ework-web 0.10.53 → 0.10.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.53",
+  "version": "0.10.55",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/config.ts

@@ -82,6 +82,7 @@ export const configSchema = z.object({
   internalAuthHook: z.string().default(""),
   userAuthHook: z.string().default(""),
   loginPage: z.string().default(""),
+  issueActionsHook: z.string().default(""),
   // Default "provider/model" string passed to `opencode run --model <X>`.
   // Empty = let opencode pick per its own opencode.json + env. ework-daemon
   // pushes this (or the per-project override) on every spawn to defend
@@ -192,6 +193,7 @@ export async function loadConfig(): Promise<Config> {
     internalAuthHook: process.env.WORK_INTERNAL_AUTH_HOOK ?? "",
     userAuthHook: process.env.WORK_USER_AUTH_HOOK ?? "",
     loginPage: process.env.WORK_LOGIN_PAGE ?? "",
+  issueActionsHook: process.env.WORK_ISSUE_ACTIONS_HOOK ?? "",
     defaultModel: db.defaultModel ?? process.env.WORK_DEFAULT_MODEL,
     autowireActive: process.env.WORK_AUTOWIRE_ACTIVE !== "false",
     webhookMaxConcurrent: Number(process.env.WORK_WEBHOOK_MAX_CONCURRENT ?? "6"),

package/src/index.ts

@@ -476,6 +476,8 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
   if (url.pathname === "/static/session.js") return staticAsset("session.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/file.js") return staticAsset("file.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/tts.js") return staticAsset("tts.js", "text/javascript; charset=utf-8", req);
+  if (url.pathname === "/static/issue-actions.js") return staticAsset("issue-actions.js", "text/javascript; charset=utf-8", req);
+  if (url.pathname === "/static/row-nav.js") return staticAsset("row-nav.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/highlight.css") {
     return new Response(hlCss, {
       headers: { "content-type": "text/css; charset=utf-8", "cache-control": "no-cache", ...SEC_HEADERS },

package/src/issue-actions-hook.ts

@@ -0,0 +1,73 @@
+export interface IssueActionContext {
+  owner: string;
+  repo: string;
+  issueNumber: number;
+  state: string;
+  aiStatus: string;
+  viewerLogin: string;
+  viewerIsAdmin: boolean;
+  labels: { id: number; name: string; color: string }[];
+}
+
+export interface IssueAction {
+  id: string;
+  label: string;
+  title?: string;
+  method?: "POST" | "GET";
+  href: string;
+  confirm?: string;
+  reloadOnOk?: boolean;
+  className?: string;
+}
+
+export interface IssueActionsProvider {
+  issueActions(ctx: IssueActionContext): Promise<IssueAction[]> | IssueAction[];
+  statusBadges?: Record<string, { cls: string; label: string }>;
+}
+
+const hookCache = new Map<string, IssueActionsProvider | null>();
+
+async function loadHook(hookPath: string): Promise<IssueActionsProvider | null> {
+  const cached = hookCache.get(hookPath);
+  if (cached !== undefined) return cached;
+
+  try {
+    const path = await import("node:path");
+    const { pathToFileURL } = await import("node:url");
+    const abs = path.isAbsolute(hookPath) ? hookPath : path.resolve(process.cwd(), hookPath);
+    const mod = await import(pathToFileURL(abs).href);
+    const provider: IssueActionsProvider = mod.default ?? mod;
+    if (!provider || typeof provider.issueActions !== "function") {
+      console.warn(`[issue-actions-hook] ${hookPath}: must export an object with issueActions()`);
+      hookCache.set(hookPath, null);
+      return null;
+    }
+    hookCache.set(hookPath, provider);
+    return provider;
+  } catch (e) {
+    console.warn(`[issue-actions-hook] failed to load ${hookPath}:`, e);
+    hookCache.set(hookPath, null);
+    return null;
+  }
+}
+
+export async function runIssueActionsHook(
+  hookPath: string,
+  ctx: IssueActionContext,
+): Promise<{ actions: IssueAction[]; statusBadges?: Record<string, { cls: string; label: string }> }> {
+  if (!hookPath) return { actions: [] };
+  const provider = await loadHook(hookPath);
+  if (!provider) return { actions: [] };
+  try {
+    const actions = await provider.issueActions(ctx);
+    if (!Array.isArray(actions)) return { actions: [], statusBadges: provider.statusBadges };
+    return { actions, statusBadges: provider.statusBadges };
+  } catch (e) {
+    console.warn(`[issue-actions-hook] ${hookPath}: issueActions() threw:`, e);
+    return { actions: [] };
+  }
+}
+
+export function clearIssueActionsHookCache(): void {
+  hookCache.clear();
+}

package/src/render/layout.ts

@@ -1,4 +1,5 @@
 import { BUILD_ID } from "../build";
+import type { IssueAction } from "../issue-actions-hook";
 export interface LayoutProps {
   title: string;
   issueTitle: string;
@@ -17,6 +18,10 @@ export interface LayoutProps {
   labels?: { id: number; name: string; color: string }[];
   canEditLabels?: boolean;
   aiStatus?: string;
+  viewerLogin?: string;
+  viewerIsAdmin?: boolean;
+  customActions?: IssueAction[];
+  extraStatusBadges?: Record<string, { cls: string; label: string }>;
 }
 
 export const THEME_CSS = `
@@ -167,18 +172,21 @@ export function renderLayout(props: LayoutProps, inner: string, initialItems: st
       dispatch_off: { cls: "ai-dispatch-off", label: "🔕 不接单" },
       completed: { cls: "ai-completed", label: "✓ 已完成" },
       failed: { cls: "ai-failed", label: "✗ 失败" },
+      ...props.extraStatusBadges,
     };
     const m = map[s];
     if (!m) return "";
     return `<span class="ai-badge ${m.cls}">${m.label}</span>`;
   })();
-  const haltBtnHtml = props.writesEnabled !== false && props.aiStatus !== "halted"
-    ? `<button type="button" id="haltBtn" class="halt-btn" title="停止 AI 处理">⏹ 停止</button>`
+  const haltBtnHtml = props.writesEnabled !== false
+    ? props.aiStatus === "halted"
+      ? `<button type="button" class="halt-btn resume-btn" data-action-href="${escapeAttr(repoIssuesHref)}/${props.issueNumber}/resume" data-action-confirm="确认恢复 AI 处理？" title="恢复 AI 处理">▶ 恢复</button>`
+      : `<button type="button" class="halt-btn" data-action-href="${escapeAttr(repoIssuesHref)}/${props.issueNumber}/halt" data-action-confirm="确认停止 AI 处理？" title="停止 AI 处理">⏹ 停止</button>`
     : "";
   const dispatchBtnHtml = props.writesEnabled !== false
     ? props.aiStatus === "dispatch_off"
-      ? `<button type="button" id="dispatchBtn" class="dispatch-btn" title="允许自动接单">🔔 接单</button>`
-      : `<button type="button" id="dispatchBtn" class="dispatch-btn" title="设为不自动接单">🔕 不接单</button>`
+      ? `<button type="button" class="dispatch-btn" data-action-href="${escapeAttr(repoIssuesHref)}/${props.issueNumber}/dispatch-on" title="允许自动接单">🔔 接单</button>`
+      : `<button type="button" class="dispatch-btn" data-action-href="${escapeAttr(repoIssuesHref)}/${props.issueNumber}/dispatch-off" data-action-confirm="设为不自动接单？" title="设为不自动接单">🔕 不接单</button>`
     : "";
   return `<!doctype html>
 <html lang="zh">
@@ -201,7 +209,14 @@ export function renderLayout(props: LayoutProps, inner: string, initialItems: st
   <h1>${escapeHtml(props.issueTitle)}</h1>
   <div class="meta-status">
     <span class="state-badge ${stateClass}">${stateLabel}</span>
-    ${aiBadgeHtml}${haltBtnHtml}${dispatchBtnHtml}
+    ${aiBadgeHtml}${haltBtnHtml}${dispatchBtnHtml}${(props.customActions ?? []).map((a) => {
+      const attrs = [`data-action-href="${escapeAttr(a.href)}"`];
+      if (a.method && a.method !== "POST") attrs.push(`data-action-method="${escapeAttr(a.method)}"`);
+      if (a.confirm) attrs.push(`data-action-confirm="${escapeAttr(a.confirm)}"`);
+      if (a.reloadOnOk === false) attrs.push(`data-action-reload="false"`);
+      const cls = a.className ? `${escapeAttr(a.className)}` : "custom-action-btn";
+      return `<button type="button" class="${cls}" ${attrs.join(" ")}${a.title ? ` title="${escapeAttr(a.title)}"` : ""}>${escapeHtml(a.label)}</button>`;
+    }).join("")}
     ${labelsHtml}${labelPickerBtn}
     <span class="count" id="count">…</span>
     ${props.upstreamWebUrl ? `<a class="upstream-link" href="${escapeAttr(props.upstreamWebUrl)}" target="_blank" rel="noopener noreferrer" title="跳转到上游仓库">🔗 查看上游</a>` : ""}
@@ -233,32 +248,7 @@ ${props.writesEnabled !== false
 <script src="/static/app.js?v=${BUILD_ID}" defer></script>
 ${props.canEditLabels ? `<dialog id="labelDlg"><h3>标签</h3><div class="lp-list" id="lpList"></div><div class="lp-empty hidden" id="lpEmpty">该项目还没有标签。先到设置页创建。</div></dialog>
 <script src="/static/label-picker.js?v=${BUILD_ID}" defer></script>` : ""}
-${haltBtnHtml ? `<script>
-(function(){
-  var btn=document.getElementById("haltBtn");
-  if(!btn)return;
-  btn.addEventListener("click",function(){
-    if(!confirm("确认停止 AI 处理？"))return;
-    btn.disabled=true;btn.textContent="⏳ 停止中…";
-    fetch(window.location.pathname+"/halt",{method:"POST"}).then(function(r){return r.json()}).then(function(d){
-      if(d.ok){location.reload()}else{alert(d.error||"操作失败");btn.disabled=false;btn.textContent="⏹ 停止"}
-    }).catch(function(e){alert("网络错误: "+e);btn.disabled=false;btn.textContent="⏹ 停止"})
-  });
-})();
-</script>` : ""}
-${dispatchBtnHtml ? `<script>
-(function(){
-  var btn=document.getElementById("dispatchBtn");
-  if(!btn)return;
-  btn.addEventListener("click",function(){
-    var off=btn.textContent.indexOf("不接单")>=0;
-    btn.disabled=true;btn.textContent="⏳ …";
-    fetch(window.location.pathname+"/"+(off?"dispatch-off":"dispatch-on"),{method:"POST"}).then(function(r){return r.json()}).then(function(d){
-      if(d.ok){location.reload()}else{alert(d.error||"操作失败");btn.disabled=false;btn.textContent=off?"🔕 不接单":"🔔 接单"}
-    }).catch(function(e){alert("网络错误: "+e);btn.disabled=false;btn.textContent=off?"🔕 不接单":"🔔 接单"})
-  });
-})();
-</script>` : ""}
+<script src="/static/issue-actions.js?v=${BUILD_ID}" defer></script>
 </body>
 </html>`;
 }

package/src/static/issue-actions.js

@@ -0,0 +1,38 @@
+// Universal delegated click handler for issue action buttons.
+// Buttons use data-* attributes so no inline JS is needed (CSP-safe).
+// Supported attributes:
+//   data-action-href="/owner/repo/issues/N/halt"  — POST target
+//   data-action-method="POST"                      — default POST
+//   data-action-confirm="确认停止？"               — if set, confirm() first
+//   data-action-reload="true"                      — default true, reload on success
+(function () {
+  document.addEventListener("click", function (e) {
+    var btn = e.target.closest("[data-action-href]");
+    if (!btn) return;
+    e.preventDefault();
+    var href = btn.getAttribute("data-action-href");
+    var method = btn.getAttribute("data-action-method") || "POST";
+    var confirmMsg = btn.getAttribute("data-action-confirm");
+    var reload = btn.getAttribute("data-action-reload") !== "false";
+    if (confirmMsg && !confirm(confirmMsg)) return;
+    var orig = btn.textContent;
+    btn.disabled = true;
+    btn.textContent = "⏳ …";
+    fetch(href, { method: method })
+      .then(function (r) { return r.json(); })
+      .then(function (d) {
+        if (d.ok) {
+          if (reload) location.reload();
+        } else {
+          alert(d.error || "操作失败");
+          btn.disabled = false;
+          btn.textContent = orig;
+        }
+      })
+      .catch(function (err) {
+        alert("网络错误: " + err);
+        btn.disabled = false;
+        btn.textContent = orig;
+      });
+  });
+})();

package/src/static/row-nav.js

@@ -0,0 +1,13 @@
+// Delegated click handler for label chips inside <a class="row"> elements.
+// Labels are <span class="issue-label" data-href="..."> nested inside the row <a>.
+// Without interception, clicking a label would navigate to the issue (the <a> default).
+// This handler stops propagation and navigates to the label filter URL instead.
+(function () {
+  document.addEventListener("click", function (e) {
+    var label = e.target.closest(".issue-label[data-href]");
+    if (!label) return;
+    e.preventDefault();
+    e.stopPropagation();
+    location.href = label.getAttribute("data-href");
+  });
+})();

package/src/views/issueList.ts

@@ -1,4 +1,5 @@
 import { THEME_CSS, escapeHtml, escapeAttr, containsCI, highlightAll, tabNavHTML, aiStatusBadge } from "../render/layout";
+import { BUILD_ID } from "../build";
 import { getProject, listIssues, listLabelsForIssues, type IssueWithMeta, type LabelRow } from "../store";
 import { relTime } from "../render/components";
 
@@ -23,10 +24,10 @@ function issueRow(
     ? `<span class="row-labels">${labels.map((l) => labelChip(l, owner, repo, state)).join("")}</span>`
     : "";
   const aiBadge = aiStatusBadge(it.ai_status);
-  return `<div class="row" data-href="${escapeAttr(href)}">
+  return `<a class="row" href="${escapeAttr(href)}">
     <div class="row-title">${title}${chips}</div>
     <div class="row-meta">#${it.number} · 💬 ${it.comment_count} · ${relTime(it.updated_at)}${aiBadge ? ` · ${aiBadge}` : ""}</div>
-  </div>`;
+  </a>`;
 }
 
 export async function buildIssueList(
@@ -75,7 +76,7 @@ export async function buildIssueList(
 .tabs-sub a{padding:.3rem .8rem;border-radius:6px;font-size:13px;color:var(--text-muted)}
 .tabs-sub a.active{background:var(--bg-muted);color:var(--text);font-weight:600}
 .new-btn{margin-left:auto;background:var(--green);color:#fff;padding:.3rem .8rem;border-radius:6px;font-size:13px;font-weight:600}
-.row{display:block;padding:.6rem .2rem;border-bottom:1px solid var(--border);color:var(--text)}
+.row{display:block;padding:.6rem .2rem;border-bottom:1px solid var(--border);color:var(--text);text-decoration:none}
 .row:hover{text-decoration:none;background:var(--bg-muted)}
 .row-title{font-weight:500;overflow-wrap:anywhere}
 .row-meta{color:var(--text-muted);font-size:12px;margin-top:.2rem}
@@ -109,7 +110,7 @@ ${tabNavHTML("issues", viewer ? { login: viewer.login, is_admin: viewer.is_admin
   </div>
   ${labelFilterHint}
   <div class="rows">${rows}</div>
-<script>document.addEventListener("click",function(e){var l=e.target.closest(".issue-label");if(l){e.preventDefault();e.stopPropagation();location.href=l.dataset.href;return}var r=e.target.closest(".row[data-href]");if(r){location.href=r.dataset.href}})</script>
+<script src="/static/row-nav.js?v=${BUILD_ID}" defer></script>
 </main>
 </body></html>`;
 }

package/src/views/issueThread.ts

@@ -2,6 +2,7 @@ import type { Config } from "../config";
 import { classifyActor, renderCommentCard, type CommentView } from "../render/components";
 import { renderMarkdown } from "../render/markdown";
 import { renderLayout, escapeHtml } from "../render/layout";
+import { runIssueActionsHook, type IssueActionContext, type IssueAction } from "../issue-actions-hook";
 import { hydrateReactions } from "../reactions";
 import {
   StoreError,
@@ -12,6 +13,7 @@ import {
   listCommentsSince,
   getDefaultUpstreamUrl,
   listLabelsForIssue,
+  getUserByLogin,
   type CommentRow,
   type IssueWithMeta,
 } from "../store";
@@ -112,6 +114,22 @@ export async function buildIssueThread(
     return webUrlFromClone(clone);
   })();
   const labels = await listLabelsForIssue(issue.id);
+  const viewerUser = viewerLogin ? await getUserByLogin(viewerLogin) : null;
+  const viewerIsAdmin = !!viewerUser?.is_admin;
+
+  let customActions: IssueAction[] = [];
+  let extraStatusBadges: Record<string, { cls: string; label: string }> | undefined;
+  if (cfg.issueActionsHook && viewerLogin) {
+    const ctx: IssueActionContext = {
+      owner, repo, issueNumber: number,
+      state: issue.state, aiStatus: issue.ai_status ?? "",
+      viewerLogin, viewerIsAdmin,
+      labels: labels.map((l) => ({ id: l.id, name: l.name, color: l.color })),
+    };
+    const result = await runIssueActionsHook(cfg.issueActionsHook, ctx);
+    customActions = result.actions;
+    extraStatusBadges = result.statusBadges;
+  }
 
   const html = renderLayout(
     {
@@ -131,6 +149,10 @@ export async function buildIssueThread(
       labels: labels.map((l) => ({ id: l.id, name: l.name, color: l.color })),
       canEditLabels: cfg.writesEnabled !== false,
       aiStatus: issue.ai_status ?? "",
+      viewerLogin,
+      viewerIsAdmin,
+      customActions,
+      extraStatusBadges,
     },
     safeJsonEmbed(payload),
     displayViews.map((v) => renderCommentCard(v, cfg)).join("")

package/src/views/issues.ts

@@ -1,4 +1,5 @@
 import { THEME_CSS, escapeHtml, escapeAttr, containsCI, highlightAll, tabNavHTML, aiStatusBadge } from "../render/layout";
+import { BUILD_ID } from "../build";
 import { listAllIssues, listLabelsForIssues, type IssueWithMeta, type LabelRow } from "../store";
 import { relTime } from "../render/components";
 
@@ -17,10 +18,10 @@ function issueRow(it: IssueWithMeta, q: string, state: string, labels: LabelRow[
     ? `<span class="row-labels">${labels.map((l) => labelChip(l, it.project_owner, it.project_name, state)).join("")}</span>`
     : "";
   const aiBadge = aiStatusBadge(it.ai_status);
-  return `<div class="row" data-href="${escapeAttr(href)}">
+  return `<a class="row" href="${escapeAttr(href)}">
     <div class="row-title">${title}${chips}</div>
     <div class="row-meta">${projectStr} · #${it.number} · 💬 ${it.comment_count} · ${relTime(it.updated_at)}${aiBadge ? ` · ${aiBadge}` : ""}</div>
-  </div>`;
+  </a>`;
 }
 
 export async function buildIssuesFeed(
@@ -60,7 +61,7 @@ export async function buildIssuesFeed(
 .tabs-sub{display:flex;gap:.3rem;margin-bottom:.6rem}
 .tabs-sub a{padding:.3rem .8rem;border-radius:6px;font-size:13px;color:var(--text-muted)}
 .tabs-sub a.active{background:var(--bg-muted);color:var(--text);font-weight:600}
-.row{display:block;padding:.6rem .2rem;border-bottom:1px solid var(--border);color:var(--text)}
+.row{display:block;padding:.6rem .2rem;border-bottom:1px solid var(--border);color:var(--text);text-decoration:none}
 .row:hover{text-decoration:none;background:var(--bg-muted)}
 .row-title{font-weight:500;overflow-wrap:anywhere}
 .row-meta{color:var(--text-muted);font-size:12px;margin-top:.2rem}
@@ -87,7 +88,7 @@ ${tabNavHTML("issues", viewer ? { login: viewer.login, is_admin: viewer.is_admin
   </div>
   ${labelFilterHint}
   <div class="rows">${rows}</div>
-<script>document.addEventListener("click",function(e){var l=e.target.closest(".issue-label");if(l){e.preventDefault();e.stopPropagation();location.href=l.dataset.href;return}var r=e.target.closest(".row[data-href]");if(r){location.href=r.dataset.href}})</script>
+<script src="/static/row-nav.js?v=${BUILD_ID}" defer></script>
 </main>
 </body></html>`;
 }

package/src/webhooks.ts

@@ -27,6 +27,8 @@ import {
   ensureUser,
   resolveModel,
   listLabelsForIssue,
+  getUserByLogin,
+  canWriteProject,
   type IssueRow,
   type ProjectRow,
   type CommentRow,
@@ -692,6 +694,15 @@ export async function emitCommentEvent(
     if (cfg["dispatchEnabled"] === "false" || cfg[`dispatchOff:${scopeKey}`] === "1" || (issue as IssueRow).ai_status === "dispatch_off") {
       log.info(`webhook: dispatch disabled but waking via comment_created (author=${comment.author}) for ${scopeKey}#${issue.number}`);
     }
+    const authorUser = await getUserByLogin(comment.author);
+    if (authorUser && authorUser.kind !== "human") {
+      log.info(`webhook: comment wake denied (author=${comment.author} kind=${authorUser.kind}) for ${scopeKey}#${issue.number}`);
+      return;
+    }
+    if (authorUser && !(await canWriteProject(projectId, { login: comment.author, is_admin: authorUser.is_admin }))) {
+      log.info(`webhook: comment wake denied (author=${comment.author} not project member) for ${scopeKey}#${issue.number}`);
+      return;
+    }
     const commentCount = await countCommentsSafe(issueId);
     const globalDefault = (await loadConfig()).defaultModel;
     const model = resolveModel(project.model, globalDefault);