Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Gen UI] Inline visualize cards always fail on SSH remote executors (desktop-attached-remote): "Gen UI file is outside the host output directory"

Aperta
  • Qualcosa non va?
#76 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
43/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
javascript, node.js
Ambito
backend, desktop

Direzione di ricerca

Start with packages/services/src/gen-ui/adapters/files.ts and the readGenUiDocument path described in the report, then read docs/architecture/r2-server-cli-and-daemon.md to confirm executor ownership. Trace how desktop-attached remote reads reach the executor and compare that with the local validation path. Done when the remote executor validates the file against its output root and returns its HTML for the client card to render.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Note: filed here because github.com/zai-org/ZCode has issues disabled; this repo already hosts main-repo bug reports (see #64, #60). Happy to repost if the team prefers another channel.

Environment

  • ZCode Desktop client 3.15.1 (Windows 11), latest
  • Remote executor over SSH: Ubuntu 24.04 (root), zcode-server 3.15.1 (matched), service authority mode desktop-attached-remote
  • Executor env: ZCODE_GEN_UI_OUTPUT_ROOT=/root/.zcode/v2/visualizations

Steps to reproduce

  1. Connect Desktop to an SSH remote executor (WSL2 Ubuntu) as a remote workspace
  2. Ask the agent to emit any ::visualize fragment; the executor writes it into the host-injected session dir, e.g. /root/.zcode/v2/visualizations/<sha256(workspace-identity,session-id)>/view.html
  3. Client renders the Gen UI card

Actual behavior

Card fails to load: Gen UI file is outside the host output directory（客户端提示“无法加载交互视图”）。100% reproducible across multiple files; “重试” never helps.

Executor-side checks (all pass)

  • File is inside ZCODE_GEN_UI_OUTPUT_ROOT; directory name = sha256 of [workspace-identity, session-id], exactly as injected by the host
  • Permissions 644, no symlinks on the whole path (verified with namei), valid HTML fragment, well under 5 MB
  • The error string exists in zcode-server.cjs (readGenUiDocument), but at read time the failing validation cannot be the executor's own — the file is under the executor root, so the relative() check would pass there

Root-cause analysis (from the client bundle + repo source)

  • The Desktop client bundle (app.asar 3.15.1) embeds the same reader — readGenUiDocument (minified bL) of packages/services/src/gen-ui/adapters/files.ts: 
    let r = resolve(t),            // t = outputRoot, resolved on the LOCAL client machine
    o = normalize(n.path),     // n.path = remote executor's absolute POSIX path, e.g. /root/.zcode/v2/...
    s = relative(r, o);
if (!s || s === ".." || s.startsWith(`..${sep}`) || isAbsolute(s))
    throw new Error("Gen UI file is outside the host output directory");
    relative() between a Windows local output root and the remote absolute path can never pass, so the client throws before any remote access happens.
  • packages/services/src/gen-ui/adapters/files.ts (current main) states the intended design in a comment: “读取范围只由执行端 Host 的固定输出根目录决定” — the read scope is owned by the executor-side Host. docs/architecture/r2-server-cli-and-daemon.md places the same ownership on the executor.
  • Conclusion: in desktop-attached-remote mode the Gen UI document read/validation is not dispatched to the remote host; the client performs a local-filesystem read with a local output root instead.

Expected behavior

In desktop-attached-remote mode, route the Gen UI document read/validation through the remote transport: the executor validates against its own ZCODE_GEN_UI_OUTPUT_ROOT and returns the HTML content to the client for rendering.

Impact / current workaround

Only inline interactive Gen UI cards are affected; all other remote functionality works fine. Current workaround: executor delivers Playwright PNG screenshots plus standalone HTML files instead of ::visualize cards.

Notes

  • No user-facing configuration found that redirects the client-side validation root (ZCODE_GEN_UI_OUTPUT_ROOT only configures the executor side).
  • Happy to provide full connection logs or a minimal repro if useful.
Lingua principale
Python
Stelle
95
Fork
57
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di zai-org/zcode-plugins

Tutte le issue di zai-org/zcode-plugins

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.