@surenkid/acli-hub 1.0.0 → 1.0.2

package/.env.example

@@ -1,16 +1,21 @@
 # Main server port (backend + built frontend in production)
-PORT=3000
-HOST=0.0.0.0
+ACLI_HUB_PORT=3000
+# Bind address — default 127.0.0.1 (local only). Use 0.0.0.0 for LAN/remote access,
+# and ALWAYS set ACLI_HUB_AUTH_PASSWORD when binding beyond loopback.
+#ACLI_HUB_HOST=0.0.0.0
 
 # Internal ttyd port range (localhost only, proxied through the main port)
-TTYD_PORT_RANGE_START=7681
-TTYD_PORT_RANGE_END=7780
+ACLI_HUB_TTYD_PORT_RANGE_START=7681
+ACLI_HUB_TTYD_PORT_RANGE_END=7780
 
 # Maximum size per uploaded file, in MiB. 0 = unlimited.
-UPLOAD_MAX_MB=500
+ACLI_HUB_UPLOAD_MAX_MB=500
 
 # Login password for the web UI. Leave UNSET to disable authentication
 # (local development). Generate a strong one with: openssl rand -base64 24
 # When set, all pages/API/terminal/WebSocket access requires a 7-day
 # login session (cookie).
-AUTH_PASSWORD=
+ACLI_HUB_AUTH_PASSWORD=
+
+# Config locations (cwd is never read): ~/.config/acli-hub/.env for the installed CLI
+# ($XDG_CONFIG_HOME respected); the repo root .env when running from source.

package/README.md

@@ -56,39 +56,46 @@ brew install ttyd tmux
 ## 🚀 快速开始
 
 ```bash
-# 安装依赖
-npm install
-cd frontend && npm install && cd ..
-
-# 构建前端
-npm run build
-
-# 启动服务
-npm start
+npm install -g @surenkid/acli-hub
+acli-hub
 ```
 
-浏览器打开 `http://localhost:3000` 即可使用。
+浏览器打开 `http://localhost:3000` 即可使用。登录密码等配置放在 `~/.config/acli-hub/.env`（模板见下方配置项）。
+
+> 也可以免安装直接体验：`npx @surenkid/acli-hub`
 
-## 👨‍💻 开发模式
+## 👨‍💻 从源码运行
 
 ```bash
-npm run dev
-```
+git clone https://cnb.cool/surenkid/acli-hub.git
+cd acli-hub
+npm install
+cd frontend && npm install && cd ..
 
-同时启动后端（端口 3000）和 Vite 开发服务器（端口 5173）。
+npm run dev    # 开发模式：后端 3000 + Vite 5173（热更新）
+# 或构建生产版运行
+npm run build && npm start
+```
 
 ## ⚙️ 配置项
 
-通过环境变量或 `.env` 文件设置（参考 `.env.example`）：
+配置从固定位置读取，**与启动目录无关**（避免与所在项目的 `.env` 冲突）：
+
+1. `~/.config/acli-hub/.env` — npm 安装（`npx`/全局）使用的配置，尊重 `$XDG_CONFIG_HOME`（模板参考包内 `.env.example`）
+2. 源码运行（`npm run dev`）时为仓库根目录的 `.env`
+
+进程环境变量优先级最高。注意：启动目录同时决定新建终端会话的起始目录，建议固定一个目录启动。
+
+配置项：
 
-| 变量                    | 说明                                       | 默认值    |
-| ----------------------- | ------------------------------------------ | --------- |
-| `PORT`                  | 服务监听端口                               | `3000`    |
-| `HOST`                  | 监听地址                                   | `0.0.0.0` |
-| `AUTH_PASSWORD`         | 登录密码；不设置则关闭认证（仅限本地开发） | _(不设置)_ |
-| `TTYD_PORT_RANGE_START` | ttyd 内部端口范围起始                      | `7681`    |
-| `TTYD_PORT_RANGE_END`   | ttyd 内部端口范围结束                      | `7780`    |
-| `UPLOAD_MAX_MB`         | 单文件上传上限（MiB），0 为不限            | `500`     |
+| 变量                            | 说明                                       | 默认值    |
+| ------------------------------- | ------------------------------------------ | --------- |
+| `ACLI_HUB_PORT`                 | 服务监听端口                               | `3000`    |
+| `ACLI_HUB_HOST`                 | 监听地址；默认仅本机，局域网访问设 `0.0.0.0`（务必同时设密码） | `127.0.0.1` |
+| `ACLI_HUB_AUTH_PASSWORD`        | 登录密码；不设置则关闭认证（仅限本地开发） | _(不设置)_ |
+| `ACLI_HUB_TTYD_PORT_RANGE_START` | ttyd 内部端口范围起始                     | `7681`    |
+| `ACLI_HUB_TTYD_PORT_RANGE_END`   | ttyd 内部端口范围结束                     | `7780`    |
+| `ACLI_HUB_UPLOAD_MAX_MB`        | 单文件上传上限（MiB），0 为不限            | `500`     |
 
 ### 📁 文件面板说明
 
@@ -98,7 +105,7 @@ npm run dev
 
 ### 🔐 公网暴露
 
-设置 `AUTH_PASSWORD` 后，建议将 ACLI Hub 部署在 HTTPS 反向代理（如 Caddy / Nginx / frp）之后，只公开 443 端口。登录会话为 7 天有效的 HttpOnly Cookie，终端 iframe 与 WebSocket 均受同一凭据保护。
+设置 `ACLI_HUB_AUTH_PASSWORD` 后，建议将 ACLI Hub 部署在 HTTPS 反向代理（如 Caddy / Nginx / frp）之后，只公开 443 端口。登录会话为 7 天有效的 HttpOnly Cookie，终端 iframe 与 WebSocket 均受同一凭据保护。
 
 ## 📄 License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surenkid/acli-hub",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Web workbench for AI CLIs — run Claude Code, Codex, Kimi and more in your browser (ttyd + tmux)",
   "license": "MIT",
   "bin": {

package/server/index.js

@@ -1,7 +1,15 @@
 #!/usr/bin/env node
-require('dotenv').config();
-const express = require('express');
+const os = require('os');
 const path = require('path');
+// Config is read from fixed locations, never the working directory (which
+// would collide with whatever project the user happens to be in):
+// 1. <package root>/.env — the source checkout during development
+// 2. ~/.config/acli-hub/.env ($XDG_CONFIG_HOME) — the installed CLI's config
+// dotenv never overrides variables that are already set, so real env vars
+// always win.
+require('dotenv').config({ path: path.join(__dirname, '..', '.env') });
+require('dotenv').config({ path: path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'acli-hub', '.env') });
+const express = require('express');
 const http = require('http');
 const { createProxyMiddleware } = require('http-proxy-middleware');
 const SessionManager = require('./services/session-manager');
@@ -11,10 +19,10 @@ const sessionsRoute = require('./routes/sessions');
 const filesRoute = require('./routes/files');
 const setupWebSocket = require('./ws');
 
-const PORT = parseInt(process.env.PORT || '3000', 10);
-const HOST = process.env.HOST || '0.0.0.0';
-const TTYD_PORT_START = parseInt(process.env.TTYD_PORT_RANGE_START || '7681', 10);
-const TTYD_PORT_END = parseInt(process.env.TTYD_PORT_RANGE_END || '7780', 10);
+const PORT = parseInt(process.env.ACLI_HUB_PORT || '3000', 10);
+const HOST = process.env.ACLI_HUB_HOST || '127.0.0.1';
+const TTYD_PORT_START = parseInt(process.env.ACLI_HUB_TTYD_PORT_RANGE_START || '7681', 10);
+const TTYD_PORT_END = parseInt(process.env.ACLI_HUB_TTYD_PORT_RANGE_END || '7780', 10);
 
 const app = express();
 const server = http.createServer(app);
@@ -26,7 +34,7 @@ app.use((req, res, next) => {
 });
 
 const sessionManager = new SessionManager(TTYD_PORT_START, TTYD_PORT_END);
-const auth = new AuthService(process.env.AUTH_PASSWORD);
+const auth = new AuthService(process.env.ACLI_HUB_AUTH_PASSWORD);
 
 function requireAuth(req, res, next) {
   if (!auth.isEnabled()) return next();
@@ -122,7 +130,7 @@ server.listen(PORT, HOST, async () => {
   if (auth.isEnabled()) {
     console.log('Auth enabled: login required (sessions last 7 days)');
   } else {
-    console.warn('WARNING: AUTH_PASSWORD is not set — running WITHOUT authentication. Do not expose this to the internet.');
+    console.warn('WARNING: ACLI_HUB_AUTH_PASSWORD is not set — running WITHOUT authentication. Do not expose this to the internet.');
   }
   const restored = await sessionManager.restore();
   if (restored.length > 0) {

package/server/routes/files.js

@@ -69,10 +69,10 @@ function respondError(res, err) {
   res.status(status).json({ error: err.message });
 }
 
-module.exports = function filesRoute({ platform = process.platform, home = os.homedir(), uploadMaxMb = process.env.UPLOAD_MAX_MB ?? '500' } = {}) {
+module.exports = function filesRoute({ platform = process.platform, home = os.homedir(), uploadMaxMb = process.env.ACLI_HUB_UPLOAD_MAX_MB ?? '500' } = {}) {
   const router = express.Router();
   const maximum = Number(uploadMaxMb);
-  if (!Number.isFinite(maximum) || maximum < 0) throw new Error('UPLOAD_MAX_MB must be a non-negative number');
+  if (!Number.isFinite(maximum) || maximum < 0) throw new Error('ACLI_HUB_UPLOAD_MAX_MB must be a non-negative number');
   const uploadLimit = maximum * 1024 * 1024;
   const trash = platform === 'darwin' ? 'mv-trash' : 'rm';
   // Serialize app mutations so concurrent renames/trash moves cannot overwrite

package/server/services/session-manager.js

@@ -305,7 +305,8 @@ class SessionManager extends EventEmitter {
   async restore() {
     let output;
     try {
-      output = execSync(`tmux list-sessions -F '#{session_name}\t#{@hub-managed}\t#{@hub-alias}\t#{@hub-root}'`, { env: SPAWN_ENV }).toString();
+      // stderr silenced: tmux prints "no server running" whenever the first session does not exist yet
+      output = execSync(`tmux list-sessions -F '#{session_name}\t#{@hub-managed}\t#{@hub-alias}\t#{@hub-root}'`, { stdio: ['ignore', 'pipe', 'ignore'], env: SPAWN_ENV }).toString();
     } catch (_) {
       return []; // no tmux server running or no sessions at all
     }
@@ -373,7 +374,7 @@ class SessionManager extends EventEmitter {
     try {
       output = execSync(
         `tmux list-panes -a -F '#{session_name}\t#{window_active}\t#{pane_active}\t#{pane_current_command}\t#{pane_title}'`,
-        { env: SPAWN_ENV }
+        { stdio: ['ignore', 'pipe', 'ignore'], env: SPAWN_ENV }
       ).toString();
     } catch (_) {
       return; // no tmux server running