agent-loft 0.2.29 → 0.2.30

package/web/settings/notify.js

@@ -0,0 +1,80 @@
+import { fill, h, toast } from "../lib/dom.js";
+import { api } from "../lib/api.js";
+import { relTime } from "../lib/time.js";
+import { currentPushSub, enablePush, pushSupport } from "../lib/push.js";
+
+export async function notifyTab(panel) {
+  const support = pushSupport();
+  const box = h("div", { class: "section" }, h("h4", {}, "系统通知"), h("span", { class: "spinner" }));
+  fill(panel, box);
+  const render = async () => {
+    let data = { subscriptions: [] };
+    try {
+      data = await api("/api/push");
+    } catch (err) {
+      fill(box, h("h4", {}, "系统通知"), h("div", { class: "error-text" }, err.message));
+      return;
+    }
+    const mine = await currentPushSub();
+    const here = mine && data.subscriptions.some((d) => d.endpoint === mine.endpoint);
+    const busy = (btn, fn) => async () => {
+      btn.disabled = true;
+      try {
+        await fn();
+      } catch (err) {
+        toast(err.message);
+      }
+      btn.disabled = false;
+      await render();
+    };
+    const onBtn = h("button", { class: "btn primary" }, "在此设备开启通知");
+    onBtn.onclick = busy(onBtn, async () => {
+      await enablePush();
+      toast("已开启，可以发一条测试通知看看");
+    });
+    const offBtn = h("button", { class: "btn" }, "关闭此设备的通知");
+    offBtn.onclick = busy(offBtn, async () => {
+      await api("/api/push/unsubscribe", { method: "POST", body: { endpoint: mine.endpoint } });
+      await mine.unsubscribe().catch(() => {});
+      toast("已关闭");
+    });
+    const testBtn = h("button", { class: "btn" }, "发送测试通知");
+    testBtn.onclick = busy(testBtn, async () => {
+      const r = await api("/api/push/test", { method: "POST" });
+      toast(`已发送到 ${r.sent} 台设备`);
+    });
+    fill(
+      box,
+      h("h4", {}, "系统通知"),
+      h("div", { class: "muted" }, "Web 对话里 agent 回复完成、出错、需要授权或向你提问时，推送到开启了通知的设备。正在前台看着那条对话的时候不推。飞书对话由飞书自己提醒。"),
+      support.ok
+        ? h("div", { class: "row" }, here ? offBtn : onBtn, data.subscriptions.length ? testBtn : null)
+        : h("div", { class: "error-text" }, support.why),
+      support.ok && Notification.permission === "denied"
+        ? h("div", { class: "error-text" }, "这个设备的通知权限已被拒绝，需要到系统设置（iPhone：设置 → 通知 → Agent Loft）里重新打开。")
+        : null,
+      h("h4", {}, "已开启通知的设备"),
+      data.subscriptions.length === 0
+        ? h("div", { class: "muted" }, "还没有")
+        : data.subscriptions.map((d) => {
+            const rm = h("button", { class: "btn small" }, "移除");
+            rm.onclick = busy(rm, async () => {
+              await api("/api/push/unsubscribe", { method: "POST", body: { endpoint: d.endpoint } });
+              if (mine && mine.endpoint === d.endpoint) await mine.unsubscribe().catch(() => {});
+            });
+            return h(
+              "div",
+              { class: "list-item" },
+              h(
+                "div",
+                { class: "grow" },
+                h("div", { class: "t" }, d.label, mine && mine.endpoint === d.endpoint ? "（本设备）" : ""),
+                h("div", { class: "s" }, `开启于 ${relTime(d.createdAt)}${d.lastOkAt ? ` · 上次送达 ${relTime(d.lastOkAt)}` : ""}`),
+              ),
+              rm,
+            );
+          }),
+    );
+  };
+  await render();
+}

package/web/settings/security.js

@@ -0,0 +1,188 @@
+import { fill, h, toast } from "../lib/dom.js";
+import { api } from "../lib/api.js";
+import { relTime } from "../lib/time.js";
+import { isAdmin, S } from "../state.js";
+import { dropPushSub } from "../lib/push.js";
+import { field } from "./common.js";
+import { feishuLinkSection } from "./memory.js";
+
+export async function authTab(panel) {
+  const [pairs, allowlist] = await Promise.all([api("/api/pairing"), api("/api/claude/allowlist")]);
+  const botName = (id) => S.bots.find((b) => b.id === id)?.name ?? id;
+  const allowText = h("textarea", { rows: 8 });
+  allowText.value = allowlist.join("\n");
+  panel.append(
+    h(
+      "div",
+      { class: "section" },
+      h("h4", {}, "待批准的配对"),
+      pairs.pending.length === 0
+        ? h("div", { class: "muted" }, "没有待批准的请求。陌生人给机器人发消息时会出现在这里。")
+        : pairs.pending.map(({ channelId, request }) =>
+            h(
+              "div",
+              { class: "list-item" },
+              h("div", { class: "grow" }, h("div", { class: "t" }, `${request.code} · ${botName(channelId)}`), h("div", { class: "s" }, `${request.userId} · ${relTime(request.createdAt)}`)),
+              h(
+                "button",
+                {
+                  class: "btn small accent",
+                  onclick: async () => {
+                    try {
+                      await api("/api/pairing/approve", { method: "POST", body: { code: request.code } });
+                      toast("已批准");
+                      fill(panel, );
+                      void authTab(panel);
+                    } catch (err) {
+                      toast(err.message);
+                    }
+                  },
+                },
+                "批准",
+              ),
+            ),
+          ),
+    ),
+    h(
+      "div",
+      { class: "section" },
+      h("h4", {}, "已配对的用户"),
+      pairs.approved.length === 0
+        ? h("div", { class: "muted" }, "无")
+        : pairs.approved.map(({ channelId, userId }) =>
+            h(
+              "div",
+              { class: "list-item" },
+              h("div", { class: "grow" }, h("div", { class: "t" }, userId), h("div", { class: "s" }, botName(channelId))),
+              h(
+                "button",
+                {
+                  class: "btn small danger",
+                  onclick: async () => {
+                    await api("/api/pairing/revoke", { method: "POST", body: { channelId, userId } });
+                    fill(panel, );
+                    void authTab(panel);
+                  },
+                },
+                "撤销",
+              ),
+            ),
+          ),
+    ),
+    h(
+      "div",
+      { class: "section" },
+      h("h4", {}, "Claude「总是允许」名单"),
+      h("div", { class: "muted" }, "点过「总是允许」的会记在这里。Bash:git 表示 git 开头的命令都放行；Edit:/路径 表示该目录下的修改都放行。一行一条，删掉即撤销。"),
+      allowText,
+      h(
+        "div",
+        { class: "row" },
+        h(
+          "button",
+          {
+            class: "btn primary",
+            onclick: async () => {
+              await api("/api/claude/allowlist", { method: "PUT", body: { list: allowText.value.split("\n") } });
+              toast("已保存");
+            },
+          },
+          "保存",
+        ),
+      ),
+    ),
+  );
+}
+
+export async function securityTab(panel) {
+  const old = h("input", { type: "password", autocomplete: "current-password" });
+  const pw = h("input", { type: "password", autocomplete: "new-password" });
+  const sessions = await api("/api/web-sessions");
+  // 管理员看到的是所有人的设备：不止一个人时标上是谁的
+  const owners = new Set(sessions.map((s) => s.userId));
+  const showOwner = isAdmin() && owners.size > 1;
+  panel.append(
+    S.user
+      ? h(
+          "div",
+          { class: "section" },
+          h("h4", {}, "当前账号"),
+          h("div", {}, S.user.name, " ", h("span", { class: "status-tag" }, S.user.role === "admin" ? "管理员" : "成员")),
+        )
+      : null,
+    h(
+      "div",
+      { class: "section" },
+      h("h4", {}, "修改登录密码"),
+      field("原密码", old),
+      field("新密码（至少 8 位）", pw),
+      h(
+        "div",
+        { class: "row" },
+        h(
+          "button",
+          {
+            class: "btn primary",
+            onclick: async () => {
+              try {
+                await api("/api/password", { method: "POST", body: { old: old.value, password: pw.value } });
+                toast("密码已修改，你的其它设备已下线");
+                old.value = pw.value = "";
+              } catch (err) {
+                toast(err.message);
+              }
+            },
+          },
+          "修改",
+        ),
+      ),
+    ),
+    feishuLinkSection(),
+    h(
+      "div",
+      { class: "section" },
+      h("h4", {}, showOwner ? "已登录的设备（所有用户）" : "已登录的设备"),
+      sessions.map((s) =>
+        h(
+          "div",
+          { class: "list-item" },
+          h(
+            "div",
+            { class: "grow" },
+            h("div", { class: "t" }, s.userAgent.slice(0, 80) || "未知设备"),
+            h("div", { class: "s" }, `${showOwner ? `${s.userName ?? "已删除的用户"} · ` : ""}${s.ip} · 最近活动 ${relTime(s.lastSeen)}`),
+          ),
+          h(
+            "button",
+            {
+              class: "btn small danger",
+              onclick: async () => {
+                await api("/api/web-sessions/revoke", { method: "POST", body: { id: s.id } });
+                fill(panel, );
+                void securityTab(panel);
+              },
+            },
+            "下线",
+          ),
+        ),
+      ),
+    ),
+    h(
+      "div",
+      { class: "row" },
+      h(
+        "button",
+        {
+          class: "btn danger",
+          onclick: async () => {
+            // 退出了就别再收这个账号的通知：换个人在这台设备上登录，不能收到上一个人的
+            await dropPushSub().catch(() => {});
+            await api("/api/logout", { method: "POST" });
+            location.reload();
+          },
+        },
+        "退出登录",
+      ),
+    ),
+  );
+}

package/web/settings/users.js

@@ -0,0 +1,189 @@
+import { fill, h, toast } from "../lib/dom.js";
+import { api } from "../lib/api.js";
+import { relTime } from "../lib/time.js";
+import { confirmDialog } from "../lib/overlay.js";
+import { field } from "./common.js";
+import { networkSection, serverVersionSection } from "./general.js";
+
+// ---------- 用户（管理员） ----------
+
+export async function usersTab(panel) {
+  const box = h("div", { class: "section" }, h("h4", {}, "用户"), h("span", { class: "spinner" }));
+  const addBox = h("div", { class: "section" });
+  fill(panel, box, addBox);
+  const reload = () => {
+    fill(panel);
+    void usersTab(panel);
+  };
+  let data;
+  try {
+    data = await api("/api/users");
+  } catch (err) {
+    fill(box, h("h4", {}, "用户"), h("div", { class: "error-text" }, err.message));
+    return;
+  }
+  const act = (btn, fn) => async () => {
+    btn.disabled = true;
+    try {
+      if ((await fn()) !== false) reload();
+    } catch (err) {
+      toast(err.message);
+    }
+    btn.disabled = false;
+  };
+  const patch = (u, body) => api(`/api/users/${encodeURIComponent(u.id)}`, { method: "PATCH", body });
+
+  /** 重置密码：就地展开一个输入框 */
+  const resetRow = (u, holder) => {
+    const pw = h("input", { type: "password", autocomplete: "new-password", placeholder: "新密码（至少 8 位）" });
+    const ok = h("button", { class: "btn small primary" }, "确定");
+    ok.onclick = act(ok, async () => {
+      await patch(u, { password: pw.value });
+      toast(`已重置「${u.name}」的密码，他的设备已下线`);
+    });
+    fill(holder, h("div", { class: "row" }, pw, ok));
+    pw.focus();
+  };
+
+  fill(
+    box,
+    h("h4", {}, "用户"),
+    h(
+      "div",
+      { class: "muted" },
+      "每个人只看得到自己的对话、授权和通知。管理员能改所有设置，还能看到飞书机器人的对话。",
+    ),
+    h(
+      "div",
+      { class: "error-text" },
+      "注意：账号不是安全隔离。所有 agent 都以服务器上的同一个系统用户运行，任何用户都能让 agent 读到这台机器上的文件（包括别人的对话记录和配置里的密钥），用的也是同一个 Claude / Codex 订阅。只把账号给你信任的人。",
+    ),
+    data.users.map((u) => {
+      const self = u.id === data.me;
+      const extra = h("div");
+      const pwBtn = h("button", { class: "btn small" }, "重置密码");
+      pwBtn.onclick = () => resetRow(u, extra);
+      const roleBtn = h("button", { class: "btn small", disabled: self }, u.role === "admin" ? "设为成员" : "设为管理员");
+      roleBtn.onclick = act(roleBtn, () => patch(u, { role: u.role === "admin" ? "member" : "admin" }));
+      const disBtn = h("button", { class: "btn small", disabled: self }, u.disabled ? "启用" : "停用");
+      disBtn.onclick = act(disBtn, () => patch(u, { disabled: !u.disabled }));
+      const memBtn = h("button", { class: "btn small", title: "删除他的「关于我」和所有记住的事。管理员看不到记忆的内容" }, "清空记忆");
+      memBtn.onclick = act(memBtn, async () => {
+        const sure = await confirmDialog({
+          title: `清空「${u.name}」的记忆？`,
+          message: "他的「关于我」和所有记住的事都会删除，不能恢复。",
+          confirmText: "清空",
+          danger: true,
+        });
+        if (!sure) return false;
+        await api(`/api/users/${encodeURIComponent(u.id)}/memory`, { method: "DELETE" });
+        toast("已清空");
+      });
+      const linkBtn = u.feishuLinks ? h("button", { class: "btn small" }, "解除飞书绑定") : null;
+      if (linkBtn) {
+        linkBtn.onclick = act(linkBtn, async () => {
+          await api(`/api/users/${encodeURIComponent(u.id)}/feishu`, { method: "DELETE" });
+          toast("已解除，他和机器人的私聊交还给管理员");
+        });
+      }
+      const rmBtn = h("button", { class: "btn small danger", disabled: self }, "删除");
+      rmBtn.onclick = act(rmBtn, async () => {
+        const sure = await confirmDialog({
+          title: `删除用户「${u.name}」？`,
+          message: "他的设备会立刻下线，记忆和飞书绑定一起删除。他的对话不会删除，之后归管理员。",
+          confirmText: "删除",
+          danger: true,
+        });
+        if (!sure) return false;
+        await api(`/api/users/${encodeURIComponent(u.id)}`, { method: "DELETE" });
+        toast("已删除");
+      });
+      return h(
+        "div",
+        { class: "list-item", style: { flexWrap: "wrap" } },
+        h(
+          "div",
+          { class: "grow" },
+          h(
+            "div",
+            { class: "t" },
+            u.name,
+            self ? "（你）" : "",
+            " ",
+            h("span", { class: "status-tag" }, u.role === "admin" ? "管理员" : "成员"),
+            u.disabled ? h("span", { class: "status-tag bad" }, "已停用") : null,
+          ),
+          h("div", { class: "s" }, `创建于 ${relTime(u.createdAt)} · ${u.devices} 台设备已登录${u.feishuLinks ? ` · 绑定了 ${u.feishuLinks} 个飞书账号` : ""}`),
+          extra,
+        ),
+        pwBtn,
+        roleBtn,
+        disBtn,
+        memBtn,
+        linkBtn,
+        rmBtn,
+      );
+    }),
+  );
+
+  const name = h("input", { autocomplete: "off", autocapitalize: "off", spellcheck: "false", placeholder: "登录用的名字" });
+  const pw = h("input", { type: "password", autocomplete: "new-password", placeholder: "至少 8 位" });
+  const role = h("select", {}, h("option", { value: "member" }, "成员"), h("option", { value: "admin" }, "管理员"));
+  const add = h("button", { class: "btn primary" }, "添加");
+  add.onclick = act(add, async () => {
+    await api("/api/users", { method: "POST", body: { name: name.value.trim(), password: pw.value, role: role.value } });
+    toast(`已添加「${name.value.trim()}」`);
+  });
+  fill(
+    addBox,
+    h("h4", {}, "添加用户"),
+    field("用户名", name),
+    field("密码", pw, "告诉对方，让他登录后在 设置 → 账号 里自己改掉"),
+    field("角色", role, "成员只能用自己的对话；管理员能改所有设置、管理用户"),
+    h("div", { class: "row" }, add),
+  );
+}
+
+export async function systemTab(cfg, panel) {
+  // 系统信息要等接口返回，先占好位置，版本和网络访问两节不用等它
+  const sysBox = h("div", { class: "section" }, h("h4", {}, "系统", h("span", { class: "grow" }), h("span", { class: "spinner" })));
+  panel.append(sysBox, serverVersionSection(), networkSection(cfg));
+  let sys;
+  try {
+    sys = await api("/api/system");
+  } catch (err) {
+    fill(sysBox, h("h4", {}, "系统"), h("div", { class: "error-text" }, err.message));
+    return;
+  }
+  fill(
+    sysBox,
+    h("h4", {}, "系统"),
+    h("div", {}, `版本 ${sys.version} · Node ${sys.node} · 已运行 ${Math.round(sys.uptimeMs / 60000)} 分钟`),
+    h("div", { class: "muted" }, sys.underSystemd ? "以系统服务运行" : "前台运行（重启需要在终端里操作）"),
+    h(
+      "div",
+      { class: "row" },
+      h(
+        "button",
+        {
+          class: "btn",
+          disabled: !sys.underSystemd,
+          onclick: async () => {
+            if (!(await confirmDialog({ title: "重启 agent-loft？", message: "进行中的对话会被中断。", confirmText: "重启", danger: true }))) return;
+            try {
+              await api("/api/system/restart", { method: "POST" });
+              toast("正在重启…");
+              setTimeout(() => location.reload(), 5000);
+            } catch (err) {
+              toast(err.message);
+            }
+          },
+        },
+        "重启服务",
+      ),
+      "Notification" in window && Notification.permission !== "granted"
+        ? h("button", { class: "btn", onclick: () => Notification.requestPermission() }, "开启浏览器通知")
+        : null,
+    ),
+  );
+}

package/web/state.js

@@ -0,0 +1,44 @@
+// ---------- 状态 ----------
+
+export const S = {
+  agents: [],
+  bots: [],
+  convs: new Map(),
+  pending: new Map(),
+  current: null,
+  draftAgent: localStorage.getItem("aim.agent") || null,
+  /** 新对话用聊天模式还是工作模式，记住上次的选择 */
+  draftMode: localStorage.getItem("aim.mode") === "chat" ? "chat" : "work",
+  /** 新对话（还没发消息）选的工作目录，null 表示工作区根目录。开新对话时沿用上次选的 */
+  draftCwd: null,
+  items: [],
+  turnAi: null,
+  seq: new Map(),
+  uploads: [],
+  busy: false,
+  allowedAgents: [],
+  search: "",
+  loadToken: 0,
+  /** 登录的用户 { id, name, role } */
+  user: null,
+};
+
+export const isAdmin = () => S.user?.role === "admin";
+
+export const ui = {};
+
+/**
+ * 运行在 macOS 桌面端（agent-loft-desktop）里时，由它的 preload 注入。
+ * 桌面端收不到 Web Push，系统通知、Dock 角标、菜单栏的待处理数都交给它。
+ */
+export const desktop = window.agentLoftDesktop ?? null;
+/** 新版桌面端：额度由它统一查好推过来，页面自己不查（老版本桌面端没有 onQuota，照旧自己查） */
+export const desktopQuota = typeof desktop?.onQuota === "function";
+// 桌面端里：顶栏、侧栏顶部可以按住拖动窗口（样式见 css/topbar.css 的 .in-desktop）
+if (desktop) document.documentElement.classList.add("in-desktop");
+/**
+ * 新版桌面端顶栏的「更多」里能打开每台服务器的设置：侧栏底部的设置按钮就不显示了（额度照常显示，数据由桌面端推）。
+ * 老版本桌面端没有这个入口，照旧显示，免得设置打不开。
+ */
+export const desktopSettings = typeof desktop?.onOpenSettings === "function";
+if (desktopSettings) document.documentElement.classList.add("desktop-settings");

package/web/views/auth.js

@@ -0,0 +1,61 @@
+import { $app, fill, h } from "../lib/dom.js";
+import { api } from "../lib/api.js";
+import { WS } from "../lib/ws.js";
+import { boot } from "./layout.js";
+
+// ---------- 登录 ----------
+
+export async function showAuth() {
+  WS.stopped = true;
+  WS.sock?.close();
+  let me = { needsSetup: false };
+  try {
+    me = await api("/api/me");
+  } catch {
+    // 网络问题时按登录处理
+  }
+  const err = h("div", { class: "error-text" });
+  const pw = h("input", { type: "password", placeholder: "密码", autocomplete: me.needsSetup ? "new-password" : "current-password" });
+  const token = h("input", { placeholder: "设置码（在启动日志里）", autocomplete: "off" });
+  // 只有一个用户时和以前一样只要密码；多个用户才要填用户名
+  const askName = me.needsSetup || me.multiUser;
+  const name = h("input", {
+    placeholder: me.needsSetup ? "admin" : "用户名",
+    autocomplete: "username",
+    autocapitalize: "off",
+    spellcheck: "false",
+  });
+  const btn = h("button", { class: "btn primary", type: "submit" }, me.needsSetup ? "设置密码并进入" : "登录");
+  const form = h(
+    "form",
+    {
+      class: "auth-card",
+      onsubmit: async (e) => {
+        e.preventDefault();
+        err.textContent = "";
+        btn.disabled = true;
+        try {
+          if (me.needsSetup) {
+            await api("/api/setup", { method: "POST", body: { token: token.value, name: name.value.trim() || "admin", password: pw.value } });
+          } else {
+            await api("/api/login", { method: "POST", body: { ...(askName ? { name: name.value.trim() } : {}), password: pw.value } });
+          }
+          await boot();
+        } catch (e2) {
+          err.textContent = e2.message;
+        } finally {
+          btn.disabled = false;
+        }
+      },
+    },
+    h("h1", {}, "Agent Loft"),
+    h("p", {}, me.needsSetup ? "首次使用：输入启动日志里的设置码，建一个管理员账号（密码至少 8 位）" : "登录以继续"),
+    me.needsSetup ? h("label", { class: "field" }, h("span", {}, "设置码"), token) : null,
+    askName ? h("label", { class: "field" }, h("span", {}, me.needsSetup ? "管理员用户名" : "用户名"), name) : null,
+    h("label", { class: "field" }, h("span", {}, me.needsSetup ? "新密码" : "密码"), pw),
+    btn,
+    err,
+  );
+  fill($app, h("div", { class: "auth" }, form));
+  (me.needsSetup ? token : askName ? name : pw).focus();
+}