feat: add project write path security guard, macOS SDK auto-detection, and walkthrough improvements by Lightning-Lion · Pull Request #304 · ohosvscode/arkTS

Lightning-Lion · 2026-05-24T18:09:45Z

🛡️ Project Write Path Security Guard

引入 project-write-path-guard 和 project-write-path-fs 两个新模块，为项目创建和模板解压提供写入路径安全保障：

系统目录拦截：禁止向文件系统根目录、Windows 系统目录（Windows、Program Files 等）、Unix 系统目录（/etc、/usr、/bin、/System 等）以及用户 Home 根目录写入项目
Zip Slip 攻击防护：模板解压时检测并拦截绝对路径、../ 目录遍历等恶意条目
排他写入：文件已存在时拒绝覆盖，防止竞态数据损坏
空目录检查：写入前确保目标目录无有意义文件，避免污染已有工程

相关文件：
packages/vscode/src/utils/project-write-path-guard.ts
packages/vscode/src/utils/project-write-path-fs.ts
packages/vscode/test/project-write-path-guard.test.ts

重构了 project-server-function.ts 中的 downloadAndExtractTemplate 和 createProject 方法，将原先直接调用 fs.mkdirSync/fs.writeFileSync 改为"收集 → 批量校验 → 排他写入"的安全流程。

🍎 macOS SDK 自动检测

在 SDK 路径选择对话框中新增「使用默认（自动从 DevEco Studio 检测）」按钮（仅 macOS），一键从 /Applications/DevEco Studio.app 中提取内置的 OpenHarmony SDK 路径，并自动校验目录结构完整性（ets、js、native、toolchains、previewer 五个核心子目录）。

相关文件：packages/vscode/src/context/server-context.ts

🚶 Walkthrough 改进

新增「创建 ArkTS 项目」Walkthrough 步骤，引导用户完成环境设置后直接创建项目。

相关文件：
packages/vscode/package.json
packages/vscode/assets/create-project.md
packages/vscode/assets/create-project.zh-cn.md

✨ 项目创建 UX 优化

智能保存路径：根据 homeDirectory 和项目名称自动填充 ~/DevEcoStudioProjects/<projectName>，用户修改项目名时自动同步；仅在用户未手动选择路径时才覆盖
按钮 loading 态：homeDirectory 异步获取期间创建按钮显示 loading 并禁用，防止数据未就绪时提交

相关文件：
packages/vscode/src/frontend/composables/project-configuration.ts
packages/vscode/src/frontend/pages/project/index.vue

📝 文档改进

CONTRIBUTING.md：新增 pnpm 严格隔离模式下依赖声明的注意事项，优化调试启动步骤说明
README.md / README-en.md：新增「参与开发」/「Contributing」区块链接到 CONTRIBUTING.md；修复英文文档中一处中文描述

📦 依赖更新

@types/vscode：1.116.0 → 1.120.0
packages/vscode：新增 volar-service-typescript 依赖（与 nodeLinker: isolated 下的运行时解析需求一致）

changeset-bot · 2026-05-24T18:09:49Z

⚠️ No Changeset found

Latest commit: 5f9a493

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Groupguanfang

请修复comments中提到的问题，并且修复CI/CD中的报错

Groupguanfang · 2026-05-25T08:02:35Z

怎么把之前do while的逻辑重新提上来了呢？此处不应该出现do while，否则对话框将永远关不掉了；在提交commit前，请先同步rebase到最新的next分支。

这个文件的修改不要再加上来了, feat(vscode): Add a help button in the language server error dialog box 这个commit本身早就已经merge了（见：00e9bf2 ）

Groupguanfang · 2026-05-25T08:05:21Z

+
+  // 测试系统路径拦截：文件系统根、DevEcoStudioProjects 根、/etc 系统目录、Home 目录根均应被拒绝
+  it('rejects filesystem root and system directories', () => {
+    expect(() => assertWritableProjectDirectoryPath('/', '/Users/shulk')).toThrow(ProjectWritePathError)


home根目录的测试可以使用 os.homedir() 获取:

import os from 'node:os'; os.homedir();

Groupguanfang · 2026-05-25T08:14:30Z

 import type { IOnActivate, Translator } from 'unioc/vscode'
 import type { FileSystemContext } from './file-system-context'
+// [新增] fs 模块用于检测 DevEco Studio SDK 路径（macOS 自动检测功能）
+import fs from 'node:fs'


目前最新的next分支中几乎没有了任何import fs from 'node:fs'，由于这是vscode插件，未来我打算添加vscode web的支持，请使用import * as vscode from 'vscode'中的fs，而非node的fs。

Groupguanfang · 2026-05-25T08:21:51Z

+  /**
+   * [新增] 校验 SDK 目录结构是否完整，返回缺失子目录的名称列表（逗号分隔），合法时返回 undefined。
+   * 必须包含: ets, js, native, toolchains, previewer 五个核心子目录。
+   */


不一定必须包含这些子目录：OpenHarmony SDK是允许这些目录不存在（允许按需下载某个SDK版本的一部分），在我们的插件中，实际上用到的仅有ets文件夹，我们只要确保该文件夹存在即可；
我建议可以通过检测是否存在ets文件夹，并且里面是否存在oh-uni-package.json文件的形式来校验SDK是否可用，这样的方案成本最低。

Groupguanfang · 2026-05-25T08:25:02Z

 import * as vscode from 'vscode'
 import { ProtocolContext } from '../../context/protocol-context'
 import { InitialCallbackEvent } from '../../context/webview-context'
+// [新增] 项目写入路径安全工具：


请去除import上的所有注释

Groupguanfang · 2026-05-25T08:35:09Z

      title: this.translator.t('project.templateMarket.extracting'),
      cancellable: false,
    }, async () => {
-      if (!fs.existsSync(uri.fsPath)) fs.mkdirSync(uri.fsPath, { recursive: true })


另外，同上一样，这里漏掉了改为使用 vscode.workspace.fs 的环节，如果可以的话这里也顺带改成 vscode.workspace.fs 进行文件操作，去除此文件中使用 node:fs 进行读写文件系统的操作。

Groupguanfang · 2026-05-25T08:45:45Z

此文件看能否也尽量使用vscode提供的vscode.workspace.fs 去访问文件系统，使用vscode提供的 vscode.Uri 工具拼接路径字符串，而非使用node中的API（node:os模块除外，此为node才有，后续我处理vscode web的时候再打算）

Groupguanfang · 2026-05-25T08:47:47Z

+ *
+ * 调用方：project-configuration.ts（前端表单校验）、project-server-function.ts（服务端写入前校验）
+ */
+import path from 'node:path'


此文件看能否也尽量使用vscode提供的 vscode.Uri 工具拼接路径字符串，而非使用node中的API。

pkg-pr-new · 2026-05-26T16:46:03Z

Open in StackBlitz

@arkts/language-plugin

npm i https://pkg.pr.new/@arkts/language-plugin@304

@arkts/language-server

npm i https://pkg.pr.new/@arkts/language-server@304

@arkts/language-service

npm i https://pkg.pr.new/@arkts/language-service@304

@arkts/shared

npm i https://pkg.pr.new/@arkts/shared@304

@arkts/types

npm i https://pkg.pr.new/@arkts/types@304

@arkts/vfs

npm i https://pkg.pr.new/@arkts/vfs@304

commit: 5f9a493

Groupguanfang · 2026-06-01T05:24:45Z

这个文件的修改不要再加上来了, feat(vscode): Add a help button in the language server error dialog box 这个commit本身早就已经merge了（见：00e9bf2 ）

Groupguanfang · 2026-06-01T05:24:59Z

这个文件的修改不要再加上来了, feat(vscode): Add a help button in the language server error dialog box 这个commit本身早就已经merge了（见：00e9bf2 ）

Groupguanfang · 2026-06-01T05:25:04Z

这个文件的修改不要再加上来了, feat(vscode): Add a help button in the language server error dialog box 这个commit本身早就已经merge了（见：00e9bf2 ）

Groupguanfang · 2026-06-01T05:27:17Z

头两个 commit 请不要再提上来

…添加vsce无依赖打包

Lightning-Lion · 2026-06-01T05:38:37Z

头两个 commit 请不要再提上来

好的，我已做好，请求审查

Groupguanfang · 2026-06-07T06:38:52Z

    "build": "tsx scripts/build.ts",
    "watch": "tsx scripts/watch.ts",
-    "pack": "tsx scripts/pre-process.ts && pnpm run build && vsce package",
+    "pack": "tsx scripts/pre-process.ts && pnpm run build && vsce package --no-dependencies",


请检查当前构建，CI上编译出来的.vsix工件下载下来测试过了吗？修改后的插件无法正常启用，扩展宿主出错（已去除敏感信息）：

2026-06-07 14:32:35.795 [info] Extension activation failure: NailyZero.vscode-naily-ets 2026-06-07 14:32:35.798 [error] Activating extension NailyZero.vscode-naily-ets failed due to an error: 2026-06-07 14:32:35.798 [error] Error: Cannot find module '@arkts/project-detector' Require stack: - <extension-dist>/src-iAKTVPdD.js - <extension-dist>/client.js - <vscode-extension-host>/extensionHostProcess.js at Module._resolveFilename (node:internal/modules/cjs/loader:1390:15) at n._resolveFilename (node:electron/js2c/utility_init:2:16319) at e._resolveFilename (file:///<vscode-extension-host>/extensionHostProcess.js:224:32911) at defaultResolveImpl (node:internal/modules/cjs/loader:1032:19) at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1037:22) at Module._load (node:internal/modules/cjs/loader:1199:37) at c._load (node:electron/js2c/node_init:2:17993) at s._load (file:///<vscode-extension-host>/extensionHostProcess.js:683:2688) at e._load (file:///<vscode-extension-host>/extensionHostProcess.js:224:32629) at r._load (file:///<vscode-extension-host>/extensionHostProcess.js:216:26895) at TracingChannel.traceSync (node:diagnostics_channel:328:14) at wrapModuleLoad (node:internal/modules/cjs/loader:244:24) at Module.require (node:internal/modules/cjs/loader:1470:12) at require (node:internal/modules/helpers:147:16) at Object.<anonymous> (<extension-dist>/src-iAKTVPdD.js:1:180) at Module._compile (node:internal/modules/cjs/loader:1713:14) at Module._extensions..js (node:internal/modules/cjs/loader:1847:10) at Module.load (node:internal/modules/cjs/loader:1448:32) at Module._load (node:internal/modules/cjs/loader:1270:12) at c._load (node:electron/js2c/node_init:2:17993) at s._load (file:///<vscode-extension-host>/extensionHostProcess.js:683:2688) at e._load (file:///<vscode-extension-host>/extensionHostProcess.js:224:32629) at r._load (file:///<vscode-extension-host>/extensionHostProcess.js:216:26895) at TracingChannel.traceSync (node:diagnostics_channel:328:14) at wrapModuleLoad (node:internal/modules/cjs/loader:244:24) at Module.require (node:internal/modules/cjs/loader:1470:12) at require (node:internal/modules/helpers:147:16) at Object.<anonymous> (<extension-dist>/client.js:1:42) at Module._compile (node:internal/modules/cjs/loader:1713:14) at Module._extensions..js (node:internal/modules/cjs/loader:1847:10) at Module.load (node:internal/modules/cjs/loader:1448:32) at Module._load (node:internal/modules/cjs/loader:1270:12) at c._load (node:electron/js2c/node_init:2:17993) at s._load (file:///<vscode-extension-host>/extensionHostProcess.js:683:2688) at e._load (file:///<vscode-extension-host>/extensionHostProcess.js:224:32629) at r._load (file:///<vscode-extension-host>/extensionHostProcess.js:216:26895) at TracingChannel.traceSync (node:diagnostics_channel:328:14) at wrapModuleLoad (node:internal/modules/cjs/loader:244:24) at Module.require (node:internal/modules/cjs/loader:1470:12) at require (node:internal/modules/helpers:147:16) at Prn._doLoadModule (file:///<vscode-extension-host>/extensionHostProcess.js:262:2141) 2026-06-07 14:32:50.096 [warning] TextEditor is closed/disposed

我认为是你加了--no-dependencies导致。请问此PR中还加了任何其他.node依赖么？如果不存在，请将此--no-dependencies去掉，改回使用拷贝的方式构建插件的node_modules并且让vsce进行打包。

插件的构建结果可以从当前PR的CI中下载，选择您电脑对应的平台/架构即可，然后可以直接安装到您的vscode/vscode like IDE:

github-project-automation Bot added this to ArkTS May 24, 2026

github-project-automation Bot moved this to Todo in ArkTS May 24, 2026

Groupguanfang self-requested a review May 25, 2026 08:02

Groupguanfang requested changes May 25, 2026

View reviewed changes

github-project-automation Bot moved this from Todo to In Progress in ArkTS May 25, 2026

Lightning-Lion requested a review from Groupguanfang May 27, 2026 08:07

Groupguanfang requested changes Jun 1, 2026

View reviewed changes

feat(vscode): 增强项目创建路径安全与SDK自动检测功能，优化工作区文件系统与项目写入安全，修复pnpm catalog依赖并…

5f9a493

…添加vsce无依赖打包

Lightning-Lion force-pushed the next branch from 1e04e4e to 5f9a493 Compare June 1, 2026 05:37

Lightning-Lion requested a review from Groupguanfang June 1, 2026 05:38

Groupguanfang requested changes Jun 7, 2026

View reviewed changes

Conversation

Lightning-Lion commented May 24, 2026

🛡️ Project Write Path Security Guard

🍎 macOS SDK 自动检测

🚶 Walkthrough 改进

✨ 项目创建 UX 优化

📝 文档改进

📦 依赖更新

Uh oh!

changeset-bot Bot commented May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

Groupguanfang left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Groupguanfang Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pkg-pr-new Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Groupguanfang Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Groupguanfang Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Groupguanfang Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Groupguanfang commented Jun 1, 2026

Uh oh!

Lightning-Lion commented Jun 1, 2026

Uh oh!

Groupguanfang Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented May 24, 2026 •

edited

Loading

Groupguanfang Jun 1, 2026 •

edited

Loading

pkg-pr-new Bot commented May 26, 2026 •

edited

Loading

Groupguanfang Jun 1, 2026 •

edited

Loading

Groupguanfang Jun 1, 2026 •

edited

Loading

Groupguanfang Jun 1, 2026 •

edited

Loading

Groupguanfang Jun 7, 2026 •

edited

Loading