@co0ontty/wand 1.29.3 → 1.29.6

package/dist/server.js

@@ -976,6 +976,10 @@ export async function startServer(config, configPath) {
         res.setHeader("Content-Disposition", `attachment; filename="${encodeURIComponent(macosDmg.fileName)}"`);
         createReadStream(macosDmg.filePath).pipe(res);
     });
+    // Public probe so the unauthenticated browser does not log a 401 on /api/config
+    app.get("/api/session-check", (req, res) => {
+        res.json({ authed: validateSession(readSessionCookie(req)) });
+    });
     app.use("/api", requireAuth);
     // ── Config & Session info ──
     app.get("/api/config", async (_req, res) => {

package/dist/web-ui/content/scripts.js

@@ -1148,14 +1148,24 @@
       }
 
       function restoreLoginSession() {
-        fetch("/api/config", { credentials: "same-origin" })
-          .then(function(res) {
-            if (!res.ok) {
+        // Probe an unauthenticated endpoint first so an anonymous visit
+        // does not leave a noisy 401 on /api/config in DevTools.
+        fetch("/api/session-check", { credentials: "same-origin" })
+          .then(function(res) { return res.ok ? res.json() : { authed: false }; })
+          .then(function(info) {
+            if (!info || !info.authed) {
               state.loginChecked = true;
               render();
               return null;
             }
-            return res.json();
+            return fetch("/api/config", { credentials: "same-origin" }).then(function(res) {
+              if (!res.ok) {
+                state.loginChecked = true;
+                render();
+                return null;
+              }
+              return res.json();
+            });
           })
           .then(function(config) {
             if (!config) return;
@@ -1286,6 +1296,7 @@
           '<span class="shortcut-sep">·</span>' +
           '<button class="shortcut-key" data-key="enter" type="button">↵</button>' +
           '<button class="shortcut-key" data-key="ctrl_enter" type="button">C-↵</button>' +
+          '<button class="shortcut-key" data-key="shift_tab" type="button" title="Shift+Tab（切换 plan / 自动接受 模式）">⇧⇥</button>' +
           '<button class="shortcut-key" data-key="escape" type="button">Esc</button>';
       }
 
@@ -1365,7 +1376,8 @@
               '</div>' +
               '<div class="login-subtitle">在浏览器中运行本机终端</div>' +
             '</div>' +
-            '<div class="login-body">' +
+            '<form id="login-form" class="login-body" autocomplete="on">' +
+              '<input type="text" name="username" autocomplete="username" value="wand" tabindex="-1" aria-hidden="true" style="position:absolute;left:-9999px;width:1px;height:1px;opacity:0;pointer-events:none" readonly />' +
               '<p class="login-hint">输入 Wand 访问密码以进入控制台。</p>' +
               '<div class="field">' +
                 '<label class="field-label" for="password">密码</label>' +
@@ -1376,7 +1388,7 @@
                 '<p id="password-hint" class="hint">使用你在 Wand 中设置的访问密码。</p>' +
                 '<p id="login-error" class="error-message hidden" role="alert"></p>' +
               '</div>' +
-              '<button id="login-button" class="btn btn-primary btn-block">进入控制台</button>' +
+              '<button id="login-button" type="submit" class="btn btn-primary btn-block">进入控制台</button>' +
               (hasNativeSwitchServer() ?
                 '<button id="login-switch-server-button" class="btn btn-ghost btn-block login-switch-server" type="button">' +
                   '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="2" y="3" width="20" height="8" rx="2"/><rect x="2" y="13" width="20" height="8" rx="2"/><line x1="6" y1="7" x2="6.01" y2="7"/><line x1="6" y1="17" x2="6.01" y2="17"/></svg>' +
@@ -1384,7 +1396,7 @@
                 '</button>'
                 : ''
               ) +
-            '</div>' +
+            '</form>' +
           '</div>' +
         '</div>';
       }
@@ -1442,7 +1454,7 @@
               '</div>' +
               '<div class="sidebar-body">' +
                 '<div id="sessions-panel">' +
-                  '<div class="sessions-list" id="sessions-list">' + renderSessions() + '</div>' +
+                  '<div class="sessions-list" id="sessions-list">' + renderSessionsListContent() + '</div>' +
                 '</div>' +
               '</div>' +
               '<div class="sidebar-footer">' +
@@ -2943,19 +2955,22 @@
                       '<p class="settings-card-desc">至少 6 个字符；保存后下次登录生效。</p>' +
                     '</div>' +
                   '</div>' +
-                  '<div class="field">' +
-                    '<label class="field-label" for="new-password">新密码</label>' +
-                    '<input id="new-password" type="password" class="field-input" placeholder="输入新密码（至少 6 个字符）" autocomplete="new-password" />' +
-                  '</div>' +
-                  '<div class="field">' +
-                    '<label class="field-label" for="confirm-password">确认密码</label>' +
-                    '<input id="confirm-password" type="password" class="field-input" placeholder="再次输入新密码" autocomplete="new-password" />' +
-                  '</div>' +
-                  '<div class="settings-card-actions">' +
-                    '<button id="save-password-button" class="btn btn-primary">保存密码</button>' +
-                  '</div>' +
-                  '<p id="settings-error" class="error-message hidden"></p>' +
-                  '<p id="settings-success" class="hint settings-success-message hidden"></p>' +
+                  '<form id="change-password-form" autocomplete="on" onsubmit="return false;">' +
+                    '<input type="text" name="username" autocomplete="username" value="wand" tabindex="-1" aria-hidden="true" style="position:absolute;left:-9999px;width:1px;height:1px;opacity:0;pointer-events:none" readonly />' +
+                    '<div class="field">' +
+                      '<label class="field-label" for="new-password">新密码</label>' +
+                      '<input id="new-password" type="password" class="field-input" placeholder="输入新密码（至少 6 个字符）" autocomplete="new-password" />' +
+                    '</div>' +
+                    '<div class="field">' +
+                      '<label class="field-label" for="confirm-password">确认密码</label>' +
+                      '<input id="confirm-password" type="password" class="field-input" placeholder="再次输入新密码" autocomplete="new-password" />' +
+                    '</div>' +
+                    '<div class="settings-card-actions">' +
+                      '<button id="save-password-button" class="btn btn-primary" type="submit">保存密码</button>' +
+                    '</div>' +
+                    '<p id="settings-error" class="error-message hidden"></p>' +
+                    '<p id="settings-success" class="hint settings-success-message hidden"></p>' +
+                  '</form>' +
                 '</div>' +
                 '<div class="settings-card">' +
                   '<div class="settings-card-head">' +
@@ -3091,6 +3106,35 @@
         return groups.join("");
       }
 
+      function isSidebarNarrow() {
+        return !!state.sidebarPinned && !isMobileLayout() && !!state.sidebarCollapsed;
+      }
+
+      function renderCollapsedSessionTiles() {
+        var running = state.sessions.filter(function(s) {
+          return !s.archived && s.status === "running";
+        });
+        running.sort(function(a, b) {
+          var ta = a.startedAt ? new Date(a.startedAt).getTime() : 0;
+          var tb = b.startedAt ? new Date(b.startedAt).getTime() : 0;
+          return ta - tb;
+        });
+        if (running.length === 0) {
+          return '<div class="sidebar-collapsed-empty" title="无运行中的会话">—</div>';
+        }
+        return '<div class="sidebar-collapsed-tiles">' +
+          running.map(function(s, i) {
+            var activeCls = s.id === state.selectedId ? " active" : "";
+            var title = s.summary || s.command || ("会话 " + (i + 1));
+            return '<button class="sidebar-collapsed-tile' + activeCls + '" type="button" data-collapsed-session-id="' + escapeHtml(s.id) + '" title="' + escapeHtml(title) + '">' + (i + 1) + '</button>';
+          }).join("") +
+        '</div>';
+      }
+
+      function renderSessionsListContent() {
+        return isSidebarNarrow() ? renderCollapsedSessionTiles() : renderSessions();
+      }
+
       function renderSessionManageBar() {
         if (!state.sessionsManageMode) {
           return '<div class="session-manage-bar">' +
@@ -5378,6 +5422,11 @@
         var loginButton = document.getElementById("login-button");
         if (loginButton) {
           loginButton.addEventListener("click", login);
+          var loginForm = document.getElementById("login-form");
+          if (loginForm) loginForm.addEventListener("submit", function(e) {
+            e.preventDefault();
+            login();
+          });
           var loginSwitchServerBtn = document.getElementById("login-switch-server-button");
           if (loginSwitchServerBtn) loginSwitchServerBtn.addEventListener("click", switchServer);
           var passwordEl = document.getElementById("password");
@@ -6540,6 +6589,14 @@
         var target = event.target;
         if (!target || !(target instanceof Element)) return;
 
+        var collapsedTile = target.closest(".sidebar-collapsed-tile");
+        if (collapsedTile && collapsedTile instanceof HTMLElement && collapsedTile.dataset.collapsedSessionId) {
+          event.preventDefault();
+          event.stopPropagation();
+          activateSessionItem(collapsedTile.dataset.collapsedSessionId);
+          return;
+        }
+
         var historyToggle = target.closest("#claude-history-toggle");
         if (historyToggle) {
           event.preventDefault();
@@ -8309,7 +8366,7 @@
               updateSessionsList();
             } else {
               var listEl = document.getElementById("sessions-list");
-              var rendered = renderSessions();
+              var rendered = renderSessionsListContent();
               if (listEl && listEl.innerHTML === rendered) {
                 var countEl = document.getElementById("session-count");
                 if (countEl) countEl.textContent = String(state.sessions.length);
@@ -8368,7 +8425,7 @@
       function updateSessionsList() {
         var listEl = document.getElementById("sessions-list");
         var countEl = document.getElementById("session-count");
-        if (listEl) listEl.innerHTML = renderSessions();
+        if (listEl) listEl.innerHTML = renderSessionsListContent();
         if (countEl) countEl.textContent = String(state.sessions.length);
         updateShellChrome();
         // Re-render cross-session queue (container may have been destroyed by DOM rebuild)
@@ -8637,7 +8694,15 @@
 
       function toggleSidebarCollapsed() {
         if (isMobileLayout()) return;
-        if (!state.sidebarPinned) return;
+        // 在 drawer 模式（未 pin）下点 collapse 视为「先固定、再收起为窄条」——
+        // 用户直觉是「点了就该看到窄条」，过去这里 early return 让按钮看上去没反应。
+        if (!state.sidebarPinned) {
+          state.sidebarPinned = true;
+          state.sessionsDrawerOpen = true;
+          try {
+            localStorage.setItem("wand-sidebar-pinned", "true");
+          } catch (e) {}
+        }
         state.sidebarCollapsed = !state.sidebarCollapsed;
         try {
           localStorage.setItem("wand-sidebar-collapsed", String(state.sidebarCollapsed));
@@ -11969,6 +12034,7 @@
       var ptySpecialKeyMap = {
         space: " ",
         tab: String.fromCharCode(9),
+        shift_tab: String.fromCharCode(27) + "[Z",
         backspace: String.fromCharCode(127),
         home: String.fromCharCode(27) + "[H",
         end: String.fromCharCode(27) + "[F",
@@ -12026,7 +12092,9 @@
         return {
           ctrl: event.ctrlKey,
           alt: event.altKey,
-          shift: event.shiftKey && key.length === 1,
+          // 仅对单字符键保留 shift（控制 toUpperCase 路径），
+          // 但 Tab 特例：物理 Shift+Tab 要走 buildPtySequence 的 back-tab 分支。
+          shift: event.shiftKey && (key.length === 1 || key === "tab"),
           meta: event.metaKey
         };
       }
@@ -12249,6 +12317,8 @@
       function buildPtySequence(key, modifiers) {
         var mods = modifiers || { ctrl: false, alt: false, shift: false };
         if (isModifierKey(key)) return "";
+        // Shift+Tab → CSI Z (back-tab)。Claude Code 用它在 plan / 自动接受 模式间切换。
+        if (key === "tab" && mods.shift) return String.fromCharCode(27) + "[Z";
         var specialSequence = getPtySpecialSequence(key);
         if (specialSequence) return specialSequence;
         if (key.indexOf("ctrl_") === 0) {
@@ -13936,6 +14006,9 @@
       function sendTerminalResize(cols, rows) {
         if (!state.selectedId) return;
         var selectedSess = state.sessions.find(function(s) { return s.id === state.selectedId; });
+        // 会话已被清除（如服务重启后 localStorage 还残留旧 id），后端 resize 会
+        // 直接 400/404，console 留一条红色错误；这里提前剪掉，避免噪音。
+        if (!selectedSess || selectedSess.status !== "running") return;
         if (isStructuredSession(selectedSess)) return;
         var nextSize = { cols: cols, rows: rows };
         if (state.lastResize.cols !== nextSize.cols || state.lastResize.rows !== nextSize.rows) {