ec-web 0.0.23 → 0.0.24

package/dist/index.js

@@ -107,7 +107,7 @@ for (const list of Object.values(ifaces)) {
 }
 process.stdout.write(`\n${BOLD}${CYAN}EC Web — EvolCore${RST}  ${DIM}(home: ${p.root})${RST}\n\n`);
 process.stdout.write(handle.pairingCode
-    ? `  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(daemon 提供，5 分钟内有效，配对后 token 缓存 30 天，有访问自动续期)${RST}\n\n`
+    ? `  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(daemon 提供，5 分钟内有效，配对后 token 缓存 7 天，有访问自动续期)${RST}\n\n`
     : `  ${BOLD}配对码:${RST}  ${YELLOW}daemon 暂不可用，请先启动 EvolCore${RST}\n\n`);
 process.stdout.write(`  ${BOLD}本机:${RST}    http://localhost:${handle.port}\n`);
 for (const ip of lanIps)

package/dist/server.js

@@ -3,8 +3,8 @@
  *
  * - HTTP: 静态资源 + 配对 API
  * - WebSocket: 订阅式实时推送（aid / msg / session）
- * - 鉴权: daemon 通过本地 IPC 提供 6 位配对码（5 分钟有效）和远程访问 token（30 天滑动续期）
- * - 安全: 绑定 0.0.0.0（支持远程访问），token 校验；远程连接可执行受控管理操作，不能修改 daemon 配置或读取 secret
+ * - 鉴权: daemon 通过本地 IPC 提供 6 位配对码（5 分钟有效）和远程访问 token（7 天滑动续期）
+ * - 安全: 绑定 0.0.0.0（支持远程访问）；本地自动登录，远程配对后使用 token，登录后权限一致
  *
  * 与 evolcore daemon 通过 IPC socket（状态、Menu 和远程访问凭据）+ 文件系统（历史数据）旁路通信。
  */
@@ -437,7 +437,7 @@ function handlePair(req, res, log) {
                 return;
             }
             res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: true, token: result.token }));
-            log(`✓ 配对成功 from ${ip}（daemon token 缓存 30 天，有访问自动续期）`);
+            log(`✓ 配对成功 from ${ip}（daemon token 缓存 7 天，有访问自动续期）`);
         }).catch(error => {
             res.writeHead(503, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: 'daemon unavailable' }));
             log(`✗ 配对失败（daemon unavailable: ${error instanceof Error ? error.message : String(error)}） from ${ip}`);
@@ -790,22 +790,13 @@ export async function startWatchWebServer(opts = {}) {
                 if (autoToken)
                     token = autoToken;
             }
-            if (!token || !(await validateRemoteToken(token))) {
+            const tokenRecord = token ? await validateRemoteToken(token) : null;
+            if (!token || !tokenRecord) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ success: false, error: 'unauthorized' }));
                 return;
             }
-            if (!localDirect && pathname === '/api/basic-settings/secret') {
-                res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-                res.end(JSON.stringify({ success: false, error: 'remote ECWeb connections cannot reveal API keys' }));
-                return;
-            }
-            if (!localDirect && req.method !== 'GET') {
-                res.writeHead(403, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: false, error: 'remote ECWeb connections cannot modify daemon settings' }));
-                return;
-            }
-            void handleBasicSettingsApi(req, res, { redactConnectionMaps: !localDirect });
+            void handleBasicSettingsApi(req, res, { redactConnectionMaps: !isLocalDirect(req), remoteAccess: !isLocalDirect(req) });
         }
         else if (req.method === 'GET' && (req.url || '').startsWith('/api/stats/')) {
             // Stats API — 本地直连自动发 token（免鉴权），远程需鉴权

package/dist/sources/basic-settings.js

@@ -767,6 +767,9 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
             return;
         }
         if (req.method === 'GET' && pathname === '/api/basic-settings/secret') {
+            if (options.remoteAccess) {
+                throw Object.assign(new Error('Remote access cannot reveal configuration secrets'), { statusCode: 403 });
+            }
             const file = url.searchParams.get('file') || 'defaults';
             const fieldPath = url.searchParams.get('path') || '';
             if (!requestedSecretPath(file, fieldPath)) {
@@ -782,6 +785,9 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
             return;
         }
         if (req.method === 'PATCH' && pathname === '/api/basic-settings') {
+            if (options.remoteAccess) {
+                throw Object.assign(new Error('Remote access cannot mutate basic settings'), { statusCode: 403 });
+            }
             const body = await readJsonBody(req);
             if (!isRecord(body) || (body.file !== 'daemon' && body.file !== 'defaults'))
                 throw new Error('file must be daemon or defaults');

package/dist/static/app.js

@@ -4711,8 +4711,17 @@ async function syncAgentCreateOptionFields(ctx, values) {
   setAgentSelectLoading(modelSelect, currentModel, currentModel ? `${currentModel} (${t('common.loadingSuffix')})` : t('common.loading'));
   setAgentSelectLoading(effortSelect, currentEffort, currentEffort ? `${currentEffort} (${t('common.loadingSuffix')})` : t('common.loading'));
 
+  let catalog;
   try {
-    const models = await agentFetchCreateModelOptions(baseagent);
+    // Load the catalog once for both selectors.  The catalog endpoint is
+    // connection-scoped and may perform a live gateway refresh, so issuing a
+    // second identical request for effort metadata is both wasteful and can
+    // produce mismatched model/effort options during a refresh.
+    catalog = await fetchModelCatalogData(baseagent);
+    const models = (catalog?.models || []).map(model => ({
+      value: model.id,
+      label: `${model.id}${model.verification === 'unverified' ? ' [unverified]' : ''}`,
+    }));
     if (_agentCreate !== ctx || ctx.optionLoadToken !== token) return;
     modelSelect.innerHTML = agentSelectOptions(models, currentModel, t('common.defaultModel'));
   } catch (e) {
@@ -4724,8 +4733,15 @@ async function syncAgentCreateOptionFields(ctx, values) {
     if (_agentCreate === ctx && ctx.optionLoadToken === token) modelSelect.disabled = Boolean(ctx.saving);
   }
 
-  const selectedModel = modelSelect?.value || currentModel;
-  await syncAgentCreateEffortOptions(ctx, baseagent, selectedModel, currentEffort, token);
+  // A freshly rendered select may not expose its browser-selected value until
+  // the next layout tick (and lightweight embedders may not implement the DOM
+  // value reflection at all).  Use the first catalog model as the default so
+  // its reasoning levels are available immediately.
+  const selectedModel = modelSelect?.value || currentModel || catalog?.models?.[0]?.id || '';
+  const efforts = catalog?.models?.find(entry => entry.id === selectedModel)?.reasoningLevels || [];
+  if (_agentCreate !== ctx || ctx.optionLoadToken !== token) return;
+  effortSelect.innerHTML = agentSelectOptions(efforts, currentEffort, t('common.default'));
+  effortSelect.disabled = Boolean(ctx.saving);
 }
 
 async function syncAgentCreateEffortOptions(ctx, baseagent, model, currentEffort, token) {

package/dist/static/index.html

@@ -49,7 +49,7 @@
 
       </nav>
       <span style="flex:1"></span>
-      2026-09-09 03:48
+      2026-09-14 01:48
       <span id="conn-status" class="conn-status" data-i18n="status.connecting">连接中…</span>
       <button id="lang-btn" class="theme-btn" data-i18n-title="language.buttonTitle" title="切换语言">🌐</button>
       <button id="theme-btn" class="theme-btn" data-i18n-title="theme.buttonTitle" title="主题">🌗</button>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ec-web",
-  "version": "0.0.23",
+  "version": "0.0.24",
   "description": "Web console and monitoring dashboard for EvolCore",
   "type": "module",
   "bin": {