ework-web 0.10.100 → 0.10.102

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.100",
+  "version": "0.10.102",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/coordination.ts

@@ -1,5 +1,6 @@
 import { getDB } from "./db";
 import { log } from "./logger";
+import { loadConfig } from "./config";
 
 export interface DaemonInfo {
   id: number;
@@ -19,6 +20,50 @@ export interface DaemonDetail {
 
 const HEARTBEAT_STALE_MS = 120_000;
 
+// Split-UID deployments keep the daemon registry in the daemon's own SQLite
+// DB, unreachable (and table-absent) from the web process — the \{\{d_*\}\}
+// queries then fail and every lookup silently degrades to "no daemons".
+// Fall back to the router's registry API, which holds the same rows and is
+// the natural source of truth when web and daemon share no database.
+interface RouterDaemonRow {
+  id: number;
+  displayName: string;
+  endpoint: string;
+  capacity: number;
+  lastHeartbeat: string;
+  status: string;
+}
+
+let routerCache: { at: number; rows: RouterDaemonRow[] } | null = null;
+
+async function routerDaemons(): Promise<RouterDaemonRow[]> {
+  if (routerCache && Date.now() - routerCache.at < 15_000) return routerCache.rows;
+  try {
+    const cfg = await loadConfig();
+    if (!cfg.daemonWebhookUrl) return [];
+    const res = await fetch(`${cfg.daemonWebhookUrl.replace(/\/$/, "")}/api/daemons`, {
+      signal: AbortSignal.timeout(5000),
+    });
+    const data = (await res.json()) as { daemons?: Array<Partial<RouterDaemonRow>> };
+    const rows: RouterDaemonRow[] = (data.daemons ?? [])
+      .filter((d): d is Partial<RouterDaemonRow> & { id: number; endpoint: string } =>
+        typeof d.id === "number" && typeof d.endpoint === "string")
+      .map((d) => ({
+        id: d.id,
+        displayName: typeof d.displayName === "string" ? d.displayName : `daemon-${d.id}`,
+        endpoint: d.endpoint,
+        capacity: typeof d.capacity === "number" ? d.capacity : 0,
+        lastHeartbeat: typeof d.lastHeartbeat === "string" ? d.lastHeartbeat : "",
+        status: typeof d.status === "string" ? d.status : "unknown",
+      }));
+    routerCache = { at: Date.now(), rows };
+    return rows;
+  } catch (e) {
+    log.info(`coordination: router registry fallback failed (${e instanceof Error ? e.message : String(e)})`);
+    return [];
+  }
+}
+
 export async function getActiveDaemons(): Promise<DaemonInfo[]> {
   const stale = new Date(Date.now() - HEARTBEAT_STALE_MS);
   const staleStr = stale.toISOString().slice(0, 19).replace("T", " ");
@@ -130,19 +175,20 @@ export async function getSessionDaemonMap(): Promise<Map<string, SessionDaemonIn
 
 export async function resolveDaemonEndpoint(daemonId: number): Promise<string | null> {
   try {
-    const rows = await getDB().all<{ internal_endpoint: string | null }>(
-      `SELECT internal_endpoint FROM {{d_daemons}} WHERE id = ?`,
+    const local = await getDB().all<{ internal_endpoint: string }>(
+      "SELECT internal_endpoint FROM {{d_daemons}} WHERE id = ? LIMIT 1",
       [daemonId],
     );
-    const ep = rows[0]?.internal_endpoint;
-    if (!ep) return null;
-    return ep;
+    const ep = local[0]?.internal_endpoint;
+    if (ep) return ep;
   } catch (e) {
-    log.info(`coordination: resolve daemon ${daemonId} failed (${e instanceof Error ? e.message : String(e)})`);
-    return null;
+    log.info(`coordination: local daemon lookup failed (${e instanceof Error ? e.message : String(e)})`);
   }
+  const row = (await routerDaemons()).find((d) => d.id === daemonId);
+  return row ? row.endpoint : null;
 }
 
+
 export interface RunningSessionInfo {
   issueNumber: string;
   sessionId: string;

package/src/index.ts

@@ -208,7 +208,6 @@ const SEC_HEADERS: Record<string, string> = {
   "x-content-type-options": "nosniff",
   "x-frame-options": "DENY",
   "referrer-policy": "same-origin",
-  "permissions-policy": "()",
 };
 
 function buildCsp(cfg: Config): string {
@@ -1828,11 +1827,19 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       const [, owner, repo, numStr] = cp;
       if (!(owner && repo && numStr)) return json({ error: "bad path" }, 400);
       const number = Number(numStr);
+      const isFormSubmit = (req.headers.get("content-type") || "").includes("application/x-www-form-urlencoded");
       try {
-        const payload = (await req.json().catch(() => ({}))) as { body?: unknown; close?: unknown; reopen?: unknown };
-        const body = typeof payload.body === "string" ? payload.body : "";
+        const payload = isFormSubmit
+          ? ((await req.formData().catch(() => new FormData())) as FormData)
+          : ((await req.json().catch(() => ({}))) as { body?: unknown; close?: unknown; reopen?: unknown });
+        const body = typeof (payload as FormData).get === "function"
+          ? String((payload as FormData).get("body") ?? "")
+          : typeof (payload as { body?: unknown }).body === "string"
+            ? ((payload as { body: string }).body)
+            : "";
         const hasBody = body.trim().length > 0;
-        const wantsStateChange = payload.close === true || payload.reopen === true;
+        const jsonPayload = isFormSubmit ? null : (payload as { close?: unknown; reopen?: unknown });
+        const wantsStateChange = (jsonPayload?.close ?? jsonPayload?.reopen) === true;
         if (!hasBody && !wantsStateChange) return json({ error: "body required" }, 400);
         if (body.length > 65536) return json({ error: "body too long" }, 413);
         const project = await getProject(owner, repo);
@@ -1855,11 +1862,11 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
         }
         let closed = false;
         let reopened = false;
-        if (payload.close === true) {
+        if (jsonPayload?.close === true) {
           await setIssueState(issue.id, "closed");
           closed = true;
           void emitIssueEvent(project.id, issue.id, "closed", url.origin);
-        } else if (payload.reopen === true) {
+        } else if (jsonPayload?.reopen === true) {
           await setIssueState(issue.id, "open");
           reopened = true;
           void emitIssueEvent(project.id, issue.id, "reopened", url.origin);
@@ -1867,8 +1874,17 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
         if (view) {
           void emitCommentEvent(project.id, issue.id, view.id, url.origin);
         }
+        if (isFormSubmit) {
+          return new Response(null, {
+            status: 303,
+            headers: { location: `/${owner}/${repo}/issues/${number}${view ? `#comment-${view.id}` : ""}` },
+          });
+        }
         return json({ comment: view, closed, reopened });
       } catch (e) {
+        if (isFormSubmit) {
+          return new Response(null, { status: 303, headers: { location: `/${owner}/${repo}/issues/${number}` } });
+        }
         return json({ error: errMsg(e) }, e instanceof StoreError ? e.status : 500);
       }
     }

package/src/render/layout.ts

@@ -263,8 +263,8 @@ ${props.descriptionHtml.trim() ? `<div class="desc-wrap">
   ${props.descriptionCollapsed ? `<button type="button" class="desc-toggle" id="descToggle">显示详情 ▾</button>` : ""}
 </div>` : ""}
 ${props.writesEnabled !== false
-  ? `<form id="composer" class="composer">
-  <textarea id="composerInput" rows="5" placeholder="写评论…（Ctrl/⌘+Enter 发送，以 ${escapeHtml(op)} 身份；可粘贴/选择图片或任意文件上传）"></textarea>
+  ? `<form id="composer" class="composer" method="post" action="/api/${encodeURIComponent(repoOwner ?? "")}/${encodeURIComponent(repoName ?? "")}/issues/${props.issueNumber}/comment">
+  <textarea id="composerInput" name="body" rows="5" placeholder="写评论…（Ctrl/⌘+Enter 发送，以 ${escapeHtml(op)} 身份；可粘贴/选择图片或任意文件上传）"></textarea>
   <div class="submit-col">
     <button type="button" id="composerClose" class="btn-close" data-action="${toggleAction}" title="${toggleTitle}">${toggleLabel}</button>
     <label class="upload-btn" title="上传图片/附件/文件">📎<input type="file" id="composerFile" multiple></label>

package/src/static/app.js

@@ -6,6 +6,16 @@
   const initialEl = document.getElementById("initial-data");
   const P = initialEl ? JSON.parse(initialEl.textContent) : null;
   if (!P) return;
+  const earlyForm = document.getElementById("composer");
+  if (earlyForm) {
+    earlyForm.addEventListener(
+      "submit",
+      (e) => {
+        if (!e.defaultPrevented) e.preventDefault();
+      },
+      { capture: true }
+    );
+  }
   const MAX_DOM = 300;
   const POLL_MS = 5000;
   const NEW_FADE_MS = 4500;