npm - agim-cli - Versions diffs - 1.2.128 → 1.2.130 - Mend

agim-cli 1.2.128 → 1.2.130

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (218) hide show

package/dist/web/public/m/login.html ADDED Viewed

@@ -0,0 +1,124 @@
+<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover" />
+<meta name="theme-color" content="#0b0c0e" />
+<title>agim · 手机登录</title>
+<style>
+  :root {
+    color-scheme: light dark;
+    --bg: #fafafa; --fg: #111; --dim: #6b7280; --card: #fff; --border: #e5e7eb;
+    --accent: #2563eb; --danger: #b91c1c; --ok: #047857;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root { --bg: #0b0c0e; --fg: #e5e7eb; --dim: #9ca3af; --card: #1a1b1e; --border: #2a2c30; }
+  }
+  * { box-sizing: border-box; }
+  html, body { margin: 0; padding: 0; }
+  body {
+    background: var(--bg); color: var(--fg);
+    font: 15px/1.6 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "PingFang SC", "Microsoft YaHei", sans-serif;
+    min-height: 100dvh; display: flex; flex-direction: column;
+    padding: env(safe-area-inset-top) env(safe-area-inset-right) env(safe-area-inset-bottom) env(safe-area-inset-left);
+  }
+  main {
+    flex: 1; display: flex; flex-direction: column; align-items: center; justify-content: center;
+    padding: 24px;
+  }
+  .card {
+    width: 100%; max-width: 360px; background: var(--card); border: 1px solid var(--border);
+    border-radius: 14px; padding: 24px 20px; box-shadow: 0 1px 3px rgba(0,0,0,0.06);
+  }
+  h1 { margin: 0 0 6px; font-size: 18px; font-weight: 600; }
+  .sub { margin: 0 0 18px; color: var(--dim); font-size: 13px; }
+  .spinner {
+    width: 22px; height: 22px; border: 2px solid var(--border); border-top-color: var(--accent);
+    border-radius: 50%; animation: spin 0.9s linear infinite; display: inline-block; vertical-align: middle;
+  }
+  @keyframes spin { to { transform: rotate(360deg); } }
+  .msg { margin-top: 10px; font-size: 13px; }
+  .msg.err { color: var(--danger); }
+  .msg.ok { color: var(--ok); }
+  .retry {
+    margin-top: 14px; display: inline-block; padding: 8px 14px; border-radius: 8px;
+    background: var(--accent); color: white; text-decoration: none; font-size: 14px;
+  }
+  .hint { margin-top: 10px; font-size: 12px; color: var(--dim); }
+  code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12px;
+    background: var(--bg); padding: 1px 6px; border-radius: 4px; }
+</style>
+</head>
+<body>
+<main>
+  <div class="card">
+    <h1 id="title">登录手机版 agim chat…</h1>
+    <p class="sub" id="sub">正在验证扫码 token，请稍候</p>
+    <div id="state"><span class="spinner"></span></div>
+    <div id="msg" class="msg"></div>
+    <div class="hint" id="hint">扫码生成的链接只能用一次性进入；如需重新进入，请回到桌面 admin 重新生成二维码。</div>
+  </div>
+</main>
+<script>
+(function(){
+  var L = (navigator.language || 'zh').toLowerCase().slice(0,2) === 'en' ? 'en' : 'zh';
+  var T = {
+    zh: { title: '登录手机版 agim chat…', sub: '正在验证扫码 token，请稍候',
+          bad: 'Token 已失效或被撤销。请回到桌面 admin 重新扫码。',
+          missing: '链接里没有 token。请通过 admin 后台「Mobile / 手机端」生成二维码后扫码。',
+          neterr: '网络错误：', ok: '验证通过，正在跳转聊天界面…',
+          retry: '回到登录页' },
+    en: { title: 'Signing in to mobile agim chat…', sub: 'Verifying the QR token, please wait',
+          bad: 'Token expired or revoked. Re-generate the QR from the desktop admin.',
+          missing: 'No token in the URL. Generate a QR from admin → Mobile.',
+          neterr: 'Network error: ', ok: 'Verified, opening chat…',
+          retry: 'Back to login' },
+  };
+  var t = T[L];
+  document.getElementById('title').textContent = t.title;
+  document.getElementById('sub').textContent = t.sub;
+  var msg = document.getElementById('msg');
+  var state = document.getElementById('state');
+  function fail(text){
+    state.innerHTML = '';
+    msg.className = 'msg err';
+    msg.textContent = text;
+    var a = document.createElement('a');
+    a.className = 'retry'; a.href = '/login'; a.textContent = t.retry;
+    msg.appendChild(document.createElement('br'));
+    msg.appendChild(a);
+  }
+  function next(){
+    var p = new URLSearchParams(location.search);
+    var n = p.get('next') || '/m/chat';
+    try {
+      var u = new URL(n, location.origin);
+      if (u.origin !== location.origin) return '/m/chat';
+      return u.pathname + u.search;
+    } catch (e) { return '/m/chat'; }
+  }
+  var raw = new URLSearchParams(location.search).get('t');
+  if (!raw) { fail(t.missing); return; }
+  fetch('/api/auth/login', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ token: raw }),
+  }).then(function(r){
+    if (r.status === 401) { fail(t.bad); return; }
+    if (!r.ok) {
+      return r.text().then(function(b){ fail(t.neterr + r.status + ' ' + b.slice(0,200)); });
+    }
+    // localStorage mirror so the legacy fallback code paths keep working
+    // in case some component reads it instead of the cookie.
+    try { localStorage.setItem('agim_token', raw); } catch (e) {}
+    state.innerHTML = '';
+    msg.className = 'msg ok';
+    msg.textContent = t.ok;
+    setTimeout(function(){ location.replace(next()); }, 300);
+  }).catch(function(err){
+    fail(t.neterr + (err && err.message || String(err)));
+  });
+})();
+</script>
+</body>
+</html>

package/dist/web/server.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"~~AAyQA~~,wBAAgB,iBAAiB,IAAI,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAOrE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,~~CA+rC~~/C"}
1	+ {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AA8QA,wBAAgB,iBAAiB,IAAI,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAOrE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAitC/C"}

package/dist/web/server.js CHANGED Viewed

@@ -46,6 +46,11 @@ const PUBLIC_EXACT_PATHS = new Set([
     // "submit my coordinates" endpoint. It's authenticated by the single-use
     // location token in the request body, NOT by the web access token.
     '/api/loc',
+    // v1.2.129 — mobile QR landing. The static page reads `?t=<raw>` and
+    // POSTs to /api/auth/login to set the cookie, then redirects to
+    // /m/chat. Public on purpose: the raw token IS the auth credential
+    // for that single redirect (same model as /login + ?token= fallback).
+    '/m/login', '/m/login.html',
     '/favicon.ico', '/favicon.svg',
 ]);
 const PUBLIC_PREFIX_PATHS = ['/l/', '/v/', '/api/loc/', '/vendor/'];
@@ -381,7 +386,10 @@ export async function startWebServer(options) {
             const isSse = p === '/events';
             const isVendor = p.startsWith('/vendor/');
             const isPublicSsr = p === '/loc' || p === '/loc.html' || p.startsWith('/l/') || p.startsWith('/v/');
-            if (!isApi && !isWs && !isSse && !isVendor && !isPublicSsr) {
+            // v1.2.129 — /m/login is a static HTML handed back below; don't let
+            // the SPA fallback swallow it (the SPA can't auto-submit the token).
+            const isMobileLogin = p === '/m/login' || p === '/m/login.html';
+            if (!isApi && !isWs && !isSse && !isVendor && !isPublicSsr && !isMobileLogin) {
                 // SPA static asset (assets/index-xxx.js, /manifest.webmanifest,
                 // /favicon.svg) → return the file if it exists in PUBLIC_DIR.
                 // Otherwise fall back to /index.html so the router handles it.
@@ -419,6 +427,12 @@ export async function startWebServer(options) {
         if (url.pathname === '/login' && req.method === 'GET') {
             return serveStatic(res, join(PUBLIC_DIR, 'login.html'), 'text/html; charset=utf-8');
         }
+        // v1.2.129 — mobile QR landing. Static page reads ?t=<raw>, POSTs
+        // to /api/auth/login, then redirects to ?next=/m/chat. Public so the
+        // scanner doesn't bounce through /login first.
+        if ((url.pathname === '/m/login' || url.pathname === '/m/login.html') && req.method === 'GET') {
+            return serveStatic(res, join(PUBLIC_DIR, 'm', 'login.html'), 'text/html; charset=utf-8');
+        }
         // v1.2.3 — vendored third-party assets (Chart.js etc). Whitelist by
         // filename pattern to keep the static surface tight. Public on
         // purpose — no auth gate (third-party libs aren't secrets).
@@ -725,6 +739,16 @@ export async function startWebServer(options) {
                 return;
             return handleSearchTest(req, res);
         }
+        // v1.2.129 — mobile QR. Admin generates a fresh role=user token with
+        // a date-stamped label and gets back a QR data URL + the raw login
+        // URL. The token persists until the admin revokes it via the regular
+        // /settings/security/tokens UI — there's no auto-expiry in this
+        // version (operator-managed lifecycle).
+        if (url.pathname === '/api/mobile/qr' && req.method === 'POST') {
+            if (!requireAdmin(req, res))
+                return;
+            return handleMobileQR(req, res);
+        }
         if (url.pathname === '/api/workspaces' && req.method === 'GET') {
             return handleListWorkspaces(req, res, url);
         }
@@ -3062,6 +3086,84 @@ async function handleSearchTest(req, res) {
         sendJson(res, 500, { error: err instanceof Error ? err.message : String(err) });
     }
 }
+/** POST /api/mobile/qr — admin generates a role=user token + QR data URL
+ *  pointing the scanner at /m/login?t=<raw>&next=/m/chat. The token is
+ *  long-lived (until the admin revokes it on /settings/security/tokens);
+ *  rationale: a 30-min TTL would invalidate the QR before the operator
+ *  can show it to anyone, and access-token.ts has no per-token TTL field.
+ *
+ *  Body: `{ host?: string, baseUrl?: string }` — optional override for
+ *  the URL embedded in the QR. Defaults to `<scheme>://<req.host>` so
+ *  the QR works on whatever hostname the admin reached the panel on
+ *  (loopback / LAN IP / cloudflared tunnel / reverse proxy). */
+async function handleMobileQR(req, res) {
+    try {
+        const body = await readBody(req, res);
+        const parsed = (() => {
+            try {
+                return JSON.parse(body || '{}');
+            }
+            catch {
+                return {};
+            }
+        })();
+        // Pick the base URL the QR scanner will hit. Priority:
+        //   1) caller-supplied baseUrl (admin can paste a public domain)
+        //   2) caller-supplied host (just the host:port, scheme auto-picked)
+        //   3) the Host header of THIS admin request (works for cloudflared
+        //      tunnels that the admin opened the panel through)
+        const isHttps = req.socket.encrypted === true
+            || String(req.headers['x-forwarded-proto'] || '').toLowerCase() === 'https';
+        const scheme = isHttps ? 'https' : 'http';
+        let base = (parsed.baseUrl || '').trim().replace(/\/+$/, '');
+        if (!base) {
+            const host = (parsed.host || req.headers.host || 'localhost').toString();
+            base = `${scheme}://${host}`;
+        }
+        // Token label: human-readable + sortable + revoke-friendly.
+        const now = new Date();
+        const stamp = `${now.getUTCFullYear()}${String(now.getUTCMonth() + 1).padStart(2, '0')}${String(now.getUTCDate()).padStart(2, '0')}-${String(now.getUTCHours()).padStart(2, '0')}${String(now.getUTCMinutes()).padStart(2, '0')}`;
+        if (!_tokenModule) {
+            sendError(res, 503, 'AUTH_NOT_READY', { message: 'auth module not ready' });
+            return;
+        }
+        const { createToken } = _tokenModule;
+        const created = createToken(`mobile-via-qr-${stamp}`, {
+            role: 'user',
+            actor: 'mobile-qr',
+        });
+        // URL the scanner hits. /m/login is public; it pulls t out of the
+        // URL, POSTs to /api/auth/login, drops the cookie, redirects.
+        // encodeURIComponent so a raw token with weird chars wouldn't break
+        // the URL — current raw tokens are URL-safe but be defensive.
+        const loginUrl = `${base}/m/login?t=${encodeURIComponent(created.raw)}&next=%2Fm%2Fchat`;
+        const QRCode = (await import('qrcode')).default;
+        // M error correction is enough for an opaque token; bigger margin
+        // helps phone scanners through screen glare.
+        const qrDataUrl = await QRCode.toDataURL(loginUrl, {
+            errorCorrectionLevel: 'M',
+            margin: 2,
+            width: 280,
+        });
+        // Audit: caller is already logged in admin (requireAdmin); we just
+        // emit the create event from createToken. Surface the URL+QR.
+        res.writeHead(200, {
+            'Content-Type': 'application/json; charset=utf-8',
+            'Cache-Control': 'no-store',
+        });
+        res.end(JSON.stringify({
+            ok: true,
+            tokenId: created.id,
+            label: `mobile-via-qr-${stamp}`,
+            loginUrl,
+            qrDataUrl,
+            revokeHint: '/settings/security/tokens',
+        }));
+    }
+    catch (err) {
+        sendJson(res, 500, { error: err instanceof Error ? err.message : String(err) });
+    }
+}
 async function handleListBgjobs(_req, res, url) {
     try {
         const { resolveRoots, listJobsForRoot, listAllJobs } = await import('../core/bgjob-reader.js');