ework-web 0.10.35 → 0.10.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.35",
+  "version": "0.10.37",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/config.ts

@@ -93,6 +93,13 @@ export const configSchema = z.object({
     if (!Number.isFinite(n) || n < 1 || n > 64) return 6;
     return Math.floor(n);
   }, z.number().int().min(1).max(64)),
+  // Space-separated list of origins (e.g. "https://ework-web.taobao.net http://ework-web.taobao.net")
+  // injected into CSP form-action + connect-src. For reverse-proxy/gateway deployments
+  // where the browser sees a different scheme/host than the app's 'self'.
+  publicOrigins: z
+    .string()
+    .default("")
+    .transform((s) => s.split(/\s+/).filter(Boolean)),
 });
 
 export type Config = z.infer<typeof configSchema>;
@@ -188,6 +195,7 @@ export async function loadConfig(): Promise<Config> {
     defaultModel: db.defaultModel ?? process.env.WORK_DEFAULT_MODEL,
     autowireActive: process.env.WORK_AUTOWIRE_ACTIVE !== "false",
     webhookMaxConcurrent: Number(process.env.WORK_WEBHOOK_MAX_CONCURRENT ?? "6"),
+    publicOrigins: process.env.WORK_PUBLIC_ORIGINS ?? "",
   });
 }
 

package/src/db.ts

@@ -301,7 +301,8 @@ function translateForMysql(sql: string): string {
   return sql
     .replace(/INSERT OR IGNORE INTO/g, "INSERT IGNORE INTO")
     .replace(/ON CONFLICT\((\w+)\) DO UPDATE SET/g, "ON DUPLICATE KEY UPDATE")
-    .replace(/excluded\.(\w+)/g, "VALUES($1)");
+    .replace(/excluded\.(\w+)/g, "VALUES($1)")
+    .replace(/LIKE \? ESCAPE '\\'/g, "LIKE ?");
 }
 
 async function migrateMysqlSurrogateId(pool: Pool): Promise<void> {

package/src/index.ts

@@ -27,7 +27,7 @@ import { buildAdminTokensPage } from "./views/adminTokens";
 import { buildSessionList, buildSessionView, renderNewMessages, renderBatchHTML } from "./views/sessionLog";
 import { buildFileView, FileViewError, readFileSince, serveRawFile } from "./fileview";
 import { translateText, translateTextStream, TranslateError } from "./translate";
-import { rateLimit } from "./ratelimit";
+import { rateLimit, clearRateLimit } from "./ratelimit";
 import {
   StoreError,
   getProject,
@@ -185,13 +185,20 @@ async function autoWireAllProjects(origin: string): Promise<void> {
 void autoWireAllProjects(`http://${cfg.host}:${cfg.port}`);
 
 const SEC_HEADERS: Record<string, string> = {
-  "content-security-policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'`,
+  "content-security-policy": buildCsp(cfg),
   "x-content-type-options": "nosniff",
   "x-frame-options": "DENY",
   "referrer-policy": "same-origin",
   "permissions-policy": "()",
 };
 
+function buildCsp(cfg: Config): string {
+  const origins = cfg.publicOrigins.join(" ");
+  const formAction = origins ? `'self' ${origins}` : "'self'";
+  const connectSrc = origins ? `'self' ${origins}` : "'self'";
+  return `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src ${connectSrc}; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action ${formAction}`;
+}
+
 const hlCss = loadHighlightCss();
 
 function loadHighlightCss(): string {
@@ -483,14 +490,18 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     if (req.method === "POST") {
       const form = await req.formData().catch(() => new FormData());
       const next = sanitizeNext(String(form.get("next") ?? "/"));
-      if (!rateLimit(`login:${ip}`, 5, 5 / (15 * 60))) {
-        return html(loginHTML(next, "尝试过多，15 分钟后再试", cfg), 429);
-      }
       const login = String(form.get("login") ?? "").trim();
       const password = String(form.get("password") ?? "");
       const token = String(form.get("token") ?? "").trim();
 
-      // Token wins over login/password if both supplied (migration path).
+      const rlKey = `login:${ip}:${login || token || "?"}`;
+      if (!rateLimit(rlKey, 5, 5 / (15 * 60))) {
+        return new Response(loginHTML(next, "尝试过多，15 分钟后再试", cfg), {
+          status: 429,
+          headers: { "content-type": "text/html; charset=utf-8", "retry-after": "900" },
+        });
+      }
+
       let resolvedLogin: string | null = null;
       if (token && token === cfg.authToken) {
         resolvedLogin = cfg.operatorLogin;
@@ -508,6 +519,7 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       }
 
       if (resolvedLogin) {
+        clearRateLimit(rlKey);
         const setCookie = await makeAuthCookieHeader(cfg, resolvedLogin);
         return new Response(null, {
           status: 302,
@@ -681,13 +693,10 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       const status = e instanceof OpencodeError ? e.status : 500;
       if (status === 404 && /^ses_[0-9A-Za-z]{8,}/.test(sid)) {
         return html(errorPage(
-          "会话尚未写入数据库",
-          `会话 ID ${sid} 在 opencode.db 里找不到。\n\n` +
-          `常见原因：daemon 把尚未完成的 opencode run 的 session ID 写进了评论（早期捕获），\n` +
-          `但 opencode 进程因 LLM 鉴权失败 / git clone 失败 / 其他错误退出前没把这条 session\n` +
-          `持久化到 DB。\n\n` +
-          `排查：docker logs ework-aio 看 opencode 子进程的报错；确认 OPENCODE_AI_API_KEY 已配置\n` +
-          `或 ~/.config/opencode/auth.json 存在。`
+          "找不到会话",
+          `会话 ID ${sid} 在 opencode 数据库中不存在。\n\n` +
+          `可能原因：opencode 进程异常退出、session 尚未持久化、或 daemon 连接问题。\n\n` +
+          `请检查 daemon 日志或确认 session ID 正确。`
         ), 404);
       }
       return html(errorPage(status === 404 ? "找不到会话" : "加载失败", errMsg(e)), status);

package/src/opencode.ts

@@ -416,16 +416,16 @@ export class MultiDaemonOpencodeClient implements OpencodeClientInterface {
   async exportSession(id: string): Promise<SessionExport> {
     try {
       return await Promise.any(this.clients.map((c) => c.exportSession(id)));
-    } catch {
-      throw new OpencodeError(`session ${id} not found on any daemon`, 404);
+    } catch (e) {
+      throw pickErrorFromAggregate(e, id);
     }
   }
 
   async exportSessionRaw(id: string): Promise<string> {
     try {
       return await Promise.any(this.clients.map((c) => c.exportSessionRaw(id)));
-    } catch {
-      throw new OpencodeError(`session ${id} not found on any daemon`, 404);
+    } catch (e) {
+      throw pickErrorFromAggregate(e, id);
     }
   }
 
@@ -450,6 +450,18 @@ export function createOpencodeClient(cfg: Config, daemonEndpoint?: string): Open
   return new OpencodeClient(cfg);
 }
 
+function pickErrorFromAggregate(e: unknown, id: string): OpencodeError {
+  if (e instanceof AggregateError) {
+    const errors = e.errors as unknown[];
+    const non404 = errors.find(
+      (err) => err instanceof OpencodeError && err.status !== 404,
+    ) as OpencodeError | undefined;
+    if (non404) return non404;
+  }
+  if (e instanceof OpencodeError) return e;
+  return new OpencodeError(`session ${id} not found on any daemon`, 404);
+}
+
 async function readCapped(stream: ReadableStream<Uint8Array> | null, maxBytes: number): Promise<string> {
   if (!stream) return "";
   const reader = stream.getReader();

package/src/ratelimit.ts

@@ -33,3 +33,7 @@ export function clientIp(req: Request): string {
   if (xff) return (xff.split(",")[0] ?? "").trim();
   return req.headers.get("x-real-ip") ?? "unknown";
 }
+
+export function clearRateLimit(id: string): void {
+  buckets.delete(id);
+}