coding-tool-x 3.5.5 → 3.5.7

package/src/server/services/network-access.js

@@ -16,6 +16,21 @@ function isLoopbackAddress(address) {
   return false;
 }
 
+function hasTrustedProxySocket(req) {
+  if (!req) return false;
+  return isLoopbackAddress(req.socket && req.socket.remoteAddress);
+}
+
+function getForwardedHeaderValue(req, headerName) {
+  if (!hasTrustedProxySocket(req) || !req.headers) {
+    return '';
+  }
+
+  const rawValue = req.headers[headerName];
+  const value = Array.isArray(rawValue) ? rawValue[0] : rawValue;
+  return String(value || '').split(',')[0].trim();
+}
+
 function isLoopbackRequest(req) {
   if (!req) return false;
   const socketAddress = req.socket && req.socket.remoteAddress;
@@ -30,6 +45,34 @@ function isLoopbackRequest(req) {
   return true;
 }
 
+function getRequestProtocol(req) {
+  const forwardedProto = getForwardedHeaderValue(req, 'x-forwarded-proto').toLowerCase();
+  if (forwardedProto === 'https' || forwardedProto === 'https:') {
+    return 'https:';
+  }
+  if (forwardedProto === 'http' || forwardedProto === 'http:') {
+    return 'http:';
+  }
+  return req && req.socket && req.socket.encrypted ? 'https:' : 'http:';
+}
+
+function getRequestHost(req) {
+  const forwardedHost = getForwardedHeaderValue(req, 'x-forwarded-host');
+  if (forwardedHost) {
+    return forwardedHost;
+  }
+
+  if (!req || !req.headers) {
+    return '';
+  }
+
+  const host = req.headers.host;
+  if (Array.isArray(host)) {
+    return String(host[0] || '').trim();
+  }
+  return String(host || '').trim();
+}
+
 function isSameOriginRequest(req) {
   if (!req) return false;
   const origin = req.headers && req.headers.origin;
@@ -37,19 +80,32 @@ function isSameOriginRequest(req) {
     return true;
   }
 
-  const host = req.headers && req.headers.host;
+  const host = getRequestHost(req);
   if (!host) {
     return false;
   }
 
   try {
     const originUrl = new URL(origin);
-    return originUrl.host === host;
+    return originUrl.host.toLowerCase() === host.toLowerCase();
   } catch (error) {
     return false;
   }
 }
 
+function isRemoteMutationAllowed(envValue) {
+  if (envValue === undefined || envValue === null) {
+    return true;
+  }
+
+  const normalized = String(envValue).trim().toLowerCase();
+  if (!normalized) {
+    return true;
+  }
+
+  return !['0', 'false', 'no', 'off'].includes(normalized);
+}
+
 function createRemoteMutationGuard(options = {}) {
   const enabled = options.enabled === true;
   const allowRemoteMutation = options.allowRemoteMutation === true;
@@ -111,7 +167,10 @@ module.exports = {
   normalizeAddress,
   isLoopbackAddress,
   isLoopbackRequest,
+  getRequestProtocol,
+  getRequestHost,
   isSameOriginRequest,
+  isRemoteMutationAllowed,
   createRemoteMutationGuard,
   createRemoteRouteGuard,
   createSameOriginGuard

package/src/server/services/notification-hooks.js

@@ -5,9 +5,11 @@ const http = require('http');
 const https = require('https');
 const { execSync, execFileSync } = require('child_process');
 const { PATHS, NATIVE_PATHS } = require('../../config/paths');
+const { loadConfig } = require('../../config/loader');
 const { loadUIConfig, saveUIConfig } = require('./ui-config');
 const codexSettingsManager = require('./codex-settings-manager');
 const geminiSettingsManager = require('./gemini-settings-manager');
+const { getWebUiProtocol } = require('./web-ui-runtime');
 
 const MANAGED_HOOK_NAME = 'coding-tool-notify';
 const MANAGED_OPENCODE_PLUGIN_FILE = 'coding-tool-notify.js';
@@ -57,6 +59,13 @@ function getFeishuConfig() {
   };
 }
 
+function getBrowserNotificationConfig() {
+  const uiConfig = loadUIConfig();
+  return {
+    enabled: uiConfig.browserNotification?.enabled === true
+  };
+}
+
 function applyClaudeDisablePreference(uiConfig = {}, claudeEnabled) {
   const nextConfig = (uiConfig && typeof uiConfig === 'object') ? { ...uiConfig } : {};
   if (claudeEnabled) {
@@ -67,7 +76,7 @@ function applyClaudeDisablePreference(uiConfig = {}, claudeEnabled) {
   return nextConfig;
 }
 
-function saveNotificationUiConfig(feishu = {}, claudeEnabled) {
+function saveNotificationUiConfig(feishu = {}, browser = {}, claudeEnabled) {
   let uiConfig = loadUIConfig();
   if (typeof claudeEnabled === 'boolean') {
     uiConfig = applyClaudeDisablePreference(uiConfig, claudeEnabled);
@@ -76,6 +85,9 @@ function saveNotificationUiConfig(feishu = {}, claudeEnabled) {
     enabled: feishu.enabled === true,
     webhookUrl: feishu.webhookUrl || ''
   };
+  uiConfig.browserNotification = {
+    enabled: browser.enabled === true
+  };
   saveUIConfig(uiConfig);
 }
 
@@ -115,6 +127,85 @@ function removeNotifyScript() {
   }
 }
 
+function getNotificationSourceLabel(source = 'claude') {
+  switch (String(source || '').trim().toLowerCase()) {
+    case 'codex':
+      return 'Codex CLI';
+    case 'gemini':
+      return 'Gemini CLI';
+    case 'opencode':
+      return 'OpenCode';
+    default:
+      return 'Claude Code';
+  }
+}
+
+function resolveFallbackNotificationMessage(source = 'claude', eventType = '') {
+  const normalizedSource = String(source || '').trim().toLowerCase();
+  const normalizedEventType = String(eventType || '').trim();
+
+  if (normalizedSource === 'codex') {
+    if (normalizedEventType === 'agent-turn-complete') {
+      return 'Codex CLI 回合已完成 | 等待交互';
+    }
+    return 'Codex CLI 已返回结果 | 等待交互';
+  }
+
+  if (normalizedSource === 'gemini') {
+    return 'Gemini CLI 回合已完成 | 等待交互';
+  }
+
+  if (normalizedSource === 'opencode') {
+    if (normalizedEventType === 'session.error') {
+      return 'OpenCode 会话异常，请检查日志';
+    }
+    return 'OpenCode 响应已完成 | 等待交互';
+  }
+
+  return 'Claude Code 任务已完成 | 等待交互';
+}
+
+function buildBrowserNotificationEndpoint() {
+  try {
+    const config = loadConfig();
+    const port = Number(config?.ports?.webUI);
+    const resolvedPort = Number.isFinite(port) && port > 0 ? port : 19999;
+    const protocol = getWebUiProtocol();
+    return `${protocol}://127.0.0.1:${resolvedPort}/api/hooks/browser-event`;
+  } catch (error) {
+    return `${getWebUiProtocol()}://127.0.0.1:19999/api/hooks/browser-event`;
+  }
+}
+
+function buildBrowserNotificationPayload(input = {}) {
+  const rawSource = String(input?.source || '').trim().toLowerCase();
+  const source = ['claude', 'codex', 'gemini', 'opencode'].includes(rawSource) ? rawSource : 'claude';
+  const eventType = String(input?.eventType || input?.event_type || '').trim();
+  const rawMessage = String(input?.message || '').trim();
+  const timestamp = Number(input?.timestamp);
+
+  return {
+    title: String(input?.title || '').trim() || 'Coding Tool',
+    source,
+    sourceLabel: getNotificationSourceLabel(source),
+    mode: normalizeType(input?.mode),
+    eventType,
+    message: rawMessage || resolveFallbackNotificationMessage(source, eventType),
+    timestamp: Number.isFinite(timestamp) ? timestamp : Date.now()
+  };
+}
+
+function emitBrowserNotificationEvent(input = {}) {
+  const browser = getBrowserNotificationConfig();
+  if (!browser.enabled) {
+    return false;
+  }
+
+  const { broadcastBrowserNotification } = require('../websocket-server');
+  broadcastBrowserNotification(buildBrowserNotificationPayload(input));
+  return true;
+}
+
 function parseManagedType(input) {
   const value = String(input || '');
   const matches = [
@@ -433,8 +524,10 @@ function runWindowsPowerShellCommand(command) {
   });
 }
 
-function generateNotifyScript(feishu = {}) {
+function generateNotifyScript(feishu = {}, browser = {}) {
   const feishuEnabled = feishu.enabled === true && !!feishu.webhookUrl;
+  const browserEnabled = browser.enabled === true;
+  const browserEndpoint = browserEnabled ? buildBrowserNotificationEndpoint() : '';
 
   return `#!/usr/bin/env node
 // Coding Tool 通知脚本 - 自动生成，请勿手动修改
@@ -446,6 +539,8 @@ const { execSync, execFileSync } = require('child_process')
 
 const FEISHU_ENABLED = ${feishuEnabled ? 'true' : 'false'}
 const FEISHU_WEBHOOK_URL = ${JSON.stringify(feishuEnabled ? feishu.webhookUrl : '')}
+const BROWSER_ENABLED = ${browserEnabled ? 'true' : 'false'}
+const BROWSER_ENDPOINT = ${JSON.stringify(browserEndpoint)}
 
 function readArg(name) {
   const prefix = \`\${name}=\`
@@ -483,21 +578,25 @@ function readOptionalPayload() {
   return null
 }
 
-function resolveMessage(source, eventType, payload) {
-  const effectiveEventType = eventType || payload?.type || payload?.hook_event?.event_type || ''
+function resolveEventType(eventType, payload) {
+  return eventType || payload?.type || payload?.hook_event?.event_type || ''
+}
+
+function resolveMessage(source, effectiveEventType) {
+  const normalizedSource = String(source || '').trim().toLowerCase()
 
-  if (source === 'codex') {
+  if (normalizedSource === 'codex') {
     if (effectiveEventType === 'agent-turn-complete') {
       return 'Codex CLI 回合已完成 | 等待交互'
     }
     return 'Codex CLI 已返回结果 | 等待交互'
   }
 
-  if (source === 'gemini') {
+  if (normalizedSource === 'gemini') {
     return 'Gemini CLI 回合已完成 | 等待交互'
   }
 
-  if (source === 'opencode') {
+  if (normalizedSource === 'opencode') {
     if (effectiveEventType === 'session.error') {
       return 'OpenCode 会话异常，请检查日志'
     }
@@ -628,15 +727,67 @@ function sendFeishu(message, source) {
   })
 }
 
+function sendBrowserNotification(payload) {
+  if (!BROWSER_ENABLED || !BROWSER_ENDPOINT) {
+    return Promise.resolve()
+  }
+
+  return new Promise((resolve) => {
+    try {
+      const urlObj = new URL(BROWSER_ENDPOINT)
+      const data = JSON.stringify(payload)
+      const options = {
+        hostname: urlObj.hostname,
+        port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
+        path: urlObj.pathname + urlObj.search,
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': Buffer.byteLength(data)
+        },
+        timeout: 5000
+      }
+
+      if (urlObj.protocol === 'https:' && ['127.0.0.1', 'localhost', '::1'].includes(urlObj.hostname)) {
+        options.rejectUnauthorized = false
+      }
+
+      const requestModule = urlObj.protocol === 'https:' ? https : http
+      const request = requestModule.request(options, () => resolve())
+      request.on('error', () => resolve())
+      request.on('timeout', () => {
+        request.destroy()
+        resolve()
+      })
+      request.write(data)
+      request.end()
+    } catch (error) {
+      resolve()
+    }
+  })
+}
+
 (async () => {
   const source = readArg('--source') || 'claude'
   const mode = readArg('--mode') || readArg('--cc-notify-type') || 'notification'
   const eventType = readArg('--event-type') || ''
   const payload = readOptionalPayload()
-  const message = resolveMessage(source, eventType, payload)
-
-  notify(mode === 'dialog' ? 'dialog' : 'notification', message)
-  await sendFeishu(message, source)
+  const effectiveEventType = resolveEventType(eventType, payload)
+  const normalizedMode = mode === 'dialog' ? 'dialog' : 'notification'
+  const message = resolveMessage(source, effectiveEventType)
+  const timestamp = Date.now()
+
+  notify(normalizedMode, message)
+  await Promise.all([
+    sendFeishu(message, source),
+    sendBrowserNotification({
+      source,
+      mode: normalizedMode,
+      eventType: effectiveEventType,
+      message,
+      timestamp
+    })
+  ])
 })().catch(() => {
   process.exit(0)
 })
@@ -856,9 +1007,9 @@ function runWindowsPowerShellCommand(command) {
 `;
 }
 
-function writeNotifyScript(feishu = {}) {
+function writeNotifyScript(feishu = {}, browser = getBrowserNotificationConfig()) {
   ensureParentDir(PATHS.notifyHook);
-  fs.writeFileSync(PATHS.notifyHook, generateNotifyScript(feishu), { mode: 0o755 });
+  fs.writeFileSync(PATHS.notifyHook, generateNotifyScript(feishu, browser), { mode: 0o755 });
 }
 
 function getClaudeHookStatus() {
@@ -1167,6 +1318,7 @@ function getNotificationSettings() {
     success: true,
     platform: os.platform(),
     feishu: getFeishuConfig(),
+    browser: getBrowserNotificationConfig(),
     platforms: {
       claude: getClaudeHookStatus(),
       codex: getCodexHookStatus(),
@@ -1185,6 +1337,7 @@ function normalizePlatformInput(platform = {}) {
 
 function saveNotificationSettings(input = {}) {
   const existingFeishu = getFeishuConfig();
+  const existingBrowser = getBrowserNotificationConfig();
   const requestedWebhookUrl = String(input?.feishu?.webhookUrl || '').trim();
   const feishu = {
     enabled: input?.feishu?.enabled === true,
@@ -1193,6 +1346,11 @@ function saveNotificationSettings(input = {}) {
   if (feishu.enabled && feishu.webhookUrl) {
     validateFeishuWebhookUrl(feishu.webhookUrl);
   }
+  const browser = {
+    enabled: input?.browser !== undefined
+      ? input?.browser?.enabled === true
+      : existingBrowser.enabled === true
+  };
   const platforms = {
     claude: normalizePlatformInput(input?.platforms?.claude),
     codex: normalizePlatformInput(input?.platforms?.codex),
@@ -1200,11 +1358,11 @@ function saveNotificationSettings(input = {}) {
     opencode: normalizePlatformInput(input?.platforms?.opencode)
   };
 
-  saveNotificationUiConfig(feishu, platforms.claude.enabled);
+  saveNotificationUiConfig(feishu, browser, platforms.claude.enabled);
 
   const hasManagedPlatform = Object.values(platforms).some((platform) => platform.enabled);
   if (hasManagedPlatform) {
-    writeNotifyScript(feishu);
+    writeNotifyScript(feishu, browser);
   }
 
   saveClaudeHook(platforms.claude.enabled, platforms.claude.type);
@@ -1347,6 +1505,9 @@ function buildLegacyClaudeSaveInput(input = {}, currentSettings = getNotificatio
       : {
           enabled: currentSettings?.feishu?.enabled === true,
           webhookUrl: currentSettings?.feishu?.webhookUrl || ''
+        },
+    browser: {
+      enabled: currentSettings?.browser?.enabled === true
         }
   };
 }
@@ -1356,6 +1517,7 @@ function getLegacyClaudeHookSettings() {
     success: true,
     stopHook: parseStopHookStatus(readClaudeSettings()),
     feishu: getFeishuConfig(),
+    browser: getBrowserNotificationConfig(),
     platform: os.platform()
   };
 }
@@ -1553,7 +1715,7 @@ function syncManagedNotificationAssets() {
   const hasManagedPlatform = Object.values(settings?.platforms || {}).some((platform) => platform?.enabled === true);
 
   if (hasManagedPlatform) {
-    writeNotifyScript(settings.feishu || {});
+    writeNotifyScript(settings.feishu || {}, settings.browser || {});
   } else {
     removeNotifyScript();
   }
@@ -1575,6 +1737,7 @@ module.exports = {
   getLegacyClaudeHookSettings,
   saveNotificationSettings,
   saveLegacyClaudeHookSettings,
+  emitBrowserNotificationEvent,
   testNotification,
   initDefaultHooks,
   syncManagedNotificationAssets,
@@ -1600,6 +1763,8 @@ module.exports = {
     buildGeminiCommand,
     buildStopHookCommand,
     buildClaudeCommand,
+    buildBrowserNotificationEndpoint,
+    buildBrowserNotificationPayload,
     buildOpenCodePluginContent,
     getOpenCodeManagedPluginPath,
     generateNotifyScript,