@co0ontty/wand 1.49.0 → 1.49.1

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "6066201e006fdce04120be0b3e0add7d68770375",
-  "builtAt": "2026-06-02T01:47:00.843Z",
-  "version": "1.49.0",
+  "commit": "b7e61be45180349fc6c31b05ead4290ca1c1781a",
+  "builtAt": "2026-06-03T15:02:08.515Z",
+  "version": "1.49.1",
   "channel": "stable"
 }

package/dist/server.js

@@ -595,7 +595,22 @@ async function resolveMacosDmgAsset(configDir, config) {
             fileStat,
         };
     }));
-    candidates.sort((a, b) => b.fileStat.mtimeMs - a.fileStat.mtimeMs);
+    candidates.sort((a, b) => {
+        const va = extractMacosDmgVersion(a.entry.name);
+        const vb = extractMacosDmgVersion(b.entry.name);
+        if (va && vb) {
+            const cmp = compareSemver(vb, va);
+            if (cmp !== 0)
+                return cmp;
+        }
+        else if (va && !vb) {
+            return -1;
+        }
+        else if (!va && vb) {
+            return 1;
+        }
+        return b.fileStat.mtimeMs - a.fileStat.mtimeMs;
+    });
     const selected = candidates[0];
     return {
         fileName: selected.entry.name,
@@ -807,6 +822,73 @@ function classifyFile(ext, baseName) {
 function mimeForExt(ext) {
     return MIME_BY_EXT[ext.toLowerCase()] || "application/octet-stream";
 }
+function parseByteRange(rangeHeader, total) {
+    if (!rangeHeader)
+        return null;
+    const trimmed = rangeHeader.trim();
+    if (!trimmed.startsWith("bytes="))
+        return null;
+    const match = /^bytes=(\d*)-(\d*)$/.exec(trimmed);
+    if (!match || (match[1] === "" && match[2] === ""))
+        return "invalid";
+    let start;
+    let end;
+    if (match[1] === "") {
+        const suffixLength = Number(match[2]);
+        if (!Number.isSafeInteger(suffixLength) || suffixLength <= 0)
+            return "invalid";
+        start = Math.max(0, total - suffixLength);
+        end = total - 1;
+    }
+    else {
+        start = Number(match[1]);
+        end = match[2] === "" ? total - 1 : Math.min(Number(match[2]), total - 1);
+    }
+    if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || start > end || start >= total) {
+        return "invalid";
+    }
+    return { start, end };
+}
+function streamFileWithRange(req, res, options) {
+    res.setHeader("Content-Type", options.contentType);
+    if (options.disposition)
+        res.setHeader("Content-Disposition", options.disposition);
+    for (const [name, value] of Object.entries(options.headers ?? {})) {
+        res.setHeader(name, value);
+    }
+    res.setHeader("Accept-Ranges", "bytes");
+    if (options.size === 0) {
+        if (req.headers.range?.trim().startsWith("bytes=")) {
+            res.status(416).setHeader("Content-Range", "bytes */0").end();
+            return;
+        }
+        res.setHeader("Content-Length", "0");
+        res.end();
+        return;
+    }
+    const parsedRange = parseByteRange(req.headers.range, options.size);
+    if (parsedRange === "invalid") {
+        res.status(416).setHeader("Content-Range", `bytes */${options.size}`).end();
+        return;
+    }
+    const start = parsedRange?.start ?? 0;
+    const end = parsedRange?.end ?? options.size - 1;
+    if (parsedRange) {
+        res.status(206);
+        res.setHeader("Content-Range", `bytes ${start}-${end}/${options.size}`);
+    }
+    res.setHeader("Content-Length", String(end - start + 1));
+    const stream = createReadStream(options.filePath, { start, end });
+    stream.on("error", (err) => {
+        if (!res.headersSent) {
+            res.status(500).json({ error: getErrorMessage(err, options.readErrorMessage ?? "读取文件失败。") });
+        }
+        else {
+            res.destroy();
+        }
+    });
+    stream.pipe(res);
+}
 export async function startServer(config, configPath) {
     // 关键：在创建 ProcessManager / 任何 spawn 之前先修 PATH。
     // 服务被注册为 systemd / launchd 时，unit 文件里的 PATH 是安装那一刻烧死的，
@@ -1021,53 +1103,13 @@ export async function startServer(config, configPath) {
             res.status(404).json({ error: "当前没有可下载的 APK 文件。" });
             return;
         }
-        const total = androidApk.size;
-        res.setHeader("Content-Type", "application/vnd.android.package-archive");
-        res.setHeader("Content-Disposition", `attachment; filename="${encodeURIComponent(androidApk.fileName)}"`);
-        // 声明支持断点续传 — 弱网/移动网络下中断后客户端可带 Range 续传, 而非从头重下。
-        res.setHeader("Accept-Ranges", "bytes");
-        // 解析 Range: bytes=start-end (含后缀范围 bytes=-N)。命中则返回 206 + 局部内容。
-        let start = 0;
-        let end = total - 1;
-        let isPartial = false;
-        const rangeHeader = req.headers.range;
-        if (rangeHeader) {
-            const match = /^bytes=(\d*)-(\d*)$/.exec(rangeHeader.trim());
-            if (match && (match[1] !== "" || match[2] !== "")) {
-                if (match[1] === "") {
-                    // bytes=-N: 最后 N 字节
-                    start = Math.max(0, total - Number(match[2]));
-                    end = total - 1;
-                }
-                else {
-                    start = Number(match[1]);
-                    end = match[2] === "" ? total - 1 : Math.min(Number(match[2]), total - 1);
-                }
-                isPartial = true;
-                if (start > end || start < 0 || start >= total) {
-                    res.status(416);
-                    res.setHeader("Content-Range", `bytes */${total}`);
-                    res.end();
-                    return;
-                }
-            }
-        }
-        if (isPartial) {
-            res.status(206);
-            res.setHeader("Content-Range", `bytes ${start}-${end}/${total}`);
-        }
-        res.setHeader("Content-Length", String(end - start + 1));
-        const stream = createReadStream(androidApk.filePath, { start, end });
-        stream.on("error", (err) => {
-            // 文件在 stat 之后被删/读错误时, 让客户端尽快感知断流, 而不是等满读超时。
-            if (!res.headersSent) {
-                res.status(500).json({ error: getErrorMessage(err, "读取 APK 文件失败。") });
-            }
-            else {
-                res.destroy();
-            }
+        streamFileWithRange(req, res, {
+            filePath: androidApk.filePath,
+            size: androidApk.size,
+            contentType: "application/vnd.android.package-archive",
+            disposition: `attachment; filename="${encodeURIComponent(androidApk.fileName)}"`,
+            readErrorMessage: "读取 APK 文件失败。",
         });
-        stream.pipe(res);
     });
     // ── macOS DMG update & download (no auth required) ──
     app.get("/api/macos-dmg-update", async (req, res) => {
@@ -1092,7 +1134,7 @@ export async function startServer(config, configPath) {
             source: latest.source,
         });
     });
-    app.get("/macos/download", async (_req, res) => {
+    app.get("/macos/download", async (req, res) => {
         if (config.macos?.enabled !== true) {
             res.status(404).json({ error: "macOS DMG 下载未启用。" });
             return;
@@ -1102,10 +1144,13 @@ export async function startServer(config, configPath) {
             res.status(404).json({ error: "当前没有可下载的 DMG 文件。" });
             return;
         }
-        res.setHeader("Content-Type", "application/x-apple-diskimage");
-        res.setHeader("Content-Length", String(macosDmg.size));
-        res.setHeader("Content-Disposition", `attachment; filename="${encodeURIComponent(macosDmg.fileName)}"`);
-        createReadStream(macosDmg.filePath).pipe(res);
+        streamFileWithRange(req, res, {
+            filePath: macosDmg.filePath,
+            size: macosDmg.size,
+            contentType: "application/x-apple-diskimage",
+            disposition: `attachment; filename="${encodeURIComponent(macosDmg.fileName)}"`,
+            readErrorMessage: "读取 DMG 文件失败。",
+        });
     });
     // Public probe so the unauthenticated browser does not log a 401 on /api/config
     app.get("/api/session-check", (req, res) => {
@@ -1773,41 +1818,17 @@ export async function startServer(config, configPath) {
             const disposition = asDownload
                 ? `attachment; filename*=UTF-8''${encodedName}`
                 : `inline; filename*=UTF-8''${encodedName}`;
-            const total = fileStat.size;
-            const range = req.headers.range;
-            // Safe to cache raw bytes briefly inside the user's browser.
-            res.setHeader("Cache-Control", "private, max-age=60");
-            res.setHeader("Content-Type", contentType);
-            res.setHeader("Content-Disposition", disposition);
-            res.setHeader("Accept-Ranges", "bytes");
-            res.setHeader("X-Content-Type-Options", "nosniff");
-            if (range && /^bytes=/.test(range)) {
-                const match = /^bytes=(\d*)-(\d*)$/.exec(range);
-                if (!match) {
-                    res.status(416).setHeader("Content-Range", `bytes */${total}`).end();
-                    return;
-                }
-                const startStr = match[1];
-                const endStr = match[2];
-                let start = startStr === "" ? 0 : parseInt(startStr, 10);
-                let end = endStr === "" ? total - 1 : parseInt(endStr, 10);
-                if (Number.isNaN(start) || Number.isNaN(end) || start > end || start < 0 || end >= total) {
-                    res.status(416).setHeader("Content-Range", `bytes */${total}`).end();
-                    return;
-                }
-                const chunkSize = end - start + 1;
-                res.status(206);
-                res.setHeader("Content-Range", `bytes ${start}-${end}/${total}`);
-                res.setHeader("Content-Length", String(chunkSize));
-                const stream = createReadStream(resolvedPath, { start, end });
-                stream.on("error", () => res.destroy());
-                stream.pipe(res);
-                return;
-            }
-            res.setHeader("Content-Length", String(total));
-            const stream = createReadStream(resolvedPath);
-            stream.on("error", () => res.destroy());
-            stream.pipe(res);
+            streamFileWithRange(req, res, {
+                filePath: resolvedPath,
+                size: fileStat.size,
+                contentType,
+                disposition,
+                headers: {
+                    "Cache-Control": "private, max-age=60",
+                    "X-Content-Type-Options": "nosniff",
+                },
+                readErrorMessage: "Failed to read file",
+            });
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "Failed to read file") });
@@ -1837,10 +1858,11 @@ export async function startServer(config, configPath) {
             res.json({ currentPath: targetPath, items });
         }
         catch (error) {
-            if (error.code === "ENOENT") {
+            const code = error && typeof error === "object" && "code" in error ? String(error.code) : "";
+            if (code === "ENOENT") {
                 res.status(404).json({ error: "路径不存在：" + q, currentPath: q, items: [] });
             }
-            else if (error.code === "EACCES") {
+            else if (code === "EACCES") {
                 res.status(403).json({ error: "权限不足，无法访问：" + q, currentPath: q, items: [] });
             }
             else {

package/dist/structured-session-manager.d.ts

@@ -149,6 +149,8 @@ export declare class StructuredSessionManager {
     private runClaudeSdkStreaming;
     private extractAssistantMessage;
     private compactContentBlocks;
+    private buildCompletedAssistantMessages;
+    private resolveQueuedMessagesAfterInterrupt;
     private normalizeToolInput;
     private normalizeToolResultContent;
     private extractCodexText;

package/dist/structured-session-manager.js

@@ -1315,17 +1315,7 @@ export class StructuredSessionManager {
                     reject(new Error(errorText));
                     return;
                 }
-                const assistantTurn = {
-                    role: "assistant",
-                    content: this.compactContentBlocks([...turnState.blocks], turnState.result),
-                    usage: turnState.usage,
-                };
-                const msgs = [...(current.messages ?? [])];
-                const lastMsg = msgs[msgs.length - 1];
-                if (lastMsg && lastMsg.role === "assistant")
-                    msgs[msgs.length - 1] = assistantTurn;
-                else
-                    msgs.push(assistantTurn);
+                const msgs = this.buildCompletedAssistantMessages(current, turnState);
                 const keepRunning = !!interruptPrompt;
                 const finished = {
                     ...current,
@@ -1335,7 +1325,7 @@ export class StructuredSessionManager {
                     output: turnState.result,
                     claudeSessionId: turnState.sessionId ?? current.claudeSessionId,
                     messages: msgs,
-                    queuedMessages: interruptPrompt && !this.preserveQueueOnInterrupt.has(sessionId) ? [] : current.queuedMessages,
+                    queuedMessages: this.resolveQueuedMessagesAfterInterrupt(sessionId, current, interruptPrompt),
                     pendingEscalation: null,
                     permissionBlocked: false,
                     structuredState: {
@@ -1843,22 +1833,7 @@ export class StructuredSessionManager {
                     reject(new Error(errorText));
                     return;
                 }
-                // Build the final assistant turn.
-                const finalContent = this.compactContentBlocks([...turnState.blocks], turnState.result);
-                const assistantTurn = {
-                    role: "assistant",
-                    content: finalContent,
-                    usage: turnState.usage,
-                };
-                // Ensure the final messages list has the completed assistant turn.
-                const msgs = [...(current.messages ?? [])];
-                const lastMsg = msgs[msgs.length - 1];
-                if (lastMsg && lastMsg.role === "assistant") {
-                    msgs[msgs.length - 1] = assistantTurn;
-                }
-                else {
-                    msgs.push(assistantTurn);
-                }
+                const msgs = this.buildCompletedAssistantMessages(current, turnState);
                 // 被 AskUserQuestion 检测或用户中断主动 kill 时，保持 status="running"
                 // 让 UI 不跳到"已停止"。inFlight=false 才能触发后续 sendMessage。
                 const interruptPrompt = this.interruptedWith.get(sessionId);
@@ -1871,7 +1846,7 @@ export class StructuredSessionManager {
                     output: turnState.result,
                     claudeSessionId: turnState.sessionId ?? current.claudeSessionId,
                     messages: msgs,
-                    queuedMessages: interruptPrompt && !this.preserveQueueOnInterrupt.has(sessionId) ? [] : current.queuedMessages,
+                    queuedMessages: this.resolveQueuedMessagesAfterInterrupt(sessionId, current, interruptPrompt),
                     pendingEscalation: null,
                     permissionBlocked: false,
                     structuredState: {
@@ -2352,19 +2327,7 @@ export class StructuredSessionManager {
             sessionId: turnState.sessionId,
         });
         const interruptedByUser = this.interruptedWith.has(sessionId);
-        // Build final assistant turn
-        const finalContent = this.compactContentBlocks([...turnState.blocks], turnState.result);
-        const assistantTurn = {
-            role: "assistant",
-            content: finalContent,
-            usage: turnState.usage,
-        };
-        const msgs = [...(current.messages ?? [])];
-        const lastMsg = msgs[msgs.length - 1];
-        if (lastMsg && lastMsg.role === "assistant")
-            msgs[msgs.length - 1] = assistantTurn;
-        else
-            msgs.push(assistantTurn);
+        const msgs = this.buildCompletedAssistantMessages(current, turnState);
         const interruptPrompt = this.interruptedWith.get(sessionId);
         const keepRunning = killedForAskUserQuestion || !!interruptPrompt;
         const finished = {
@@ -2375,7 +2338,7 @@ export class StructuredSessionManager {
             output: turnState.result,
             claudeSessionId: turnState.sessionId ?? current.claudeSessionId,
             messages: msgs,
-            queuedMessages: interruptPrompt && !this.preserveQueueOnInterrupt.has(sessionId) ? [] : current.queuedMessages,
+            queuedMessages: this.resolveQueuedMessagesAfterInterrupt(sessionId, current, interruptPrompt),
             pendingEscalation: null,
             permissionBlocked: false,
             structuredState: {
@@ -2496,6 +2459,25 @@ export class StructuredSessionManager {
         }
         return compacted;
     }
+    buildCompletedAssistantMessages(current, turnState) {
+        const assistantTurn = {
+            role: "assistant",
+            content: this.compactContentBlocks([...turnState.blocks], turnState.result),
+            usage: turnState.usage,
+        };
+        const msgs = [...(current.messages ?? [])];
+        const lastMsg = msgs[msgs.length - 1];
+        if (lastMsg && lastMsg.role === "assistant")
+            msgs[msgs.length - 1] = assistantTurn;
+        else
+            msgs.push(assistantTurn);
+        return msgs;
+    }
+    resolveQueuedMessagesAfterInterrupt(sessionId, current, interruptPrompt) {
+        if (interruptPrompt && !this.preserveQueueOnInterrupt.has(sessionId))
+            return [];
+        return current.queuedMessages;
+    }
     normalizeToolInput(input) {
         if (!input || typeof input !== "object" || Array.isArray(input)) {
             return {};

package/dist/types.d.ts

@@ -1,5 +1,4 @@
 export type SessionKind = "pty" | "structured";
-export type SessionCreateKind = "pty" | "structured";
 export type SessionProvider = "claude" | "codex";
 export type SessionRunner = "claude-cli" | "claude-cli-print" | "claude-sdk" | "codex-cli-exec" | "pty";
 export type ExecutionMode = "assist" | "agent" | "agent-max" | "default" | "auto-edit" | "full-access" | "native" | "managed";
@@ -310,10 +309,6 @@ export interface FilePreviewResponse {
     /** File content; only present when kind === "text". */
     content?: string;
 }
-export interface ChatMessage {
-    role: "user" | "assistant";
-    content: string;
-}
 /**
  * Meta marker attached to blocks emitted by a Task-spawned subagent. Present
  * on every block (text / thinking / tool_use / tool_result) whose origin is a

package/dist/upload-routes.js

@@ -10,9 +10,11 @@ function sanitizeFilename(name) {
 export function registerUploadRoutes(app, processes) {
     const storage = multer.diskStorage({
         destination(_req, _file, cb) {
-            const sessionId = _req.params?.id;
-            const session = sessionId ? processes.get(sessionId) : null;
-            const cwd = session?.cwd || "/tmp";
+            const cwd = _req.uploadCwd;
+            if (!cwd) {
+                cb(new Error("会话不存在。"), "");
+                return;
+            }
             const uploadDir = path.join(cwd, ".wand-uploads");
             if (!existsSync(uploadDir)) {
                 mkdirSync(uploadDir, { recursive: true });
@@ -30,13 +32,17 @@ export function registerUploadRoutes(app, processes) {
         storage,
         limits: { fileSize: MAX_FILE_SIZE, files: MAX_FILES },
     });
-    app.post("/api/sessions/:id/upload", upload.array("files", MAX_FILES), (req, res) => {
+    function requireUploadSession(req, res, next) {
         const sessionId = req.params.id;
         const session = processes.get(sessionId);
         if (!session) {
             res.status(404).json({ error: "会话不存在。" });
             return;
         }
+        req.uploadCwd = session.cwd || "/tmp";
+        next();
+    }
+    app.post("/api/sessions/:id/upload", requireUploadSession, upload.array("files", MAX_FILES), (req, res) => {
         const files = req.files || [];
         if (files.length === 0) {
             res.status(400).json({ error: "未收到文件。" });