{name}
+ data-error={phase === 'error' || phase === 'revealError' || phase === 'nativeUnavailable' ? true : undefined}>
{status}
{t('presented.preview')}
diff --git a/packages/client/ui-deliverables/src/client/locales.ts b/packages/client/ui-deliverables/src/client/locales.ts
index 5b9fa7781d..1e4d78f8c1 100644
--- a/packages/client/ui-deliverables/src/client/locales.ts
+++ b/packages/client/ui-deliverables/src/client/locales.ts
@@ -5,6 +5,7 @@ export const NS = 'deliverables'
/** Simplified Chinese dictionary (the key-set source of truth). */
export const zh = {
+ 'presented.nativeUnavailable': '此文件没有可用的主机路径，请在侧边栏预览',
'presented.revealError': '无法在文件管理器中显示，请重试',
'presented.directoryError': '无法打开所在文件夹，请重试',
'presented.directoryOpening': '正在打开所在文件夹…',
@@ -46,6 +47,7 @@ export const zh = {
/** English dictionary (same key set). */
export const en: Record
= {
+ 'presented.nativeUnavailable': 'This file has no available Host path. Preview it in the sidebar.',
'presented.revealError': 'Could not show in file manager. Try again.',
'presented.directoryError': 'Could not open containing folder. Try again.',
'presented.directoryOpening': 'Opening containing folder…',
diff --git a/packages/client/ui-deliverables/src/client/present-open.ts b/packages/client/ui-deliverables/src/client/present-open.ts
index bb47634011..8e66b380c0 100644
--- a/packages/client/ui-deliverables/src/client/present-open.ts
+++ b/packages/client/ui-deliverables/src/client/present-open.ts
@@ -4,7 +4,7 @@ import type { SessionId } from '@deepseek-ai/dsh-session/types'
import { presentedFileUrl, PRESENT_HOST_PATH, isPresentedHost, type PresentedAction, type PresentedHost } from '../presented.ts'
/** State of the latest explicit open gesture for one saved file. */
-export type PresentedOpenPhase = 'opening' | 'opened' | 'revealing' | 'revealed' | 'error' | 'revealError'
+export type PresentedOpenPhase = 'opening' | 'opened' | 'revealing' | 'revealed' | 'error' | 'revealError' | 'nativeUnavailable'
/** One browser plugin's file-open requests, cancelled when that plugin is disposed. */
export class PresentedOpenController {
@@ -18,7 +18,7 @@ export class PresentedOpenController {
private readonly pending = new Set>()
/**
- * Open a declared workspace file once while a request for the same coordinates is pending.
+ * Open a declared file once while a request for the same coordinates is pending.
* Failures remain visible on the card and a later gesture retries them.
* @param sessionId - viewed Session, including a fork's own identity.
* @param seq - durable delivery event sequence.
@@ -93,7 +93,7 @@ export class PresentedOpenController {
let phase: PresentedOpenPhase = action === 'open' ? 'opened' : 'revealed'
try {
const response = await fetch(action === 'open' ? url : `${url}&action=reveal`, { method: 'POST', signal: this.lifetime.signal })
- if (!response.ok) phase = failure
+ if (!response.ok) phase = response.status === 422 ? 'nativeUnavailable' : failure
} catch {
// Transport failures share the retryable card state with Host open failures.
phase = failure
diff --git a/packages/client/ui-deliverables/src/index.ts b/packages/client/ui-deliverables/src/index.ts
index 4239299e63..ee4ef63a40 100644
--- a/packages/client/ui-deliverables/src/index.ts
+++ b/packages/client/ui-deliverables/src/index.ts
@@ -1,7 +1,7 @@
/**
* Deliverables plugin, node half. Registers the response-format guidance that
* lets the browser half recognize final-response file references and serves
- * authenticated native opens of workspace files. The browser
+ * authenticated native opens of declared files. The browser
* half ships via exports["./client"], discovered through the package.json
* dsh.client declaration.
*/
@@ -10,8 +10,8 @@ import type { Context } from '@deepseek-ai/cordis'
import type {} from '@deepseek-ai/dsh-system-prompt'
import { registerPresentOpen } from './present-open.ts'
-/** Services required for file-reference guidance and authenticated native opens of workspace files. */
-export const inject = ['systemPrompt', 'connection', 'sessionQuery', 'sessionController']
+/** Services required for file-reference guidance and authenticated native opens of declared files. */
+export const inject = ['systemPrompt', 'connection', 'sessionQuery', 'sessionController', 'workspaceFiles', 'fs']
/** Stable final-response guidance owned by the matching renderer. */
const FILE_REFERENCE_PROMPT = 'When you successfully create or modify files, mention the primary outputs in your final response. '
diff --git a/packages/client/ui-deliverables/src/present-open.ts b/packages/client/ui-deliverables/src/present-open.ts
index ba5880a0e9..97aab3242a 100644
--- a/packages/client/ui-deliverables/src/present-open.ts
+++ b/packages/client/ui-deliverables/src/present-open.ts
@@ -1,8 +1,9 @@
-/** Open declared source files inside the viewed Session's workspace. */
-import { realpath, stat } from 'node:fs/promises'
-import { isAbsolute, relative, resolve, sep } from 'node:path'
+/** Open declared source files verified by the viewed Session's filesystem. */
import type { Context } from '@deepseek-ai/cordis'
import type {} from '@deepseek-ai/dsh-api-session-controller'
+import type {} from '@deepseek-ai/dsh-api-workspace-files'
+import type {} from '@deepseek-ai/dsh-fs'
+import { remoteErrorOf } from '@deepseek-ai/dsh-typert-protocol'
import type {} from '@deepseek-ai/dsh-client-connection'
import type {} from '@deepseek-ai/dsh-session-query'
import type { SessionId, SessionSeq } from '@deepseek-ai/dsh-session'
@@ -53,27 +54,31 @@ async function handlePresentOpen(ctx: Context, request: Request): Promise {
+ vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response(null, { status: 422 })))
+ const controller = new PresentedOpenController()
+ await controller.open(id, 2, 1, action)
+ expect(controller.state.getSnapshot()[url]).toBe('nativeUnavailable')
+ await controller.dispose()
+})
diff --git a/packages/client/ui-deliverables/tests/present-open.host.spec.ts b/packages/client/ui-deliverables/tests/present-open.host.spec.ts
index fc12bc71d3..346ce60279 100644
--- a/packages/client/ui-deliverables/tests/present-open.host.spec.ts
+++ b/packages/client/ui-deliverables/tests/present-open.host.spec.ts
@@ -2,6 +2,10 @@
import { mkdtemp, rm, readFile, writeFile, mkdir, realpath, symlink, unlink } from 'node:fs/promises'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import { LocalFileSystem } from '@deepseek-ai/dsh-fs-local'
+import { WorkspaceFiles } from '@deepseek-ai/dsh-api-workspace-files'
+import { RemoteError } from '@deepseek-ai/dsh-typert-protocol'
import { Context } from '@deepseek-ai/cordis'
import { HostConnectionService } from '@deepseek-ai/dsh-client-connection'
import type { BrowserAuth } from '@deepseek-ai/dsh-client-connection/src/browser-auth.ts'
@@ -30,6 +34,11 @@ async function fixture() {
const ctx = new Context()
cleanups.push(() => ctx.fiber.dispose())
const session: { cwd?: string } = { cwd }
+ await ctx.plugin(LocalFileSystem, { cwd })
+ ctx.provide('sandboxPolicy', { resolve: () => ({ workspaceRoot: session.cwd ?? cwd }) } as never)
+ new WorkspaceFiles(ctx, { maxBytes: 1024, maxFileBytes: 1024, maxLines: 100, maxEntries: 100 })
+ const agent = { ctx, session: { header: session } } as unknown as Agent
+ const resolveAgent = vi.fn(async () => ({ agent }))
const readEvent = vi.fn(async (request: SessionEventReadRequest) => {
if (request.sessionId !== 'owner') throw new SessionQueryError('missing', 'SESSION_QUERY_SESSION_NOT_FOUND')
if (request.seq !== 7) throw new SessionQueryError('missing', 'SESSION_QUERY_EVENT_NOT_FOUND')
@@ -37,15 +46,15 @@ async function fixture() {
})
ctx.provide('sessionQuery', { readEvent } as never)
const opener = vi.fn(async (_request: { path: string; action?: 'reveal' }, _signal: AbortSignal) => ({ opened: true as const }))
- ctx.provide('sessionController', { openWorkspacePath: opener, workspaceDesktop: () => ({ name: 'desktop', available: true, fileManager: 'finder' }) } as never)
+ ctx.provide('sessionController', { resolveAgent, openWorkspacePath: opener, workspaceDesktop: () => ({ name: 'desktop', available: true, fileManager: 'finder' }) } as never)
const connection = new HostConnectionService(ctx, [], {} as BrowserAuth)
- const fiber = ctx.plugin({ inject: ['connection', 'sessionQuery', 'sessionController'], apply: registerPresentOpen })
+ const fiber = ctx.plugin({ inject: ['connection', 'sessionQuery', 'sessionController', 'workspaceFiles', 'fs'], apply: registerPresentOpen })
await fiber
const handler = connection.createSharedFetchHandler('/api')
const open = (query = '?sessionId=owner&seq=7&index=0', signal?: AbortSignal) => handler.fetch(new Request(
`http://localhost${PRESENT_OPEN_PATH}${query}`, { method: 'POST', signal: signal ?? null },
))
- return { root, cwd, ctx, fiber, file, session, readEvent, open, opener, handler }
+ return { root, cwd, ctx, fiber, file, session, readEvent, open, opener, handler, resolveAgent }
}
describe('Presented workspace file native open route', () => {
@@ -75,7 +84,8 @@ describe('Presented workspace file native open route', () => {
const fork = join(root, 'fork')
await mkdir(fork)
await writeFile(join(fork, file.path), 'child source')
- readEvent.mockResolvedValueOnce({ session: { ...session, cwd: fork }, target: { type: 'deliverables/presented', data: { turn: 1, callId: 'inherited', files: [file] } } as SessionEvent })
+ session.cwd = fork
+ readEvent.mockResolvedValueOnce({ session, target: { type: 'deliverables/presented', data: { turn: 1, callId: 'inherited', files: [file] } } as SessionEvent })
expect((await open('?sessionId=fork&seq=7&index=0')).status).toBe(204)
expect(opener.mock.lastCall?.[0].path).toBe(await realpath(join(fork, file.path)))
})
@@ -109,30 +119,29 @@ describe('Presented workspace file native open route', () => {
expect(opener).not.toHaveBeenCalled()
})
- it('reports removed files, directories, and absent workspaces without launching', async () => {
- const { cwd, file, session, open, opener } = await fixture()
+ it('reports removed files and directories without launching', async () => {
+ const { cwd, file, open, opener } = await fixture()
await unlink(join(cwd, file.path))
expect((await open()).status).toBe(404)
file.path = '.'
expect((await open()).status).toBe(404)
- delete session.cwd
- expect((await open()).status).toBe(404)
expect(opener).not.toHaveBeenCalled()
})
- it('refuses traversal and a source replaced by a symlink outside the workspace', async () => {
+ it('opens external regular files through absolute and relative paths but refuses final symlinks', async () => {
const { root, cwd, file, open, opener } = await fixture()
const outside = join(root, 'outside.txt')
await writeFile(outside, 'outside')
const source = join(cwd, file.path)
await unlink(source)
await symlink(outside, source)
- expect((await open()).status).toBe(403)
- file.path = '../outside.txt'
- expect((await open()).status).toBe(403)
- file.path = outside
- expect((await open()).status).toBe(403)
+ expect((await open()).status).toBe(404)
expect(opener).not.toHaveBeenCalled()
+ for (const path of ['../outside.txt', outside]) {
+ file.path = path
+ expect((await open()).status).toBe(204)
+ expect(opener.mock.lastCall?.[0].path).toBe(await realpath(outside))
+ }
})
it('reports query and launcher failures without leaking Host paths and allows retry', async () => {
@@ -186,7 +195,7 @@ it('reports the serving desktop and reveals only an authorized declared source',
expect(opener).toHaveBeenCalledWith({ path: await realpath(join(cwd, file.path)), action: 'reveal' }, expect.any(AbortSignal))
expect((await open('?sessionId=owner&seq=7&index=0&action=delete')).status).toBe(400)
file.path = '..'
- expect((await open('?sessionId=owner&seq=7&index=0&action=reveal')).status).toBe(403)
+ expect((await open('?sessionId=owner&seq=7&index=0&action=reveal')).status).toBe(404)
expect(opener).toHaveBeenCalledOnce()
})
@@ -199,3 +208,32 @@ it('refuses native actions when the configured Host desktop is unavailable', asy
}
expect(opener).not.toHaveBeenCalled()
})
+
+
+it('refuses native opening without a matching Host mapping even when a same-name Host file exists', async () => {
+ const { ctx, open, opener } = await fixture()
+ const mapping = vi.spyOn(ctx.fs, 'processPathFromHostPath').mockReturnValue(undefined)
+ expect((await open()).status).toBe(422)
+ mapping.mockReturnValue('/another-filesystem/file')
+ expect((await open()).status).toBe(422)
+ expect(opener).not.toHaveBeenCalled()
+})
+
+it('reports Session resolution failures before checking files', async () => {
+ const { resolveAgent, open, opener } = await fixture()
+ resolveAgent.mockResolvedValueOnce({ error: new RemoteError('session/not-found', 'missing', { sessionId: SessionId('owner') }) })
+ expect((await open()).status).toBe(404)
+ expect(opener).not.toHaveBeenCalled()
+})
+
+
+it('uses the resolved Agent filesystem instead of the Host filesystem', async () => {
+ const { ctx, cwd, open, resolveAgent, opener } = await fixture()
+ const scoped = ctx.isolate('fs')
+ await scoped.plugin(LocalFileSystem, { cwd })
+ vi.spyOn(scoped.fs, 'processPathFromHostPath').mockReturnValue(undefined)
+ resolveAgent.mockResolvedValueOnce({ agent: { ctx: scoped, session: { header: { cwd } } } as unknown as Agent })
+ expect((await open()).status).toBe(422)
+ expect(opener).not.toHaveBeenCalled()
+ expect((await open()).status).toBe(204)
+})
diff --git a/packages/client/ui-deliverables/tests/prompt.host.spec.ts b/packages/client/ui-deliverables/tests/prompt.host.spec.ts
index 8f342099fd..e168303128 100644
--- a/packages/client/ui-deliverables/tests/prompt.host.spec.ts
+++ b/packages/client/ui-deliverables/tests/prompt.host.spec.ts
@@ -19,6 +19,8 @@ describe('ui-deliverables node plugin', () => {
ctx.provide('connection', { fetch: { register: () => () => {} } } as never)
ctx.provide('sessionQuery', {} as never)
ctx.provide('sessionController', {} as never)
+ ctx.provide('workspaceFiles', {} as never)
+ ctx.provide('fs', {} as never)
const mounted = ctx.plugin({ apply, inject })
await mounted.await()
diff --git a/packages/client/ui-deliverables/tsconfig.host.json b/packages/client/ui-deliverables/tsconfig.host.json
index 0123290583..ee8f384dd8 100644
--- a/packages/client/ui-deliverables/tsconfig.host.json
+++ b/packages/client/ui-deliverables/tsconfig.host.json
@@ -34,6 +34,15 @@
},
{
"path": "../../api/session-controller/tsconfig.host.json"
+ },
+ {
+ "path": "../../api/workspace-files/tsconfig.host.json"
+ },
+ {
+ "path": "../../fs/fs"
+ },
+ {
+ "path": "../../typert/protocol"
}
]
}
diff --git a/packages/fs/tool-present/README.i18n.yaml b/packages/fs/tool-present/README.i18n.yaml
index d1453cce74..22c9c3dd2d 100644
--- a/packages/fs/tool-present/README.i18n.yaml
+++ b/packages/fs/tool-present/README.i18n.yaml
@@ -2,5 +2,5 @@
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write packages/fs/tool-present/README.md
-README.md: 77c1a83a30bdbe58b3be35d8bc0d879f1669b5a5
-README.zh.md: cec2d64b4e6f95a4e8210e7e24a9c796ed95d749
+README.md: 93003711545f678336a02c9bf8589176f844af65
+README.zh.md: 152ba39be7184ca536a56ed9b4cfb5dfa4a5fe82
diff --git a/packages/fs/tool-present/README.md b/packages/fs/tool-present/README.md
index 77c1a83a30..9300371154 100644
--- a/packages/fs/tool-present/README.md
+++ b/packages/fs/tool-present/README.md
@@ -1,5 +1,5 @@
---
-description: "Declare workspace files as deliverables with present; configuration, Session ownership, and source-file opening."
+description: "Declare accessible files as deliverables with present; configuration, Session ownership, and source-file opening."
kind: "package-reference"
---
@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
## Summary
-Use `present` to declare final workspace files, including files created through shell commands. Users open the current source files in their default application. The tool records paths and optional descriptions without copying file contents.
+Use `present` to declare final files accessible through the Session filesystem, including files created through shell commands. Users open the current source files in their default application. The tool records paths and optional descriptions without copying file contents.
## Table of Contents
@@ -25,7 +25,7 @@ Use `present` to declare final workspace files, including files created through
## Use this package
-The `standard`, `ptc`, and `cordis` agent presets mount this plugin. Call `present` with `files: [{ path, description? }]` after creating the files. Files must exist inside the Session workspace and be regular files. Missing files, directories, and paths outside the workspace fail the call.
+The `standard`, `ptc`, and `cordis` agent presets mount this plugin. Call `present` with `files: [{ path, description? }]` after creating the files. Files must be regular files accessible through the Session filesystem. Relative paths resolve against the Session working directory; absolute paths may name files outside it, including `/tmp` or Downloads. Missing files, directories, final symbolic links, and provider-denied paths fail the call. Files in a shell sandbox’s private `/tmp` must first be written somewhere the Session filesystem can access.
Mount it in an agent's Cordis composition with `tools`, `fs`, and the `turnBoundary` Session projection available:
@@ -49,7 +49,7 @@ The file-count limit is validated at mount. The tool requires an agent Session w
Implementation internals — click to expand
-The tool resolves paths through the configured filesystem provider and checks workspace containment and regular-file metadata without reading contents. Successful final `tools/result` notifications append `deliverables/presented`, including nested calls. A later enclosing program failure does not revoke an already completed declaration. Blocked results publish none. Each plugin instance records only calls it executed; scoped tools with the same name cannot publish through another instance.
+The tool resolves paths through the configured filesystem provider and checks regular-file metadata without reading contents. Successful final `tools/result` notifications append `deliverables/presented`, including nested calls. A later enclosing program failure does not revoke an already completed declaration. Blocked results publish none. Each plugin instance records only calls it executed; scoped tools with the same name cannot publish through another instance.
The pure `./types` entry declares `PresentedFile` and the Session event without importing Host runtime code. The Web consumer validates persisted declarations before displaying or opening them. The event stores no Session ID, so forked history resolves relative paths against the viewed Session's workspace.
@@ -73,7 +73,7 @@ The pure `./types` entry declares `PresentedFile` and the Session event without
#### What the model sees
-The [present schema](../../../docs/tool-catalog.md#present) asks for existing workspace files: “Declare existing workspace files as final deliverables. When a file you create or update is an output the user asked to receive, you must call present after writing it and before your final response, including files created through Bash or code execution. Mentioning its path in your reply does not replace this call. The files must already exist. The user opens the current source files; their contents are not copied or preserved.” Results report `Presented ` for each file; the program result and durable event contain paths and optional descriptions.
+The [present schema](../../../docs/tool-catalog.md#present) asks for existing accessible files: “Declare existing files accessible through the Session filesystem as final deliverables. When a file you create or update is an output the user asked to receive, you must call present after writing it and before your final response, including files created through Bash or code execution. Mentioning its path in your reply does not replace this call. The files must already exist. The user opens the current source files; their contents are not copied or preserved.” Results report `Presented ` for each file; the program result and durable event contain paths and optional descriptions.
#### Token effect
@@ -87,7 +87,7 @@ The tool schema is static for the mount lifetime. Delivery result text extends t
-- Path containment checks are best effort; they cannot atomically defend against a concurrent symlink replacement before the desktop application opens the file.
+- Metadata and Host-path checks cannot atomically prevent replacement before a desktop application opens a file.
- Edits change what opens. Deleted or moved source files cannot be opened from their declarations.
- Session ZIP exports contain declarations, not file contents. Persistent delivery versions and copy-on-write storage are deferred.
diff --git a/packages/fs/tool-present/README.zh.md b/packages/fs/tool-present/README.zh.md
index cec2d64b4e..152ba39be7 100644
--- a/packages/fs/tool-present/README.zh.md
+++ b/packages/fs/tool-present/README.zh.md
@@ -1,5 +1,5 @@
---
-description: "通过 present 声明交付工作区文件；配置、Session 归属与源文件打开。"
+description: "通过 present 声明交付可访问的文件；配置、Session 归属与源文件打开。"
kind: "package-reference"
---
@@ -9,7 +9,7 @@ kind: "package-reference"
## 概述
-使用 `present` 声明交付最终工作区文件，包括通过 shell 命令创建的文件。用户使用默认应用打开当前源文件。工具记录路径和可选说明，不复制文件内容。
+使用 `present` 声明交付Session 文件系统可访问的最终文件，包括通过 shell 命令创建的文件。用户使用默认应用打开当前源文件。工具记录路径和可选说明，不复制文件内容。
## 目录
@@ -25,7 +25,7 @@ kind: "package-reference"
## 使用本包
-`standard`、`ptc` 与 `cordis` Agent preset 挂载本插件。创建文件后，以 `files: [{ path, description? }]` 调用 `present`。文件必须存在于 Session 工作区内，且为普通文件。文件缺失、为目录或路径位于工作区外时，调用失败。
+`standard`、`ptc` 与 `cordis` Agent preset 挂载本插件。创建文件后，以 `files: [{ path, description? }]` 调用 `present`。文件必须是 Session 文件系统可访问的普通文件。相对路径按 Session 工作目录解析；绝对路径可以指向工作区外的文件，包括 `/tmp` 或 Downloads。文件缺失、为目录、最终路径为符号链接或提供方拒绝访问时，调用失败。Shell 沙箱私有 `/tmp` 中的文件需要先写入 Session 文件系统可访问的位置。
在 Agent 的 Cordis 组合中挂载，并提供 `tools`、`fs` 和 `turnBoundary` Session 投影：
@@ -49,7 +49,7 @@ kind: "package-reference"
实现细节——点击展开
-工具通过配置的文件系统提供方解析路径，检查工作区包含关系和普通文件元数据，不读取内容。成功的最终 `tools/result` 通知追加 `deliverables/presented`，嵌套调用也适用。外层程序随后失败不会撤销已完成的声明。被阻止的结果不发布声明。每个插件实例只记录其实际执行的调用；同名作用域工具不能通过其他实例发布交付。
+工具通过配置的文件系统提供方解析路径，检查普通文件元数据，不读取内容。成功的最终 `tools/result` 通知追加 `deliverables/presented`，嵌套调用也适用。外层程序随后失败不会撤销已完成的声明。被阻止的结果不发布声明。每个插件实例只记录其实际执行的调用；同名作用域工具不能通过其他实例发布交付。
纯 `./types` 入口声明 `PresentedFile` 与 Session 事件，不导入 Host 运行时代码。Web 消费方在展示或打开文件前校验持久声明。事件不保存 Session ID，因此 fork 历史中的相对路径按当前查看的 Session 工作区解析。
@@ -73,7 +73,7 @@ kind: "package-reference"
#### 模型看到的内容
-[present schema](../../../docs/tool-catalog.zh.md#present)要求已有的工作区文件：“Declare existing workspace files as final deliverables. When a file you create or update is an output the user asked to receive, you must call present after writing it and before your final response, including files created through Bash or code execution. Mentioning its path in your reply does not replace this call. The files must already exist. The user opens the current source files; their contents are not copied or preserved.” 每个文件的结果为 `Presented `；程序结果和持久事件包含路径及可选说明。
+[present schema](../../../docs/tool-catalog.zh.md#present)要求已有且可访问的文件：“Declare existing files accessible through the Session filesystem as final deliverables. When a file you create or update is an output the user asked to receive, you must call present after writing it and before your final response, including files created through Bash or code execution. Mentioning its path in your reply does not replace this call. The files must already exist. The user opens the current source files; their contents are not copied or preserved.” 每个文件的结果为 `Presented `；程序结果和持久事件包含路径及可选说明。
#### Token 影响
@@ -87,7 +87,7 @@ kind: "package-reference"
-- 路径包含关系检查是尽力而为的；无法原子防御桌面应用打开文件前发生的并发符号链接替换。
+- 元数据和 Host 路径检查无法原子性地阻止桌面应用打开文件前发生的路径替换。
- 编辑会改变打开的内容。源文件删除或移动后，无法通过原声明打开。
- Session ZIP 导出包含声明，不包含文件内容。交付版本持久化和写时复制存储延期实现。
diff --git a/packages/fs/tool-present/src/index.ts b/packages/fs/tool-present/src/index.ts
index b898c5671a..626006e17b 100644
--- a/packages/fs/tool-present/src/index.ts
+++ b/packages/fs/tool-present/src/index.ts
@@ -1,4 +1,4 @@
-/** Scoped tool that declares workspace file deliveries in their owning Session. */
+/** Scoped tool that declares filesystem deliveries in their owning Session. */
import type { Context } from '@deepseek-ai/cordis'
import z from '@deepseek-ai/schemastery'
import { FsError } from '@deepseek-ai/dsh-fs'
@@ -37,7 +37,7 @@ export function apply(ctx: Context, config: Config): void {
const pending = new WeakMap()
ctx.tools.register(defineTool({
name: 'present',
- description: 'Declare existing workspace files as final deliverables. '
+ description: 'Declare existing files accessible through the Session filesystem as final deliverables. '
+ 'When a file you create or update is an output the user asked to receive, you must call present after writing it and before your final response, including files created through Bash or code execution. '
+ 'Mentioning its path in your reply does not replace this call. The files must already exist. '
+ 'The user opens the current source files; their contents are not copied or preserved.',
@@ -47,7 +47,7 @@ export function apply(ctx: Context, config: Config): void {
items: {
type: 'object', additionalProperties: false,
properties: {
- path: { type: 'string', required: true, description: 'Path of an existing file inside the workspace.' },
+ path: { type: 'string', required: true, description: 'Path of an existing regular file. Relative paths use the Session working directory.' },
description: { type: 'string', description: 'Brief description for the user.' },
},
},
@@ -80,12 +80,12 @@ export function apply(ctx: Context, config: Config): void {
const cwd = exec.agent.session.header.cwd
if (cwd === undefined) throw new Error('present requires a workspace')
const options = { cwd, signal: exec.signal }
- const root = await ctx.fs.resolve('.', options)
const files: PresentedFile[] = []
for (const file of args.files) {
if (file.path.trim().length === 0) throw new Error('present requires a non-empty file path')
+ const entry = await ctx.fs.lstat(file.path, { cwd }, exec.signal)
+ if (entry !== undefined && entry.type !== 'file') throw new Error(`Cannot present ${file.path}: not a regular file`)
const target = await ctx.fs.resolve(file.path, options)
- if (!ctx.fs.contains(root, target)) throw new Error(`Cannot present ${file.path}: outside the workspace`)
const info = await ctx.fs.stat(target, exec.signal)
if (info === undefined) throw new FsError(`Cannot present ${file.path}: file not found. Check the path, create the file if needed, and retry.`, 'FS_NOT_FOUND')
if (info.type !== 'file') throw new Error(`Cannot present ${file.path}: not a regular file`)
diff --git a/packages/fs/tool-present/src/types.ts b/packages/fs/tool-present/src/types.ts
index 796f0104ab..04d8aba451 100644
--- a/packages/fs/tool-present/src/types.ts
+++ b/packages/fs/tool-present/src/types.ts
@@ -1,9 +1,9 @@
/** Durable file deliveries produced by the present tool. */
import type { ToolCallId } from '@deepseek-ai/dsh-llm/brand'
-/** A declared workspace file whose current contents remain at its source path. */
+/** A declared filesystem file whose current contents remain at its source path. */
export interface PresentedFile {
- /** Original workspace path. */
+ /** Original absolute path or path relative to the Session working directory. */
path: string
/** Optional description supplied by the model. */
description?: string
@@ -11,7 +11,7 @@ export interface PresentedFile {
declare module '@deepseek-ai/dsh-session/types' {
interface SessionEventMap {
- /** Declared workspace files from a successful final present result, including nested calls. */
+ /** Declared filesystem files from a successful final present result, including nested calls. */
'deliverables/presented': { turn: number; callId: ToolCallId; files: PresentedFile[] }
}
}
diff --git a/packages/fs/tool-present/tests/present.spec.ts b/packages/fs/tool-present/tests/present.spec.ts
index 95606e09dc..0f219f7b14 100644
--- a/packages/fs/tool-present/tests/present.spec.ts
+++ b/packages/fs/tool-present/tests/present.spec.ts
@@ -1,7 +1,7 @@
/** Explicit deliveries commit only after a successful final tool result. */
import { mkdtemp, rm, writeFile, symlink } from 'node:fs/promises'
import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { join, relative } from 'node:path'
import { afterEach, describe, expect, it, vi } from 'vitest'
import { Context } from '@deepseek-ai/cordis'
import AgentRegistry, { type Agent } from '@deepseek-ai/dsh-agent'
@@ -133,7 +133,7 @@ describe('present', () => {
expect(owner.session.snapshotEvents().some(event => event.type === 'deliverables/presented')).toBe(false)
})
- it('rejects missing, non-file, outside-workspace, empty, and excessive inputs', async () => {
+ it('rejects missing, non-file, empty, and excessive inputs', async () => {
const { root, owner, execute } = await setup()
await writeFile(join(root, 'large'), 'four')
await symlink(tmpdir(), join(root, 'outside'))
@@ -165,3 +165,31 @@ it('requires an agent, an open turn, and a workspace', async () => {
const absent = await ctx.tools.execute({ signal: new AbortController().signal, callId: ToolCallId('no-workspace'), name: 'present', arguments: { files: [{ path: 'a' }] }, agent: noWorkspace })
expect(absent.isError).toBe(true)
})
+
+
+it('declares readable files outside the Session directory using absolute and relative paths', async () => {
+ const { root, execute, owner } = await setup()
+ const outside = await mkdtemp(join(tmpdir(), 'dsh-present-external-'))
+ cleanups.push(() => rm(outside, { recursive: true, force: true }))
+ const file = join(outside, 'report.txt')
+ await writeFile(file, 'external report')
+ const files = [{ path: file }, { path: relative(root, file) }]
+ expect((await execute(files)).isError).toBe(false)
+ expect(owner.session.snapshotEvents().find(event => event.type === 'deliverables/presented')?.data.files).toEqual(files)
+})
+
+it('refuses a final symlink to an ordinary file', async () => {
+ const { root, execute } = await setup()
+ await writeFile(join(root, 'source'), 'source')
+ await symlink(join(root, 'source'), join(root, 'link'))
+ expect((await execute([{ path: 'link' }])).isError).toBe(true)
+})
+
+
+it('refuses a file replaced by a directory after inspecting its final component', async () => {
+ const { ctx, root, execute } = await setup()
+ await writeFile(join(root, 'source'), 'source')
+ const directory = await ctx.fs.stat(await ctx.fs.resolve(root))
+ vi.spyOn(ctx.fs, 'stat').mockResolvedValueOnce(directory)
+ expect((await execute([{ path: 'source' }])).isError).toBe(true)
+})
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b94d4efb64..6cfebbe630 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -2687,12 +2687,18 @@ importers:
'@deepseek-ai/cordis':
specifier: workspace:^
version: link:../../../vendor/cordis
+ '@deepseek-ai/dsh-agent':
+ specifier: workspace:^
+ version: link:../../core/agent
'@deepseek-ai/dsh-api-remotes':
specifier: workspace:^
version: link:../../api/remotes
'@deepseek-ai/dsh-api-session-controller':
specifier: workspace:^
version: link:../../api/session-controller
+ '@deepseek-ai/dsh-api-workspace-files':
+ specifier: workspace:^
+ version: link:../../api/workspace-files
'@deepseek-ai/dsh-client-connection':
specifier: workspace:^
version: link:../connection
@@ -2723,6 +2729,12 @@ importers:
'@deepseek-ai/dsh-client-ui-tool':
specifier: workspace:^
version: link:../ui-tool
+ '@deepseek-ai/dsh-fs':
+ specifier: workspace:^
+ version: link:../../fs/fs
+ '@deepseek-ai/dsh-fs-local':
+ specifier: workspace:^
+ version: link:../../fs/fs-local
'@deepseek-ai/dsh-llm':
specifier: workspace:^
version: link:../../llm/llm
@@ -2738,6 +2750,9 @@ importers:
'@deepseek-ai/dsh-tool-present':
specifier: workspace:^
version: link:../../fs/tool-present
+ '@deepseek-ai/dsh-typert-protocol':
+ specifier: workspace:^
+ version: link:../../typert/protocol
'@deepseek-ai/dsh-util-workspace-path':
specifier: workspace:^
version: link:../../util/workspace-path