@olares/lares-core 0.15.0

package/media/ffmpeg-run.js

@@ -0,0 +1,117 @@
+import { spawn } from "node:child_process";
+import { existsSync, statSync } from "node:fs";
+import { extname } from "node:path";
+
+const LOG_LIMIT = 32_000;
+const STDERR_LIMIT = 2000;
+const SUBTITLE_STYLE = "FontName=Noto Sans CJK SC,FontSize=20,Outline=2,Shadow=0,MarginV=28";
+const EVEN_DIMENSIONS = "pad=ceil(iw/2)*2:ceil(ih/2)*2";
+const LIBX264_ARGV = [
+  "-c:v", "libx264",
+  "-preset", "veryfast",
+  "-crf", "23",
+  "-pix_fmt", "yuv420p",
+];
+
+export function parseFfmpegReport(log, fallbackEncoder = "libx264") {
+  const text = String(log ?? "");
+  const speedMatch = [...text.matchAll(/\bspeed=\s*([0-9.]+)x\b/g)].at(-1);
+  const encoderMatch = text.match(/\[(libx264)\s@/i)
+    || text.match(/\bencoder:\s*(libx264)\b/i);
+  return {
+    encoder: encoderMatch?.[1] || fallbackEncoder,
+    speed: speedMatch ? `${speedMatch[1]}x` : "",
+  };
+}
+
+function escapeFilterValue(value) {
+  return String(value).replace(/([\\':,\[\];=\s])/g, "\\$1");
+}
+
+export function subtitleFilter(absolutePath) {
+  return `subtitles=filename=${escapeFilterValue(absolutePath)}:force_style='${SUBTITLE_STYLE}'`;
+}
+
+export function ffmpegEncodeArgv(job, { overwrite = false } = {}) {
+  const generated = Boolean(job.lavfi);
+  const args = ["-hide_banner", overwrite ? "-y" : "-n"];
+  if (generated) {
+    args.push("-f", "lavfi", "-i", job.lavfi);
+  } else {
+    args.push("-i", job.inputAbsolute);
+  }
+  if (job.duration != null) args.push("-t", String(job.duration));
+  const filters = [];
+  if (!generated) filters.push(EVEN_DIMENSIONS);
+  if (job.subtitlesAbsolute) filters.push(subtitleFilter(job.subtitlesAbsolute));
+  if (filters.length > 0) args.push("-vf", filters.join(","));
+  args.push(...LIBX264_ARGV);
+  if (!generated) args.push("-map", "0:v:0", "-map", "0:a:0?", "-c:a", "aac", "-b:a", "128k");
+  const ext = extname(job.absolutePath).toLowerCase();
+  if (ext === ".mp4") args.push("-movflags", "+faststart");
+  args.push(job.absolutePath);
+  return args;
+}
+
+function collectLog(stream, limit) {
+  let log = "";
+  stream?.on("data", (chunk) => {
+    log = `${log}${chunk}`.slice(-limit);
+  });
+  return () => log;
+}
+
+function ffmpegLogFailed(log) {
+  return /File ['"].*['"] already exists/i.test(log)
+    || /Conversion failed!/i.test(log)
+    || /Error opening output file/i.test(log);
+}
+
+function runFfmpeg(args, {
+  ffmpegBin = "ffmpeg",
+  spawnFn = spawn,
+  signal,
+} = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawnFn(ffmpegBin, args, {
+      env: process.env,
+      stdio: ["ignore", "pipe", "pipe"],
+      ...(signal ? { signal } : {}),
+    });
+    const stdout = collectLog(child.stdout, LOG_LIMIT);
+    const stderr = collectLog(child.stderr, LOG_LIMIT);
+    child.on("error", (error) => {
+      reject(new Error(`ffmpeg failed: ${error.message}`));
+    });
+    child.on("close", (code) => {
+      const log = `${stdout()}\n${stderr()}`;
+      if (code === 0 && !ffmpegLogFailed(log)) {
+        resolve(log);
+        return;
+      }
+      reject(new Error(`ffmpeg exited ${code}: ${log.trim().slice(-STDERR_LIMIT) || "no output"}`));
+    });
+  });
+}
+
+export async function encodeWorkspaceVideo(job, {
+  ffmpegBin = "ffmpeg",
+  spawnFn = spawn,
+  signal,
+} = {}) {
+  if (!job.overwrite && existsSync(job.absolutePath)) {
+    throw new Error(`${job.absolutePath} already exists; pass overwrite or choose another destination`);
+  }
+  const args = ffmpegEncodeArgv(job, { overwrite: Boolean(job.overwrite) });
+  const log = await runFfmpeg(args, { ffmpegBin, spawnFn, signal });
+  const info = statSync(job.absolutePath);
+  if (!info.isFile() || info.size === 0) {
+    throw new Error("ffmpeg wrote an empty file");
+  }
+  const report = parseFfmpegReport(log);
+  return {
+    bytes: info.size,
+    encoder: report.encoder,
+    speed: report.speed || "",
+  };
+}

package/media/router-images.js

@@ -0,0 +1,63 @@
+/**
+ * Router's local engines decode prompt images with llama.cpp's stb_image,
+ * which has no WebP decoder: a WebP part is dropped from the prompt without an
+ * error and the model answers as though no image arrived. dsh sends each image
+ * in the media type it was uploaded as, so this gateway — the one hop every
+ * image bound for Router takes, whatever composer or tool produced it — is
+ * where the encoding is brought back into what the engines read.
+ */
+import sharp from "sharp";
+
+const WEBP_DATA_URL = /^data:image\/webp;base64,([a-z0-9+/=\s]*)$/i;
+/** Parsing a chat body is only worth it when one of these is actually in it. */
+const WEBP_MARKER = "data:image/webp";
+
+/** @param {Buffer} body */
+export function carriesWebpImage(body) {
+  return body.includes(WEBP_MARKER);
+}
+
+/**
+ * PNG preserves an icon's transparency; a photograph re-encoded losslessly
+ * would multiply the request body, so one without alpha goes to JPEG.
+ */
+async function transcode(dataUrl) {
+  const match = WEBP_DATA_URL.exec(dataUrl);
+  if (match === null) return dataUrl;
+  const image = sharp(Buffer.from(match[1], "base64"));
+  const { hasAlpha } = await image.metadata();
+  const mediaType = hasAlpha ? "image/png" : "image/jpeg";
+  const bytes = await (hasAlpha ? image.png() : image.jpeg({ quality: 90 })).toBuffer();
+  return `data:${mediaType};base64,${bytes.toString("base64")}`;
+}
+
+/**
+ * Re-encode every WebP data URL the payload carries, wherever it sits: the
+ * OpenAI wire shape puts one under `image_url.url`, but a nested tool result
+ * or a future part spells its own path to the same string.
+ */
+async function rewrite(value) {
+  if (typeof value === "string") return transcode(value);
+  if (Array.isArray(value)) return Promise.all(value.map((item) => rewrite(item)));
+  if (value === null || typeof value !== "object") return value;
+  const entries = await Promise.all(
+    Object.entries(value).map(async ([key, nested]) => [key, await rewrite(nested)]),
+  );
+  return Object.fromEntries(entries);
+}
+
+/**
+ * @param {Buffer} body - the chat request exactly as dsh sent it.
+ * @returns {Promise<Buffer>} the same request with WebP images re-encoded as
+ * PNG, or the original bytes when it cannot be rewritten.
+ */
+export async function transcodeWebpImages(body) {
+  try {
+    const rewritten = await rewrite(JSON.parse(body.toString("utf8")));
+    return Buffer.from(JSON.stringify(rewritten), "utf8");
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.warn(`[lares] WebP prompt image forwarded unconverted: ${message}`);
+    return body;
+  }
+}

package/olares/entrance.js

@@ -0,0 +1,45 @@
+/**
+ * Olares 入口域推导（client 侧共享源码，由各插件 client 构建时内联）。
+ *
+ * Olares 给每个应用入口分配 `<前缀>.<用户>.<zone>`：Lares 的前缀随安装随机，
+ * Router chart 固定申领第三级域名 `router`，两者共用同一 zone
+ * （公网 olares.com 与局域网 olares.local 各一套）。因此把当前页面域名的
+ * 首段换成 `router` 即 Router 控制台。
+ *
+ * 端口转发 / IP 直连等非入口访问下无法推断，返回空串，调用方应隐藏入口。
+ */
+
+export function loopbackWebUrl(port) {
+  if (port === undefined || port === null || port === "") {
+    throw new Error("webServer missing while resolving surface URL");
+  }
+  return `http://127.0.0.1:${String(port)}`;
+}
+
+const ROUTER_LABEL = "router";
+const OLARES_ZONES = new Set(["olares.com", "olares.local"]);
+const DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+// Router 控制台是 history 模式 SPA，入口即顶层路由路径。
+const ROUTER_ROUTE = /^[a-z0-9]+(?:-[a-z0-9]+)*(?:\/[a-z0-9]+(?:-[a-z0-9]+)*)*$/;
+
+/**
+ * @param {string} [route] Router 控制台顶层路由，如 llm / audio / tools
+ * @param {string} [hostname] 当前页面 hostname（不含端口）
+ * @returns {string} Router 控制台 URL；无法推断时为空串
+ */
+export function routerConsoleUrl(route = "", hostname = globalThis.location?.hostname ?? "") {
+  const labels = String(hostname).trim().toLowerCase().split(".");
+  if (labels.length !== 4 || labels.some((label) => !DNS_LABEL.test(label))) return "";
+  if (!OLARES_ZONES.has(labels.slice(-2).join("."))) return "";
+  const path = String(route).trim().toLowerCase();
+  if (path && !ROUTER_ROUTE.test(path)) return "";
+  const origin = `https://${[ROUTER_LABEL, ...labels.slice(1)].join(".")}`;
+  return path ? `${origin}/${path}` : origin;
+}
+
+/** 新标签页打开 Router 控制台；无入口时静默忽略。 */
+export function openRouterConsole(route = "") {
+  const url = routerConsoleUrl(route);
+  if (!url) return;
+  globalThis.open?.(url, "_blank", "noopener,noreferrer");
+}

package/olares/identity.js

@@ -0,0 +1,190 @@
+/**
+ * Olares edge identity → olares-cli profile (from test_lares).
+ * Access JWT only; no refresh. Commands work until the cookie expires.
+ */
+import { createCipheriv, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+const MASTER_KEY_BYTES = 32;
+const IV_BYTES = 12;
+const SERVICE = "olares-cli";
+
+/**
+ * @typedef {{ user: string, token: string, terminus: string }} OlaresIdentity
+ */
+
+/** @param {OlaresIdentity} identity */
+export function identityAvailable(identity) {
+  return Boolean(identity.user && identity.token && identity.terminus);
+}
+
+/** @param {string} cookieHeader */
+function parseCookies(cookieHeader) {
+  /** @type {Record<string, string>} */
+  const out = {};
+  for (const part of cookieHeader.split(";")) {
+    if (!part.includes("=")) continue;
+    const [name, ...rest] = part.split("=");
+    out[name.trim()] = rest.join("=").trim();
+  }
+  return out;
+}
+
+/** @param {string} user */
+function userLabel(user) {
+  return user.split("@", 1)[0]?.trim().toLowerCase() ?? "";
+}
+
+/**
+ * @param {string} hostHeader
+ * @param {string} user
+ */
+function terminusFromHost(hostHeader, user) {
+  const host = hostHeader.trim().split(":")[0]?.toLowerCase() ?? "";
+  const parts = host.split(".");
+  if (parts.length < 3) return "";
+  const terminus = parts.slice(1).join(".");
+  const label = userLabel(user);
+  if (!label || terminus.split(".", 1)[0] !== label) return "";
+  return terminus;
+}
+
+/**
+ * @param {import('node:http').IncomingHttpHeaders | Headers | Record<string, string | string[] | undefined>} headers
+ * @param {string | null} [userDomain]
+ * @returns {OlaresIdentity}
+ */
+export function identityFromHeaders(headers, userDomain) {
+  const get = (name) => {
+    if (typeof Headers !== "undefined" && headers instanceof Headers) {
+      return headers.get(name) ?? "";
+    }
+    const raw = /** @type {Record<string, string | string[] | undefined>} */ (headers)[name]
+      ?? /** @type {Record<string, string | string[] | undefined>} */ (headers)[name.toLowerCase()];
+    if (Array.isArray(raw)) return raw.join(",");
+    return raw ?? "";
+  };
+
+  const user = (
+    get("remote-user")
+    || get("authelia-remote-user")
+    || get("x-bfl-user")
+    || ""
+  ).trim();
+
+  const cookies = parseCookies(get("cookie"));
+  let token = (cookies.auth_token ?? "").trim();
+  if (!token) {
+    const authorization = get("authorization").trim();
+    if (authorization.toLowerCase().startsWith("bearer ")) {
+      token = authorization.slice(7).trim();
+    } else if (authorization) {
+      token = authorization;
+    }
+  }
+  if (!token) token = get("x-authorization").trim();
+
+  let terminus = (userDomain ?? "").trim();
+  if (!terminus) terminus = terminusFromHost(get("x-forwarded-host"), user);
+  if (!terminus && user) terminus = `${userLabel(user)}.olares.com`;
+
+  return { user, token, terminus };
+}
+
+/** @param {string} account */
+function safeFileName(account) {
+  return `${account.replace(/[^a-zA-Z0-9._-]/g, "_")}.enc`;
+}
+
+/**
+ * @param {string} plaintext
+ * @param {Buffer} key
+ */
+function encryptAesGcm(plaintext, key) {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, ciphertext, tag]);
+}
+
+/** @param {OlaresIdentity} identity */
+function ownerHome(identity) {
+  const root = (
+    process.env.LARES_CLI_ROOT
+    ?? process.env.OLARES_CLI_ROOT
+    ?? "/data/cli"
+  ).replace(/\/+$/, "");
+  const label = userLabel(identity.user) || "anonymous";
+  return join(root, label);
+}
+
+/**
+ * Materialize per-user olares-cli profile + Linux file keychain from the edge
+ * access token so bash/`olares-cli` authenticates without interactive login.
+ *
+ * @param {OlaresIdentity} identity
+ */
+export function ensureCliProfile(identity) {
+  if (!identityAvailable(identity)) {
+    throw new Error("Olares edge identity incomplete (need user + auth_token + terminus)");
+  }
+
+  const home = ownerHome(identity);
+  const configDir = join(home, ".olares-cli");
+  const dataDir = join(home, "keychain");
+  const serviceDir = join(dataDir, SERVICE);
+  mkdirSync(configDir, { recursive: true, mode: 0o700 });
+  mkdirSync(serviceDir, { recursive: true, mode: 0o700 });
+
+  const configPath = join(configDir, "config.json");
+  const config = {
+    currentProfile: identity.user,
+    profiles: [
+      {
+        olaresId: identity.user,
+        backendVersion: "1.12.7",
+        backendVersionRefreshedAt: Math.floor(Date.now() / 1000),
+      },
+    ],
+  };
+  writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+
+  const masterPath = join(serviceDir, "master.key");
+  let master;
+  if (existsSync(masterPath)) {
+    master = readFileSync(masterPath);
+    if (master.length !== MASTER_KEY_BYTES) {
+      master = randomBytes(MASTER_KEY_BYTES);
+      writeFileSync(masterPath, master, { mode: 0o600 });
+    }
+  } else {
+    master = randomBytes(MASTER_KEY_BYTES);
+    writeFileSync(masterPath, master, { mode: 0o600 });
+  }
+
+  const stored = {
+    olaresId: identity.user,
+    accessToken: identity.token,
+    refreshToken: "",
+    grantedAt: Date.now(),
+    invalidatedAt: 0,
+  };
+  const enc = encryptAesGcm(JSON.stringify(stored), master);
+  const tokenPath = join(serviceDir, safeFileName(identity.user));
+  const tmp = `${tokenPath}.${process.pid}.tmp`;
+  writeFileSync(tmp, enc, { mode: 0o600 });
+  renameSync(tmp, tokenPath);
+
+  return {
+    home,
+    dataDir,
+    env: {
+      HOME: home,
+      OLARES_CLI_HOME: configDir,
+      OLARES_CLI_DATA_DIR: dataDir,
+      OLARES_CLI_REMOTE_ONLY: "1",
+    },
+  };
+}

package/olares/session-identity.js

@@ -0,0 +1,48 @@
+import {
+  ensureCliProfile,
+  identityAvailable,
+} from "./identity.js";
+
+/** @type {Map<string, import('./identity.js').OlaresIdentity>} */
+const bySession = new Map();
+
+/** @type {import('./identity.js').OlaresIdentity | null} */
+let latest = null;
+
+/**
+ * Cache edge identity and materialize olares-cli env (HOME / OLARES_CLI_*) for bash.
+ * @param {string} sessionId
+ * @param {import('./identity.js').OlaresIdentity} identity
+ */
+export function rememberSessionIdentity(sessionId, identity) {
+  if (sessionId) bySession.set(sessionId, identity);
+  latest = identity;
+  if (!identityAvailable(identity)) return;
+  const profile = ensureCliProfile(identity);
+  Object.assign(process.env, profile.env);
+}
+
+/**
+ * Apply identity from a browser request when no session id is known yet.
+ * @param {import('./identity.js').OlaresIdentity} identity
+ */
+export function rememberRequestIdentity(identity) {
+  latest = identity;
+  if (!identityAvailable(identity)) return;
+  const profile = ensureCliProfile(identity);
+  Object.assign(process.env, profile.env);
+}
+
+/** @param {string} sessionId */
+export function getSessionIdentity(sessionId) {
+  return bySession.get(sessionId) ?? null;
+}
+
+export function getLatestIdentity() {
+  return latest;
+}
+
+/** @param {string} sessionId */
+export function forgetSessionIdentity(sessionId) {
+  bySession.delete(sessionId);
+}

package/olares/trusted-host.js

@@ -0,0 +1,37 @@
+export function trustedEntranceHosts(env = process.env) {
+  return (env.DSH_TRUSTED_HOSTS ?? "")
+    .split(",")
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+/** Hostname of a bare `host[:port]` authority, or null when unparsable. */
+export function hostnameOf(authority) {
+  try {
+    return new URL(`http://${authority}`).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+
+export function viaOlaresEntrance(hostHeader, entranceHosts) {
+  if (!hostHeader) return false;
+  const hostname = hostnameOf(hostHeader);
+  if (!hostname) return false;
+  return entranceHosts.some((entry) => hostnameOf(entry) === hostname);
+}
+
+export function shouldRewriteApiLoopback(req, entranceHosts) {
+  const path = new URL(req.url ?? "/", "http://x").pathname;
+  if (!path.startsWith("/api")) return false;
+  return viaOlaresEntrance(req.headers.host, entranceHosts);
+}
+
+export function loopbackAuthority(port) {
+  return `127.0.0.1:${port}`;
+}
+
+export function applyLoopbackHeaders(headers, authority) {
+  headers.host = authority;
+  if (headers.origin !== undefined) headers.origin = `http://${authority}`;
+}

package/package.json

@@ -0,0 +1,111 @@
+{
+  "name": "@olares/lares-core",
+  "version": "0.15.0",
+  "description": "Lares 共享业务核心：Router、workspace、文件/媒体、Olares 身份（无 UI、无平台壳）",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/beclab/lares.git",
+    "directory": "packages/core"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "files": [
+    "brand",
+    "drive",
+    "files",
+    "i18n",
+    "icons",
+    "larepass",
+    "media",
+    "olares",
+    "router",
+    "search",
+    "tools",
+    "voice",
+    "workspace"
+  ],
+  "exports": {
+    "./tools/http": "./tools/http.js",
+    "./tools/json-file": "./tools/json-file.js",
+    "./tools/async": "./tools/async.js",
+    "./tools/crypto-uuid": "./tools/crypto-uuid.js",
+    "./brand/identity": "./brand/identity.js",
+    "./brand/manifest": "./brand/manifest.js",
+    "./icons/mark": "./icons/mark.js",
+    "./i18n/t": "./i18n/t.js",
+    "./i18n/chat-model": "./i18n/chat-model.js",
+    "./i18n/chat-model-switch": "./i18n/chat-model-switch.js",
+    "./i18n/files": "./i18n/files.js",
+    "./i18n/voice": "./i18n/voice.js",
+    "./i18n/search": "./i18n/search.js",
+    "./i18n/preview": "./i18n/preview.js",
+    "./i18n/mobile": "./i18n/mobile.js",
+    "./router/catalog": "./router/catalog.js",
+    "./router/gateway": "./router/gateway.js",
+    "./router/models": {
+      "types": "./router/models.d.ts",
+      "default": "./router/models.js"
+    },
+    "./router/search": "./router/search.js",
+    "./router/shim": "./router/shim.js",
+    "./router/stt": "./router/stt.js",
+    "./router/catalog-sync": "./router/catalog-sync.js",
+    "./router/session-model": "./router/session-model.js",
+    "./workspace/env": "./workspace/env.js",
+    "./workspace/home": "./workspace/home.js",
+    "./workspace/path": "./workspace/path.js",
+    "./workspace/seed": "./workspace/seed.js",
+    "./workspace/session": "./workspace/session.js",
+    "./files/filename": "./files/filename.js",
+    "./files/upload": "./files/upload.js",
+    "./files/upload-http": "./files/upload-http.js",
+    "./files/limits": "./files/limits.js",
+    "./files/upload-client": "./files/upload-client.js",
+    "./files/preview": "./files/preview.js",
+    "./files/preview-workspace": "./files/preview-workspace.js",
+    "./files/preview-groups": "./files/preview-groups.js",
+    "./files/preview-cache": "./files/preview-cache.js",
+    "./files/markdown": "./files/markdown.js",
+    "./files/deliverables": "./files/deliverables.js",
+    "./files/disposition": "./files/disposition.js",
+    "./files/intake": "./files/intake.js",
+    "./files/mention": "./files/mention.js",
+    "./drive/files-path": "./drive/files-path.js",
+    "./drive/paths": "./drive/paths.js",
+    "./drive/download": "./drive/download.js",
+    "./drive/ls": "./drive/ls.js",
+    "./drive/url-download": "./drive/url-download.js",
+    "./drive/execute": "./drive/execute.js",
+    "./drive/tools": "./drive/tools.js",
+    "./voice/config": "./voice/config.js",
+    "./voice/languages": "./voice/languages.js",
+    "./voice/service": "./voice/service.js",
+    "./voice/client": "./voice/client.js",
+    "./voice/recorder": "./voice/recorder.js",
+    "./search/config": "./search/config.js",
+    "./search/menu": "./search/menu.js",
+    "./search/client": "./search/client.js",
+    "./router/models-client": "./router/models-client.js",
+    "./media/ffmpeg-run": "./media/ffmpeg-run.js",
+    "./media/router-images": "./media/router-images.js",
+    "./olares/identity": "./olares/identity.js",
+    "./olares/session-identity": "./olares/session-identity.js",
+    "./olares/entrance": "./olares/entrance.js",
+    "./olares/trusted-host": "./olares/trusted-host.js",
+    "./larepass/host": "./larepass/host.js",
+    "./larepass/rpc": "./larepass/rpc.js",
+    "./larepass/context-provenance": "./larepass/context-provenance.js",
+    "./larepass/tool-row": "./larepass/tool-row.js",
+    "./larepass/stage-copy": "./larepass/stage-copy.js",
+    "./larepass/transcript": "./larepass/transcript.js",
+    "./larepass/chat": "./larepass/chat.js",
+    "./larepass/mux": "./larepass/mux.js",
+    "./larepass/session-cache": "./larepass/session-cache.js",
+    "./larepass/runtime": "./larepass/runtime.js",
+    "./larepass/questions": "./larepass/questions.js",
+    "./larepass/settings": "./larepass/settings.js"
+  }
+}