@xcanwin/manyoyo 5.7.2 → 5.7.3

package/lib/web/frontend/app.css

@@ -783,8 +783,8 @@ body.mobile-actions-open .header-actions {
     color: var(--muted);
     font-size: 12px;
     font-weight: 700;
-    text-transform: uppercase;
-    letter-spacing: 0.3px;
+    text-transform: none;
+    letter-spacing: 0.1px;
     line-height: 1.45;
     overflow-wrap: anywhere;
 }

package/lib/web/frontend/app.html

@@ -126,7 +126,7 @@
         <div id="configModal" class="modal-backdrop" hidden>
             <section class="modal" role="dialog" aria-modal="true" aria-labelledby="configModalTitle">
                 <header class="modal-header">
-                    <h2 id="configModalTitle">编辑配置 (~/.manyoyo/manyoyo.json)</h2>
+                    <h2 id="configModalTitle">查看配置摘要 (~/.manyoyo/manyoyo.json)</h2>
                     <button type="button" id="configCancelBtn" class="secondary">关闭</button>
                 </header>
                 <div class="modal-body">
@@ -136,7 +136,7 @@
                 </div>
                 <footer class="modal-footer">
                     <button type="button" id="configReloadBtn" class="secondary">重新加载</button>
-                    <button type="button" id="configSaveBtn">保存</button>
+                    <button type="button" id="configSaveBtn">只读</button>
                 </footer>
             </section>
         </div>

package/lib/web/frontend/app.js

@@ -104,6 +104,7 @@
     const openConfigBtn = document.getElementById('openConfigBtn');
     const openCreateBtn = document.getElementById('openCreateBtn');
     const configModal = document.getElementById('configModal');
+    const configModalTitle = document.getElementById('configModalTitle');
     const configPath = document.getElementById('configPath');
     const configEditor = document.getElementById('configEditor');
     const configError = document.getElementById('configError');
@@ -621,9 +622,10 @@
         createAgentPromptCommand.value = value.agentPromptCommand || '';
         state.createAgentPromptAuto = false;
         createYolo.value = value.yolo || '';
-        createEnv.value = envMapToText(value.env);
-        createEnvFile.value = Array.isArray(value.envFile) ? value.envFile.join('\n') : '';
-        createVolumes.value = Array.isArray(value.volumes) ? value.volumes.join('\n') : '';
+        // 敏感 env 与继承数组由服务端在创建时合并，前端表单默认不回显，避免泄露或重复提交。
+        createEnv.value = '';
+        createEnvFile.value = '';
+        createVolumes.value = '';
         updateCreateAgentPromptCommandFromCommand();
     }
 
@@ -1236,9 +1238,9 @@
     function renderSessionDetailPanels() {
         const detail = state.sessionDetail;
         if (!state.active) {
-            renderEmptyInspector(detailSummary, '详情视图', '选择左侧会话后，这里会显示会话概览、Agent 状态与运行参数。');
-            renderEmptyInspector(configSummary, '配置视图', '选择会话后可查看当前容器会话的运行参数摘要。');
-            renderEmptyInspector(checkSummary, '检查视图', '选择会话后可查看当前会话的基础健康检查。');
+            renderEmptyInspector(detailSummary, '详情视图', '选择左侧会话后，这里会显示会话概览、Agent 运行状态与最近活动。');
+            renderEmptyInspector(configSummary, '配置视图', '选择会话后可查看当前容器会话的生效配置摘要。');
+            renderEmptyInspector(checkSummary, '检查视图', '选择会话后可查看当前会话的诊断结论与最近问题。');
             return;
         }
         if (state.loadingSessionDetail) {
@@ -1258,6 +1260,51 @@
         const applied = detail.applied || {};
         const status = sessionStatusInfo(detail.status);
         const updatedText = formatDateTime(detail.updatedAt) || '暂无更新';
+        const lastResumeText = detail.lastResumeAt ? formatDateTime(detail.lastResumeAt) : '暂无';
+        const latestTimestampText = detail.latestTimestamp ? formatDateTime(detail.latestTimestamp) : '暂无';
+        const latestRoleMap = {
+            user: '我',
+            assistant: 'Agent',
+            system: '系统'
+        };
+        const latestRoleLabel = latestRoleMap[String(detail.latestRole || '').toLowerCase()] || (detail.latestRole || '暂无');
+        const imageVersionValid = /^\d+\.\d+\.\d+-[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(String(applied.imageVersion || ''));
+        let resumeStatusValue = '未执行';
+        let resumeStatusTone = 'warn';
+        let resumeStatusDetail = detail.resumeSupported
+            ? '支持 resume，但当前会话还没有最近一次执行记录。'
+            : '当前 Agent 程序或模板不支持 resume。';
+        if (detail.lastResumeOk === true) {
+            resumeStatusValue = '最近成功';
+            resumeStatusTone = 'ok';
+            resumeStatusDetail = `最近一次 resume 成功，时间：${lastResumeText}。`;
+        } else if (detail.lastResumeOk === false) {
+            resumeStatusValue = '最近失败';
+            resumeStatusTone = 'danger';
+            resumeStatusDetail = detail.lastResumeError
+                ? `最近一次 resume 失败：${detail.lastResumeError}`
+                : `最近一次 resume 失败，时间：${lastResumeText}。`;
+        } else if (!detail.resumeSupported) {
+            resumeStatusValue = '不支持';
+        }
+
+        const commandEntries = [];
+        if (applied.shellPrefix) {
+            commandEntries.push({ label: 'shellPrefix', value: applied.shellPrefix });
+        }
+        if (applied.shell) {
+            commandEntries.push({ label: 'shell', value: applied.shell });
+        }
+        if (applied.shellSuffix) {
+            commandEntries.push({ label: 'shellSuffix', value: applied.shellSuffix });
+        }
+        if (applied.defaultCommand && applied.defaultCommand !== applied.shell) {
+            commandEntries.push({ label: '启动命令', value: applied.defaultCommand });
+        } else if (!applied.shell) {
+            commandEntries.push({ label: '启动命令', value: applied.defaultCommand || '—' });
+        }
+        commandEntries.push({ label: 'Agent 模板', value: detail.agentPromptCommand || '—' });
+        commandEntries.push({ label: 'yolo', value: applied.yolo || '—' });
 
         if (detailSummary) {
             detailSummary.innerHTML = '';
@@ -1268,45 +1315,41 @@
                 { label: '最近更新', value: updatedText },
                 { label: '消息数', value: String(safeMessageCount(detail.messageCount)) }
             ]);
-            renderKeyValueCard(detailSummary, 'Agent 上下文', [
+            renderKeyValueCard(detailSummary, 'Agent 运行', [
                 { label: '已启用', value: detail.agentEnabled ? '是' : '否', tone: detail.agentEnabled ? 'ok' : 'warn' },
                 { label: '程序', value: detail.agentProgram || '—' },
                 { label: '支持 resume', value: detail.resumeSupported ? '是' : '否', tone: detail.resumeSupported ? 'ok' : 'warn' },
-                { label: '最近 resume', value: detail.lastResumeAt ? formatDateTime(detail.lastResumeAt) : '暂无' },
+                { label: '最近 resume', value: lastResumeText },
                 { label: '最近结果', value: detail.lastResumeOk == null ? '暂无' : (detail.lastResumeOk ? '成功' : '失败'), tone: detail.lastResumeOk == null ? 'info' : (detail.lastResumeOk ? 'ok' : 'danger') }
             ]);
-            renderKeyValueCard(detailSummary, '运行参数', [
-                { label: 'hostPath', value: applied.hostPath || '—' },
-                { label: 'containerPath', value: applied.containerPath || '—' },
-                { label: 'imageVersion', value: applied.imageVersion || '—' },
-                { label: 'containerMode', value: applied.containerMode || 'default' },
-                { label: 'env/vol/ports', value: `${applied.envCount || 0} / ${applied.volumeCount || 0} / ${applied.portCount || 0}` }
+            renderKeyValueCard(detailSummary, '最近活动', [
+                { label: '最近角色', value: latestRoleLabel },
+                { label: '最近时间', value: latestTimestampText },
+                { label: 'resume 状态', value: resumeStatusValue, tone: resumeStatusTone }
             ]);
         }
 
         if (configSummary) {
             configSummary.innerHTML = '';
-            renderKeyValueCard(configSummary, '配置摘要', [
+            renderKeyValueCard(configSummary, '基础配置', [
                 { label: 'containerName', value: applied.containerName || detail.name || state.active },
-                { label: 'hostPath', value: applied.hostPath || '—' },
-                { label: 'containerPath', value: applied.containerPath || '—' },
                 { label: 'imageName', value: applied.imageName || detail.image || '—' },
                 { label: 'imageVersion', value: applied.imageVersion || '—' },
                 { label: 'containerMode', value: applied.containerMode || 'default' }
-            ], { actionLabel: '打开配置', actionId: 'configSummaryOpenBtn' });
-            renderKeyValueCard(configSummary, '命令与 Agent', [
-                { label: 'shellPrefix', value: applied.shellPrefix || '—' },
-                { label: 'shell', value: applied.shell || '—' },
-                { label: 'shellSuffix', value: applied.shellSuffix || '—' },
-                { label: '默认命令', value: applied.defaultCommand || '—' },
-                { label: 'Agent 模板', value: detail.agentPromptCommand || '—' },
-                { label: 'yolo', value: applied.yolo || '—' }
             ]);
+            renderKeyValueCard(configSummary, '路径与资源', [
+                { label: 'hostPath', value: applied.hostPath || '—' },
+                { label: 'containerPath', value: applied.containerPath || '—' },
+                { label: 'env 数量', value: String(applied.envCount || 0) },
+                { label: 'volume 数量', value: String(applied.volumeCount || 0) },
+                { label: 'port 数量', value: String(applied.portCount || 0) }
+            ]);
+            renderKeyValueCard(configSummary, '命令与 Agent', commandEntries);
         }
 
         if (checkSummary) {
             checkSummary.innerHTML = '';
-            renderCheckCard(checkSummary, '基础检查', [
+            renderCheckCard(checkSummary, '运行检查', [
                 {
                     label: '容器状态',
                     value: status.label,
@@ -1314,28 +1357,32 @@
                     detail: status.tone === 'running' ? '容器处于可交互状态。' : '当前不是活跃运行态，部分功能可能受限。'
                 },
                 {
-                    label: 'Agent 模板',
+                    label: 'Agent 输入',
                     value: detail.agentEnabled ? '已配置' : '未配置',
                     tone: detail.agentEnabled ? 'ok' : 'warn',
                     detail: detail.agentEnabled ? '活动页可直接发送 Agent 提示词。' : '当前会话不支持 Agent 模式。'
                 },
                 {
-                    label: 'Resume 能力',
-                    value: detail.resumeSupported ? '支持' : '不支持',
-                    tone: detail.resumeSupported ? 'ok' : 'warn',
-                    detail: detail.resumeSupported ? '可以尝试基于历史继续 Agent 会话。' : '当前 Agent 程序或模板不支持 resume。'
+                    label: 'Resume 健康',
+                    value: resumeStatusValue,
+                    tone: resumeStatusTone,
+                    detail: resumeStatusDetail
                 },
                 {
-                    label: '镜像版本格式',
-                    value: applied.imageVersion || '缺失',
-                    tone: /^\d+\.\d+\.\d+-[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(String(applied.imageVersion || '')) ? 'ok' : 'danger',
-                    detail: '建议保持 x.y.z-后缀 格式，便于 manyoyo 的版本校验。'
+                    label: '镜像版本',
+                    value: imageVersionValid ? '格式正常' : '格式异常',
+                    tone: imageVersionValid ? 'ok' : 'danger',
+                    detail: applied.imageVersion
+                        ? `当前值：${applied.imageVersion}。建议保持 x.y.z-后缀 格式，便于 manyoyo 的版本校验。`
+                        : '缺少 imageVersion，manyoyo 的版本校验会失效。'
                 },
                 {
-                    label: '工作目录',
-                    value: applied.hostPath && applied.containerPath ? '完整' : '缺失',
+                    label: '工作目录映射',
+                    value: applied.hostPath && applied.containerPath ? '已配置' : '缺失',
                     tone: applied.hostPath && applied.containerPath ? 'ok' : 'danger',
-                    detail: 'hostPath / containerPath 是容器会话最关键的上下文。'
+                    detail: applied.hostPath && applied.containerPath
+                        ? '宿主目录与容器目录都已配置。'
+                        : 'hostPath / containerPath 是容器会话最关键的上下文。'
                 }
             ]);
             if (detail.lastResumeError) {
@@ -1349,13 +1396,6 @@
                 ]);
             }
         }
-
-        const configSummaryOpenBtn = document.getElementById('configSummaryOpenBtn');
-        if (configSummaryOpenBtn) {
-            configSummaryOpenBtn.addEventListener('click', function () {
-                openConfigModal();
-            });
-        }
     }
 
     function syncUi() {
@@ -1444,7 +1484,7 @@
             openConfigBtn.disabled = state.configLoading || state.configSaving;
         }
         if (configSaveBtn) {
-            configSaveBtn.disabled = state.configLoading || state.configSaving;
+            configSaveBtn.disabled = true;
         }
         if (configReloadBtn) {
             configReloadBtn.disabled = state.configLoading || state.configSaving;
@@ -1612,11 +1652,22 @@
         syncUi();
         try {
             const config = await fetchConfigSnapshot();
+            if (configModalTitle) {
+                configModalTitle.textContent = '查看配置摘要 (~/.manyoyo/manyoyo.json)';
+            }
             if (configPath) {
-                configPath.textContent = config.path || '';
+                const lines = [config.path || ''];
+                if (config.notice) {
+                    lines.push(config.notice);
+                }
+                configPath.textContent = lines.filter(Boolean).join('\n');
             }
             if (configEditor) {
-                configEditor.value = typeof config.raw === 'string' ? config.raw : '';
+                configEditor.readOnly = true;
+                configEditor.value = stringifyPrettyJson({
+                    defaults: config.defaults || {},
+                    runs: config.parsed && config.parsed.runs ? config.parsed.runs : {}
+                });
             }
             if (config.parseError) {
                 showConfigError('当前文件存在解析错误：' + config.parseError);
@@ -1637,23 +1688,7 @@
     }
 
     async function saveConfig() {
-        state.configSaving = true;
-        showConfigError('');
-        syncUi();
-        try {
-            await api('/api/config', {
-                method: 'PUT',
-                body: JSON.stringify({ raw: configEditor ? configEditor.value : '' })
-            });
-            await fetchConfigSnapshot();
-            showConfigError('');
-            alert('配置已保存。后续新建会读取最新配置。');
-        } catch (e) {
-            showConfigError(e.message);
-        } finally {
-            state.configSaving = false;
-            syncUi();
-        }
+        alert('Web 端已禁用明文配置编辑，请在本地 ~/.manyoyo/manyoyo.json 中维护敏感配置。');
     }
 
     async function openCreateModal() {

package/lib/web/server.js

@@ -32,6 +32,8 @@ const WEB_AUTH_TTL_SECONDS = 12 * 60 * 60;
 const FRONTEND_DIR = path.join(__dirname, 'frontend');
 const SAFE_CONTAINER_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
 const IMAGE_VERSION_TAG_PATTERN = /^(\d+\.\d+\.\d+)-([A-Za-z0-9][A-Za-z0-9_.-]*)$/;
+const SENSITIVE_CONFIG_KEY_PATTERN = /(pass(word)?|passwd|secret|token|api(?:_|-)?key|auth(?:_|-)?token|oauth(?:_|-)?token)$/i;
+const REDACTED_CONFIG_VALUE = '***';
 
 const YOLO_COMMAND_MAP = {
     claude: 'IS_SANDBOX=1 claude --dangerously-skip-permissions',
@@ -1300,6 +1302,59 @@ function toPlainObject(value) {
     return value;
 }
 
+function isSensitiveConfigKey(key) {
+    const normalized = String(key || '').trim();
+    return Boolean(normalized) && SENSITIVE_CONFIG_KEY_PATTERN.test(normalized);
+}
+
+function redactConfigValue(value) {
+    if (Array.isArray(value)) {
+        return value.map(item => redactConfigValue(item));
+    }
+    if (!value || typeof value !== 'object') {
+        return REDACTED_CONFIG_VALUE;
+    }
+    return redactConfigObject(value);
+}
+
+function redactConfigObject(value) {
+    if (Array.isArray(value)) {
+        return value.map(item => redactConfigValue(item));
+    }
+    if (!value || typeof value !== 'object') {
+        return value;
+    }
+    const result = {};
+    Object.entries(toPlainObject(value)).forEach(([key, item]) => {
+        if (isSensitiveConfigKey(key)) {
+            result[key] = redactConfigValue(item);
+            return;
+        }
+        if (Array.isArray(item)) {
+            result[key] = item.map(entry => redactConfigValue(entry));
+            return;
+        }
+        if (item && typeof item === 'object') {
+            result[key] = redactConfigObject(item);
+            return;
+        }
+        result[key] = item;
+    });
+    return result;
+}
+
+function buildSafeWebConfigSnapshot(snapshot, ctx) {
+    const parsed = snapshot && snapshot.parseError ? {} : toPlainObject(snapshot && snapshot.parsed);
+    return {
+        path: snapshot && snapshot.path ? snapshot.path : path.resolve(getDefaultWebConfigPath()),
+        parsed: redactConfigObject(parsed),
+        defaults: redactConfigObject(buildConfigDefaults(ctx, parsed)),
+        parseError: snapshot && snapshot.parseError ? snapshot.parseError : null,
+        editable: false,
+        notice: 'Web 端仅显示脱敏后的配置摘要；敏感值请在本地 manyoyo.json 中维护。'
+    };
+}
+
 function pickFirstString() {
     for (let i = 0; i < arguments.length; i += 1) {
         const value = arguments[i];
@@ -1705,23 +1760,29 @@ function buildCreateRuntime(ctx, state, payload) {
     const hasConfigPorts = hasOwn(config, 'ports');
 
     const requestName = pickFirstString(requestOptions.containerName, body.name);
-    let containerName = pickFirstString(requestName, config.containerName);
+    let containerName = pickFirstString(requestName, runConfig.containerName, config.containerName);
     if (!containerName) {
         containerName = `my-${ctx.formatDate()}`;
     }
     containerName = resolveNowTemplate(containerName, ctx.formatDate);
     validateContainerNameStrict(containerName);
 
-    const hostPath = pickFirstString(requestOptions.hostPath, config.hostPath, ctx.hostPath);
+    const hostPath = pickFirstString(requestOptions.hostPath, runConfig.hostPath, config.hostPath, ctx.hostPath);
     if (typeof ctx.validateHostPath === 'function') {
         ctx.validateHostPath(hostPath);
     } else {
         validateWebHostPath(hostPath);
     }
 
-    const containerPath = pickFirstString(requestOptions.containerPath, config.containerPath, ctx.containerPath, hostPath) || hostPath;
-    const imageName = pickFirstString(requestOptions.imageName, config.imageName, ctx.imageName);
-    const imageVersion = pickFirstString(requestOptions.imageVersion, config.imageVersion, ctx.imageVersion);
+    const containerPath = pickFirstString(
+        requestOptions.containerPath,
+        runConfig.containerPath,
+        config.containerPath,
+        ctx.containerPath,
+        hostPath
+    ) || hostPath;
+    const imageName = pickFirstString(requestOptions.imageName, runConfig.imageName, config.imageName, ctx.imageName);
+    const imageVersion = pickFirstString(requestOptions.imageVersion, runConfig.imageVersion, config.imageVersion, ctx.imageVersion);
 
     if (!/^[A-Za-z0-9][A-Za-z0-9._/:-]*$/.test(imageName)) {
         throw new Error(`imageName 非法: ${imageName}`);
@@ -1730,7 +1791,7 @@ function buildCreateRuntime(ctx, state, payload) {
 
     let contModeArgs = Array.isArray(ctx.contModeArgs) ? ctx.contModeArgs.slice() : [];
     let containerMode = '';
-    const modeValue = pickFirstString(requestOptions.containerMode, config.containerMode);
+    const modeValue = pickFirstString(requestOptions.containerMode, runConfig.containerMode, config.containerMode);
     if (modeValue) {
         const mode = resolveContainerModeArgs(modeValue);
         containerMode = mode.mode;
@@ -1739,16 +1800,24 @@ function buildCreateRuntime(ctx, state, payload) {
 
     const shellPrefix = hasOwn(requestOptions, 'shellPrefix')
         ? String(requestOptions.shellPrefix || '')
-        : (hasOwn(config, 'shellPrefix') ? String(config.shellPrefix || '') : String(ctx.execCommandPrefix || ''));
+        : (hasOwn(runConfig, 'shellPrefix')
+            ? String(runConfig.shellPrefix || '')
+            : (hasOwn(config, 'shellPrefix') ? String(config.shellPrefix || '') : String(ctx.execCommandPrefix || '')));
     let shell = hasOwn(requestOptions, 'shell')
         ? String(requestOptions.shell || '')
-        : (hasOwn(config, 'shell') ? String(config.shell || '') : String(ctx.execCommand || ''));
+        : (hasOwn(runConfig, 'shell')
+            ? String(runConfig.shell || '')
+            : (hasOwn(config, 'shell') ? String(config.shell || '') : String(ctx.execCommand || '')));
     const shellSuffix = hasOwn(requestOptions, 'shellSuffix')
         ? String(requestOptions.shellSuffix || '')
-        : (hasOwn(config, 'shellSuffix') ? String(config.shellSuffix || '') : String(ctx.execCommandSuffix || ''));
+        : (hasOwn(runConfig, 'shellSuffix')
+            ? String(runConfig.shellSuffix || '')
+            : (hasOwn(config, 'shellSuffix') ? String(config.shellSuffix || '') : String(ctx.execCommandSuffix || '')));
     const yolo = hasOwn(requestOptions, 'yolo')
         ? String(requestOptions.yolo || '')
-        : (hasOwn(config, 'yolo') ? String(config.yolo || '') : '');
+        : (hasOwn(runConfig, 'yolo')
+            ? String(runConfig.yolo || '')
+            : (hasOwn(config, 'yolo') ? String(config.yolo || '') : ''));
     const yoloCommand = resolveYoloCommand(yolo);
     if (yoloCommand) {
         shell = yoloCommand;
@@ -1769,19 +1838,23 @@ function buildCreateRuntime(ctx, state, payload) {
     const resumeSupported = Boolean(buildAgentResumeCommand(agentProgram));
 
     let containerEnvs = Array.isArray(ctx.containerEnvs) ? ctx.containerEnvs.slice() : [];
-    if (hasRequestEnv || hasRequestEnvFile || hasConfigEnv || hasConfigEnvFile) {
+    const hasRunEnv = hasOwn(runConfig, 'env');
+    const hasRunEnvFile = hasOwn(runConfig, 'envFile');
+    if (hasRequestEnv || hasRequestEnvFile || hasRunEnv || hasRunEnvFile || hasConfigEnv || hasConfigEnvFile) {
         const configEnv = normalizeEnvMap(config.env, 'config.env');
+        const runEnv = normalizeEnvMap(runConfig.env, runName ? `runs.${runName}.env` : 'run.env');
         const requestEnv = hasRequestEnv ? normalizeEnvMap(requestOptions.env, 'createOptions.env') : {};
-        const mergedEnv = { ...configEnv, ...requestEnv };
+        const mergedEnv = { ...configEnv, ...runEnv, ...requestEnv };
         const envArgs = [];
         Object.entries(mergedEnv).forEach(([key, value]) => {
             const parsed = parseEnvEntry(`${key}=${value}`);
             envArgs.push('--env', `${parsed.key}=${parsed.value}`);
         });
 
-        const envFileList = hasRequestEnvFile
-            ? normalizeStringArray(requestOptions.envFile, 'createOptions.envFile')
-            : normalizeStringArray(config.envFile, 'config.envFile');
+        const envFileList = []
+            .concat(normalizeStringArray(config.envFile, 'config.envFile'))
+            .concat(normalizeStringArray(runConfig.envFile, runName ? `runs.${runName}.envFile` : 'run.envFile'))
+            .concat(hasRequestEnvFile ? normalizeStringArray(requestOptions.envFile, 'createOptions.envFile') : []);
         const envFileArgs = [];
         envFileList.forEach(filePath => {
             envFileArgs.push(...parseEnvFileToArgs(filePath));
@@ -1791,10 +1864,12 @@ function buildCreateRuntime(ctx, state, payload) {
     }
 
     let containerVolumes = Array.isArray(ctx.containerVolumes) ? ctx.containerVolumes.slice() : [];
-    if (hasRequestVolumes || hasConfigVolumes) {
-        const volumeList = hasRequestVolumes
-            ? normalizeStringArray(requestOptions.volumes, 'createOptions.volumes')
-            : normalizeStringArray(config.volumes, 'config.volumes');
+    const hasRunVolumes = hasOwn(runConfig, 'volumes');
+    if (hasRequestVolumes || hasRunVolumes || hasConfigVolumes) {
+        const volumeList = []
+            .concat(normalizeStringArray(config.volumes, 'config.volumes'))
+            .concat(normalizeStringArray(runConfig.volumes, runName ? `runs.${runName}.volumes` : 'run.volumes'))
+            .concat(hasRequestVolumes ? normalizeStringArray(requestOptions.volumes, 'createOptions.volumes') : []);
         containerVolumes = [];
         volumeList.forEach(volume => {
             containerVolumes.push('--volume', normalizeVolume(volume));
@@ -1802,10 +1877,12 @@ function buildCreateRuntime(ctx, state, payload) {
     }
 
     let containerPorts = Array.isArray(ctx.containerPorts) ? ctx.containerPorts.slice() : [];
-    if (hasRequestPorts || hasConfigPorts) {
-        const portList = hasRequestPorts
-            ? normalizeStringArray(requestOptions.ports, 'createOptions.ports')
-            : normalizeStringArray(config.ports, 'config.ports');
+    const hasRunPorts = hasOwn(runConfig, 'ports');
+    if (hasRequestPorts || hasRunPorts || hasConfigPorts) {
+        const portList = []
+            .concat(normalizeStringArray(config.ports, 'config.ports'))
+            .concat(normalizeStringArray(runConfig.ports, runName ? `runs.${runName}.ports` : 'run.ports'))
+            .concat(hasRequestPorts ? normalizeStringArray(requestOptions.ports, 'createOptions.ports') : []);
         containerPorts = [];
         portList.forEach(port => {
             containerPorts.push('--publish', port);
@@ -2216,6 +2293,15 @@ function sendHtml(res, statusCode, html, extraHeaders = {}) {
     res.end(html);
 }
 
+function sendRedirect(res, statusCode, location, extraHeaders = {}) {
+    res.writeHead(statusCode, {
+        Location: location,
+        'Cache-Control': 'no-store',
+        ...extraHeaders
+    });
+    res.end('');
+}
+
 function decodeSessionName(encoded) {
     try {
         return decodeURIComponent(encoded);
@@ -2563,6 +2649,12 @@ function bindTerminalWebSocket(ctx, state, ws, containerName, cols, rows) {
 }
 
 async function handleWebAuthRoutes(req, res, pathname, ctx, state) {
+    if (req.method === 'GET' && pathname === '/favicon.ico') {
+        res.writeHead(204, { 'Cache-Control': 'no-store' });
+        res.end();
+        return true;
+    }
+
     if (req.method === 'GET' && pathname === '/auth/login') {
         sendHtml(res, 200, loadTemplate('login.html'));
         return true;
@@ -2625,6 +2717,10 @@ function sendWebUnauthorized(res, pathname) {
         sendJson(res, 401, { error: 'UNAUTHORIZED' });
         return;
     }
+    if (pathname === '/' || pathname === '') {
+        sendRedirect(res, 302, '/auth/login', { 'Set-Cookie': getWebAuthClearCookie() });
+        return;
+    }
     sendHtml(
         res,
         401,
@@ -2648,14 +2744,7 @@ async function handleWebApi(req, res, pathname, ctx, state) {
             match: currentPath => currentPath === '/api/config' ? [] : null,
             handler: async () => {
                 const snapshot = readWebConfigSnapshot(state.webConfigPath);
-                const defaults = buildConfigDefaults(ctx, snapshot.parseError ? {} : snapshot.parsed);
-                sendJson(res, 200, {
-                    path: snapshot.path,
-                    raw: snapshot.raw,
-                    parsed: snapshot.parseError ? null : snapshot.parsed,
-                    parseError: snapshot.parseError,
-                    defaults
-                });
+                sendJson(res, 200, buildSafeWebConfigSnapshot(snapshot, ctx));
             }
         },
         {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@xcanwin/manyoyo",
-    "version": "5.7.2",
+    "version": "5.7.3",
     "imageVersion": "1.9.0-common",
     "playwrightCliVersion": "0.1.1",
     "description": "AI Agent CLI Security Sandbox for Docker and Podman",