ZiyaZhang
f5d53f04b7
cleanup(web): stop sandboxing served workspace documents
...
A preview lost localStorage and cookies under CSP sandbox — measurably, the
reported artifact throws SecurityError on load and its theme toggle goes
dead. The capability the sandbox denied is one the file's author, an agent
already holding this user's shell, never needed the browser for, so the
header sat behind a trust boundary it had already crossed.
Isolating a preview becomes a real question when workspace content stops
being the viewer's own; the answer then is a separate origin, not a header.
2026-07-31 23:20:36 -07:00
ZiyaZhang
35e9122a65
feat(web): list a turn's produced files under its closing message
...
The paths come from the mutation tools' follow-along locations, not from the
closing prose, so a turn's output is listed whether or not the model named
it. Each chip opens through the same openFile the tool rows use.
Reads contribute nothing (looking at a file does not produce it), a failed
mutation contributes nothing, a file touched twice is one entry, and the row
shows six with an explicit remainder rather than burying the answer.
2026-07-31 22:13:34 -07:00
ZiyaZhang
00390ae851
feat(web): open a produced file from the conversation
...
Serve one file at a time out of a Session's workspace under /f on the web
transport, and point the conversation's existing file-open affordance at it.
Clicking a write/edit/read row's path now opens that file in a browser tab —
including from a LAN client, where the Host's system opener is fenced to
loopback and answered nothing.
- /f/<sessionId>/<segments> in client-connection, behind the same
browser-trust fence as /api; realpath confinement, streamed reads,
GET/HEAD only, nosniff + no-store.
- Script-capable documents carry CSP sandbox: model-authored markup must not
be same-origin with /api, where events.mux is a readable GET stream.
- ApiProxy.workspaceRootOf answers where a Session's files live without
resuming an agent; the client program cannot reach the core services.
- The /f URL shape lives in dsh-host-apiproxy/api so both ends share one
encoding (client bundles may not value-import another plugin).
2026-07-31 12:07:43 -07:00
imccyu
3dfbfb4e72
Merge branch 'master' into fix/web-fork-interrupted-seq
2026-08-01 02:19:51 +08:00
_Kerman
1a09174987
refactor(goal): persist state with domain events
2026-07-31 22:52:18 +08:00
kingwl
5e1c4b2b7b
Merge remote-tracking branch 'origin/master' into codex/remove-scoped-bash
...
# Conflicts:
# packages/client/ui-conversation/README.i18n.yaml
2026-07-31 22:41:07 +08:00
_Kerman
e0988abc74
Merge remote-tracking branch 'origin/master' into xtr/react-loop-simplification
...
# Conflicts:
# .agents/notes/implemented/architecture/2026-06-21-bounded-llm-request-recovery.i18n.yaml
# .agents/notes/implemented/feature/2026-06-18-compaction-capability-seam.i18n.yaml
# .agents/notes/implemented/feature/2026-06-18-compaction-capability-seam.md
# .agents/notes/implemented/feature/2026-06-18-compaction-capability-seam.zh.md
# .agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
# .agents/notes/implemented/feature/2026-07-06-sandbox.md
# .agents/notes/implemented/feature/2026-07-06-sandbox.zh.md
# .agents/notes/implemented/feature/2026-07-27-tmux-location-context.i18n.yaml
# .agents/notes/implemented/simplification/2026-06-20-public-agent-stop-surface.i18n.yaml
# .agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.i18n.yaml
# .agents/notes/implemented/simplification/2026-07-30-private-agent-send.i18n.yaml
# docs/architecture.i18n.yaml
# docs/architecture.md
# docs/architecture.zh.md
# docs/config-catalog.md
# docs/cordis-catalog/events.md
# docs/cordis-catalog/services.md
# docs/core-data-structures/compaction.i18n.yaml
# docs/core-data-structures/core.i18n.yaml
# docs/core-data-structures/core.md
# docs/core-data-structures/core.zh.md
# docs/core-data-structures/llm-streaming.i18n.yaml
# docs/core-data-structures/llm-streaming.md
# docs/core-data-structures/llm-streaming.zh.md
# docs/core-data-structures/session.i18n.yaml
# docs/event-producer-consumer.md
# docs/module-graph.md
# docs/persistence-catalog.md
# examples/acp-agent/tests/goal-snapshots/goal-session/session.expected.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.1.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.2.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.jsonl
# examples/acp-agent/tests/snapshots/bash-spill/session.jsonl
# examples/acp-agent/tests/snapshots/bash-tool-turn/session.jsonl
# examples/acp-agent/tests/snapshots/both-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/cancel-tool-calls/session.jsonl
# examples/acp-agent/tests/snapshots/cancel/session.jsonl
# examples/acp-agent/tests/snapshots/code-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/code-mode-workspace-context/session.jsonl
# examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl
# examples/acp-agent/tests/snapshots/empty-response-retry/session.jsonl
# examples/acp-agent/tests/snapshots/error-finish/session.jsonl
# examples/acp-agent/tests/snapshots/escalation-approved/session.jsonl
# examples/acp-agent/tests/snapshots/escalation-rejected/session.jsonl
# examples/acp-agent/tests/snapshots/fs-edit/session.jsonl
# examples/acp-agent/tests/snapshots/fs-escalation-approved/session.jsonl
# examples/acp-agent/tests/snapshots/fs-glob-sampling/session.jsonl
# examples/acp-agent/tests/snapshots/fs-policy-reject/session.jsonl
# examples/acp-agent/tests/snapshots/fs-read-window/session.jsonl
# examples/acp-agent/tests/snapshots/fs-read/session.jsonl
# examples/acp-agent/tests/snapshots/fs-write-overwrite/session.jsonl
# examples/acp-agent/tests/snapshots/fs-write/session.jsonl
# examples/acp-agent/tests/snapshots/hook-cc-invalid-matcher/session.jsonl
# examples/acp-agent/tests/snapshots/hook-cc-posttool-block/session.jsonl
# examples/acp-agent/tests/snapshots/hook-cc-posttool-context/session.jsonl
# examples/acp-agent/tests/snapshots/hook-cc-pretool-ask/session.jsonl
# examples/acp-agent/tests/snapshots/hook-cc-pretool-deny/session.jsonl
# examples/acp-agent/tests/snapshots/hook-cc-promptsubmit-context/session.jsonl
# examples/acp-agent/tests/snapshots/hook-cc-stop-continue/session.jsonl
# examples/acp-agent/tests/snapshots/hook-codex-invalid-matcher/session.jsonl
# examples/acp-agent/tests/snapshots/hook-codex-posttool-block/session.jsonl
# examples/acp-agent/tests/snapshots/hook-codex-posttool-context/session.jsonl
# examples/acp-agent/tests/snapshots/hook-codex-pretool-block/session.jsonl
# examples/acp-agent/tests/snapshots/hook-codex-promptsubmit-context/session.jsonl
# examples/acp-agent/tests/snapshots/hook-codex-stop-continue/session.jsonl
# examples/acp-agent/tests/snapshots/lsp-definition/session.jsonl
# examples/acp-agent/tests/snapshots/multi-turn/session.jsonl
# examples/acp-agent/tests/snapshots/packed-chunks/session.jsonl
# examples/acp-agent/tests/snapshots/parallel-tool-calls/session.jsonl
# examples/acp-agent/tests/snapshots/pty-tools/session.jsonl
# examples/acp-agent/tests/snapshots/repeat-tool-guard/session.jsonl
# examples/acp-agent/tests/snapshots/session-query-spill/session.jsonl
# examples/acp-agent/tests/snapshots/session-sandbox-root/session.jsonl
# examples/acp-agent/tests/snapshots/session-title-after-turn/session.jsonl
# examples/acp-agent/tests/snapshots/skill-load/session.jsonl
# examples/acp-agent/tests/snapshots/subagent-depth-two-rejection/session.1.jsonl
# examples/acp-agent/tests/snapshots/subagent-depth-two-rejection/session.2.jsonl
# examples/acp-agent/tests/snapshots/subagent-depth-two-rejection/session.jsonl
# examples/acp-agent/tests/snapshots/subagent-fork/session.1.jsonl
# examples/acp-agent/tests/snapshots/subagent-fork/session.jsonl
# examples/acp-agent/tests/snapshots/subagent-mixed/session.1.jsonl
# examples/acp-agent/tests/snapshots/subagent-mixed/session.2.jsonl
# examples/acp-agent/tests/snapshots/subagent-mixed/session.jsonl
# examples/acp-agent/tests/snapshots/subagent-multi/session.1.jsonl
# examples/acp-agent/tests/snapshots/subagent-multi/session.2.jsonl
# examples/acp-agent/tests/snapshots/subagent-multi/session.jsonl
# examples/acp-agent/tests/snapshots/subagent-spawn/session.1.jsonl
# examples/acp-agent/tests/snapshots/subagent-spawn/session.jsonl
# examples/acp-agent/tests/snapshots/text-turn/session.jsonl
# examples/acp-agent/tests/snapshots/todo-write/session.jsonl
# examples/acp-agent/tests/snapshots/tool-call-turn/session.jsonl
# examples/acp-agent/tests/snapshots/web-fetch/session.jsonl
# examples/acp-agent/tests/snapshots/workflow-run/session.1.jsonl
# examples/acp-agent/tests/snapshots/workflow-run/session.jsonl
# examples/acp-agent/tests/snapshots/workspace-context/session.jsonl
# examples/acp-agent/tests/snapshots/workspace-edit/session.jsonl
# examples/headless-agent/tests/semantic-checkpoint-snapshots/tool-outcome-unknown/session.expected.jsonl
# examples/headless-agent/tests/snapshots/advanced-toolchain/session.1.jsonl
# examples/headless-agent/tests/snapshots/advanced-toolchain/session.2.jsonl
# examples/headless-agent/tests/snapshots/advanced-toolchain/session.jsonl
# examples/headless-agent/tests/snapshots/advanced-toolchain/stream-json.expected.jsonl
# examples/headless-agent/tests/snapshots/goal-tools/stream-json.expected.jsonl
# examples/headless-agent/tests/snapshots/missing-credential/stream-json.expected.jsonl
# examples/headless-agent/tests/snapshots/provider-retry/stream-json.expected.jsonl
# examples/headless-agent/tests/snapshots/pty-tools/session.jsonl
# examples/headless-agent/tests/snapshots/pty-tools/stream-json.expected.jsonl
# examples/headless-agent/tests/snapshots/ralph-loop/stream-json.expected.jsonl
# examples/headless-agent/tests/subagent-inheritance-snapshots/parent-override/child.expected.jsonl
# examples/headless-agent/tests/subagent-inheritance-snapshots/parent-override/parent.expected.jsonl
# examples/jsonrpc-agent/tests/snapshots/bash-tool/notifications.expected.jsonl
# examples/jsonrpc-agent/tests/snapshots/bash-tool/session.jsonl
# examples/jsonrpc-agent/tests/snapshots/persistent-tools/notifications.expected.jsonl
# examples/jsonrpc-agent/tests/snapshots/persistent-tools/session.jsonl
# examples/jsonrpc-agent/tests/snapshots/subagent-spawn/notifications.expected.jsonl
# examples/jsonrpc-agent/tests/snapshots/subagent-spawn/session.1.jsonl
# examples/jsonrpc-agent/tests/snapshots/subagent-spawn/session.jsonl
# examples/jsonrpc-agent/tests/snapshots/text-turn/notifications.expected.jsonl
# examples/jsonrpc-agent/tests/snapshots/text-turn/session.jsonl
# packages/client/runtime/README.i18n.yaml
# packages/client/runtime/src/client/sessions/request-inspection.ts
# packages/compact/compact-basic/README.i18n.yaml
# packages/compact/compact-basic/README.md
# packages/compact/compact-basic/README.zh.md
# packages/compact/compact-basic/src/index.ts
# packages/context/time-context/tests/time-context.spec.ts
# packages/context/tmux-context/README.i18n.yaml
# packages/context/tmux-context/tests/tmux-context.spec.ts
# packages/context/workspace-context/tests/workspace-context.spec.ts
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-loop/README.i18n.yaml
# packages/core/agent-loop/README.md
# packages/core/agent-loop/README.zh.md
# packages/core/agent-loop/src/agent.ts
# packages/core/agent/README.i18n.yaml
# packages/core/agent/README.md
# packages/core/agent/README.zh.md
# packages/core/agent/src/types.ts
# packages/core/session/README.i18n.yaml
# packages/core/session/README.md
# packages/core/session/README.zh.md
# packages/fs/tool-str-replace-editor/tests/tools.spec.ts
# packages/goal/command-goal/tests/command-goal.spec.ts
# packages/goal/goal/tests/goal.spec.ts
# packages/host/apiproxy/README.i18n.yaml
# packages/host/apiproxy/README.md
# packages/host/apiproxy/README.zh.md
# packages/host/apiproxy/src/api/index.ts
# packages/host/apiproxy/tests/api-proxy-workspace.spec.ts
# packages/llm/llm/README.i18n.yaml
# packages/llm/llm/README.md
# packages/llm/llm/README.zh.md
# packages/llm/llm/src/index.ts
# packages/pty/pty-local/tests/index.spec.ts
# packages/pty/pty-local/tests/local.spec.ts
# packages/pty/pty/tests/service.spec.ts
# packages/pty/tool-bash-persistent/tests/loader-composition.spec.ts
# packages/pty/tool-bash-persistent/tests/tools.spec.ts
# packages/pty/tool-pty/tests/loader-composition.spec.ts
# packages/pty/tool-pty/tests/tools.spec.ts
# packages/session-persistence/session-checkpoint-policy/tests/crash-recovery.e2e.ts
# packages/skill/tool-skill/tests/tool-skill.spec.ts
# packages/tasks/tasks-local/tests/tasks.spec.ts
# packages/ui/tui/README.i18n.yaml
# packages/ui/tui/tests/tui.spec.ts
# packages/ui/user-approval/src/index.ts
# packages/ui/user-approval/tests/approval.spec.ts
2026-07-31 22:16:40 +08:00
_Kerman
afedf18ccf
fix inbox lifecycle downstream contracts
2026-07-31 22:00:39 +08:00
Wenlu Wang
e3e6621e48
Merge branch 'master' into codex/goal-clear-single-flight
2026-07-31 21:54:14 +08:00
Wenlu Wang
9a3bdd599c
Merge pull request #1099 from deepseek-harness/codex/hide-session-lineage-header
...
fix(web): hide session lineage in header
2026-07-31 21:51:56 +08:00
kingwl
7b826bf16c
Merge remote-tracking branch 'origin/master' into codex/remove-scoped-bash
...
# Conflicts:
# packages/client/ui-conversation/README.i18n.yaml
2026-07-31 21:32:02 +08:00
kingwl
6879c0c9ca
Merge remote-tracking branch 'origin/master' into codex/hide-session-lineage-header
...
# Conflicts:
# packages/client/ui-conversation/README.i18n.yaml
2026-07-31 21:31:04 +08:00
kingwl
aa85e0c6cd
Merge remote-tracking branch 'origin/master' into codex/goal-clear-single-flight
2026-07-31 21:30:22 +08:00
kingwl
32972f1675
Merge remote-tracking branch 'origin/master' into codex/web-stop-preserve-queue
2026-07-31 21:30:19 +08:00
Ziya
3a01dc814e
Merge pull request #1088 from deepseek-harness/agent/web-context-injection-auto-height
...
fix(web): let context injection cards fit content
2026-07-31 09:28:45 -04:00
kingwl
07b0efc49e
fix(web): hide session lineage in header
2026-07-31 21:08:57 +08:00
kingwl
e73cdd6b7d
fix(web): single-flight goal clear
2026-07-31 20:54:23 +08:00
kingwl
32a0e871b7
fix(web): preserve queue on stop
2026-07-31 20:51:05 +08:00
kingwl
ddda8be736
docs: record scoped bash translation pairs
2026-07-31 20:48:52 +08:00
07akioni
575e1217bb
fix: remove scoped bash
2026-07-31 20:47:55 +08:00
ZiyaZhang
344ad0d6fb
fix(client): floor the fork anchor to a real event seq
...
The fork button on a stopped assistant message was inert. Frozen
interrupted nodes carry a flow-ordering seq of turnEnd.seq - 0.9, and
session.fork takes a non-negative integer on the wire, so every such
request was rejected as invalid-params before reaching the host — where
an aborted turn's logged turn/end has always made it forkable.
SessionsService.fork floors atSeq at the wire boundary. Flooring stays
inside the anchor's own turn (every turn opens with turn/start), so the
host's first-turn/end-at-or-after cut still closes on that turn.
2026-07-31 05:41:45 -07:00
ZiyaZhang
5e68d812d1
fix(web): let context injection cards fit content
2026-07-31 05:20:54 -07:00
creatixchu
7557fda62b
Merge latest master into PR 555
...
# Conflicts:
# .agents/notes/implemented/architecture/2026-07-25-web-input-machine-and-slash-pipeline.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-25-web-input-machine-and-slash-pipeline.md
# .agents/notes/implemented/architecture/2026-07-25-web-input-machine-and-slash-pipeline.zh.md
# packages/client/ui-conversation/README.i18n.yaml
# packages/client/ui-conversation/src/client/chat/MessageItem.tsx
# packages/client/ui-conversation/src/client/input/facade.ts
# packages/client/ui-conversation/src/client/input/hub.ts
# packages/client/ui-conversation/src/client/service.ts
# packages/client/ui-conversation/tests/apply-inject.spec.tsx
# packages/client/ui-conversation/tests/input-bar.spec.tsx
# packages/client/ui-conversation/tests/input-matrix.spec.tsx
# packages/client/ui-conversation/tests/input-scenarios.spec.tsx
# packages/client/ui-conversation/tests/skeleton.spec.tsx
2026-07-31 20:11:28 +08:00
_Kerman
966add3305
Merge remote-tracking branch 'github/master' into xtr/trajectory-timeline-polish
2026-07-31 20:01:50 +08:00
_Kerman
dd98d15b1d
Merge remote-tracking branch 'github/master' into xtr/trajectory-timeline-polish
...
# Conflicts:
# packages/client/ui-trajectory/src/client/timeline.ts
# packages/client/ui-trajectory/tests/views.spec.tsx
2026-07-31 20:01:16 +08:00
creatixchu
38c21c1428
Merge latest master into PR 555
...
# Conflicts:
# packages/host/apiproxy/README.i18n.yaml
2026-07-31 19:55:58 +08:00
_Kerman
094f1976c4
fix(trajectory): lighten summary section headings
2026-07-31 19:53:55 +08:00
imccyu
23ee31efc0
Merge branch 'master' into fix/remove-badge
2026-07-31 19:47:55 +08:00
creatixchu
09b7fcfd4f
Merge latest master into PR 555
...
# Conflicts:
# docs/architecture.i18n.yaml
# docs/core-data-structures/core.i18n.yaml
# examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl
# packages/client/runtime/README.i18n.yaml
# packages/client/ui-conversation/README.i18n.yaml
# packages/client/ui-conversation/src/client/chat/MessageItem.tsx
# packages/compact/compact-basic/README.i18n.yaml
# packages/ui/tui/README.i18n.yaml
2026-07-31 19:39:22 +08:00
Tianyi Cui
d64b032311
Merge pull request #1082 from deepseek-harness/worktree/fix-web-duplicate-folder-names-20260731
...
fix(workspace): allow same-basename folders in Web
2026-07-31 19:37:38 +08:00
07akioni
410a837e02
Merge remote-tracking branch 'origin/master' into fix/remove-badge
2026-07-31 19:33:01 +08:00
_Kerman
fcc2b5e282
refactor agent pre-step inbox lifecycle
2026-07-31 19:21:16 +08:00
07akioni
57d6d9ee1c
fix: ci
2026-07-31 19:20:23 +08:00
07akioni
94a600eddd
Merge branch 'master' into fix/remove-badge
2026-07-31 19:19:55 +08:00
Tianyi Cui
2d73157099
docs(client): refresh runtime README pairing
2026-07-31 19:18:08 +08:00
07akioni
1766461947
Merge remote-tracking branch 'origin/master' into fix/remove-badge
2026-07-31 19:13:22 +08:00
Ziya
9473951c79
Merge branch 'master' into fix/web-turn-error-surface
2026-07-31 07:13:02 -04:00
07akioni
f9dc4aa702
feat: remove "插话" badge displayed in user message
2026-07-31 19:12:16 +08:00
hypatiamay
57761539b4
Merge pull request #989 from deepseek-harness/feat/manual-compact-single-lock
...
feat(compact): add queued manual /compact
2026-07-31 19:10:48 +08:00
Ziya
4f13ce7b7f
Merge branch 'master' into fix/web-turn-error-surface
2026-07-31 07:07:05 -04:00
creatixchu
ff79170944
refactor(web): share user content stack
2026-07-31 18:58:03 +08:00
creatixchu
404c58717a
Merge remote-tracking branch 'origin/worktree/hero-blank-session-settling' into worktree/hero-blank-session-settling
2026-07-31 18:43:37 +08:00
Tianyi Cui
ce04a85d80
Merge origin/master into same-basename workspace fix
...
# Conflicts:
# packages/client/ui-workspace/README.i18n.yaml
2026-07-31 18:42:20 +08:00
CreatixChu
e18efd3375
Merge branch 'master' into worktree/hero-blank-session-settling
2026-07-31 18:39:38 +08:00
Tianyi Cui
678ad97f9a
Allow same-basename Workspace paths
2026-07-31 18:37:34 +08:00
creatixchu
3b2ee5ce87
test(ui-conversation): pin all three list-summary shapes for the settling exemption
...
The mount fixture always listed the session, so the case named "no list
summary" actually exercised a row proving non-blank. An omitSummaryRow
option drops the row, and the three cases now pin blank:false, an absent
row, and the summary-proven blank open.
2026-07-31 18:37:04 +08:00
creatixchu
3c3ef85c9c
Merge remote-tracking branch 'origin/master' into worktree/web-multimodal-image-input
...
# Conflicts:
# packages/client/runtime/README.i18n.yaml
# packages/client/ui-conversation/README.i18n.yaml
# packages/client/ui-conversation/README.md
# packages/client/ui-conversation/README.zh.md
# packages/client/ui-conversation/src/client/chat/MessageItem.tsx
2026-07-31 18:18:07 +08:00
Tianyi Cui
5d87f8b291
Merge latest master into manual compaction
2026-07-31 18:11:53 +08:00
ZiyaZhang
215bf15f78
fix(web): surface terminal turn failures
2026-07-31 03:10:48 -07:00
creatixchu
8acb924f82
doc(ui-conversation): note that the settling exemption spans every open state
2026-07-31 18:09:31 +08:00
