@xcanwin/manyoyo 6.2.5 → 6.2.7

package/lib/web/server.js

@@ -45,6 +45,16 @@ const WEB_AGENT_CONTEXT_PER_MESSAGE_MAX_CHARS = 600;
 const NATIVE_SESSION_RESUME_PROGRAMS = new Set(['claude', 'codex', 'opencode']);
 const WEB_FILE_PREVIEW_MAX_BYTES = 512 * 1024;
 const WEB_FILE_EDIT_MAX_BYTES = 2 * 1024 * 1024;
+const WEB_FILE_RAW_MAX_CONCURRENT_PER_CONTAINER = 4;
+const IMAGE_EXTENSION_CONTENT_TYPES = {
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.bmp': 'image/bmp',
+    '.ico': 'image/x-icon'
+};
 const WEB_AUTH_COOKIE_NAME = 'manyoyo_web_auth';
 const WEB_AUTH_TTL_SECONDS = 12 * 60 * 60;
 const WEB_SESSION_KEY_SEPARATOR = '~';
@@ -157,11 +167,21 @@ function normalizeWebAgentName(agentId, agentName) {
     return String(agentId || '').trim() || WEB_DEFAULT_AGENT_NAME;
 }
 
+const WEB_REMARK_MAX_LENGTH = 200;
+
+function normalizeRemarkText(value) {
+    if (typeof value !== 'string') {
+        return '';
+    }
+    return value.trim().slice(0, WEB_REMARK_MAX_LENGTH);
+}
+
 function createEmptyWebAgentSession(agentId, agentName) {
     return {
         agentId,
         agentName: normalizeWebAgentName(agentId, agentName),
         agentPromptCommand: '',
+        remark: '',
         createdAt: null,
         updatedAt: null,
         messages: [],
@@ -181,6 +201,7 @@ function normalizeWebAgentSessionRecord(agentId, rawAgent) {
         agentPromptCommand: typeof source.agentPromptCommand === 'string'
             ? normalizeAgentPromptCommandTemplate(source.agentPromptCommand, `agents.${agentId}.agentPromptCommand`)
             : '',
+        remark: normalizeRemarkText(source.remark),
         createdAt: typeof source.createdAt === 'string' ? source.createdAt : null,
         updatedAt: typeof source.updatedAt === 'string' ? source.updatedAt : null,
         messages: Array.isArray(source.messages) ? source.messages : [],
@@ -244,6 +265,9 @@ function normalizeWebHistoryRecord(containerName, rawData) {
     const applied = data.applied && typeof data.applied === 'object' && !Array.isArray(data.applied)
         ? data.applied
         : null;
+    const runtimeSnapshot = data.runtimeSnapshot && typeof data.runtimeSnapshot === 'object' && !Array.isArray(data.runtimeSnapshot)
+        ? data.runtimeSnapshot
+        : null;
     const history = {
         containerName,
         updatedAt: typeof data.updatedAt === 'string' ? data.updatedAt : null,
@@ -251,7 +275,10 @@ function normalizeWebHistoryRecord(containerName, rawData) {
             typeof data.agentPromptCommand === 'string' ? data.agentPromptCommand : '',
             applied
         ),
+        remark: normalizeRemarkText(data.remark),
         applied,
+        // 服务端内部字段，绝不能被 buildSessionSummary/buildSessionDetail/buildSessionAudit 引用或透传给前端。
+        runtimeSnapshot,
         agents: {}
     };
 
@@ -2547,6 +2574,24 @@ function buildCreateRuntime(ctx, state, payload) {
         containerPorts,
         agentPromptCommand,
         defaultCommand: buildDefaultCommand(shellPrefix, shell, shellSuffix) || '/bin/bash',
+        // 仅供服务端内部复用（如"创建相同配置容器"/"复制容器"），绝不能透传给任何对外响应字段，
+        // 因为 env/volumes/ports 可能包含密钥原始值（对外响应向来只暴露 envCount 等计数）。
+        runtimeSnapshot: {
+            hostPath,
+            containerPath,
+            imageName,
+            imageVersion,
+            containerMode,
+            shellPrefix: shellPrefix || '',
+            shell: shell || '',
+            shellSuffix: shellSuffix || '',
+            agentPromptCommand: configuredAgentPromptCommand,
+            yolo: yolo || '',
+            env: resolvedBase.env || {},
+            envFile: resolvedBase.envFile || [],
+            volumes: resolvedBase.volumes || [],
+            ports: resolvedBase.ports || []
+        },
         applied: {
             containerName,
             hostPath,
@@ -2569,6 +2614,138 @@ function buildCreateRuntime(ctx, state, payload) {
     };
 }
 
+function resolveUniqueContainerName(ctx, state, baseName) {
+    const containerMap = listWebManyoyoContainers(ctx);
+    const historyNames = listWebHistorySessionNames(state.webHistoryDir, ctx.isValidContainerName);
+    const taken = new Set([...Object.keys(containerMap), ...historyNames]);
+    // 基于历史最大编号 +1 命名，即使较小编号的副本被删除也不回收其编号，
+    // 避免"删除 -copy1 后新副本又叫 -copy1"造成的名称语义混乱。
+    const escapedBase = baseName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const pattern = new RegExp(`^${escapedBase}-copy(\\d+)$`);
+    let maxN = 0;
+    taken.forEach(name => {
+        const matched = name.match(pattern);
+        if (matched) {
+            const n = Number(matched[1]);
+            if (Number.isFinite(n) && n > maxN) {
+                maxN = n;
+            }
+        }
+    });
+    return `${baseName}-copy${maxN + 1}`;
+}
+
+function buildCloneCreateOptionsFromSnapshot(runtimeSnapshot, fallbackHistory) {
+    if (runtimeSnapshot && typeof runtimeSnapshot === 'object') {
+        return {
+            hostPath: runtimeSnapshot.hostPath || '',
+            containerPath: runtimeSnapshot.containerPath || '',
+            imageName: runtimeSnapshot.imageName || '',
+            imageVersion: runtimeSnapshot.imageVersion || '',
+            containerMode: runtimeSnapshot.containerMode || '',
+            shellPrefix: runtimeSnapshot.shellPrefix || '',
+            shell: runtimeSnapshot.shell || '',
+            shellSuffix: runtimeSnapshot.shellSuffix || '',
+            agentPromptCommand: runtimeSnapshot.agentPromptCommand || '',
+            yolo: runtimeSnapshot.yolo || '',
+            env: runtimeSnapshot.env || {},
+            envFile: runtimeSnapshot.envFile || [],
+            volumes: runtimeSnapshot.volumes || [],
+            ports: runtimeSnapshot.ports || []
+        };
+    }
+
+    const applied = fallbackHistory && fallbackHistory.applied && typeof fallbackHistory.applied === 'object'
+        ? fallbackHistory.applied
+        : {};
+    return {
+        hostPath: applied.hostPath || '',
+        containerPath: applied.containerPath || '',
+        imageName: applied.imageName || '',
+        imageVersion: applied.imageVersion || '',
+        containerMode: applied.containerMode || '',
+        shellPrefix: applied.shellPrefix || '',
+        shell: applied.shell || '',
+        shellSuffix: applied.shellSuffix || '',
+        agentPromptCommand: typeof fallbackHistory.agentPromptCommand === 'string' ? fallbackHistory.agentPromptCommand : '',
+        yolo: applied.yolo || '',
+        env: {},
+        envFile: [],
+        volumes: [],
+        ports: []
+    };
+}
+
+function cloneWebAgentSessionsDeep(sourceHistory) {
+    const cloned = {};
+    const agents = sourceHistory && sourceHistory.agents && typeof sourceHistory.agents === 'object'
+        ? sourceHistory.agents
+        : {};
+    Object.keys(agents).forEach(agentId => {
+        cloned[agentId] = JSON.parse(JSON.stringify(agents[agentId]));
+    });
+    return cloned;
+}
+
+async function createClonedContainer(ctx, state, sourceContainerName, requestedName, options = {}) {
+    const copyHistory = options.copyHistory === true;
+    const history = loadWebSessionHistory(state.webHistoryDir, sourceContainerName);
+    const cloneFidelity = history.runtimeSnapshot ? 'full' : 'partial';
+    const createOptions = buildCloneCreateOptionsFromSnapshot(history.runtimeSnapshot, history);
+
+    let finalName = '';
+    if (requestedName) {
+        validateContainerNameStrict(requestedName);
+        const containerMap = listWebManyoyoContainers(ctx);
+        const historyNames = listWebHistorySessionNames(state.webHistoryDir, ctx.isValidContainerName);
+        const taken = new Set([...Object.keys(containerMap), ...historyNames]);
+        if (taken.has(requestedName)) {
+            const err = new Error(`容器名已存在: ${requestedName}`);
+            err.statusCode = 409;
+            throw err;
+        }
+        finalName = requestedName;
+    } else {
+        finalName = resolveUniqueContainerName(ctx, state, sourceContainerName);
+    }
+
+    createOptions.containerName = finalName;
+    const runtime = buildCreateRuntime(ctx, state, { createOptions });
+    await ensureWebContainer(ctx, state, runtime);
+    setWebSessionAgentPromptCommand(state.webHistoryDir, runtime.containerName, runtime.agentPromptCommand);
+
+    const patch = {
+        applied: runtime.applied,
+        runtimeSnapshot: runtime.runtimeSnapshot
+    };
+    if (copyHistory) {
+        patch.agents = cloneWebAgentSessionsDeep(history);
+        patch.agentPromptCommand = history.agentPromptCommand;
+    }
+    patchWebSessionHistory(state.webHistoryDir, finalName, patch);
+
+    return {
+        name: finalName,
+        applied: runtime.applied,
+        sourceContainerName,
+        cloneFidelity,
+        resumeMayFail: copyHistory
+    };
+}
+
+function resolveContainerNamesByHostPath(ctx, state, hostPath) {
+    const target = String(hostPath || '').trim();
+    const containerMap = listWebManyoyoContainers(ctx);
+    const names = new Set([
+        ...Object.keys(containerMap),
+        ...listWebHistorySessionNames(state.webHistoryDir, ctx.isValidContainerName)
+    ]);
+    return Array.from(names).filter(name => {
+        const summary = buildSessionSummary(ctx, state, containerMap, { containerName: name, agentId: WEB_DEFAULT_AGENT_ID });
+        return summary && String(summary.hostPath || '').trim() === target;
+    });
+}
+
 // Estimate container start time from "Up X hours/minutes/seconds" status string.
 // Uses relative time to avoid Podman Machine VM clock drift issues.
 function estimateStartTimeFromStatus(status) {
@@ -2763,6 +2940,34 @@ ${scriptSource}
 __MANYOYO_NODE__`;
 }
 
+function spawnContainerRawFileStream(ctx, containerName, filePath) {
+    return spawn(
+        ctx.dockerCmd,
+        ['exec', containerName, 'cat', '--', filePath],
+        { stdio: ['ignore', 'pipe', 'pipe'] }
+    );
+}
+
+const webRawFileStreamCounts = new Map();
+
+function acquireWebRawFileStreamSlot(containerName) {
+    const current = webRawFileStreamCounts.get(containerName) || 0;
+    if (current >= WEB_FILE_RAW_MAX_CONCURRENT_PER_CONTAINER) {
+        return false;
+    }
+    webRawFileStreamCounts.set(containerName, current + 1);
+    return true;
+}
+
+function releaseWebRawFileStreamSlot(containerName) {
+    const current = webRawFileStreamCounts.get(containerName) || 0;
+    if (current <= 1) {
+        webRawFileStreamCounts.delete(containerName);
+        return;
+    }
+    webRawFileStreamCounts.set(containerName, current - 1);
+}
+
 function inferFileLanguage(filePath) {
     const ext = path.extname(String(filePath || '')).toLowerCase();
     return FILE_LANGUAGE_MAP[ext] || 'text';
@@ -2851,9 +3056,11 @@ function buildContainerFileReadCommand(requestedPath, options = {}) {
     return buildWebContainerNodeCommand(`
 // __MANYOYO_FS_READ__
 const fs = require('fs');
+const path = require('path');
 
 const requestedPath = ${JSON.stringify(String(requestedPath || ''))};
 const maxBytes = ${String(maxBytes)};
+const imageExtensions = new Set(${JSON.stringify(Object.keys(IMAGE_EXTENSION_CONTENT_TYPES))});
 
 function looksBinary(buffer) {
     const length = Math.min(buffer.length, 4096);
@@ -2877,31 +3084,40 @@ try {
         throw new Error('目标不是文件: ' + realPath);
     }
 
-    const size = stat.size;
-    const readBytes = maxBytes > 0 ? Math.min(size, maxBytes) : size;
-    const buffer = Buffer.alloc(readBytes);
-    const fd = fs.openSync(realPath, 'r');
-    try {
-        fs.readSync(fd, buffer, 0, readBytes, 0);
-    } finally {
-        fs.closeSync(fd);
-    }
-
-    if (looksBinary(buffer)) {
+    // 图片走 fs/raw 流式传输,这里只确认元信息,不把整份二进制读进内存/JSON
+    if (imageExtensions.has(path.extname(realPath).toLowerCase())) {
         process.stdout.write(JSON.stringify({
             path: realPath,
-            kind: 'binary',
-            size,
-            truncated: maxBytes > 0 && size > maxBytes
+            kind: 'image',
+            size: stat.size
         }));
     } else {
-        process.stdout.write(JSON.stringify({
-            path: realPath,
-            kind: 'text',
-            size,
-            truncated: maxBytes > 0 && size > maxBytes,
-            content: buffer.toString('utf8')
-        }));
+        const size = stat.size;
+        const readBytes = maxBytes > 0 ? Math.min(size, maxBytes) : size;
+        const buffer = Buffer.alloc(readBytes);
+        const fd = fs.openSync(realPath, 'r');
+        try {
+            fs.readSync(fd, buffer, 0, readBytes, 0);
+        } finally {
+            fs.closeSync(fd);
+        }
+
+        if (looksBinary(buffer)) {
+            process.stdout.write(JSON.stringify({
+                path: realPath,
+                kind: 'binary',
+                size,
+                truncated: maxBytes > 0 && size > maxBytes
+            }));
+        } else {
+            process.stdout.write(JSON.stringify({
+                path: realPath,
+                kind: 'text',
+                size,
+                truncated: maxBytes > 0 && size > maxBytes,
+                content: buffer.toString('utf8')
+            }));
+        }
     }
 } catch (e) {
     process.stdout.write(JSON.stringify({
@@ -2911,6 +3127,31 @@ try {
 `);
 }
 
+function buildContainerFileStatCommand(requestedPath) {
+    return buildWebContainerNodeCommand(`
+// __MANYOYO_FS_STAT__
+const fs = require('fs');
+
+const requestedPath = ${JSON.stringify(String(requestedPath || ''))};
+
+try {
+    const realPath = fs.realpathSync(requestedPath);
+    const stat = fs.statSync(realPath);
+    if (!stat.isFile()) {
+        throw new Error('目标不是文件: ' + realPath);
+    }
+    process.stdout.write(JSON.stringify({
+        path: realPath,
+        size: stat.size
+    }));
+} catch (e) {
+    process.stdout.write(JSON.stringify({
+        error: e && e.message ? e.message : '读取文件失败'
+    }));
+}
+`);
+}
+
 function buildContainerFileWriteCommand(requestedPath, content) {
     return buildWebContainerNodeCommand(`
 // __MANYOYO_FS_WRITE__
@@ -3283,6 +3524,8 @@ function buildSessionSummary(ctx, state, containerMap, sessionRef) {
         containerName,
         agentId,
         agentName: agentSession.agentName,
+        agentRemark: agentSession.remark || '',
+        containerRemark: history.remark || '',
         status: containerInfo.status || 'history',
         image: containerInfo.image || '',
         createdAt,
@@ -3924,7 +4167,8 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 await ensureWebContainer(ctx, state, runtime);
                 setWebSessionAgentPromptCommand(state.webHistoryDir, runtime.containerName, runtime.agentPromptCommand);
                 patchWebSessionHistory(state.webHistoryDir, runtime.containerName, {
-                    applied: runtime.applied
+                    applied: runtime.applied,
+                    runtimeSnapshot: runtime.runtimeSnapshot
                 });
                 sendJson(res, 200, { name: runtime.containerName, applied: runtime.applied });
             }
@@ -3948,6 +4192,125 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 });
             }
         },
+        {
+            method: 'POST',
+            match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/clone-config$/),
+            handler: async match => {
+                const sessionRef = getValidSessionRef(ctx, res, match[1]);
+                if (!sessionRef) {
+                    return;
+                }
+                if (sessionRef.agentId !== WEB_DEFAULT_AGENT_ID) {
+                    sendJson(res, 400, { error: '该操作需在容器层级执行' });
+                    return;
+                }
+                const sourceContainerName = sessionRef.containerName;
+                const historyExists = fs.existsSync(getWebHistoryFile(state.webHistoryDir, sourceContainerName));
+                if (!historyExists && !ctx.containerExists(sourceContainerName)) {
+                    sendJson(res, 404, { error: `容器不存在: ${sourceContainerName}` });
+                    return;
+                }
+                const payload = await readJsonBody(req);
+                const requestedName = pickFirstString(payload.containerName);
+                try {
+                    const result = await createClonedContainer(ctx, state, sourceContainerName, requestedName, { copyHistory: false });
+                    sendJson(res, 200, result);
+                } catch (e) {
+                    sendJson(res, e.statusCode || 400, { error: e.message || '创建相同配置容器失败' });
+                }
+            }
+        },
+        {
+            method: 'POST',
+            match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/duplicate$/),
+            handler: async match => {
+                const sessionRef = getValidSessionRef(ctx, res, match[1]);
+                if (!sessionRef) {
+                    return;
+                }
+                if (sessionRef.agentId !== WEB_DEFAULT_AGENT_ID) {
+                    sendJson(res, 400, { error: '该操作需在容器层级执行' });
+                    return;
+                }
+                const sourceContainerName = sessionRef.containerName;
+                const historyExists = fs.existsSync(getWebHistoryFile(state.webHistoryDir, sourceContainerName));
+                if (!historyExists && !ctx.containerExists(sourceContainerName)) {
+                    sendJson(res, 404, { error: `容器不存在: ${sourceContainerName}` });
+                    return;
+                }
+                const payload = await readJsonBody(req);
+                const requestedName = pickFirstString(payload.containerName);
+                try {
+                    const result = await createClonedContainer(ctx, state, sourceContainerName, requestedName, { copyHistory: true });
+                    sendJson(res, 200, result);
+                } catch (e) {
+                    sendJson(res, e.statusCode || 400, { error: e.message || '复制容器失败' });
+                }
+            }
+        },
+        {
+            method: 'POST',
+            match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/container-remark$/),
+            handler: async match => {
+                const sessionRef = getValidSessionRef(ctx, res, match[1]);
+                if (!sessionRef) {
+                    return;
+                }
+                if (sessionRef.agentId !== WEB_DEFAULT_AGENT_ID) {
+                    sendJson(res, 400, { error: '该操作需在容器层级执行' });
+                    return;
+                }
+                const payload = await readJsonBody(req);
+                const remark = normalizeRemarkText(payload.remark);
+                patchWebSessionHistory(state.webHistoryDir, sessionRef.containerName, { remark });
+                sendJson(res, 200, { containerName: sessionRef.containerName, remark });
+            }
+        },
+        {
+            method: 'POST',
+            match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/agent-remark$/),
+            handler: async match => {
+                const sessionRef = getValidSessionRef(ctx, res, match[1]);
+                if (!sessionRef) {
+                    return;
+                }
+                const payload = await readJsonBody(req);
+                const remark = normalizeRemarkText(payload.remark);
+                patchWebAgentSessionState(state.webHistoryDir, sessionRef, { remark });
+                sendJson(res, 200, { name: buildWebSessionKey(sessionRef.containerName, sessionRef.agentId), remark });
+            }
+        },
+        {
+            method: 'POST',
+            match: currentPath => currentPath === '/api/sessions/by-directory/remove' ? [] : null,
+            handler: async () => {
+                const payload = await readJsonBody(req);
+                const hostPath = typeof payload.hostPath === 'string' ? payload.hostPath : '';
+                if (!hostPath.trim()) {
+                    sendJson(res, 400, { error: 'hostPath 不能为空' });
+                    return;
+                }
+                const targets = resolveContainerNamesByHostPath(ctx, state, hostPath);
+                if (!targets.length) {
+                    sendJson(res, 404, { error: '未找到该工作目录下的容器' });
+                    return;
+                }
+                const removed = [];
+                const errors = [];
+                targets.forEach(name => {
+                    try {
+                        if (ctx.containerExists(name)) {
+                            ctx.removeContainer(name);
+                        }
+                        removeWebSessionHistory(state.webHistoryDir, name);
+                        removed.push(name);
+                    } catch (e) {
+                        errors.push({ name, error: e.message || String(e) });
+                    }
+                });
+                sendJson(res, 200, { hostPath, removed, errors });
+            }
+        },
         {
             method: 'GET',
             match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/messages$/),
@@ -4027,6 +4390,73 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 sendJson(res, 200, payload);
             }
         },
+        {
+            method: 'GET',
+            match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/fs\/raw$/),
+            handler: async match => {
+                const sessionRef = getValidSessionRef(ctx, res, match[1]);
+                if (!sessionRef) {
+                    return;
+                }
+                const requestUrl = new URL(req.url || '/api/sessions/x/fs/raw', 'http://localhost');
+                const targetPath = String(requestUrl.searchParams.get('path') || '').trim();
+                if (!targetPath) {
+                    sendJson(res, 400, { error: 'path 不能为空' });
+                    return;
+                }
+                const ext = path.extname(targetPath).toLowerCase();
+                const contentType = IMAGE_EXTENSION_CONTENT_TYPES[ext];
+                if (!contentType) {
+                    sendJson(res, 400, { error: '不支持预览该文件类型' });
+                    return;
+                }
+
+                await ensureWebContainer(ctx, state, sessionRef.containerName, sessionRef);
+                const statPayload = await execJsonCommandInWebContainer(
+                    ctx,
+                    sessionRef.containerName,
+                    buildContainerFileStatCommand(targetPath)
+                );
+                if (statPayload && statPayload.error) {
+                    sendJson(res, 404, { error: statPayload.error });
+                    return;
+                }
+
+                if (!acquireWebRawFileStreamSlot(sessionRef.containerName)) {
+                    sendJson(res, 429, { error: '预览并发已达上限，请稍后重试' });
+                    return;
+                }
+
+                let released = false;
+                const releaseOnce = () => {
+                    if (released) {
+                        return;
+                    }
+                    released = true;
+                    releaseWebRawFileStreamSlot(sessionRef.containerName);
+                };
+
+                const child = spawnContainerRawFileStream(ctx, sessionRef.containerName, statPayload.path);
+                // stderr 单独消费,绝不混入响应体,避免管道缓冲区打满导致 cat 进程卡死
+                child.stderr.on('data', () => {});
+                child.on('error', () => releaseOnce());
+                child.on('close', () => releaseOnce());
+                res.on('close', () => {
+                    releaseOnce();
+                    if (!child.killed) {
+                        child.kill();
+                    }
+                });
+
+                res.writeHead(200, {
+                    'Content-Type': contentType,
+                    'Content-Length': String(statPayload.size),
+                    'X-Content-Type-Options': 'nosniff',
+                    'Cache-Control': 'no-store'
+                });
+                child.stdout.pipe(res);
+            }
+        },
         {
             method: 'PUT',
             match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/fs\/write$/),

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@xcanwin/manyoyo",
-    "version": "6.2.5",
+    "version": "6.2.7",
     "imageVersion": "1.9.1-common",
     "playwrightCliVersion": "0.1.18",
     "description": "AI Agent CLI Security Sandbox for Docker and Podman",