Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,315 Commits 1 Branch 0 Tags
f5d53f04b7f02f7ad69c0dd135b61ae4f16a7330
Commit Graph

8315 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
ZiyaZhang
f5d53f04b7 cleanup(web): stop sandboxing served workspace documents 
A preview lost localStorage and cookies under CSP sandbox — measurably, the
reported artifact throws SecurityError on load and its theme toggle goes
dead. The capability the sandbox denied is one the file's author, an agent
already holding this user's shell, never needed the browser for, so the
header sat behind a trust boundary it had already crossed.

Isolating a preview becomes a real question when workspace content stops
being the viewer's own; the answer then is a separate origin, not a header.
 2026-07-31 23:20:36 -07:00
ZiyaZhang
35e9122a65 feat(web): list a turn's produced files under its closing message 
The paths come from the mutation tools' follow-along locations, not from the
closing prose, so a turn's output is listed whether or not the model named
it. Each chip opens through the same openFile the tool rows use.

Reads contribute nothing (looking at a file does not produce it), a failed
mutation contributes nothing, a file touched twice is one entry, and the row
shows six with an explicit remainder rather than burying the answer.
 2026-07-31 22:13:34 -07:00
ZiyaZhang
00390ae851 feat(web): open a produced file from the conversation 
Serve one file at a time out of a Session's workspace under /f on the web
transport, and point the conversation's existing file-open affordance at it.
Clicking a write/edit/read row's path now opens that file in a browser tab —
including from a LAN client, where the Host's system opener is fenced to
loopback and answered nothing.

- /f/<sessionId>/<segments> in client-connection, behind the same
  browser-trust fence as /api; realpath confinement, streamed reads,
  GET/HEAD only, nosniff + no-store.
- Script-capable documents carry CSP sandbox: model-authored markup must not
  be same-origin with /api, where events.mux is a readable GET stream.
- ApiProxy.workspaceRootOf answers where a Session's files live without
  resuming an agent; the client program cannot reach the core services.
- The /f URL shape lives in dsh-host-apiproxy/api so both ends share one
  encoding (client bundles may not value-import another plugin).
 2026-07-31 12:07:43 -07:00
Turtle
992fdc0cee Merge pull request #1102 from deepseek-harness/test/refresh-queue-actions-golden 
test(web): refresh queue-actions golden for the lineage-free header
 2026-07-31 23:10:35 +08:00
Turtle
3a6c253cc7 test(web): refresh queue-actions golden for the lineage-free header 
PR #1100 recorded the golden with the session-lineage navigation still in
the header; PR #1099 removed it. Master's snapshots job was skipped on the
combining merge, so the conflict first surfaced on the next PR's CI.
 2026-07-31 22:29:14 +08:00
Wenlu Wang
9a3bdd599c Merge pull request #1099 from deepseek-harness/codex/hide-session-lineage-header 
fix(web): hide session lineage in header
 2026-07-31 21:51:56 +08:00
Wenlu Wang
880203a738 Merge pull request #1100 from deepseek-harness/codex/web-stop-preserve-queue 
fix(web): preserve queued prompts when stopping
 2026-07-31 21:51:25 +08:00
kingwl
6879c0c9ca Merge remote-tracking branch 'origin/master' into codex/hide-session-lineage-header 
# Conflicts:
#	packages/client/ui-conversation/README.i18n.yaml
 2026-07-31 21:31:04 +08:00
kingwl
32972f1675 Merge remote-tracking branch 'origin/master' into codex/web-stop-preserve-queue 2026-07-31 21:30:19 +08:00
Wenlu Wang
fb9da7587c Merge pull request #1098 from deepseek-harness/codex/refresh-translation-prompt-snapshot 
test: refresh translation prompt snapshot
 2026-07-31 21:28:47 +08:00
Ziya
3a01dc814e Merge pull request #1088 from deepseek-harness/agent/web-context-injection-auto-height 
fix(web): let context injection cards fit content
 2026-07-31 09:28:45 -04:00
kingwl
07b0efc49e fix(web): hide session lineage in header 2026-07-31 21:08:57 +08:00
kingwl
f38d37be11 test: refresh translation prompt snapshot 2026-07-31 21:06:03 +08:00
kingwl
f001f0c3d7 Merge remote-tracking branch 'origin/master' into codex/web-stop-preserve-queue 2026-07-31 20:53:25 +08:00
kingwl
32a0e871b7 fix(web): preserve queue on stop 2026-07-31 20:51:05 +08:00
Tianyi Cui
5c4b701afe Merge pull request #1090 from deepseek-harness/worktree/readme-install-clone 
docs: install from a repository clone
 2026-07-31 20:33:55 +08:00
Tianyi Cui
2a7e659fb5 docs: install from a repository clone 2026-07-31 20:29:25 +08:00
Tianyi Cui
e1c6fc3db4 Merge pull request #1032 from deepseek-harness/xtr/trajectory-timeline-polish 
fix(trajectory): polish timeline timing and layering
 2026-07-31 20:25:08 +08:00
Tianyi Cui
0cdf78013b Merge pull request #1087 from deepseek-harness/codex/experimental-cli-command-names 
feat(cli): mark meta and upgrade commands experimental
 2026-07-31 20:24:13 +08:00
ZiyaZhang
5e68d812d1 fix(web): let context injection cards fit content 2026-07-31 05:20:54 -07:00
Turtle
dc88440dad Merge remote-tracking branch 'origin/master' into codex/experimental-cli-command-names 
# Conflicts:
#	apps/cli/README.i18n.yaml
#	packages/ui/tui/README.i18n.yaml
 2026-07-31 20:18:15 +08:00
Turtle
60a0bcd358 feat(cli): mark meta and upgrade commands experimental 2026-07-31 20:16:19 +08:00
_Kerman
e921fae362 Merge remote-tracking branch 'github/master' into xtr/trajectory-timeline-polish 2026-07-31 20:12:20 +08:00
Tianyi Cui
e1eb581f2b Merge pull request #1018 from deepseek-harness/feature/tui-first-run-welcome 
feat(tui): add versioned first-run welcome
 2026-07-31 20:08:56 +08:00
_Kerman
966add3305 Merge remote-tracking branch 'github/master' into xtr/trajectory-timeline-polish 2026-07-31 20:01:50 +08:00
_Kerman
dd98d15b1d Merge remote-tracking branch 'github/master' into xtr/trajectory-timeline-polish 
# Conflicts:
#	packages/client/ui-trajectory/src/client/timeline.ts
#	packages/client/ui-trajectory/tests/views.spec.tsx
 2026-07-31 20:01:16 +08:00
imccyu
d93fe10682 Merge pull request #1084 from deepseek-harness/fix/remove-badge 
feat: remove "插话" badge displayed in user message
 2026-07-31 19:59:25 +08:00
_Kerman
094f1976c4 fix(trajectory): lighten summary section headings 2026-07-31 19:53:55 +08:00
Tianyi Cui
76f3b402e1 Merge remote-tracking branch 'origin/master' into worktree/pr1018-todo-retarget-20260731 2026-07-31 19:48:14 +08:00
Tianyi Cui
c83159f1c0 test(cli): acknowledge welcome in composition smoke 2026-07-31 19:48:04 +08:00
imccyu
23ee31efc0 Merge branch 'master' into fix/remove-badge 2026-07-31 19:47:55 +08:00
Tianyi Cui
d64b032311 Merge pull request #1082 from deepseek-harness/worktree/fix-web-duplicate-folder-names-20260731 
fix(workspace): allow same-basename folders in Web
 2026-07-31 19:37:38 +08:00
07akioni
410a837e02 Merge remote-tracking branch 'origin/master' into fix/remove-badge 2026-07-31 19:33:01 +08:00
Tianyi Cui
e0cedd16b8 Merge remote-tracking branch 'origin/master' into worktree/pr1018-todo-retarget-20260731 2026-07-31 19:25:27 +08:00
Tianyi Cui
7d04e4654a Merge remote-tracking branch 'origin/master' into worktree/pr1018-todo-retarget-20260731 
# Conflicts:
#	apps/cli/README.i18n.yaml
#	packages/ui/tui/README.i18n.yaml
 2026-07-31 19:23:34 +08:00
Ziya
9b1486f90f Merge pull request #1078 from deepseek-harness/fix/web-turn-error-surface 
fix(web): surface terminal turn failures
 2026-07-31 07:23:09 -04:00
Tianyi Cui
2abf643326 Merge pull request #1040 from deepseek-harness/feat/recommended-deployment-presets 
feat(cli): even out the shipped tool rosters across both surfaces
 2026-07-31 19:21:18 +08:00
07akioni
57d6d9ee1c fix: ci 2026-07-31 19:20:23 +08:00
07akioni
94a600eddd Merge branch 'master' into fix/remove-badge 2026-07-31 19:19:55 +08:00
Tianyi Cui
2d73157099 docs(client): refresh runtime README pairing 2026-07-31 19:18:08 +08:00
Tianyi Cui
3aa98ba609 Merge remote-tracking branch 'origin/master' into worktree/pr1018-todo-retarget-20260731 
# Conflicts:
#	apps/cli/README.i18n.yaml
#	apps/cli/README.md
#	apps/cli/README.zh.md
 2026-07-31 19:17:50 +08:00
hypatiamay
dcc9e50f84 Merge pull request #1026 from deepseek-harness/feat/compaction-progress-visibility 
feat(tui): show live compaction progress
 2026-07-31 19:17:43 +08:00
Tianyi Cui
c16e33d8db Merge latest master into feat/recommended-deployment-presets 
# Conflicts:
#	apps/cli/README.i18n.yaml
#	apps/web/tsconfig.json
#	tsconfig.host.json
 2026-07-31 19:16:05 +08:00
Tianyi Cui
53e7e5b247 docs(cli): track welcome storage migration 2026-07-31 19:14:24 +08:00
07akioni
1766461947 Merge remote-tracking branch 'origin/master' into fix/remove-badge 2026-07-31 19:13:22 +08:00
Ziya
9473951c79 Merge branch 'master' into fix/web-turn-error-surface 2026-07-31 07:13:02 -04:00
07akioni
f9dc4aa702 feat: remove "插话" badge displayed in user message 2026-07-31 19:12:16 +08:00
hypatiamay
57761539b4 Merge pull request #989 from deepseek-harness/feat/manual-compact-single-lock 
feat(compact): add queued manual /compact
 2026-07-31 19:10:48 +08:00
Ziya
4f13ce7b7f Merge branch 'master' into fix/web-turn-error-surface 2026-07-31 07:07:05 -04:00
CreatixChu
76694f435a Merge pull request #1076 from deepseek-harness/worktree/hero-blank-session-settling 
fix(ui-conversation): keep hero visible while a blank session opens
 2026-07-31 18:56:48 +08:00