agentworkshop 0.7.54 → 0.7.59

package/app/pages/workshop/index.vue

@@ -1,116 +1,121 @@
-<script setup lang="ts">
-/**
- * Workspace 总览(用户级隔离):
- * - 未登录 → 注册/登录门(用户 token = 管理 API 凭证)
- * - 已登录 → workspace 卡片墙(服务端持久化;按用户隔离)+ 实时状态徽标
- *
- * 本页只做编排:登录门状态与动作在 ./composables/useWorkbenchAuth,workspace 加载 /
- * channel 订阅 / 新建 / 删除 / 卡片摘要在 ./composables/useWorkbenchWorkspaces,
- * 展示件在 components/workshop/workbench/**;样式随各自的标记进组件
- * (scoped 编译成 .x[data-v-<scopeId>],不能外移成公共 css)。
- *
- * ⚠️ 两个 composable 都必须在**页面 setup 期**调用(各一次):useWorkshopWs 的心跳
- * onMounted、needsSetup 的 onMounted 探测、channel 订阅的 watch 都注册在页面实例上。
- * 把这些调用挪进子组件会让副作用跟随子组件的挂载时机注册,页面也不再持有订阅引用计数。
- */
-import AuthGate from '@/app/components/workshop/workbench/AuthGate.vue'
-import CreateWorkspaceModal from '@/app/components/workshop/workbench/CreateWorkspaceModal.vue'
-import WorkbenchHead from '@/app/components/workshop/workbench/WorkbenchHead.vue'
-import WorkspaceCard from '@/app/components/workshop/workbench/WorkspaceCard.vue'
-import WorkspaceEmpty from '@/app/components/workshop/workbench/WorkspaceEmpty.vue'
-import { useWorkbenchAuth } from './composables/useWorkbenchAuth'
-import { useWorkbenchWorkspaces } from './composables/useWorkbenchWorkspaces'
-
-const { t } = useI18n()
-
-definePageMeta({ layout: 'default' })
-
-const {
-  userStore,
-  authTab,
-  authName,
-  authEmail,
-  authPassword,
-  authTokenInput,
-  authLoading,
-  needsSetup,
-  doRegister,
-  doLogin,
-  doLoginWithToken,
-  doLogout,
-} = useWorkbenchAuth()
-const { wsStore, ready, createOpen, createName, createLoading, create, remove, channelSummary } = useWorkbenchWorkspaces()
-
-/** 卡片两个入口(摘要行 / 底部主按钮)共用同一跳转 */
-const openWorkspace = (id: string): void => {
-  navigateTo(`/workshop/w/${id}`)
-}
-
-useHead({ title: () => t('titles.workshop') })
-</script>
-
-<template>
-  <div class="page">
-    <!-- 登录门 -->
-    <AuthGate
-      v-if="!userStore.isLoggedIn"
-      v-model:active-tab="authTab"
-      v-model:name="authName"
-      v-model:email="authEmail"
-      v-model:password="authPassword"
-      v-model:token-input="authTokenInput"
-      :loading="authLoading"
-      :needs-setup="needsSetup"
-      @register="doRegister"
-      @login="doLogin"
-      @login-with-token="doLoginWithToken"
-    />
-
-    <!-- 工作区(已登录) -->
-    <template v-else>
-      <WorkbenchHead
-        :user-name="userStore.user?.name"
-        @logout="doLogout"
-        @new-workspace="createOpen = true"
-      />
-
-      <a-spin :spinning="!ready">
-        <div class="grid">
-          <WorkspaceCard
-            v-for="ws in wsStore.workspaces"
-            :key="ws.id"
-            :workspace="ws"
-            :channels="channelSummary(ws.channelIds)"
-            @open="openWorkspace"
-            @remove="remove"
-          />
-
-          <WorkspaceEmpty
-            v-if="wsStore.workspaces.length === 0 && ready"
-            @create="createOpen = true"
-          />
-        </div>
-      </a-spin>
-
-      <CreateWorkspaceModal
-        v-model:open="createOpen"
-        v-model:name="createName"
-        :loading="createLoading"
-        @ok="create"
-      />
-    </template>
-  </div>
-</template>
-
-<style scoped>
-.page { padding: 4px; }
-
-/* 卡片/空态/页头/登录门的规则都随各自的标记搬进了 components/workshop/workbench/*
-   (scoped 编译成 .x[data-v-<scopeId>],样式必须与拥有该元素的标记同址);
-   这里只剩页面自己的外壳类。 */
-.grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(300px, 1fr));
-  gap: 16px;
-}
-</style>
+<script setup lang="ts">
+/**
+ * Workspace 总览(用户级隔离):
+ * - 未登录 → 注册/登录门(用户 token = 管理 API 凭证)
+ * - 已登录 → workspace 卡片墙(服务端持久化;按用户隔离)+ 实时状态徽标
+ *
+ * 本页只做编排:登录门状态与动作在 ./composables/useWorkbenchAuth,workspace 加载 /
+ * channel 订阅 / 新建 / 删除 / 卡片摘要在 ./composables/useWorkbenchWorkspaces,
+ * 展示件在 components/workshop/workbench/**;样式随各自的标记进组件
+ * (scoped 编译成 .x[data-v-<scopeId>],不能外移成公共 css)。
+ *
+ * ⚠️ 两个 composable 都必须在**页面 setup 期**调用(各一次):useWorkshopWs 的心跳
+ * onMounted、needsSetup 的 onMounted 探测、channel 订阅的 watch 都注册在页面实例上。
+ * 把这些调用挪进子组件会让副作用跟随子组件的挂载时机注册,页面也不再持有订阅引用计数。
+ */
+import AuthGate from '@/app/components/workshop/workbench/AuthGate.vue'
+import ChangePasswordModal from '@/app/components/workshop/workbench/ChangePasswordModal.vue'
+import CreateWorkspaceModal from '@/app/components/workshop/workbench/CreateWorkspaceModal.vue'
+import WorkbenchHead from '@/app/components/workshop/workbench/WorkbenchHead.vue'
+import WorkspaceCard from '@/app/components/workshop/workbench/WorkspaceCard.vue'
+import WorkspaceEmpty from '@/app/components/workshop/workbench/WorkspaceEmpty.vue'
+import { useWorkbenchAuth } from './composables/useWorkbenchAuth'
+import { useWorkbenchWorkspaces } from './composables/useWorkbenchWorkspaces'
+
+const { t } = useI18n()
+
+definePageMeta({ layout: 'default' })
+
+const {
+  userStore,
+  authTab,
+  authName,
+  authEmail,
+  authPassword,
+  authTokenInput,
+  authLoading,
+  needsSetup,
+  allowRegister,
+  doRegister,
+  doLogin,
+  doLoginWithToken,
+  doLogout,
+} = useWorkbenchAuth()
+const { wsStore, ready, createOpen, createName, createLoading, create, remove, channelSummary } = useWorkbenchWorkspaces()
+
+/** 卡片两个入口(摘要行 / 底部主按钮)共用同一跳转 */
+const openWorkspace = (id: string): void => {
+  navigateTo(`/workshop/w/${id}`)
+}
+
+useHead({ title: () => t('titles.workshop') })
+</script>
+
+<template>
+  <div class="page">
+    <!-- 首登强制改密门:admin 建号/重置后弹出,改密成功前不得进入工作台 -->
+    <ChangePasswordModal />
+    <!-- 登录门 -->
+    <AuthGate
+      v-if="!userStore.isLoggedIn"
+      v-model:active-tab="authTab"
+      v-model:name="authName"
+      v-model:email="authEmail"
+      v-model:password="authPassword"
+      v-model:token-input="authTokenInput"
+      :loading="authLoading"
+      :needs-setup="needsSetup"
+      :allow-register="allowRegister"
+      @register="doRegister"
+      @login="doLogin"
+      @login-with-token="doLoginWithToken"
+    />
+
+    <!-- 工作区(已登录) -->
+    <template v-else>
+      <WorkbenchHead
+        :user-name="userStore.user?.name"
+        @logout="doLogout"
+        @new-workspace="createOpen = true"
+      />
+
+      <a-spin :spinning="!ready">
+        <div class="grid">
+          <WorkspaceCard
+            v-for="ws in wsStore.workspaces"
+            :key="ws.id"
+            :workspace="ws"
+            :channels="channelSummary(ws.channelIds)"
+            @open="openWorkspace"
+            @remove="remove"
+          />
+
+          <WorkspaceEmpty
+            v-if="wsStore.workspaces.length === 0 && ready"
+            @create="createOpen = true"
+          />
+        </div>
+      </a-spin>
+
+      <CreateWorkspaceModal
+        v-model:open="createOpen"
+        v-model:name="createName"
+        :loading="createLoading"
+        @ok="create"
+      />
+    </template>
+  </div>
+</template>
+
+<style scoped>
+.page { padding: 4px; }
+
+/* 卡片/空态/页头/登录门的规则都随各自的标记搬进了 components/workshop/workbench/*
+   (scoped 编译成 .x[data-v-<scopeId>],样式必须与拥有该元素的标记同址);
+   这里只剩页面自己的外壳类。 */
+.grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(300px, 1fr));
+  gap: 16px;
+}
+</style>

package/app/plugins/http.ts

@@ -6,6 +6,7 @@ import axios, {
 } from 'axios'
 import { message } from 'ant-design-vue'
 import { useUserStore } from '~/stores/workshop/user'
+import { useAuthUiStore } from '~/stores/workshop/auth-ui'
 
 const g = globalThis as typeof globalThis & { __awShown401?: boolean }
 
@@ -58,6 +59,11 @@ export default defineNuxtPlugin((nuxtApp) => {
             g.__awShown401 = false
           }, 3000)
         }
+        // F2 修复:401 不再只弹 toast —— 弹出全局登录对话框给出进门通道
+        try {
+          if (import.meta.client) useAuthUiStore(nuxtApp.$pinia).openLogin('expired')
+        }
+        catch { /* 无 pinia 上下文(极端时序) */ }
       }
       else if (status >= 500) {
         if (import.meta.client) message.error('服务器异常，请稍后重试')

package/app/stores/workshop/auth-ui.ts

@@ -0,0 +1,26 @@
+/**
+ * 登录对话框全局状态(独立于 user store):401 拦截器 / 访客菜单 / 登出 /
+ * 匿名横幅 四路共用同一开关。不并入 workshop.user —— 401 处理会对 user store
+ * 执行 $reset(),放里面会被一并清掉。
+ */
+import { defineStore } from 'pinia'
+
+export type LoginReason = 'manual' | 'expired' | 'anonymous'
+
+interface AuthUiState {
+  open: boolean
+  reason: LoginReason
+}
+
+export const useAuthUiStore = defineStore('workshop.authUi', {
+  state: (): AuthUiState => ({ open: false, reason: 'manual' }),
+  actions: {
+    openLogin(reason: LoginReason = 'manual'): void {
+      this.reason = reason
+      this.open = true
+    },
+    closeLogin(): void {
+      this.open = false
+    },
+  },
+})

package/app/stores/workshop/user.ts

@@ -15,6 +15,8 @@ export interface CurrentUser {
   token: string
   /** 当前会话 token 的 id（吊销会话时比对用） */
   tokenId: string
+  /** 首登强制改密(admin 建号/重置后为 true;本人改密成功后服务端清除) */
+  mustChangePassword?: boolean
 }
 
 export interface TokenMeta {
@@ -68,8 +70,13 @@ export const useUserStore = defineStore('workshop.user', {
       // 请求上下文已丢失,useCookie 会抛 NUXT_E1001(useNuxtApp outside context);
       // 请求期写 Set-Cookie 在响应完成后也无实效。客户端 useCookie 不依赖请求上下文。
       if (import.meta.server) return
-      // maxAge 与服务端 token TTL(30 天)对齐:365 天会让浏览器带着必死 token 往返
-      const cookie = useCookie<string | null>('token', { maxAge: 60 * 60 * 24 * 30 })
+      // maxAge 与服务端 token TTL(30 天)对齐:365 天会让浏览器带着必死 token 往返。
+      // 安全属性:SameSite=Lax 防 CSRF 跳板;https 部署自动附加 Secure(明文 http 内网调试不设)。
+      const cookie = useCookie<string | null>('token', {
+        maxAge: 60 * 60 * 24 * 30,
+        sameSite: 'lax',
+        secure: import.meta.client && window.location.protocol === 'https:',
+      })
       cookie.value = this.user?.token ?? null
     },
     /** 以 me 响应补全 tokenId（注册/登录签发的新 token 尚未绑定 id） */
@@ -136,6 +143,16 @@ export const useUserStore = defineStore('workshop.user', {
         }
       }
     },
+    /** 本人修改密码(首登强制改密同一入口);成功后清除本地强制标记 */
+    async changePassword(currentPassword: string, newPassword: string): Promise<void> {
+      const res = await http<ApiEnvelope<{ ok: boolean, mustChangePassword: boolean }>>('/api/users/change-password', {
+        method: 'POST',
+        body: { currentPassword, newPassword },
+        headers: this.authHeaders(),
+      })
+      if (res.code !== 0 || !res.data?.ok) throw new Error(res.message ?? '修改密码失败')
+      if (this.user) this.user.mustChangePassword = false
+    },
     // ===== API Token CRUD（仅本人；$fetch 不走 axios 拦截器，需显式携带当前会话 Bearer）=====
     authHeaders(): Record<string, string> {
       const t = this.user?.token

package/cli/commands/mcp.mjs

@@ -150,5 +150,11 @@ export async function run(argv) {
   if (flags.port) process.env.AW_PORT = String(flags.port)
   const { runStdio } = await import('../../mcp/aw-mcp-server.mjs')
   runStdio()
+  // runStdio 是事件驱动的:这里绝不能 return —— main() 返回会触发 bin 的 process.exit,
+  // stdio 服务刚启动就被自己杀掉(0.7.58 实测 `aw mcp` 秒退无输出)。挂起直至 stdin 关闭。
+  await new Promise((resolve) => {
+    if (process.stdin.readableEnded) resolve()
+    else process.stdin.on('end', resolve)
+  })
   return 0
 }