WHC
6e81513e36
A second implementation of cst_agent_hooks_t next to the TUI: the turn runs on a worker thread, the hooks publish events into a ring buffer that SSE clients read, so the engine itself needs no changes. - src/net.c, include/cst_net.h: POSIX/Winsock sockets, non-blocking connect - src/http_srv.c, include/cst_http.h: HTTP/1.1, keep-alive, chunked streaming, body caps (413), Expect: 100-continue, connection cap, exact routing - src/web_md.c, include/cst_web_md.h: streaming markdown -> sanitized HTML (tag/attribute allowlist, javascript: URLs and off-site images dropped) - src/webui.c, include/cst_webui.h: event ring + SSE broadcast, all routes, token (Bearer/Cookie/query) and loopback Host checks, 3 s auto-deny when no client is attached - src/webui_stub.c, CST_WEBUI=0 / CST_BUILD_WEBUI=OFF: build without the WebUI - web/: no-build front end (transcript, approvals, todo, sessions, image upload, status bar) - docs/webui.md: engine API v1 - events, requests, security model - tests/test_webui.c, scripts/e2e_webui.sh: unit tests plus an end-to-end run driven by a recorded SSE stream (no API key needed) - src/main.c: --web --web-port --web-host --web-token --web-dev --web-open and CST_WEB_PORT/HOST/TOKEN/ROOT An empty POST body is now accepted without Content-Length (RFC 9112 6.3) so curl-driven clients can reach cancel/undo/compact/quit; CMakeList's core tests learned about sashidown and test_webui, and CST_WEBUI=0 defines CST_NO_WEBUI.
49 lines
1.8 KiB
C
49 lines
1.8 KiB
C
#ifndef CST_WEB_MD_H
|
|
#define CST_WEB_MD_H
|
|
|
|
/* Markdown for the WebUI: the same sashidown renderer the TUI uses, but
|
|
* HTML output with a strict allowlist.
|
|
*
|
|
* sashidown renders straight to HTML and escapes text, quotes and '&', so
|
|
* no raw markup can reach the browser. Two holes remain, and both matter
|
|
* because every byte rendered here comes from a model or a tool: a link's
|
|
* href keeps any scheme ("javascript:") and an image's src may point
|
|
* anywhere (a tracking pixel, or worse). cst_web_md_* therefore rewrites
|
|
* tags instead of passing them through: unknown tags are dropped, hrefs
|
|
* are limited to http/https/mailto/relative, and images to the session's
|
|
* own attachment endpoint.
|
|
*
|
|
* The streaming form renders confirmed HTML as the model talks, which is
|
|
* the CST property the project is built on: nothing is emitted before it
|
|
* is safe to emit. A tag split across two deltas is held back until its
|
|
* '>' arrives. */
|
|
|
|
#include <stddef.h>
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/* Called with chunks of sanitized HTML; return non-zero to stop. */
|
|
typedef int (*cst_web_md_emit_fn)(const char *html, size_t len, void *ud);
|
|
|
|
typedef struct cst_web_md cst_web_md_t;
|
|
|
|
cst_web_md_t *cst_web_md_new(cst_web_md_emit_fn emit, void *ud);
|
|
/* Feed model output. Returns 0, or -1 on OOM. */
|
|
int cst_web_md_feed(cst_web_md_t *s, const char *data, size_t len);
|
|
/* Flush the pending input and close the renderer. */
|
|
int cst_web_md_finish(cst_web_md_t *s);
|
|
void cst_web_md_free(cst_web_md_t *s);
|
|
|
|
/* One-shot: markdown -> sanitized HTML (malloc'd, never NULL on success). */
|
|
char *cst_web_md_html(const char *md, size_t len);
|
|
/* The sanitizer alone (tests, and any HTML that did not come from here). */
|
|
char *cst_web_md_sanitize(const char *html, size_t len);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif /* CST_WEB_MD_H */
|