@cosmicstack/mercury-agent 1.2.3 → 1.2.4

package/README.md

@@ -21,7 +21,7 @@
 </p>
 
 <p align="center">
-  <strong>🔖 Current Stable: v1.1.13</strong>
+  <strong>🔖 Current Stable: v1.2.3</strong>
 </p>
 
 <p align="center">

package/README.zh-CN.md

@@ -23,7 +23,7 @@
 </p>
 
 <p align="center">
-  <strong>🔖 当前稳定版：v1.1.6</strong>
+  <strong>🔖 当前稳定版：v1.2.3</strong>
 </p>
 
 <p align="center">

package/dist/index.js

@@ -32374,6 +32374,15 @@ init_config();
 init_logger();
 import { existsSync as existsSync21, readFileSync as readFileSync16, writeFileSync as writeFileSync15 } from "fs";
 import { join as join19 } from "path";
+
+// src/utils/format.ts
+function formatNumber(value) {
+  const n = Number(value);
+  if (!Number.isFinite(n)) return "0";
+  return n.toLocaleString("en-US", { useGrouping: true });
+}
+
+// src/utils/tokens.ts
 var TOKEN_FILE = "token-usage.json";
 function safeNumber(value) {
   if (value === null || value === void 0) return 0;
@@ -32499,7 +32508,7 @@ var TokenBudget = class {
     const used = this.sanitizeCount(this.dailyUsed);
     const pct = Math.round(this.getUsagePercentage());
     const remaining = this.getRemaining();
-    return `Token budget: ${used.toLocaleString()} / ${this.dailyBudget.toLocaleString()} used (${pct}%), ${remaining.toLocaleString()} remaining`;
+    return `Token budget: ${formatNumber(used)} / ${formatNumber(this.dailyBudget)} used (${pct}%), ${formatNumber(remaining)} remaining`;
   }
   /**
    * Record an estimated savings from Token Saver Mode. Updates both the
@@ -35870,6 +35879,18 @@ function getWebPort() {
   }
   return 6174;
 }
+var ATTACH_TOKEN_FILE = "attach-token";
+function getAttachTokenPath() {
+  return join26(getMercuryHome(), ATTACH_TOKEN_FILE);
+}
+function readAttachToken() {
+  try {
+    const token = readFileSync24(getAttachTokenPath(), "utf-8").trim();
+    return token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
 function loadWebAuth() {
   const path9 = getWebConfigPath();
   if (!existsSync35(path9)) return null;
@@ -36009,6 +36030,14 @@ function getSessionMaxAge() {
 
 // src/web/middleware.ts
 var PUBLIC_PATHS = /* @__PURE__ */ new Set(["/login", "/api/auth/login", "/api/auth/logout"]);
+function isLoopbackRequest(c) {
+  try {
+    const address = c.env?.incoming?.socket?.remoteAddress || "";
+    return ["127.0.0.1", "::1", "::ffff:127.0.0.1"].includes(address);
+  } catch {
+    return false;
+  }
+}
 async function authGuard(c, next) {
   const path9 = new URL(c.req.url).pathname;
   if (path9.startsWith("/vendor/") || path9.startsWith("/static/") || path9.startsWith("/assets/") || path9.startsWith("/icons/") || path9.endsWith(".css") || path9.endsWith(".js") || path9.endsWith(".png") || path9.endsWith(".ico") || path9.endsWith(".svg") || path9.endsWith(".woff2") || path9.endsWith(".webmanifest")) {
@@ -36019,10 +36048,13 @@ async function authGuard(c, next) {
   }
   if (path9.startsWith("/api/")) {
     const token2 = getCookie(c, getSessionCookieName()) || c.req.header("Authorization")?.replace("Bearer ", "");
-    if (!token2 || !validateSession(token2)) {
-      return c.json({ error: "Unauthorized" }, 401);
+    if (token2 && validateSession(token2)) {
+      return next();
     }
-    return next();
+    if (token2 && isLoopbackRequest(c) && token2 === readAttachToken()) {
+      return next();
+    }
+    return c.json({ error: "Unauthorized" }, 401);
   }
   const token = getCookie(c, getSessionCookieName());
   if (!token || !validateSession(token)) {
@@ -37922,7 +37954,7 @@ var pkgVersion;
 try {
   pkgVersion = JSON.parse(readFileSync31(join33(__dirname2, "..", "package.json"), "utf8")).version;
 } catch {
-  pkgVersion = "1.2.3";
+  pkgVersion = "1.2.4";
 }
 function hr() {
   console.log(chalk10.dim("\u2500".repeat(50)));