@youweichen/pi-web-ui 0.45.0

package/dist/server/text-sniff.js

@@ -0,0 +1,268 @@
+/**
+ * text-sniff — 文件预览相关的纯函数：扩展名分类、内容嗅探、文本解码
+ * （UTF-8 → GBK → latin1 回退）、十六进制视图、行数统计。
+ *
+ * 全部无副作用、不碰 fs —— 便于单元测试（tests/unit/text-sniff.test.ts）。
+ * 从 agent-service.ts 抽出，行为保持不变。
+ */
+const PREVIEW_IMAGE_EXTS = new Set([
+    "png",
+    "jpg",
+    "jpeg",
+    "gif",
+    "webp",
+    "svg",
+    "bmp",
+    "ico",
+    "avif",
+    "jfif",
+    "tif",
+    "tiff",
+]);
+const PREVIEW_VIDEO_EXTS = new Set([
+    "mp4",
+    "webm",
+    "mov",
+    "mkv",
+    "avi",
+    "m4v",
+    "ogv",
+    "mpg",
+    "mpeg",
+    "wmv",
+    "flv",
+]);
+const PREVIEW_TEXT_EXTS = new Set([
+    // code
+    "ts",
+    "tsx",
+    "js",
+    "jsx",
+    "mjs",
+    "cjs",
+    "jsm",
+    "es6",
+    "vue",
+    "svelte",
+    "py",
+    "pyw",
+    "ipynb",
+    "go",
+    "rs",
+    "c",
+    "h",
+    "cpp",
+    "hpp",
+    "cc",
+    "cxx",
+    "hh",
+    "csh",
+    "java",
+    "kt",
+    "kts",
+    "scala",
+    "sc",
+    "cs",
+    "fs",
+    "fsx",
+    "fsi",
+    "sh",
+    "bash",
+    "zsh",
+    "fish",
+    "bat",
+    "cmd",
+    "ps1",
+    "psd1",
+    "psm1",
+    "rb",
+    "php",
+    "pl",
+    "pm",
+    "tcl",
+    "lua",
+    "r",
+    "rmd",
+    "sql",
+    "swift",
+    "dart",
+    "groovy",
+    "gradle",
+    "tf",
+    "tfvars",
+    "hcl",
+    "nim",
+    "zig",
+    "v",
+    "vala",
+    "d",
+    "clj",
+    "cljs",
+    "cljc",
+    "edn",
+    "ex",
+    "exs",
+    "erl",
+    "hrl",
+    "ml",
+    "mli",
+    // markup / config / data
+    "json",
+    "jsonc",
+    "json5",
+    "jsonl",
+    "md",
+    "mdx",
+    "markdown",
+    "html",
+    "htm",
+    "xhtml",
+    "css",
+    "scss",
+    "sass",
+    "less",
+    "styl",
+    "xml",
+    "dtd",
+    "yaml",
+    "yml",
+    "toml",
+    "ini",
+    "cfg",
+    "conf",
+    "properties",
+    "env",
+    "log",
+    "txt",
+    "text",
+    "csv",
+    "tsv",
+    "lock",
+    "sqlite",
+    "graphql",
+    "gql",
+    "proto",
+    "prisma",
+    "asm",
+    "s",
+]);
+/**
+ * Classify a file name into its preview category. Files with no extension
+ * (README, Makefile, .gitignore, …) are treated as text. Everything not in an
+ * allowlist (exe, jar, dll, zip, …) is "none" — never previewed.
+ */
+export function previewKind(name) {
+    const dot = name.lastIndexOf(".");
+    // A leading dot with nothing after it (.gitignore, .env) counts as no ext.
+    const ext = dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
+    if (PREVIEW_IMAGE_EXTS.has(ext))
+        return "image";
+    if (PREVIEW_VIDEO_EXTS.has(ext))
+        return "video";
+    if (ext === "" || PREVIEW_TEXT_EXTS.has(ext))
+        return "text";
+    return "none";
+}
+/**
+ * Content sniff for the preview: any data that has no NUL bytes and no
+ * meaningful control-char ratio is treated as text — so files with unknown
+ * or absent extensions (jsonl, .log.1, …) still open as text. NULs catch
+ * zip/sqlite/png/… even when the extension claims text.
+ */
+export function looksLikeText(buf) {
+    if (buf.length === 0)
+        return true;
+    if (buf.includes(0))
+        return false;
+    const text = buf.toString("utf8");
+    let control = 0;
+    for (const ch of text) {
+        const c = ch.charCodeAt(0);
+        // Keep \t \n \r \f (and \b); everything else < 0x20 is binary-ish.
+        if (c < 0x20 && c !== 9 && c !== 10 && c !== 12 && c !== 13)
+            control++;
+    }
+    return control / Math.max(text.length, 1) < 0.02;
+}
+/** Decode bytes: strict UTF-8 first, falling back to GBK (Windows legacy
+ *  Chinese files), then latin1 as a last resort — so previews and inline
+ *  attachments never show mojibake for GBK/GB2312 encoded files. */
+export function decodeText(buf) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(buf);
+    }
+    catch {
+        try {
+            return new TextDecoder("gbk").decode(buf);
+        }
+        catch {
+            return buf.toString("latin1");
+        }
+    }
+}
+/** Sniff an image MIME type from magic bytes (extension is only a hint).
+ *  Returns null when the bytes don't look like a known raster format —
+ *  callers keep such files as plain path references. */
+export function sniffImageMime(buf, ext) {
+    if (buf.length >= 8 &&
+        buf[0] === 0x89 &&
+        buf[1] === 0x50 &&
+        buf[2] === 0x4e &&
+        buf[3] === 0x47) {
+        return "image/png";
+    }
+    if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) {
+        return "image/jpeg";
+    }
+    const head = buf.slice(0, 6).toString("ascii");
+    if (head === "GIF87a" || head === "GIF89a")
+        return "image/gif";
+    if (buf.length >= 12 &&
+        buf.slice(0, 4).toString("ascii") === "RIFF" &&
+        buf.slice(8, 12).toString("ascii") === "WEBP") {
+        return "image/webp";
+    }
+    if (buf.length >= 2 && buf[0] === 0x42 && buf[1] === 0x4d)
+        return "image/bmp";
+    // Unknown but raster-looking extension — trust the extension so existing
+    // image attachments keep working.
+    const known = {
+        ".png": "image/png",
+        ".jpg": "image/jpeg",
+        ".jpeg": "image/jpeg",
+        ".gif": "image/gif",
+        ".webp": "image/webp",
+        ".bmp": "image/bmp",
+    };
+    return known[ext] ?? null;
+}
+/** First few KB of binary data as a classic hex + ASCII dump (preview only). */
+export function hexDump(buf, maxBytes = 4096) {
+    const data = buf.subarray(0, Math.min(buf.length, maxBytes));
+    const rows = [];
+    for (let off = 0; off < data.length; off += 16) {
+        const chunk = data.subarray(off, off + 16);
+        const hex = [...chunk]
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join(" ");
+        const ascii = [...chunk]
+            .map((b) => (b >= 0x20 && b < 0x7f ? String.fromCharCode(b) : "."))
+            .join("");
+        rows.push(`${off.toString(16).padStart(8, "0")}  ${hex.padEnd(47, " ")}  ${ascii}`);
+    }
+    return rows.join("\n");
+}
+/** Count lines in a buffer; a trailing newline terminates the last line
+ *  instead of starting an empty one — matches the client preview's
+ *  split-based line numbering. */
+export function countLines(buf) {
+    if (buf.length === 0)
+        return 0;
+    const hasTrailingNewline = buf[buf.length - 1] === 10; /* \n */
+    let lines = 0;
+    for (let i = 0; i < buf.length; i++) {
+        if (buf[i] === 10)
+            lines++;
+    }
+    return hasTrailingNewline ? lines : lines + 1;
+}

package/dist/server/uploads.js

@@ -0,0 +1,107 @@
+/**
+ * uploads — 文件对话上传的存储与清理。
+ *
+ * 上传文件落在 <dataDir>/uploads/<clientId>/<ts>-<name>（模型以绝对路径
+ * reference 读取）。此前这里硬编码 ~/.pi-web，不吃 PI_WEB_DATA_DIR —— 已改为
+ * 与 index.ts 相同的解析逻辑。清理策略：默认保留 14 天，启动时扫一次 +
+ * 每 6 小时扫一次；PI_WEB_UPLOAD_RETENTION_DAYS 覆盖保留天数，0 = 关闭清理。
+ * 全程 best-effort：清理失败绝不影响服务。
+ */
+import { readdir, rm, stat } from "node:fs/promises";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+/** Same resolution as index.ts DATA_DIR — kept in sync by env contract. */
+export function resolveDataDir() {
+    return resolve(process.env.PI_WEB_DATA_DIR ?? join(homedir(), ".pi-web"));
+}
+export function uploadsRoot(dataDir = resolveDataDir()) {
+    return join(dataDir, "uploads");
+}
+/** Retention in days; 0 disables sweeping. */
+export function uploadRetentionDays() {
+    const v = Number(process.env.PI_WEB_UPLOAD_RETENTION_DAYS);
+    return Number.isFinite(v) && v >= 0 ? v : 14;
+}
+/** Persist an uploaded buffer; returns the absolute path + sanitized display name. */
+export function saveUpload(clientId, name, buf, dataDir = resolveDataDir()) {
+    const dir = join(uploadsRoot(dataDir), clientId);
+    mkdirSync(dir, { recursive: true });
+    const displayName = name
+        .replace(/[\\/:*?"<>|\x00-\x1f]/g, "_")
+        .slice(0, 80) || "file";
+    const abs = join(dir, `${Date.now()}-${displayName}`);
+    writeFileSync(abs, buf);
+    return { abs, displayName };
+}
+/**
+ * Delete uploaded files older than the retention window, then prune client
+ * dirs left empty. Returns { files, bytes, dirs } removed (best-effort:
+ * individual failures are skipped).
+ */
+export async function cleanupUploads(dataDir = resolveDataDir(), retentionDays = uploadRetentionDays()) {
+    const out = { files: 0, bytes: 0, dirs: 0 };
+    if (retentionDays <= 0)
+        return out;
+    const root = uploadsRoot(dataDir);
+    if (!existsSync(root))
+        return out;
+    const cutoff = Date.now() - retentionDays * 24 * 60 * 60 * 1000;
+    let clients;
+    try {
+        clients = await readdir(root);
+    }
+    catch {
+        return out;
+    }
+    for (const clientId of clients) {
+        const dir = join(root, clientId);
+        let entries;
+        try {
+            entries = await readdir(dir);
+        }
+        catch {
+            continue; // not a dir / vanished
+        }
+        for (const entry of entries) {
+            const abs = join(dir, entry);
+            try {
+                const st = await stat(abs);
+                if (st.mtimeMs >= cutoff)
+                    continue;
+                await rm(abs, { recursive: true });
+                out.files++;
+                out.bytes += st.size;
+            }
+            catch {
+                // skip on any per-file failure
+            }
+        }
+        try {
+            if ((await readdir(dir)).length === 0) {
+                await rmdirSafe(dir);
+                out.dirs++;
+            }
+        }
+        catch {
+            // ignore
+        }
+    }
+    return out;
+}
+async function rmdirSafe(dir) {
+    try {
+        await rm(dir, { recursive: false });
+    }
+    catch {
+        // non-empty or race — fine
+    }
+}
+/** Startup sweep + periodic re-sweep. Timer is unref'd so it never blocks exit. */
+export function scheduleUploadCleanup(intervalMs = 6 * 60 * 60 * 1000) {
+    void cleanupUploads().catch(() => { });
+    const timer = setInterval(() => {
+        void cleanupUploads().catch(() => { });
+    }, intervalMs);
+    timer.unref?.();
+}

package/dist/server/vision-bridge.js

@@ -0,0 +1,131 @@
+/** Per-batch timeout; a slow vision provider shouldn't stall a prompt forever. */
+const TRANSCRIBE_TIMEOUT_MS = Number(process.env.PI_WEB_VISION_TIMEOUT_MS ?? 90_000);
+/** Cap the transcript length so it doesn't blow up the main context. */
+const MAX_TRANSCRIBE_TOKENS = 4000;
+/**
+ * Scan every configured provider for models that accept image input.
+ * Providers the user already configured in pi (models.json + auth.json) are
+ * reused as-is — zero new credentials to set up.
+ */
+export function findVisionModels(runtime) {
+    const out = [];
+    for (const p of runtime.getProviders()) {
+        // Only providers that actually have credentials — SDK built-ins like
+        // amazon-bedrock ship vision-capable models but are not configured
+        // unless the user added auth, and calling them would just fail.
+        if (!runtime.hasConfiguredAuth(p.id))
+            continue;
+        for (const m of runtime.getModels(p.id)) {
+            if (m.input?.includes("image")) {
+                out.push({
+                    provider: p.id,
+                    id: m.id,
+                    label: `${m.name ?? m.id} (${p.id})`,
+                });
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Evidence-first transcription prompt, modeled on modlens' output contract:
+ * full verbatim text, reading-order layout blocks, entities/relations, chart
+ * axes & data. Emphasizes honesty over hallucination.
+ *
+ * Exported so the settings panel can offer a custom prompt (append to this
+ * default or replace it entirely).
+ */
+export const SYSTEM_PROMPT = `You are a vision bridge for a text-only language model. You receive one or more images and must transcribe them into precise, structured text evidence so another model that cannot see images can answer questions about them accurately.
+
+Follow these rules:
+1. Transcribe ALL visible text verbatim, preserving wording, spelling, punctuation and line breaks. This is the most important part — the reader relies on your transcription, not on the image.
+2. Describe the layout in reading order: headers, paragraphs, lists, tables, buttons, panels — say what appears where.
+3. For tables/charts/diagrams: read axes, scales (note log scale), legend entries, series names, highlighted points and their coordinates, and any data values you can discern.
+4. Name entities: people, products, companies, colors, style, objects, actions.
+5. If part of the image is too blurry/low-resolution to read, say "（读不清）" or "unclear" for that part — NEVER invent or guess content you cannot see.
+6. If there are multiple images, address them in order (图 1 / Image 1, 图 2 / Image 2, ...).
+7. Output only the transcript. No preamble, no commentary about the image itself.`;
+/**
+ * Assemble the final vision-model system prompt from the settings-panel prefs.
+ * mode "append": custom text appended after the default prompt (empty custom =
+ * pure default). mode "replace": custom text REPLACES the default prompt, but
+ * an empty custom text still falls back to the default (never send an empty
+ * system prompt to the vision model).
+ */
+export function buildVisionBridgePrompt(mode, custom) {
+    const text = custom?.trim() ?? "";
+    if (mode === "replace" && text)
+        return text;
+    if (text)
+        return `${SYSTEM_PROMPT}\n\n${text}`;
+    return SYSTEM_PROMPT;
+}
+/** Per-batch user instruction appended after the images. */
+function buildUserPrompt(count) {
+    if (count <= 1) {
+        return "请逐字转写这张图片的内容，并按上述规则输出结构化文字证据。";
+    }
+    return `请按图片顺序（图 1 到 图 ${count}）逐张转写每张图片的内容，并按上述规则输出结构化文字证据。`;
+}
+/**
+ * Send one batch of images to a vision model and return its transcript.
+ * Throws on timeout, abort, provider error or an empty response.
+ */
+export async function transcribeImages(runtime, images, options = {}) {
+    const model = options.model ??
+        (() => {
+            const found = findVisionModels(runtime);
+            if (found.length === 0) {
+                throw new Error("未找到可用的视觉模型（models.json 中没有任何 input 含 image 的模型）");
+            }
+            return runtime.getModel(found[0].provider, found[0].id);
+        })();
+    if (!model)
+        throw new Error("视觉模型不可用（ModelRuntime.getModel 返回空）");
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), TRANSCRIBE_TIMEOUT_MS);
+    const onOuterAbort = () => ac.abort();
+    options.signal?.addEventListener("abort", onOuterAbort);
+    try {
+        const imageBlocks = images.map((img) => ({
+            type: "image",
+            data: img.data.replace(/^data:[^;]*;base64,/, ""),
+            mimeType: img.mimeType?.startsWith("image/")
+                ? img.mimeType
+                : "image/png",
+        }));
+        const context = {
+            systemPrompt: options.systemPrompt ?? SYSTEM_PROMPT,
+            messages: [
+                {
+                    role: "user",
+                    timestamp: Date.now(),
+                    content: [
+                        ...imageBlocks,
+                        { type: "text", text: buildUserPrompt(images.length) },
+                    ],
+                },
+            ],
+        };
+        const msg = await runtime.completeSimple(model, context, {
+            signal: ac.signal,
+            maxTokens: MAX_TRANSCRIBE_TOKENS,
+        });
+        if (msg.stopReason === "error" || msg.stopReason === "aborted") {
+            throw new Error(msg.errorMessage || `视觉模型异常终止（${msg.stopReason}）`);
+        }
+        const text = msg.content
+            .filter((b) => b.type === "text")
+            .map((b) => b.text ?? "")
+            .join("\n")
+            .trim();
+        if (!text) {
+            throw new Error("视觉模型返回了空的转写结果");
+        }
+        return text;
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", onOuterAbort);
+    }
+}