@rexvane/piweb 0.3.18 → 0.3.20

package/src/app/api/sessions/[id]/export/route.ts

@@ -4,6 +4,16 @@ import { BoundaryError, resolveSessionPath } from "@/lib/path-security";
 
 export const dynamic = "force-dynamic";
 
+/**
+ * 下载文件名：filename= 里放 ASCII 兜底，filename*= 按 RFC 6266/5987 放 UTF-8 原名。
+ * 只写百分号编码的 filename= 时浏览器不解码，中文会话名下载下来就是一串 %E4%BD%A0…
+ */
+function attachmentDisposition(filename: string): string {
+	const fallback = filename.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_") || "session";
+	const encoded = encodeURIComponent(filename).replace(/['()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+	return `attachment; filename="${fallback}"; filename*=UTF-8''${encoded}`;
+}
+
 export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
 	const { id } = await params;
 	const format = new URL(req.url).searchParams.get("format") === "html" ? "html" : "jsonl";
@@ -13,7 +23,7 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
 		return new Response(content, {
 			headers: {
 				"Content-Type": `${contentType}; charset=utf-8`,
-				"Content-Disposition": `attachment; filename="${encodeURIComponent(filename)}"`,
+				"Content-Disposition": attachmentDisposition(filename),
 			},
 		});
 	} catch (error) {

package/src/app/api/sessions/route.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { NextResponse } from "next/server";
 import { listSessions } from "@/lib/session-reader";
-import { activeStatus } from "@/lib/agent-manager";
+import { activeStatus, warmSessionResources } from "@/lib/agent-manager";
 import { getWorkspaceRegistry, registerCwds } from "@/lib/workspace-store";
 
 export const dynamic = "force-dynamic";
@@ -10,6 +10,8 @@ export async function GET(req: Request) {
 	try {
 		const q = new URL(req.url).searchParams.get("q") ?? undefined;
 		const sessions = await listSessions(q);
+		// 侧栏一拿到列表就预热最近那个工作区的资源发现（约 140ms），别等用户点开会话才做
+		warmSessionResources(sessions.slice(0, 1).map((session) => session.cwd));
 		await registerCwds(sessions.map((session) => session.cwd));
 		const workspaceRegistry = await getWorkspaceRegistry();
 		// 侧栏每 3 秒轮询：内容没变就 304，浏览器复用缓存体（no-cache = 每次都回源校验，不会用陈旧数据）

package/src/app/api/web-auth/route.ts

@@ -1,16 +1,21 @@
 /**
- * 网页认证：GET 状态 / POST 登录（写会话 Cookie）/ DELETE 登出（清 Cookie）。
- * 无密码配置时整体关闭（GET 返回 enabled:false，POST 404）。
+ * 网页认证：GET 状态 / POST 已废弃（密码登录移除）/ DELETE 登出。
+ * DELETE 在服务端撤回本设备这张 Cookie 再清掉它（被拷走的副本同样失效）；
+ * DELETE ?scope=all 让此刻之前签发的所有 Cookie 失效（所有设备都要重新用启动令牌登录）。
+ * 没启用认证时整体关闭（GET 返回 enabled:false）。
+ *
+ * 唯一的登录路径是启动令牌换 Cookie（见 src/proxy.ts）：根路径的 GET 带上 ?token=…
+ * 换一张签名 Cookie，之后带着 Cookie 请求即可。这里不再收任何凭据。
  */
 import { NextResponse } from "next/server";
-import { isSafeHost, isSafeOrigin, validBasicAuthorization } from "@/lib/auth";
-import { SESSION_COOKIE, clearedCookieOptions, createSessionToken, readCookieHeader, safeNextPath, sessionCookieOptions, validPassword, validSessionToken } from "@/lib/web-auth";
+import { configuredTrustedHosts, isSafeHost, isSafeOrigin } from "@/lib/auth";
+import { authEnabled, clearSessionCookie, clearedCookieOptions, sessionCookieFromRequest, validSessionCookie } from "@/lib/web-auth";
+import { loadSessionRevocations, loadWebSecret, revokeAllSessions, revokeSessionCookie } from "@/lib/web-secret";
 
 export const dynamic = "force-dynamic";
 
 function untrusted(request: Request): NextResponse | null {
-	const password = process.env.PI_WEB_PASSWORD;
-	if (!isSafeHost(request, Boolean(password))) {
+	if (!isSafeHost(request, configuredTrustedHosts())) {
 		return NextResponse.json({ success: false, error: "untrusted host" }, { status: 403 });
 	}
 	if (request.method !== "GET" && request.method !== "HEAD" && !isSafeOrigin(request)) {
@@ -22,59 +27,50 @@ function untrusted(request: Request): NextResponse | null {
 export async function GET(request: Request) {
 	const blocked = untrusted(request);
 	if (blocked) return blocked;
-	const password = process.env.PI_WEB_PASSWORD;
-	const enabled = Boolean(password);
-	const authenticated = !enabled
-		|| validBasicAuthorization(request.headers.get("authorization"), password!)
-		|| validSessionToken(readCookieHeader(request.headers.get("cookie"), SESSION_COOKIE), password!);
-	return NextResponse.json({ success: true, data: { enabled, authenticated } }, { headers: { "Cache-Control": "no-store" } });
+	const enabled = authEnabled();
+	const authenticated = !enabled || validSessionCookie(request, loadWebSecret(), Date.now(), loadSessionRevocations());
+	return NextResponse.json(
+		{ success: true, data: { enabled, authenticated } },
+		{ headers: { "Cache-Control": "no-store" } },
+	);
 }
 
+/** 密码登录已移除：这里曾经用密码换会话 Cookie，现在只回答「此路已废」。 */
 export async function POST(request: Request) {
 	const blocked = untrusted(request);
 	if (blocked) return blocked;
-	const password = process.env.PI_WEB_PASSWORD;
-	if (!password) return NextResponse.json({ success: false, error: "password authentication is disabled" }, { status: 404 });
-	if (!(request.headers.get("content-type") ?? "").includes("application/json")) {
-		return NextResponse.json({ success: false, error: "Content-Type must be application/json" }, { status: 415 });
-	}
-	let body: { password?: unknown; next?: unknown };
-	try {
-		const reader = request.body?.getReader();
-		if (!reader) return NextResponse.json({ success: false, error: "missing login payload" }, { status: 400 });
-		const chunks: Uint8Array[] = [];
-		let size = 0;
-		try {
-			for (;;) {
-				const { value, done } = await reader.read();
-				if (done) break;
-				size += value.byteLength;
-				if (size > 16 * 1024) return NextResponse.json({ success: false, error: "login payload too large" }, { status: 413 });
-				chunks.push(value);
-			}
-		} finally {
-			await reader.cancel().catch(() => undefined);
-			reader.releaseLock();
-		}
-		body = JSON.parse(Buffer.concat(chunks).toString("utf8")) as { password?: unknown; next?: unknown };
-	} catch {
-		return NextResponse.json({ success: false, error: "invalid JSON body" }, { status: 400 });
-	}
-	if (!body || typeof body !== "object" || Array.isArray(body)) {
-		return NextResponse.json({ success: false, error: "invalid login payload" }, { status: 400 });
-	}
-	if (typeof body.password !== "string" || !validPassword(body.password, password)) {
-		return NextResponse.json({ success: false, error: "invalid password" }, { status: 401 });
-	}
-	const response = NextResponse.json({ success: true, data: { next: safeNextPath(typeof body.next === "string" ? body.next : null) } }, { headers: { "Cache-Control": "no-store" } });
-	response.cookies.set(SESSION_COOKIE, createSessionToken(password), sessionCookieOptions(request));
-	return response;
+	return NextResponse.json(
+		{ success: false, error: "password login has been removed; use the launch token link printed at startup" },
+		{ status: 410, headers: { "Cache-Control": "no-store" } },
+	);
 }
 
 export async function DELETE(request: Request) {
 	const blocked = untrusted(request);
 	if (blocked) return blocked;
+	if (authEnabled()) {
+		const secret = loadWebSecret();
+		const all = new URL(request.url).searchParams.get("scope") === "all";
+		// 「所有设备」只能由一个仍然有效的会话发起（DELETE 走不到 proxy 的拦截：/api/web-auth 是公开路径）
+		if (all && !validSessionCookie(request, secret, Date.now(), loadSessionRevocations())) {
+			return NextResponse.json({ success: false, error: "authentication required" }, { status: 401, headers: { "Cache-Control": "no-store" } });
+		}
+		try {
+			if (all) revokeAllSessions();
+			else {
+				const cookie = sessionCookieFromRequest(request, secret);
+				if (cookie && cookie.payload.expiresAt > Date.now()) revokeSessionCookie(cookie.id, cookie.payload.expiresAt);
+			}
+		} catch (error) {
+			// 吊销没记下来就别报「已退出」：Cookie 的副本还能用
+			return NextResponse.json(
+				{ success: false, error: `could not revoke the session: ${error instanceof Error ? error.message : String(error)}` },
+				{ status: 500, headers: { "Cache-Control": "no-store" } },
+			);
+		}
+	}
 	const response = NextResponse.json({ success: true }, { headers: { "Cache-Control": "no-store" } });
-	response.cookies.set(SESSION_COOKIE, "", clearedCookieOptions(request));
+	const cleared = clearSessionCookie(request);
+	response.cookies.set(cleared.name, cleared.value, clearedCookieOptions(request));
 	return response;
 }

package/src/app/api/workspaces/route.ts

@@ -13,9 +13,21 @@ import {
 import { encodeSessionId } from "@/lib/pi";
 import { disposeSessionPath } from "@/lib/agent-manager";
 import { BoundaryError, resolveSessionPath, resolveWorkspacePath } from "@/lib/path-security";
+import { isLoopbackHostname } from "@/lib/auth";
 
 export const dynamic = "force-dynamic";
 
+/**
+ * 请求是否来自本机回环。
+ * 原生文件夹对话框只会在运行 PiWeb 的那台机器上弹出，所以对手机/平板这类远程设备
+ * 它等于没有反应——那种情况要让客户端改用应用内目录浏览器（/api/fs）。
+ */
+function isLoopbackRequest(req: Request): boolean {
+	const host = req.headers.get("host") ?? new URL(req.url).host;
+	const hostname = host.startsWith("[") ? host.slice(0, host.indexOf("]") + 1) : host.split(":")[0];
+	return isLoopbackHostname(hostname);
+}
+
 export async function GET() {
 	try {
 		return NextResponse.json({ success: true, data: await getWorkspaceRegistry() });
@@ -33,6 +45,10 @@ export async function POST(req: Request) {
 			cwds?: string[];
 		};
 		if (body.action === "pick") {
+			if (!isLoopbackRequest(req)) {
+				// 远程设备：不弹主机上的对话框，让前端改用应用内目录浏览器。
+				return NextResponse.json({ success: true, data: { path: null, canceled: false, remote: true } });
+			}
 			const r = await pickFolderNative();
 			const registry = r.path ? await addWorkspace(await resolveWorkspacePath(r.path)) : null;
 			return NextResponse.json({ success: true, data: { ...r, ...(registry ?? {}) } });

package/src/app/globals.css

@@ -2121,6 +2121,12 @@ body[data-pebrel-theme="pebrel"][data-ds-dark-theme] {
 	box-shadow: 0 0 0 1px var(--dsw-label-tertiary);
 }
 
+/* 回合懒渲染的纯文本占位：尽量贴近正式渲染的排版，升级前的过渡形态 */
+.pw-turn-lite > div {
+	white-space: pre-wrap;
+	overflow-wrap: anywhere;
+}
+
 /* 窄屏：查看器全屏 */
 @media (max-width: 840px) {
 	.pw-viewer {

package/src/app/login/page.tsx

@@ -1,10 +1,11 @@
 "use client";
 
 /**
- * 登录页：无密码配置时直接回主页；已认证（Cookie / Basic）自动放行。
+ * 登录页：认证未启用或已认证自动回主页。这里只有启动令牌提示 ——
+ * 密码登录已移除，本页不再收集任何凭据。
  * ?next= 只接受同源相对路径（safeNextPath 白名单）。
  */
-import { Suspense, useEffect, useRef, useState } from "react";
+import { Suspense, useEffect } from "react";
 import { useRouter, useSearchParams } from "next/navigation";
 import { I18nProvider, useI18n } from "@/i18n";
 import { PiMark } from "@/components/PiMark";
@@ -14,21 +15,17 @@ export default function LoginPage() {
 	return (
 		<I18nProvider>
 			<Suspense fallback={<div className="flex min-h-screen items-center justify-center" aria-busy="true"><PiMark size={40} /></div>}>
-				<LoginForm />
+				<LoginNotice />
 			</Suspense>
 		</I18nProvider>
 	);
 }
 
-function LoginForm() {
+function LoginNotice() {
 	const { t } = useI18n();
 	const router = useRouter();
 	const params = useSearchParams();
 	const next = safeNextPath(params.get("next"));
-	const [password, setPassword] = useState("");
-	const [busy, setBusy] = useState(false);
-	const [error, setError] = useState("");
-	const inputRef = useRef<HTMLInputElement>(null);
 
 	// 认证未启用 / 已登录：不用停留
 	useEffect(() => {
@@ -40,7 +37,7 @@ function LoginForm() {
 				if (!alive || !result?.success) return;
 				if (!result.data.enabled || result.data.authenticated) router.replace(next);
 			} catch {
-				/* 网络异常时留在页面，提交时会再次尝试 */
+				/* 网络异常时留在页面：提示里已经写清怎么拿登录链接 */
 			}
 		})();
 		return () => {
@@ -48,63 +45,14 @@ function LoginForm() {
 		};
 	}, [router, next]);
 
-	const submit = async () => {
-		if (busy || !password) return;
-		setBusy(true);
-		setError("");
-		try {
-			const response = await fetch("/api/web-auth", {
-				method: "POST",
-				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({ password, next }),
-			});
-			const result = await response.json();
-			if (result.success) {
-				router.replace(safeNextPath(result.data?.next ?? next));
-				return;
-			}
-			setError(response.status === 401 ? t.loginFailed : result.error || t.loginFailed);
-			setPassword("");
-			requestAnimationFrame(() => inputRef.current?.focus());
-		} catch {
-			setError(t.loginFailed);
-		} finally {
-			setBusy(false);
-		}
-	};
-
 	return (
 		<div className="flex min-h-screen items-center justify-center px-4" style={{ background: "var(--dsw-bg-base)" }}>
 			<div className="glass-modal flex w-[min(92vw,380px)] flex-col gap-4 p-7" style={{ borderRadius: 24, boxShadow: "var(--dsw-elevation-prominent)" }}>
 				<div className="flex flex-col items-center gap-2">
 					<PiMark size={40} />
-					<div style={{ fontSize: 16, fontWeight: 600 }}>{t.loginTitle}</div>
-					<div className="text-center" style={{ fontSize: 12.5, color: "var(--dsw-label-caption)", lineHeight: 1.55 }}>{t.loginDesc}</div>
+					<div style={{ fontSize: 16, fontWeight: 600 }}>{t.loginTokenTitle}</div>
+					<div className="text-center" style={{ fontSize: 12.5, color: "var(--dsw-label-caption)", lineHeight: 1.55 }}>{t.loginTokenDesc}</div>
 				</div>
-				<input
-					ref={inputRef}
-					autoFocus
-					type="password"
-					autoComplete="current-password"
-					aria-label={t.loginPassword}
-					value={password}
-					placeholder={t.loginPassword}
-					onChange={(event) => setPassword(event.target.value)}
-					onKeyDown={(event) => {
-						if (event.key === "Enter" && !event.nativeEvent.isComposing) void submit();
-					}}
-					className="w-full rounded-xl px-3 py-2.5"
-					style={{ fontSize: 14, background: "var(--dsw-hover)", border: "0.5px solid var(--dsw-border-l2)" }}
-				/>
-				{error ? <div role="alert" style={{ fontSize: 12.5, color: "var(--dsw-danger)" }}>{error}</div> : null}
-				<button
-					className="btn-primary-white w-full"
-					style={{ height: 38, opacity: busy || !password ? 0.55 : 1 }}
-					disabled={busy || !password}
-					onClick={() => void submit()}
-				>
-					{busy ? t.loginSubmitting : t.loginSubmit}
-				</button>
 			</div>
 		</div>
 	);