@xcanwin/manyoyo 7.0.26 → 7.1.1

package/lib/web/frontend/login.css

@@ -1,208 +0,0 @@
-:root {
-    --font-ui: "IBM Plex Sans", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", sans-serif;
-    --font-display: "IBM Plex Sans Condensed", "IBM Plex Sans", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", sans-serif;
-
-    --bg-canvas: #f3ede4;
-    --bg-canvas-alt: #efe4d3;
-    --bg-grid: rgba(138, 114, 83, 0.16);
-
-    --panel: #fffdfa;
-    --line: #d9c7ad;
-    --line-focus: #c4551f;
-
-    --text: #1f1a14;
-    --muted: #6a5f52;
-
-    --accent: #c4551f;
-    --accent-strong: #9d4418;
-    --danger: #bf332d;
-
-    --shadow-soft: 0 24px 58px rgba(44, 31, 15, 0.2);
-}
-
-* {
-    box-sizing: border-box;
-}
-
-html,
-body {
-    height: 100%;
-    touch-action: manipulation;
-}
-
-body {
-    margin: 0;
-    min-height: 100vh;
-    display: grid;
-    place-items: center;
-    position: relative;
-    overflow: hidden;
-    font-family: var(--font-ui);
-    color: var(--text);
-    background:
-        radial-gradient(125% 82% at 6% -6%, #f8f2ea 0%, rgba(248, 242, 234, 0) 57%),
-        radial-gradient(95% 66% at 94% 106%, #f2ddc6 0%, rgba(242, 221, 198, 0) 68%),
-        linear-gradient(168deg, var(--bg-canvas) 0%, var(--bg-canvas-alt) 100%);
-}
-
-body::before,
-body::after {
-    content: "";
-    position: absolute;
-    inset: 0;
-    pointer-events: none;
-}
-
-body::before {
-    background-image:
-        repeating-linear-gradient(
-            90deg,
-            transparent 0,
-            transparent 27px,
-            var(--bg-grid) 27px,
-            var(--bg-grid) 28px
-        );
-    opacity: 0.2;
-}
-
-body::after {
-    background-image:
-        linear-gradient(148deg, rgba(196, 85, 31, 0.08) 0%, rgba(196, 85, 31, 0) 42%),
-        linear-gradient(-148deg, rgba(15, 124, 114, 0.08) 0%, rgba(15, 124, 114, 0) 38%);
-}
-
-.card {
-    position: relative;
-    z-index: 1;
-    width: min(440px, calc(100vw - 30px));
-    padding: 26px 24px 20px;
-    border: 1px solid var(--line);
-    border-radius: 18px;
-    background:
-        linear-gradient(172deg, rgba(255, 255, 255, 0.97) 0%, rgba(249, 241, 230, 0.97) 100%);
-    box-shadow: var(--shadow-soft);
-    animation: cardIn 340ms ease both;
-}
-
-.card::before {
-    content: "";
-    position: absolute;
-    left: 0;
-    top: 0;
-    right: 0;
-    height: 4px;
-    border-radius: 18px 18px 0 0;
-    background: linear-gradient(90deg, #c4551f 0%, #0f7c72 100%);
-}
-
-.badge {
-    display: inline-flex;
-    align-items: center;
-    border-radius: 99px;
-    padding: 4px 11px;
-    background: #fee8db;
-    color: #8b3713;
-    font-size: 11px;
-    font-weight: 700;
-    letter-spacing: 0.95px;
-    margin-bottom: 10px;
-    text-transform: uppercase;
-}
-
-h1 {
-    margin: 0 0 6px;
-    font-family: var(--font-display);
-    font-size: 30px;
-    line-height: 1.05;
-    letter-spacing: 0.4px;
-}
-
-p {
-    margin: 0 0 16px;
-    color: var(--muted);
-    font-size: 13px;
-}
-
-label {
-    display: block;
-    margin: 11px 0 6px;
-    font-size: 12px;
-    font-weight: 700;
-    letter-spacing: 0.2px;
-    text-transform: uppercase;
-}
-
-input {
-    width: 100%;
-    border: 1px solid var(--line);
-    border-radius: 10px;
-    padding: 10px 11px;
-    font-size: 14px;
-    color: var(--text);
-    background: #ffffff;
-}
-
-input:focus {
-    outline: none;
-    border-color: var(--line-focus);
-    box-shadow: 0 0 0 3px rgba(196, 85, 31, 0.15);
-}
-
-button {
-    width: 100%;
-    margin-top: 14px;
-    border: 1px solid transparent;
-    border-radius: 10px;
-    padding: 10px 12px;
-    font-size: 14px;
-    font-weight: 700;
-    color: #ffffff;
-    background: var(--accent);
-    cursor: pointer;
-    transition: transform 140ms ease, background-color 140ms ease;
-}
-
-button:hover {
-    transform: translateY(-1px);
-    background: var(--accent-strong);
-}
-
-button:disabled {
-    opacity: 0.62;
-    cursor: not-allowed;
-    transform: none;
-}
-
-button:focus-visible,
-input:focus-visible {
-    outline: 2px solid rgba(196, 85, 31, 0.45);
-    outline-offset: 2px;
-}
-
-.error {
-    margin-top: 10px;
-    min-height: 20px;
-    font-size: 13px;
-    color: var(--danger);
-}
-
-@keyframes cardIn {
-    from {
-        opacity: 0;
-        transform: translateY(8px);
-    }
-    to {
-        opacity: 1;
-        transform: translateY(0);
-    }
-}
-
-@media (prefers-reduced-motion: reduce) {
-    *,
-    *::before,
-    *::after {
-        animation-duration: 0.01ms !important;
-        animation-iteration-count: 1 !important;
-        transition-duration: 0.01ms !important;
-    }
-}

package/lib/web/frontend/login.html

@@ -1,25 +0,0 @@
-<!doctype html>
-<html lang="zh-CN">
-<head>
-    <meta charset="utf-8" />
-    <meta
-        name="viewport"
-        content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover"
-    />
-    <title>MANYOYO Web</title>
-    <link rel="stylesheet" href="/auth/frontend/login.css" />
-</head>
-<body>
-    <form class="card" id="loginForm">
-        <div class="badge">MANYOYO</div>
-        <h1>Web 登录</h1>
-        <label for="username">用户名</label>
-        <input id="username" name="username" autocomplete="username" required />
-        <label for="password">密码</label>
-        <input id="password" name="password" type="password" autocomplete="current-password" required />
-        <button type="submit" id="loginBtn">登录</button>
-        <div class="error" id="error" role="alert"></div>
-    </form>
-    <script src="/auth/frontend/login.js"></script>
-</body>
-</html>

package/lib/web/frontend/login.js

@@ -1,74 +0,0 @@
-(function () {
-    function preventAccidentalZoom() {
-        let lastTouchEnd = 0;
-
-        document.addEventListener('dblclick', function (event) {
-            event.preventDefault();
-        }, { passive: false });
-
-        document.addEventListener('touchstart', function (event) {
-            if (event.touches && event.touches.length > 1) {
-                event.preventDefault();
-            }
-        }, { passive: false });
-
-        document.addEventListener('touchmove', function (event) {
-            if (event.touches && event.touches.length > 1) {
-                event.preventDefault();
-            }
-        }, { passive: false });
-
-        document.addEventListener('touchend', function (event) {
-            const now = Date.now();
-            if (now - lastTouchEnd <= 320) {
-                event.preventDefault();
-            }
-            lastTouchEnd = now;
-        }, { passive: false });
-
-        ['gesturestart', 'gesturechange', 'gestureend'].forEach(function (eventName) {
-            document.addEventListener(eventName, function (event) {
-                event.preventDefault();
-            }, { passive: false });
-        });
-    }
-
-    preventAccidentalZoom();
-
-    const form = document.getElementById('loginForm');
-    const userNode = document.getElementById('username');
-    const passNode = document.getElementById('password');
-    const submitBtn = document.getElementById('loginBtn');
-    const errorNode = document.getElementById('error');
-
-    userNode.focus();
-
-    form.addEventListener('submit', async function (event) {
-        event.preventDefault();
-        if (submitBtn.disabled) return;
-        errorNode.textContent = '';
-        const previousText = submitBtn.textContent;
-        submitBtn.disabled = true;
-        submitBtn.textContent = '登录中...';
-        try {
-            const response = await fetch('/auth/login', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    username: (userNode.value || '').trim(),
-                    password: passNode.value || ''
-                })
-            });
-            const payload = await response.json().catch(function () { return {}; });
-            if (!response.ok) {
-                throw new Error(payload.error || '登录失败');
-            }
-            window.location.href = '/legacy';
-        } catch (e) {
-            errorNode.textContent = e.message || '登录失败';
-        } finally {
-            submitBtn.disabled = false;
-            submitBtn.textContent = previousText;
-        }
-    });
-})();

package/lib/web/frontend/markdown-renderer.js

@@ -1,316 +0,0 @@
-(function () {
-    const MARKDOWN_LINK_PROTOCOL_PATTERN = /^(https?:|mailto:|tel:)/i;
-    const MARKDOWN_IMAGE_PROTOCOL_PATTERN = /^(https?:)/i;
-    const runtime = {
-        configured: false,
-        available: false,
-        linkGuardBound: false,
-        linkOpenHandler: null,
-        currentImageResolver: null
-    };
-
-    function escapeHtml(value) {
-        return String(value == null ? '' : value)
-            .replace(/&/g, '&')
-            .replace(/</g, '&lt;')
-            .replace(/>/g, '&gt;')
-            .replace(/"/g, '&quot;')
-            .replace(/'/g, '&#39;');
-    }
-
-    function normalizeRendererValue(value) {
-        if (value && typeof value === 'object') {
-            if (typeof value.href === 'string') {
-                return value.href;
-            }
-            if (typeof value.text === 'string') {
-                return value.text;
-            }
-        }
-        return String(value == null ? '' : value);
-    }
-
-    function sanitizeMarkdownLinkUrl(value) {
-        const raw = String(value == null ? '' : value).trim();
-        if (!raw) {
-            return '';
-        }
-        if (MARKDOWN_LINK_PROTOCOL_PATTERN.test(raw)) {
-            return raw;
-        }
-        return '';
-    }
-
-    function sanitizeMarkdownImageUrl(value) {
-        const raw = String(value == null ? '' : value).trim();
-        if (!raw) {
-            return '';
-        }
-        if (raw[0] === '/') {
-            return raw.startsWith('//') ? '' : raw;
-        }
-        if (raw.startsWith('./') || raw.startsWith('../')) {
-            return raw;
-        }
-        if (MARKDOWN_IMAGE_PROTOCOL_PATTERN.test(raw)) {
-            return raw;
-        }
-        return '';
-    }
-
-    function getRendererToken(value) {
-        return value && typeof value === 'object' ? value : null;
-    }
-
-    function renderInlineTokens(rendererContext, token, fallbackText) {
-        if (
-            token
-            && Array.isArray(token.tokens)
-            && rendererContext
-            && rendererContext.parser
-            && typeof rendererContext.parser.parseInline === 'function'
-        ) {
-            try {
-                return String(rendererContext.parser.parseInline(token.tokens) || '');
-            } catch (e) {
-                // ignore and fallback to plain text below
-            }
-        }
-        if (token && typeof token.text === 'string') {
-            return escapeHtml(token.text);
-        }
-        return escapeHtml(fallbackText || '');
-    }
-
-    function buildSafeAnchorHtml(href, title, content, extraAttrs) {
-        let output = '<a href="' + escapeHtml(href) + '" target="_blank" rel="noopener noreferrer"'
-            + ' referrerpolicy="no-referrer" data-safe-external-link="true"'
-            + ' data-safe-href="' + escapeHtml(href) + '"';
-        if (title) {
-            output += ' title="' + escapeHtml(title) + '"';
-        }
-        if (extraAttrs) {
-            output += extraAttrs;
-        }
-        output += '>' + content + '</a>';
-        return output;
-    }
-
-    function openExternalLinkWithNoReferrer(href) {
-        const url = String(href || '').trim();
-        if (!url || typeof document === 'undefined' || !document || typeof document.createElement !== 'function') {
-            if (typeof window.open === 'function') {
-                const opened = window.open(url, '_blank', 'noopener,noreferrer');
-                if (opened) {
-                    opened.opener = null;
-                }
-            }
-            return;
-        }
-
-        const anchor = document.createElement('a');
-        anchor.href = url;
-        anchor.target = '_blank';
-        anchor.rel = 'noopener noreferrer';
-        anchor.referrerPolicy = 'no-referrer';
-        anchor.style.display = 'none';
-        document.body.appendChild(anchor);
-        try {
-            if (typeof anchor.click === 'function') {
-                anchor.click();
-            } else if (typeof window.open === 'function') {
-                const opened = window.open(url, '_blank', 'noopener,noreferrer');
-                if (opened) {
-                    opened.opener = null;
-                }
-            }
-        } finally {
-            if (anchor.parentNode && typeof anchor.parentNode.removeChild === 'function') {
-                anchor.parentNode.removeChild(anchor);
-            }
-        }
-    }
-
-    function requestExternalLinkOpen(href) {
-        const url = String(href || '').trim();
-        if (!url) {
-            return;
-        }
-        if (typeof runtime.linkOpenHandler === 'function') {
-            runtime.linkOpenHandler(url);
-            return;
-        }
-
-        const shouldOpen = typeof window.confirm === 'function'
-            ? window.confirm('即将打开外部链接：\n' + url + '\n\n确认继续打开？')
-            : true;
-        if (!shouldOpen) {
-            return;
-        }
-
-        openExternalLinkWithNoReferrer(url);
-    }
-
-    function bindDocumentLinkGuard() {
-        if (runtime.linkGuardBound || typeof document === 'undefined' || !document || typeof document.addEventListener !== 'function') {
-            return;
-        }
-
-        document.addEventListener('click', function (event) {
-            const target = event && event.target;
-            if (!target || typeof target.closest !== 'function') {
-                return;
-            }
-            const link = target.closest('a[data-safe-external-link="true"]');
-            if (!link) {
-                return;
-            }
-            if (event.preventDefault) {
-                event.preventDefault();
-            }
-            if (event.stopPropagation) {
-                event.stopPropagation();
-            }
-
-            const href = String(
-                (typeof link.getAttribute === 'function' && (link.getAttribute('data-safe-href') || link.getAttribute('href')))
-                || link.href
-                || ''
-            ).trim();
-            if (!href) {
-                return;
-            }
-
-            requestExternalLinkOpen(href);
-        });
-
-        runtime.linkGuardBound = true;
-    }
-
-    function getMarkedApi() {
-        const api = window.marked;
-        if (!api || typeof api.parse !== 'function') {
-            return null;
-        }
-        return api;
-    }
-
-    function ensureRendererConfigured() {
-        if (runtime.configured) {
-            return runtime.available;
-        }
-
-        const markedApi = getMarkedApi();
-        if (!markedApi || typeof markedApi.Renderer !== 'function' || typeof markedApi.use !== 'function') {
-            runtime.configured = true;
-            runtime.available = false;
-            return false;
-        }
-
-        try {
-            const renderer = new markedApi.Renderer();
-            renderer.html = function (html) {
-                const token = getRendererToken(html);
-                return escapeHtml(token ? token.text : html);
-            };
-            renderer.link = function (href, title, text) {
-                const token = getRendererToken(href);
-                const rawHref = token ? token.href : normalizeRendererValue(href);
-                const rawTitle = token ? token.title : title;
-                const safeHref = sanitizeMarkdownLinkUrl(rawHref);
-                const safeText = renderInlineTokens(this, token, text)
-                    // [P1-02] 移除 marked 已渲染链接文本中的 on* 事件属性，防止内联 HTML 注入 XSS
-                    .replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]*)/gi, '');
-                if (!safeHref) {
-                    return safeText || escapeHtml(token ? token.text : text || '');
-                }
-                return buildSafeAnchorHtml(safeHref, rawTitle, safeText || escapeHtml(safeHref));
-            };
-            // [P1-01] 重写 image 渲染器：
-            //   - 外部 http/https 图片转为可点击链接，避免浏览器自动发起外部请求（追踪像素风险）
-            //   - 相对路径图片正常渲染为 <img>
-            //   - 危险协议（javascript:/data: 等）降级为纯文本
-            renderer.image = function (href, title, text) {
-                const token = getRendererToken(href);
-                const rawHref = token ? token.href : normalizeRendererValue(href);
-                const rawTitle = token ? token.title : title;
-                const safeHref = sanitizeMarkdownImageUrl(rawHref);
-                const safeText = renderInlineTokens(this, token, text)
-                    .replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]*)/gi, '');
-                if (!safeHref) {
-                    return safeText || escapeHtml(token ? token.text : text || '');
-                }
-                // 外部绝对 URL：转为链接，用户主动决定是否访问
-                if (/^https?:/i.test(safeHref)) {
-                    return buildSafeAnchorHtml(
-                        safeHref,
-                        rawTitle,
-                        '[\uD83D\uDDBC\uFE0F点击查看图片:' + (safeText || escapeHtml(safeHref)) + ']'
-                    );
-                }
-                // 相对路径：交给调用方按当前渲染上下文解析为可访问的 URL（未提供 resolver 时原样使用）
-                const resolvedHref = typeof runtime.currentImageResolver === 'function'
-                    ? runtime.currentImageResolver(safeHref)
-                    : safeHref;
-                if (!resolvedHref) {
-                    return safeText || escapeHtml(token ? token.text : text || '');
-                }
-                let output = '<img src="' + escapeHtml(resolvedHref) + '" alt="' + escapeHtml(text || '') + '"';
-                if (rawTitle) {
-                    output += ' title="' + escapeHtml(rawTitle) + '"';
-                }
-                return output + '>';
-            };
-
-            markedApi.use({
-                gfm: true,
-                breaks: true,
-                renderer
-            });
-            runtime.available = true;
-        } catch (e) {
-            runtime.available = false;
-        }
-        runtime.configured = true;
-        return runtime.available;
-    }
-
-    function shouldRenderMessage(msg) {
-        return Boolean(msg && msg.mode === 'agent' && msg.role === 'assistant');
-    }
-
-    function render(content, options) {
-        const source = String(content == null ? '' : content);
-        if (!source) {
-            return '';
-        }
-        if (!ensureRendererConfigured()) {
-            return '';
-        }
-        const markedApi = getMarkedApi();
-        if (!markedApi) {
-            return '';
-        }
-        runtime.currentImageResolver = options && typeof options.imageUrlResolver === 'function'
-            ? options.imageUrlResolver
-            : null;
-        try {
-            return String(markedApi.parse(source) || '');
-        } catch (e) {
-            return '';
-        } finally {
-            runtime.currentImageResolver = null;
-        }
-    }
-
-    window.ManyoyoMarkdown = {
-        shouldRenderMessage,
-        render,
-        openExternalLink: openExternalLinkWithNoReferrer,
-        setLinkOpenHandler: function (handler) {
-            runtime.linkOpenHandler = typeof handler === 'function' ? handler : null;
-        }
-    };
-
-    bindDocumentLinkGuard();
-}());

package/lib/web/frontend/markdown.css

@@ -1,84 +0,0 @@
-.md-content {
-    color: var(--text);
-    font-size: 13px;
-    line-height: 1.6;
-    word-break: break-word;
-}
-
-.md-content > :first-child {
-    margin-top: 0;
-}
-
-.md-content > :last-child {
-    margin-bottom: 0;
-}
-
-.md-content p,
-.md-content ul,
-.md-content ol,
-.md-content blockquote,
-.md-content pre,
-.md-content table {
-    margin: 0.6em 0;
-}
-
-.md-content ul,
-.md-content ol {
-    padding-left: 1.4em;
-}
-
-.md-content code {
-    font-family: var(--font-mono);
-    font-size: 12px;
-    padding: 1px 5px;
-    border-radius: 6px;
-    background: rgba(194, 149, 79, 0.16);
-}
-
-.md-content pre {
-    border-radius: 8px;
-    padding: 9px 10px;
-    border: 1px solid #e6d2b7;
-    background: rgba(255, 244, 224, 0.72);
-    overflow-x: auto;
-}
-
-.md-content pre code {
-    background: transparent;
-    border-radius: 0;
-    padding: 0;
-    font-size: 12px;
-    line-height: 1.5;
-}
-
-.md-content blockquote {
-    margin-left: 0;
-    padding-left: 10px;
-    border-left: 3px solid #dcb788;
-    color: #66492d;
-}
-
-.md-content table {
-    border-collapse: collapse;
-    width: 100%;
-}
-
-.md-content th,
-.md-content td {
-    border: 1px solid #e6d2b7;
-    padding: 4px 6px;
-    text-align: left;
-}
-
-.md-content a {
-    color: #8a4f17;
-    text-decoration-line: underline;
-    text-decoration-thickness: 2px;
-    text-underline-offset: 0.16em;
-    text-decoration-color: rgba(138, 79, 23, 0.8);
-}
-
-.md-content a:hover,
-.md-content a:focus-visible {
-    text-decoration-color: #8a4f17;
-}