dsh-zen-remote 1.0.0

package/src/client/styles/turn-fold.css.ts

@@ -0,0 +1,106 @@
+// turn-fold — the folded turn process and its summary row (S8, 2026-08-17).
+// Everything that can hide content lives inside (max-width: 767px); the two
+// markers this file reads (data-mnav-fold on a process element,
+// data-mobile-nav="turn-fold" on the injected summary row) are only ever
+// written by effects/turn-fold.ts, which detaches and wipes them at >= 768px
+// — so tablet and desktop are a no-op twice over, by attribute and by media
+// query. Appended last in styles/index.ts; it shares no selector with any
+// other file, the position just keeps the "phone files come after the shared
+// <=1023px block" ordering intact.
+
+export const TURN_FOLD_CSS = `/* ---------- turn process fold (< 768px) ---------- */
+
+/* The summary row never paints outside the phone breakpoint, even if a
+   media-query change raced the effect's own cleanup. */
+[data-mobile-nav="turn-fold"] {
+  display: none;
+}
+
+@media (max-width: 767px) {
+  /* Folded process: tool-call / context / command rows and the Think
+     disclosures inside an assistant step. !important because the official
+     flow item and ReasoningRow both set their own display. */
+  [data-mnav-fold]:not([data-mnav-fold-open]) {
+    display: none !important;
+  }
+
+  /* Compact chip, sized like the composer's own pills rather than a button:
+     it is a reading affordance in the middle of the message flow, so it has
+     to stay quieter than the content around it. The flow column is a flex
+     column with gap: 16px (ChatView.module.css) — align-self keeps the chip
+     from stretching, and the negative block margin trims that generous gap
+     back to something a 26px row can live in. */
+  [data-chat-flow] > [data-mobile-nav="turn-fold"] {
+    display: inline-flex;
+    align-self: flex-start;
+    align-items: center;
+    gap: 6px;
+    margin: -4px 0;
+    padding: 0 10px;
+    height: 26px;
+    border: none;
+    border-radius: 13px;
+    background: var(--dsw-alias-interactive-bg-hover, rgba(0, 0, 0, .06));
+    color: var(--dsw-alias-label-secondary, rgba(0, 0, 0, .55));
+    font: inherit;
+    font-size: 12px;
+    line-height: 26px;
+    white-space: nowrap;
+    cursor: pointer;
+    -webkit-tap-highlight-color: transparent;
+  }
+  [data-chat-flow] > [data-mobile-nav="turn-fold"]:active {
+    background: var(--dsw-alias-interactive-bg-pressed, rgba(0, 0, 0, .1));
+  }
+
+  /* Leading dot: idle turns get a quiet mark, a running turn gets the same
+     business-primary colour the session header's own status dot uses
+     (styles/header.css.ts) plus a breathing pulse. */
+  [data-chat-flow] > [data-mobile-nav="turn-fold"]::before {
+    content: '';
+    flex: none;
+    width: 6px;
+    height: 6px;
+    border-radius: 50%;
+    background: currentColor;
+    opacity: .45;
+  }
+  [data-chat-flow] > [data-mobile-nav="turn-fold"][data-running]::before {
+    background: var(--dsw-alias-state-business-primary, #4f6ef7);
+    opacity: 1;
+    animation: dsh-mobile-nav-breathe 1.4s var(--ds-ease-in-out, ease-in-out) infinite;
+  }
+
+  /* Chevron drawn from two borders — no icon injection, no mask image, and
+     it rotates to point up once the turn is open. */
+  [data-chat-flow] > [data-mobile-nav="turn-fold"]::after {
+    content: '';
+    flex: none;
+    width: 5px;
+    height: 5px;
+    margin-top: -3px;
+    border-right: 1.5px solid currentColor;
+    border-bottom: 1.5px solid currentColor;
+    transform: rotate(45deg);
+    transition: transform .16s var(--ds-ease-out, ease-in-out);
+  }
+  [data-chat-flow] > [data-mobile-nav="turn-fold"][data-open]::after {
+    margin-top: 3px;
+    transform: rotate(-135deg);
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    [data-chat-flow] > [data-mobile-nav="turn-fold"][data-running]::before {
+      animation: none;
+    }
+    [data-chat-flow] > [data-mobile-nav="turn-fold"]::after {
+      transition: none;
+    }
+  }
+}
+
+@keyframes dsh-mobile-nav-breathe {
+  0%, 100% { opacity: 1; transform: scale(1); }
+  50% { opacity: .4; transform: scale(.72); }
+}
+`

package/src/index.ts

@@ -0,0 +1,343 @@
+/**
+ * dsh-mobile-nav, node half.
+ *
+ * Was an empty apply (pure client UI plugin) until S7. It now owns ONE host
+ * route: the phone composer's attachment upload. The official file picker
+ * opens on the machine running DSH, which is useless from a phone, and the
+ * public client API has no upload verb at all — the only public browser->host
+ * byte channel is `session.prompt([{type:'image',…}])`, which is images only
+ * and lands as a sent message rather than a file on disk. So a non-image
+ * attachment needs a route of its own, and that route belongs here rather
+ * than in the gateway half of this plugin: the gateway authenticates and forwards
+ * verbatim, it does not know what a session or a workspace is.
+ *
+ * The browser half still ships via exports["./client"], discovered through
+ * the package.json dsh.client declaration.
+ */
+
+import { lstat, mkdir, open, realpath, rm } from 'node:fs/promises'
+import type { FileHandle } from 'node:fs/promises'
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { basename, extname, isAbsolute, join, relative, resolve, sep } from 'node:path'
+import type { Context } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/dsh-host-webserver'
+import type {} from '@deepseek-ai/dsh-session'
+
+/** Exact route the phone composer POSTs one file body to. */
+export const UPLOAD_ROUTE = '/_dsh/mobile-nav/upload'
+
+/** Workspace-relative directory uploads land in (also the `@` prefix the composer inserts). */
+export const UPLOAD_DIR = '.dsh-uploads'
+
+/** Body cap when the plugin row sets no `maxUploadBytes`. */
+export const DEFAULT_MAX_UPLOAD_BYTES = 20 * 1024 * 1024
+
+/** Longest filename, in bytes, that survives sanitization (ext4/APFS leaf limit is 255). */
+const MAX_NAME_BYTES = 180
+
+/** Distinct leaf names tried before a collision is given up on. */
+const MAX_COLLISION_TRIES = 100
+
+/** Host half config; the only knob is the body cap. */
+export interface MobileNavConfig {
+  /** Max upload body in bytes; larger bodies get 413. Default {@link DEFAULT_MAX_UPLOAD_BYTES}. */
+  maxUploadBytes?: number
+}
+
+/**
+ * One rejection carrying the status the client should see.
+ *
+ * Fields are assigned in the body rather than declared as constructor
+ * parameter properties: `scripts/check-upload-endpoint.mjs` imports this
+ * module through Node's strip-only type stripping, which rejects that syntax.
+ */
+class UploadError extends Error {
+  readonly status: number
+  readonly code: string
+
+  constructor(status: number, code: string, message: string) {
+    super(message)
+    this.name = 'UploadError'
+    this.status = status
+    this.code = code
+  }
+}
+
+function message(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+function isErrnoCode(error: unknown, code: string): boolean {
+  return error instanceof Error && 'code' in error && (error as { code?: unknown }).code === code
+}
+
+function responseJson(res: ServerResponse, status: number, body: unknown): void {
+  const bytes = Buffer.from(JSON.stringify(body))
+  res.setHeader('Content-Type', 'application/json; charset=utf-8')
+  res.setHeader('Content-Length', String(bytes.length))
+  res.setHeader('Cache-Control', 'no-store')
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+  res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'")
+  res.writeHead(status)
+  res.end(bytes)
+}
+
+/**
+ * Accept a state-changing request only from this DSH Web application's origin.
+ *
+ * The gateway half rewrites `Origin`/`Host` to the upstream origin
+ * before forwarding (lan-gate-server.cjs `cleanHeaders`), so a phone request
+ * that already cleared the pairing wall presents here as same-origin; a
+ * request with neither header falls back to the Fetch metadata.
+ * @param req - the inbound request.
+ * @returns true when the request may mutate the workspace.
+ */
+export function sameOriginPost(req: IncomingMessage): boolean {
+  const fetchSite = req.headers['sec-fetch-site']
+  if (fetchSite === 'cross-site') return false
+  const origin = req.headers.origin
+  if (origin === undefined) return fetchSite === 'same-origin' || fetchSite === 'same-site' || fetchSite === 'none'
+  const host = req.headers.host
+  if (host === undefined) return false
+  try {
+    const parsed = new URL(origin)
+    return (parsed.protocol === 'http:' || parsed.protocol === 'https:') && parsed.host === host
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Reject a resolved path that is not rooted below the expected directory.
+ * @param root - the directory the target must stay inside.
+ * @param target - the resolved candidate path.
+ * @throws when the target escapes the root.
+ */
+export function ensurePathInside(root: string, target: string): void {
+  const rel = relative(root, target)
+  if (rel !== '' && (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))) {
+    throw new UploadError(400, 'path-escape', `resolved upload path escapes its workspace root: ${target}`)
+  }
+}
+
+/**
+ * Convert an untrusted browser label into one portable leaf filename.
+ *
+ * Everything that could steer the write out of the upload directory is gone
+ * after this: only the basename survives (so `../../etc/passwd` becomes
+ * `passwd`), separators and control characters become `_`, leading dots are
+ * dropped, and the Windows reserved device names are prefixed. Whitespace
+ * folds to `_` rather than being kept: the client appends the result to the
+ * composer draft as an `@path` mention, and a mention with a space in it is
+ * broken for the agent reading it, not just for the chip parser. Length is
+ * capped in BYTES because the label arrives as UTF-8.
+ * @param raw - browser-supplied filename.
+ * @returns a single safe leaf name, never empty.
+ */
+export function safeUploadName(raw: string): string {
+  const leaf = basename(raw.replaceAll('\\', '/')).normalize('NFC')
+  let cleaned = leaf
+    .replace(/[<>:"|?*\u0000-\u001f/\\]/gu, '_')
+    .replace(/\s+/gu, '_')
+    .replace(/^\.+/u, '')
+    .trim()
+    .replace(/[. ]+$/u, '')
+  if (/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu.test(cleaned)) cleaned = `_${cleaned}`
+  const candidate = cleaned === '' ? 'upload.bin' : cleaned
+  if (Buffer.byteLength(candidate) <= MAX_NAME_BYTES) return candidate
+  const extension = extname(candidate).slice(0, 20)
+  const budget = Math.max(1, MAX_NAME_BYTES - Buffer.byteLength(extension))
+  let stem = candidate.slice(0, Math.max(1, candidate.length - extension.length))
+  while (Buffer.byteLength(stem) > budget) stem = stem.slice(0, -1)
+  return `${stem}${extension}`
+}
+
+function singleQuery(url: URL, key: string): string {
+  const values = url.searchParams.getAll(key)
+  const value = values[0]
+  if (values.length !== 1 || value === undefined || value === '') {
+    throw new UploadError(400, 'bad-request', `${key} is required exactly once`)
+  }
+  return value
+}
+
+/** Create the directory if absent, then prove it is a real directory inside the workspace. */
+async function ensureManagedDirectory(workspace: string, path: string): Promise<string> {
+  try {
+    await mkdir(path, { mode: 0o700 })
+  } catch (error) {
+    if (!isErrnoCode(error, 'EEXIST')) throw error
+  }
+  const entry = await lstat(path)
+  // A symlink here would be the one way a prior workspace write could still
+  // redirect the bytes elsewhere — realpath alone would happily follow it.
+  if (entry.isSymbolicLink()) {
+    throw new UploadError(400, 'path-escape', `upload directory is a symbolic link: ${path}`)
+  }
+  if (!entry.isDirectory()) throw new UploadError(400, 'path-escape', `upload path is not a directory: ${path}`)
+  const canonical = await realpath(path)
+  ensurePathInside(workspace, canonical)
+  return canonical
+}
+
+interface UploadRoot {
+  /** Canonical directory the bytes are written into. */
+  writeRoot: string
+  /** The same directory as the user sees it (pre-realpath), for the returned relative path. */
+  visibleRoot: string
+}
+
+/**
+ * Resolve (and create) the upload directory of one live session.
+ * @param ctx - host context carrying the sessions service.
+ * @param sessionId - the session whose workspace receives the file.
+ * @returns the canonical and visible upload directories.
+ * @throws 404 when no live session has that id.
+ */
+async function sessionUploadRoot(ctx: Context, sessionId: string): Promise<UploadRoot> {
+  const session = ctx.sessions.get(sessionId as never)
+  if (session === undefined) throw new UploadError(404, 'session-not-found', `live Session not found: ${sessionId}`)
+  const cwd = session.header.cwd
+  if (cwd === undefined || !isAbsolute(cwd)) {
+    throw new UploadError(404, 'session-not-found', `Session has no absolute workspace: ${sessionId}`)
+  }
+  const visibleWorkspace = resolve(cwd)
+  const workspace = await realpath(visibleWorkspace)
+  const visibleRoot = join(visibleWorkspace, UPLOAD_DIR)
+  const writeRoot = await ensureManagedDirectory(workspace, visibleRoot)
+  return { writeRoot, visibleRoot }
+}
+
+/**
+ * Claim one not-yet-existing leaf name, suffixing `-1`, `-2`, … on collision.
+ * `wx` makes the claim atomic, so two concurrent uploads of the same name
+ * cannot both win the same path.
+ */
+async function openUnique(directory: string, filename: string): Promise<{ handle: FileHandle; path: string }> {
+  const extension = extname(filename)
+  const stem = filename.slice(0, filename.length - extension.length) || 'upload'
+  for (let n = 0; n < MAX_COLLISION_TRIES; n += 1) {
+    const path = join(directory, n === 0 ? `${stem}${extension}` : `${stem}-${n}${extension}`)
+    ensurePathInside(directory, path)
+    try {
+      return { handle: await open(path, 'wx', 0o600), path }
+    } catch (error) {
+      if (!isErrnoCode(error, 'EEXIST')) throw error
+    }
+  }
+  throw new UploadError(409, 'name-taken', `too many files named like ${filename}`)
+}
+
+/**
+ * Stream the request body onto disk under a running byte cap.
+ * @param req - the request whose body is the file.
+ * @param directory - canonical upload directory.
+ * @param filename - sanitized leaf name.
+ * @param maxBytes - hard cap; exceeding it aborts and unlinks.
+ * @returns the absolute path written and its byte count.
+ */
+async function writeUpload(
+  req: IncomingMessage,
+  directory: string,
+  filename: string,
+  maxBytes: number,
+): Promise<{ path: string; bytes: number }> {
+  const declared = req.headers['content-length']
+  const expected = declared === undefined ? undefined : Number(declared)
+  if (expected !== undefined && (!Number.isSafeInteger(expected) || expected < 0)) {
+    throw new UploadError(400, 'bad-request', 'Content-Length is not a byte count')
+  }
+  // Reject the oversized upload before a single byte is read, so the phone
+  // gets its 413 without spending the whole body on the radio.
+  if (expected !== undefined && expected > maxBytes) {
+    throw new UploadError(413, 'too-large', `upload exceeds the ${maxBytes}-byte limit`)
+  }
+
+  const { handle, path } = await openUnique(directory, filename)
+  let received = 0
+  try {
+    for await (const chunk of req) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk as Uint8Array)
+      received += bytes.length
+      // Chunked bodies declare no length, so the cap must also hold here.
+      if (received > maxBytes) throw new UploadError(413, 'too-large', `upload exceeds the ${maxBytes}-byte limit`)
+      await handle.write(bytes)
+    }
+    if (expected !== undefined && received !== expected) {
+      throw new UploadError(400, 'truncated', `upload body size mismatch: expected ${expected}, received ${received}`)
+    }
+    await handle.close()
+    return { path, bytes: received }
+  } catch (error) {
+    await handle.close().catch(() => {})
+    await rm(path, { force: true }).catch(() => {})
+    throw error
+  }
+}
+
+/**
+ * Handle one `POST {@link UPLOAD_ROUTE}?session=<id>&name=<file>` request.
+ *
+ * Exported so an integration check can drive it with a plain node:http server
+ * and a fake sessions service instead of booting a harness.
+ * @param ctx - host context carrying the sessions service and logger.
+ * @param maxBytes - body cap.
+ * @param req - inbound request; its body is the raw file.
+ * @param res - the response this call owns end to end.
+ */
+export async function handleUpload(
+  ctx: Context,
+  maxBytes: number,
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<void> {
+  if (req.method !== 'POST') {
+    res.setHeader('Allow', 'POST')
+    responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use POST' } })
+    return
+  }
+  if (!sameOriginPost(req)) {
+    const error = { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' }
+    responseJson(res, 403, { ok: false, error })
+    return
+  }
+  try {
+    const url = new URL(req.url ?? UPLOAD_ROUTE, 'http://dsh.internal')
+    const sessionId = singleQuery(url, 'session')
+    const filename = safeUploadName(singleQuery(url, 'name'))
+    const root = await sessionUploadRoot(ctx, sessionId)
+    const written = await writeUpload(req, root.writeRoot, filename, maxBytes)
+    const leaf = basename(written.path)
+    responseJson(res, 201, {
+      ok: true,
+      relPath: `${UPLOAD_DIR}/${leaf}`,
+      absolutePath: join(root.visibleRoot, leaf),
+      filename: leaf,
+      bytes: written.bytes,
+    })
+  } catch (error) {
+    const status = error instanceof UploadError ? error.status : 400
+    const code = error instanceof UploadError ? error.code : 'upload-rejected'
+    ctx.logger.warn('dsh-mobile-nav upload rejected: %s', message(error))
+    responseJson(res, status, { ok: false, error: { code, message: message(error) } })
+  }
+}
+
+/**
+ * Host half: mount the upload route wherever a webServer and live sessions
+ * exist. Both are injected INSIDE apply rather than declared as a top-level
+ * `inject`, so the plugin row still loads (and the browser half still ships)
+ * in a composition without them — Electron carries no webServer.
+ * @param ctx - host plugin context.
+ * @param config - optional body cap override.
+ */
+export function apply(ctx: Context, config: MobileNavConfig = {}): void {
+  const maxBytes = config.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES
+  ctx.inject(['webServer', 'sessions'], (webCtx) => {
+    webCtx.effect(() => webCtx.webServer.register({
+      kind: 'exact',
+      path: UPLOAD_ROUTE,
+      handler: (req, res) => handleUpload(webCtx, maxBytes, req, res),
+    }), 'dsh-mobile-nav: upload route')
+  })
+}