ework-web 0.10.105 → 0.10.107

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.105",
+  "version": "0.10.107",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/index.ts

@@ -391,6 +391,8 @@ const REPO_MEMBER_ACTION_RE = /^\/([^/]+)\/([^/]+)\/settings\/members\/([^/]+)\/
 const REPO_MEMBER_ADD_RE = /^\/([^/]+)\/([^/]+)\/settings\/members\/add$/;
 const REPO_VISIBILITY_RE = /^\/([^/]+)\/([^/]+)\/settings\/visibility$/;
 const REPO_DISPATCH_RE = /^\/([^/]+)\/([^/]+)\/settings\/dispatch$/;
+
+const REPO_WAKE_LOGINS_RE = /^\/([^/]+)\/([^/]+)\/settings\/ai\/wake-logins$/;
 const REPO_HALT_ALL_RE = /^\/([^/]+)\/([^/]+)\/settings\/ai\/halt-all$/;
 const SETTINGS_DISPATCH_RE = /^\/settings\/dispatch$/;
 const REPO_UPSTREAMS_RE = /^\/([^/]+)\/([^/]+)\/settings\/upstreams$/;
@@ -611,6 +613,15 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       const issueOff = aiStatus === "dispatch_off" || aiStatus === "halted";
       return json({ dispatchOff: globalOff || projectOff || issueOff, aiStatus });
     }
+    if (url.pathname === "/api/v1/wake-logins" && req.method === "GET") {
+      const owner = url.searchParams.get("owner") ?? "";
+      const repo = url.searchParams.get("repo") ?? "";
+      if (!owner || !repo) return json({ error: "owner, repo required" }, 400);
+      const cfgKv = await getConfigAll();
+      const logins = (cfgKv[`wakeLogins:${owner}/${repo}`] ?? "")
+        .split(/[\s,]+/).map((s) => s.trim()).filter(Boolean);
+      return json({ logins });
+    }
     const evStatus = url.pathname.match(/^\/api\/v1\/repos\/([^/]+)\/([^/]+)\/issues\/(\d+)\/status$/);
     if (evStatus && req.method === "POST") {
       const [, owner, repo, numStr] = evStatus;
@@ -2128,6 +2139,57 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       return Response.redirect(`${back}?ok=1&ok_msg=${encodeURIComponent(isOff ? "已开启自动接单" : "已关闭自动接单")}`, 303);
     }
 
+    const repoWakeLoginsMatch = url.pathname.match(REPO_WAKE_LOGINS_RE);
+    if (repoWakeLoginsMatch) {
+      const [, owner, repo] = repoWakeLoginsMatch;
+      if (!(owner && repo)) return html(errorPage("bad path", ""), 400);
+      const project = await getProject(owner, repo);
+      if (!project) return html(errorPage("项目不存在", ""), 404);
+      const aiBack = `${url.origin}/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/settings/ai`;
+      const wantsJson = url.searchParams.get("json") === "1";
+      if (!(await canAdminProject(project.id, ctx.user))) {
+        if (wantsJson) return json({ error: "需要该项目 admin 角色" }, 403);
+        return Response.redirect(`${aiBack}?err=${encodeURIComponent("无权限")}`, 303);
+      }
+      const fd = await req.formData();
+      const key = `wakeLogins:${owner}/${repo}`;
+      const current = ((await getConfigAll())[key] ?? "")
+        .split(/[\s,]+/).map((s) => s.trim()).filter(Boolean);
+      const validLogin = (l: string) => /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38}[A-Za-z0-9])?$/.test(l);
+      let next: string[];
+      const add = String(fd.get("add") ?? "").trim();
+      if (add) {
+        if (!validLogin(add)) {
+          if (wantsJson) return json({ error: "无效的用户名" }, 400);
+          return Response.redirect(`${aiBack}?err=${encodeURIComponent(`无效的用户名：${add}`)}`, 303);
+        }
+        next = current.some((l) => l.toLowerCase() === add.toLowerCase())
+          ? current
+          : [...current, add];
+      } else {
+        const seen = new Set<string>();
+        next = String(fd.get("logins") ?? "")
+          .split(/[\s,]+/).map((s) => s.trim()).filter(Boolean)
+          .filter((l) => {
+            if (!validLogin(l)) return false;
+            const lower = l.toLowerCase();
+            if (seen.has(lower)) return false;
+            seen.add(lower);
+            return true;
+          });
+      }
+      if (next.length === 0) await deleteConfig(key);
+      else await setConfig(key, next.join(","));
+      if (wantsJson) return json({ ok: true, logins: next });
+      const backRaw = String(fd.get("back") ?? "").trim();
+      const back = backRaw && backRaw.startsWith("/") ? backRaw : aiBack;
+      const sep = back.includes("?") ? "&" : "?";
+      return Response.redirect(
+        `${back}${sep}ok=1&ok_msg=${encodeURIComponent(add ? `已把 ${add} 加入唤醒白名单` : "唤醒白名单已保存")}`,
+        303,
+      );
+    }
+
     const repoHaltAllMatch = url.pathname.match(REPO_HALT_ALL_RE);
     if (repoHaltAllMatch) {
       const [, owner, repo] = repoHaltAllMatch;
@@ -2431,7 +2493,8 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     const globalDispatchOff = dispatchCfg["dispatchEnabled"] === "false";
     const running = await getRunningSessionsForProject(`${owner}/${repo}`);
     const processingCount = new Set(running.map((r) => r.issueNumber)).size;
-    return html(buildProjectAiPage(project, dispatchOff, globalDispatchOff, processingCount).html);
+    const wakeLoginsRaw = dispatchCfg[`wakeLogins:${owner}/${repo}`] ?? "";
+    return html(buildProjectAiPage(project, dispatchOff, globalDispatchOff, processingCount, wakeLoginsRaw).html);
   }
 
   const upstreamsPage = url.pathname.match(REPO_UPSTREAMS_RE);

package/src/render/layout.ts

@@ -26,6 +26,7 @@ export interface LayoutProps {
   extraStatusBadges?: Record<string, { cls: string; label: string }>;
   modelSelect?: { current: string; options: { id: string; label: string }[] } | null;
   runtimeSelect?: { current: string } | null;
+  authorLineHtml?: string;
 }
 
 export const THEME_CSS = `
@@ -83,6 +84,8 @@ header.topbar .num{opacity:.7}
 .ttsstop:hover{color:var(--accent)}
 .cbtn,.tbtn{background:none;border:none;cursor:pointer;font-size:13px;color:var(--text-muted);padding:0 .2rem;opacity:.6;line-height:1.5}
 .cbtn:hover,.tbtn:hover{opacity:1;color:var(--accent)}
+.wlbtn{background:none;border:1px solid var(--border);border-radius:4px;cursor:pointer;font-size:11px;color:var(--text-muted);padding:.05rem .35rem;margin-right:.3rem;line-height:1.5}
+.wlbtn:hover{color:var(--accent);border-color:var(--accent)}
 .clink:hover{opacity:1;color:var(--accent)}
 .clink.done{color:var(--green);opacity:1}
 .rx{display:inline-flex;gap:.3rem;align-items:center;margin-left:.2rem;flex-wrap:wrap}
@@ -161,6 +164,9 @@ header.topbar .num{opacity:.7}
 .action-btn.dispatch-btn:hover{background:#6f7781;color:#fff}
 .action-btn.custom-btn{color:var(--accent)}
 .action-btn.custom-btn:hover{background:var(--accent);color:#fff}
+.author-line{color:var(--fg-muted);font-size:.9em;margin:2px 0 6px}
+.author-line .wl-form{display:inline;margin-left:8px}
+.author-line .kind-tag{font-size:.75em;border:1px solid var(--border);border-radius:8px;padding:0 6px;margin-left:4px;color:var(--fg-muted)}
 `;
 
 export function renderLayout(props: LayoutProps, inner: string, initialItems: string): string {
@@ -241,6 +247,7 @@ export function renderLayout(props: LayoutProps, inner: string, initialItems: st
 </header>
 <div class="meta-bar">
   <h1>${escapeHtml(props.issueTitle)}</h1>
+  ${props.authorLineHtml ?? ""}
   <div class="meta-status">
     <span class="state-badge ${stateClass}">${stateLabel}</span>
     ${aiBadgeHtml}

package/src/static/app.js

@@ -36,8 +36,17 @@
     seenIds: new Set(P.comments.map((c) => c.id)),
     newIds: new Set(),
     booted: false,
+    canWhitelist: P.canWhitelist === true,
+    wakeSet: toSet(P.wakeLogins),
+    trustedSet: toSet(P.trustedLogins),
   };
 
+  function toSet(list) {
+    const s = {};
+    (list || []).forEach(function (l) { s[String(l).toLowerCase()] = 1; });
+    return s;
+  }
+
   const $ = (id) => document.getElementById(id);
   const itemsEl = $("items");
   const countEl = $("count");
@@ -131,6 +140,9 @@
       `<span class="when" data-ts="${esc(c.created_at)}" title="${esc(c.created_at)}">${relTime(c.created_at)}</span>` +
       rx +
       `<span class="card-actions">` +
+      (state.canWhitelist && tag === "human" && c.login && !state.trustedSet[c.login.toLowerCase()] && !state.wakeSet[c.login.toLowerCase()]
+        ? `<button type="button" class="wlbtn" data-login="${esc(c.login)}" title="把 ${esc(c.login)} 加入本项目唤醒白名单">＋白名单</button>`
+        : "") +
       `<button type="button" class="cbtn" data-cid="${c.id}" title="复制">📋</button>` +
       `<button type="button" class="clink" data-cid="${c.id}" title="复制楼层链接">🔗</button>` +
       `<button type="button" class="tbtn" data-cid="${c.id}" title="翻译">翻译</button>` +
@@ -359,6 +371,22 @@
     }
     if (e.target.closest(".cbtn")) { doCopy(e.target.closest(".cbtn")); return; }
     if (e.target.closest(".tbtn")) { doTranslate(e.target.closest(".tbtn")); return; }
+    const wl = e.target.closest(".wlbtn");
+    if (wl) {
+      const login = wl.getAttribute("data-login") || "";
+      if (!login || wl.disabled) return;
+      wl.disabled = true;
+      wl.textContent = "…";
+      fetch(`/${encodeURIComponent(state.owner)}/${encodeURIComponent(state.repo)}/settings/ai/wake-logins?json=1`, {
+        method: "POST",
+        body: new URLSearchParams({ add: login }),
+      }).then((r) => r.json().then((d) => ({ ok: r.ok, d }))).then(({ ok, d }) => {
+        if (!ok) { wl.disabled = false; wl.textContent = "＋白名单"; alert((d && d.error) || "加白失败"); return; }
+        state.wakeSet[login.toLowerCase()] = 1;
+        render();
+      }).catch(() => { wl.disabled = false; wl.textContent = "＋白名单"; alert("网络错误，加白失败"); });
+      return;
+    }
   });
 
   itemsEl.addEventListener("click", (e) => {

package/src/views/issueThread.ts

@@ -1,7 +1,7 @@
 import type { Config } from "../config";
 import { classifyActor, renderCommentCard, type CommentView } from "../render/components";
 import { renderMarkdown } from "../render/markdown";
-import { renderLayout, escapeHtml } from "../render/layout";
+import { renderLayout, escapeHtml, escapeAttr } from "../render/layout";
 import { runIssueActionsHook, type IssueActionContext, type IssueAction } from "../issue-actions-hook";
 import { hydrateReactions } from "../reactions";
 import {
@@ -15,10 +15,12 @@ import {
   listLabelsForIssue,
   getUserByLogin,
   listCachedModels,
+  listProjectMembersWithUsers,
   type CommentRow,
   type IssueWithMeta,
   type ProjectRow,
 } from "../store";
+import { getConfigAll } from "../db";
 import { webUrlFromClone } from "./projectUpstreams";
 
 export const PAGE_SIZE = 30;
@@ -36,6 +38,9 @@ export interface IssueThreadPayload {
   sinceISO: string;
   commentSort: "desc" | "asc";
   comments: CommentView[];
+  canWhitelist?: boolean;
+  wakeLogins?: string[];
+  trustedLogins?: string[];
 }
 
 // Issues in a project cloned from an upstream are that upstream's issues:
@@ -127,7 +132,6 @@ export async function buildIssueThread(
   const hasOlder = currentPage > 1;
   const displayViews = orderForDisplay(views, cfg.commentSort);
   const payload = payloadFromComments(issue, displayViews, currentPage, hasOlder, cfg.commentSort);
-
   const descriptionHtml = renderMarkdown(issue.body, "", issuePath);
   const descriptionCollapsed = issue.body.length > 1200;
   const upstreamWebUrl = (() => {
@@ -139,6 +143,36 @@ export async function buildIssueThread(
   const viewerUser = viewerLogin ? await getUserByLogin(viewerLogin) : null;
   const viewerIsAdmin = !!viewerUser?.is_admin;
 
+  // Consumed by app.js to render ＋白名单 buttons on external authors' comments.
+  const cfgKv = await getConfigAll();
+  payload.canWhitelist = viewerIsAdmin;
+  payload.wakeLogins = (cfgKv[`wakeLogins:${owner}/${repo}`] ?? "")
+    .split(/[\s,]+/).map((s) => s.trim()).filter(Boolean);
+  payload.trustedLogins = (await listProjectMembersWithUsers(project.id)).map((m) => m.user_login);
+
+  // Submitter line: synced upstream issues/PRs carry their real author. The
+  // ＋白名单 form targets the wake-logins route (add+back fields, 303 back).
+  const authorUser = await getUserByLogin(issue.author);
+  const authorKind = authorUser?.kind ?? "human";
+  const trustedList = payload.trustedLogins ?? [];
+  const wakeList = payload.wakeLogins ?? [];
+  const lowerAuthor = issue.author.toLowerCase();
+  const showAuthorWhitelist =
+    viewerIsAdmin &&
+    authorKind === "human" &&
+    !trustedList.some((l) => l.toLowerCase() === lowerAuthor) &&
+    !wakeList.some((l) => l.toLowerCase() === lowerAuthor);
+  const authorLineHtml =
+    `<div class="author-line">由 <strong>${escapeHtml(issue.author)}</strong> 提交` +
+    (authorKind === "bot" ? ` <span class="kind-tag">bot</span>` : "") +
+    (showAuthorWhitelist
+      ? `<form method="post" action="/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/settings/ai/wake-logins" class="wl-form">` +
+        `<input type="hidden" name="back" value="/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/issues/${issue.number}">` +
+        `<input type="hidden" name="add" value="${escapeAttr(issue.author)}">` +
+        `<button type="submit" class="wlbtn">＋白名单</button></form>`
+      : "") +
+    `</div>`;
+
   let customActions: IssueAction[] = [];
   let extraStatusBadges: Record<string, { cls: string; label: string }> | undefined;
   if (cfg.issueActionsHook && viewerLogin) {
@@ -183,6 +217,7 @@ export async function buildIssueThread(
         ? { current: issue.model ?? "", options: (await listCachedModels()).map((m) => ({ id: m.id, label: m.label })) }
         : null,
       runtimeSelect: cfg.writesEnabled !== false ? { current: issue.runtime ?? "" } : null,
+      authorLineHtml,
     },
     safeJsonEmbed(payload),
     displayViews.map((v) => renderCommentCard(v, cfg)).join("")

package/src/views/projectAi.ts

@@ -7,6 +7,7 @@ export function buildProjectAiPage(
   dispatchOff: boolean,
   globalDispatchOff: boolean,
   processingCount: number,
+  wakeLoginsRaw = "",
 ): { html: string } {
   const aiBase = `/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/ai`;
   const dispatchAction = `/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/dispatch`;
@@ -28,6 +29,14 @@ ${hint}
 </form>`;
   })();
 
+  const wakeList = wakeLoginsRaw.split(/[\s,]+/).map((s) => s.trim()).filter(Boolean);
+  const wakeCard = `<form class="card" method="POST" action="${escapeAttr(`${aiBase}/wake-logins`)}">
+<h2>👥 唤醒白名单</h2>
+<div class="hint">默认只有平台成员能唤醒 AI。把外部 GitHub 用户加进来（逗号或换行分隔），他们在<b>本项目</b>的新 issue / 评论就会自动触发 AI 处理。bot 账号（如 github-actions[bot]）永远无效；全局与项目接单开关仍是总闸。issue 评论区对外部用户也有「＋白名单」一键按钮。清空内容保存即删除白名单。</div>
+<textarea name="logins" rows="4" style="width:100%;box-sizing:border-box;background:var(--bg-muted);color:var(--text);border:1px solid var(--border);border-radius:6px;padding:.5rem;font-family:inherit;font-size:13px" placeholder="stirp&#10;Rika-xie">${escapeHtml(wakeList.join("\n"))}</textarea>
+<button type="submit" class="primary" style="margin-top:.5rem">保存白名单${wakeList.length > 0 ? `（当前 ${wakeList.length} 人）` : ""}</button>
+</form>`;
+
   const haltCard = (() => {
     const hint = processingCount > 0
       ? `当前有 <b>${processingCount}</b> 个 AI 会话正在运行。点击下方按钮将全部停止（向 daemon 发送 halt 信号）。`
@@ -77,11 +86,12 @@ ${projectSettingsTabsHTML(project.owner, project.name, "ai")}
 <h1>🤖 AI 设置</h1>
 <p class="hint">两个独立控制：<b>🔔 自动接单</b>控制是否自动派新单（不影响运行中）；<b>⏹️ 停止</b>杀死当前所有运行中AI会话（不影响接单状态）。模型选择请去 <a href="${escapeAttr(`/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/model`)}">⚙️ 模型</a> 标签页。</p>
 ${dispatchCard}
+${wakeCard}
 ${haltCard}
 
 <div class="card future">
 <h2>更多配置（规划中）</h2>
-<div class="hint">后续版本将在此标签页增加：项目级唤醒策略、Nudge 间隔、Observer 开关等。</div>
+<div class="hint">后续版本将在此标签页增加：Nudge 间隔、Observer 开关等。</div>
 </div>
 </main></body></html>`;
   return { html };