdownEditor, type MarkdownEditor } from './markdown-editor.ts'
 import { fetchStatus } from './status-cache.ts'
-import { EDIT_ENDPOINT, GET_ENDPOINT, NOTE_ENDPOINT, RECENT_ENDPOINT, TAGS_ENDPOINT, UPLOAD_ENDPOINT } from './endpoints.ts'
+import { EDIT_ENDPOINT, GET_ENDPOINT, NOTE_ENDPOINT, RECENT_ENDPOINT, TAGS_ENDPOINT, UPLOAD_ENDPOINT, resolveTwUrl } from './endpoints.ts'
 
 const MAX_UPLOAD_BYTES = 64 * 1024 * 1024
 
@@ -557,7 +557,7 @@ export function createNoteWidget(): NoteWidgetHandle {
         signal: AbortSignal.timeout(10_000),
       })
       const payload = (await res.json().catch(() => null)) as
-        | { ok?: boolean; title?: string; draftTitle?: string; twUrl?: string; error?: string }
+        | { ok?: boolean; title?: string; draftTitle?: string; twUrl?: string; twUrlAbsolute?: string; error?: string }
         | null
       if (!res.ok || payload?.ok !== true) {
         toast(`打开失败：${payload?.error ?? `HTTP ${res.status}`}`)
@@ -575,9 +575,12 @@ export function createNoteWidget(): NoteWidgetHandle {
       persistedSignature = draftSignature(title, text, tags)
       loadedToken = null
       // twUrl is the same-origin proxy path (e.g. /dsh-tiddlywiki/tw/);
-      // resolve it against this page's origin so the popup works from any
-      // host/domain DSH is reached on (loopback, LAN, Tailscale, HTTPS).
-      const popupUrl = `${new URL(payload.twUrl, location.origin).href}#${encodeURIComponent(payload.draftTitle)}`
+      // resolveTwUrl turns it into an absolute URL against this page's origin
+      // so the popup works from any host/domain DSH is reached on (loopback,
+      // LAN, Tailscale, HTTPS) — and, on the DSH desktop app (`dsh-app:`), to
+      // the host's loopback HTTP base, without which TW's sync adaptor refuses
+      // to load and the native editor would come up read-only.
+      const popupUrl = `${resolveTwUrl(payload.twUrl, payload.twUrlAbsolute)}#${encodeURIComponent(payload.draftTitle)}`
       openEditorPopup(popupUrl, payload.title ?? title)
       toast(`已在弹出窗口打开「${payload.title ?? title}」编辑器`)
       return true

package/src/client/status-cache.ts

@@ -23,6 +23,13 @@ export interface StatusPayload {
   url?: string
   /** Same-origin TW proxy path (e.g. /dsh-tiddlywiki/tw/); the iframe base. */
   twProxy?: string
+  /**
+   * Absolute twin of `twProxy` (host loopback HTTP base, v0.26.7). Used only
+   * when this document is not on http(s) — the DSH desktop app's `dsh-app:`
+   * renderer, where a relative path would leave TW without a sync adaptor.
+   * See `resolveTwUrl`.
+   */
+  twProxyAbsolute?: string
   wikiPath?: string
   error?: string
   git?: {

package/src/client/tw-frame.ts

@@ -27,7 +27,7 @@
  * @module dsh-tiddlywiki/client/tw-frame
  */
 import * as React from 'react'
-import { RESTART_ENDPOINT } from './endpoints.ts'
+import { RESTART_ENDPOINT, resolveTwUrl } from './endpoints.ts'
 import { fetchStatus } from './status-cache.ts'
 import { attachThemeSync, setThemeSyncConfig } from './theme-sync.ts'
 
@@ -234,8 +234,21 @@ export function createTwFrameSurface(skin: TwFrameSkin): TwFrameSurface {
     const tryOnce = (attempt: number): void => {
       if (disposed) return // unmounted: do not keep waiting or touch the frame
       if (pendingHash !== hash) return // superseded by a newer request
-      const frameTw = win as { $tw?: unknown }
-      if (typeof frameTw.$tw !== 'object' || frameTw.$tw === null) {
+      // Cross-origin frame (v0.26.7): on the DSH desktop app the TW frame is
+      // loaded from the host's loopback HTTP origin — the only way TW's
+      // TiddlyWeb sync adaptor will load there — which makes it a different
+      // origin than the DSH page. Reading `$tw` inside it raises SecurityError,
+      // so we cannot watch for TW's boot: go straight to the full
+      // reload-with-hash fallback (TW honours the hash at startup).
+      let frameIsTw = false
+      try {
+        const frameTw = win as { $tw?: unknown }
+        frameIsTw = typeof frameTw.$tw === 'object' && frameTw.$tw !== null
+      } catch {
+        fallbackLoad(hash)
+        return
+      }
+      if (!frameIsTw) {
         if (attempt < 40) {
           // Tracked so dispose() cancels the chain (v0.19.1 — the untracked
           // 40×150ms retry kept the iframe/closure alive after unmount).
@@ -302,7 +315,10 @@ export function createTwFrameSurface(skin: TwFrameSkin): TwFrameSurface {
       // matter which host/domain the user reached DSH on. Fall back to the
       // legacy loopback `url` for older servers that do not send twProxy.
       if (typeof payload.twProxy === 'string') {
-        showFrame(new URL(payload.twProxy, window.location.origin).href)
+        // resolveTwUrl prefers the host's ABSOLUTE loopback base when THIS page
+        // is not on http(s) (the DSH desktop app's `dsh-app:` renderer), because
+        // TW refuses to load its sync adaptor anywhere else — see resolveTwUrl.
+        showFrame(resolveTwUrl(payload.twProxy, payload.twProxyAbsolute))
       } else if (typeof payload.url === 'string') {
         showFrame(payload.url)
       } else {

package/src/host/http.ts

@@ -198,7 +198,40 @@ export function rejectCrossSiteWrite(
   return true
 }
 
-/** Read-only route guard: GET/HEAD only, no side effects on any other method. */
+/**
+ * Read-only route guard: GET/HEAD only, no side effects on any other method. */
 export function rejectNonRead(req: IncomingMessage, res: ServerResponse): boolean {
   return rejectCrossSiteWrite(req, res, ['GET', 'HEAD'])
 }
+
+/**
+ * Absolute loopback base for a same-origin proxy path, from a request's `Host`
+ * header (v0.26.7). Returns undefined when the header is unusable, in which
+ * case the caller simply omits the absolute twin and clients keep using the
+ * relative path.
+ *
+ * WHY THIS EXISTS: the DSH **desktop** app serves its renderer from the custom
+ * `dsh-app:` scheme, and TiddlyWiki's own TiddlyWeb sync adaptor refuses to load
+ * on a document whose protocol does not start with `http`
+ * (`plugins/tiddlywiki/tiddlyweb/tiddlywebadaptor.js`:
+ * `if($tw.browser && document.location.protocol.substr(0,4) === "http")`).
+ * Embedded from `dsh-app://app/…` the wiki therefore had NO sync adaptor:
+ * `$:/status/IsReadOnly` was never written, TW's read-only stylesheet (which
+ * treats a MISSING status as read-only) hid 添加条目 / 日志 / 导入 / 管理器 /
+ * 编辑 …, and the saver fell back to local-only dirty tracking — an edit made
+ * there could not be saved either. The client falls back to this absolute URL
+ * only while its own document is not on http(s) (see `resolveTwUrl` in
+ * `src/client/endpoints.ts`), so http(s) embedders — loopback, LAN, Tailscale,
+ * domain, HTTPS — are never moved off their own origin.
+ *
+ * `http` is deliberate rather than `x-forwarded-proto`: the desktop app's host
+ * always listens on plain HTTP loopback, and only a renderer able to reach it
+ * ever reads this value.
+ */
+export function absoluteHostBase(hostHeader: string | string[] | undefined, proxyPath: string): string | undefined {
+  const host = typeof hostHeader === 'string' ? hostHeader.trim() : Array.isArray(hostHeader) ? String(hostHeader[0] ?? '').trim() : ''
+  // `host[:port]` only — a smuggled path or credentials must never reach the
+  // URL handed back to the browser.
+  if (!/^[A-Za-z0-9.\-[\]:]+$/.test(host)) return undefined
+  return `http://${host}${proxyPath}`
+}

package/src/host/routes.ts

@@ -60,7 +60,7 @@ import { GitConflictStateError, type GitFace, type GitStatusView } from './git.t
 import { PATH_PREFIX, TW_PROXY_PREFIX, TW_PROXY_PATH } from './wiki.ts'
 import { writeSessionSummary, type SessionQueryFace, type SessionSummaryResult } from './session-summary.ts'
 import { WORKSPACE_TAG_PREFIX } from './workspace.ts'
-import { readBody, readBodyBuffer, json, guardHandler, errorStatus, rejectCrossSiteWrite, rejectNonRead, safeTokenEqual, MAX_PROXY_BODY_BYTES, MAX_UPLOAD_BYTES } from './http.ts'
+import { readBody, readBodyBuffer, json, guardHandler, errorStatus, rejectCrossSiteWrite, rejectNonRead, safeTokenEqual, absoluteHostBase, MAX_PROXY_BODY_BYTES, MAX_UPLOAD_BYTES } from './http.ts'
 import { sanitizeTwFragment } from './sanitize.ts'
 import { drainThenStop } from './seeds.ts'
 import { snippetOf, formatLocalMinute } from './text-util.ts'
@@ -628,6 +628,15 @@ export function registerRoutes(ctx: { webServer: WebServerFace }, deps: RouteDep
   const referencesBlockedTitle = (value: string | undefined): boolean =>
     value !== undefined && BLOCKED_PROXY_TITLE_PREFIXES.some((prefix) => value.includes(prefix))
 
+  /**
+   * Absolute twin of `twProxy` for embedders whose own document is not on
+   * http(s) — the DSH desktop app's `dsh-app:` renderer (v0.26.7). See
+   * `absoluteHostBase()` in http.ts for the full why; clients only consult it
+   * while their own page is not http(s), so nothing changes for http(s)
+   * deployments.
+   */
+  const twProxyAbsoluteBase = (req: IncomingMessage): string | undefined => absoluteHostBase(req.headers.host, TW_PROXY_PATH)
+
   const handleStatus = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
     if (rejectNonRead(req, res)) return
     const view = deps.server.status()
@@ -639,6 +648,10 @@ export function registerRoutes(ctx: { webServer: WebServerFace }, deps: RouteDep
       // the spawn line's `password=…` (or a forwarded Authorization header).
       logs: redactLogLines(view.logs),
       twProxy: TW_PROXY_PATH,
+      // Absolute twin of `twProxy` for embedders whose own document is not on
+      // http(s) — the DSH desktop app (`dsh-app://app`); see
+      // twProxyAbsoluteBase(). Absent when the Host header is unusable.
+      twProxyAbsolute: twProxyAbsoluteBase(req),
       git: gitSummary,
       note: { tag: deps.noteDefaults().tag },
       ui: deps.uiDefaults(),
@@ -707,7 +720,7 @@ export function registerRoutes(ctx: { webServer: WebServerFace }, deps: RouteDep
         })
       }
       const result = await pendingSummary
-      json(res, { ok: true, ...result, twUrl: TW_PROXY_PATH })
+      json(res, { ok: true, ...result, twUrl: TW_PROXY_PATH, twUrlAbsolute: twProxyAbsoluteBase(req) })
     } catch (err) {
       json(res, { ok: false, error: err instanceof Error ? err.message : String(err) }, errorStatus(err))
     }
@@ -1071,7 +1084,7 @@ export function registerRoutes(ctx: { webServer: WebServerFace }, deps: RouteDep
       })
       deps.autoCommit()
       invalidateGitStatus()
-      json(res, { ok: true, ...result, twUrl: TW_PROXY_PATH })
+      json(res, { ok: true, ...result, twUrl: TW_PROXY_PATH, twUrlAbsolute: twProxyAbsoluteBase(req) })
     } catch (err) {
       if (err instanceof WriteConflictError) {
         json(res, { ok: false, error: err.message, conflict: true }, 409)