@artenx/dshb 0.0.3 → 0.1.0

package/lib/auth/loopback-compat.js

@@ -0,0 +1,94 @@
+//#region src/auth/loopback-compat.ts
+const MOBILE_CSS = `
+<style id="dshb-mobile-fix">
+@media (max-width:1023px),(display-mode:standalone){
+html{-webkit-text-size-adjust:100%!important;text-size-adjust:100%!important}
+[class*="_command_1gdtu_"]{min-width:max-content!important;max-width:none!important;overflow:visible!important;white-space:pre!important;text-overflow:clip!important;max-height:999999px!important}
+[class*="_prompt_1gdtu_"],[class*="_promptLine_1gdtu_"]{min-width:max-content!important;max-height:999999px!important}
+[class*="_header_1gdtu_"]{min-width:0!important;max-width:100%!important;overflow-x:auto!important;overscroll-behavior-x:contain;touch-action:pan-x pan-y!important}
+[class*="_output_1gdtu_"]{overflow-x:auto!important;overflow-y:auto!important;-webkit-overflow-scrolling:touch;touch-action:pan-x pan-y!important}
+[class*="_line_1gdtu_"]{min-width:max-content!important;overflow-x:visible!important;max-height:999999px!important}
+[class*="_copyButton_1gdtu_"]{position:sticky!important;right:0}
+[class*="7KE1Ra_modelName"],[class*="7KE1Ra_description"],[class*="modelName"]{white-space:normal!important;overflow-wrap:break-word;text-overflow:clip!important;overflow:visible!important}
+[class*="7KE1Ra_menu"],[class*="_menu"]:has([class*="modelName"]){left:0!important;right:auto!important;width:calc(100vw - 32px)!important;min-width:0!important;max-width:calc(100vw - 32px)!important}
+[class*="_copyButton_"]{touch-action:manipulation!important}
+[class*="_copyAnchor_"],[class*="_body_1ye18_"],[class*="_root_4qrvp_"]{touch-action:pan-x pan-y!important}
+[class*="_root_4qrvp_1"]{width:100%!important;min-width:0!important;overflow-x:auto!important}
+[class*="_container_4qrvp_"]{width:auto!important;min-width:100%!important;max-width:none!important}
+[class*="_expandedTopLevel_4qrvp_"]{width:auto!important;min-width:100%!important;max-width:none!important}
+[class*="_body_biesw_"],[class*="_body_srovd_"],[class*="_body_s66q0_"]{overflow-x:auto!important;-webkit-overflow-scrolling:touch}
+[class*="_line_biesw_"],[class*="_line_srovd_"],[class*="_line_s66q0_"]{min-width:max-content!important}
+[class*="_block_1gdtu_"]{padding-left:0!important;overflow-x:auto!important}
+}
+</style>`;
+function loopbackCompatScript() {
+	return `<script>
+;(function () {
+  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID !== 'function' && typeof crypto.getRandomValues === 'function') {
+    crypto.randomUUID = function () {
+      var b = crypto.getRandomValues(new Uint8Array(16))
+      b[6] = (b[6] & 0x0f) | 0x40
+      b[8] = (b[8] & 0x3f) | 0x80
+      var h = ''
+      for (var i = 0; i < 16; i++) {
+        if (i === 4 || i === 6 || i === 8 || i === 10) h += '-'
+        var hex = b[i].toString(16)
+        if (hex.length < 2) hex = '0' + hex
+        h += hex
+      }
+      return h
+    }
+  }
+  function installIsLoopbackOverride() {
+    var loader = window.__ModuleLoader__
+    if (!loader || loader.__dshbIsLoopbackHooked) return false
+    if (loader.mode !== 'live') return false
+    loader.__dshbIsLoopbackHooked = true
+    var origLoad = loader.load.bind(loader)
+    loader.load = function (handoff) {
+      var factory = handoff && handoff.factory
+      if (typeof factory === 'function') {
+        handoff.factory = function (require) {
+          var exports = factory(require)
+          var apply = exports && exports.apply
+          if (typeof apply === 'function') {
+            exports.apply = function (ctx) {
+              var result = apply(ctx)
+              try {
+                var connection = ctx && ctx.get && ctx.get('connection')
+                if (connection) {
+                  Object.defineProperty(connection, 'isLoopback', { configurable: true, get: function () { return true } })
+                }
+              } catch (e) {}
+              return result
+            }
+          }
+          return exports
+        }
+      }
+      return origLoad(handoff)
+    }
+    return true
+  }
+  function tryInstall() { if (!installIsLoopbackOverride()) setTimeout(tryInstall, 0) }
+  tryInstall()
+})()
+;(async function () {
+  try {
+    var res = await fetch('/api/auth/status')
+    var data = await res.json()
+    if (window.location.pathname !== '/login' && !data.authenticated) {
+      window.location.replace('/login')
+      return
+    }
+  } catch (e) {}
+})()
+<\/script>`;
+}
+function installLoopbackCompat(html) {
+	return html.replace("</head>", `${MOBILE_CSS}${loopbackCompatScript()}</head>`);
+}
+//#endregion
+export { installLoopbackCompat, loopbackCompatScript };
+
+//# sourceMappingURL=loopback-compat.js.map

package/lib/auth/loopback-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-compat.js","names":[],"sources":["../../src/auth/loopback-compat.ts"],"sourcesContent":["const MOBILE_CSS = `\n<style id=\"dshb-mobile-fix\">\n@media (max-width:1023px),(display-mode:standalone){\nhtml{-webkit-text-size-adjust:100%!important;text-size-adjust:100%!important}\n[class*=\"_command_1gdtu_\"]{min-width:max-content!important;max-width:none!important;overflow:visible!important;white-space:pre!important;text-overflow:clip!important;max-height:999999px!important}\n[class*=\"_prompt_1gdtu_\"],[class*=\"_promptLine_1gdtu_\"]{min-width:max-content!important;max-height:999999px!important}\n[class*=\"_header_1gdtu_\"]{min-width:0!important;max-width:100%!important;overflow-x:auto!important;overscroll-behavior-x:contain;touch-action:pan-x pan-y!important}\n[class*=\"_output_1gdtu_\"]{overflow-x:auto!important;overflow-y:auto!important;-webkit-overflow-scrolling:touch;touch-action:pan-x pan-y!important}\n[class*=\"_line_1gdtu_\"]{min-width:max-content!important;overflow-x:visible!important;max-height:999999px!important}\n[class*=\"_copyButton_1gdtu_\"]{position:sticky!important;right:0}\n[class*=\"7KE1Ra_modelName\"],[class*=\"7KE1Ra_description\"],[class*=\"modelName\"]{white-space:normal!important;overflow-wrap:break-word;text-overflow:clip!important;overflow:visible!important}\n[class*=\"7KE1Ra_menu\"],[class*=\"_menu\"]:has([class*=\"modelName\"]){left:0!important;right:auto!important;width:calc(100vw - 32px)!important;min-width:0!important;max-width:calc(100vw - 32px)!important}\n[class*=\"_copyButton_\"]{touch-action:manipulation!important}\n[class*=\"_copyAnchor_\"],[class*=\"_body_1ye18_\"],[class*=\"_root_4qrvp_\"]{touch-action:pan-x pan-y!important}\n[class*=\"_root_4qrvp_1\"]{width:100%!important;min-width:0!important;overflow-x:auto!important}\n[class*=\"_container_4qrvp_\"]{width:auto!important;min-width:100%!important;max-width:none!important}\n[class*=\"_expandedTopLevel_4qrvp_\"]{width:auto!important;min-width:100%!important;max-width:none!important}\n[class*=\"_body_biesw_\"],[class*=\"_body_srovd_\"],[class*=\"_body_s66q0_\"]{overflow-x:auto!important;-webkit-overflow-scrolling:touch}\n[class*=\"_line_biesw_\"],[class*=\"_line_srovd_\"],[class*=\"_line_s66q0_\"]{min-width:max-content!important}\n[class*=\"_block_1gdtu_\"]{padding-left:0!important;overflow-x:auto!important}\n}\n</style>`\n\nexport function loopbackCompatScript(): string {\n  return `<script>\n;(function () {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID !== 'function' && typeof crypto.getRandomValues === 'function') {\n    crypto.randomUUID = function () {\n      var b = crypto.getRandomValues(new Uint8Array(16))\n      b[6] = (b[6] & 0x0f) | 0x40\n      b[8] = (b[8] & 0x3f) | 0x80\n      var h = ''\n      for (var i = 0; i < 16; i++) {\n        if (i === 4 || i === 6 || i === 8 || i === 10) h += '-'\n        var hex = b[i].toString(16)\n        if (hex.length < 2) hex = '0' + hex\n        h += hex\n      }\n      return h\n    }\n  }\n  function installIsLoopbackOverride() {\n    var loader = window.__ModuleLoader__\n    if (!loader || loader.__dshbIsLoopbackHooked) return false\n    if (loader.mode !== 'live') return false\n    loader.__dshbIsLoopbackHooked = true\n    var origLoad = loader.load.bind(loader)\n    loader.load = function (handoff) {\n      var factory = handoff && handoff.factory\n      if (typeof factory === 'function') {\n        handoff.factory = function (require) {\n          var exports = factory(require)\n          var apply = exports && exports.apply\n          if (typeof apply === 'function') {\n            exports.apply = function (ctx) {\n              var result = apply(ctx)\n              try {\n                var connection = ctx && ctx.get && ctx.get('connection')\n                if (connection) {\n                  Object.defineProperty(connection, 'isLoopback', { configurable: true, get: function () { return true } })\n                }\n              } catch (e) {}\n              return result\n            }\n          }\n          return exports\n        }\n      }\n      return origLoad(handoff)\n    }\n    return true\n  }\n  function tryInstall() { if (!installIsLoopbackOverride()) setTimeout(tryInstall, 0) }\n  tryInstall()\n})()\n;(async function () {\n  try {\n    var res = await fetch('/api/auth/status')\n    var data = await res.json()\n    if (window.location.pathname !== '/login' && !data.authenticated) {\n      window.location.replace('/login')\n      return\n    }\n  } catch (e) {}\n})()\n</script>`\n}\n\nexport function installLoopbackCompat(html: string): string {\n  return html.replace('</head>', `${MOBILE_CSS}${loopbackCompatScript()}</head>`)\n}\n"],"mappings":";AAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;AAuBnB,SAAgB,uBAA+B;CAC7C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DT;AAEA,SAAgB,sBAAsB,MAAsB;CAC1D,OAAO,KAAK,QAAQ,WAAW,GAAG,aAAa,qBAAqB,EAAE,QAAQ;AAChF"}

package/lib/auth/loopback.d.ts

@@ -0,0 +1,7 @@
+//#region src/auth/loopback.d.ts
+declare function isLoopbackAddress(address: string | undefined | null): boolean;
+declare function isLoopbackHost(hostHeader: string | undefined | null): boolean;
+declare function isLoopbackRequest(remoteAddress: string | undefined | null, hostHeader: string | undefined | null): boolean;
+//#endregion
+export { isLoopbackAddress, isLoopbackHost, isLoopbackRequest };
+//# sourceMappingURL=loopback.d.ts.map

package/lib/auth/loopback.js

@@ -0,0 +1,24 @@
+//#region src/auth/loopback.ts
+function isLoopbackAddress(address) {
+	if (!address) return false;
+	let addr = address.trim().toLowerCase();
+	const v4mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(addr);
+	if (v4mapped) addr = v4mapped[1];
+	if (addr === "::1" || addr === "::") return true;
+	return /^127\./.test(addr);
+}
+function isLoopbackHost(hostHeader) {
+	if (!hostHeader) return false;
+	const authority = hostHeader.trim().toLowerCase();
+	if (!authority) return false;
+	const host = authority.startsWith("[") ? authority.slice(1, authority.indexOf("]")) : authority.split(":")[0];
+	if (host === "localhost" || host.endsWith(".localhost")) return true;
+	return isLoopbackAddress(host);
+}
+function isLoopbackRequest(remoteAddress, hostHeader) {
+	return isLoopbackAddress(remoteAddress) && isLoopbackHost(hostHeader);
+}
+//#endregion
+export { isLoopbackAddress, isLoopbackHost, isLoopbackRequest };
+
+//# sourceMappingURL=loopback.js.map

package/lib/auth/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","names":[],"sources":["../../src/auth/loopback.ts"],"sourcesContent":["export function isLoopbackAddress(address: string | undefined | null): boolean {\n  if (!address) return false\n  let addr = address.trim().toLowerCase()\n  const v4mapped = /^::ffff:(\\d{1,3}(?:\\.\\d{1,3}){3})$/.exec(addr)\n  if (v4mapped) addr = v4mapped[1]\n  if (addr === '::1' || addr === '::') return true\n  return /^127\\./.test(addr)\n}\n\nexport function isLoopbackHost(hostHeader: string | undefined | null): boolean {\n  if (!hostHeader) return false\n  const authority = hostHeader.trim().toLowerCase()\n  if (!authority) return false\n  const host = authority.startsWith('[')\n    ? authority.slice(1, authority.indexOf(']'))\n    : authority.split(':')[0]\n  if (host === 'localhost' || host.endsWith('.localhost')) return true\n  return isLoopbackAddress(host)\n}\n\nexport function isLoopbackRequest(\n  remoteAddress: string | undefined | null,\n  hostHeader: string | undefined | null,\n): boolean {\n  return isLoopbackAddress(remoteAddress) && isLoopbackHost(hostHeader)\n}\n"],"mappings":";AAAA,SAAgB,kBAAkB,SAA6C;CAC7E,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,OAAO,QAAQ,KAAK,CAAC,CAAC,YAAY;CACtC,MAAM,WAAW,qCAAqC,KAAK,IAAI;CAC/D,IAAI,UAAU,OAAO,SAAS;CAC9B,IAAI,SAAS,SAAS,SAAS,MAAM,OAAO;CAC5C,OAAO,SAAS,KAAK,IAAI;AAC3B;AAEA,SAAgB,eAAe,YAAgD;CAC7E,IAAI,CAAC,YAAY,OAAO;CACxB,MAAM,YAAY,WAAW,KAAK,CAAC,CAAC,YAAY;CAChD,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,OAAO,UAAU,WAAW,GAAG,IACjC,UAAU,MAAM,GAAG,UAAU,QAAQ,GAAG,CAAC,IACzC,UAAU,MAAM,GAAG,CAAC,CAAC;CACzB,IAAI,SAAS,eAAe,KAAK,SAAS,YAAY,GAAG,OAAO;CAChE,OAAO,kBAAkB,IAAI;AAC/B;AAEA,SAAgB,kBACd,eACA,YACS;CACT,OAAO,kBAAkB,aAAa,KAAK,eAAe,UAAU;AACtE"}

package/lib/auth/ratelimit.d.ts

@@ -0,0 +1,11 @@
+//#region src/auth/ratelimit.d.ts
+declare class LoginRateLimiter {
+  private readonly entries;
+  isLocked(ip: string, now?: number): boolean;
+  recordFailure(ip: string, now?: number): void;
+  recordSuccess(ip: string): void;
+  private sweep;
+}
+//#endregion
+export { LoginRateLimiter };
+//# sourceMappingURL=ratelimit.d.ts.map

package/lib/auth/ratelimit.js

@@ -0,0 +1,37 @@
+//#region src/auth/ratelimit.ts
+const WINDOW_MS = 3e4;
+const MAX_FAILURES = 5;
+var LoginRateLimiter = class {
+	entries = /* @__PURE__ */ new Map();
+	isLocked(ip, now = Date.now()) {
+		const entry = this.entries.get(ip);
+		if (!entry) return false;
+		if (entry.lockedUntil > now) return true;
+		if (entry.lockedUntil !== 0 && entry.lockedUntil <= now) this.entries.delete(ip);
+		return false;
+	}
+	recordFailure(ip, now = Date.now()) {
+		const entry = this.entries.get(ip) ?? {
+			failures: 0,
+			lockedUntil: 0
+		};
+		entry.failures += 1;
+		if (entry.failures >= MAX_FAILURES) {
+			entry.lockedUntil = now + WINDOW_MS;
+			entry.failures = 0;
+		}
+		this.entries.set(ip, entry);
+		this.sweep(now);
+	}
+	recordSuccess(ip) {
+		this.entries.delete(ip);
+	}
+	sweep(now) {
+		if (this.entries.size < 1024) return;
+		for (const [ip, entry] of this.entries) if (entry.lockedUntil <= now) this.entries.delete(ip);
+	}
+};
+//#endregion
+export { LoginRateLimiter };
+
+//# sourceMappingURL=ratelimit.js.map

package/lib/auth/ratelimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ratelimit.js","names":[],"sources":["../../src/auth/ratelimit.ts"],"sourcesContent":["const WINDOW_MS = 30_000\nconst MAX_FAILURES = 5\n\ninterface Entry {\n  failures: number\n  lockedUntil: number\n}\n\nexport class LoginRateLimiter {\n  private readonly entries = new Map<string, Entry>()\n\n  isLocked(ip: string, now = Date.now()): boolean {\n    const entry = this.entries.get(ip)\n    if (!entry) return false\n    if (entry.lockedUntil > now) return true\n    if (entry.lockedUntil !== 0 && entry.lockedUntil <= now) this.entries.delete(ip)\n    return false\n  }\n\n  recordFailure(ip: string, now = Date.now()): void {\n    const entry = this.entries.get(ip) ?? { failures: 0, lockedUntil: 0 }\n    entry.failures += 1\n    if (entry.failures >= MAX_FAILURES) {\n      entry.lockedUntil = now + WINDOW_MS\n      entry.failures = 0\n    }\n    this.entries.set(ip, entry)\n    this.sweep(now)\n  }\n\n  recordSuccess(ip: string): void {\n    this.entries.delete(ip)\n  }\n\n  private sweep(now: number): void {\n    if (this.entries.size < 1024) return\n    for (const [ip, entry] of this.entries) {\n      if (entry.lockedUntil <= now) this.entries.delete(ip)\n    }\n  }\n}\n"],"mappings":";AAAA,MAAM,YAAY;AAClB,MAAM,eAAe;AAOrB,IAAa,mBAAb,MAA8B;CAC5B,0BAA2B,IAAI,IAAmB;CAElD,SAAS,IAAY,MAAM,KAAK,IAAI,GAAY;EAC9C,MAAM,QAAQ,KAAK,QAAQ,IAAI,EAAE;EACjC,IAAI,CAAC,OAAO,OAAO;EACnB,IAAI,MAAM,cAAc,KAAK,OAAO;EACpC,IAAI,MAAM,gBAAgB,KAAK,MAAM,eAAe,KAAK,KAAK,QAAQ,OAAO,EAAE;EAC/E,OAAO;CACT;CAEA,cAAc,IAAY,MAAM,KAAK,IAAI,GAAS;EAChD,MAAM,QAAQ,KAAK,QAAQ,IAAI,EAAE,KAAK;GAAE,UAAU;GAAG,aAAa;EAAE;EACpE,MAAM,YAAY;EAClB,IAAI,MAAM,YAAY,cAAc;GAClC,MAAM,cAAc,MAAM;GAC1B,MAAM,WAAW;EACnB;EACA,KAAK,QAAQ,IAAI,IAAI,KAAK;EAC1B,KAAK,MAAM,GAAG;CAChB;CAEA,cAAc,IAAkB;EAC9B,KAAK,QAAQ,OAAO,EAAE;CACxB;CAEA,MAAc,KAAmB;EAC/B,IAAI,KAAK,QAAQ,OAAO,MAAM;EAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,SAC7B,IAAI,MAAM,eAAe,KAAK,KAAK,QAAQ,OAAO,EAAE;CAExD;AACF"}

package/lib/auth/routes.d.ts

@@ -0,0 +1,8 @@
+import { CredentialStore } from "./credentials.js";
+import { LoginRateLimiter } from "./ratelimit.js";
+import { Context } from "@deepseek-ai/cordis";
+//#region src/auth/routes.d.ts
+declare function registerAuthRoutes(ctx: Context, store: CredentialStore, limiter: LoginRateLimiter): void;
+//#endregion
+export { registerAuthRoutes };
+//# sourceMappingURL=routes.d.ts.map

package/lib/auth/routes.js

@@ -0,0 +1,224 @@
+import { sanitizeUsername } from "./credentials.js";
+import { isLoopbackRequest } from "./loopback.js";
+import { SESSION_COOKIE, clearCookieHeader, issueSession, readCookie, sessionCookieHeader, verifySession } from "./session.js";
+import { loginPageHtml } from "./login-page.js";
+//#region src/auth/routes.ts
+const MAX_BODY = 65536;
+function sendJson(res, status, body, headers = {}) {
+	res.writeHead(status, {
+		"content-type": "application/json",
+		...headers
+	});
+	res.end(JSON.stringify(body));
+}
+function readBody(req) {
+	return new Promise((resolve) => {
+		if ((req.headers["content-type"] ?? "") !== "application/json") {
+			resolve(null);
+			return;
+		}
+		const chunks = [];
+		let size = 0;
+		req.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > MAX_BODY) {
+				resolve(null);
+				req.destroy();
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => {
+			try {
+				resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+			} catch {
+				resolve(null);
+			}
+		});
+		req.on("error", () => resolve(null));
+	});
+}
+function clientIp(req) {
+	return req.socket.remoteAddress ?? "unknown";
+}
+function registerAuthRoutes(ctx, store, limiter) {
+	const webServer = ctx.webServer;
+	ctx.effect(() => webServer.register({
+		kind: "exact",
+		path: "/login",
+		handler: (_req, res) => {
+			res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+			res.end(loginPageHtml());
+		}
+	}));
+	ctx.effect(() => webServer.register({
+		kind: "prefix",
+		path: "/api/auth",
+		handler: async (req, res) => {
+			const path = new URL(req.url ?? "/", "http://x").pathname;
+			if (path === "/api/auth/status" && req.method === "GET") {
+				const loopback = isLoopbackRequest(req.socket.remoteAddress, req.headers.host);
+				let authenticated = loopback;
+				let username;
+				if (!loopback) {
+					const secret = store.sessionSecret;
+					const currentName = store.username;
+					if (secret && currentName) {
+						const cookie = readCookie(req.headers.cookie, SESSION_COOKIE);
+						if (verifySession(cookie, secret, currentName)) {
+							authenticated = true;
+							username = currentName;
+						}
+					}
+				}
+				sendJson(res, 200, {
+					ok: true,
+					authenticated,
+					initialized: store.isInitialized(),
+					username
+				});
+				return;
+			}
+			if (req.method !== "POST") {
+				sendJson(res, 405, {
+					ok: false,
+					error: "method not allowed"
+				});
+				return;
+			}
+			const body = await readBody(req);
+			if (!body) {
+				sendJson(res, 400, {
+					ok: false,
+					error: "请求体必须是 JSON"
+				});
+				return;
+			}
+			if (path === "/api/auth/register") {
+				if (store.isInitialized()) {
+					sendJson(res, 409, {
+						ok: false,
+						error: "管理员已存在"
+					});
+					return;
+				}
+				const username = sanitizeUsername(String(body.username ?? ""));
+				const password = String(body.password ?? "");
+				if (!username) {
+					sendJson(res, 400, {
+						ok: false,
+						error: "用户名不能为空"
+					});
+					return;
+				}
+				if (password.length < 8) {
+					sendJson(res, 400, {
+						ok: false,
+						error: "密码至少 8 个字符"
+					});
+					return;
+				}
+				store.register(username, password);
+				const cookie = issueSession(username, store.sessionSecret);
+				sendJson(res, 200, { ok: true }, { "set-cookie": sessionCookieHeader(cookie) });
+				return;
+			}
+			if (path === "/api/auth/login") {
+				const ip = clientIp(req);
+				if (limiter.isLocked(ip)) {
+					sendJson(res, 429, {
+						ok: false,
+						error: "尝试次数过多，请 30 秒后再试"
+					});
+					return;
+				}
+				if (!store.isInitialized()) {
+					sendJson(res, 409, {
+						ok: false,
+						error: "尚未初始化管理员"
+					});
+					return;
+				}
+				const username = sanitizeUsername(String(body.username ?? ""));
+				const password = String(body.password ?? "");
+				if (username !== store.username || !store.verify(password)) {
+					limiter.recordFailure(ip);
+					sendJson(res, 401, {
+						ok: false,
+						error: "用户名或密码错误"
+					});
+					return;
+				}
+				limiter.recordSuccess(ip);
+				const cookie = issueSession(username, store.sessionSecret);
+				sendJson(res, 200, { ok: true }, { "set-cookie": sessionCookieHeader(cookie) });
+				return;
+			}
+			if (path === "/api/auth/logout") {
+				sendJson(res, 200, { ok: true }, { "set-cookie": clearCookieHeader() });
+				return;
+			}
+			if (path === "/api/auth/change-password" || path === "/api/auth/change-username") {
+				const secret = store.sessionSecret;
+				const currentName = store.username;
+				const cookie = secret && currentName ? readCookie(req.headers.cookie, SESSION_COOKIE) : void 0;
+				if (!secret || !currentName || !cookie || !verifySession(cookie, secret, currentName)) {
+					sendJson(res, 401, {
+						ok: false,
+						error: "unauthorized"
+					});
+					return;
+				}
+				const ip = clientIp(req);
+				if (limiter.isLocked(ip)) {
+					sendJson(res, 429, {
+						ok: false,
+						error: "尝试次数过多，请 30 秒后再试"
+					});
+					return;
+				}
+				if (!store.verify(String(body.currentPassword ?? ""))) {
+					limiter.recordFailure(ip);
+					sendJson(res, 401, {
+						ok: false,
+						error: "当前密码错误"
+					});
+					return;
+				}
+				limiter.recordSuccess(ip);
+				if (path === "/api/auth/change-password") {
+					const password = String(body.password ?? "");
+					if (password.length < 8) {
+						sendJson(res, 400, {
+							ok: false,
+							error: "密码至少 8 个字符"
+						});
+						return;
+					}
+					store.changePassword(currentName, password);
+				} else {
+					const username = sanitizeUsername(String(body.username ?? ""));
+					if (!username) {
+						sendJson(res, 400, {
+							ok: false,
+							error: "用户名不能为空"
+						});
+						return;
+					}
+					store.changeUsername(username);
+				}
+				const fresh = issueSession(store.username, store.sessionSecret);
+				sendJson(res, 200, { ok: true }, { "set-cookie": sessionCookieHeader(fresh) });
+				return;
+			}
+			sendJson(res, 404, {
+				ok: false,
+				error: "not found"
+			});
+		}
+	}));
+}
+//#endregion
+export { registerAuthRoutes };
+
+//# sourceMappingURL=routes.js.map

package/lib/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","names":[],"sources":["../../src/auth/routes.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sanitizeUsername, type CredentialStore } from './credentials.js'\nimport { isLoopbackRequest } from './loopback.js'\nimport { clearCookieHeader, issueSession, readCookie, SESSION_COOKIE, sessionCookieHeader, verifySession } from './session.js'\nimport type { LoginRateLimiter } from './ratelimit.js'\nimport { loginPageHtml } from './login-page.js'\n\nconst MAX_BODY = 64 * 1024\n\nfunction sendJson(res: ServerResponse, status: number, body: unknown, headers: Record<string, string> = {}): void {\n  res.writeHead(status, { 'content-type': 'application/json', ...headers })\n  res.end(JSON.stringify(body))\n}\n\nfunction readBody(req: IncomingMessage): Promise<Record<string, unknown> | null> {\n  return new Promise((resolve) => {\n    if ((req.headers['content-type'] ?? '') !== 'application/json') {\n      resolve(null)\n      return\n    }\n    const chunks: Buffer[] = []\n    let size = 0\n    req.on('data', (chunk: Buffer) => {\n      size += chunk.length\n      if (size > MAX_BODY) {\n        resolve(null)\n        req.destroy()\n        return\n      }\n      chunks.push(chunk)\n    })\n    req.on('end', () => {\n      try {\n        resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')) as Record<string, unknown>)\n      } catch {\n        resolve(null)\n      }\n    })\n    req.on('error', () => resolve(null))\n  })\n}\n\nfunction clientIp(req: IncomingMessage): string {\n  return req.socket.remoteAddress ?? 'unknown'\n}\n\nexport function registerAuthRoutes(ctx: Context, store: CredentialStore, limiter: LoginRateLimiter): void {\n  const webServer = ctx.webServer\n\n  ctx.effect(() =>\n    webServer.register({\n      kind: 'exact',\n      path: '/login',\n      handler: (_req, res) => {\n        res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })\n        res.end(loginPageHtml())\n      },\n    }),\n  )\n\n  ctx.effect(() =>\n    webServer.register({\n      kind: 'prefix',\n      path: '/api/auth',\n      handler: async (req, res) => {\n        const path = new URL(req.url ?? '/', 'http://x').pathname\n\n        if (path === '/api/auth/status' && req.method === 'GET') {\n          const loopback = isLoopbackRequest(req.socket.remoteAddress, req.headers.host)\n          let authenticated = loopback\n          let username: string | undefined\n          if (!loopback) {\n            const secret = store.sessionSecret\n            const currentName = store.username\n            if (secret && currentName) {\n              const cookie = readCookie(req.headers.cookie, SESSION_COOKIE)\n              if (verifySession(cookie, secret, currentName)) {\n                authenticated = true\n                username = currentName\n              }\n            }\n          }\n          sendJson(res, 200, { ok: true, authenticated, initialized: store.isInitialized(), username })\n          return\n        }\n\n        if (req.method !== 'POST') {\n          sendJson(res, 405, { ok: false, error: 'method not allowed' })\n          return\n        }\n\n        const body = await readBody(req)\n        if (!body) {\n          sendJson(res, 400, { ok: false, error: '请求体必须是 JSON' })\n          return\n        }\n\n        if (path === '/api/auth/register') {\n          if (store.isInitialized()) {\n            sendJson(res, 409, { ok: false, error: '管理员已存在' })\n            return\n          }\n          const username = sanitizeUsername(String(body.username ?? ''))\n          const password = String(body.password ?? '')\n          if (!username) {\n            sendJson(res, 400, { ok: false, error: '用户名不能为空' })\n            return\n          }\n          if (password.length < 8) {\n            sendJson(res, 400, { ok: false, error: '密码至少 8 个字符' })\n            return\n          }\n          store.register(username, password)\n          const cookie = issueSession(username, store.sessionSecret!)\n          sendJson(res, 200, { ok: true }, { 'set-cookie': sessionCookieHeader(cookie) })\n          return\n        }\n\n        if (path === '/api/auth/login') {\n          const ip = clientIp(req)\n          if (limiter.isLocked(ip)) {\n            sendJson(res, 429, { ok: false, error: '尝试次数过多，请 30 秒后再试' })\n            return\n          }\n          if (!store.isInitialized()) {\n            sendJson(res, 409, { ok: false, error: '尚未初始化管理员' })\n            return\n          }\n          const username = sanitizeUsername(String(body.username ?? ''))\n          const password = String(body.password ?? '')\n          if (username !== store.username || !store.verify(password)) {\n            limiter.recordFailure(ip)\n            sendJson(res, 401, { ok: false, error: '用户名或密码错误' })\n            return\n          }\n          limiter.recordSuccess(ip)\n          const cookie = issueSession(username, store.sessionSecret!)\n          sendJson(res, 200, { ok: true }, { 'set-cookie': sessionCookieHeader(cookie) })\n          return\n        }\n\n        if (path === '/api/auth/logout') {\n          sendJson(res, 200, { ok: true }, { 'set-cookie': clearCookieHeader() })\n          return\n        }\n\n        if (path === '/api/auth/change-password' || path === '/api/auth/change-username') {\n          const secret = store.sessionSecret\n          const currentName = store.username\n          const cookie = secret && currentName ? readCookie(req.headers.cookie, SESSION_COOKIE) : undefined\n          if (!secret || !currentName || !cookie || !verifySession(cookie, secret, currentName)) {\n            sendJson(res, 401, { ok: false, error: 'unauthorized' })\n            return\n          }\n          const ip = clientIp(req)\n          if (limiter.isLocked(ip)) {\n            sendJson(res, 429, { ok: false, error: '尝试次数过多，请 30 秒后再试' })\n            return\n          }\n          if (!store.verify(String(body.currentPassword ?? ''))) {\n            limiter.recordFailure(ip)\n            sendJson(res, 401, { ok: false, error: '当前密码错误' })\n            return\n          }\n          limiter.recordSuccess(ip)\n          if (path === '/api/auth/change-password') {\n            const password = String(body.password ?? '')\n            if (password.length < 8) {\n              sendJson(res, 400, { ok: false, error: '密码至少 8 个字符' })\n              return\n            }\n            store.changePassword(currentName, password)\n          } else {\n            const username = sanitizeUsername(String(body.username ?? ''))\n            if (!username) {\n              sendJson(res, 400, { ok: false, error: '用户名不能为空' })\n              return\n            }\n            store.changeUsername(username)\n          }\n          const fresh = issueSession(store.username!, store.sessionSecret!)\n          sendJson(res, 200, { ok: true }, { 'set-cookie': sessionCookieHeader(fresh) })\n          return\n        }\n\n        sendJson(res, 404, { ok: false, error: 'not found' })\n      },\n    }),\n  )\n}\n"],"mappings":";;;;;AAQA,MAAM,WAAW;AAEjB,SAAS,SAAS,KAAqB,QAAgB,MAAe,UAAkC,CAAC,GAAS;CAChH,IAAI,UAAU,QAAQ;EAAE,gBAAgB;EAAoB,GAAG;CAAQ,CAAC;CACxE,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;AAEA,SAAS,SAAS,KAA+D;CAC/E,OAAO,IAAI,SAAS,YAAY;EAC9B,KAAK,IAAI,QAAQ,mBAAmB,QAAQ,oBAAoB;GAC9D,QAAQ,IAAI;GACZ;EACF;EACA,MAAM,SAAmB,CAAC;EAC1B,IAAI,OAAO;EACX,IAAI,GAAG,SAAS,UAAkB;GAChC,QAAQ,MAAM;GACd,IAAI,OAAO,UAAU;IACnB,QAAQ,IAAI;IACZ,IAAI,QAAQ;IACZ;GACF;GACA,OAAO,KAAK,KAAK;EACnB,CAAC;EACD,IAAI,GAAG,aAAa;GAClB,IAAI;IACF,QAAQ,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,CAA4B;GACvF,QAAQ;IACN,QAAQ,IAAI;GACd;EACF,CAAC;EACD,IAAI,GAAG,eAAe,QAAQ,IAAI,CAAC;CACrC,CAAC;AACH;AAEA,SAAS,SAAS,KAA8B;CAC9C,OAAO,IAAI,OAAO,iBAAiB;AACrC;AAEA,SAAgB,mBAAmB,KAAc,OAAwB,SAAiC;CACxG,MAAM,YAAY,IAAI;CAEtB,IAAI,aACF,UAAU,SAAS;EACjB,MAAM;EACN,MAAM;EACN,UAAU,MAAM,QAAQ;GACtB,IAAI,UAAU,KAAK,EAAE,gBAAgB,2BAA2B,CAAC;GACjE,IAAI,IAAI,cAAc,CAAC;EACzB;CACF,CAAC,CACH;CAEA,IAAI,aACF,UAAU,SAAS;EACjB,MAAM;EACN,MAAM;EACN,SAAS,OAAO,KAAK,QAAQ;GAC3B,MAAM,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC;GAEjD,IAAI,SAAS,sBAAsB,IAAI,WAAW,OAAO;IACvD,MAAM,WAAW,kBAAkB,IAAI,OAAO,eAAe,IAAI,QAAQ,IAAI;IAC7E,IAAI,gBAAgB;IACpB,IAAI;IACJ,IAAI,CAAC,UAAU;KACb,MAAM,SAAS,MAAM;KACrB,MAAM,cAAc,MAAM;KAC1B,IAAI,UAAU,aAAa;MACzB,MAAM,SAAS,WAAW,IAAI,QAAQ,QAAQ,cAAc;MAC5D,IAAI,cAAc,QAAQ,QAAQ,WAAW,GAAG;OAC9C,gBAAgB;OAChB,WAAW;MACb;KACF;IACF;IACA,SAAS,KAAK,KAAK;KAAE,IAAI;KAAM;KAAe,aAAa,MAAM,cAAc;KAAG;IAAS,CAAC;IAC5F;GACF;GAEA,IAAI,IAAI,WAAW,QAAQ;IACzB,SAAS,KAAK,KAAK;KAAE,IAAI;KAAO,OAAO;IAAqB,CAAC;IAC7D;GACF;GAEA,MAAM,OAAO,MAAM,SAAS,GAAG;GAC/B,IAAI,CAAC,MAAM;IACT,SAAS,KAAK,KAAK;KAAE,IAAI;KAAO,OAAO;IAAc,CAAC;IACtD;GACF;GAEA,IAAI,SAAS,sBAAsB;IACjC,IAAI,MAAM,cAAc,GAAG;KACzB,SAAS,KAAK,KAAK;MAAE,IAAI;MAAO,OAAO;KAAS,CAAC;KACjD;IACF;IACA,MAAM,WAAW,iBAAiB,OAAO,KAAK,YAAY,EAAE,CAAC;IAC7D,MAAM,WAAW,OAAO,KAAK,YAAY,EAAE;IAC3C,IAAI,CAAC,UAAU;KACb,SAAS,KAAK,KAAK;MAAE,IAAI;MAAO,OAAO;KAAU,CAAC;KAClD;IACF;IACA,IAAI,SAAS,SAAS,GAAG;KACvB,SAAS,KAAK,KAAK;MAAE,IAAI;MAAO,OAAO;KAAa,CAAC;KACrD;IACF;IACA,MAAM,SAAS,UAAU,QAAQ;IACjC,MAAM,SAAS,aAAa,UAAU,MAAM,aAAc;IAC1D,SAAS,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,cAAc,oBAAoB,MAAM,EAAE,CAAC;IAC9E;GACF;GAEA,IAAI,SAAS,mBAAmB;IAC9B,MAAM,KAAK,SAAS,GAAG;IACvB,IAAI,QAAQ,SAAS,EAAE,GAAG;KACxB,SAAS,KAAK,KAAK;MAAE,IAAI;MAAO,OAAO;KAAmB,CAAC;KAC3D;IACF;IACA,IAAI,CAAC,MAAM,cAAc,GAAG;KAC1B,SAAS,KAAK,KAAK;MAAE,IAAI;MAAO,OAAO;KAAW,CAAC;KACnD;IACF;IACA,MAAM,WAAW,iBAAiB,OAAO,KAAK,YAAY,EAAE,CAAC;IAC7D,MAAM,WAAW,OAAO,KAAK,YAAY,EAAE;IAC3C,IAAI,aAAa,MAAM,YAAY,CAAC,MAAM,OAAO,QAAQ,GAAG;KAC1D,QAAQ,cAAc,EAAE;KACxB,SAAS,KAAK,KAAK;MAAE,IAAI;MAAO,OAAO;KAAW,CAAC;KACnD;IACF;IACA,QAAQ,cAAc,EAAE;IACxB,MAAM,SAAS,aAAa,UAAU,MAAM,aAAc;IAC1D,SAAS,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,cAAc,oBAAoB,MAAM,EAAE,CAAC;IAC9E;GACF;GAEA,IAAI,SAAS,oBAAoB;IAC/B,SAAS,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,cAAc,kBAAkB,EAAE,CAAC;IACtE;GACF;GAEA,IAAI,SAAS,+BAA+B,SAAS,6BAA6B;IAChF,MAAM,SAAS,MAAM;IACrB,MAAM,cAAc,MAAM;IAC1B,MAAM,SAAS,UAAU,cAAc,WAAW,IAAI,QAAQ,QAAQ,cAAc,IAAI,KAAA;IACxF,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,QAAQ,QAAQ,WAAW,GAAG;KACrF,SAAS,KAAK,KAAK;MAAE,IAAI;MAAO,OAAO;KAAe,CAAC;KACvD;IACF;IACA,MAAM,KAAK,SAAS,GAAG;IACvB,IAAI,QAAQ,SAAS,EAAE,GAAG;KACxB,SAAS,KAAK,KAAK;MAAE,IAAI;MAAO,OAAO;KAAmB,CAAC;KAC3D;IACF;IACA,IAAI,CAAC,MAAM,OAAO,OAAO,KAAK,mBAAmB,EAAE,CAAC,GAAG;KACrD,QAAQ,cAAc,EAAE;KACxB,SAAS,KAAK,KAAK;MAAE,IAAI;MAAO,OAAO;KAAS,CAAC;KACjD;IACF;IACA,QAAQ,cAAc,EAAE;IACxB,IAAI,SAAS,6BAA6B;KACxC,MAAM,WAAW,OAAO,KAAK,YAAY,EAAE;KAC3C,IAAI,SAAS,SAAS,GAAG;MACvB,SAAS,KAAK,KAAK;OAAE,IAAI;OAAO,OAAO;MAAa,CAAC;MACrD;KACF;KACA,MAAM,eAAe,aAAa,QAAQ;IAC5C,OAAO;KACL,MAAM,WAAW,iBAAiB,OAAO,KAAK,YAAY,EAAE,CAAC;KAC7D,IAAI,CAAC,UAAU;MACb,SAAS,KAAK,KAAK;OAAE,IAAI;OAAO,OAAO;MAAU,CAAC;MAClD;KACF;KACA,MAAM,eAAe,QAAQ;IAC/B;IACA,MAAM,QAAQ,aAAa,MAAM,UAAW,MAAM,aAAc;IAChE,SAAS,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,cAAc,oBAAoB,KAAK,EAAE,CAAC;IAC7E;GACF;GAEA,SAAS,KAAK,KAAK;IAAE,IAAI;IAAO,OAAO;GAAY,CAAC;EACtD;CACF,CAAC,CACH;AACF"}

package/lib/auth/session.d.ts

@@ -0,0 +1,11 @@
+//#region src/auth/session.d.ts
+declare const SESSION_COOKIE = "dshb_sid";
+declare const SESSION_MAX_AGE_SEC: number;
+declare function issueSession(username: string, secret: Buffer): string;
+declare function verifySession(value: string | undefined, secret: Buffer, currentUsername: string): boolean;
+declare function readCookie(header: string | undefined, name: string): string | undefined;
+declare function sessionCookieHeader(value: string): string;
+declare function clearCookieHeader(): string;
+//#endregion
+export { SESSION_COOKIE, SESSION_MAX_AGE_SEC, clearCookieHeader, issueSession, readCookie, sessionCookieHeader, verifySession };
+//# sourceMappingURL=session.d.ts.map

package/lib/auth/session.js

@@ -0,0 +1,52 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+//#region src/auth/session.ts
+const SESSION_COOKIE = "dshb_sid";
+const SESSION_MAX_AGE_SEC = 1209600;
+function base64url(input) {
+	return Buffer.from(input).toString("base64url");
+}
+function sign(secret, payload) {
+	return createHmac("sha256", secret).update(payload).digest("base64url");
+}
+function issueSession(username, secret) {
+	const payload = `${base64url(username)}.${Math.floor(Date.now() / 1e3)}`;
+	return `${payload}.${sign(secret, payload)}`;
+}
+function verifySession(value, secret, currentUsername) {
+	if (!value) return false;
+	const parts = value.split(".");
+	if (parts.length !== 3) return false;
+	const [b64user, iatText, sig] = parts;
+	const expected = sign(secret, `${b64user}.${iatText}`);
+	const a = Buffer.from(sig);
+	const b = Buffer.from(expected);
+	if (a.length !== b.length || !timingSafeEqual(a, b)) return false;
+	const iat = Number(iatText);
+	if (!Number.isInteger(iat)) return false;
+	if (Math.floor(Date.now() / 1e3) - iat > 1209600) return false;
+	let username;
+	try {
+		username = Buffer.from(b64user, "base64url").toString("utf8");
+	} catch {
+		return false;
+	}
+	return username === currentUsername;
+}
+function readCookie(header, name) {
+	if (!header) return void 0;
+	for (const part of header.split(";")) {
+		const eq = part.indexOf("=");
+		if (eq < 0) continue;
+		if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
+	}
+}
+function sessionCookieHeader(value) {
+	return `${SESSION_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_MAX_AGE_SEC}`;
+}
+function clearCookieHeader() {
+	return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+//#endregion
+export { SESSION_COOKIE, SESSION_MAX_AGE_SEC, clearCookieHeader, issueSession, readCookie, sessionCookieHeader, verifySession };
+
+//# sourceMappingURL=session.js.map

package/lib/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","names":[],"sources":["../../src/auth/session.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto'\n\nexport const SESSION_COOKIE = 'dshb_sid'\nexport const SESSION_MAX_AGE_SEC = 14 * 24 * 3600\n\nfunction base64url(input: Buffer | string): string {\n  return Buffer.from(input).toString('base64url')\n}\n\nfunction sign(secret: Buffer, payload: string): string {\n  return createHmac('sha256', secret).update(payload).digest('base64url')\n}\n\nexport function issueSession(username: string, secret: Buffer): string {\n  const payload = `${base64url(username)}.${Math.floor(Date.now() / 1000)}`\n  return `${payload}.${sign(secret, payload)}`\n}\n\nexport function verifySession(\n  value: string | undefined,\n  secret: Buffer,\n  currentUsername: string,\n): boolean {\n  if (!value) return false\n  const parts = value.split('.')\n  if (parts.length !== 3) return false\n  const [b64user, iatText, sig] = parts\n  const payload = `${b64user}.${iatText}`\n  const expected = sign(secret, payload)\n  const a = Buffer.from(sig)\n  const b = Buffer.from(expected)\n  if (a.length !== b.length || !timingSafeEqual(a, b)) return false\n  const iat = Number(iatText)\n  if (!Number.isInteger(iat)) return false\n  if (Math.floor(Date.now() / 1000) - iat > SESSION_MAX_AGE_SEC) return false\n  let username: string\n  try {\n    username = Buffer.from(b64user, 'base64url').toString('utf8')\n  } catch {\n    return false\n  }\n  return username === currentUsername\n}\n\nexport function readCookie(header: string | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  for (const part of header.split(';')) {\n    const eq = part.indexOf('=')\n    if (eq < 0) continue\n    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim()\n  }\n  return undefined\n}\n\nexport function sessionCookieHeader(value: string): string {\n  return `${SESSION_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_MAX_AGE_SEC}`\n}\n\nexport function clearCookieHeader(): string {\n  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`\n}\n"],"mappings":";;AAEA,MAAa,iBAAiB;AAC9B,MAAa,sBAAsB;AAEnC,SAAS,UAAU,OAAgC;CACjD,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,WAAW;AAChD;AAEA,SAAS,KAAK,QAAgB,SAAyB;CACrD,OAAO,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,WAAW;AACxE;AAEA,SAAgB,aAAa,UAAkB,QAAwB;CACrE,MAAM,UAAU,GAAG,UAAU,QAAQ,EAAE,GAAG,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CACtE,OAAO,GAAG,QAAQ,GAAG,KAAK,QAAQ,OAAO;AAC3C;AAEA,SAAgB,cACd,OACA,QACA,iBACS;CACT,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,MAAM,CAAC,SAAS,SAAS,OAAO;CAEhC,MAAM,WAAW,KAAK,QAAQ,GADX,QAAQ,GAAG,SACO;CACrC,MAAM,IAAI,OAAO,KAAK,GAAG;CACzB,MAAM,IAAI,OAAO,KAAK,QAAQ;CAC9B,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,gBAAgB,GAAG,CAAC,GAAG,OAAO;CAC5D,MAAM,MAAM,OAAO,OAAO;CAC1B,IAAI,CAAC,OAAO,UAAU,GAAG,GAAG,OAAO;CACnC,IAAI,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,MAAA,SAA2B,OAAO;CACtE,IAAI;CACJ,IAAI;EACF,WAAW,OAAO,KAAK,SAAS,WAAW,CAAC,CAAC,SAAS,MAAM;CAC9D,QAAQ;EACN,OAAO;CACT;CACA,OAAO,aAAa;AACtB;AAEA,SAAgB,WAAW,QAA4B,MAAkC;CACvF,IAAI,CAAC,QAAQ,OAAO,KAAA;CACpB,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,KAAK,GAAG;EACZ,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CACxE;AAEF;AAEA,SAAgB,oBAAoB,OAAuB;CACzD,OAAO,GAAG,eAAe,GAAG,MAAM,4CAA4C;AAChF;AAEA,SAAgB,oBAA4B;CAC1C,OAAO,GAAG,eAAe;AAC3B"}

package/lib/auth/startup.d.ts

@@ -0,0 +1,15 @@
+import { Context } from "@deepseek-ai/cordis";
+//#region src/auth/startup.d.ts
+declare const name = "web-startup";
+declare const inject: string[];
+declare const WEB_STARTUP_SERVICE = "webStartup";
+interface WebStartupValues {
+  openBrowser: boolean;
+  host?: string;
+  port?: number;
+  trustedHosts: string[];
+}
+declare function apply(ctx: Context): void;
+//#endregion
+export { WEB_STARTUP_SERVICE, WebStartupValues, apply, inject, name };
+//# sourceMappingURL=startup.d.ts.map

package/lib/auth/startup.js

@@ -0,0 +1,68 @@
+import { sanitizeUsername, sharedCredentialStore } from "./credentials.js";
+import { Command } from "commander";
+import { parseCmdline } from "@deepseek-ai/dsh-cmdline";
+//#region src/auth/startup.ts
+const name = "web-startup";
+const inject = ["cmdlineArgs"];
+const WEB_STARTUP_SERVICE = "webStartup";
+function runAuthReset(args) {
+	const store = sharedCredentialStore();
+	if (!store.isInitialized()) {
+		console.error("auth-reset: 尚未初始化管理员账号");
+		process.exit(1);
+	}
+	let password;
+	let username;
+	for (let i = 1; i < args.length; i++) if (args[i] === "--password") password = args[++i];
+	else if (args[i] === "--username") username = args[++i];
+	if (password === void 0 && username === void 0) {
+		console.error("auth-reset: 需要 --password <新密码> 和/或 --username <新用户名>");
+		process.exit(1);
+	}
+	if (password !== void 0 && password.length < 8) {
+		console.error("auth-reset: 密码至少 8 个字符");
+		process.exit(1);
+	}
+	if (username !== void 0) {
+		username = sanitizeUsername(username);
+		if (!username) {
+			console.error("auth-reset: 用户名不能为空");
+			process.exit(1);
+		}
+	}
+	if (password !== void 0) store.changePassword(username ?? store.username, password);
+	else store.changeUsername(username);
+	console.log("auth-reset: 已更新凭据并轮换会话密钥，全部已签发会话作废");
+	process.exit(0);
+}
+function webCommand() {
+	return new Command().name("dsh --profile web").description("Serve the DeepSeek Harness browser UI.").helpOption("-h, --help", "show this help").option("--host <host>", "bind host").option("--no-open", "do not open the Web UI in the default browser").option("--port <port>", "listen port; pass 0 to let the OS pick a free one").option("--trusted-host <authority...>", "extra authority the /api browser-trust fence accepts (host or host:port; repeatable)").addHelpText("after", `
+Examples:
+  dsh --profile web                          serve on the composed host and port
+  dsh --profile web --no-open                serve without opening a browser
+  dsh --profile web --port 8080              serve on another port
+  dsh --profile web --host 0.0.0.0           serve on all interfaces (DSHB: auth plugin guards access)
+  dsh --profile web auth-reset --password <新密码>   reset admin credentials and revoke all sessions
+`);
+}
+function apply(ctx) {
+	const args = ctx.cmdlineArgs?.get() ?? [];
+	if (args[0] === "auth-reset") runAuthReset(args);
+	const program = webCommand();
+	program.action(() => {
+		const options = program.opts();
+		if (options.port !== void 0 && !/^\d+$/.test(options.port)) program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`);
+		const values = {
+			openBrowser: options.open,
+			...options.host !== void 0 && { host: options.host },
+			...options.port !== void 0 && { port: Number(options.port) },
+			trustedHosts: options.trustedHost ?? []
+		};
+		ctx.provide(WEB_STARTUP_SERVICE, values);
+	});
+	parseCmdline(ctx, program);
+}
+//#endregion
+export { WEB_STARTUP_SERVICE, apply, inject, name };
+
+//# sourceMappingURL=startup.js.map

package/lib/auth/startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.js","names":[],"sources":["../../src/auth/startup.ts"],"sourcesContent":["import { Command } from 'commander'\nimport { parseCmdline } from '@deepseek-ai/dsh-cmdline'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sanitizeUsername, sharedCredentialStore } from './credentials.js'\n\nexport const name = 'web-startup'\n\nexport const inject = ['cmdlineArgs']\n\nexport const WEB_STARTUP_SERVICE = 'webStartup'\n\nexport interface WebStartupValues {\n  openBrowser: boolean\n  host?: string\n  port?: number\n  trustedHosts: string[]\n}\n\nfunction runAuthReset(args: readonly string[]): never {\n  const store = sharedCredentialStore()\n  if (!store.isInitialized()) {\n    console.error('auth-reset: 尚未初始化管理员账号')\n    process.exit(1)\n  }\n  let password: string | undefined\n  let username: string | undefined\n  for (let i = 1; i < args.length; i++) {\n    if (args[i] === '--password') password = args[++i]\n    else if (args[i] === '--username') username = args[++i]\n  }\n  if (password === undefined && username === undefined) {\n    console.error('auth-reset: 需要 --password <新密码> 和/或 --username <新用户名>')\n    process.exit(1)\n  }\n  if (password !== undefined && password.length < 8) {\n    console.error('auth-reset: 密码至少 8 个字符')\n    process.exit(1)\n  }\n  if (username !== undefined) {\n    username = sanitizeUsername(username)\n    if (!username) {\n      console.error('auth-reset: 用户名不能为空')\n      process.exit(1)\n    }\n  }\n  if (password !== undefined) store.changePassword(username ?? store.username!, password)\n  else store.changeUsername(username!)\n  console.log('auth-reset: 已更新凭据并轮换会话密钥，全部已签发会话作废')\n  process.exit(0)\n}\n\nfunction webCommand(): Command {\n  return new Command()\n    .name('dsh --profile web')\n    .description('Serve the DeepSeek Harness browser UI.')\n    .helpOption('-h, --help', 'show this help')\n    .option('--host <host>', 'bind host')\n    .option('--no-open', 'do not open the Web UI in the default browser')\n    .option('--port <port>', 'listen port; pass 0 to let the OS pick a free one')\n    .option(\n      '--trusted-host <authority...>',\n      'extra authority the /api browser-trust fence accepts (host or host:port; repeatable)',\n    )\n    .addHelpText(\n      'after',\n      `\nExamples:\n  dsh --profile web                          serve on the composed host and port\n  dsh --profile web --no-open                serve without opening a browser\n  dsh --profile web --port 8080              serve on another port\n  dsh --profile web --host 0.0.0.0           serve on all interfaces (DSHB: auth plugin guards access)\n  dsh --profile web auth-reset --password <新密码>   reset admin credentials and revoke all sessions\n`,\n    )\n}\n\nexport function apply(ctx: Context): void {\n  const args = ctx.cmdlineArgs?.get() ?? []\n  if (args[0] === 'auth-reset') runAuthReset(args)\n  const program = webCommand()\n  program.action(() => {\n    const options = program.opts()\n    if (options.port !== undefined && !/^\\d+$/.test(options.port)) {\n      program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`)\n    }\n    const values: WebStartupValues = {\n      openBrowser: options.open,\n      ...(options.host !== undefined && { host: options.host }),\n      ...(options.port !== undefined && { port: Number(options.port) }),\n      trustedHosts: options.trustedHost ?? [],\n    }\n    ctx.provide(WEB_STARTUP_SERVICE, values)\n  })\n  parseCmdline(ctx, program)\n}\n"],"mappings":";;;;AAKA,MAAa,OAAO;AAEpB,MAAa,SAAS,CAAC,aAAa;AAEpC,MAAa,sBAAsB;AASnC,SAAS,aAAa,MAAgC;CACpD,MAAM,QAAQ,sBAAsB;CACpC,IAAI,CAAC,MAAM,cAAc,GAAG;EAC1B,QAAQ,MAAM,wBAAwB;EACtC,QAAQ,KAAK,CAAC;CAChB;CACA,IAAI;CACJ,IAAI;CACJ,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,KAAK,OAAO,cAAc,WAAW,KAAK,EAAE;MAC3C,IAAI,KAAK,OAAO,cAAc,WAAW,KAAK,EAAE;CAEvD,IAAI,aAAa,KAAA,KAAa,aAAa,KAAA,GAAW;EACpD,QAAQ,MAAM,uDAAuD;EACrE,QAAQ,KAAK,CAAC;CAChB;CACA,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,GAAG;EACjD,QAAQ,MAAM,wBAAwB;EACtC,QAAQ,KAAK,CAAC;CAChB;CACA,IAAI,aAAa,KAAA,GAAW;EAC1B,WAAW,iBAAiB,QAAQ;EACpC,IAAI,CAAC,UAAU;GACb,QAAQ,MAAM,qBAAqB;GACnC,QAAQ,KAAK,CAAC;EAChB;CACF;CACA,IAAI,aAAa,KAAA,GAAW,MAAM,eAAe,YAAY,MAAM,UAAW,QAAQ;MACjF,MAAM,eAAe,QAAS;CACnC,QAAQ,IAAI,oCAAoC;CAChD,QAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,aAAsB;CAC7B,OAAO,IAAI,QAAQ,CAAC,CACjB,KAAK,mBAAmB,CAAC,CACzB,YAAY,wCAAwC,CAAC,CACrD,WAAW,cAAc,gBAAgB,CAAC,CAC1C,OAAO,iBAAiB,WAAW,CAAC,CACpC,OAAO,aAAa,+CAA+C,CAAC,CACpE,OAAO,iBAAiB,mDAAmD,CAAC,CAC5E,OACC,iCACA,sFACF,CAAC,CACA,YACC,SACA;;;;;;;CAQF;AACJ;AAEA,SAAgB,MAAM,KAAoB;CACxC,MAAM,OAAO,IAAI,aAAa,IAAI,KAAK,CAAC;CACxC,IAAI,KAAK,OAAO,cAAc,aAAa,IAAI;CAC/C,MAAM,UAAU,WAAW;CAC3B,QAAQ,aAAa;EACnB,MAAM,UAAU,QAAQ,KAAK;EAC7B,IAAI,QAAQ,SAAS,KAAA,KAAa,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAC1D,QAAQ,MAAM,uCAAuC,KAAK,UAAU,QAAQ,IAAI,GAAG;EAErF,MAAM,SAA2B;GAC/B,aAAa,QAAQ;GACrB,GAAI,QAAQ,SAAS,KAAA,KAAa,EAAE,MAAM,QAAQ,KAAK;GACvD,GAAI,QAAQ,SAAS,KAAA,KAAa,EAAE,MAAM,OAAO,QAAQ,IAAI,EAAE;GAC/D,cAAc,QAAQ,eAAe,CAAC;EACxC;EACA,IAAI,QAAQ,qBAAqB,MAAM;CACzC,CAAC;CACD,aAAa,KAAK,OAAO;AAC3B"}