@surething/cockpit 1.0.230 → 1.0.231

package/.next-prod/trace-build

@@ -1 +1 @@
-[{"name":"run-webpack","duration":19529043,"timestamp":273243687,"id":14,"parentId":1,"tags":{},"startTime":1782530159452,"traceId":"f63e4386afa40357"},{"name":"run-typescript","duration":17848581,"timestamp":292776722,"id":1602,"parentId":1,"tags":{},"startTime":1782530178985,"traceId":"f63e4386afa40357"},{"name":"static-check","duration":1197212,"timestamp":310663305,"id":1605,"parentId":1,"tags":{},"startTime":1782530196872,"traceId":"f63e4386afa40357"},{"name":"static-generation","duration":6324628,"timestamp":311987963,"id":1877,"parentId":1,"tags":{},"startTime":1782530198196,"traceId":"f63e4386afa40357"},{"name":"collect-build-traces","duration":20344456,"timestamp":311861128,"id":1874,"parentId":1,"tags":{},"startTime":1782530198070,"traceId":"f63e4386afa40357"},{"name":"telemetry-flush","duration":72,"timestamp":332211532,"id":1886,"parentId":1,"tags":{},"startTime":1782530218420,"traceId":"f63e4386afa40357"},{"name":"next-build","duration":59143442,"timestamp":273068174,"id":1,"tags":{"buildMode":"default","version":"16.2.6","bundler":"webpack","has-custom-webpack-config":"true","use-build-worker":"false"},"startTime":1782530159277,"traceId":"f63e4386afa40357"}]
+[{"name":"run-webpack","duration":19913822,"timestamp":394761478,"id":14,"parentId":1,"tags":{},"startTime":1782573830076,"traceId":"19b1732556652e31"},{"name":"run-typescript","duration":18180157,"timestamp":414679089,"id":1603,"parentId":1,"tags":{},"startTime":1782573849994,"traceId":"19b1732556652e31"},{"name":"static-check","duration":1122581,"timestamp":432893720,"id":1606,"parentId":1,"tags":{},"startTime":1782573868209,"traceId":"19b1732556652e31"},{"name":"static-generation","duration":6167280,"timestamp":434127573,"id":1878,"parentId":1,"tags":{},"startTime":1782573869442,"traceId":"19b1732556652e31"},{"name":"collect-build-traces","duration":19577375,"timestamp":434016895,"id":1875,"parentId":1,"tags":{},"startTime":1782573869332,"traceId":"19b1732556652e31"},{"name":"telemetry-flush","duration":60,"timestamp":453598132,"id":1887,"parentId":1,"tags":{},"startTime":1782573888913,"traceId":"19b1732556652e31"},{"name":"next-build","duration":58977558,"timestamp":394620647,"id":1,"tags":{"buildMode":"default","version":"16.2.6","bundler":"webpack","has-custom-webpack-config":"true","use-build-worker":"false"},"startTime":1782573829936,"traceId":"19b1732556652e31"}]

package/bin/cock.mjs

@@ -27,6 +27,7 @@ Commands:
 
 Options:
   --port <port>                  Set server port (default: 3457)
+  --token <token>                Require this token for remote access (local stays open)
   --no-open                      Don't open browser after start
   -v, --version                  Show version
   -h, --help                     Show this help
@@ -57,6 +58,15 @@ if (portIdx !== -1 && process.argv[portIdx + 1]) {
   process.argv.splice(portIdx, 2);
 }
 
+// Parse --token argument → enable shared-token auth (server.mjs reads
+// COCKPIT_TOKEN). Off entirely when omitted. Local (loopback) access stays
+// exempt; remote access must present the token.
+const tokenIdx = process.argv.indexOf('--token');
+if (tokenIdx !== -1 && process.argv[tokenIdx + 1] && !process.argv[tokenIdx + 1].startsWith('-')) {
+  process.env.COCKPIT_TOKEN = process.argv[tokenIdx + 1];
+  process.argv.splice(tokenIdx, 2);
+}
+
 // Default prod port
 if (!process.env.COCKPIT_PORT) {
   process.env.COCKPIT_PORT = '3457';

package/dist/auth.mjs

@@ -0,0 +1,92 @@
+import "./chunk-7P6ASYW6.mjs";
+
+// src/lib/auth.ts
+import { timingSafeEqual } from "crypto";
+var COOKIE_NAME = "cockpit_token";
+var QUERY_KEY = "token";
+var COOKIE_MAX_AGE = 60 * 60 * 24 * 365;
+function tokenEnabled() {
+  return Boolean(process.env.COCKPIT_TOKEN);
+}
+function configuredToken() {
+  return process.env.COCKPIT_TOKEN || "";
+}
+function safeEqual(a, b) {
+  const ba = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ba.length !== bb.length) return false;
+  return timingSafeEqual(ba, bb);
+}
+function isLoopbackAddr(addr) {
+  if (!addr) return false;
+  return addr === "::1" || addr === "::ffff:127.0.0.1" || addr.startsWith("127.");
+}
+function parseCookies(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const i = part.indexOf("=");
+    if (i < 0) continue;
+    const k = part.slice(0, i).trim();
+    if (!k) continue;
+    out[k] = decodeURIComponent(part.slice(i + 1).trim());
+  }
+  return out;
+}
+function tokenFromQuery(url) {
+  try {
+    return new URL(url, "http://localhost").searchParams.get(QUERY_KEY) ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function stripTokenParam(url) {
+  try {
+    const u = new URL(url, "http://localhost");
+    u.searchParams.delete(QUERY_KEY);
+    const qs = u.searchParams.toString();
+    return u.pathname + (qs ? `?${qs}` : "") + (u.hash || "");
+  } catch {
+    return "/";
+  }
+}
+function makeCookie(token, secure) {
+  const attrs = [
+    `${COOKIE_NAME}=${encodeURIComponent(token)}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${COOKIE_MAX_AGE}`
+  ];
+  if (secure) attrs.push("Secure");
+  return attrs.join("; ");
+}
+function checkAccess(input) {
+  if (!tokenEnabled()) return { action: "pass" };
+  if (!input.forwarded && isLoopbackAddr(input.remoteAddr)) {
+    return { action: "pass" };
+  }
+  const want = configuredToken();
+  const cookieTok = parseCookies(input.cookieHeader)[COOKIE_NAME];
+  if (cookieTok && safeEqual(cookieTok, want)) return { action: "pass" };
+  const auth = input.authHeader;
+  const bearer = auth && auth.startsWith("Bearer ") ? auth.slice(7).trim() : void 0;
+  if (bearer && safeEqual(bearer, want)) return { action: "pass" };
+  const queryTok = tokenFromQuery(input.url);
+  if (queryTok && safeEqual(queryTok, want)) {
+    if (input.isWs) return { action: "pass" };
+    return {
+      action: "redirect",
+      location: stripTokenParam(input.url),
+      setCookie: makeCookie(want, input.isHttps)
+    };
+  }
+  return { action: "deny" };
+}
+export {
+  COOKIE_NAME,
+  checkAccess,
+  isLoopbackAddr,
+  makeCookie,
+  tokenEnabled
+};

package/dist/{chunk-XW5CKMXI.mjs → chunk-VHFWPI2X.mjs}

@@ -217,16 +217,37 @@ async function getLastUserMessage(cwd, sessionId) {
 var SUMMARY_THRESHOLD = 10;
 var SUMMARY_HEAD = 5;
 var SUMMARY_TAIL = 5;
+async function getSessionContent(cwd, sessionId) {
+  const claudePath = getClaudeSessionPath(cwd, sessionId);
+  if (existsSync(claudePath)) return getClaudeStyleContent(claudePath);
+  const claude2Path = getClaude2SessionPath(cwd, sessionId);
+  if (existsSync(claude2Path)) return getClaudeStyleContent(claude2Path);
+  const ollamaPath = getOllamaSessionPath(cwd, sessionId);
+  if (existsSync(ollamaPath)) return getClaudeStyleContent(ollamaPath);
+  const codexPath = findCodexSessionPath(sessionId);
+  if (codexPath && existsSync(codexPath)) {
+    return { summary: "", messages: await getCodexUserMessages(codexPath) };
+  }
+  const kimiPath = findKimiSessionPath(sessionId);
+  if (kimiPath && existsSync(kimiPath)) {
+    return { summary: "", messages: await getKimiUserMessages(kimiPath) };
+  }
+  return { summary: "", messages: [] };
+}
 async function getSessionPreview(cwd, sessionId) {
-  const messages = await collectUserMessages(cwd, sessionId);
+  const { summary, messages } = await getSessionContent(cwd, sessionId);
+  const title = generateTitle(summary, messages);
   const lastUserMessage = messages[messages.length - 1];
+  const searchText = [summary, ...messages].join("\n").toLowerCase();
   if (messages.length <= SUMMARY_THRESHOLD) {
-    return { lastUserMessage, firstMessages: messages.map((m) => truncate(m)), lastMessages: [] };
+    return { title, lastUserMessage, firstMessages: messages.map((m) => truncate(m)), lastMessages: [], searchText };
   }
   return {
+    title,
     lastUserMessage,
     firstMessages: messages.slice(0, SUMMARY_HEAD).map((m) => truncate(m)),
-    lastMessages: messages.slice(-SUMMARY_TAIL).map((m) => truncate(m))
+    lastMessages: messages.slice(-SUMMARY_TAIL).map((m) => truncate(m)),
+    searchText
   };
 }
 function filterCommandTags(text) {
@@ -308,6 +329,46 @@ async function getClaudeStyleUserMessages(filePath) {
   }
   return messages;
 }
+async function getClaudeStyleContent(filePath) {
+  let summary = "";
+  const messages = [];
+  try {
+    const fileStream = createReadStream(filePath);
+    const rl = createInterface({ input: fileStream, crlfDelay: Infinity });
+    for await (const line of rl) {
+      if (!line.trim()) continue;
+      try {
+        const entry = JSON.parse(line);
+        if (entry.type === "summary" && entry.summary) {
+          summary = entry.summary;
+          continue;
+        }
+        if (entry.type !== "user") continue;
+        const message = entry.message;
+        if (!message?.content) continue;
+        let text = "";
+        if (typeof message.content === "string") {
+          text = message.content;
+        } else if (Array.isArray(message.content)) {
+          for (const block of message.content) {
+            if (block.type === "text" && block.text) {
+              text = block.text;
+              break;
+            }
+          }
+        }
+        if (!text) continue;
+        const filtered = filterCommandTags(text);
+        if (filtered && isValidUserMessage(filtered)) {
+          messages.push(filtered);
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return { summary, messages };
+}
 async function getCodexUserMessages(filePath) {
   const messages = [];
   try {

package/dist/scheduledTasks.mjs

@@ -10,7 +10,7 @@ import {
   setRunAbort,
   startRun,
   updateGlobalState
-} from "./chunk-XW5CKMXI.mjs";
+} from "./chunk-VHFWPI2X.mjs";
 import {
   AgentError,
   AppRuntime,

package/dist/wsServer.mjs

@@ -2,7 +2,7 @@ import {
   addRunListener,
   getRunSnapshot,
   getSessionPreview
-} from "./chunk-XW5CKMXI.mjs";
+} from "./chunk-VHFWPI2X.mjs";
 import {
   addExitListener,
   addOutputListener,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surething/cockpit",
-  "version": "1.0.230",
+  "version": "1.0.231",
   "description": "Claude Code GUI for parallel AI coding — drive Claude (default), Codex, DeepSeek, Kimi, or local Ollama in tabs. Multi-project sessions, terminal, browser & DB bubbles, code review, slash modes. Local-first, MIT.",
   "author": "Robert",
   "license": "MIT",

package/server.mjs

@@ -128,6 +128,7 @@ app.prepare().then(async () => {
   const upgradeHandler = app.getUpgradeHandler();
   // v2 P8: HTTP intercepts (handleTerminalApi / handleBrowserApi) moved to src/lib/httpApi.ts
   const { handleUpgrade, broadcastToGlobalState } = await import(dev ? './src/lib/wsServer.ts' : './dist/wsServer.mjs');
+  const auth = await import(dev ? './src/lib/auth.ts' : './dist/auth.mjs');
   const httpApi = await import(dev ? './src/lib/httpApi.ts' : './dist/httpApi.mjs');
   const { handleBrowserApi, handleTerminalApi, handleConnectionApi } = httpApi;
   flushRunningSync = httpApi.flushAllRunningSync || null;
@@ -139,7 +140,45 @@ app.prepare().then(async () => {
   });
   await scheduledTaskManager.init();
 
+  // ============================================
+  // Token gate — opt-in via `cockpit --token <value>` (COCKPIT_TOKEN).
+  // Off by default (open). Local callers (loopback peer + no forwarding header)
+  // are exempt, so the CLI / /cg curls / self-probe never need a token.
+  // ============================================
+  const gateInput = (req, isWs) => ({
+    url: req.url || '',
+    remoteAddr: req.socket?.remoteAddress,
+    cookieHeader: req.headers?.cookie,
+    authHeader: req.headers?.authorization,
+    forwarded:
+      req.headers?.['x-forwarded-for'] ||
+      req.headers?.['x-real-ip'] ||
+      req.headers?.['forwarded'],
+    isWs,
+    isHttps:
+      String(req.headers?.['x-forwarded-proto'] || '').split(',')[0].trim() === 'https',
+  });
+
+  // Apply the gate to an HTTP request. Returns true if it wrote a response
+  // (blocked / redirected) and the caller should stop.
+  const applyHttpGate = (req, res) => {
+    const decision = auth.checkAccess(gateInput(req, false));
+    if (decision.action === 'redirect') {
+      res.writeHead(302, { Location: decision.location, 'Set-Cookie': decision.setCookie });
+      res.end();
+      return true;
+    }
+    if (decision.action === 'deny') {
+      res.writeHead(401, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('401 Unauthorized - append ?token=<token> to the URL to authenticate\n');
+      return true;
+    }
+    return false;
+  };
+
   const server = createServer(async (req, res) => {
+    if (applyHttpGate(req, res)) return;
+
     // /api/browser/* 必须在自定义 server 中处理（与 WS 共享 BrowserBridge 内存）
     if (req.url?.startsWith('/api/browser/') && req.method === 'POST') {
       const handled = await handleBrowserApi(req, res);
@@ -157,6 +196,12 @@ app.prepare().then(async () => {
   });
 
   server.on('upgrade', (req, socket, head) => {
+    // Cookie / ?token ride the same-origin upgrade → gate WS too.
+    if (auth.checkAccess(gateInput(req, true)).action !== 'pass') {
+      socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+      socket.destroy();
+      return;
+    }
     if (!handleUpgrade(req, socket, head)) {
       upgradeHandler(req, socket, head);
     }
@@ -212,6 +257,9 @@ app.prepare().then(async () => {
   }
 
   const shareServer = createServer((req, res) => {
+    // Token gate first (share is also covered). Read the gate BEFORE we inject
+    // x-forwarded-for below, so the injection can't fool the local check.
+    if (applyHttpGate(req, res)) return;
     if (isShareAllowed(req.url || '')) {
       // 注入客户端真实 IP，供 /api/review/identify 使用
       const clientIp = req.socket.remoteAddress || '';