@co0ontty/wand 4.61.1 → 4.62.0

package/README.md

@@ -216,6 +216,7 @@ npm install -g opencode-ai@latest
 - **个性化角色** — 像素风猫咪头像（赛博虎妞 / 勤劳初二），支持自定义对话角色名称
 - **消息排队** — 在 AI 思考时可继续输入，消息自动排队发送
 - **文件浏览器** — 内置路径浏览和搜索功能
+- **本地预览** — 消息和终端里的本机链接可点击预览；顶栏也可手动打开本机 HTTP 端口或 HTML 目录
 - **快捷提交** — Git 变动快速提交入口，一键生成 commit message
 
 #### 部署与访问

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "14d0be2916773382d9b9c692d21ec271479d1fe4",
-  "builtAt": "2026-09-14T06:29:08.871Z",
-  "version": "4.61.1",
+  "commit": "21dc7e71b1a62f0b83dc1932ae726c53164a3009",
+  "builtAt": "2026-09-14T11:06:50.198Z",
+  "version": "4.62.0",
   "channel": "stable"
 }

package/dist/server-file-routes.js

@@ -8,7 +8,7 @@ import { promisify } from "node:util";
 import { getErrorMessage } from "./error-utils.js";
 import { asyncRoute } from "./express-async.js";
 import { sendRouteError } from "./server-request.js";
-import { isBlockedFolderPath, normalizeFolderPath } from "./middleware/path-safety.js";
+import { isBlockedFolderPath, isPathWithinBase, normalizeFolderPath } from "./middleware/path-safety.js";
 import { parseBoundedInteger } from "./request-limits.js";
 const execAsync = promisify(exec);
 const DIRECTORY_MAX_ITEMS = 200;
@@ -400,6 +400,88 @@ export function registerFileRoutes(app, deps) {
             sendRouteError(res, error, "Failed to read file");
         }
     }));
+    // Serve a directory or a single HTML file as a small local static site. The
+    // base64url root keeps a URL-directory shape so browser-resolved relative
+    // assets stay on this endpoint instead of escaping to the Wand shell.
+    app.use("/api/local-file/:encodedRoot", asyncRoute(async (req, res) => {
+        if (req.method !== "GET" && req.method !== "HEAD") {
+            res.status(405).json({ error: "本地文件预览只支持 GET。" });
+            return;
+        }
+        const encodedRoot = String(req.params.encodedRoot ?? "");
+        if (!/^[A-Za-z0-9_-]*$/.test(encodedRoot)) {
+            res.status(400).json({ error: "本地预览路径格式无效。" });
+            return;
+        }
+        let rootPath = "";
+        try {
+            rootPath = Buffer.from(encodedRoot, "base64url").toString("utf8");
+        }
+        catch {
+            res.status(400).json({ error: "本地预览路径格式无效。" });
+            return;
+        }
+        if (!rootPath.trim()) {
+            res.status(400).json({ error: "缺少本地预览路径。" });
+            return;
+        }
+        const requestedRoot = normalizeFolderPath(rootPath);
+        if (isBlockedFolderPath(requestedRoot)) {
+            res.status(403).json({ error: "访问被拒绝：无法访问系统敏感目录。" });
+            return;
+        }
+        let relativePath = req.url.split("?")[0] ?? "/";
+        try {
+            relativePath = decodeURIComponent(relativePath);
+        }
+        catch {
+            res.status(400).json({ error: "本地预览资源路径无效。" });
+            return;
+        }
+        relativePath = relativePath.replace(/^\/+/, "");
+        try {
+            const rootStat = await stat(requestedRoot);
+            const baseRoot = rootStat.isFile() ? path.dirname(requestedRoot) : requestedRoot;
+            const requested = relativePath.trim() || (rootStat.isFile() ? path.basename(requestedRoot) : "index.html");
+            const resolvedPath = path.resolve(baseRoot, requested);
+            if (!isPathWithinBase(resolvedPath, baseRoot) || isBlockedFolderPath(resolvedPath)) {
+                res.status(403).json({ error: "访问被拒绝：路径越界。" });
+                return;
+            }
+            let fileStat = await stat(resolvedPath);
+            let filePath = resolvedPath;
+            if (fileStat.isDirectory()) {
+                filePath = path.join(resolvedPath, "index.html");
+                fileStat = await stat(filePath);
+            }
+            if (!fileStat.isFile()) {
+                res.status(400).json({ error: "目标不是普通文件。" });
+                return;
+            }
+            const ext = path.extname(filePath).toLowerCase();
+            const baseName = path.basename(filePath);
+            const encodedName = encodeURIComponent(baseName);
+            streamFileWithRange(req, res, {
+                filePath,
+                size: fileStat.size,
+                contentType: mimeForExt(ext),
+                disposition: `inline; filename*=UTF-8''${encodedName}`,
+                headers: {
+                    "Cache-Control": "private, no-cache",
+                    "X-Content-Type-Options": "nosniff",
+                },
+                readErrorMessage: "读取本地文件失败。",
+            });
+        }
+        catch (error) {
+            const err = error;
+            if (err.code === "ENOENT") {
+                res.status(404).json({ error: "本地预览入口或资源不存在。" });
+                return;
+            }
+            sendRouteError(res, error, "读取本地文件失败。");
+        }
+    }));
     app.get("/api/folders", asyncRoute(async (req, res) => {
         const q = typeof req.query.q === "string" ? req.query.q : "/tmp";
         const targetPath = normalizeFolderPath(q);
@@ -729,6 +811,10 @@ const TEXT_BASENAME_ALLOW = new Set([
     "makefile", "readme", "license", "changelog",
 ]);
 const MIME_BY_EXT = {
+    ".html": "text/html; charset=utf-8", ".htm": "text/html; charset=utf-8",
+    ".css": "text/css; charset=utf-8", ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8", ".json": "application/json; charset=utf-8",
+    ".map": "application/json; charset=utf-8", ".xml": "application/xml; charset=utf-8",
     ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp",
     ".svg": "image/svg+xml", ".avif": "image/avif", ".bmp": "image/bmp", ".ico": "image/x-icon", ".heic": "image/heic",
     ".heif": "image/heif", ".pdf": "application/pdf", ".mp4": "video/mp4", ".webm": "video/webm", ".mov": "video/quicktime",

package/dist/server-local-preview-routes.d.ts

@@ -0,0 +1,17 @@
+import type { Express, RequestHandler } from "express";
+export interface LocalPreviewTarget {
+    hostname: string;
+    port: number;
+    path: string;
+}
+/** Parse and constrain a proxy target to a loopback HTTP service. */
+export declare function parseLocalPreviewTarget(rawHost: string, rawPort: string, rawPath: string): LocalPreviewTarget | null;
+/**
+ * Reverse-proxy a user-selected loopback port. The route is mounted before the
+ * JSON body parser so POST/PUT bodies remain byte streams, including multipart
+ * uploads and other content types that Express does not need to inspect.
+ */
+export declare function registerLocalPreviewRoutes(app: Express, dependencies: {
+    requireAuth: RequestHandler;
+    requireFiles: RequestHandler;
+}): void;

package/dist/server-local-preview-routes.js

@@ -0,0 +1,136 @@
+import http from "node:http";
+import { getErrorMessage } from "./error-utils.js";
+import { asyncRoute } from "./express-async.js";
+const MAX_PORT = 65535;
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+/** Headers that identify the original Wand request and must not leak downstream. */
+const FILTERED_REQUEST_HEADERS = new Set([
+    "authorization",
+    "connection",
+    "cookie",
+    "expect",
+    "host",
+    "upgrade",
+]);
+/** Hop-by-hop and browser-security headers are owned by the proxy response. */
+const FILTERED_RESPONSE_HEADERS = new Set([
+    "connection",
+    "content-security-policy",
+    "content-security-policy-report-only",
+    "cross-origin-embedder-policy",
+    "cross-origin-opener-policy",
+    "cross-origin-resource-policy",
+    "keep-alive",
+    "permissions-policy",
+    "set-cookie",
+    "strict-transport-security",
+    "transfer-encoding",
+    "upgrade",
+    "x-frame-options",
+]);
+/** Parse and constrain a proxy target to a loopback HTTP service. */
+export function parseLocalPreviewTarget(rawHost, rawPort, rawPath) {
+    const hostname = rawHost.trim().toLowerCase();
+    if (!LOOPBACK_HOSTS.has(hostname))
+        return null;
+    if (!/^\d{1,5}$/.test(rawPort))
+        return null;
+    const port = Number(rawPort);
+    if (!Number.isInteger(port) || port < 1 || port > MAX_PORT)
+        return null;
+    const suffix = rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
+    return {
+        hostname: hostname === "localhost" ? "127.0.0.1" : hostname === "[::1]" ? "::1" : hostname,
+        port,
+        path: suffix,
+    };
+}
+function proxyLocation(value, target) {
+    if (value.startsWith("/")) {
+        return `/api/local-preview/${target.hostname}/${target.port}${value}`;
+    }
+    try {
+        const url = new URL(value);
+        if (url.hostname === target.hostname && url.port === String(target.port)) {
+            return `/api/local-preview/${target.hostname}/${target.port}${url.pathname}${url.search}`;
+        }
+    }
+    catch {
+        // Leave non-HTTP schemes and opaque values untouched.
+    }
+    return value;
+}
+/**
+ * Reverse-proxy a user-selected loopback port. The route is mounted before the
+ * JSON body parser so POST/PUT bodies remain byte streams, including multipart
+ * uploads and other content types that Express does not need to inspect.
+ */
+export function registerLocalPreviewRoutes(app, dependencies) {
+    const handler = asyncRoute(async (req, res, next) => {
+        const target = parseLocalPreviewTarget(String(req.params.host ?? ""), String(req.params.port ?? ""), req.url || "/");
+        if (!target) {
+            res.status(400).json({ error: "只允许预览本机（localhost）HTTP 服务。" });
+            return;
+        }
+        const headers = {};
+        for (const [key, value] of Object.entries(req.headers)) {
+            if (FILTERED_REQUEST_HEADERS.has(key) || value === undefined)
+                continue;
+            headers[key] = Array.isArray(value) ? [...value] : value;
+        }
+        headers["x-forwarded-for"] = req.ip || req.socket.remoteAddress || "";
+        headers["x-forwarded-host"] = req.headers.host ?? "";
+        headers["x-forwarded-proto"] = req.protocol;
+        let upstream;
+        try {
+            upstream = await new Promise((resolve, reject) => {
+                const proxyReq = http.request({
+                    hostname: target.hostname,
+                    port: target.port,
+                    path: target.path,
+                    method: req.method,
+                    headers,
+                }, resolve);
+                proxyReq.once("error", reject);
+                req.once("error", reject);
+                req.pipe(proxyReq);
+            });
+        }
+        catch (error) {
+            if (!res.headersSent) {
+                const code = error.code;
+                const message = code === "ECONNREFUSED"
+                    ? "本地服务未启动或端口不可用。"
+                    : `无法连接本地服务：${getErrorMessage(error)}`;
+                res.status(502).json({ error: message });
+            }
+            else {
+                res.destroy();
+            }
+            return;
+        }
+        res.status(upstream.statusCode ?? 502);
+        for (const [key, value] of Object.entries(upstream.headers)) {
+            if (FILTERED_RESPONSE_HEADERS.has(key) || value === undefined)
+                continue;
+            if (key.toLowerCase() === "location" && typeof value === "string") {
+                res.setHeader(key, proxyLocation(value, target));
+                continue;
+            }
+            res.setHeader(key, value);
+        }
+        if (req.method === "HEAD" || !upstream.statusCode) {
+            upstream.destroy();
+            res.end();
+            return;
+        }
+        upstream.once("error", () => {
+            if (!res.writableEnded)
+                res.destroy();
+        });
+        upstream.pipe(res);
+    });
+    // req.url is the suffix after the mounted host/port prefix, preserving query
+    // strings and relative assets while keeping host and port as route params.
+    app.use("/api/local-preview/:host/:port", dependencies.requireAuth, dependencies.requireFiles, handler);
+}

package/dist/server.js

@@ -20,6 +20,7 @@ import { SessionRegistry } from "./session-registry.js";
 import { resolveSessionAiContext, resolveSystemAiContext } from "./session-ai-context.js";
 import { StructuredSessionManager } from "./structured-session-manager.js";
 import { recordRecentPath, registerFileRoutes } from "./server-file-routes.js";
+import { registerLocalPreviewRoutes } from "./server-local-preview-routes.js";
 import { registerSettingsRoutes } from "./server-settings-routes.js";
 import { appTokenLoginPayload, buildStructuredChatPersonaPayload, isBrowserExtensionOrigin, resolveAppConnectCode, resolveStructuredChatAvatarPath, verifyAppToken, } from "./server-app-connect.js";
 import { firstHeaderValue, sendRouteError } from "./server-request.js";
@@ -325,6 +326,9 @@ export async function startServer(config, configPath, options = {}) {
     const requireSessions = buildRequireScope("sessions");
     const requireFiles = buildRequireScope("files");
     const requirePasswordVault = buildRequireScope("password-vault");
+    // Local preview traffic may contain arbitrary POST bodies. Mounting it before
+    // Express body parsers keeps uploads, SSE and non-JSON requests streamable.
+    registerLocalPreviewRoutes(app, { requireAuth, requireFiles });
     // Route-specific parsers must run before the global parser. Once body-parser
     // has consumed a request, a later express.json() cannot tighten or widen it.
     app.use("/api/optimize-prompt", express.json({ limit: "256kb" }));
@@ -544,6 +548,7 @@ export async function startServer(config, configPath, options = {}) {
         "/api/quick-paths",
         "/api/validate-path",
         "/api/file-search",
+        "/api/local-file",
     ], requireFiles);
     app.use("/api/browser-extension", requirePasswordVault);
     // ── Config & Session info ──