npm - @chenbihao/pomasa-dashboard - Versions diffs - 1.0.2 → 1.0.3 - Mend

@chenbihao/pomasa-dashboard 1.0.2 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/cli.js +99 -16
package/package.json +1 -1

package/dist/cli.js CHANGED Viewed

@@ -57,6 +57,7 @@ var init_paths = __esm({
 // server/setup.ts
 import express from "express";
 import cors from "cors";
+import crypto from "crypto";
 import path7 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createServer } from "http";
@@ -147,9 +148,23 @@ function spawnShell(ws, cwd, cols, rows) {
   }
   return spawnWithChildProcess(ws, cwd);
 }
-function setupTerminalWebSocket(server) {
+function setupTerminalWebSocket(server, accessToken = null) {
   const wss = new WebSocketServer({ server, path: "/api/terminal" });
-  wss.on("connection", (ws) => {
+  wss.on("connection", (ws, req) => {
+    if (accessToken) {
+      const cookieHeader = req.headers.cookie || "";
+      const cookies = {};
+      for (const pair of cookieHeader.split(";")) {
+        const [key, ...rest] = pair.split("=");
+        if (key && rest.length) {
+          cookies[key.trim()] = rest.join("=").trim();
+        }
+      }
+      if (cookies.pomasa_access !== accessToken) {
+        ws.close(4001, "Unauthorized");
+        return;
+      }
+    }
     let shellProcess = null;
     ws.on("message", (data) => {
       try {
@@ -975,16 +990,78 @@ var mas_default = router4;
 // server/setup.ts
 var __dirname2 = path7.dirname(fileURLToPath2(import.meta.url));
-function createApp() {
+function generateToken() {
+  return crypto.randomBytes(24).toString("hex");
+}
+function denyAccess(req, res) {
+  const accept = req.headers.accept || "";
+  if (accept.includes("text/html")) {
+    res.status(401).send(`<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>POMASA Dashboard</title>
+<style>
+  body { font-family: -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #f5f5f5; }
+  .box { text-align: center; padding: 2rem; background: #fff; border-radius: 8px; box-shadow: 0 2px 8px rgba(0,0,0,0.1); }
+  h2 { color: #333; margin-bottom: 0.5rem; }
+  p { color: #666; }
+  code { background: #eee; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; }
+</style></head>
+<body><div class="box">
+  <h2>\u{1F512} \u9700\u8981\u8BBF\u95EE\u4EE4\u724C</h2>
+  <p>\u8BF7\u4F7F\u7528\u542F\u52A8\u65F6\u8F93\u51FA\u7684\u5E26\u6709 <code>?token=...</code> \u7684 URL \u8BBF\u95EE</p>
+</div></body></html>`);
+  } else {
+    res.status(401).json({ error: "Unauthorized", message: "Access token required. Use ?token=... in URL." });
+  }
+}
+function createApp(options = {}) {
+  const { token: enableToken = true } = options;
   const app = express();
   const server = createServer(app);
+  const accessToken = enableToken ? generateToken() : null;
   app.use(cors());
   app.use(express.json({ limit: "10mb" }));
+  app.use((req, _res, next) => {
+    if (!req.cookies) {
+      req.cookies = {};
+      const cookieHeader = req.headers.cookie;
+      if (cookieHeader) {
+        for (const pair of cookieHeader.split(";")) {
+          const [key, ...rest] = pair.split("=");
+          if (key && rest.length) {
+            req.cookies[key.trim()] = rest.join("=").trim();
+          }
+        }
+      }
+    }
+    next();
+  });
+  if (accessToken) {
+    app.use((req, res, next) => {
+      const queryToken = req.query.token;
+      if (queryToken) {
+        if (queryToken === accessToken) {
+          res.cookie("pomasa_access", accessToken, {
+            httpOnly: true,
+            sameSite: "lax",
+            path: "/"
+          });
+          const cleanUrl = req.path;
+          return res.redirect(302, cleanUrl);
+        }
+        return denyAccess(req, res);
+      }
+      const cookieToken = req.cookies?.pomasa_access;
+      if (cookieToken === accessToken) {
+        return next();
+      }
+      return denyAccess(req, res);
+    });
+  }
   app.use("/api/projects", projects_default);
   app.use("/api/framework", framework_default);
   app.use("/api/fs", filesystem_default);
   app.use("/api/mas", mas_default);
-  setupTerminalWebSocket(server);
+  setupTerminalWebSocket(server, accessToken);
   const distDir = path7.resolve(__dirname2, "../dist");
   app.use(express.static(distDir));
   app.use("/api", (_req, res) => {
@@ -993,25 +1070,22 @@ function createApp() {
   app.get("/{*splat}", (_req, res) => {
     res.sendFile(path7.join(distDir, "index.html"));
   });
-  return { app, server };
+  return { app, server, accessToken };
 }
-function startServer(port2, host2 = "127.0.0.1", maxRetries = 10) {
-  const { server } = createApp();
+function startServer(port2, host2 = "0.0.0.0", options = {}, maxRetries = 10) {
+  const { server, accessToken } = createApp(options);
   return new Promise((resolve, reject) => {
     server.on("error", (err) => {
       if (err.code === "EADDRINUSE" && maxRetries > 0) {
         console.log(`Port ${port2} in use, trying ${port2 + 1}...`);
         server.removeAllListeners("error");
-        startServer(port2 + 1, host2, maxRetries - 1).then(resolve).catch(reject);
+        startServer(port2 + 1, host2, options, maxRetries).then(resolve).catch(reject);
       } else {
         reject(err);
       }
     });
     server.listen(port2, host2, () => {
-      console.log(`POMASA Dashboard running at http://localhost:${port2}`);
-      console.log(`API at http://localhost:${port2}/api`);
-      console.log(`WebSocket terminal at ws://localhost:${port2}/api/terminal`);
-      resolve(server);
+      resolve({ server, accessToken });
     });
   });
 }
@@ -1030,20 +1104,29 @@ if (portArg !== -1 && process.argv[portArg + 1]) {
 } else if (process.env.PORT) {
   port = parseInt(process.env.PORT, 10);
 }
-var host = "127.0.0.1";
+var host = "0.0.0.0";
 var hostArg = process.argv.indexOf("--host");
 if (hostArg !== -1 && process.argv[hostArg + 1]) {
   host = process.argv[hostArg + 1];
 } else if (process.env.HOST) {
   host = process.env.HOST;
 }
-startServer(port, host).then(async () => {
+var noToken = process.argv.includes("--no-token") || !!process.env.NO_TOKEN;
+startServer(port, host, { token: !noToken }).then(async ({ accessToken }) => {
   const displayHost = host === "0.0.0.0" ? "localhost" : host;
-  const url = `http://${displayHost}:${port}`;
+  const baseUrl = `http://${displayHost}:${port}`;
+  const url = accessToken ? `${baseUrl}/?token=${accessToken}` : baseUrl;
+  console.log(`POMASA Dashboard running at ${baseUrl}`);
+  if (accessToken) {
+    console.log(`Access token: ${accessToken}`);
+    console.log(`Full URL (with token): ${url}`);
+  }
+  console.log(`API at ${baseUrl}/api`);
+  console.log(`WebSocket terminal at ws://${displayHost}:${port}/api/terminal`);
   try {
     const open = (await import("open")).default;
     await open(url);
-    console.log(`Opened ${url} in browser`);
+    console.log(`Opened in browser`);
   } catch {
     console.log(`Please open ${url} in your browser`);
   }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@chenbihao/pomasa-dashboard",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "POMASA Multi-Agent System Dashboard",
   "repository": {
     "type": "git",