@rexvane/piweb 0.3.24 → 0.3.26

package/src/app/api/models/route.ts

@@ -99,6 +99,7 @@ export async function POST(req: Request) {
 			text?: string;
 			force?: boolean;
 			allowPrivate?: boolean;
+			headers?: unknown;
 		};
 		if (body.action === "setKey") {
 			if (!body.providerId || !body.apiKey) return NextResponse.json({ success: false, error: "missing fields" }, { status: 400 });
@@ -120,7 +121,27 @@ export async function POST(req: Request) {
 		}
 		if (body.action === "discoverModels") {
 			if (!body.baseUrl) return NextResponse.json({ success: false, error: "missing baseUrl" }, { status: 400 });
-			const models = await discoverModels({ baseUrl: body.baseUrl, api: body.api, apiKey: body.apiKey, providerId: body.providerId, allowPrivate: body.allowPrivate === true });
+			// 自定义请求头来自表单：只接受「名字与值都是字符串」的键值对，条数与长度都要设上限，
+			// 否则一个超大对象会原样发给上游。名字按 HTTP 令牌字符集收窄，避免注入换行等非法字符。
+			let headers: Record<string, string> | undefined;
+			if (body.headers !== undefined) {
+				if (!body.headers || typeof body.headers !== "object" || Array.isArray(body.headers)) {
+					return NextResponse.json({ success: false, error: "invalid headers" }, { status: 400 });
+				}
+				const entries = Object.entries(body.headers as Record<string, unknown>);
+				if (entries.length > 32) return NextResponse.json({ success: false, error: "too many headers" }, { status: 400 });
+				headers = {};
+				for (const [name, value] of entries) {
+					if (!/^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/.test(name)) {
+						return NextResponse.json({ success: false, error: `invalid header name: ${name}` }, { status: 400 });
+					}
+					if (typeof value !== "string" || value.length > 4096 || /[\r\n]/.test(value)) {
+						return NextResponse.json({ success: false, error: `invalid header value: ${name}` }, { status: 400 });
+					}
+					if (value) headers[name] = value;
+				}
+			}
+			const models = await discoverModels({ baseUrl: body.baseUrl, api: body.api, apiKey: body.apiKey, providerId: body.providerId, allowPrivate: body.allowPrivate === true, headers });
 			return NextResponse.json({ success: true, data: { models } });
 		}
 		if (body.action === "providerUsage") {

package/src/app/api/plugins/route.ts

@@ -10,12 +10,13 @@ import {
 	updatePackages,
 } from "@/lib/plugins-service";
 import { BoundaryError, resolveWorkspacePath } from "@/lib/path-security";
+import { APP_ROOT } from "@/lib/app-root";
 
 export const dynamic = "force-dynamic";
 
 export async function GET(req: Request) {
 	try {
-		const cwd = await resolveWorkspacePath(new URL(req.url).searchParams.get("cwd") || process.cwd());
+		const cwd = await resolveWorkspacePath(new URL(req.url).searchParams.get("cwd") || APP_ROOT);
 		const [packages, extensions] = await Promise.all([listPackages(cwd), listLoadedExtensions(cwd)]);
 		return NextResponse.json({ success: true, data: { packages, extensions } });
 	} catch (err: any) {
@@ -35,7 +36,7 @@ export async function POST(req: Request) {
 			local?: boolean;
 			cwd?: string;
 		};
-		const cwd = await resolveWorkspacePath(body.cwd || process.cwd());
+		const cwd = await resolveWorkspacePath(body.cwd || APP_ROOT);
 		if (body.source && body.source.length > 4096) {
 			return NextResponse.json({ success: false, error: "package source is too long" }, { status: 400 });
 		}

package/src/app/api/prompts/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { listPromptSources, readPromptSource } from "@/lib/prompt-sources";
 import { getManaged } from "@/lib/agent-manager";
 import { BoundaryError, resolveSessionPath, resolveWorkspacePath } from "@/lib/path-security";
+import { APP_ROOT } from "@/lib/app-root";
 
 export const dynamic = "force-dynamic";
 
@@ -27,7 +28,7 @@ async function hotSession(cwd: string, sessionId: string | null) {
 export async function GET(req: Request) {
 	try {
 		const url = new URL(req.url);
-		const cwd = await resolveWorkspacePath(url.searchParams.get("cwd") || process.cwd());
+		const cwd = await resolveWorkspacePath(url.searchParams.get("cwd") || APP_ROOT);
 		const sessionId = url.searchParams.get("session");
 		const data = await listPromptSources({ cwd, session: await hotSession(cwd, sessionId) });
 		return NextResponse.json({ success: true, data });
@@ -42,7 +43,7 @@ export async function POST(req: Request) {
 		const body = (await req.json()) as { action?: string; filePath?: string; cwd?: string };
 		if (body.action !== "read") return NextResponse.json({ success: false, error: "unknown action" }, { status: 400 });
 		if (!body.filePath) return NextResponse.json({ success: false, error: "missing filePath" }, { status: 400 });
-		const cwd = await resolveWorkspacePath(body.cwd || process.cwd());
+		const cwd = await resolveWorkspacePath(body.cwd || APP_ROOT);
 		return NextResponse.json({ success: true, data: { content: await readPromptSource(body.filePath, cwd) } });
 	} catch (err) {
 		const message = err instanceof Error ? err.message : "request failed";

package/src/app/api/remote/route.ts

@@ -1,15 +1,15 @@
 /**
  * 「远程连接」内置插件的控制接口。
  *
- * GET    当前状态（局域网入口 + 公网入口 + 拼登录链接用的启动令牌）
- * POST   { action: "start" | "stop" | "start-lan" | "stop-lan" }
+ * GET    当前状态（插件开关 + 局域网入口 + 公网入口 + 拼登录链接用的启动令牌）
+ * POST   { action: "start" | "stop" | "start-lan" | "stop-lan" | "set-plugin" }
  * DELETE 全停
  *
  * 「谁能调这个接口」由 proxy.ts 把关；但「现在能不能开入口」必须在这里再看一次：
  * 认证没开时 proxy 一律放行，这时开出去的局域网 / 公网入口就是一个免密 shell。
  */
 import { NextResponse } from "next/server";
-import { remoteBlocked, remoteStatus, startLan, startPublic, stopAll, stopPublic } from "@/lib/remote/supervisor";
+import { remoteBlocked, remoteLanEnabled, remoteStatus, setRemotePluginEnabled, startLan, startPublic, stopAll, stopLan, stopPublic } from "@/lib/remote/supervisor";
 import { authEnabled } from "@/lib/web-auth";
 
 export const dynamic = "force-dynamic";
@@ -63,9 +63,27 @@ export async function POST(request: Request) {
 		case "start-lan":
 			await startLan();
 			return respond();
+		// 只停局域网入口。原先这里调的是 stopAll()，会连公网隧道一起杀掉——
+		// 与动作名不符，也让「只关局域网」变得做不到。
 		case "stop-lan":
-			await stopAll();
+			await stopLan();
 			return respond();
+		case "set-plugin": {
+			// 内置插件总开关。关掉后：不再注入手机排版、公网入口也必须停（它依赖插件）；
+			// 局域网入口**保留**，退化成纯转发，自建反代指向同一个端口照旧可用。
+			const enabled = (body as { enabled?: unknown }).enabled;
+			if (typeof enabled !== "boolean") return bad("enabled must be a boolean");
+			const before = remoteStatus();
+			setRemotePluginEnabled(enabled);
+			if (!enabled) await stopPublic();
+			// 注入资源是在建监听时就烧进去的，所以必须重建监听，开关才真正生效；
+			// 重建只在「原监听需要换模式」时做，避免白断一次连接。
+			if (before.lan.running && before.lan.styled !== enabled) await stopLan();
+			// 起监听与启动时（instrumentation-node）同一道闸：认证没开 / 开发模式 / PIWEB_REMOTE_LAN=0 时
+			// 只存开关，不开局域网入口——否则拨一下开关就绕过 start-lan 的检查开出一个免密入口。
+			if (remoteBlocked() === null && remoteLanEnabled()) await startLan();
+			return respond();
+		}
 		default:
 			return bad("unknown action");
 	}

package/src/app/api/sessions/[id]/export/route.ts

@@ -18,7 +18,9 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
 	const { id } = await params;
 	const format = new URL(req.url).searchParams.get("format") === "html" ? "html" : "jsonl";
 	try {
-		const m = getManaged(await resolveSessionPath(id));
+		// 与 /api/agent/[id] 同一种解析（allowPending 返回原写法而不是 realpath）：会话表按路径字符串做键，
+		// ~/.pi 经过 junction / 符号链接时两种写法不同，导出 HTML 就会给同一个文件再起一个 agent
+		const m = getManaged(await resolveSessionPath(id, { allowPending: true }));
 		const { filename, content, contentType } = await exportSession(m, format);
 		return new Response(content, {
 			headers: {

package/src/app/api/skills/route.ts

@@ -1,13 +1,14 @@
 import { NextResponse } from "next/server";
 import { deleteSkill, listSkills, readSkillFile, setSkillDisabled } from "@/lib/skills-service";
 import { BoundaryError, resolveWorkspacePath } from "@/lib/path-security";
+import { APP_ROOT } from "@/lib/app-root";
 
 export const dynamic = "force-dynamic";
 
 export async function GET(req: Request) {
 	try {
 		const rawCwd = new URL(req.url).searchParams.get("cwd");
-		const cwd = await resolveWorkspacePath(rawCwd || process.cwd());
+		const cwd = await resolveWorkspacePath(rawCwd || APP_ROOT);
 		const skills = await listSkills(cwd);
 		return NextResponse.json({ success: true, data: { skills } });
 	} catch (err: any) {
@@ -18,7 +19,7 @@ export async function GET(req: Request) {
 export async function POST(req: Request) {
 	try {
 		const body = (await req.json()) as { action: "toggle" | "read" | "delete"; filePath?: string; disabled?: boolean; cwd?: string };
-		const cwd = await resolveWorkspacePath(body.cwd || process.cwd());
+		const cwd = await resolveWorkspacePath(body.cwd || APP_ROOT);
 		if (body.action === "toggle") {
 			if (!body.filePath || typeof body.disabled !== "boolean")
 				return NextResponse.json({ success: false, error: "missing fields" }, { status: 400 });