ec-web 0.0.23 → 0.0.25

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 EvolCore contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 EvolCore contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,17 +1,17 @@
-# EC Web
-
-Web console and monitoring dashboard for EvolCore.
-
-## Install
-
-```bash
-npm install -g ec-web
-```
-
-## Run
-
-```bash
-ec-web --home /path/to/runtime-home
-```
-
-Use `ec watch web` when EC Web is managed by the main daemon.
+# EC Web
+
+Web console and monitoring dashboard for EvolCore.
+
+## Install
+
+```bash
+npm install -g ec-web
+```
+
+## Run
+
+```bash
+ec-web --home /path/to/runtime-home
+```
+
+Use `ec watch web` when EC Web is managed by the main daemon.

package/dist/index.js

@@ -107,7 +107,7 @@ for (const list of Object.values(ifaces)) {
 }
 process.stdout.write(`\n${BOLD}${CYAN}EC Web — EvolCore${RST}  ${DIM}(home: ${p.root})${RST}\n\n`);
 process.stdout.write(handle.pairingCode
-    ? `  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(daemon 提供，5 分钟内有效，配对后 token 缓存 30 天，有访问自动续期)${RST}\n\n`
+    ? `  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(daemon 提供，5 分钟内有效，配对后 token 缓存 7 天，有访问自动续期)${RST}\n\n`
     : `  ${BOLD}配对码:${RST}  ${YELLOW}daemon 暂不可用，请先启动 EvolCore${RST}\n\n`);
 process.stdout.write(`  ${BOLD}本机:${RST}    http://localhost:${handle.port}\n`);
 for (const ip of lanIps)

package/dist/server.js

@@ -3,8 +3,8 @@
  *
  * - HTTP: 静态资源 + 配对 API
  * - WebSocket: 订阅式实时推送（aid / msg / session）
- * - 鉴权: daemon 通过本地 IPC 提供 6 位配对码（5 分钟有效）和远程访问 token（30 天滑动续期）
- * - 安全: 绑定 0.0.0.0（支持远程访问），token 校验；远程连接可执行受控管理操作，不能修改 daemon 配置或读取 secret
+ * - 鉴权: daemon 通过本地 IPC 提供 6 位配对码（5 分钟有效）和远程访问 token（7 天滑动续期）
+ * - 安全: 绑定 0.0.0.0（支持远程访问）；本地自动登录，远程配对后使用 token，登录后权限一致
  *
  * 与 evolcore daemon 通过 IPC socket（状态、Menu 和远程访问凭据）+ 文件系统（历史数据）旁路通信。
  */
@@ -437,7 +437,7 @@ function handlePair(req, res, log) {
                 return;
             }
             res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: true, token: result.token }));
-            log(`✓ 配对成功 from ${ip}（daemon token 缓存 30 天，有访问自动续期）`);
+            log(`✓ 配对成功 from ${ip}（daemon token 缓存 7 天，有访问自动续期）`);
         }).catch(error => {
             res.writeHead(503, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: 'daemon unavailable' }));
             log(`✗ 配对失败（daemon unavailable: ${error instanceof Error ? error.message : String(error)}） from ${ip}`);
@@ -790,22 +790,13 @@ export async function startWatchWebServer(opts = {}) {
                 if (autoToken)
                     token = autoToken;
             }
-            if (!token || !(await validateRemoteToken(token))) {
+            const tokenRecord = token ? await validateRemoteToken(token) : null;
+            if (!token || !tokenRecord) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ success: false, error: 'unauthorized' }));
                 return;
             }
-            if (!localDirect && pathname === '/api/basic-settings/secret') {
-                res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-                res.end(JSON.stringify({ success: false, error: 'remote ECWeb connections cannot reveal API keys' }));
-                return;
-            }
-            if (!localDirect && req.method !== 'GET') {
-                res.writeHead(403, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: false, error: 'remote ECWeb connections cannot modify daemon settings' }));
-                return;
-            }
-            void handleBasicSettingsApi(req, res, { redactConnectionMaps: !localDirect });
+            void handleBasicSettingsApi(req, res, { redactConnectionMaps: !isLocalDirect(req) });
         }
         else if (req.method === 'GET' && (req.url || '').startsWith('/api/stats/')) {
             // Stats API — 本地直连自动发 token（免鉴权），远程需鉴权

package/dist/sources/session-codex.js

@@ -205,12 +205,12 @@ function listProjects() {
     if (!db)
         return [];
     try {
-        const rows = db.prepare(`
-      SELECT cwd, COUNT(*) as count, MAX(updated_at) as lastActivity
-      FROM threads
-      WHERE archived = 0
-      GROUP BY cwd
-      ORDER BY lastActivity DESC
+        const rows = db.prepare(`
+      SELECT cwd, COUNT(*) as count, MAX(updated_at) as lastActivity
+      FROM threads
+      WHERE archived = 0
+      GROUP BY cwd
+      ORDER BY lastActivity DESC
     `).all();
         const projects = rows.map(r => {
             const cwd = r.cwd || '';
@@ -382,11 +382,11 @@ function listTranscripts(encoded, cwd) {
     if (!db)
         return [];
     try {
-        const rows = db.prepare(`
-      SELECT id, title, first_user_message, updated_at, rollout_path, source, thread_source
-      FROM threads
-      WHERE cwd = ? AND archived = 0
-      ORDER BY updated_at DESC
+        const rows = db.prepare(`
+      SELECT id, title, first_user_message, updated_at, rollout_path, source, thread_source
+      FROM threads
+      WHERE cwd = ? AND archived = 0
+      ORDER BY updated_at DESC
     `).all(cwd);
         const out = [];
         let parsed = 0, hitMem = 0, hitDisk = 0;

package/dist/sources/stats.js

@@ -46,41 +46,41 @@ export function queryStatsForDashboard() {
     const h24ago = Date.now() - 24 * 60 * 60 * 1000;
     try {
         // Today summary with cost
-        const todayRow = db.prepare(`
-      SELECT
-        COALESCE(SUM(input_tokens),0) AS input_tokens,
-        COALESCE(SUM(output_tokens),0) AS output_tokens,
-        COALESCE(SUM(cache_creation_tokens),0) AS cache_creation_tokens,
-        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
-        COUNT(*) AS call_count,
-        COALESCE(SUM(cost_gateway_usd),0) AS cost_usd,
-        COALESCE(SUM(cost_gateway_cny),0) AS cost_cny
-      FROM usage_events WHERE ts >= ?
+        const todayRow = db.prepare(`
+      SELECT
+        COALESCE(SUM(input_tokens),0) AS input_tokens,
+        COALESCE(SUM(output_tokens),0) AS output_tokens,
+        COALESCE(SUM(cache_creation_tokens),0) AS cache_creation_tokens,
+        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
+        COUNT(*) AS call_count,
+        COALESCE(SUM(cost_gateway_usd),0) AS cost_usd,
+        COALESCE(SUM(cost_gateway_cny),0) AS cost_cny
+      FROM usage_events WHERE ts >= ?
     `).get(todayStart);
         const totalIn = (todayRow.input_tokens ?? 0) + (todayRow.cache_read_tokens ?? 0);
         const hitRate = totalIn > 0 ? (todayRow.cache_read_tokens ?? 0) / totalIn : 0;
         // Hourly (last 24h)
-        const hourly = db.prepare(`
-      SELECT
-        strftime('%Y-%m-%d %H:00', ts/1000, 'unixepoch', 'localtime') AS hour,
-        COALESCE(SUM(input_tokens),0) AS input_tokens,
-        COALESCE(SUM(output_tokens),0) AS output_tokens,
-        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
-        COUNT(*) AS call_count
-      FROM usage_events WHERE ts >= ?
-      GROUP BY hour ORDER BY hour
+        const hourly = db.prepare(`
+      SELECT
+        strftime('%Y-%m-%d %H:00', ts/1000, 'unixepoch', 'localtime') AS hour,
+        COALESCE(SUM(input_tokens),0) AS input_tokens,
+        COALESCE(SUM(output_tokens),0) AS output_tokens,
+        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
+        COUNT(*) AS call_count
+      FROM usage_events WHERE ts >= ?
+      GROUP BY hour ORDER BY hour
     `).all(h24ago);
         // Top models (today)
-        const top_models = db.prepare(`
-      SELECT model, SUM(input_tokens+output_tokens) AS total_tokens, COUNT(*) AS call_count
-      FROM usage_events WHERE ts >= ?
-      GROUP BY model ORDER BY total_tokens DESC LIMIT 10
+        const top_models = db.prepare(`
+      SELECT model, SUM(input_tokens+output_tokens) AS total_tokens, COUNT(*) AS call_count
+      FROM usage_events WHERE ts >= ?
+      GROUP BY model ORDER BY total_tokens DESC LIMIT 10
     `).all(todayStart);
         // Top peers (today)
-        const top_peers = db.prepare(`
-      SELECT peer_key, SUM(input_tokens+output_tokens) AS total_tokens, COUNT(*) AS call_count
-      FROM usage_events WHERE ts >= ?
-      GROUP BY peer_key ORDER BY total_tokens DESC LIMIT 5
+        const top_peers = db.prepare(`
+      SELECT peer_key, SUM(input_tokens+output_tokens) AS total_tokens, COUNT(*) AS call_count
+      FROM usage_events WHERE ts >= ?
+      GROUP BY peer_key ORDER BY total_tokens DESC LIMIT 5
     `).all(todayStart);
         return {
             today: { ...todayRow, cache_hit_rate: hitRate },
@@ -124,16 +124,16 @@ export function queryStatsExplorer(params) {
     }
     const where = conds.length ? 'WHERE ' + conds.join(' AND ') : '';
     try {
-        return db.prepare(`
-      SELECT
-        strftime('${strfmt}', ts/1000, 'unixepoch', 'localtime') AS period,
-        COALESCE(SUM(input_tokens),0) AS input_tokens,
-        COALESCE(SUM(output_tokens),0) AS output_tokens,
-        COALESCE(SUM(cache_creation_tokens),0) AS cache_creation_tokens,
-        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
-        COUNT(*) AS call_count
-      FROM usage_events ${where}
-      GROUP BY period ORDER BY period
+        return db.prepare(`
+      SELECT
+        strftime('${strfmt}', ts/1000, 'unixepoch', 'localtime') AS period,
+        COALESCE(SUM(input_tokens),0) AS input_tokens,
+        COALESCE(SUM(output_tokens),0) AS output_tokens,
+        COALESCE(SUM(cache_creation_tokens),0) AS cache_creation_tokens,
+        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
+        COUNT(*) AS call_count
+      FROM usage_events ${where}
+      GROUP BY period ORDER BY period
     `).all(...p);
     }
     finally {
@@ -162,14 +162,14 @@ export function queryStatsByPeer(params) {
     const where = conds.length ? 'WHERE ' + conds.join(' AND ') : '';
     const limit = params.limit ?? 50;
     try {
-        const rows = db.prepare(`
-      SELECT peer_key, peer_type,
-        COALESCE(SUM(input_tokens),0) AS input_tokens,
-        COALESCE(SUM(output_tokens),0) AS output_tokens,
-        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
-        COUNT(*) AS call_count
-      FROM usage_events ${where}
-      GROUP BY peer_key ORDER BY (COALESCE(SUM(input_tokens),0) + COALESCE(SUM(output_tokens),0)) DESC LIMIT ${limit}
+        const rows = db.prepare(`
+      SELECT peer_key, peer_type,
+        COALESCE(SUM(input_tokens),0) AS input_tokens,
+        COALESCE(SUM(output_tokens),0) AS output_tokens,
+        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
+        COUNT(*) AS call_count
+      FROM usage_events ${where}
+      GROUP BY peer_key ORDER BY (COALESCE(SUM(input_tokens),0) + COALESCE(SUM(output_tokens),0)) DESC LIMIT ${limit}
     `).all(...p);
         // 为每个peer添加名称和详细信息
         return rows.map((row) => {
@@ -212,34 +212,34 @@ export function queryStatsOverview(params) {
         }
         const where = conds.length ? 'WHERE ' + conds.join(' AND ') : '';
         // Token and cost aggregation with filters
-        const allRow = db.prepare(`
-      SELECT
-        COALESCE(SUM(input_tokens),0) AS input_tokens,
-        COALESCE(SUM(output_tokens),0) AS output_tokens,
-        COALESCE(SUM(cache_creation_tokens),0) AS cache_creation_tokens,
-        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
-        COUNT(*) AS call_count,
-        COALESCE(SUM(cost_official_usd),0) AS cost_official_usd,
-        COALESCE(SUM(cost_official_cny),0) AS cost_official_cny,
-        COALESCE(SUM(cost_gateway_usd),0) AS cost_usd,
-        COALESCE(SUM(cost_gateway_cny),0) AS cost_cny
-      FROM usage_events ${where}
+        const allRow = db.prepare(`
+      SELECT
+        COALESCE(SUM(input_tokens),0) AS input_tokens,
+        COALESCE(SUM(output_tokens),0) AS output_tokens,
+        COALESCE(SUM(cache_creation_tokens),0) AS cache_creation_tokens,
+        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
+        COUNT(*) AS call_count,
+        COALESCE(SUM(cost_official_usd),0) AS cost_official_usd,
+        COALESCE(SUM(cost_official_cny),0) AS cost_official_cny,
+        COALESCE(SUM(cost_gateway_usd),0) AS cost_usd,
+        COALESCE(SUM(cost_gateway_cny),0) AS cost_cny
+      FROM usage_events ${where}
     `).get(...p);
         // By agent aggregation with filters
-        const byAgentRows = db.prepare(`
-      SELECT agent_aid,
-        COALESCE(SUM(input_tokens),0) AS input_tokens,
-        COALESCE(SUM(output_tokens),0) AS output_tokens,
-        COALESCE(SUM(cache_creation_tokens),0) AS cache_creation_tokens,
-        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
-        COUNT(*) AS call_count,
-        COALESCE(SUM(cost_official_usd),0) AS cost_official_usd,
-        COALESCE(SUM(cost_official_cny),0) AS cost_official_cny,
-        COALESCE(SUM(cost_gateway_usd),0) AS cost_usd,
-        COALESCE(SUM(cost_gateway_cny),0) AS cost_cny
-      FROM usage_events ${where}
-      GROUP BY agent_aid
-      ORDER BY (COALESCE(SUM(input_tokens),0) + COALESCE(SUM(output_tokens),0)) DESC
+        const byAgentRows = db.prepare(`
+      SELECT agent_aid,
+        COALESCE(SUM(input_tokens),0) AS input_tokens,
+        COALESCE(SUM(output_tokens),0) AS output_tokens,
+        COALESCE(SUM(cache_creation_tokens),0) AS cache_creation_tokens,
+        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
+        COUNT(*) AS call_count,
+        COALESCE(SUM(cost_official_usd),0) AS cost_official_usd,
+        COALESCE(SUM(cost_official_cny),0) AS cost_official_cny,
+        COALESCE(SUM(cost_gateway_usd),0) AS cost_usd,
+        COALESCE(SUM(cost_gateway_cny),0) AS cost_cny
+      FROM usage_events ${where}
+      GROUP BY agent_aid
+      ORDER BY (COALESCE(SUM(input_tokens),0) + COALESCE(SUM(output_tokens),0)) DESC
     `).all(...p);
         // 为每个agent添加名称
         const byAgentWithNames = byAgentRows.map((row) => ({
@@ -303,14 +303,14 @@ export function queryStatsByAgent(params) {
     const where = conds.length ? 'WHERE ' + conds.join(' AND ') : '';
     const limit = params.limit ?? 50;
     try {
-        const rows = db.prepare(`
-      SELECT agent_aid,
-        COALESCE(SUM(input_tokens),0) AS input_tokens,
-        COALESCE(SUM(output_tokens),0) AS output_tokens,
-        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
-        COUNT(*) AS call_count
-      FROM usage_events ${where}
-      GROUP BY agent_aid ORDER BY (COALESCE(SUM(input_tokens),0) + COALESCE(SUM(output_tokens),0)) DESC LIMIT ${limit}
+        const rows = db.prepare(`
+      SELECT agent_aid,
+        COALESCE(SUM(input_tokens),0) AS input_tokens,
+        COALESCE(SUM(output_tokens),0) AS output_tokens,
+        COALESCE(SUM(cache_read_tokens),0) AS cache_read_tokens,
+        COUNT(*) AS call_count
+      FROM usage_events ${where}
+      GROUP BY agent_aid ORDER BY (COALESCE(SUM(input_tokens),0) + COALESCE(SUM(output_tokens),0)) DESC LIMIT ${limit}
     `).all(...p);
         // 为每个agent添加名称
         return rows.map((row) => ({
@@ -353,15 +353,15 @@ export function queryUsageDetail(params) {
         const countRow = db.prepare(`SELECT COUNT(*) as total FROM usage_events ${where}`).get(...p);
         const total = countRow?.total || 0;
         // 获取数据
-        const data = db.prepare(`
-      SELECT ts, agent_aid, peer_key, model,
-        input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens,
-        COALESCE(cost_official_usd, 0) AS cost_official_usd,
-        COALESCE(cost_official_cny, 0) AS cost_official_cny,
-        COALESCE(cost_gateway_usd, 0) AS cost_gateway_usd,
-        COALESCE(cost_gateway_cny, 0) AS cost_gateway_cny
-      FROM usage_events ${where}
-      ORDER BY ts DESC LIMIT ${limit} OFFSET ${offset}
+        const data = db.prepare(`
+      SELECT ts, agent_aid, peer_key, model,
+        input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens,
+        COALESCE(cost_official_usd, 0) AS cost_official_usd,
+        COALESCE(cost_official_cny, 0) AS cost_official_cny,
+        COALESCE(cost_gateway_usd, 0) AS cost_gateway_usd,
+        COALESCE(cost_gateway_cny, 0) AS cost_gateway_cny
+      FROM usage_events ${where}
+      ORDER BY ts DESC LIMIT ${limit} OFFSET ${offset}
     `).all(...p);
         // 为每条记录添加agent_name (需要从文件系统读取agent.md)
         const dataWithNames = data.map((row) => ({
@@ -391,10 +391,10 @@ export function queryUsedModels(params) {
     }
     const where = conds.length ? 'WHERE ' + conds.join(' AND ') : '';
     try {
-        const rows = db.prepare(`
-      SELECT DISTINCT model
-      FROM usage_events ${where}
-      ORDER BY model
+        const rows = db.prepare(`
+      SELECT DISTINCT model
+      FROM usage_events ${where}
+      ORDER BY model
     `).all(...p);
         return rows.map((row) => row.model).filter(Boolean);
     }