aims-workstation 0.1.1 → 0.1.2

package/README.md

@@ -19,7 +19,7 @@ npx aims-workstation
 # 打开 http://127.0.0.1:5600 → 系统设置里配置 ARM 源与 LLM 即可
 ```
 
-要求 **Node ≥ 22.5**（`node:sqlite` 依赖）。服务默认只绑定 `127.0.0.1`（本机工具，勿暴露局域网）。
+要求 **Node ≥ 22.5**（`node:sqlite` 依赖）。服务默认监听 `0.0.0.0`（局域网可访问，适合团队共用）；仅本机使用请设 `AIMS_HOST=127.0.0.1`。
 
 ## 配置
 
@@ -35,6 +35,7 @@ npx aims-workstation
 
 ## 安全模型
 
+- **访问令牌**（可选）：设置页「访问安全」启用后，所有 API 需认证——浏览器登录换 HttpOnly Cookie，脚本用 `Authorization: Bearer <token>`；替换令牌即踢掉所有已登录设备
 - 助手凭据与提示词分离；密钥只存本机（界面永远掩码）
 - 写操作 L2 挂起确认；毁灭性命令黑名单全级别拒绝
 - 面板代理出网白名单（仅插件声明过的主机）；数据集按助手×工作区物理隔离

package/package.json

@@ -13,7 +13,7 @@
     "@earendil-works/pi-ai": "^1.2.0"
   },
   "packageManager": "pnpm@11.21.0+sha512.521705bce689924eac72f5a3587122f362689ef6571e55ba80076fd637c11132ecffada26fad4ea79c485bfddbfd3d5a2a5b05805a77e893de71ec8a6cca3bb1",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "AIMS 工作站：本地智能体工作站——ARM 助手本地化（下载/离线/升级）、工作台对话式定制、多工作区隔离、分级自主与审计",
   "bin": {
     "aims-workstation": "bin/aims-workstation.js"

package/server.js

@@ -69,11 +69,11 @@ for (const envFile of [path.join(PKG_ROOT, '.env'), path.join(AIMS_HOME, '.env')
   } catch { /* .env 可选 */ }
 }
 const PORT = +(process.env.PORT || env.PORT || 5600);
-const HOST = process.env.AIMS_HOST || '127.0.0.1'; // 本机工具默认只绑回环（exec/目录浏览/面板动作不宜暴露局域网）
+const HOST = process.env.AIMS_HOST || '0.0.0.0'; // 默认局域网可达（团队共用）；仅本机使用可设 AIMS_HOST=127.0.0.1
 const ARM_MCP_URL = process.env.ARM_MCP_URL || env.ARM_MCP_URL;
 // ── 运行时配置（ARM 源与 LLM 均可私有化部署：在「系统设置」页切换，存 AIMS_HOME/config/platform.json，优先级 运行时 > 环境变量 > .env）──
 const CFG_FILE = path.join(AIMS_HOME, 'config/platform.json');
-const cfg = { arm_api_base: '', arm_mcp_url: '', arm_token: '', llm_base_url: '', llm_api_key: '', llm_model: '', scene_profile: '' };
+const cfg = { arm_api_base: '', arm_mcp_url: '', arm_token: '', llm_base_url: '', llm_api_key: '', llm_model: '', scene_profile: '', access_token: '' };
 function loadCfg() { try { Object.assign(cfg, JSON.parse(fs.readFileSync(CFG_FILE, 'utf8'))); } catch { } }
 loadCfg();
 function saveCfg() { fs.writeFileSync(CFG_FILE, JSON.stringify(cfg, null, 2)); }
@@ -90,6 +90,17 @@ const llmModelName = () => cfg.llm_model || env.LLM_MODEL || 'glm-5.3';
 // 与知识检索互补（常驻事实 vs 按需检索）；凭据不进画像（放"凭据在哪、找谁要"）。
 const sceneProfile = () => String(cfg.scene_profile || '').trim();
 const SCENE_PROFILE_MAX = 4000;
+// 访问令牌：启用后所有 /api/* 需认证（Cookie 或 Bearer），静态页面不拦；局域网开放时的基本防护
+const accessToken = () => String(cfg.access_token || '').trim();
+const AUTH_COOKIE = 'aims_auth';
+const authCookieValue = () => crypto.createHash('sha256').update('aims:' + accessToken()).digest('hex');
+const authOk = (req) => {
+  if (!accessToken()) return true; // 未启用=开放
+  const cookie = String(req.headers.cookie || '');
+  if (cookie.includes(`${AUTH_COOKIE}=${authCookieValue()}`)) return true;
+  return req.headers.authorization === `Bearer ${accessToken()}`;
+};
+const safeEqual = (a, b) => String(a).length === String(b).length && crypto.timingSafeEqual(Buffer.from(String(a)), Buffer.from(String(b)));
 let ARM_PAT = env.ARM_PAT || '';
 if (!ARM_PAT) {
   try { ARM_PAT = JSON.parse(fs.readFileSync(path.join(process.env.HOME, '.arm/config.json'), 'utf8')).token || ''; }
@@ -1168,8 +1179,8 @@ function devSystemPrompt() {
 async function devChatLoop(session, emit) {
   const events = [];
   const tools = Object.entries(DEV_TOOLS).map(([n, t]) => ({ name: n, description: t.desc, parameters: { type: 'object', properties: t.schema, required: t.required || [] } }));
-  for (let round = 0; round < 24; round++) {
-    emit('status', { text: `第 ${round + 1}/24 轮` });
+  for (let round = 0; round < 32; round++) {
+    emit('status', { text: `第 ${round + 1}/32 轮` });
     const stream = models.stream(model, session.context);
     for await (const ev of stream) {
       if (ev.type === 'text_delta') emit('text_delta', { delta: ev.delta });
@@ -1263,7 +1274,7 @@ async function ensureSession(sessionId, agentId, autonomyLevel, wsId) {
 }
 
 // 运行一轮 Agent 循环，事件通过 emit(type, data) 推给 SSE；s.running/s.statusText 供跨页面进度跟踪
-async function agentLoop(s, deployment, emit, maxRounds = 16) {
+async function agentLoop(s, deployment, emit, maxRounds = 32) {
   for (let round = 0; round < maxRounds; round++) {
     s.statusText = `第 ${round + 1}/${maxRounds} 轮 · 推理中`;
     const stream = models.stream(model, s.context);
@@ -1307,7 +1318,7 @@ async function agentLoop(s, deployment, emit, maxRounds = 16) {
       audit({ actor: 'assistant', agent: deployment.agent_id, tool: tc.name, autonomy: s.autonomy, ok: !isErr });
     }
   }
-  return { reply: '（达到工具调用轮次上限）', pending: null };
+  return { reply: '（达到工具调用轮次上限——回复「继续」可在完整上下文上续跑；也可在工作台 DSL 提高 max_rounds，上限 128）', pending: null };
 }
 
 // ── HTTP ────────────────────────────────────────────────
@@ -1333,6 +1344,18 @@ const server = http.createServer(async (req, res) => {
       }
       return json(res, 404, { error: '前端未构建：cd web && pnpm build' });
     }
+    // ── 访问认证（启用令牌后：API 需 Cookie/Bearer；静态页面开放；health 化身只报 auth_required）──
+    if (req.method === 'POST' && pathname === '/api/auth/login') {
+      const { token } = await body(req);
+      if (!accessToken()) return json(res, 200, { ok: true, auth_required: false });
+      if (!token || !safeEqual(token, accessToken())) return json(res, 401, { error: '访问令牌不正确' });
+      res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8', 'Set-Cookie': `${AUTH_COOKIE}=${authCookieValue()}; HttpOnly; Path=/; SameSite=Lax; Max-Age=2592000` });
+      return res.end(JSON.stringify({ ok: true }));
+    }
+    if (!authOk(req) && pathname.startsWith('/api')) {
+      if (pathname === '/api/health') return json(res, 200, { ok: true, auth_required: true }); // 前端据此弹登录门
+      return json(res, 401, { error: '需要访问令牌', code: 'AUTH_REQUIRED' });
+    }
     if (req.method === 'GET' && pathname === '/api/health') return json(res, 200, { ok: true, model: model?.id, arm: armMcpUrl(), pat: !!ARM_PAT, local_agents: loadRegistry().agents.length });
 
     // ── ARM 连接与同步（07：大厅双视图 = 本地助手库 ∪ 远端目录）──
@@ -1353,10 +1376,13 @@ const server = http.createServer(async (req, res) => {
           key_source: cfg.llm_api_key ? 'runtime' : (env.LLM_API_KEY ? 'env' : 'none'),
         },
         scene: { profile: sceneProfile(), length: sceneProfile().length },
+        auth: { enabled: !!accessToken(), token_masked: accessToken() ? `${accessToken().slice(0, 4)}…${accessToken().slice(-2)}` : '' },
       });
     }
     if (req.method === 'PUT' && pathname === '/api/settings') {
-      const { arm_api_base, arm_mcp_url, arm_token, llm_base_url, llm_api_key, llm_model, scene_profile } = await body(req);
+      const { arm_api_base, arm_mcp_url, arm_token, llm_base_url, llm_api_key, llm_model, scene_profile, access_token } = await body(req);
+      let authChanged = false;
+      if (access_token !== undefined) { const t = String(access_token || '').trim(); authChanged = t !== accessToken(); cfg.access_token = t; } // 置空=关闭认证
       const normUrl = (u) => { const s = String(u || '').trim().replace(/\/+$/, ''); return s; };
       let sceneChanged = false;
       if (scene_profile !== undefined) {
@@ -1399,7 +1425,7 @@ const server = http.createServer(async (req, res) => {
         try { llm_probe = await llmProbe(); } catch (e) { llm_probe = { online: false, error: String(e.message).slice(0, 150) }; }
       }
       saveCfg();
-      audit({ actor: 'settings', action: 'save', arm_api_base: cfg.arm_api_base, mcp_explicit: !!cfg.arm_mcp_url, llm_model: cfg.llm_model, llm_base_changed: llm_base_url !== undefined, token_changed: arm_token !== undefined || llm_api_key !== undefined, scene_profile_changed: sceneChanged, scene_profile_len: sceneProfile().length });
+      audit({ actor: 'settings', action: 'save', arm_api_base: cfg.arm_api_base, mcp_explicit: !!cfg.arm_mcp_url, llm_model: cfg.llm_model, llm_base_changed: llm_base_url !== undefined, token_changed: arm_token !== undefined || llm_api_key !== undefined, scene_profile_changed: sceneChanged, scene_profile_len: sceneProfile().length, auth_changed: authChanged });
       // ARM 保存后即时探测（失败不回滚：允许先配置后启动 ARM）
       let probe = { online: false, error: '' };
       if ([arm_api_base, arm_mcp_url, arm_token].some((v) => v !== undefined)) {
@@ -1885,7 +1911,7 @@ const server = http.createServer(async (req, res) => {
         s.context.messages.push({ role: 'user', content: context ? `${message}\n（界面注入上下文：当前选中设备 ${context.device}）` : message, timestamp: Date.now() });
         const wb = loadDraft(agentId) || loadWorkbench(agentId) || {};
         s.running = true; s.sinceTs = Date.now();
-        const out = await agentLoop(s, deployment, emit, Math.max(1, +(wb.max_rounds) || 16));
+        const out = await agentLoop(s, deployment, emit, Math.min(128, Math.max(1, +(wb.max_rounds) || 32)));
         emit('done', { reply: out.reply, pending: out.pending });
       } catch (e) { emit('error', { message: e.message }); }
       finally { const s = sessions.get(sessionId); if (s) { s.running = false; s.statusText = ''; } }
@@ -1912,7 +1938,7 @@ const server = http.createServer(async (req, res) => {
         }
         const wb = loadDraft(s.agentId) || loadWorkbench(s.agentId) || {};
         s.running = true; s.sinceTs = Date.now();
-        const out = await agentLoop(s, deployment, emit, Math.max(1, +(wb.max_rounds) || 16));
+        const out = await agentLoop(s, deployment, emit, Math.min(128, Math.max(1, +(wb.max_rounds) || 32)));
         emit('done', { reply: out.reply, pending: out.pending });
       } catch (e) { emit('error', { message: e.message }); }
       finally { if (s) { s.running = false; s.statusText = ''; } }