@thaut/claude-ide 0.0.0-stage → 1.0.0

package/server/config/plugins.ts

@@ -0,0 +1,204 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import type { AvailablePlugin, InstalledPlugin, Marketplace, PluginActionResult, PluginListing, SkillInfo } from "../../shared/config.ts";
+import { cached, invalidate, skillsDialog } from "../cli-control.ts";
+import { splitFrontmatter } from "./agents.ts";
+import { ConfigError, configDir, parseJsonOutput, runClaude } from "./paths.ts";
+
+/**
+ * Plugins and marketplaces (/plugin) via `claude plugin … --json`, and skills
+ * (user, project, plugin) listed from their SKILL.md files plus the CLI's skills dialog.
+ */
+
+type RawInstalled = { id: string; version?: string; scope: string; enabled: boolean; installPath?: string };
+
+async function readJson(file: string): Promise<Record<string, unknown> | null> {
+  try {
+    return JSON.parse(await fs.readFile(file, "utf8")) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+async function installed(cwd: string): Promise<RawInstalled[]> {
+  const r = await runClaude(["plugin", "list", "--json"], cwd);
+  const list = parseJsonOutput<RawInstalled[]>(r.stdout);
+  if (!Array.isArray(list)) throw new ConfigError(502, (r.stderr || r.stdout).trim() || "无法读取插件列表");
+  return list;
+}
+
+export async function listPlugins(root: string | null): Promise<PluginListing> {
+  const cwd = root ?? os.homedir();
+  const [plugins, mr] = await Promise.all([installed(cwd), runClaude(["plugin", "marketplace", "list", "--json"], cwd)]);
+  const marketplaces = parseJsonOutput<Marketplace[]>(mr.stdout) ?? [];
+  return {
+    installed: await Promise.all(plugins.map(
+      async (p): Promise<InstalledPlugin> => ({
+        id: p.id,
+        version: p.version,
+        scope: p.scope,
+        enabled: p.enabled,
+        installPath: p.installPath,
+        description: p.installPath ? (((await readJson(path.join(p.installPath, ".claude-plugin", "plugin.json")))?.description as string | undefined) ?? undefined) : undefined,
+      }),
+    )),
+    marketplaces: Array.isArray(marketplaces) ? marketplaces : [],
+  };
+}
+
+export function availablePlugins(root: string | null): Promise<AvailablePlugin[]> {
+  const cwd = root ?? os.homedir();
+  return cached(`available:${cwd}`, 5 * 60_000, async () => {
+    const r = await runClaude(["plugin", "list", "--available", "--json"], cwd, { timeoutMs: 120_000 });
+    const out = parseJsonOutput<{ available?: AvailablePlugin[] }>(r.stdout);
+    if (!out) throw new ConfigError(502, (r.stderr || r.stdout).trim() || "无法读取可安装的插件");
+    return (out.available ?? []).map((p) => ({
+      pluginId: p.pluginId,
+      name: p.name,
+      description: p.description,
+      marketplaceName: p.marketplaceName,
+      installCount: p.installCount,
+    }));
+  });
+}
+
+const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._@/:-]{0,200}$/;
+const ACTIONS = new Set(["install", "uninstall", "enable", "disable", "update"]);
+
+type CliJson = { outcome?: string; message?: string; shownCommand?: { sha256?: string; command?: unknown; kind?: string } };
+
+function toResult(r: { code: number; stdout: string; stderr: string }): PluginActionResult {
+  const j = parseJsonOutput<CliJson>(r.stdout);
+  if (j?.shownCommand?.sha256 && r.code !== 0) {
+    return { ok: false, message: j.message ?? "需要确认插件市场声明的命令", confirm: { sha256: j.shownCommand.sha256, command: j.shownCommand.command, kind: j.shownCommand.kind } };
+  }
+  const ok = r.code === 0 && (j?.outcome === undefined || j.outcome === "ok");
+  return { ok, message: (j?.message ?? (r.stderr || r.stdout)).trim() || (ok ? "完成" : "失败") };
+}
+
+export async function pluginAction(
+  root: string | null,
+  body: { action?: string; plugin?: string; scope?: string; acceptCommand?: string },
+): Promise<PluginActionResult> {
+  const action = String(body.action ?? "");
+  const plugin = String(body.plugin ?? "").trim();
+  if (!ACTIONS.has(action)) throw new ConfigError(400, "未知操作");
+  if (!ID_RE.test(plugin)) throw new ConfigError(400, "插件名不合法");
+  const args = ["plugin", action, plugin, "--json"];
+  if (body.scope) {
+    if (!["user", "project", "local"].includes(body.scope)) throw new ConfigError(400, "未知的作用域");
+    if (body.scope !== "user" && !root) throw new ConfigError(400, "项目作用域需要先选择项目");
+    args.push("-s", body.scope);
+  }
+  if (action === "install" && body.acceptCommand) {
+    if (!/^[0-9a-f]{64}$/.test(body.acceptCommand)) throw new ConfigError(400, "确认码不正确");
+    args.push("--accept-command", body.acceptCommand);
+  }
+  const r = await runClaude(args, root ?? os.homedir(), { timeoutMs: 300_000 });
+  invalidate("init:");
+  invalidate("available:");
+  return toResult(r);
+}
+
+export async function marketplaceAction(root: string | null, body: { action?: string; source?: string; name?: string; scope?: string }): Promise<PluginActionResult> {
+  const cwd = root ?? os.homedir();
+  let args: string[];
+  if (body.action === "add") {
+    const source = String(body.source ?? "").trim();
+    if (!source || source.startsWith("-")) throw new ConfigError(400, "请填写来源（owner/repo、git 地址、URL 或本地路径）");
+    args = ["plugin", "marketplace", "add", source, "--json"];
+    if (body.scope && body.scope !== "user") {
+      if (!["project", "local"].includes(body.scope) || !root) throw new ConfigError(400, "未知的作用域");
+      args.push("--scope", body.scope);
+    }
+  } else if (body.action === "remove" || body.action === "update") {
+    const name = String(body.name ?? "").trim();
+    if (!ID_RE.test(name)) throw new ConfigError(400, "名称不合法");
+    args = ["plugin", "marketplace", body.action, name, ...(body.action === "remove" ? ["--json"] : [])];
+  } else throw new ConfigError(400, "未知操作");
+  const r = await runClaude(args, cwd, { timeoutMs: 300_000 });
+  invalidate("available:");
+  return toResult(r);
+}
+
+// ---------- skills ----------
+
+async function skillMeta(file: string): Promise<{ name?: string; description: string }> {
+  try {
+    const { entries } = splitFrontmatter((await fs.readFile(file, "utf8")).slice(0, 16_384));
+    const val = (k: string) => {
+      const e = entries?.find((x) => x.key === k);
+      if (!e) return undefined;
+      const first = e.lines[0].slice(e.lines[0].indexOf(":") + 1).trim();
+      const v = /^[|>][-+]?$/.test(first) ? e.lines.slice(1).map((l) => l.trim()).join(" ") : [first, ...e.lines.slice(1).map((l) => l.trim())].join(" ");
+      return v.replace(/^["']|["']$/g, "").trim();
+    };
+    return { name: val("name"), description: val("description") ?? "" };
+  } catch {
+    return { description: "" };
+  }
+}
+
+async function scanSkills(dir: string, source: string, plugin?: string, prefix = ""): Promise<SkillInfo[]> {
+  let names: string[] = [];
+  try {
+    names = (await fs.readdir(dir)).sort();
+  } catch {
+    return [];
+  }
+  const out: SkillInfo[] = [];
+  for (const n of names) {
+    const file = path.join(dir, n, "SKILL.md");
+    let fileExists = true;
+    try { await fs.access(file); } catch { fileExists = false; }
+    if (!fileExists) continue;
+    const meta = await skillMeta(file);
+    out.push({ name: prefix + (meta.name || n), source, description: meta.description, path: file, ...(plugin ? { plugin } : {}) });
+  }
+  return out;
+}
+
+async function scanCommands(dir: string, source: string): Promise<SkillInfo[]> {
+  let names: string[] = [];
+  try {
+    names = (await fs.readdir(dir)).filter((n) => n.endsWith(".md")).sort();
+  } catch {
+    return [];
+  }
+  return Promise.all(names.map(async (n) => {
+    const file = path.join(dir, n);
+    return { name: n.slice(0, -3), source: `${source}-command`, description: (await skillMeta(file)).description, path: file };
+  }));
+}
+
+export async function listSkills(root: string | null): Promise<SkillInfo[]> {
+  const cwd = root ?? os.homedir();
+  const skills: SkillInfo[] = [...await scanSkills(path.join(configDir, "skills"), "user"), ...await scanCommands(path.join(configDir, "commands"), "user")];
+  if (root) skills.push(...await scanSkills(path.join(root, ".claude", "skills"), "project"), ...await scanCommands(path.join(root, ".claude", "commands"), "project"));
+  const plugins = await installed(cwd).catch(() => [] as RawInstalled[]);
+  for (const p of plugins) {
+    if (!p.installPath) continue;
+    const short = p.id.split("@")[0];
+    skills.push(...await scanSkills(path.join(p.installPath, "skills"), "plugin", p.id, `${short}:`));
+  }
+  // The CLI's view adds state (on/off) and descriptions it derived itself.
+  const dialog = await skillsDialog(cwd).catch(() => null);
+  if (dialog) {
+    for (const s of skills) {
+      const d = dialog.skills.find((x) => x.name === s.name);
+      if (d) {
+        s.state = d.state;
+        if (!s.description) s.description = d.description;
+      }
+    }
+  }
+  return skills;
+}
+
+export async function readSkill(root: string | null, file: string) {
+  const skills = await listSkills(root);
+  const hit = skills.find((s) => s.path === file);
+  if (!hit || !hit.path) throw new ConfigError(404, "技能不存在");
+  return { path: hit.path, content: await fs.readFile(hit.path, "utf8") };
+}

package/server/config/routes.ts

@@ -0,0 +1,95 @@
+import os from "node:os";
+import type { Context, Hono } from "hono";
+import { projectPath } from "../sessions.ts";
+import { cancelMcpAuth, startMcpAuth, submitMcpAuth } from "../cli-control.ts";
+import { ConfigError } from "./paths.ts";
+import { deleteMemoryFile, listMemory, readMemoryFile, setAutoMemory, writeMemoryFile } from "./memory.ts";
+import { applyHookOp, applyPermissionOp, getSettingsInfo, listHooks, listPermissions, setSetting } from "./settings.ts";
+import { deleteAgent, listAgents, saveAgent } from "./agents.ts";
+import { addMcp, getMcpText, listMcp, logoutMcp, removeMcp, setMcpEnabled } from "./mcp.ts";
+import { availablePlugins, listPlugins, listSkills, marketplaceAction, pluginAction, readSkill } from "./plugins.ts";
+import { accountStatus, doctor } from "./account.ts";
+
+/**
+ * /api/config/* — settings pages. `?project=<pid>` (or `project` in the JSON body)
+ * selects the project whose project-level config is shown; without it only
+ * user-level config is available.
+ */
+
+type Handler = (c: Context, root: string | null, body: Record<string, any>) => Promise<unknown> | unknown;
+
+function wrap(fn: Handler) {
+  return async (c: Context) => {
+    try {
+      const body = c.req.method === "GET" || c.req.method === "DELETE" ? {} : await c.req.json().catch(() => ({}));
+      const pid = c.req.query("project") || (typeof body?.project === "string" ? body.project : "");
+      const root = pid ? projectPath(pid) : null;
+      return c.json((await fn(c, root, body ?? {})) ?? { ok: true });
+    } catch (err) {
+      if (err instanceof ConfigError) return c.json({ error: err.message }, err.status);
+      throw err;
+    }
+  };
+}
+
+const q = (c: Context, k: string) => c.req.query(k) ?? "";
+
+export function registerConfigRoutes(app: Hono) {
+  // memory
+  app.get("/api/config/memory", wrap((_c, root) => listMemory(root)));
+  app.get("/api/config/memory/file", wrap((c, root) => readMemoryFile(root, q(c, "path"))));
+  app.put("/api/config/memory/file", wrap((_c, root, b) => writeMemoryFile(root, b)));
+  app.delete("/api/config/memory/file", wrap((c, root) => deleteMemoryFile(root, q(c, "path"))));
+  app.put("/api/config/memory/auto", wrap((_c, root, b) => setAutoMemory(root, b.enabled === true)));
+
+  // permissions, hooks, settings
+  app.get("/api/config/permissions", wrap((_c, root) => listPermissions(root)));
+  app.post("/api/config/permissions", wrap((_c, root, b) => applyPermissionOp(root, b as never)));
+  app.get("/api/config/hooks", wrap((_c, root) => listHooks(root)));
+  app.post("/api/config/hooks", wrap((_c, root, b) => applyHookOp(root, b as never)));
+  app.get("/api/config/settings", wrap((_c, root) => getSettingsInfo(root)));
+  app.put("/api/config/settings", wrap((_c, root, b) => setSetting(root, b)));
+
+  // agents
+  app.get("/api/config/agents", wrap((_c, root) => listAgents(root)));
+  app.put("/api/config/agents", wrap((_c, root, b) => saveAgent(root, b as never)));
+  app.delete("/api/config/agents", wrap((c, root) => deleteAgent(root, q(c, "scope"), q(c, "file"))));
+
+  // MCP
+  app.get("/api/config/mcp", wrap((_c, root) => listMcp(root)));
+  app.post("/api/config/mcp", wrap((_c, root, b) => addMcp(root, b as never)));
+  app.delete("/api/config/mcp", wrap((c, root) => removeMcp(root, q(c, "name"), q(c, "scope"))));
+  app.get("/api/config/mcp/get", wrap((c, root) => getMcpText(root, q(c, "name"))));
+  app.post("/api/config/mcp/toggle", wrap((_c, root, b) => setMcpEnabled(root, String(b.name ?? ""), b.enabled === true)));
+  app.post("/api/config/mcp/logout", wrap((_c, root, b) => logoutMcp(root, String(b.name ?? ""))));
+  app.post(
+    "/api/config/mcp/auth/start",
+    wrap(async (_c, root, b) => {
+      const r = await startMcpAuth(root ?? os.homedir(), String(b.name ?? ""));
+      return { flowId: r.flowId, authUrl: r.authUrl ?? null, requiresUserAction: r.requiresUserAction !== false, callbackPort: r.callbackPort };
+    }),
+  );
+  app.post(
+    "/api/config/mcp/auth/submit",
+    wrap(async (_c, _root, b) => {
+      try {
+        return { ok: true, result: await submitMcpAuth(String(b.flowId ?? ""), String(b.url ?? "")) };
+      } catch (err) {
+        throw new ConfigError(400, (err as Error).message);
+      }
+    }),
+  );
+  app.post("/api/config/mcp/auth/cancel", wrap((_c, _root, b) => cancelMcpAuth(String(b.flowId ?? ""))));
+
+  // plugins, marketplaces, skills
+  app.get("/api/config/plugins", wrap((_c, root) => listPlugins(root)));
+  app.get("/api/config/plugins/available", wrap((_c, root) => availablePlugins(root)));
+  app.post("/api/config/plugins", wrap((_c, root, b) => pluginAction(root, b)));
+  app.post("/api/config/marketplaces", wrap((_c, root, b) => marketplaceAction(root, b)));
+  app.get("/api/config/skills", wrap((_c, root) => listSkills(root)));
+  app.get("/api/config/skills/file", wrap((c, root) => readSkill(root, q(c, "path"))));
+
+  // account
+  app.get("/api/config/account", wrap(() => accountStatus()));
+  app.get("/api/config/doctor", wrap((_c, root) => doctor(root)));
+}

package/server/config/settings.ts

@@ -0,0 +1,246 @@
+import os from "node:os";
+import {
+  PERMISSION_KINDS,
+  type HookCommand,
+  type HookGroup,
+  type HookLayer,
+  type HookOp,
+  type HooksListing,
+  type PermissionKind,
+  type PermissionLayer,
+  type PermissionOp,
+  type SettingsInfo,
+  type SettingsLayer,
+  type SettingsScope,
+} from "../../shared/config.ts";
+import { effectiveSettings, hooksListing, initInfo } from "../cli-control.ts";
+import { ConfigError, readJsonFile, settingsFile, updateJsonFile } from "./paths.ts";
+
+/**
+ * Permission rules, hooks and plain settings (/permissions, /hooks, /config):
+ * read and written directly in the settings.json files of each layer.
+ */
+
+type Obj = Record<string, unknown>;
+const isObj = (v: unknown): v is Obj => !!v && typeof v === "object" && !Array.isArray(v);
+
+export function scopesFor(root: string | null): SettingsScope[] {
+  return root ? ["user", "project", "local"] : ["user"];
+}
+
+function layerFile(scope: SettingsScope, root: string | null): string {
+  const f = settingsFile(scope, root);
+  if (!f) throw new ConfigError(400, "项目级设置需要先选择项目");
+  return f;
+}
+
+function parseScope(v: unknown, root: string | null): SettingsScope {
+  if (v !== "user" && v !== "project" && v !== "local") throw new ConfigError(400, "未知的层级");
+  if (v !== "user" && !root) throw new ConfigError(400, "项目级设置需要先选择项目");
+  return v;
+}
+
+// ---------- permissions ----------
+
+export async function listPermissions(root: string | null): Promise<PermissionLayer[]> {
+  return Promise.all(scopesFor(root).map(async (scope) => {
+    const file = layerFile(scope, root);
+    const { data, exists } = await readJsonFile(file);
+    const perms = isObj(data.permissions) ? data.permissions : {};
+    const lists = Object.fromEntries(
+      PERMISSION_KINDS.map((k) => [k, Array.isArray(perms[k]) ? (perms[k] as unknown[]).filter((x): x is string => typeof x === "string") : []]),
+    ) as Record<PermissionKind, string[]>;
+    return { scope, path: file, exists, lists };
+  }));
+}
+
+export async function applyPermissionOp(root: string | null, body: PermissionOp) {
+  const scope = parseScope(body?.scope, root);
+  const kind = body.kind;
+  if (!PERMISSION_KINDS.includes(kind)) throw new ConfigError(400, "未知的规则类型");
+  const value = typeof body.value === "string" ? body.value.trim() : "";
+  if (!value) throw new ConfigError(400, "规则不能为空");
+  await updateJsonFile(layerFile(scope, root), (d) => {
+    const perms: Obj = isObj(d.permissions) ? d.permissions : {};
+    const list = Array.isArray(perms[kind]) ? [...(perms[kind] as unknown[])] : [];
+    if (body.op === "add") {
+      if (list.includes(value)) throw new ConfigError(409, "这条规则已经存在");
+      list.push(value);
+    } else if (body.op === "remove") {
+      const i = list.indexOf(value);
+      if (i < 0) throw new ConfigError(404, "规则不存在（可能已被修改）");
+      list.splice(i, 1);
+    } else if (body.op === "replace") {
+      const i = list.indexOf(body.old);
+      if (i < 0) throw new ConfigError(404, "规则不存在（可能已被修改）");
+      if (body.old !== value && list.includes(value)) throw new ConfigError(409, "这条规则已经存在");
+      list[i] = value;
+    } else {
+      throw new ConfigError(400, "未知操作");
+    }
+    if (list.length) perms[kind] = list;
+    else delete perms[kind];
+    if (Object.keys(perms).length) d.permissions = perms;
+    else delete d.permissions;
+  });
+  return listPermissions(root);
+}
+
+// ---------- hooks ----------
+
+function readHooks(data: Obj): Record<string, HookGroup[]> {
+  if (!isObj(data.hooks)) return {};
+  const out: Record<string, HookGroup[]> = {};
+  for (const [event, groups] of Object.entries(data.hooks)) {
+    if (!Array.isArray(groups)) continue;
+    out[event] = groups.filter(isObj).map((g) => ({
+      ...(typeof g.matcher === "string" ? { matcher: g.matcher } : {}),
+      hooks: Array.isArray(g.hooks) ? (g.hooks.filter(isObj) as HookCommand[]) : [],
+    }));
+  }
+  return out;
+}
+
+const SETTINGS_SOURCES = new Set(["userSettings", "projectSettings", "localSettings"]);
+
+export async function listHooks(root: string | null): Promise<HooksListing> {
+  const layers: HookLayer[] = await Promise.all(scopesFor(root).map(async (scope) => {
+    const file = layerFile(scope, root);
+    const { data, exists } = await readJsonFile(file);
+    return { scope, path: file, exists, hooks: readHooks(data) };
+  }));
+  let events: HooksListing["events"] = [];
+  let readonly: HooksListing["readonly"] = [];
+  try {
+    const l = await hooksListing(root ?? os.homedir());
+    events = l.eventCatalog.map((e) => ({ name: e.name, summary: e.summary, supportsMatcher: e.supportsMatcher }));
+    readonly = l.hooks
+      .filter((h) => !SETTINGS_SOURCES.has(h.source))
+      .map((h) => ({ event: h.event, matcher: h.matcher, source: h.source, label: h.sourceLabel, text: h.displayText }));
+  } catch {
+    // The listing is a nicety (summaries, plugin hooks); the files are the truth.
+  }
+  return { layers, events, readonly };
+}
+
+function cleanHook(h: HookCommand): HookCommand {
+  if (!isObj(h) || typeof h.type !== "string") throw new ConfigError(400, "钩子格式不正确");
+  if (h.type === "command") {
+    const command = typeof h.command === "string" ? h.command.trim() : "";
+    if (!command) throw new ConfigError(400, "命令不能为空");
+    const out: HookCommand = { ...h, type: "command", command };
+    if (h.timeout === undefined || h.timeout === null || (h.timeout as unknown) === "") delete out.timeout;
+    else {
+      const t = Number(h.timeout);
+      if (!Number.isFinite(t) || t <= 0) throw new ConfigError(400, "超时时间必须是正数（秒）");
+      out.timeout = t;
+    }
+    return out;
+  }
+  return h;
+}
+
+export async function applyHookOp(root: string | null, body: HookOp) {
+  const scope = parseScope(body?.scope, root);
+  const event = typeof body.event === "string" ? body.event.trim() : "";
+  if (!/^[A-Za-z]+$/.test(event)) throw new ConfigError(400, "未知的事件");
+  await updateJsonFile(layerFile(scope, root), (d) => {
+    const hooks: Obj = isObj(d.hooks) ? d.hooks : {};
+    const groups: Obj[] = Array.isArray(hooks[event]) ? [...(hooks[event] as Obj[])] : [];
+    const add = (matcher: string | undefined, hook: HookCommand) => {
+      const m = matcher?.trim() || undefined;
+      const g = groups.find((x) => isObj(x) && (typeof x.matcher === "string" && x.matcher ? x.matcher : undefined) === m);
+      if (g) g.hooks = [...(Array.isArray(g.hooks) ? g.hooks : []), hook];
+      else groups.push({ ...(m !== undefined ? { matcher: m } : {}), hooks: [hook] });
+    };
+    const at = (gi: number, hi: number) => {
+      const g = groups[gi];
+      if (!isObj(g) || !Array.isArray(g.hooks) || !isObj(g.hooks[hi])) throw new ConfigError(404, "钩子不存在（可能已被修改）");
+      return g as Obj & { hooks: unknown[] };
+    };
+    const removeAt = (gi: number, hi: number) => {
+      const g = at(gi, hi);
+      g.hooks = g.hooks.filter((_, i) => i !== hi);
+      if (!g.hooks.length) groups.splice(gi, 1);
+    };
+    if (body.op === "add") add(body.matcher, cleanHook(body.hook));
+    else if (body.op === "remove") removeAt(body.group, body.index);
+    else if (body.op === "replace") {
+      const hook = cleanHook(body.hook);
+      const g = at(body.group, body.index);
+      const oldMatcher = typeof g.matcher === "string" && g.matcher ? g.matcher : undefined;
+      const newMatcher = body.matcher?.trim() || undefined;
+      if (oldMatcher === newMatcher) g.hooks = g.hooks.map((h, i) => (i === body.index ? hook : h));
+      else {
+        removeAt(body.group, body.index);
+        add(newMatcher, hook);
+      }
+    } else throw new ConfigError(400, "未知操作");
+    if (groups.length) hooks[event] = groups;
+    else delete hooks[event];
+    if (Object.keys(hooks).length) d.hooks = hooks;
+    else delete d.hooks;
+  });
+  return listHooks(root);
+}
+
+// ---------- plain settings (/config) ----------
+
+type KeySpec = { type: "string" } | { type: "boolean" } | { type: "number"; min?: number } | { type: "enum"; values: string[] };
+
+/** Settings the /config page edits. Anything else in the files is left untouched. */
+export const CONFIG_KEYS: Record<string, KeySpec> = {
+  model: { type: "string" },
+  effortLevel: { type: "enum", values: ["low", "medium", "high", "xhigh"] },
+  outputStyle: { type: "string" },
+  alwaysThinkingEnabled: { type: "boolean" },
+  showThinkingSummaries: { type: "boolean" },
+  language: { type: "string" },
+  includeGitInstructions: { type: "boolean" },
+  respectGitignore: { type: "boolean" },
+  cleanupPeriodDays: { type: "number", min: 1 },
+  autoUpdatesChannel: { type: "enum", values: ["latest", "stable", "rc"] },
+  autoMemoryEnabled: { type: "boolean" },
+};
+
+export async function getSettingsInfo(root: string | null): Promise<SettingsInfo> {
+  const layers: SettingsLayer[] = await Promise.all(scopesFor(root).map(async (scope) => {
+    const file = layerFile(scope, root);
+    const { data, exists } = await readJsonFile(file);
+    return { scope, path: file, exists, settings: data };
+  }));
+  const cwd = root ?? os.homedir();
+  const [effective, init] = await Promise.all([effectiveSettings(cwd).catch(() => null), initInfo(cwd).catch(() => null)]);
+  return {
+    layers,
+    effective: effective?.effective ?? {},
+    outputStyles: init?.available_output_styles ?? ["default"],
+    models: (init?.models ?? []).map((m) => ({ value: m.value, displayName: m.displayName, description: m.description })),
+  };
+}
+
+export async function setSetting(root: string | null, body: { scope?: unknown; key?: unknown; value?: unknown }) {
+  const scope = parseScope(body.scope, root);
+  const key = String(body.key ?? "");
+  const spec = CONFIG_KEYS[key];
+  if (!spec) throw new ConfigError(400, "不支持修改这个设置");
+  let value = body.value;
+  if (value === null || value === undefined || value === "") value = undefined;
+  else if (spec.type === "string") {
+    if (typeof value !== "string") throw new ConfigError(400, "应为文本");
+    value = value.trim() || undefined;
+  } else if (spec.type === "boolean") {
+    if (typeof value !== "boolean") throw new ConfigError(400, "应为开或关");
+  } else if (spec.type === "number") {
+    const n = Number(value);
+    if (!Number.isFinite(n) || (spec.min !== undefined && n < spec.min)) throw new ConfigError(400, "数值不正确");
+    value = n;
+  } else if (spec.type === "enum") {
+    if (!spec.values.includes(String(value))) throw new ConfigError(400, "取值不正确");
+  }
+  updateJsonFile(layerFile(scope, root), (d) => {
+    if (value === undefined) delete d[key];
+    else d[key] = value;
+  });
+  return getSettingsInfo(root);
+}

package/server/config.ts

@@ -0,0 +1,46 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+
+function expandHome(p: string): string {
+  return p.startsWith("~/") ? path.join(os.homedir(), p.slice(2)) : p;
+}
+
+const dataDir = path.resolve(expandHome(process.env.CLAUDE_IDE_DATA_DIR ?? "~/.claude-ide"));
+fs.mkdirSync(dataDir, { recursive: true, mode: 0o700 });
+
+/** The password file is authoritative. CLAUDE_IDE_PASSWORD only seeds a new
+ * installation; it never overrides an existing/missing deployed credential. */
+function loadPassword(): { password: string; generated: boolean } {
+  const file = path.join(dataDir, "password");
+  try {
+    return { password: fs.readFileSync(file, "utf8").trim(), generated: false };
+  } catch (err) {
+    // Only a brand-new installation generates a password. A missing/unreadable
+    // credential on an existing installation stays unavailable until repaired.
+    if ((err as NodeJS.ErrnoException).code !== "ENOENT" || fs.existsSync(path.join(dataDir, "ide.sqlite"))) {
+      return { password: "", generated: false };
+    }
+  }
+  const password = process.env.CLAUDE_IDE_PASSWORD || crypto.randomBytes(12).toString("base64url");
+  fs.writeFileSync(file, password + "\n", { mode: 0o600 });
+  return { password, generated: !process.env.CLAUDE_IDE_PASSWORD };
+}
+
+const { password, generated } = loadPassword();
+
+export const config = {
+  port: Number(process.env.CLAUDE_IDE_PORT ?? 8787),
+  host: process.env.CLAUDE_IDE_HOST ?? "0.0.0.0",
+  dataDir,
+  password,
+  passwordGenerated: generated,
+  passwordFile: path.join(dataDir, "password"),
+  /** Overrides the model for every session (tests use Haiku). */
+  modelOverride: process.env.CLAUDE_IDE_MODEL || undefined,
+  production: process.env.NODE_ENV === "production",
+  /** Idle CLI processes are stopped after this long (resumed on the next message). */
+  idleReapMs: Number(process.env.CLAUDE_IDE_IDLE_MINUTES ?? 15) * 60_000,
+  webDist: path.resolve(import.meta.dirname, "../web/dist"),
+};