npm - evolclaw-web - Versions diffs - 1.2.0 → 1.2.2 - Mend

evolclaw-web 1.2.0 → 1.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/dist/server.js CHANGED Viewed

@@ -20,12 +20,13 @@ import { ipcQuery } from './ipc-client.js';
 import { setDebugLog, dlog } from './debug-log.js';
 import { aidSource } from './sources/aid.js';
 import { msgSource } from './sources/msg.js';
-import { sessionSource } from './sources/session.js';
+import { sessionSource, buildBindMap } from './sources/session.js';
 import { cacheSource } from './sources/cache.js';
 import { systemSource } from './sources/system.js';
 import { triggersSource } from './sources/triggers.js';
 import { monitorSource } from './sources/monitor.js';
-import { queryStatsForDashboard, queryStatsExplorer, queryStatsByPeer, queryStatsByAgent, queryStatsOverview } from './sources/stats.js';
+import { gatewaySource } from './sources/gateway.js';
+import { queryStatsForDashboard, queryStatsExplorer, queryStatsByPeer, queryStatsOverview, queryUsageDetail, queryUsedModels } from './sources/stats.js';
 import { getSessionsAunDir, listLocalAids, listPeers, readMessages } from './fs-utils.js';
 import { ccProjectsDir } from './paths.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -34,7 +35,7 @@ const TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30天（滑动窗口：每次
 const PAIRING_TTL_MS = 5 * 60 * 1000; // 5min
 const DEFAULT_PORT = 42705;
 const PROTOCOL_VERSION = 1; // 与 evolclaw ping response 对齐的软校验版本
-const SOURCES = { agents: aidSource, msg: msgSource, session: sessionSource, cache: cacheSource, system: systemSource, triggers: triggersSource, monitor: monitorSource };
+const SOURCES = { agents: aidSource, msg: msgSource, session: sessionSource, cache: cacheSource, system: systemSource, triggers: triggersSource, monitor: monitorSource, gateway: gatewaySource };
 // ECWeb 自身版本：渲染 System 页时随快照下发（不走 daemon IPC，ECWeb 就是这个进程）。
 function readEcwebVersion() {
     try {
@@ -104,6 +105,26 @@ function validateAndRenew(token, now) {
     return false;
 }
 // ── Static ──
+// 经 AUN Service Proxy 转发时，proxy-server 注入 x-forwarded-prefix 头，
+// 值为外部前缀（如 /evolai/ecweb）。把它作为 <base href> 注入 index.html，
+// 使相对路径资源（style.css / app.js / api / ws）在带不带尾斜杠时都正确解析。
+// 本地直连无此头，<base> 注入为 "/"，行为不变。
+function forwardedPrefix(req) {
+    const raw = req.headers['x-forwarded-prefix'];
+    const value = (Array.isArray(raw) ? raw[0] : raw || '').trim();
+    // 安全：只接受形如 /a/b 的简单路径，拒绝含协议、双斜杠、引号、尖括号等的值
+    if (!value || !/^\/[A-Za-z0-9._~%/-]*$/.test(value))
+        return '';
+    return value.replace(/\/+$/, ''); // 去尾斜杠，注入时统一补
+}
+function injectBaseHref(html, prefix) {
+    const base = prefix ? `${prefix}/` : '/';
+    const tag = `<base href="${base}">`;
+    // 若已有 <base> 则替换，否则插在 <head> 之后
+    if (/<base\b[^>]*>/i.test(html))
+        return html.replace(/<base\b[^>]*>/i, tag);
+    return html.replace(/<head[^>]*>/i, (m) => `${m}\n  ${tag}`);
+}
 function serveStatic(req, res) {
     let urlPath = (req.url || '/').split('?')[0];
     if (urlPath === '/')
@@ -119,7 +140,16 @@ function serveStatic(req, res) {
             res.writeHead(404).end('Not Found');
             return;
         }
-        res.writeHead(200, { 'Content-Type': MIME[path.extname(file)] || 'application/octet-stream' });
+        const ext = path.extname(file);
+        // index.html 注入 <base href>，适配 AUN Service Proxy 前缀
+        if (ext === '.html') {
+            const prefix = forwardedPrefix(req);
+            const html = injectBaseHref(data.toString('utf-8'), prefix);
+            res.writeHead(200, { 'Content-Type': MIME[ext] });
+            res.end(html);
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream' });
         res.end(data);
     });
 }
@@ -183,40 +213,97 @@ function handleStatsApi(req, res) {
         res.end(JSON.stringify(data));
     }
     else if (urlPath === '/api/stats/agents') {
+        // 返回所有agent列表（与智能体管理页面一致，从aidSource获取）
+        aidSource.snapshot().then(snapshot => {
+            const agents = (snapshot?.agents || []).map((ag) => ({
+                agent_aid: ag.aid,
+                agent_name: ag.displayName || null
+            }));
+            res.writeHead(200);
+            res.end(JSON.stringify(agents));
+        }).catch(err => {
+            res.writeHead(500);
+            res.end(JSON.stringify({ error: 'Failed to fetch agents' }));
+        });
+        return;
+    }
+    else if (urlPath === '/api/stats/overview') {
+        // 从查询参数中获取时间范围和筛选条件
         const params = {};
         if (query.from)
             params.from_ts = Number(query.from);
         if (query.to)
             params.to_ts = Number(query.to);
-        if (query.limit)
-            params.limit = Number(query.limit);
-        const data = queryStatsByAgent(params);
-        res.writeHead(200);
-        res.end(JSON.stringify(data));
-    }
-    else if (urlPath === '/api/stats/overview') {
-        const tokenStats = queryStatsOverview();
-        // session count: scan all CC project dirs
+        if (query.agent)
+            params.agent_aid = String(query.agent);
+        if (query.peer)
+            params.peer_key = String(query.peer);
+        const tokenStats = queryStatsOverview(params);
+        // session count: 使用 bindMap 按 agent 和 peer 筛选
         let sessionCount = 0;
         try {
+            // 构建 agentSessionId → agent_aid 的映射
+            const bindMap = buildBindMap();
+            // 如果指定了 peer_key，提取并解码 channelId
+            let targetChannelId;
+            if (params.peer_key) {
+                const parts = params.peer_key.split('#');
+                if (parts.length >= 4) {
+                    // aun#{agent}#main#{channelId}，需要解码 URL 编码
+                    targetChannelId = decodeURIComponent(parts[3]);
+                }
+            }
             const base = ccProjectsDir();
             for (const d of fs.readdirSync(base, { withFileTypes: true })) {
                 if (!d.isDirectory())
                     continue;
+                const projectDir = path.join(base, d.name);
                 try {
-                    sessionCount += fs.readdirSync(path.join(base, d.name)).filter(f => f.endsWith('.jsonl')).length;
+                    const sessionFiles = fs.readdirSync(projectDir).filter(f => f.endsWith('.jsonl'));
+                    for (const sessionFile of sessionFiles) {
+                        const sessionId = sessionFile.replace('.jsonl', '');
+                        // 如果指定了 agent 或 peer，检查该会话是否匹配
+                        if (params.agent_aid || targetChannelId) {
+                            const bindInfo = bindMap.get(sessionId);
+                            if (!bindInfo)
+                                continue;
+                            // 检查 agent
+                            if (params.agent_aid && bindInfo.selfAID !== params.agent_aid)
+                                continue;
+                            // 检查 peer
+                            if (targetChannelId && bindInfo.channelId !== targetChannelId)
+                                continue;
+                        }
+                        // 如果有时间范围限制，检查会话文件的修改时间
+                        if (params.from_ts || params.to_ts) {
+                            const stat = fs.statSync(path.join(projectDir, sessionFile));
+                            const mtime = stat.mtimeMs;
+                            if (params.from_ts && mtime < params.from_ts)
+                                continue;
+                            if (params.to_ts && mtime > params.to_ts)
+                                continue;
+                        }
+                        sessionCount++;
+                    }
                 }
                 catch { }
             }
         }
         catch { }
-        // message counts: scan aun dir
+        // message counts: scan aun dir, 根据时间范围和 agent/peer 过滤
         let msgIn = 0, msgOut = 0;
         try {
             const aunDir = getSessionsAunDir();
-            for (const aid of listLocalAids(aunDir)) {
-                for (const peer of listPeers(aunDir, aid)) {
+            const aids = params.agent_aid ? [params.agent_aid] : listLocalAids(aunDir);
+            for (const aid of aids) {
+                const peers = params.peer_key ? [params.peer_key] : listPeers(aunDir, aid);
+                for (const peer of peers) {
                     for (const m of readMessages(aunDir, aid, peer)) {
+                        // 根据消息时间戳过滤
+                        if (params.from_ts && m.ts < params.from_ts)
+                            continue;
+                        if (params.to_ts && m.ts > params.to_ts)
+                            continue;
                         if (m.dir === 'in')
                             msgIn++;
                         else
@@ -229,6 +316,34 @@ function handleStatsApi(req, res) {
         res.writeHead(200);
         res.end(JSON.stringify({ token_stats: tokenStats, session_count: sessionCount, msg_in: msgIn, msg_out: msgOut }));
     }
+    else if (urlPath === '/api/stats/detail') {
+        // 模型访问明细查询
+        const params = {};
+        if (query.from)
+            params.from_ts = Number(query.from);
+        if (query.to)
+            params.to_ts = Number(query.to);
+        if (query.agent)
+            params.agent_aid = query.agent;
+        if (query.model)
+            params.model = String(query.model);
+        params.limit = Number(query.limit) || 50; // 默认限制50条
+        params.offset = Number(query.offset) || 0; // 默认从0开始
+        const result = queryUsageDetail(params);
+        res.writeHead(200);
+        res.end(JSON.stringify(result));
+    }
+    else if (urlPath === '/api/stats/models') {
+        // 获取指定时间范围内使用过的模型列表
+        const params = {};
+        if (query.from)
+            params.from_ts = Number(query.from);
+        if (query.to)
+            params.to_ts = Number(query.to);
+        const models = queryUsedModels(params);
+        res.writeHead(200);
+        res.end(JSON.stringify(models));
+    }
     else {
         res.writeHead(404);
         res.end(JSON.stringify({ error: 'not found' }));
@@ -246,6 +361,18 @@ function isLocalhost(req) {
     const addr = req.socket.remoteAddress || '';
     return addr === '127.0.0.1' || addr === '::1' || addr === '::ffff:127.0.0.1';
 }
+/**
+ * 判定「真本地直连」：socket 地址是回环 AND 无 x-aun-provider-aid 头。
+ * proxy-server 回连本地时 remoteAddress 也是 127.0.0.1，但会注入 x-aun-provider-aid
+ * 可信头（访客伪造的 x-aun-* 会被 proxy-server 剥掉）。只有真本地直连时两条件同时满足。
+ * 真本地直连免配对（自动发 token），隧道/远程需配对码。
+ */
+function isLocalDirect(req) {
+    if (!isLocalhost(req))
+        return false;
+    const providerAid = req.headers['x-aun-provider-aid'];
+    return !providerAid || (Array.isArray(providerAid) ? providerAid.length === 0 : !providerAid.trim());
+}
 function genPairingCode() {
     return String(crypto.randomInt(0, 1000000)).padStart(6, '0');
 }
@@ -281,6 +408,23 @@ function handlePair(req, res, pairingCode, pairingExpiry, log) {
         log(`✓ 配对成功 from ${ip}（token 缓存 30 天，有访问自动续期）`);
     });
 }
+/**
+ * 本地直连免配对：自动发 token。远程（隧道或真远程）需配对码。
+ * 本地直连判定：socket 来源是回环 AND 无 x-aun-provider-aid 头（非隧道）。
+ */
+function issueLocalDirectToken(req, log) {
+    if (!isLocalDirect(req))
+        return null;
+    const now = Date.now();
+    const token = crypto.randomBytes(32).toString('hex');
+    const store = loadTokens();
+    pruneExpired(store, now);
+    const ip = clientIp(req);
+    store.tokens.push({ token, createdAt: now, lastActive: now, label: `local-direct:${ip}` });
+    saveTokens(store);
+    log(`✓ 本地直连自动授权 from ${ip}`);
+    return token;
+}
 // ── WebSocket connection ──
 function handleConnection(ws, req, log) {
     const ip = clientIp(req);
@@ -471,8 +615,10 @@ export async function startWatchWebServer(opts = {}) {
     }
     const server = http.createServer((req, res) => {
         if (req.method === 'GET' && (req.url || '') === '/api/pair-code') {
-            // 仅 localhost 可取码：远程浏览器拿不到，必须由同机的 `ec watch web` 显示给用户
-            if (!isLocalhost(req)) {
+            // 取码 API：仅真本地直连可用（socket 回环 + 无 x-aun-provider-aid）。
+            // 隧道回连虽然 socket 也是 127.0.0.1，但有 x-aun-provider-aid 头 → 拒绝，
+            // 防止远程访客通过隧道拿到配对码（安全漏洞）。
+            if (!isLocalDirect(req)) {
                 res.writeHead(403, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'forbidden' }));
                 return;
@@ -482,15 +628,27 @@ export async function startWatchWebServer(opts = {}) {
             res.end(JSON.stringify({ code, expiresAt }));
         }
         else if (req.method === 'POST' && (req.url || '').startsWith('/api/pair')) {
+            // 配对 API：远程（隧道/真远程）需要配对码；本地直连自动发 token 跳过配对。
+            const autoToken = issueLocalDirectToken(req, log);
+            if (autoToken) {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ ok: true, token: autoToken }));
+                return;
+            }
             handlePair(req, res, pairingCode, pairingExpiry, log);
         }
         else if (req.method === 'GET' && (req.url || '').startsWith('/api/stats/')) {
-            // Stats API — requires auth
+            // Stats API — 本地直连自动发 token（免鉴权），远程需鉴权
             const authHeader = req.headers.authorization || '';
             const bearerToken = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '';
             const { query } = parseUrl(req.url || '');
-            const token = bearerToken || query.token || '';
-            if (!validateAndRenew(token, Date.now())) {
+            let token = bearerToken || query.token || '';
+            if (!token) {
+                const autoToken = issueLocalDirectToken(req, log);
+                if (autoToken)
+                    token = autoToken;
+            }
+            if (!token || !validateAndRenew(token, Date.now())) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
                 return;
@@ -504,7 +662,8 @@ export async function startWatchWebServer(opts = {}) {
     const wss = new WebSocketServer({ noServer: true });
     server.on('upgrade', (req, socket, head) => {
         const { query } = parseUrl(req.url || '');
-        const authed = validateAndRenew(query.token || '', Date.now());
+        // 本地直连免 token；远程需 token。
+        const authed = isLocalDirect(req) || validateAndRenew(query.token || '', Date.now());
         wss.handleUpgrade(req, socket, head, (ws) => {
             if (!authed) {
                 log(`✗ WS 拒绝（无效 token） from ${clientIp(req)}`);

package/dist/sources/gateway.js ADDED Viewed

@@ -0,0 +1,44 @@
+/**
+ * gateway.ts — 网关（baseagent 后端）配置数据源（只读代理）。
+ *
+ * ECWeb 不直接读写配置文件。snapshot 通过 daemon 的 menu.exec IPC 调
+ * menu.query name=gateway，由 daemon 端的 command-handler-gateway-control 统一
+ * 出数据（apiKey 已掩码）。写操作（update/test/delete）走前端 menuSend → menu IPC，
+ * 不经过本 source。
+ *
+ * 连不上 daemon 时返回 { gateways: [], error } 让前端提示。
+ */
+import { resolvePaths } from '../paths.js';
+import { ipcQuery } from '../ipc-client.js';
+async function getSnapshot() {
+    const sock = resolvePaths().socket;
+    const resp = await ipcQuery(sock, { type: 'menu.exec', payload: { type: 'menu.query', name: 'gateway', id: 'ecw-gateway-snap' } }, 5000);
+    if (!resp) {
+        return { gateways: [], scopes: [], types: [], error: 'evolclaw 未运行或 socket 不可达' };
+    }
+    if (!resp.ok) {
+        return { gateways: [], scopes: [], types: [], error: resp.error || 'daemon 返回失败' };
+    }
+    const inner = resp.response;
+    if (inner?.error) {
+        return { gateways: [], scopes: [], types: [], error: inner.error.message };
+    }
+    const data = inner?.data ?? {};
+    return {
+        gateways: Array.isArray(data.gateways) ? data.gateways : [],
+        scopes: Array.isArray(data.scopes) ? data.scopes : [],
+        types: Array.isArray(data.types) ? data.types : [],
+        effective: Array.isArray(data.effective) ? data.effective : [],
+        envMismatch: data.envMismatch || { hasMismatch: false, mismatches: [] },
+    };
+}
+export const gatewaySource = {
+    kind: 'gateway',
+    async snapshot() {
+        return getSnapshot();
+    },
+    subscribe(_params, _push) {
+        // 网关配置变更不频繁，无文件监听；前端通过操作后主动 re-subscribe 刷新。
+        return () => { };
+    },
+};

package/dist/sources/session.js CHANGED Viewed

@@ -221,7 +221,7 @@ function resolveProject(params, projects) {
     dlog(`[session] resolveProject: cwd project=${curEncoded.slice(-24)} not found → using first=${projects[0]?.encoded.slice(-24)}`);
     return projects[0] || null;
 }
-function buildBindMap() {
+export function buildBindMap() {
     const map = new Map();
     try {
         const p = resolvePaths();