kevin/deepseek-harness
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,028 Commits 1 Branch 0 Tags
d1ce22e7ad142f99dba86f94de0c353b43bc5a57
Commit Graph
6028 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
creatixchu d1ce22e7ad doc(packages): add the host/ and client/ group READMEs and table rows 
Both web-GUI groups shipped without the group README that the packages
table names as each group's canonical package/ctx-key map, and without
rows in that table. Adds both bilingual pairs, the two table rows
(ceiling 835→870: two genuinely new product groups joined the canonical
table at minimal row width), and fixes webserver README drift
(WebServerService/ctx.webServer → HttpServerService/ctx.httpServer,
matching src/index.ts).
 2026-07-28 15:04:59 +08:00
creatixchu 01d68dee4e fix(connection): fence every /api request behind one browser-trust check 
The only browser-trust guard covered host.pickDirectory, while the
consequential methods (session.prompt drives bash) accepted any Host —
open to DNS rebinding, where a rebound page reads and writes the API as
if same-origin and only the Host header betrays the attacker's domain.

The pickDirectory-specific loopback guard becomes a prefix-wide fence:
Host must be loopback or an exact host[:port] from the new trustedHosts
config, an attached Origin must equal that authority, and explicit
cross-site markers are refused; requests without browser markers (curl,
tests, native clients) pass, because without a browser there is no
confused deputy. The loopback-socket check is dropped — binding policy
expresses reachability, and the fence is not an auth layer. The Agent
Note records the full threat model and the alternatives.
 2026-07-28 14:56:45 +08:00
creatixchu d2fea6d789 fix(apiproxy): refuse non-JSON media types on /api POST bodies 
Browsers send "simple" POSTs (text/plain, form encodings) without a CORS
preflight, so a malicious page could execute side-effectful RPCs blind —
the response stays unreadable cross-origin, but session.prompt would
still run. The carrier now answers 415 unless the declared media type is
application/json, forcing every cross-site attempt into a preflight this
server never answers. Raw-fetch specs gain the header; a new handler case
proves the fence rejects before the impl runs.
 2026-07-28 14:40:13 +08:00
Tianyi Cui 4c6fb8b957 Merge pull request #794 from deepseek-harness/dependabot/github_actions/actions/upload-artifact-7 
chore(deps): bump actions/upload-artifact from 6 to 7
 2026-07-28 12:40:15 +08:00
Tianyi Cui f89fe5c259 Merge branch 'master' into dependabot/github_actions/actions/upload-artifact-7 2026-07-28 12:35:34 +08:00
Tianyi Cui 4ea537210b Merge pull request #777 from deepseek-harness/dependabot/npm_and_yarn/native/landlock-run/types/node-26.0.1 
chore(deps-dev): bump @types/node from 24.13.2 to 26.0.1 in /native/landlock-run
 2026-07-28 12:27:39 +08:00
Tianyi Cui 18653c029d Merge branch 'master' into dependabot/npm_and_yarn/native/landlock-run/types/node-26.0.1 2026-07-28 12:23:28 +08:00
Tianyi Cui 589e421220 Merge pull request #776 from deepseek-harness/dependabot/npm_and_yarn/native/landlock-run/typescript-6.0.3 
chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /native/landlock-run
 2026-07-28 12:15:39 +08:00
dependabot[bot] 305f185ede chore(deps): bump actions/upload-artifact from 6 to 7 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-28 04:13:32 +00:00
Tianyi Cui 5f6ba69e2b Merge branch 'master' into dependabot/npm_and_yarn/native/landlock-run/typescript-6.0.3 2026-07-28 12:11:50 +08:00
Tianyi Cui 10d8fc1dce Merge pull request #775 from deepseek-harness/dependabot/github_actions/actions/deploy-pages-5 
chore(deps): bump actions/deploy-pages from 4 to 5
 2026-07-28 12:11:27 +08:00
Tianyi Cui fb3b35d70b Merge branch 'master' into dependabot/github_actions/actions/deploy-pages-5 2026-07-28 12:06:30 +08:00
Tianyi Cui 1ffaeedd3b Merge pull request #770 from deepseek-harness/dependabot/github_actions/actions/configure-pages-6 
chore(deps): bump actions/configure-pages from 5 to 6
 2026-07-28 12:01:42 +08:00
Tianyi Cui b27a542149 Merge branch 'master' into dependabot/github_actions/actions/configure-pages-6 2026-07-28 11:56:00 +08:00
imccyu fe26d793c5 Merge pull request #746 from deepseek-harness/fix/todo-tool-ui 
refactor(todos): update TodoRow styling and logic, add IconChecklistOutline16, and enhance AssistantMarkdown rendering
 2026-07-28 11:35:36 +08:00
imccyu 8f13e09f31 Merge branch 'master' into fix/todo-tool-ui 2026-07-28 11:32:07 +08:00
07akioni 99d631d41a fix: ci 2026-07-28 11:21:45 +08:00
Yichen Jiang 2a46685414 Merge pull request #797 from deepseek-harness/worktree/tui-session-title-search 
fix(tui): search session references by title
 2026-07-28 11:17:15 +08:00
Yichen Jiang 2e6abdf8a7 Merge remote-tracking branch 'origin/master' into worktree/tui-session-title-search 2026-07-28 11:12:56 +08:00
Yichen Jiang 968e4d5312 Merge remote-tracking branch 'origin/master' into worktree/tui-session-title-search 
# Conflicts:
#	.agents/notes/implemented/feature/2026-07-21-cross-session-references.i18n.yaml
#	.agents/notes/implemented/feature/2026-07-21-cross-session-references.md
#	.agents/notes/implemented/feature/2026-07-21-cross-session-references.zh.md
#	packages/context/session-reference/README.i18n.yaml
#	packages/context/session-reference/README.md
#	packages/context/session-reference/README.zh.md
#	packages/context/session-reference/src/index.ts
 2026-07-28 11:11:57 +08:00
Tianyi Cui bbeaa9fb2e Merge pull request #790 from deepseek-harness/worktree/sdk-public-api 
fix(sdk): narrow TypeScript client interface
 2026-07-28 11:09:59 +08:00
Tianyi Cui cee7462994 Merge remote-tracking branch 'origin/master' into worktree/sdk-public-api 2026-07-28 11:06:00 +08:00
Yichen Jiang a43a2032ec fix(tui): search session references by title 2026-07-28 11:05:53 +08:00
Tianyi Cui 3f97b88ff9 Merge pull request #787 from deepseek-harness/worktree/change-scope-trim-20260728 
refactor(dev-infra): narrow change-scope contract
 2026-07-28 11:03:13 +08:00
Tianyi Cui 4bba60f726 Merge remote-tracking branch 'origin/master' into worktree/sdk-public-api 2026-07-28 11:03:06 +08:00
07akioni fb9495b21e Merge branch 'master' into fix/todo-tool-ui 2026-07-28 10:59:05 +08:00
Tianyi Cui e98c180062 Merge branch 'master' into worktree/change-scope-trim-20260728 2026-07-28 10:59:00 +08:00
Tianyi Cui b7abd1bb8b Merge branch 'master' into dependabot/github_actions/actions/configure-pages-6 2026-07-28 10:58:36 +08:00
Tianyi Cui 7efd0a1192 Merge branch 'master' into dependabot/npm_and_yarn/native/landlock-run/types/node-26.0.1 2026-07-28 03:03:00 +08:00
Tianyi Cui 283fcd6605 Merge branch 'master' into dependabot/npm_and_yarn/native/landlock-run/typescript-6.0.3 2026-07-28 02:58:20 +08:00
Tianyi Cui c4c142c855 Merge branch 'master' into dependabot/github_actions/actions/deploy-pages-5 2026-07-28 02:51:31 +08:00
Tianyi Cui c49c0ba497 Merge pull request #773 from deepseek-harness/dependabot/uv/python/sdk/hatchling-gte-1.30.1 
chore(deps-dev): update hatchling requirement from >=1.24.0 to >=1.30.1 in /python/sdk
 2026-07-28 02:47:37 +08:00
dependabot[bot] b2b063b667 chore(deps): bump actions/deploy-pages from 4 to 5 
Bumps [actions/deploy-pages](https://github.com/actions/deploy-pages) from 4 to 5.
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](https://github.com/actions/deploy-pages/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/deploy-pages
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-27 18:43:26 +00:00
Tianyi Cui 9803b1c62c Merge branch 'master' into dependabot/uv/python/sdk/hatchling-gte-1.30.1 2026-07-28 02:41:56 +08:00
Tianyi Cui a2f6f9db39 Merge pull request #772 from deepseek-harness/dependabot/github_actions/actions/setup-python-6.3.0 
chore(deps): bump actions/setup-python from 6 to 6.3.0
 2026-07-28 02:41:21 +08:00
Tianyi Cui d597cbf87a Merge branch 'master' into dependabot/github_actions/actions/setup-python-6.3.0 2026-07-28 02:36:09 +08:00
Tianyi Cui 67109cac49 Merge pull request #771 from deepseek-harness/dependabot/github_actions/actions/upload-pages-artifact-5 
chore(deps): bump actions/upload-pages-artifact from 4 to 5
 2026-07-28 02:35:33 +08:00
Tianyi Cui 8067ef8bd7 Merge branch 'master' into dependabot/github_actions/actions/upload-pages-artifact-5 2026-07-28 02:28:25 +08:00
Tianyi Cui 69c60d6ad6 Merge branch 'master' into dependabot/github_actions/actions/configure-pages-6 2026-07-28 02:25:00 +08:00
Tianyi Cui 6c6dd37d4f Merge pull request #741 from deepseek-harness/codex/ignore-worktree-directories 
chore: ignore worktree directories
 2026-07-28 02:15:51 +08:00
Tianyi Cui 629f1c638b Merge branch 'master' into worktree/sdk-public-api 2026-07-28 02:11:10 +08:00
Tianyi Cui 4da9876b30 Merge current master into codex/ignore-worktree-directories 2026-07-28 02:11:08 +08:00
Tianyi Cui 547c0ab55e Merge pull request #728 from deepseek-harness/codex/fix-acp-snapshot-refresh-volatiles 
fix(snapshot): stabilize refresh volatiles
 2026-07-28 01:57:40 +08:00
Tianyi Cui 7503fa896f fix(snapshot): pass refresh context in SDK snapshots 2026-07-28 01:43:40 +08:00
Tianyi Cui 3b5be72086 fix(sdk): narrow TypeScript client interface 2026-07-28 01:41:32 +08:00
Tianyi Cui 1a623946b9 Merge current master with codex/fix-acp-snapshot-refresh-volatiles 2026-07-28 01:36:32 +08:00
Tianyi Cui a1401349d8 Merge remote-tracking branch 'origin/master' into worktree/change-scope-trim-20260728 2026-07-28 01:26:55 +08:00
Tianyi Cui fed1b23eac Merge pull request #726 from deepseek-harness/fix/pty-handoff-grace 
fix(pty-local): make the foreground-handoff grace a config field
 2026-07-28 01:26:27 +08:00
Tianyi Cui f6a850b107 Merge remote-tracking branch 'origin/master' into worktree/change-scope-trim-20260728 2026-07-28 01:21:25 +08:00
Tianyi Cui 9ebd0075e9 Merge master into fix/pty-handoff-grace 2026-07-28 01:19:58 +08:00