ework-web 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dog and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,170 @@
+# ework-web
+
+Standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML + vanilla JS.
+
+Issues, comments, labels, reactions, and attachments live in a local SQLite database, served under `/<owner>/<repo>/issues/<n>` URLs. The same process also hosts an OpenCode session viewer, a file viewer, inline translate, and TTS sidecars.
+
+## Features
+
+- **Multi-project issues** — `/<owner>/<repo>/issues/<n>` URLs, one DB holds all projects
+- **Comments** with markdown (marked + highlight.js + DOMPurify), code highlighting, linkify
+- **Attachments** — image/pdf/etc upload, stored on local filesystem, streamed via `Bun.file`
+- **Labels & reactions** — per-project labels, 9-emoji reactions on comments
+- **OpenCode session viewer** — read-only `/sessions`, hot bars, translate, TTS
+- **File viewer** — `/file?path=…` with security gate (path validation + denylist + realpath)
+- **Inline translation + TTS** — OpenAI-compatible `/v1/chat/completions` + `/v1/audio/speech`
+- **Token-cookie auth** — single shared token + HMAC-signed cookie (30d)
+- **Rate limiting** — token bucket on `/api/*`, `/login`, translate, TTS, settings
+
+## Installation
+
+### Prerequisites
+
+- **Bun** runtime (v1.x) — required for all install paths
+- **Gitea instance** — optional; only needed if you want an upstream mirror per project. Standalone mode (local SQLite) needs no external service.
+- **LLM endpoint** (OpenAI-compatible `/v1/chat/completions`, optionally `/v1/audio/speech`) — optional; only needed for inline translation and TTS.
+
+### Option 1 — AIO Docker (recommended)
+
+The all-in-one image bundles ework-web, the daemon, and opencode. Requires Docker.
+
+```bash
+cp docker/.env.docker.example docker/.env.docker   # fill WORK_TOKEN + WORK_COOKIE_SECRET
+./docker/build.sh                                   # builds ework-aio:latest
+HOST_PORT_WEB=13002 HOST_PORT_DAEMON=13101 ./docker/run.sh ework-aio:latest
+```
+
+Default published ports are `3002` (web) and `3101` (daemon). Override `HOST_PORT_WEB` / `HOST_PORT_DAEMON` if those are taken on the host. See [`docker/run.sh`](./docker/run.sh) and [`docker/README.md`](./docker/) (if present) for full options (`HOST_BIND_ADDR`, volume names, env passthrough).
+
+### Option 2 — From source (development)
+
+```bash
+git clone <this-repo> ework-web && cd ework-web
+cp .env.example .env       # fill WORK_TOKEN (≥8 chars) + WORK_COOKIE_SECRET (≥8 chars)
+bun install
+bun run check              # tsc --noEmit — must pass
+bun run dev                # :3002 watch (or bun run start for one-shot)
+```
+
+### Option 3 — Systemd (production)
+
+For a persistent single-host deploy, use the deploy script which rsyncs to `~/.local/share/ework/` and installs a systemd unit:
+
+```bash
+./scripts/deploy.sh --restart   # type-check → rsync src/ → bun install → install unit → restart
+```
+
+The unit runs under `User=ework` and reads `/var/lib/ework/.env`. Inspect or customize [`scripts/ework.service`](./scripts/ework.service) before first deploy; subsequent deploys leave the installed unit alone. See the **Deploy** section below for the full flow.
+
+### First-run setup
+
+1. Visit `http://127.0.0.1:3002/login` (or whichever `WORK_PORT` you set).
+2. Log in with the `WORK_TOKEN` you configured.
+3. Land on `/projects` — create a project inline, or just POST an issue to `/<owner>/<repo>/issues` and the project will be auto-created.
+
+## Configuration
+
+All env vars prefixed `WORK_*`. Zod-validated in `src/config.ts`.
+
+| Var | Default | Purpose |
+|---|---|---|
+| `WORK_PORT` | `3002` | Listen port |
+| `WORK_HOST` | `127.0.0.1` | Bind host (use `::` for IPv6 remote) |
+| `WORK_TOKEN` | — | Required access token (≥8 chars) |
+| `WORK_COOKIE_SECRET` | — | HMAC secret for auth cookie (≥8 chars) |
+| `WORK_OPERATOR_LOGIN` | `op` | Author attribution for writes |
+| `WORK_WRITES_ENABLED` | `true` | Gate all write ops |
+| `WORK_DB_PATH` | `$XDG_DATA_HOME/ework/ework.db` | SQLite DB location |
+| `WORK_ATTACHMENT_ROOT` | `$XDG_DATA_HOME/ework/attachments` | Attachment files root |
+
+Plus OpenCode / translate / TTS / file-viewer vars — see `.env.example` and `src/config.ts`.
+
+### Defaults worth knowing
+
+- **Port `3002`** — chosen to avoid the 119x range used by VPN/tunnels.
+- **Writes default `true`** — ework-web is intended for direct human use; flip `WORK_WRITES_ENABLED=false` for a read-only mirror.
+- **Auth scope** — single operator (`WORK_OPERATOR_LOGIN`) writing as one user. The schema reserves a `users` table for multi-user; not yet surfaced in the UI.
+
+## Project layout
+
+```
+src/
+├── index.ts             # Bun.serve :3002 + route dispatch + security headers
+├── config.ts            # Zod env validation (no gitea block)
+├── auth.ts              # token + HMAC cookie
+├── store.ts             # SQLite data layer (projects/issues/comments/labels/reactions/attachments)
+├── schema.sql           # DDL applied on boot
+├── db.ts                # rawDB handle + config table CRUD
+├── attachments.ts       # filesystem blob storage + Bun.file streaming
+├── ratelimit.ts         # token bucket
+├── opencode.ts          # OpenCode CLI client (read-only)
+├── translate.ts         # OpenAI-compatible translation
+├── fileview.ts          # file/dir viewer + security gate
+├── reactions.ts         # hydrate reactions onto CommentView[]
+├── render/
+│   ├── layout.ts        # SSR layout + THEME_CSS + utils
+│   ├── markdown.ts      # marked + DOMPurify + linkify (no Gitea rewrite)
+│   └── components.ts    # CommentView + renderCommentCard
+├── views/
+│   ├── issueThread.ts   # SSR issue thread (SQLite-backed)
+│   ├── issueList.ts     # per-project list (with search + state tabs)
+│   ├── issueNew.ts      # create-issue form
+│   ├── issues.ts        # global feed (cross-project)
+│   ├── home.ts          # projects list + new-project form
+│   ├── sessionLog.ts    # OpenCode session viewer
+│   └── settings.ts      # /settings form
+└── static/
+    ├── app.js           # issue-thread client (virtual scroll, poll, composer, reactions UI)
+    ├── session.js       # session-viewer client
+    ├── file.js          # file tail -f
+    ├── tts.js           # TTS playback
+    └── favicon.svg
+
+scripts/deploy.sh        # tsc → rsync → bun install → systemctl restart ework
+```
+
+## URL / API surface
+
+| Method | Path | Notes |
+|---|---|---|
+| `GET` | `/` | redirect → `/projects` |
+| `GET/POST` | `/projects` | projects list / create new |
+| `GET` | `/issues` | global feed (cross-project), `?state=&q=` |
+| `GET` | `/<o>/<r>/issues` | per-project list, `?state=&q=` |
+| `GET` | `/<o>/<r>/issues/new` | create form |
+| `POST` | `/<o>/<r>/issues` | create (auto-creates project if missing) |
+| `GET` | `/<o>/<r>/issues/<n>` | issue thread SSR |
+| `GET` | `/api/<o>/<r>/issues/<n>/page?page=K` | fetch older comments page |
+| `GET` | `/api/<o>/<r>/issues/<n>/since?since=ISO` | poll for new comments |
+| `POST` | `/api/<o>/<r>/issues/<n>/comment` | `{body, close?, reopen?}` |
+| `POST` | `/api/<o>/<r>/issues/<n>/upload` | multipart attachment upload |
+| `GET` | `/attachments/<uuid>` | stream attachment (image inline, else download) |
+| `GET` | `/sessions` `/sessions/:id` | OpenCode session browser |
+| `GET` | `/file` `/file/raw` `/file/dl` | file viewer (path-gated) |
+| `GET` | `/api/file/since` | tail -f polling |
+| `POST` | `/api/translate` `/api/translate/stream` | inline translation |
+| `POST` | `/api/tts` `GET /api/tts/stream/:id` | TTS staging + streaming |
+| `GET/POST` | `/settings` | runtime overrides |
+| `POST` | `/login` | token → cookie |
+
+## Deploy
+
+```bash
+git add -A && git commit -m "..."    # commit first (deploy.sh rsyncs working tree)
+./scripts/deploy.sh
+```
+
+`deploy.sh` type-checks → rsyncs `src/` → `bun install` → installs the systemd unit from `scripts/ework.service` on first run → restarts `ework.service`. To customize the unit (different user, port, env path), edit `scripts/ework.service` before first deploy; subsequent deploys leave the installed unit alone.
+
+Logs: `sudo journalctl -u ework -f`.
+
+## Scope
+
+- ❌ No issue edit/delete.
+- ❌ No milestones / assignees / PR / multi-user login (schema-compatible; not implemented).
+- ❌ No migration tool from Gitea (fresh start; can be added later).
+- ✅ **Never writes** to `opencode.db` (read-only SELECT).
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/bin/ework-web.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+import "../src/index.ts";

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "ework-web",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
+  "license": "MIT",
+  "author": "contributors",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ranxianglei/ework-web.git"
+  },
+  "homepage": "https://github.com/ranxianglei/ework-web",
+  "bugs": {
+    "url": "https://github.com/ranxianglei/ework-web/issues"
+  },
+  "keywords": [
+    "issue-tracker",
+    "gitea-compatible",
+    "opencode",
+    "sqlite",
+    "ssr",
+    "bun",
+    "self-hosted"
+  ],
+  "bin": {
+    "ework-web": "./bin/ework-web.js"
+  },
+  "files": [
+    "src",
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "bun": ">=1.1.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "dev": "bun --watch src/index.ts",
+    "start": "bun src/index.ts",
+    "check": "tsc --noEmit",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@types/dompurify": "^3.2.0",
+    "dompurify": "^3.4.11",
+    "highlight.js": "^11.10.0",
+    "jsdom": "^29.1.1",
+    "marked": "^15.0.0",
+    "marked-highlight": "^2.2.0",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@types/jsdom": "^28.0.3",
+    "typescript": "^5.6.0"
+  }
+}

package/src/attachments.ts

@@ -0,0 +1,54 @@
+// Filesystem-backed attachment storage. One file per uuid under WORK_ATTACHMENT_ROOT
+// (defaults to $XDG_DATA_HOME/ework/attachments). Streamed back via Bun.file so
+// large media never sits in memory.
+
+import { mkdirSync, writeFileSync, existsSync, statSync } from "fs";
+import { join } from "path";
+import { randomUUID } from "crypto";
+
+const ATTACHMENT_ROOT =
+  process.env.WORK_ATTACHMENT_ROOT ||
+  join(process.env.XDG_DATA_HOME || `${process.env.HOME}/.local/share`, "ework", "attachments");
+
+export const MAX_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+
+export function attachmentPath(uuid: string): string {
+  return join(ATTACHMENT_ROOT, uuid);
+}
+
+export function saveAttachmentBlob(uuid: string, data: Uint8Array): string {
+  mkdirSync(ATTACHMENT_ROOT, { recursive: true });
+  const p = attachmentPath(uuid);
+  writeFileSync(p, data);
+  return p;
+}
+
+export function newAttachmentUUID(): string {
+  return randomUUID();
+}
+
+type BunFile = ReturnType<typeof Bun.file>;
+
+export function readAttachmentStream(uuid: string): { file: BunFile; size: number } | null {
+  const p = attachmentPath(uuid);
+  if (!existsSync(p)) return null;
+  const stat = statSync(p);
+  return { file: Bun.file(p) as BunFile, size: stat.size };
+}
+
+export function sniffImageContentType(filename: string): string {
+  const lower = filename.toLowerCase();
+  if (lower.endsWith(".png")) return "image/png";
+  if (lower.endsWith(".jpg") || lower.endsWith(".jpeg")) return "image/jpeg";
+  if (lower.endsWith(".gif")) return "image/gif";
+  if (lower.endsWith(".webp")) return "image/webp";
+  if (lower.endsWith(".svg")) return "image/svg+xml";
+  if (lower.endsWith(".pdf")) return "application/pdf";
+  if (lower.endsWith(".txt")) return "text/plain; charset=utf-8";
+  if (lower.endsWith(".md")) return "text/markdown; charset=utf-8";
+  return "application/octet-stream";
+}
+
+export function isImageContentType(ct: string): boolean {
+  return ct.startsWith("image/");
+}

package/src/auth.ts

@@ -0,0 +1,218 @@
+import type { Config } from "./config";
+import { getUserByLogin, ensureUser, verifyPat, type UserRow } from "./store";
+
+// Per-user token-cookie auth. Cookie value is HMAC-signed and carries login +
+// issued-at, so the server is stateless (no session table). Two cookie formats
+// coexist for one release to avoid breaking existing sessions on upgrade:
+//   v2 (new): "v2.<login>.<issued_unix>.<sig>" — resolves to that user
+//   legacy:   "<token>.<sig>" — resolves to cfg.operatorLogin (shared-token era)
+
+export const AUTH_COOKIE_NAME = "ework_auth";
+export const AUTH_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+const COOKIE_VERSION = "v2";
+
+async function hmac(secret: string, msg: string): Promise<string> {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(msg));
+  return Buffer.from(new Uint8Array(sig)).toString("base64url");
+}
+
+function parseCookies(header: string | null): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx < 0) continue;
+    const k = part.slice(0, idx).trim();
+    const v = part.slice(idx + 1).trim();
+    if (k) out[k] = v;
+  }
+  return out;
+}
+
+export interface AuthResult {
+  ok: boolean;
+  user: UserRow | null;
+}
+
+export function authCookieName(cfg: Config): string {
+  // __Host- prefix (C2 hardening) requires Secure + Path=/ + no Domain and is only
+  // honored by browsers over TLS; cfg.secureCookie is flipped on only after Caddy/TLS.
+  return cfg.secureCookie ? `__Host-${AUTH_COOKIE_NAME}` : AUTH_COOKIE_NAME;
+}
+
+export async function makeAuthCookieHeader(cfg: Config, login: string): Promise<string> {
+  const issued = Math.floor(Date.now() / 1000);
+  const payload = `${COOKIE_VERSION}.${login}.${issued}`;
+  const sig = await hmac(cfg.cookieSecret, payload);
+  const value = `${payload}.${sig}`;
+  const flags = ["Path=/", "HttpOnly", `Max-Age=${AUTH_COOKIE_MAX_AGE_SECONDS}`, "SameSite=Lax"];
+  if (cfg.secureCookie) flags.push("Secure");
+  return `${authCookieName(cfg)}=${value}; ${flags.join("; ")}`;
+}
+
+// Logout: set Max-Age=0 so the browser drops the cookie immediately.
+export function clearAuthCookieHeader(cfg: Config): string {
+  const flags = ["Path=/", "HttpOnly", "Max-Age=0", "SameSite=Lax"];
+  if (cfg.secureCookie) flags.push("Secure");
+  return `${authCookieName(cfg)}=; ${flags.join("; ")}`;
+}
+
+function ctEqual(a: string, b: string): boolean {
+  const ab = new TextEncoder().encode(a);
+  const bb = new TextEncoder().encode(b);
+  if (ab.length !== bb.length) return false;
+  let diff = 0;
+  for (let i = 0; i < ab.length; i++) diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  return diff === 0;
+}
+
+// v2 cookie parse: value is "v2.<login>.<issued>.<sig>" where login is
+// guaranteed not to contain "." (enforced by LOGIN_RE in store.ts).
+function parseV2Cookie(value: string): { login: string; issued: string; sig: string } | null {
+  const parts = value.split(".");
+  if (parts.length !== 4 || parts[0] !== COOKIE_VERSION) return null;
+  const [, login, issued, sig] = parts;
+  if (!login || !issued || !sig) return null;
+  return { login, issued, sig };
+}
+
+export async function checkAuth(req: Request, cfg: Config, ip?: string | null): Promise<AuthResult> {
+  const cookies = parseCookies(req.headers.get("cookie"));
+  const cookieVal = cookies[authCookieName(cfg)];
+
+  if (cookieVal) {
+    if (cookieVal.startsWith(`${COOKIE_VERSION}.`)) {
+      const parsed = parseV2Cookie(cookieVal);
+      if (!parsed) return { ok: false, user: null };
+      const payload = `${COOKIE_VERSION}.${parsed.login}.${parsed.issued}`;
+      const expected = await hmac(cfg.cookieSecret, payload);
+      if (!ctEqual(parsed.sig, expected)) return { ok: false, user: null };
+      const user = getUserByLogin(parsed.login);
+      if (!user || !user.is_active) return { ok: false, user: null };
+      return { ok: true, user };
+    }
+
+    // Legacy format: "<token>.<sig>". Accept only if token == cfg.authToken,
+    // then resolve to the configured operator user (auto-created on boot by
+    // ensureBootstrapAdmin in index.ts).
+    const dot = cookieVal.lastIndexOf(".");
+    if (dot <= 0) return { ok: false, user: null };
+    const token = cookieVal.slice(0, dot);
+    const sig = cookieVal.slice(dot + 1);
+    const expected = await hmac(cfg.cookieSecret, token);
+    if (!ctEqual(sig, expected) || !ctEqual(token, cfg.authToken)) {
+      return { ok: false, user: null };
+    }
+    const user = getUserByLogin(cfg.operatorLogin);
+    if (!user || !user.is_active) return { ok: false, user: null };
+    return { ok: true, user };
+  }
+
+  // PAT bearer (API clients / agents). Same auth surface as cookies, so any
+  // route that takes a logged-in cookie also takes a Bearer PAT. Two header
+  // shapes are accepted:
+  //   "Bearer <token>"      — RFC 6750 / OAuth standard (also GitHub-compat)
+  //   "token <token>"       — Gitea legacy form (Gitea's own client uses this)
+  const authHeader = req.headers.get("authorization");
+  if (authHeader) {
+    const lower = authHeader.toLowerCase();
+    let token: string | null = null;
+    if (lower.startsWith("bearer ")) {
+      token = authHeader.slice(7).trim();
+    } else if (lower.startsWith("token ")) {
+      token = authHeader.slice(6).trim();
+    }
+    if (token) {
+      const user = await verifyPat(token, ip);
+      if (user) return { ok: true, user };
+    }
+  }
+
+  return { ok: false, user: null };
+}
+
+export function ensureBootstrapAdmin(login: string): UserRow {
+  const existing = getUserByLogin(login);
+  if (existing) return existing;
+  return ensureUser(login, "human");
+}
+
+// Reserved system user for automated actions (cron, import jobs, future CI
+// integration). kind=system, no password (cannot login via UI). Created on
+// boot if missing. UI guards prevent disabling/deleting it.
+export function ensureBootstrapSystem(login: string): UserRow {
+  const existing = getUserByLogin(login);
+  if (existing) return existing;
+  return ensureUser(login, "system");
+}
+
+export function isReservedSystemLogin(login: string, cfg: Config): boolean {
+  return login === cfg.systemLogin;
+}
+
+// Same-origin relative targets only. Rejects "//" and "/\" — browsers collapse a
+// leading "/\" to "//" (protocol-relative), an open-redirect bypass (M1).
+export function sanitizeNext(next: string): string {
+  if (!next.startsWith("/") || next.startsWith("//") || next.startsWith("/\\")) return "/";
+  try {
+    const u = new URL(next, "http://x.invalid");
+    if (u.origin !== "http://x.invalid") return "/";
+  } catch {
+    return "/";
+  }
+  return next;
+}
+
+function esc(s: string): string {
+  return (s ?? "")
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
+export function loginHTML(next: string, error?: string): string {
+  const err = error ? `<div class="err">${esc(error)}</div>` : "";
+  return `<!doctype html><html lang="zh"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<link rel="icon" type="image/svg+xml" href="/favicon.svg">
+<title>登录 · ework</title>
+<style>
+body{font-family:system-ui,-apple-system,sans-serif;background:#1b1b1b;color:#e6e6e6;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}
+.box{background:#262626;border:1px solid #373737;border-radius:12px;padding:1.8rem;max-width:360px;width:90%}
+h1{font-size:18px;margin:0 0 1.2rem;font-weight:600}
+label{display:block;font-size:12px;color:#9a9a9a;margin:0 0 .25rem}
+input{width:100%;box-sizing:border-box;padding:.75rem;border:1px solid #373737;border-radius:8px;background:#1b1b1b;color:#e6e6e6;font:inherit;margin-bottom:.8rem}
+input:focus{outline:none;border-color:#2da44e}
+button{width:100%;padding:.75rem;border:none;border-radius:8px;background:#2da44e;color:#fff;font:600 14px system-ui,sans-serif;cursor:pointer}
+button:hover{background:#218742}
+.err{color:#f85149;font-size:13px;margin-bottom:.8rem}
+.hint{color:#9a9a9a;font-size:12px;line-height:1.5;margin-top:.6rem}
+.divider{display:flex;align-items:center;gap:.6rem;color:#666;font-size:12px;margin:1rem 0 .6rem}
+.divider::before,.divider::after{content:"";flex:1;height:1px;background:#373737}
+.section-tag{display:inline-block;background:#373737;color:#d6d6d6;font-size:11px;padding:.15rem .55rem;border-radius:4px;margin-bottom:.4rem}
+</style></head><body>
+<form class="box" method="POST" action="/login" autocomplete="on">
+<h1>🔒 ework 登录</h1>
+${err}
+<span class="section-tag">首次登录 / 管理员</span>
+<label for="f-token">共享 token</label>
+<input id="f-token" name="token" type="password" autocomplete="off" autofocus placeholder="WORK_TOKEN（新部署时填这个）">
+<div class="hint">新部署的管理员 token 在 <code>.env</code> 文件的 <code>WORK_TOKEN</code> 里。</div>
+<div class="divider">或已注册用户</div>
+<label for="f-login">用户名</label>
+<input id="f-login" name="login" type="text" autocomplete="username">
+<label for="f-pw">密码</label>
+<input id="f-pw" name="password" type="password" autocomplete="current-password">
+<input type="hidden" name="next" value="${esc(next)}">
+<button type="submit">登录</button>
+<div class="hint">登录后 cookie 30 天有效；token 登录后可在「我的」页面给自己设密码，之后即可用户名密码登录。</div>
+</form></body></html>`;
+}

package/src/build.ts

@@ -0,0 +1,17 @@
+import { statSync } from "fs";
+import { join } from "path";
+
+const STATIC = join(__dirname, "static");
+let m = 0;
+for (const f of ["app.js", "session.js", "file.js", "tts.js", "highlight.css"]) {
+  try {
+    const s = statSync(join(STATIC, f));
+    if (s.mtimeMs > m) m = s.mtimeMs;
+  } catch (e) {
+    /* file missing at boot — fall through to Date.now() */
+  }
+}
+
+// Cache-bust query for /static/*.js — changes on every deploy (newest mtime),
+// forcing browsers to fetch fresh instead of serving a stale heuristic-cached copy.
+export const BUILD_ID = String(m || Date.now());