codexmate 0.0.33 → 0.0.34

package/cli/agents-files.js

@@ -92,6 +92,9 @@ function createAgentsFileController(deps = {}) {
     function applyClaudeMdFile(params = {}) {
         const filePath = resolveClaudeMdFilePath();
         const content = typeof params.content === 'string' ? params.content : '';
+        if (content.length > 2 * 1024 * 1024) {
+            return { error: '内容过大（最大 2MB）' };
+        }
         const lineEnding = params.lineEnding === '\r\n' ? '\r\n' : '\n';
         const normalized = normalizeLineEnding(content, lineEnding);
         const finalContent = ensureUtf8Bom(normalized);
@@ -150,6 +153,9 @@ function createAgentsFileController(deps = {}) {
         }
 
         const content = typeof params.content === 'string' ? params.content : '';
+        if (content.length > 2 * 1024 * 1024) {
+            return { error: '内容过大（最大 2MB）' };
+        }
         const lineEnding = params.lineEnding === '\r\n' ? '\r\n' : '\n';
         const normalized = normalizeLineEnding(content, lineEnding);
         const finalContent = ensureUtf8Bom(normalized);

package/cli/archive-helpers.js

@@ -4,6 +4,7 @@ function createArchiveHelperController(deps = {}) {
         path,
         os,
         execSync,
+        execFileSync,
         zipLib,
         yauzl,
         ensureDir,
@@ -341,8 +342,11 @@ function createArchiveHelperController(deps = {}) {
 
             const zipTool = resolveZipTool();
             if (zipTool.type === 'zip') {
-                const cmd = `"${zipTool.cmd}" -0 -q -r "${zipFilePath}" "${dirPath}"`;
-                execSync(cmd, { stdio: 'ignore' });
+                if (typeof execFileSync === 'function') {
+                    execFileSync(zipTool.cmd, ['-0', '-q', '-r', zipFilePath, dirPath], { stdio: 'ignore' });
+                } else {
+                    execSync(`"${zipTool.cmd}" -0 -q -r "${zipFilePath}" "${dirPath}"`, { stdio: 'ignore' });
+                }
             } else {
                 await zipWithLibrary(dirPath, zipFilePath);
             }
@@ -371,8 +375,11 @@ function createArchiveHelperController(deps = {}) {
 
         try {
             if (zipTool.type === 'zip') {
-                const cmd = `"${zipTool.cmd}" -0 -q -r "${zipFilePath}" "${dirPath}"`;
-                execSync(cmd, { stdio: 'ignore' });
+                if (typeof execFileSync === 'function') {
+                    execFileSync(zipTool.cmd, ['-0', '-q', '-r', zipFilePath, dirPath], { stdio: 'ignore' });
+                } else {
+                    execSync(`"${zipTool.cmd}" -0 -q -r "${zipFilePath}" "${dirPath}"`, { stdio: 'ignore' });
+                }
             } else {
                 await zipWithLibrary(dirPath, zipFilePath);
             }

package/cli/local-bridge.js

@@ -74,7 +74,7 @@ function buildClaudeUpstreamPool(claudeProvidersFile, excludedProviders) {
         if (excludedSet.has(name.toLowerCase())) continue;
         const baseUrl = typeof p.baseUrl === 'string' ? p.baseUrl.trim() : '';
         if (!baseUrl || !isValidHttpUrl(normalizeBaseUrl(baseUrl))) continue;
-        pool.push({ name, baseUrl: normalizeBaseUrl(baseUrl), apiKey: typeof p.apiKey === 'string' ? p.apiKey : '' });
+        pool.push({ name, baseUrl: normalizeBaseUrl(baseUrl), apiKey: typeof p.apiKey === 'string' ? p.apiKey : '', model: typeof p.model === 'string' ? p.model.trim() : '' });
     }
     if (pool.length === 0) return { error: '请先添加可用的 Claude 上游提供商' };
     return { pool };
@@ -271,7 +271,7 @@ function createLocalBridgeHttpHandler(options = {}) {
                     return;
                 }
                 res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
-                res.end(JSON.stringify({ object: 'codexmate.claude_local_bridge', provider: entry.name, status: 'ok', pool: pool.map(p => p.name) }));
+                res.end(JSON.stringify({ object: 'codexmate.claude_local_bridge', provider: entry.name, model: entry.model || '', status: 'ok', pool: pool.map(p => p.name) }));
                 return;
             }
 
@@ -285,7 +285,12 @@ function createLocalBridgeHttpHandler(options = {}) {
 
             let parsedBody;
             try { parsedBody = bodyResult.body ? JSON.parse(bodyResult.body) : {}; } catch (_) { parsedBody = {}; }
+            // Override model to match the selected upstream provider
+            if (entry.model && parsedBody && typeof parsedBody === 'object') {
+                parsedBody.model = entry.model;
+            }
             const wantsStream = !!(parsedBody && parsedBody.stream);
+            const bodyToForward = JSON.stringify(parsedBody);
             const upstreamUrl = joinApiUrl(entry.baseUrl.replace(/\/+$/, ''), suffix);
             const headers = { 'Content-Type': 'application/json' };
             if (entry.apiKey) {
@@ -300,7 +305,7 @@ function createLocalBridgeHttpHandler(options = {}) {
                 // Streaming proxy: pipe upstream SSE directly to client
                 const upstreamResult = await streamClaudeUpstream(upstreamUrl, {
                     method: req.method || 'POST',
-                    body: bodyResult.body,
+                    body: bodyToForward,
                     headers,
                     maxBytes: maxUpstreamBytes,
                     httpAgent,
@@ -322,7 +327,7 @@ function createLocalBridgeHttpHandler(options = {}) {
             // Non-streaming proxy
             const upstreamResult = await retryTransientRequest(() => proxyRequestJson(upstreamUrl, {
                 method: req.method || 'POST',
-                body: bodyResult.body || null,
+                body: bodyToForward || null,
                 headers,
                 maxBytes: maxUpstreamBytes,
                 httpAgent,

package/cli/openai-bridge.js

@@ -5,7 +5,7 @@ const { StringDecoder } = require('string_decoder');
 const { readJsonFile, writeJsonAtomic } = require('../lib/cli-file-utils');
 const { isValidHttpUrl, normalizeBaseUrl, joinApiUrl } = require('../lib/cli-utils');
 
-const DEFAULT_BRIDGE_TOKEN = 'codexmate';
+const DEFAULT_BRIDGE_TOKEN = crypto.randomBytes(16).toString('hex');
 const SETTINGS_VERSION = 1;
 // 推理模型 reasoning 阶段可能长时间无字节输出，需匹配 codex 的 stream_idle_timeout_ms=300000。
 const STREAM_IDLE_TIMEOUT_MS = 5 * 60 * 1000;

package/cli/update.js

@@ -1,5 +1,6 @@
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const https = require('https');
 const { execSync, spawn } = require('child_process');
 
@@ -147,8 +148,16 @@ function updateViaStandalone(version) {
     if (process.platform !== 'win32') {
         console.log('[Update] 尝试自动执行安装脚本...');
         try {
-            const script = 'curl -fsSL https://raw.githubusercontent.com/SakuraByteCore/codexmate/main/scripts/install.sh | bash';
-            execSync(script, { stdio: 'inherit' });
+            const crypto = require('crypto');
+            const tmpScript = path.join(os.tmpdir(), `codexmate-install-${Date.now()}.sh`);
+            const { execFileSync, execSync: _unused } = require('child_process');
+            execSync(`curl -fsSL -o "${tmpScript}" https://raw.githubusercontent.com/SakuraByteCore/codexmate/main/scripts/install.sh`, { stdio: 'inherit' });
+            const scriptContent = fs.readFileSync(tmpScript, 'utf-8');
+            const checksum = crypto.createHash('sha256').update(scriptContent).digest('hex');
+            console.log(`[Update] Script checksum: ${checksum}`);
+            fs.chmodSync(tmpScript, 0o755);
+            execFileSync('bash', [tmpScript], { stdio: 'inherit' });
+            try { fs.unlinkSync(tmpScript); } catch (_) {}
         } catch (e) {
             console.warn('[Update] 自动脚本执行失败，请手动运行。');
         }

package/cli.js

@@ -7,7 +7,7 @@ const toml = require('@iarna/toml');
 const JSON5 = require('json5');
 const zipLib = require('zip-lib');
 const yauzl = require('yauzl');
-const { exec, execSync, spawn, spawnSync } = require('child_process');
+const { exec, execSync, execFileSync, spawn, spawnSync } = require('child_process');
 const http = require('http');
 const https = require('https');
 const net = require('net');
@@ -175,7 +175,7 @@ const {
 } = require('./lib/download-artifacts');
 
 const DEFAULT_WEB_PORT = 3737;
-const DEFAULT_WEB_HOST = '0.0.0.0';
+const DEFAULT_WEB_HOST = '127.0.0.1';
 const DEFAULT_WEB_OPEN_HOST = '127.0.0.1';
 
 // ============================================================================
@@ -758,7 +758,7 @@ function updateAuthJson(apiKey) {
         } catch (e) { }
     }
     authData['OPENAI_API_KEY'] = apiKey;
-    fs.writeFileSync(AUTH_FILE, JSON.stringify(authData, null, 2), 'utf-8');
+    fs.writeFileSync(AUTH_FILE, JSON.stringify(authData, null, 2), { encoding: 'utf-8', mode: 0o600 });
 }
 
 function isPlainObject(value) {
@@ -1711,6 +1711,7 @@ const {
     path,
     os,
     execSync,
+    execFileSync,
     zipLib,
     yauzl,
     ensureDir,
@@ -4234,6 +4235,9 @@ function parseClaudeSessionSummary(filePath, options = {}) {
 
     const tailRecords = parseJsonlTailRecords(filePath, summaryReadBytes);
     for (const record of tailRecords) {
+        if (record && record.timestamp) {
+            updatedAt = updateLatestIso(updatedAt, record.timestamp);
+        }
         applySessionUsageSummaryFromRecord(usageState, record, 'claude');
         totalTokens = usageState.totalTokens || 0;
         contextWindow = usageState.contextWindow || 0;
@@ -4741,8 +4745,8 @@ function listClaudeSessions(limit, options = {}) {
                 continue;
             }
 
-            const updatedAt = toIsoTime(entry.modified || entry.fileMtime, '');
-            const createdAt = toIsoTime(entry.created, '');
+            let updatedAt = toIsoTime(entry.modified || entry.fileMtime, fileStat.mtime.toISOString());
+            let createdAt = toIsoTime(entry.created, '');
             let title = truncateText(entry.summary || entry.firstPrompt || sessionId, 120);
             let messageCount = Number.isFinite(entry.messageCount) ? Math.max(0, entry.messageCount - 1) : 0;
             let totalTokens = 0;
@@ -4774,6 +4778,12 @@ function listClaudeSessions(limit, options = {}) {
 
                 const quickMessages = [];
                 for (const record of quickRecords) {
+                    if (record && record.timestamp) {
+                        if (!createdAt) {
+                            createdAt = toIsoTime(record.timestamp, createdAt);
+                        }
+                        updatedAt = updateLatestIso(updatedAt, record.timestamp);
+                    }
                     applySessionUsageSummaryFromRecord(usageState, record, 'claude');
                     const recordModels = readSessionModelsFromRecord(record);
                     for (const recordModel of recordModels) {
@@ -4804,6 +4814,12 @@ function listClaudeSessions(limit, options = {}) {
 
             const tailRecords = parseJsonlTailRecords(filePath, summaryReadBytes);
             for (const record of tailRecords) {
+                if (record && record.timestamp) {
+                    if (!createdAt) {
+                        createdAt = toIsoTime(record.timestamp, createdAt);
+                    }
+                    updatedAt = updateLatestIso(updatedAt, record.timestamp);
+                }
                 applySessionUsageSummaryFromRecord(usageState, record, 'claude');
                 const recordModels = readSessionModelsFromRecord(record);
                 for (const recordModel of recordModels) {
@@ -7892,7 +7908,7 @@ function normalizeImportPayload(payload) {
             const name = item.name || item.provider || '';
             const baseUrl = item.baseUrl || item.base_url || item.url || '';
             const apiKey = item.apiKey ?? item.key ?? item.preferred_auth_method ?? null;
-            if (name && baseUrl) {
+            if (name && baseUrl && /^[a-zA-Z0-9_\-.\s]+$/.test(name)) {
                 providers[name] = { baseUrl, apiKey };
             }
         }
@@ -7901,7 +7917,7 @@ function normalizeImportPayload(payload) {
             if (!item || typeof item !== 'object') continue;
             const baseUrl = item.baseUrl || item.base_url || item.url || '';
             const apiKey = item.apiKey ?? item.key ?? item.preferred_auth_method ?? null;
-            if (name && baseUrl) {
+            if (name && baseUrl && /^[a-zA-Z0-9_\-.\s]+$/.test(name)) {
                 providers[name] = { baseUrl, apiKey };
             }
         }
@@ -9237,6 +9253,9 @@ function applyClaudeSettingsRaw(params = {}) {
     if (!content.trim()) {
         return { error: '内容不能为空' };
     }
+    if (content.length > 1024 * 1024) {
+        return { error: '内容过大（最大 1MB）' };
+    }
     let parsed;
     try {
         parsed = JSON.parse(content);
@@ -10119,7 +10138,7 @@ function assertRequestAuthorized(req, res) {
         return { ok: false, mode: 'missing-token' };
     }
     const actual = extractRequestToken(req);
-    if (!actual || actual !== expected) {
+    if (!actual || !safeTimingEqual(actual, expected)) {
         writeJsonResponse(res, 401, { error: 'Unauthorized' });
         return { ok: false, mode: 'unauthorized' };
     }
@@ -10576,7 +10595,38 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
         res.end('Internal Server Error');
     };
 
+    const rateLimitMap = new Map();
+    const RATE_LIMIT_WINDOW_MS = 60000;
+    const RATE_LIMIT_MAX = 120;
+    function checkRateLimit(key) {
+        const now = Date.now();
+        const entry = rateLimitMap.get(key);
+        if (!entry || now - entry.start > RATE_LIMIT_WINDOW_MS) {
+            rateLimitMap.set(key, { start: now, count: 1 });
+            return true;
+        }
+        entry.count++;
+        if (entry.count > RATE_LIMIT_MAX) return false;
+        return true;
+    }
+    setInterval(function () {
+        const now = Date.now();
+        for (const [key, entry] of rateLimitMap.entries()) {
+            if (now - entry.start > RATE_LIMIT_WINDOW_MS * 2) rateLimitMap.delete(key);
+        }
+    }, RATE_LIMIT_WINDOW_MS).unref();
+
     const server = http.createServer((req, res) => {
+        const securityHeaders = {
+            'X-Content-Type-Options': 'nosniff',
+            'X-Frame-Options': 'DENY',
+            'Content-Security-Policy': "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ws: wss:"
+        };
+        const origWriteHead = res.writeHead.bind(res);
+        res.writeHead = function (statusCode, headers) {
+            const merged = Object.assign({}, securityHeaders, headers || {});
+            return origWriteHead(statusCode, merged);
+        };
         const requestPath = (req.url || '/').split('?')[0];
         const sendJson = (statusCode, payload) => {
             const body = JSON.stringify(payload || {}, null, 2);
@@ -10604,6 +10654,12 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                 || remoteAddr === '::1'
                 || remoteAddr === '::ffff:127.0.0.1';
             if (!isLoopback) {
+                const rateLimitKey = (remoteAddr || 'unknown') + ':' + requestPath;
+                if (!checkRateLimit(rateLimitKey)) {
+                    res.writeHead(429, { 'Content-Type': 'application/json; charset=utf-8', 'Retry-After': '60' });
+                    res.end(JSON.stringify({ error: 'Rate limit exceeded' }));
+                    return;
+                }
                 const expected = typeof process.env.CODEXMATE_HTTP_TOKEN === 'string'
                     ? process.env.CODEXMATE_HTTP_TOKEN.trim()
                     : '';
@@ -10619,7 +10675,7 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                 const actual = match && match[1]
                     ? match[1].trim()
                     : (rawAuth ? rawAuth : (typeof headers['x-codexmate-token'] === 'string' ? String(headers['x-codexmate-token']).trim() : ''));
-                if (!actual || actual !== expected) {
+                if (!actual || !safeTimingEqual(actual, expected)) {
                     sendJson(401, { error: 'Unauthorized' });
                     return;
                 }

package/lib/cli-webhook.js

@@ -3,10 +3,33 @@ const fs = require('fs');
 const http = require('http');
 const https = require('https');
 const os = require('os');
+const net = require('net');
 
 const ALLOWED_EVENTS = ['provider-switch', 'claude-md-edit'];
 const DEFAULT_TIMEOUT_MS = 5000;
 
+function isPrivateNetworkHost(hostname) {
+    const host = typeof hostname === 'string' ? hostname.trim().toLowerCase() : '';
+    if (!host) return true;
+    if (host === 'localhost') return true;
+    const ipVer = net.isIP(host);
+    if (!ipVer) return false;
+    if (ipVer === 4) {
+        const parts = host.split('.').map(function (x) { return parseInt(x, 10); });
+        if (parts[0] === 10) return true;
+        if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) return true;
+        if (parts[0] === 192 && parts[1] === 168) return true;
+        if (parts[0] === 127) return true;
+        if (parts[0] === 0) return true;
+        if (parts[0] === 169 && parts[1] === 254) return true;
+        return false;
+    }
+    if (host === '::1' || host === '::') return true;
+    if (host.startsWith('fc') || host.startsWith('fd')) return true;
+    if (host.startsWith('fe80')) return true;
+    return false;
+}
+
 function defaultConfigPath() {
     return path.join(os.homedir(), '.codex', 'codexmate-webhook.json');
 }
@@ -42,7 +65,7 @@ function saveWebhookConfig(cfg, filePath) {
     try {
         fs.mkdirSync(path.dirname(target), { recursive: true });
     } catch (_) {}
-    fs.writeFileSync(target, JSON.stringify(normalized, null, 2), 'utf-8');
+    fs.writeFileSync(target, JSON.stringify(normalized, null, 2), { encoding: 'utf-8', mode: 0o600 });
     return normalized;
 }
 
@@ -55,6 +78,11 @@ function postJson(targetUrl, payload, timeoutMs) {
             resolve({ ok: false, error: 'invalid-url' });
             return;
         }
+        const allowPrivateWebhook = process.env.CODEXMATE_ALLOW_PRIVATE_WEBHOOK === '1';
+        if (!allowPrivateWebhook && isPrivateNetworkHost(parsed.hostname || '')) {
+            resolve({ ok: false, error: 'Refusing to send webhook to private network host' });
+            return;
+        }
         const transport = parsed.protocol === 'https:' ? https : http;
         const body = JSON.stringify(payload || {});
         let req;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codexmate",
-  "version": "0.0.33",
+  "version": "0.0.34",
   "description": "Codex/Claude Code/OpenClaw 配置、会话与任务编排 CLI + Web 工具",
   "main": "cli.js",
   "bin": {

package/web-ui/app.js

@@ -71,6 +71,9 @@ document.addEventListener('DOMContentLoaded', () => {
                 showAgentsModal: false,
                 showSkillsModal: false,
                 showHealthCheckModal: false,
+                showCodexBridgePoolModal: false,
+                showClaudeBridgePoolModal: false,
+                showWebhookModal: false,
                 // Plugins
                 pluginsActiveId: 'prompt-templates',
                 pluginsLoading: false,
@@ -98,6 +101,7 @@ document.addEventListener('DOMContentLoaded', () => {
                 confirmDialogResolver: null,
                 configTemplateContent: '',
                 configTemplateApplying: false,
+                configTemplateContext: 'codex',
                 configTemplateDiffVisible: false,
                 configTemplateDiffLoading: false,
                 configTemplateDiffError: '',

package/web-ui/index.html

@@ -26,6 +26,7 @@
     <!-- @include ./partials/index/panel-plugins.html -->
     <!-- @include ./partials/index/layout-footer.html -->
     <!-- @include ./partials/index/modals-basic.html -->
+    <!-- @include ./partials/index/modal-webhook.html -->
     <!-- @include ./partials/index/modal-openclaw-config.html -->
     <!-- @include ./partials/index/modal-config-template-agents.html -->
     <!-- @include ./partials/index/modal-skills.html -->

package/web-ui/logic.claude.mjs

@@ -111,6 +111,10 @@ export function matchClaudeConfigFromSettings(claudeConfigs = {}, env = {}) {
     if (!normalizedSettings.baseUrl || !normalizedSettings.model || !hasClaudeCredential(normalizedSettings)) {
         return '';
     }
+    // 检测本地桥接 URL
+    if (typeof normalizedSettings.baseUrl === 'string' && normalizedSettings.baseUrl.includes('/bridge/claude-local/')) {
+        return 'claude-local';
+    }
     const comparableSettingsUrl = normalizeClaudeComparableUrl(normalizedSettings.baseUrl);
     const entries = Object.entries(claudeConfigs || {});
     for (const [name, config] of entries) {

package/web-ui/modules/app.methods.claude-config.mjs

@@ -264,6 +264,43 @@ export function createClaudeConfigMethods(options = {}) {
 
         claudeLocalBridgeConfigured() {
             return this.claudeLocalBridgeCandidateProviders().some(p => p.hasKey);
+        },
+
+        async applyClaudeLocalBridge() {
+            this.currentClaudeConfig = 'claude-local';
+            try { localStorage.setItem('currentClaudeConfig', 'claude-local'); } catch (_) {}
+            this.refreshClaudeModelContext();
+
+            const candidates = this.claudeLocalBridgeCandidateProviders();
+            if (candidates.length === 0) {
+                return this.showMessage('请先添加并配置至少一个 Claude 提供商', 'error');
+            }
+
+            try {
+                const res = await api('claude-local-bridge-toggle', { enable: true });
+                if (res.error) {
+                    this.showMessage(res.error || '启用本地负载均衡失败', 'error');
+                    return;
+                }
+                this.showMessage('Claude 本地负载均衡已启用', 'success');
+            } catch (e) {
+                this.showMessage('启用本地负载均衡失败', 'error');
+            }
+        },
+
+        async openClaudeConfigTemplateEditor() {
+            try {
+                const res = await api('get-claude-settings-raw');
+                if (res.error) {
+                    this.showMessage(res.error, 'error');
+                    return;
+                }
+                this.configTemplateContent = res.content || '{}';
+                this.configTemplateContext = 'claude';
+                this.showConfigTemplateModal = true;
+            } catch (e) {
+                this.showMessage('加载 Claude settings 失败', 'error');
+            }
         }
     };
 }

package/web-ui/modules/app.methods.codex-config.mjs

@@ -558,6 +558,7 @@ export function createCodexConfigMethods(options = {}) {
                     template = `${template.trimEnd()}\n\n${appendBlock}\n`;
                 }
                 this.configTemplateContent = template;
+                this.configTemplateContext = 'codex';
                 this.showConfigTemplateModal = true;
             } catch (e) {
                 this.showMessage('加载模板失败', 'error');
@@ -807,9 +808,16 @@ export function createCodexConfigMethods(options = {}) {
             const performApply = async () => {
                 this.configTemplateApplying = true;
                 try {
-                    const res = await api('apply-config-template', {
-                        template: this.configTemplateContent
-                    });
+                    let res;
+                    if (this.configTemplateContext === 'claude') {
+                        res = await api('apply-claude-settings-raw', {
+                            content: this.configTemplateContent
+                        });
+                    } else {
+                        res = await api('apply-config-template', {
+                            template: this.configTemplateContent
+                        });
+                    }
                     if (res.error) {
                         this.showMessage(res.error, 'error');
                         return;

package/web-ui/modules/app.methods.navigation.mjs

@@ -419,6 +419,20 @@
                 mainTab: targetTab,
                 configMode: targetTab === 'config' ? this.configMode : this.configMode
             });
+            if (targetTab !== 'sessions') {
+                try {
+                    const url = new URL(window.location.href);
+                    if (url.pathname !== '/session') {
+                        url.searchParams.delete('s_source');
+                        url.searchParams.delete('s_path');
+                        url.searchParams.delete('s_query');
+                        url.searchParams.delete('s_role');
+                        url.searchParams.delete('s_time');
+                        url.searchParams.delete('tab');
+                        window.history.replaceState(null, '', url.toString());
+                    }
+                } catch (_) {}
+            }
             this.cancelTouchNavIntentReset();
             if (targetTab === 'sessions') {
                 this.cancelScheduledSessionTabDeferredTeardown();

package/web-ui/modules/app.methods.session-browser.mjs

@@ -479,14 +479,13 @@ export function createSessionBrowserMethods(options = {}) {
             if (typeof text !== 'string' || !text) return text;
             var tokens = this.queryTokens;
             if (!tokens || tokens.length === 0) return text;
-            var result = text;
+            var escaped = text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
             for (var i = 0; i < tokens.length; i++) {
-                var token = tokens[i];
-                var escaped = token.replace(/[.*+?^${}()|[\]\\]/g, '\\        async onSessionSourceChange(event) {');
-                var re = new RegExp('(' + escaped + ')', 'gi');
-                result = result.replace(re, '<mark>$1</mark>');
+                var token = tokens[i].replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                var re = new RegExp('(' + token + ')', 'gi');
+                escaped = escaped.replace(re, '<mark>$1</mark>');
             }
-            return result;
+            return escaped;
         },
 
         async onSessionSourceChange(event) {

package/web-ui/modules/app.methods.startup-claude.mjs

@@ -383,6 +383,15 @@ export function createStartupClaudeMethods(options = {}) {
         },
 
         syncClaudeModelFromConfig() {
+            if (this.currentClaudeConfig === 'claude-local') {
+                const candidates = this.claudeLocalBridgeCandidateProviders
+                    ? this.claudeLocalBridgeCandidateProviders()
+                    : [];
+                const active = candidates.find(cp => !this.isClaudeLocalBridgeExcluded(cp.name));
+                this.currentClaudeModel = active && active.model ? active.model : '';
+                this.claudeCustomModelDraft = this.currentClaudeModel;
+                return;
+            }
             const config = this.getCurrentClaudeConfig();
             this.currentClaudeModel = config && config.model ? config.model : '';
             this.claudeCustomModelDraft = this.currentClaudeModel;

package/web-ui/modules/app.methods.webhook.mjs

@@ -2,6 +2,14 @@ import { api } from './api.mjs';
 
 export function createWebhookMethods() {
     return {
+        openWebhookModal() {
+            this.showWebhookModal = true;
+        },
+
+        closeWebhookModal() {
+            this.showWebhookModal = false;
+        },
+
         async loadWebhookSettings() {
             try {
                 const data = await api('get-webhook-config');

package/web-ui/modules/i18n.dict.mjs

@@ -910,6 +910,7 @@ const DICT = Object.freeze({
         'settings.tab.general': '通用',
         'settings.tab.data': '数据',
         'settings.tabs.aria': '设置分类',
+        'settings.quickSettings.title': '快捷设置',
         'settings.sharePrefix.title': '分享命令前缀',
         'settings.sharePrefix.meta': '影响 Web UI 里“复制分享命令”的前缀',
         'settings.sharePrefix.label': '前缀',
@@ -1965,6 +1966,7 @@ const DICT = Object.freeze({
         'settings.tab.general': '一般',
         'settings.tab.data': 'データ',
         'settings.tabs.aria': '設定カテゴリ',
+        'settings.quickSettings.title': 'クイック設定',
         'settings.sharePrefix.title': '共有コマンドプレフィックス',
         'settings.sharePrefix.meta': 'Web UI の「共有コマンドをコピー」のプレフィックスに影響',
         'settings.sharePrefix.label': 'プレフィックス',
@@ -3034,6 +3036,7 @@ const DICT = Object.freeze({
         'settings.tab.general': 'General',
         'settings.tab.data': 'Data',
         'settings.tabs.aria': 'Settings categories',
+        'settings.quickSettings.title': 'Quick Settings',
         'settings.sharePrefix.title': 'Share command prefix',
         'settings.sharePrefix.meta': 'Used as the prefix for “Copy share command” in the Web UI',
         'settings.sharePrefix.label': 'Prefix',

package/web-ui/partials/index/modal-webhook.html

@@ -0,0 +1,42 @@
+	        <!-- Webhook 配置模态框 -->
+	        <div v-if="showWebhookModal" class="modal-overlay" @click.self="closeWebhookModal">
+	            <div class="modal" role="dialog" aria-modal="true" aria-labelledby="webhook-modal-title">
+	                <div class="modal-title" id="webhook-modal-title">Webhook 配置</div>
+
+	                <div class="form-group">
+	                    <label class="form-label">启用状态</label>
+	                    <label class="settings-toggle">
+	                        <input type="checkbox" v-model="webhookConfig.enabled">
+	                        <span>启用 Webhook</span>
+	                    </label>
+	                </div>
+
+	                <div class="form-group">
+	                    <label class="form-label">URL</label>
+	                    <input
+	                        v-model="webhookConfig.url"
+	                        class="form-input"
+	                        type="url"
+	                        placeholder="https://example.com/webhook"
+	                        autocomplete="off"
+	                        spellcheck="false">
+	                </div>
+
+	                <div class="form-group">
+	                    <label class="form-label">事件</label>
+	                    <div class="webhook-events-checkbox-list">
+	                        <label v-for="ev in webhookEventOptions" :key="ev" class="webhook-event-checkbox-item">
+	                            <input type="checkbox" :checked="webhookConfig.events.includes(ev)" @change="toggleWebhookEvent(ev)">
+	                            <span>{{ ev }}</span>
+	                        </label>
+	                    </div>
+	                </div>
+
+	                <div class="btn-group">
+	                    <button class="btn btn-cancel" @click="closeWebhookModal">取消</button>
+	                    <button class="btn btn-confirm" @click="saveWebhookSettings" :disabled="webhookSaving">
+	                        {{ webhookSaving ? '保存中...' : '保存' }}
+	                    </button>
+	                </div>
+	            </div>
+	        </div>