@very_aq/codex-cli-web 0.0.1

package/server/dist/app.js

@@ -0,0 +1,993 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApp = createApp;
+const express_1 = __importDefault(require("express"));
+const busboy_1 = __importDefault(require("busboy"));
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const env_1 = require("./env");
+const httpAuth_1 = require("./auth/httpAuth");
+const roles_1 = require("./auth/roles");
+const bootstrapAdmin_1 = require("./auth/bootstrapAdmin");
+const password_1 = require("./auth/password");
+const adminInit_1 = require("./auth/adminInit");
+const userAdminRoutes_1 = require("./admin/userAdminRoutes");
+const cwdSuggest_1 = require("./tools/cwdSuggest");
+const accessControl_1 = require("./workspace/accessControl");
+const threadAccess_1 = require("./workspace/threadAccess");
+const threadListVisibility_1 = require("./workspace/threadListVisibility");
+const userWorkspaceRoutes_1 = require("./workspace/userWorkspaceRoutes");
+const userSettingsRoutes_1 = require("./settings/userSettingsRoutes");
+const userSettingsTypes_1 = require("./settings/userSettingsTypes");
+const historyRoutes_1 = require("./history/http/historyRoutes");
+const threadListServerCache_1 = require("./threadList/threadListServerCache");
+const session_1 = require("./auth/session");
+function createInMemoryUserStore() {
+    // 测试默认使用内存仓库，避免读写真实文件系统导致串扰。
+    const usersByUsername = new Map();
+    const normalizeUsername = (username) => String(username ?? "").trim();
+    const normalizeRole = (role) => (role === "admin" ? "admin" : "member");
+    return {
+        async createUser(input) {
+            const username = normalizeUsername(input.username);
+            if (!username)
+                throw new Error("username is required");
+            if (usersByUsername.has(username))
+                throw new Error("username already exists");
+            const password = String(input.password ?? "");
+            if (!password)
+                throw new Error("password is required");
+            // 这里复用 password.ts 的哈希逻辑，确保测试环境与生产一致。
+            const { hashPassword } = await Promise.resolve().then(() => __importStar(require("./auth/password")));
+            const passwordHash = await hashPassword(password);
+            const user = { username, role: normalizeRole(input.role), passwordHash, workspaces: [] };
+            usersByUsername.set(username, user);
+            return user;
+        },
+        async getUserByUsername(username) {
+            const normalized = normalizeUsername(username);
+            return usersByUsername.get(normalized) ?? null;
+        },
+        async setUserPassword(username, password) {
+            // 规范化用户名：作为 Map key 使用。
+            const normalizedUsername = normalizeUsername(username);
+            if (!normalizedUsername)
+                throw new Error("username is required");
+            // 新密码明文：仅用于计算 hash，不做持久化。
+            const nextPassword = String(password ?? "");
+            if (!nextPassword)
+                throw new Error("password is required");
+            // 定位目标用户；不存在则报错。
+            const user = usersByUsername.get(normalizedUsername);
+            if (!user)
+                throw new Error("user not found");
+            // 这里复用 password.ts 的哈希逻辑，确保测试环境与生产一致。
+            const { hashPassword } = await Promise.resolve().then(() => __importStar(require("./auth/password")));
+            // 计算新的 passwordHash 并回写。
+            const nextPasswordHash = await hashPassword(nextPassword);
+            user.passwordHash = nextPasswordHash;
+            usersByUsername.set(normalizedUsername, user);
+            return user;
+        },
+        async assignWorkspaces(username, workspaces) {
+            const normalized = normalizeUsername(username);
+            const user = usersByUsername.get(normalized);
+            if (!user)
+                throw new Error("user not found");
+            const seen = new Set();
+            user.workspaces = (workspaces ?? []).map(String).map((w) => w.trim()).filter(Boolean).filter((w) => {
+                if (seen.has(w))
+                    return false;
+                seen.add(w);
+                return true;
+            });
+            return user;
+        },
+        async listUsers() {
+            return [...usersByUsername.values()];
+        },
+    };
+}
+function createInMemoryUserWorkspaceStore() {
+    // 用户工作目录内存仓库：测试默认值，避免依赖真实文件系统。
+    const workspaceDirsByUsername = new Map();
+    const normalizeUsername = (username) => String(username ?? "").trim();
+    return {
+        async listUserWorkspaceDirs(username) {
+            const normalizedUsername = normalizeUsername(username);
+            if (!normalizedUsername)
+                return [];
+            const workspaceDirs = workspaceDirsByUsername.get(normalizedUsername) ?? [];
+            return [...workspaceDirs];
+        },
+        async replaceUserWorkspaceDirs(username, workspaceDirs) {
+            const normalizedUsername = normalizeUsername(username);
+            if (!normalizedUsername)
+                throw new Error("username is required");
+            // 内存仓库仅做去重和绝对路径化，与文件仓库行为保持一致。
+            const seen = new Set();
+            const normalizedWorkspaceDirs = (workspaceDirs ?? [])
+                .map((workspaceDir) => path_1.default.resolve(String(workspaceDir ?? "").trim()))
+                .filter(Boolean)
+                .filter((workspaceDir) => {
+                if (seen.has(workspaceDir))
+                    return false;
+                seen.add(workspaceDir);
+                return true;
+            });
+            workspaceDirsByUsername.set(normalizedUsername, normalizedWorkspaceDirs);
+            return [...normalizedWorkspaceDirs];
+        },
+    };
+}
+function createInMemoryUserSettingsStore() {
+    // 用户配置内存仓库：测试默认值，避免依赖真实数据库。
+    const settingsByUsername = new Map();
+    const normalizeUsername = (username) => String(username ?? "").trim();
+    return {
+        async getUserSettings(username) {
+            const normalizedUsername = normalizeUsername(username);
+            if (!normalizedUsername)
+                return (0, userSettingsTypes_1.normalizeUserSettings)(null);
+            return (0, userSettingsTypes_1.normalizeUserSettings)(settingsByUsername.get(normalizedUsername) ?? null);
+        },
+        async replaceUserSettings(username, settings) {
+            const normalizedUsername = normalizeUsername(username);
+            if (!normalizedUsername)
+                throw new Error("username is required");
+            const normalizedSettings = (0, userSettingsTypes_1.normalizeUserSettings)(settings);
+            settingsByUsername.set(normalizedUsername, normalizedSettings);
+            return (0, userSettingsTypes_1.normalizeUserSettings)(normalizedSettings);
+        },
+    };
+}
+function createApp(opts) {
+    const app = (0, express_1.default)();
+    app.use(express_1.default.json({ limit: "1mb" }));
+    // 基础安全头：减少常见浏览器侧攻击面（不影响 API/前端功能）。
+    app.use((_req, res, next) => {
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.setHeader("X-Frame-Options", "DENY");
+        res.setHeader("Referrer-Policy", "same-origin");
+        next();
+    });
+    const userStore = opts.userStore ?? createInMemoryUserStore();
+    const userWorkspaceStore = opts.userWorkspaceStore ?? createInMemoryUserWorkspaceStore();
+    const userSettingsStore = opts.userSettingsStore ?? createInMemoryUserSettingsStore();
+    const adminBootstrap = (0, bootstrapAdmin_1.bootstrapAdmin)(userStore);
+    const threadListServerCache = (0, threadListServerCache_1.createThreadListServerCache)();
+    const listThreadsWithServerCache = async () => {
+        const cachedThreads = threadListServerCache.get();
+        if (cachedThreads)
+            return cachedThreads;
+        const latestThreads = await opts.codex.listThreads();
+        threadListServerCache.set(latestThreads);
+        return latestThreads;
+    };
+    const clearThreadListServerCache = () => {
+        threadListServerCache.clear();
+    };
+    // 登录限流：按 IP + username 做简单窗口限制，降低暴力破解风险（每 app 实例独立）。
+    const loginRateWindowMs = 30_000;
+    const loginRateMaxAttempts = 20;
+    const loginAttemptsByKey = new Map();
+    const getLoginRateKey = (req, username) => {
+        const xfwd = typeof req.headers["x-forwarded-for"] === "string" ? req.headers["x-forwarded-for"] : "";
+        const ip = xfwd.split(",")[0]?.trim() || String(req.socket?.remoteAddress ?? "unknown");
+        return `${ip}::${username}`;
+    };
+    const checkAndBumpLoginAttempt = (key) => {
+        const nowMs = Date.now();
+        // best-effort 清理过期 entry，避免长时间运行导致内存增长。
+        if (loginAttemptsByKey.size > 10_000) {
+            for (const [k, v] of loginAttemptsByKey.entries()) {
+                if (nowMs >= v.resetAtMs)
+                    loginAttemptsByKey.delete(k);
+            }
+        }
+        const existing = loginAttemptsByKey.get(key);
+        if (!existing || nowMs >= existing.resetAtMs) {
+            loginAttemptsByKey.set(key, { count: 1, resetAtMs: nowMs + loginRateWindowMs });
+            return false;
+        }
+        existing.count += 1;
+        return existing.count > loginRateMaxAttempts;
+    };
+    const startedAtMs = opts.startedAtMs ?? Date.now();
+    const webDist = path_1.default.resolve(__dirname, "..", "..", "web", "dist");
+    app.get("/api/health", (_req, res) => res.json({ ok: true }));
+    app.get("/api/status", (_req, res) => {
+        const nowMs = Date.now();
+        const snapshot = opts.getStatusSnapshot?.() ?? {};
+        const webUiVersion = getWebUiVersion(webDist);
+        res.setHeader("Cache-Control", "no-store");
+        res.json({
+            ok: true,
+            nowMs,
+            server: { pid: process.pid, startedAtMs, uptimeMs: Math.max(0, nowMs - startedAtMs) },
+            webUi: { version: webUiVersion },
+            ...snapshot,
+        });
+    });
+    app.get("/api/auth/bootstrap-admin/status", (req, res) => {
+        void (async () => {
+            // 等待 bootstrap 完成，避免 setup/status 与 bootstrap 并发导致用户仓库写入冲突。
+            await adminBootstrap;
+            // 读取 admin 初始化状态：用于前端决定是否展示“首次设置密码”入口。
+            const state = await (0, adminInit_1.readAdminInitState)(userStore);
+            res.setHeader("Cache-Control", "no-store");
+            res.json({ ok: true, ...state });
+        })().catch((err) => {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        });
+    });
+    app.post("/api/auth/bootstrap-admin/setup", (req, res) => {
+        void (async () => {
+            // 等待 bootstrap 完成，避免 setup/status 与 bootstrap 并发导致用户仓库写入冲突。
+            await adminBootstrap;
+            // setup 请求体：只关心新密码字段（前端可做二次确认校验）。
+            const body = (req.body ?? {});
+            const username = body.username;
+            const password = body.password;
+            const result = await (0, adminInit_1.setupAdminPassword)({ store: userStore, username, password });
+            if (!result.ok) {
+                if (result.status === "already_configured") {
+                    res.status(409).json({ ok: false, error: "already_configured" });
+                    return;
+                }
+                if (result.status === "invalid_username") {
+                    res.status(400).json({ ok: false, error: "invalid_request", details: result.details });
+                    return;
+                }
+                res.status(400).json({ ok: false, error: "invalid_request", details: result.details });
+                return;
+            }
+            // 初始化成功后直接建立会话 cookie，避免用户再手动登录一次。
+            const secure = isSecureRequest(req);
+            const sessionUsername = String(result.user.username ?? "").trim() || "admin";
+            const cookieValue = (0, session_1.createSessionCookieValue)({ username: sessionUsername, role: "admin" }, opts.sessionSecret);
+            res.setHeader("Set-Cookie", (0, session_1.buildSessionSetCookieHeader)(cookieValue, { maxAgeSeconds: session_1.DEFAULT_SESSION_TTL_SECONDS, secure }));
+            res.json({ ok: true, status: result.status });
+        })().catch((err) => {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        });
+    });
+    app.post("/api/auth/login", (req, res) => {
+        void (async () => {
+            await adminBootstrap;
+            const body = (req.body ?? {});
+            const username = String(body.username ?? "").trim();
+            const password = String(body.password ?? "");
+            if (!username || !password) {
+                res.status(401).json({ ok: false, error: "invalid_credentials" });
+                return;
+            }
+            const rateLimitKey = getLoginRateKey(req, username);
+            const limited = checkAndBumpLoginAttempt(rateLimitKey);
+            if (limited) {
+                res.status(429).json({ ok: false, error: "rate_limited" });
+                return;
+            }
+            const user = await userStore.getUserByUsername(username);
+            if (!user) {
+                res.status(401).json({ ok: false, error: "invalid_credentials" });
+                return;
+            }
+            const ok = await (0, password_1.verifyPassword)(password, user.passwordHash);
+            if (!ok) {
+                res.status(401).json({ ok: false, error: "invalid_credentials" });
+                return;
+            }
+            // 成功登录后清理该 key，避免正常用户被之前失败尝试影响。
+            loginAttemptsByKey.delete(rateLimitKey);
+            const secure = isSecureRequest(req);
+            const cookieValue = (0, session_1.createSessionCookieValue)({ username: user.username, role: user.role }, opts.sessionSecret);
+            res.setHeader("Set-Cookie", (0, session_1.buildSessionSetCookieHeader)(cookieValue, { maxAgeSeconds: session_1.DEFAULT_SESSION_TTL_SECONDS, secure }));
+            res.json({ ok: true });
+        })().catch((err) => {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        });
+    });
+    app.post("/api/auth/logout", (req, res) => {
+        const secure = isSecureRequest(req);
+        res.setHeader("Set-Cookie", (0, session_1.buildSessionClearCookieHeader)({ secure }));
+        res.json({ ok: true });
+    });
+    app.get("/api/auth/me", (req, res) => {
+        void (async () => {
+            const cookies = (0, session_1.parseCookieHeader)(req.headers.cookie);
+            const raw = cookies[session_1.SESSION_COOKIE_NAME];
+            const session = raw ? (0, session_1.verifySessionCookieValueWithRole)(raw, opts.sessionSecret) : null;
+            if (!session) {
+                res.status(401).json({ ok: false, error: "unauthorized" });
+                return;
+            }
+            const stored = await userStore.getUserByUsername(session.username);
+            const role = stored?.role ?? session.role ?? (session.username === "admin" ? "admin" : "member");
+            const storedWorkspaces = stored?.workspaces ?? [];
+            // 原始分配目录：仅用于前端提示“已分配但未生效”，不参与本接口鉴权判定。
+            const assignedWorkspaces = storedWorkspaces;
+            // 返回给前端的工作区列表必须是“当前用户实际可用”的工作区：
+            // - member：由管理员分配 workspaces；
+            // - admin：默认授权根目录为 `/`（右模糊/前缀匹配可覆盖所有路径）；若用户数据中显式配置了 workspaces，则以其为准。
+            const access = (0, accessControl_1.resolveAllowedRootsForUser)({ role, workspaces: storedWorkspaces });
+            const workspaces = access.allowAnyRoot ? (storedWorkspaces.length ? storedWorkspaces : ["/"]) : access.roots;
+            // 兼容旧版前端：保留 `user` 字段为 string。
+            res.json({ ok: true, user: session.username, username: session.username, role, workspaces, assignedWorkspaces });
+        })().catch((err) => {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        });
+    });
+    app.use("/api", (req, res, next) => {
+        if (req.path === "/health")
+            return next();
+        if (req.path === "/status")
+            return next();
+        if (req.path.startsWith("/auth/"))
+            return next();
+        return (0, httpAuth_1.requireAuth)(opts.sessionSecret, userStore)(req, res, next);
+    });
+    app.use("/api/admin", (0, userAdminRoutes_1.createUserAdminRoutes)({ userStore }));
+    app.use("/api/workspaces", (0, userWorkspaceRoutes_1.createUserWorkspaceRoutes)({ userWorkspaceStore }));
+    app.use("/api/user-settings", (0, userSettingsRoutes_1.createUserSettingsRoutes)({ userSettingsStore }));
+    const uploadHandler = async (req, res) => {
+        const username = String(req.user?.username ?? "").trim();
+        if (!username) {
+            res.status(401).json({ ok: false, error: "unauthorized" });
+            return;
+        }
+        try {
+            const result = await receiveAttachmentUpload(req, { username, maxBytes: (0, env_1.getWebMaxUploadBytes)() });
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            const e = err;
+            const status = typeof e?.status === "number" && Number.isFinite(e.status) ? Math.floor(e.status) : 400;
+            res.status(status).json({ ok: false, error: "upload_failed", details: String(e?.message ?? err) });
+        }
+    };
+    app.post("/api/uploads/attachment", uploadHandler);
+    // Back-compat for older UIs.
+    app.post("/api/uploads/image", uploadHandler);
+    app.get("/api/uploads/:filename", async (req, res) => {
+        const username = String(req.user?.username ?? "").trim();
+        if (!username) {
+            res.status(401).json({ ok: false, error: "unauthorized" });
+            return;
+        }
+        const raw = String(req.params.filename ?? "");
+        const filename = sanitizeUploadedFilename(raw);
+        if (!filename) {
+            res.status(404).end();
+            return;
+        }
+        const { dir } = getUserUploadsDir(username);
+        const fullPath = path_1.default.join(dir, filename);
+        try {
+            const st = await fs_1.default.promises.stat(fullPath);
+            if (!st.isFile()) {
+                res.status(404).end();
+                return;
+            }
+        }
+        catch {
+            res.status(404).end();
+            return;
+        }
+        res.setHeader("Cache-Control", "no-store");
+        res.setHeader("Content-Type", "application/octet-stream");
+        res.setHeader("Content-Disposition", `attachment; filename="${filename.replace(/\"/g, "")}"`);
+        res.sendFile(fullPath);
+    });
+    app.get("/api/config", async (_req, res) => {
+        const approvalPolicy = (0, env_1.getCodexApprovalPolicy)();
+        const sandboxMode = (0, env_1.getCodexSandboxMode)();
+        let model = null;
+        let reasoningEffort = null;
+        if (opts.codex) {
+            try {
+                const [collabRes, modelRes] = await Promise.allSettled([opts.codex.listCollaborationModes(), opts.codex.listModels()]);
+                const collabData = collabRes.status === "fulfilled" ? collabRes.value : null;
+                const collabItems = Array.isArray(collabData?.data) ? collabData.data : [];
+                const lowerIncludes = (s, needle) => String(s ?? "").toLowerCase().includes(needle);
+                const defaultCollab = collabItems.find((m) => m && typeof m === "object" && m.mode === "default") ??
+                    collabItems.find((m) => m && typeof m === "object" && lowerIncludes(m.name, "default")) ??
+                    null;
+                const collabModel = String(defaultCollab?.model ?? "").trim();
+                const collabEffortRaw = defaultCollab?.reasoning_effort;
+                const collabEffort = typeof collabEffortRaw === "string" ? collabEffortRaw.trim() : collabEffortRaw ?? null;
+                if (collabModel)
+                    model = collabModel;
+                if (typeof collabEffort === "string" && collabEffort.trim())
+                    reasoningEffort = collabEffort.trim();
+                const modelData = modelRes.status === "fulfilled" ? modelRes.value : null;
+                const modelItems = Array.isArray(modelData?.data) ? modelData.data : [];
+                const defaultModel = modelItems.find((m) => m && typeof m === "object" && Boolean(m.isDefault)) ??
+                    modelItems.find((m) => m && typeof m === "object" && String(m.id ?? "").toLowerCase().includes("default")) ??
+                    null;
+                if (!model) {
+                    const fallbackModel = String(defaultModel?.model ?? defaultModel?.id ?? "").trim();
+                    if (fallbackModel)
+                        model = fallbackModel;
+                }
+                if (!reasoningEffort) {
+                    const d = String(defaultModel?.defaultReasoningEffort ?? "").trim();
+                    if (d)
+                        reasoningEffort = d;
+                }
+            }
+            catch {
+                // Best-effort only: still return env-derived defaults below.
+            }
+        }
+        // Security: avoid leaking server directory structure (e.g. CODEX_CWD) to clients.
+        res.json({ approvalPolicy, sandboxMode, model, reasoningEffort });
+    });
+    app.get("/api/cwd/suggest", async (req, res) => {
+        const q = typeof req.query?.q === "string" ? String(req.query.q) : "";
+        const limit = typeof req.query?.limit === "string" ? Number(req.query.limit) : undefined;
+        const access = (0, accessControl_1.resolveAllowedRootsForUser)(req.user);
+        if (!access.allowAnyRoot && !access.roots.length) {
+            res.status(403).json({ ok: false, error: "path_not_allowed" });
+            return;
+        }
+        try {
+            const suggestions = await (0, cwdSuggest_1.suggestCwds)({
+                query: q,
+                limit,
+                allowAnyRoot: access.allowAnyRoot,
+                allowedRoots: access.allowAnyRoot ? undefined : access.roots,
+            });
+            res.json({ ok: true, suggestions });
+        }
+        catch (err) {
+            if (err instanceof cwdSuggest_1.CwdSuggestError) {
+                const status = err.code === "path_not_allowed" ? 403 : 400;
+                res.status(status).json({ ok: false, error: err.code });
+                return;
+            }
+            res.status(500).json({ ok: false, error: "request_failed" });
+        }
+    });
+    app.get("/api/model/list", async (_req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        try {
+            const result = await opts.codex.listModels();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.get("/api/experimental/list", async (_req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        try {
+            const result = await opts.codex.listExperimentalFeatures();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.get("/api/collaboration/list", async (_req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        try {
+            const result = await opts.codex.listCollaborationModes();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.post("/api/experimental/set", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        if (!(0, roles_1.isAdminRole)(req.user?.role)) {
+            res.status(403).json({ ok: false, error: "forbidden" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const name = String(body.name ?? "").trim();
+        const enabled = Boolean(body.enabled);
+        if (!name) {
+            res.status(400).json({ ok: false, error: "invalid_request" });
+            return;
+        }
+        try {
+            const result = await opts.codex.setConfigValue({ keyPath: `features.${name}`, value: enabled, mergeStrategy: "replace" });
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.get("/api/skills/list", async (_req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        try {
+            const result = await opts.codex.listSkills();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.post("/api/skills/set", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        if (!(0, roles_1.isAdminRole)(req.user?.role)) {
+            res.status(403).json({ ok: false, error: "forbidden" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const skillPath = String(body.path ?? "").trim();
+        const enabled = Boolean(body.enabled);
+        if (!skillPath) {
+            res.status(400).json({ ok: false, error: "invalid_request" });
+            return;
+        }
+        try {
+            const result = await opts.codex.setSkillEnabled({ path: skillPath, enabled });
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.get("/api/thread/list", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        const user = req.user;
+        if (!user) {
+            res.status(401).json({ ok: false, error: "unauthorized" });
+            return;
+        }
+        const requestedCwd = typeof req.query?.cwd === "string" ? String(req.query.cwd) : "";
+        let workspaceFilterCwd = null;
+        try {
+            workspaceFilterCwd = await (0, threadListVisibility_1.resolveThreadListWorkspaceFilter)(requestedCwd, user);
+        }
+        catch {
+            // 统一返回 path_not_allowed，避免暴露目录是否存在等细节。
+            res.status(403).json({ ok: false, error: "path_not_allowed" });
+            return;
+        }
+        try {
+            const routingSnapshot = await userStore
+                .listUsers()
+                .then((users) => (0, threadListVisibility_1.buildWorkspaceRoutingSnapshot)(users))
+                .catch(() => null);
+            const threads = await listThreadsWithServerCache();
+            const visibleThreads = threads.filter((thread) => (0, threadListVisibility_1.shouldIncludeThreadForList)({
+                thread,
+                user,
+                workspaceFilterCwd,
+                routingSnapshot,
+            }));
+            res.setHeader("Cache-Control", "no-store");
+            res.json({ ok: true, threads: visibleThreads, cwd: workspaceFilterCwd });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    // 线程写接口统一鉴权：member 必须在其分配 workspaces 内操作 thread.cwd。
+    const requireThreadAccess = async (req, res, threadId) => {
+        const user = req.user;
+        if (!user) {
+            res.status(401).json({ ok: false, error: "unauthorized" });
+            return false;
+        }
+        try {
+            await (0, threadAccess_1.assertThreadAllowedForUser)({ threadId, user, codex: opts.codex });
+            return true;
+        }
+        catch {
+            // 不区分 thread 不存在 / 越权等细节，避免信息泄露。
+            res.status(403).json({ ok: false, error: "forbidden" });
+            return false;
+        }
+    };
+    // 历史读取接口：复用线程访问权限校验，避免绕过现有工作区隔离规则。
+    if (opts.historyQuery) {
+        app.use("/api/history", (0, historyRoutes_1.createHistoryRoutes)({
+            historyQuery: opts.historyQuery,
+            requireThreadAccess,
+        }));
+    }
+    app.post("/api/thread/name/set", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const threadId = String(body.threadId ?? "").trim();
+        const name = String(body.name ?? "").trim();
+        if (!threadId || !name) {
+            res.status(400).json({ ok: false, error: "invalid_request" });
+            return;
+        }
+        try {
+            if (!(await requireThreadAccess(req, res, threadId)))
+                return;
+            const result = await opts.codex.setThreadName({ threadId, name });
+            clearThreadListServerCache();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.post("/api/review/start", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const threadId = String(body.threadId ?? "").trim();
+        const target = body.target ?? { type: "uncommittedChanges" };
+        if (!threadId) {
+            res.status(400).json({ ok: false, error: "invalid_request" });
+            return;
+        }
+        try {
+            if (!(await requireThreadAccess(req, res, threadId)))
+                return;
+            const result = await opts.codex.startReview({ threadId, target });
+            clearThreadListServerCache();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.post("/api/thread/compact/start", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const threadId = String(body.threadId ?? "").trim();
+        if (!threadId) {
+            res.status(400).json({ ok: false, error: "invalid_request" });
+            return;
+        }
+        try {
+            if (!(await requireThreadAccess(req, res, threadId)))
+                return;
+            const result = await opts.codex.startCompact({ threadId });
+            clearThreadListServerCache();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.post("/api/thread/fork", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const threadId = String(body.threadId ?? "").trim();
+        if (!threadId) {
+            res.status(400).json({ ok: false, error: "invalid_request" });
+            return;
+        }
+        try {
+            if (!(await requireThreadAccess(req, res, threadId)))
+                return;
+            const result = await opts.codex.forkThread({ threadId });
+            const thread = result?.thread ?? result;
+            const forkedId = String(thread?.id ?? "");
+            clearThreadListServerCache();
+            res.json({ ok: true, threadId: forkedId || undefined, thread });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.post("/api/thread/archive", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const threadId = String(body.threadId ?? "").trim();
+        if (!threadId) {
+            res.status(400).json({ ok: false, error: "invalid_request" });
+            return;
+        }
+        try {
+            if (!(await requireThreadAccess(req, res, threadId)))
+                return;
+            const result = await opts.codex.archiveThread({ threadId });
+            clearThreadListServerCache();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.post("/api/thread/unarchive", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const threadId = String(body.threadId ?? "").trim();
+        if (!threadId) {
+            res.status(400).json({ ok: false, error: "invalid_request" });
+            return;
+        }
+        try {
+            if (!(await requireThreadAccess(req, res, threadId)))
+                return;
+            const result = await opts.codex.unarchiveThread({ threadId });
+            clearThreadListServerCache();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    app.post("/api/thread/rollback", async (req, res) => {
+        if (!opts.codex) {
+            res.status(501).json({ ok: false, error: "not_supported" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const threadId = String(body.threadId ?? "").trim();
+        const numTurns = Number(body.numTurns ?? 0);
+        if (!threadId || !Number.isFinite(numTurns) || numTurns < 1) {
+            res.status(400).json({ ok: false, error: "invalid_request" });
+            return;
+        }
+        try {
+            if (!(await requireThreadAccess(req, res, threadId)))
+                return;
+            const result = await opts.codex.rollbackThread({ threadId, numTurns: Math.floor(numTurns) });
+            clearThreadListServerCache();
+            res.json({ ok: true, ...result });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: "request_failed", details: String(err) });
+        }
+    });
+    // API 路由兜底：未命中的 `/api/*` 统一返回 JSON 404，避免落到 HTML SPA fallback。
+    app.use("/api", (_req, res) => {
+        res.status(404).json({ ok: false, error: "not_found" });
+    });
+    if (fs_1.default.existsSync(webDist)) {
+        app.use(express_1.default.static(webDist, { index: false }));
+        app.get("*", (_req, res) => {
+            res.setHeader("Cache-Control", "no-cache");
+            res.sendFile(path_1.default.join(webDist, "index.html"));
+        });
+    }
+    return app;
+}
+function isSecureRequest(req) {
+    if (req.secure)
+        return true;
+    const xfProto = String(req.headers["x-forwarded-proto"] ?? "");
+    return xfProto.toLowerCase() === "https";
+}
+function sanitizeUploadedFilename(input) {
+    const name = input.trim();
+    if (!name)
+        return null;
+    if (name.includes("/") || name.includes("\\") || name.includes("\0"))
+        return null;
+    // Only allow our generated names.
+    if (!/^(?:img|att)-\d{13}-[a-f0-9]{16}(?:\.[a-z0-9]{1,10})?$/i.test(name))
+        return null;
+    return name;
+}
+function isPathWithinRoot(root, candidate) {
+    const rel = path_1.default.relative(root, candidate);
+    if (!rel)
+        return true;
+    if (rel.startsWith(".."))
+        return false;
+    if (path_1.default.isAbsolute(rel))
+        return false;
+    return true;
+}
+function getUserUploadsDir(username) {
+    // 用户名只保留安全字符，避免目录穿越和非法文件名。
+    // Keep only safe chars in username to avoid traversal/invalid paths.
+    const safeUser = username.replace(/[^a-zA-Z0-9._-]/g, "_") || "user";
+    // 计算 Codex 工作目录和上传根目录，用于回传“是否在 Codex CWD 内”标记。
+    // Resolve Codex cwd and upload base dir to compute `withinCodexCwd`.
+    const codexCwd = path_1.default.resolve((0, env_1.getCodexCwd)());
+    const uploadBaseDir = path_1.default.resolve((0, env_1.getWebUploadBaseDir)());
+    const withinCodexCwd = isPathWithinRoot(codexCwd, uploadBaseDir);
+    // 每个用户隔离子目录，避免命名冲突。
+    // Per-user subdirectory isolation to avoid collisions.
+    const dir = path_1.default.join(uploadBaseDir, safeUser);
+    return { dir, withinCodexCwd };
+}
+function safeExtFromFilename(filename) {
+    const ext = path_1.default.extname(filename || "").toLowerCase();
+    if (!ext)
+        return "";
+    if (ext.length > 12)
+        return "";
+    if (!/^\.[a-z0-9]+$/.test(ext))
+        return "";
+    return ext;
+}
+function getWebUiVersion(webDist) {
+    const indexPath = path_1.default.join(webDist, "index.html");
+    try {
+        const stat = fs_1.default.statSync(indexPath);
+        if (!stat.isFile())
+            return null;
+        return `${Math.floor(stat.mtimeMs)}-${stat.size}`;
+    }
+    catch {
+        return null;
+    }
+}
+async function receiveAttachmentUpload(req, opts) {
+    const contentType = String(req.headers["content-type"] ?? "");
+    if (!contentType.toLowerCase().startsWith("multipart/form-data")) {
+        throw Object.assign(new Error("expected multipart/form-data"), { status: 415 });
+    }
+    const { dir, withinCodexCwd } = getUserUploadsDir(opts.username);
+    await fs_1.default.promises.mkdir(dir, { recursive: true });
+    const bb = (0, busboy_1.default)({
+        headers: req.headers,
+        limits: { files: 1, fileSize: Math.max(1, Math.floor(opts.maxBytes)) },
+    });
+    let done = false;
+    let fileFound = false;
+    let uploadError = null;
+    let localPathToCleanup = null;
+    let saved = null;
+    let writeStream = null;
+    let writePromise = null;
+    let writeReject = null;
+    const finishWrite = async () => {
+        if (!writePromise)
+            return;
+        await writePromise;
+    };
+    const abortWrite = async (err) => {
+        if (done)
+            return;
+        done = true;
+        uploadError = err;
+        if (writeReject)
+            writeReject(err);
+        try {
+            writeStream?.destroy();
+        }
+        catch {
+            // ignore
+        }
+    };
+    bb.on("file", (_fieldname, file, info) => {
+        fileFound = true;
+        const originalName = String(info?.filename ?? "attachment").trim() || "attachment";
+        const mime = String(info?.mimeType ?? info?.mimetype ?? "application/octet-stream").trim().toLowerCase();
+        const ext = safeExtFromFilename(originalName);
+        const filename = `att-${Date.now()}-${crypto_1.default.randomBytes(8).toString("hex")}${ext}`;
+        const localPath = path_1.default.join(dir, filename);
+        const apiUrl = `/api/uploads/${encodeURIComponent(filename)}`;
+        localPathToCleanup = localPath;
+        let size = 0;
+        writeStream = fs_1.default.createWriteStream(localPath, { flags: "wx" });
+        writePromise = new Promise((resolve, reject) => {
+            writeReject = reject;
+            writeStream.on("error", reject);
+            writeStream.on("finish", resolve);
+        });
+        // Avoid Node's PromiseRejectionHandledWarning when we intentionally reject early (e.g. size limit).
+        writePromise.catch(() => { });
+        file.on("data", (chunk) => {
+            size += Buffer.byteLength(chunk);
+        });
+        file.on("limit", () => {
+            file.unpipe(writeStream);
+            file.resume();
+            void abortWrite(Object.assign(new Error("file too large"), { status: 413 }));
+        });
+        file.on("error", (err) => {
+            void abortWrite(err);
+        });
+        file.on("end", () => {
+            if (file.truncated) {
+                void abortWrite(Object.assign(new Error("file too large"), { status: 413 }));
+                return;
+            }
+            saved = { filename, originalName, mime, size, localPath, apiUrl };
+        });
+        file.pipe(writeStream);
+    });
+    try {
+        const result = await new Promise((resolve, reject) => {
+            bb.on("error", reject);
+            bb.on("finish", () => resolve(saved));
+            req.pipe(bb);
+        });
+        await finishWrite();
+        if (uploadError)
+            throw uploadError;
+        if (!fileFound || !result) {
+            throw Object.assign(new Error("no file uploaded"), { status: 400 });
+        }
+        if (result.size <= 0) {
+            throw Object.assign(new Error("empty upload"), { status: 400 });
+        }
+        localPathToCleanup = null;
+        return { ...result, withinCodexCwd };
+    }
+    catch (err) {
+        if (localPathToCleanup) {
+            try {
+                await fs_1.default.promises.unlink(localPathToCleanup);
+            }
+            catch {
+                // ignore
+            }
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=app.js.map