agim-cli 1.1.6 → 1.1.7

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [1.1.7] - 2026-05-16
+
+### Fixed — Viewer page leaked the IM user id
+
+- `/v/:id` rendered the `source` field (thread key
+  `platform:channelId:threadId`) in the page header. That string
+  contains the IM user id (wxid on WeChat, numeric id on Telegram).
+  Since the `/v/:id` URL is anyone-with-link, this exposed the user
+  id to anyone the link was forwarded to. The render template now
+  omits `source` entirely — the field stays in the local DB for the
+  operator's own dashboard but no longer ships in HTML.
+
 ## [1.1.6] - 2026-05-16
 
 ### Added — IM long-message viewer (local-first, never leaves your host)

package/dist/web/viewer-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"viewer-render.d.ts","sourceRoot":"","sources":["../../src/web/viewer-render.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAgBvD,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAsGrD;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}
+{"version":3,"file":"viewer-render.d.ts","sourceRoot":"","sources":["../../src/web/viewer-render.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAgBvD,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAuGrD;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}

package/dist/web/viewer-render.js

@@ -17,7 +17,9 @@ function fmtDate(unix) {
 export function renderPasteHtml(row) {
     const isMd = row.content_type !== 'plain';
     const title = row.title || (isMd ? 'agim · markdown' : 'agim · plaintext');
-    const source = row.source ? `<span class="source">${escapeHtml(row.source)}</span>` : '';
+    // Intentionally do NOT render `source` (thread_key). It contains the IM
+    // user id (wxid / telegram id), and the /v/:id URL is anyone-with-link.
+    // Source stays in the DB for the operator's own dashboard.
     const created = fmtDate(row.created_at);
     const body = isMd
         ? `<pre id="md-src" hidden>${escapeHtml(row.content)}</pre><article id="rendered" class="prose"></article>`
@@ -70,7 +72,6 @@ footer a{color:#0969da;text-decoration:none}
 <div class="wrap">
   <header>
     <div class="title">${escapeHtml(title)}</div>
-    ${source}
     <span class="meta">${created}</span>
     <button id="copy-btn" title="copy raw">📋 Copy</button>
   </header>

package/dist/web/viewer-render.js.map

@@ -1 +1 @@
-{"version":3,"file":"viewer-render.js","sourceRoot":"","sources":["../../src/web/viewer-render.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,wEAAwE;AACxE,qEAAqE;AAIrE,SAAS,UAAU,CAAC,CAA4B;IAC9C,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,EAAE,CAAA;IACxB,OAAO,MAAM,CAAC,CAAC,CAAC;SACb,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACvF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,KAAK,OAAO,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAEvC,MAAM,IAAI,GAAG,IAAI;QACf,CAAC,CAAC,2BAA2B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,uDAAuD;QAC3G,CAAC,CAAC,sBAAsB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAA;IAEzD,OAAO;;;;;;;SAOA,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAwCD,UAAU,CAAC,KAAK,CAAC;MACpC,MAAM;yBACa,OAAO;;;IAG5B,IAAI;;;;;EAMJ,IAAI;QACF,CAAC,CAAC;;;;;;;;;;;;;;;;;CAiBP;QACK,CAAC,CAAC,EACN;;;cAGY,IAAI,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,8CAA8C;;;;;;;;;;QAU7G,CAAA;AACR,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,yfAAyf,CAAA;AAClgB,CAAC"}
+{"version":3,"file":"viewer-render.js","sourceRoot":"","sources":["../../src/web/viewer-render.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,wEAAwE;AACxE,qEAAqE;AAIrE,SAAS,UAAU,CAAC,CAA4B;IAC9C,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,EAAE,CAAA;IACxB,OAAO,MAAM,CAAC,CAAC,CAAC;SACb,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACvF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,KAAK,OAAO,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAA;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAEvC,MAAM,IAAI,GAAG,IAAI;QACf,CAAC,CAAC,2BAA2B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,uDAAuD;QAC3G,CAAC,CAAC,sBAAsB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAA;IAEzD,OAAO;;;;;;;SAOA,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAwCD,UAAU,CAAC,KAAK,CAAC;yBACjB,OAAO;;;IAG5B,IAAI;;;;;EAMJ,IAAI;QACF,CAAC,CAAC;;;;;;;;;;;;;;;;;CAiBP;QACK,CAAC,CAAC,EACN;;;cAGY,IAAI,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,8CAA8C;;;;;;;;;;QAU7G,CAAA;AACR,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,yfAAyf,CAAA;AAClgB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agim-cli",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "description": "Agim (阿吉姆) — universal messenger-to-agent bridge. Connect WeChat / Feishu / DingTalk / Telegram / Discord to Claude Code / Codex / Copilot / OpenCode, or any custom agent via ACP. Installs the `agim` command.",
   "type": "module",
   "bin": {