figmar/apes-sidebar
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity
694 Commits 6 Branches 43 Tags
f4c44d13d6c855f42ec084c8ef9b1c36cb622f2a
Commit Graph
4 Commits
Author SHA1 Message Date
figmar f4c44d13d6 feat: align devDeps to 0.2.0-rc.2 (21 packages)
CI / plugin-mount (push) Canceled after 0s
Details
CI / ci-windows (push) Canceled after 0s
Details
CI / ci (push) Canceled after 0s
Details 
- Bump 21 @deepseek-ai devDeps from 0.1.5-rc.2 → 0.2.0-rc.2
  (dsh-code-runtime stays at 0.1.5-rc.2 — no 0.2.0-rc.2 published)
- Fix sidechat-routes.ts: source.kind 'plugin' → 'user'
  (0.2.0-rc.2 removed 'plugin' from MessageSourceMap)
- Remove unused SIDE_INJECTION_PLUGIN import
- Fix test fixtures for 0.2.0-rc.2 stricter validation:
  - tool/result message role: 'user' → 'tool'
  - add toolCallId at message top level
  - assertion kind: 'plugin' → 'user'
- Icon migration: Icon*14 → Icon*Regular, Icon*16 → Icon*Medium (19 files)
- SideChatView API migration to 0.2.0-rc.2
- Add 4 new locale keys (sideChatBlockNoExitCode, codeLabel, wrapLabel, unwrapLabel)
- intercept.tsx: guard against undefined matched in SidebarProducedFiles

Verification:
- pnpm run typecheck: PASS
- pnpm run build: PASS
- npx vitest run: 1015 passed | 0 failed | 9 skipped
 2026-10-11 18:25:35 +08:00
Menghuan1918 6cfe7a736f feat: adapt to DSH 0.1.2-alpha.1 (Remote gateway + token auth + MarkdownText labels) 
Dual-version compatibility: the plugin now works identically on
0.1.0-rc.8 ~ 0.1.1-rc.2 and 0.1.2-alpha.1 (the latter verified against a
source build of the dsh-v0.1.2-alpha.1 tag: mount smoke 14/14 + aggregate
double-mount; 0.1.1-rc.2 re-verified 14/14).

- MarkdownText: alpha.1 renamed the flat optional `codeLabels` prop to a
  required nested `labels: { code: {copyLabel, copiedLabel}, footnotes }`;
  the old prop alone crashes fence rendering with "reading 'code'". All
  four render sites (mermaid / MarkdownHtml / TextEditor / SideChatView)
  now go through src/client/markdown-labels.tsx (dual-shape object passed
  under both prop names).
- e2e mount lanes speak both host dialects (tests/e2e/host-protocol.ts +
  host.ts, unit-locked by tests/e2e-host-protocol.spec.ts):
  - one-time-token browser auth: the launch URL grep extends past the
    `/?token=` query (truncating at `/` loses the token), goto navigates
    the token URL (browser cookie exchange), and stamped navigations
    pre-seed the context cookie via addCookies — the exchange 303 drops
    sibling query params;
  - Remote gateway: dot endpoints first, slash endpoints on 404 fallback,
    with args keyed by the controller parameter name (workspace/create ->
    {request}, session/list -> {_request}; verified on a live host).
- package.json: drop the @deepseek-ai/dsh-client-runtime peer (package
  removed upstream in alpha.1; zero references in the source — the chunk
  externals entry stays and is resolution-tolerant).
- scripts/e2e-mount.sh: fix a latent set -u crash in the npx fallback
  branch ($DSH_CMD followed by a full-width comma parsed as part of the
  variable name).
- CI pin stays at @deepseek-ai/dsh@0.1.1-rc.2 until alpha.1 publishes to
  npm (comment updated); README/AGENTS document the new contracts.
- Version lockstep bumped to 0.17.1.
 2026-08-28 04:20:36 +08:00
zhangqianfeng a75928daf1 fix(mermaid): suppress global error rendering 2026-08-23 01:50:07 +08:00
Atlas Zeng 5e416eccef feat(mermaid): Markdown 预览安全渲染 Mermaid 图表（strict 清洗 + 懒加载 chunk + 点击放大） (#164) 
* feat(mermaid): 新增 mermaid 懒加载 chunk（构建链四处同步 + mermaid 依赖）

tsdown CHUNKS / bundle-route CHUNK_NAMES / chunk-loader ChunkName /
package.json files 同步注册 mermaid chunk；mermaid ^11.16.1 进依赖与
lockfile；chunk 构建注入 uuid 浏览器入口别名，绕开 node:crypto 纯度门。

* feat(mermaid): Markdown 预览安全渲染 mermaid 图表 + 点击放大弹窗

- splitMermaidBlocks 纯函数按 fence 切块，无 mermaid 文件零行为变化；
- mermaid.initialize 走 securityLevel strict + htmlLabels:false，不应用
  bindFunctions（静态图）；渲染 SVG 经 mermaid-sanitize 二次清洗：
  删 foreignObject/script/外来 HTML 元素、剥 @*/on* 属性、移除全部
  href/xlink:href，仅接受 SVG 根，解析失败返回空串；
- 点击图表弹出放大弹窗（滚轮缩放/拖拽平移/快捷键，借鉴 PR #75 交互，
  基于已清洗 SVG 克隆重写，不新增攻击面）；
- 深浅色跟随重渲、失败回退错误条 + 原码、CodeBlock 同款 chrome。

* test(mermaid): splitter/sanitize 单测 + chunk 清单同步 + 挂载冒烟 diagram.md

- mermaid-blocks.spec 10 例 fence 切块语义；
- mermaid-sanitize.spec 8 例 XSS（foreignObject/on*/@*/href/xlink:href/
  script/外来元素/畸形 XML/非 SVG 根）；
- bundle-route / chunk-artifact / manifest-consistency 清单加入 mermaid
  （chunk-artifact 补 addEventListener stub）；
- 挂载冒烟新增 diagram.md：client-mermaid.js 往返、SVG 节点文字、
  点击弹窗 Esc 关闭、preview 模式编辑器隐藏。

* docs(mermaid): 安全渲染设计文档 + lazy-chunks 表 + README 双语更新

设计文档记录基线决策（PR #99 架构 + PR #75 点击放大）、安全模型
（strict/htmlLabels/清洗/href 剥离/无 bindFunctions）、验证与取舍。

* fix(mermaid): sanitizer 属性名大小写归一，堵住混合大小写属性绕过（CR P1）

XML 属性名保留大小写，而输出会经 HTML 解析归一化（dangerouslySetInnerHTML），
oNload/HREF/xlink:HREF 这类混合大小写属性此前会漏过清洗。比较前先
toLowerCase()，按原名删除；新增混合大小写事件/链接属性回归用例。

* fix(mermaid): sanitizer 元素黑名单大小写归一，堵住混合大小写元素绕过（CR P1）

XML 元素名保留大小写，querySelectorAll('script') 等选择器匹配不到
<sCrIpT>/<foreignobject>，而输出经 HTML 解析会被归一化为 SVG
script/foreignObject（可执行/可注入 HTML）。改为遍历全部元素按
localName.toLowerCase() 命中小写黑名单后整节点删除；新增混合大小写
script/foreignObject/外来 HTML 元素回归用例（jsdom 实证：旧选择器
命中 0，新逻辑命中 2）。

* fix(mermaid): 单次 Markdown 解析 + 占位交换（CR P1）+ CommonMark fence 规则（CR P2）

P1（跨 fence 语义）：弃用逐块 MarkdownText 拆分，改为整篇文档单次
MarkdownText 渲染，布局后把 language-mermaid 代码块交换为 MermaidDiagram
（React 管理的 .md-code-block 宿主保留在树中、display:contents 抑制盒子，
协调安全；块不再 mermaid 时还原原 children）。新增
tests/mermaid-markdown.spec.tsx 与 e2e 跨 fence 引用链接断言。

P2（fence 匹配）：支持 3+ 反引号与波浪号开 fence；闭 fence 须同字符且
长度不小于开 fence；反引号 info string 含反引号不视为开 fence；修复
带缩进开 fence 的 info 提取。blocks 单测 +3 例。
 2026-08-18 01:22:28 +08:00