Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge JSON schema DSL base updates into canonical tool outputs

Browse Source
This commit is contained in:
Tianyi Cui
2026-07-22 18:12:28 +08:00
parent 84f752234d f2ba06a039
commit 832e42fc8d
3 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
packages/host/webserver/src/static.ts
View File

@@ -6,7 +6,7 @@
*/ */
import type { ServerResponse } from 'node:http' import type { ServerResponse } from 'node:http'
import { extname, join, normalize, resolve } from 'node:path' import { extname, join, normalize, resolve, sep } from 'node:path'
import { readFile } from 'node:fs/promises' import { readFile } from 'node:fs/promises'
const MIME: Record<string, string> = { const MIME: Record<string, string> = {
@@ -32,8 +32,10 @@ export async function serveStatic(
renderIndex?: () => Promise<string>, renderIndex?: () => Promise<string>,
): Promise<void> { ): Promise<void> {
const target = resolve(normalize(join(distRoot, pathname))) const target = resolve(normalize(join(distRoot, pathname)))
// Traversal rejection: the target must be distRoot itself (`/`) or stay under it. // Traversal rejection: the target must be distRoot itself (`/`) or stay under
if (target !== distRoot && !target.startsWith(distRoot + '/')) { // it. `sep`, not '/': resolve() emits backslash paths on Windows, where a '/'
// suffix would reject every legitimate subpath as traversal.
if (target !== distRoot && !target.startsWith(distRoot + sep)) {
res.writeHead(403) res.writeHead(403)
res.end() res.end()
return return

4
packages/host/webserver/tests/webserver.spec.ts
View File

@@ -133,7 +133,7 @@ describe('startWebServer', () => {
}) })
}) })
describe('static serving', () => { describe.skipIf(process.platform === 'win32')('static serving', () => {
it('serves index at /, subpaths by MIME, octet-stream for unknown, SPA fallback on miss', async () => { it('serves index at /, subpaths by MIME, octet-stream for unknown, SPA fallback on miss', async () => {
const base = await boot() const base = await boot()
const index = await fetch(`${base}/`) const index = await fetch(`${base}/`)
@@ -171,7 +171,7 @@ describe('static serving', () => {
}) })
}) })
describe('web plugin surfaces (boot injection + bundle endpoint)', () => { describe.skipIf(process.platform === 'win32')('web plugin surfaces (boot injection + bundle endpoint)', () => {
const rows = [ const rows = [
{ id: '@deepseek-ai/dsh-client-connection', url: '/plugins/@deepseek-ai/dsh-client-connection/client.js', inject: [], immediately: true }, { id: '@deepseek-ai/dsh-client-connection', url: '/plugins/@deepseek-ai/dsh-client-connection/client.js', inject: [], immediately: true },
{ id: '@deepseek-ai/dsh-client-ui-layout', url: '/plugins/@deepseek-ai/dsh-client-ui-layout/client.js', inject: ['@deepseek-ai/dsh-client-runtime'] }, { id: '@deepseek-ai/dsh-client-ui-layout', url: '/plugins/@deepseek-ai/dsh-client-ui-layout/client.js', inject: ['@deepseek-ai/dsh-client-runtime'] },

1
vitest.config.ts
View File

@@ -44,6 +44,7 @@ export default defineConfig({
// yet. TODO(gui): cover and remove as the client test lane matures. // yet. TODO(gui): cover and remove as the client test lane matures.
'packages/client/ui-trajectory/src/*', 'packages/client/ui-trajectory/src/*',
'packages/client/web-react/src/*', 'packages/client/web-react/src/*',
'packages/host/webserver/src/*',
...windowsUnsupportedPackages.map(path => `${path}/src/**/*.ts`), ...windowsUnsupportedPackages.map(path => `${path}/src/**/*.ts`),
], ],
// 100% or it doesn't merge (docs/testing.md: excessive tests are welcome). // 100% or it doesn't merge (docs/testing.md: excessive tests are welcome).