ework-web 0.10.61 → 0.10.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.61",
+  "version": "0.10.63",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/coordination.ts

@@ -118,3 +118,39 @@ export async function resolveDaemonEndpoint(daemonId: number): Promise<string |
     return null;
   }
 }
+
+export interface RunningSessionInfo {
+  issueNumber: string;
+  sessionId: string;
+  daemonId: number;
+}
+
+/**
+ * Query daemon DB for sessions with state='running' belonging to a specific project scope.
+ * Uses REAL daemon session state instead of the display-only ai_status field.
+ */
+export async function getRunningSessionsForProject(scopeKey: string): Promise<RunningSessionInfo[]> {
+  try {
+    const rows = await getDB().all<{
+      tracker_issue_id: string;
+      opencode_session_id: string;
+      daemon_id: number;
+    }>(
+      `SELECT i.tracker_issue_id, s.opencode_session_id, i.owner_daemon_id AS daemon_id
+       FROM {{d_op_sessions}} s
+       JOIN {{d_issues}} i ON i.uid = s.issue_id
+       WHERE s.state = 'running'
+         AND i.tracker_scope_key = ?
+         AND s.opencode_session_id IS NOT NULL`,
+      [scopeKey],
+    );
+    return rows.map((r) => ({
+      issueNumber: r.tracker_issue_id,
+      sessionId: r.opencode_session_id,
+      daemonId: r.daemon_id,
+    }));
+  } catch (e) {
+    log.info(`coordination: running-sessions query failed (${e instanceof Error ? e.message : String(e)})`);
+    return [];
+  }
+}

package/src/giteaApi.ts

@@ -12,7 +12,7 @@
 // bg audit) plus a few cheap stubs (/version, /user, /repos/:o/:r) that
 // Gitea clients commonly hit during connection bootstrap.
 
-import { getDB } from "./db";
+import { getDB, getConfigAll } from "./db";
 import {
   StoreError,
   getProject,
@@ -32,6 +32,8 @@ import {
   listReactionsFor,
   canWriteProject,
   canReadProject,
+  ensureUser,
+  getUserByLogin,
   type UserRow,
 } from "./store";
 import {
@@ -95,6 +97,12 @@ function asContent(v: unknown): string | undefined {
   return trimmed;
 }
 
+async function canSudo(u: UserRow): Promise<boolean> {
+  const cfg = await getConfigAll();
+  const allow = (cfg["sudoLogins"] ?? "").split(",").map((s: string) => s.trim()).filter(Boolean);
+  return allow.includes(u.login);
+}
+
 export async function handleGiteaApi(
   req: Request,
   url: URL,
@@ -103,8 +111,30 @@ export async function handleGiteaApi(
   const path = url.pathname;
   if (!path.startsWith("/api/v1/")) return null;
   const origin = new URL(req.url).origin;
-  const user = ctx.user;
-  if (!user) return giteaError(401, "requires authentication");
+  const caller = ctx.user;
+  if (!caller) return giteaError(401, "requires authentication");
+
+  // ─── Sudo: Gitea convention for impersonation ───
+  // Allows bridge/integration processes to post on behalf of real users.
+  // Permission gated by config KV `sudoLogins` whitelist (not is_admin — bridges
+  // should not be admins). Sudo-Kind header controls kind for first-creation
+  // only; existing users' kind is never changed via sudo.
+  const sudoLoginRaw = req.headers.get("Sudo") ?? url.searchParams.get("sudo");
+  const sudoLogin = sudoLoginRaw?.trim() || null;
+  let user: UserRow = caller;
+  if (sudoLogin && sudoLogin !== caller.login) {
+    if (!(await canSudo(caller))) return giteaError(403, "sudo requires permission");
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(sudoLogin)) return giteaError(400, "invalid sudo login");
+    const sudoKindRaw = req.headers.get("Sudo-Kind")?.trim();
+    const existing = await getUserByLogin(sudoLogin);
+    if (existing) {
+      user = existing;
+    } else {
+      const kind = sudoKindRaw === "bot" || sudoKindRaw === "system" ? sudoKindRaw : "human";
+      user = await ensureUser(sudoLogin, kind);
+    }
+    if (!user.is_active) return giteaError(403, "sudo target inactive");
+  }
 
   if (ROUTES.version.test(path) && req.method === "GET") {
     return { status: 200, body: { version: "1.22.0" } };

package/src/index.ts

@@ -6,7 +6,7 @@ import { homedir } from "os";
 import { loadConfig, DB_OVERRIDABLE, parseOverride, resolveTtsBackend } from "./config";
 import type { Config } from "./config";
 import { setConfig, deleteConfig, getConfigAll, initDB, getDB } from "./db";
-import { getActiveDaemons, listAllDaemons, getSessionDaemonMap, resolveDaemonEndpoint } from "./coordination";
+import { getActiveDaemons, listAllDaemons, getSessionDaemonMap, resolveDaemonEndpoint, getRunningSessionsForProject } from "./coordination";
 import { testMysqlConnection, migrateSqliteToMysql, writeMysqlEnv, migrateMysqlToSqlite, writeSqliteEnv, migrateDaemonSqliteToMysql, generateMysqlDDL } from "./db-admin";
 import type { MysqlTargetOpts } from "./db-admin";
 import { checkAuth, makeAuthCookieHeader, clearAuthCookieHeader, loginHTML, sanitizeNext, ensureBootstrapAdmin, ensureBootstrapSystem, isReservedSystemLogin } from "./auth";
@@ -1311,6 +1311,22 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     return json({ ok: true });
   }
 
+  if (url.pathname === "/api/sudo-policy" && req.method === "GET") {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    const cfg = await getConfigAll();
+    const list = (k: string, d: string) => (cfg[k] ?? d).split(",").map((s) => s.trim()).filter(Boolean);
+    return json({ sudoLogins: list("sudoLogins", "") });
+  }
+
+  if (url.pathname === "/api/sudo-policy" && req.method === "POST") {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    const payload = await req.json().catch(() => ({} as Record<string, unknown>));
+    const join = (v: unknown) => Array.isArray(v) ? v.filter((s) => typeof s === "string").join(",") : (typeof v === "string" ? v : "");
+    const sl = join((payload as { sudoLogins?: unknown }).sudoLogins);
+    if (sl) await setConfig("sudoLogins", sl); else await deleteConfig("sudoLogins");
+    return json({ ok: true });
+  }
+
   if (url.pathname === "/api/router/daemons" && req.method === "GET") {
     if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
     try {
@@ -1978,12 +1994,17 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
         return Response.redirect(`${back}?err=${encodeURIComponent("无权限")}`, 303);
       }
       const issues = await listIssues(project.id, { state: "all" });
-      const processing = issues.filter((it) => it.ai_status === "processing");
-      for (const it of processing) {
-        await updateIssueAiStatus(it.id, "halted");
-        void emitStatusChanged(project.id, it.number, "processing", "halted", ctx.user!.login, url.origin);
+      const running = await getRunningSessionsForProject(`${owner}/${repo}`);
+      const issueIds = new Set<number>();
+      for (const r of running) {
+        const it = issues.find((i) => String(i.number) === r.issueNumber);
+        if (it) issueIds.add(it.id);
+      }
+      for (const id of issueIds) {
+        await updateIssueAiStatus(id, "halted");
+        void emitStatusChanged(project.id, id, "processing", "halted", ctx.user!.login, url.origin);
       }
-      return Response.redirect(`${back}?ok=1&ok_msg=${encodeURIComponent(`已停止 ${processing.length} 个运行中AI会话`)}`, 303);
+      return Response.redirect(`${back}?ok=1&ok_msg=${encodeURIComponent(`已停止 ${issueIds.size} 个运行中AI会话`)}`, 303);
     }
 
     const settingsDispatchMatch = url.pathname.match(SETTINGS_DISPATCH_RE);

package/src/webhooks.ts

@@ -756,7 +756,7 @@ export async function emitStatusChanged(
     const project = await getProjectById(projectId);
     if (!project) return;
     const issue = await getIssueById(issueId);
-    if (!issue) return;
+    if (!issue) { log.warn(`emitStatusChanged: issue ${issueId} not found (project=${projectId}) — silent skip prevented`); return; }
     const commentCount = await countCommentsSafe(issueId);
     const repo = buildRepository(project, origin);
     const sender = buildUser(actor, origin);