@xcanwin/manyoyo 7.0.25 → 7.1.1

package/lib/web/server.js

@@ -42,6 +42,12 @@ const WEB_TERMINAL_DEFAULT_COLS = 120;
 const WEB_TERMINAL_DEFAULT_ROWS = 36;
 const WEB_TERMINAL_MIN_COLS = 40;
 const WEB_TERMINAL_MIN_ROWS = 12;
+// 终端 WebSocket 空闲心跳：纯交互式终端可能长时间没有任何数据，
+// 反向代理 / 移动网络的空闲超时（常见 60s）会悄悄掐断连接，这里定期发 ping
+// 帧制造流量。判死放宽到连续 3 次没回 pong（约 90s），手机切后台导致连接被
+// 系统短暂挂起时不至于被误杀——误杀意味着容器里的 shell 直接没了
+const WEB_TERMINAL_PING_INTERVAL_MS = 30000;
+const WEB_TERMINAL_MAX_MISSED_PONGS = 3;
 const WEB_AGENT_CONTEXT_MAX_MESSAGES = 24;
 const WEB_AGENT_CONTEXT_MAX_CHARS = 6000;
 const WEB_AGENT_CONTEXT_PER_MESSAGE_MAX_CHARS = 600;
@@ -96,36 +102,6 @@ const DEFAULT_WEB_CONFIG_TEMPLATE = `{
 }
 `;
 
-let XTERM_JS_FILE = null;
-let XTERM_CSS_FILE = null;
-let XTERM_ADDON_FIT_JS_FILE = null;
-let MARKED_MIN_JS_FILE = null;
-try {
-    const xtermPackageDir = path.dirname(require.resolve('@xterm/xterm/package.json'));
-    XTERM_JS_FILE = path.join(xtermPackageDir, 'lib', 'xterm.js');
-    XTERM_CSS_FILE = path.join(xtermPackageDir, 'css', 'xterm.css');
-} catch (e) {
-    XTERM_JS_FILE = null;
-    XTERM_CSS_FILE = null;
-}
-try {
-    const xtermAddonFitPackageDir = path.dirname(require.resolve('@xterm/addon-fit/package.json'));
-    XTERM_ADDON_FIT_JS_FILE = path.join(xtermAddonFitPackageDir, 'lib', 'addon-fit.js');
-} catch (e) {
-    XTERM_ADDON_FIT_JS_FILE = null;
-}
-try {
-    const markedPackageDir = path.dirname(require.resolve('marked/package.json'));
-    MARKED_MIN_JS_FILE = path.join(markedPackageDir, 'lib', 'marked.umd.js');
-} catch (e) {
-    MARKED_MIN_JS_FILE = null;
-}
-
-const MIME_TYPES = {
-    '.css': 'text/css; charset=utf-8',
-    '.js': 'application/javascript; charset=utf-8',
-    '.html': 'text/html; charset=utf-8'
-};
 const FILE_LANGUAGE_MAP = {
     '.cjs': 'javascript',
     '.css': 'css',
@@ -4183,49 +4159,6 @@ function resolveStaticAsset(name) {
     return fs.existsSync(fullPath) ? fullPath : null;
 }
 
-function resolveVendorAsset(name) {
-    if (!isSafeStaticAssetName(name)) {
-        return null;
-    }
-    if (name === 'xterm.js') {
-        return XTERM_JS_FILE && fs.existsSync(XTERM_JS_FILE) ? XTERM_JS_FILE : null;
-    }
-    if (name === 'xterm.css') {
-        return XTERM_CSS_FILE && fs.existsSync(XTERM_CSS_FILE) ? XTERM_CSS_FILE : null;
-    }
-    if (name === 'xterm-addon-fit.js') {
-        return XTERM_ADDON_FIT_JS_FILE && fs.existsSync(XTERM_ADDON_FIT_JS_FILE) ? XTERM_ADDON_FIT_JS_FILE : null;
-    }
-    if (name === 'marked.min.js') {
-        return MARKED_MIN_JS_FILE && fs.existsSync(MARKED_MIN_JS_FILE) ? MARKED_MIN_JS_FILE : null;
-    }
-    return null;
-}
-
-function sendFileAsset(res, filePath) {
-    if (!filePath || !fs.existsSync(filePath)) {
-        sendHtml(res, 404, '<h1>404 Not Found</h1>');
-        return;
-    }
-
-    const ext = path.extname(filePath).toLowerCase();
-    const contentType = MIME_TYPES[ext] || 'application/octet-stream';
-    const content = fs.readFileSync(filePath);
-    res.writeHead(200, {
-        'Content-Type': contentType,
-        'Cache-Control': 'no-store'
-    });
-    res.end(content);
-}
-
-function sendStaticAsset(res, assetName) {
-    sendFileAsset(res, resolveStaticAsset(assetName));
-}
-
-function sendVendorAsset(res, assetName) {
-    sendFileAsset(res, resolveVendorAsset(assetName));
-}
-
 function loadTemplate(name) {
     const filePath = resolveStaticAsset(name);
     if (!filePath) {
@@ -4241,42 +4174,20 @@ function escapeHtmlText(value) {
         .replace(/>/g, '&gt;');
 }
 
-// JSON.stringify 不转义 "</script>"，且作为 String.replace 的第二个参数时 $&/$'/$` 等会被
-// 当成特殊替换模式重新解释；用替换函数 + 转义 "<" 双重防护，避免 serveTitle 里的内容
-// 提前闭合 <script> 标签或拼接进原始 HTML。
-function jsonForInlineScript(value) {
-    return JSON.stringify(value).replace(/</g, '\\u003c');
-}
-
 function applyServeTitle(html, ctx) {
     if (typeof ctx.serveTitle !== 'string') {
         return html;
     }
-    // 正则匹配任意 <title> 内容而非硬编码 "MANYOYO Web"，兼容 app.html/shadcn.html 各自的默认标题
+    // 正则匹配任意 <title> 内容而非硬编码 "MANYOYO Web"，前端换了默认标题也不用改这里
     return html.replace(/<title>[^<]*<\/title>/, () => `<title>${escapeHtmlText(ctx.serveTitle)}</title>`);
 }
 
-function injectServeTitleFlag(html, ctx) {
-    if (typeof ctx.serveTitle !== 'string') {
-        return html;
-    }
-    // 告知 app.js 跳过按会话动态改写 document.title
-    return html.replace(
-        '</head>',
-        () => `    <script>window.__MANYOYO_SERVE_TITLE__ = ${jsonForInlineScript(ctx.serveTitle)};</script>\n</head>`
-    );
-}
-
-function renderIndexHtml(ctx) {
-    return injectServeTitleFlag(applyServeTitle(loadTemplate('app.html'), ctx), ctx);
-}
-
 function renderShadcnHtml(ctx) {
     // shadcn.html 是 vite singlefile 打包产物，全部依赖内联成一个 <script>，
-    // 用 .replace('</head>', ...) 有极小概率命中某个库源码里字面量出现的
-    // "</head>"，把注入脚本插进内联脚本中间导致整页解析错乱；所以不复用
-    // injectServeTitleFlag 那个 </head> 定位方式，改成跟 applyServeTitle 同款
-    // 更窄、更安全的 <title> 定位，插一个 meta 标记告知前端跳过动态改写 document.title
+    // 用 .replace('</head>', ...) 注入标记有极小概率命中某个库源码里字面量出现的
+    // "</head>"，把注入内容插进内联脚本中间导致整页解析错乱；所以改成跟
+    // applyServeTitle 同款更窄、更安全的 <title> 定位，插一个 meta 标记
+    // 告知前端跳过动态改写 document.title
     let html = applyServeTitle(loadTemplate('shadcn.html'), ctx);
     if (typeof ctx.serveTitle === 'string') {
         html = html.replace(
@@ -4287,10 +4198,6 @@ function renderShadcnHtml(ctx) {
     return html;
 }
 
-function renderLoginHtml(ctx) {
-    return applyServeTitle(loadTemplate('login.html'), ctx);
-}
-
 function toPositiveInt(value, fallback) {
     const parsed = Number.parseInt(value, 10);
     if (!Number.isFinite(parsed) || parsed <= 0) {
@@ -4406,11 +4313,32 @@ function bindTerminalWebSocket(ctx, state, ws, containerName, cols, rows) {
         rows
     });
 
+    let missedPongs = 0;
+    ws.on('pong', () => {
+        missedPongs = 0;
+    });
+    const pingTimer = setInterval(() => {
+        if (ws.readyState !== WebSocket.OPEN) {
+            return;
+        }
+        if (missedPongs >= WEB_TERMINAL_MAX_MISSED_PONGS) {
+            ws.terminate();
+            return;
+        }
+        missedPongs += 1;
+        try {
+            ws.ping();
+        } catch (e) {
+            // ping 失败说明链路已经不可用，交给 close/error 事件收尾
+        }
+    }, WEB_TERMINAL_PING_INTERVAL_MS);
+
     const cleanup = () => {
         if (session.closing) {
             return;
         }
         session.closing = true;
+        clearInterval(pingTimer);
         state.terminalSessions.delete(sessionId);
         if (ptyProcess && !ptyProcess.killed) {
             ptyProcess.kill('SIGTERM');
@@ -4472,6 +4400,12 @@ function bindTerminalWebSocket(ctx, state, ws, containerName, cols, rows) {
             return;
         }
 
+        if (payload.type === 'ping') {
+            // 浏览器 JS 发不出 WebSocket ping 帧，前端改用应用层消息保活上行链路
+            sendTerminalEvent(ws, 'pong');
+            return;
+        }
+
         if (payload.type === 'close') {
             ws.close();
         }
@@ -4488,27 +4422,16 @@ async function handleWebAuthRoutes(req, res, pathname, ctx, state) {
         return true;
     }
 
-    // 旧版默认主题（现为 /legacy 兜底路由）的登录页
-    if (req.method === 'GET' && pathname === '/auth/login') {
-        sendHtml(res, 200, renderLoginHtml(ctx));
-        return true;
-    }
-
-    // 默认主题（shadcn/ui 版）的登录页：与 / 、/shadcn 复用同一份构建产物，
-    // 由前端按 pathname 自行渲染登录表单，登录逻辑仍复用 /auth/login 接口
+    // 登录页：与 / 、/shadcn 复用同一份构建产物，由前端按 pathname 自行渲染
+    // 登录表单，登录逻辑走下面的 POST /auth/login 接口
     if (req.method === 'GET' && pathname === '/shadcn/auth/login') {
         sendHtml(res, 200, applyServeTitle(loadTemplate('shadcn.html'), ctx));
         return true;
     }
 
-    const authFrontendMatch = pathname.match(/^\/auth\/frontend\/([A-Za-z0-9._-]+)$/);
-    if (req.method === 'GET' && authFrontendMatch) {
-        const assetName = authFrontendMatch[1];
-        if (!(assetName === 'login.css' || assetName === 'login.js')) {
-            sendHtml(res, 404, '<h1>404 Not Found</h1>');
-            return true;
-        }
-        sendStaticAsset(res, assetName);
+    // GET /auth/login 曾经是独立的登录页面，现在只留一个跳转，接住老书签
+    if (req.method === 'GET' && pathname === '/auth/login') {
+        sendRedirect(res, 302, '/shadcn/auth/login');
         return true;
     }
 
@@ -4553,25 +4476,14 @@ async function handleWebAuthRoutes(req, res, pathname, ctx, state) {
     return false;
 }
 
-function sendWebUnauthorized(res, pathname, ctx) {
+function sendWebUnauthorized(res, pathname) {
     if (pathname.startsWith('/api/') || pathname.startsWith('/auth/')) {
         sendJson(res, 401, { error: 'UNAUTHORIZED' });
         return;
     }
-    if (pathname === '' || pathname === '/' || pathname === '/shadcn') {
-        sendRedirect(res, 302, '/shadcn/auth/login', { 'Set-Cookie': getWebAuthClearCookie() });
-        return;
-    }
-    if (pathname === '/legacy') {
-        sendRedirect(res, 302, '/auth/login', { 'Set-Cookie': getWebAuthClearCookie() });
-        return;
-    }
-    sendHtml(
-        res,
-        401,
-        renderLoginHtml(ctx),
-        { 'Set-Cookie': getWebAuthClearCookie() }
-    );
+    // 其余都是页面请求：一律打回登录页。登录页本身在认证网关之前就被
+    // handleWebAuthRoutes 放行，不会在这里形成重定向循环
+    sendRedirect(res, 302, '/shadcn/auth/login', { 'Set-Cookie': getWebAuthClearCookie() });
 }
 
 // 运行日志查看接口的支撑函数。日志目录以 serve 实际使用的 logger.path 为准，
@@ -5912,7 +5824,7 @@ async function startWebServer(options) {
 
             const authSession = getWebAuthSession(state, req);
             if (!authSession) {
-                sendWebUnauthorized(res, pathname, ctx);
+                sendWebUnauthorized(res, pathname);
                 return;
             }
 
@@ -5928,40 +5840,6 @@ async function startWebServer(options) {
                 return;
             }
 
-            // 旧版默认主题：不再是默认路由，移到 /legacy 继续保留一段时间作为兜底
-            if (req.method === 'GET' && pathname === '/legacy') {
-                sendHtml(res, 200, renderIndexHtml(ctx));
-                return;
-            }
-
-            const appFrontendMatch = pathname.match(/^\/app\/frontend\/([A-Za-z0-9._-]+)$/);
-            if (req.method === 'GET' && appFrontendMatch) {
-                const assetName = appFrontendMatch[1];
-                if (!(assetName === 'app.css'
-                    || assetName === 'app.js'
-                    || assetName === 'markdown.css'
-                    || assetName === 'markdown-renderer.js'
-                    || assetName === 'chat-behavior.js'
-                    || assetName === 'file-browser.js'
-                    || assetName === 'codemirror.bundle.js')) {
-                    sendHtml(res, 404, '<h1>404 Not Found</h1>');
-                    return;
-                }
-                sendStaticAsset(res, assetName);
-                return;
-            }
-
-            const appVendorMatch = pathname.match(/^\/app\/vendor\/([A-Za-z0-9._-]+)$/);
-            if (req.method === 'GET' && appVendorMatch) {
-                const assetName = appVendorMatch[1];
-                if (!(assetName === 'xterm.css' || assetName === 'xterm.js' || assetName === 'xterm-addon-fit.js' || assetName === 'marked.min.js')) {
-                    sendHtml(res, 404, '<h1>404 Not Found</h1>');
-                    return;
-                }
-                sendVendorAsset(res, assetName);
-                return;
-            }
-
             if (pathname === '/healthz') {
                 sendJson(res, 200, { ok: true });
                 return;
@@ -6061,6 +5939,12 @@ async function startWebServer(options) {
             url.searchParams.get('rows')
         );
 
+        // 升级成 WebSocket 后这条连接是长连接，不能再受 HTTP 请求的空闲超时约束；
+        // 同时打开 TCP keepalive，避免中间设备（NAT / 代理）回收看起来空闲的连接
+        socket.setTimeout(0);
+        socket.setNoDelay(true);
+        socket.setKeepAlive(true, WEB_TERMINAL_PING_INTERVAL_MS);
+
         ensureWebContainer(ctx, state, sessionRef.containerName)
             .then(() => {
                 wsServer.handleUpgrade(req, socket, head, ws => {
@@ -6091,7 +5975,7 @@ async function startWebServer(options) {
             const { GREEN, CYAN, YELLOW, NC } = ctx.colors;
             const listenHost = formatUrlHost(ctx.serverHost);
             console.log(`${GREEN}✅ MANYOYO Web 服务已启动: http://${listenHost}:${listenPort}${NC}`);
-            console.log(`${CYAN}提示: 左侧是 manyoyo 容器会话列表，中间是活动/终端/配置/检查工作台，右侧显示当前会话上下文。${NC}`);
+            console.log(`${CYAN}提示: 左侧是 manyoyo 容器与 AGENT 列表，右侧是聊天/终端/文件/详情/配置/检查工作台。${NC}`);
             if (ctx.serverHost === '0.0.0.0') {
                 console.log(`${CYAN}提示: 当前监听全部网卡，请用本机局域网 IP 访问。${NC}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@xcanwin/manyoyo",
-    "version": "7.0.25",
+    "version": "7.1.1",
     "imageVersion": "1.9.1-common",
     "playwrightCliVersion": "0.1.18",
     "description": "AI Agent CLI Security Sandbox for Docker and Podman",
@@ -31,12 +31,10 @@
     },
     "scripts": {
         "dev:release": "node scripts/dev-release.js",
-        "build:web-editor": "node scripts/build-web-code-editor.js",
         "build:web-shadcn": "node scripts/build-web-shadcn.js",
         "dev:web-shadcn": "node scripts/dev-web-shadcn.js",
         "test:web-shadcn": "node scripts/test-web-shadcn.js",
-        "prepack": "npm run build:web-editor && npm run build:web-shadcn",
-        "prepare": "npm run build:web-editor",
+        "prepack": "npm run build:web-shadcn",
         "install-link": "npm link",
         "test": "jest --coverage && npm run test:web-shadcn",
         "test:unit": "jest test/ && npm run test:web-shadcn",
@@ -63,29 +61,12 @@
     ],
     "dependencies": {
         "@playwright/mcp": "0.0.79",
-        "@xterm/addon-fit": "^0.11.0",
-        "@xterm/xterm": "^6.0.0",
         "commander": "^15.0.0",
         "json5": "^2.2.3",
-        "marked": "^18.0.9",
         "playwright": "1.62.1",
         "ws": "^8.21.3"
     },
     "devDependencies": {
-        "@codemirror/commands": "^6.10.4",
-        "@codemirror/lang-css": "^6.3.1",
-        "@codemirror/lang-html": "^6.4.12",
-        "@codemirror/lang-javascript": "^6.2.5",
-        "@codemirror/lang-json": "^6.0.2",
-        "@codemirror/lang-markdown": "^6.5.2",
-        "@codemirror/lang-python": "^6.2.1",
-        "@codemirror/lang-yaml": "^6.1.3",
-        "@codemirror/language": "^6.12.4",
-        "@codemirror/search": "^6.7.1",
-        "@codemirror/state": "^6.7.1",
-        "@codemirror/view": "^6.43.8",
-        "codemirror": "^6.0.2",
-        "esbuild": "^0.28.2",
         "jest": "^30.4.2",
         "vitepress": "^1.6.4"
     },