ework-web 0.7.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/coordination.ts

@@ -7,6 +7,16 @@ export interface DaemonInfo {
   endpoint: string;
 }
 
+export interface DaemonDetail {
+  id: number;
+  displayName: string;
+  endpoint: string;
+  capacity: number;
+  lastHeartbeat: string | null;
+  status: string;
+  registeredAt: string | null;
+}
+
 const HEARTBEAT_STALE_MS = 120_000;
 
 export async function getActiveDaemons(): Promise<DaemonInfo[]> {
@@ -30,3 +40,31 @@ export async function getActiveDaemons(): Promise<DaemonInfo[]> {
     return [];
   }
 }
+
+export async function listAllDaemons(): Promise<DaemonDetail[]> {
+  try {
+    const rows = await getDB().all<{
+      id: number;
+      display_name: string | null;
+      internal_endpoint: string;
+      capacity: number | null;
+      last_heartbeat: string | null;
+      status: string | null;
+      registered_at: string | null;
+    }>(
+      `SELECT id, display_name, internal_endpoint, capacity, last_heartbeat, status, registered_at FROM {{d_daemons}} ORDER BY id`,
+    );
+    return rows.map((r) => ({
+      id: r.id,
+      displayName: r.display_name ?? `daemon-${r.id}`,
+      endpoint: r.internal_endpoint,
+      capacity: r.capacity ?? 0,
+      lastHeartbeat: r.last_heartbeat,
+      status: r.status ?? "unknown",
+      registeredAt: r.registered_at,
+    }));
+  } catch (e) {
+    log.info(`coordination: list daemons failed (${e instanceof Error ? e.message : String(e)})`);
+    return [];
+  }
+}

package/src/daemon-deploy.ts

@@ -0,0 +1,174 @@
+import { join } from "path";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+
+export interface DeployOpts {
+  sshHost: string;
+  sshUser: string;
+  sshPort: number;
+  sshKeyFile?: string;
+  daemonPort?: number;
+  mysqlHost: string;
+}
+
+export interface DeployResult {
+  ok: boolean;
+  output: string;
+  error?: string;
+}
+
+// Keys forwarded from the local daemon .env to the remote one. Secrets are
+// never logged — only written to the remote .env over SSH.
+const FORWARD_KEYS = [
+  "WORK_DB_DRIVER",
+  "WORK_DB_USER",
+  "WORK_DB_PASSWORD",
+  "WORK_DB_NAME",
+  "WORK_DB_PREFIX",
+  "GITEA_URL",
+  "GITEA_TOKEN",
+  "BOT_TOKEN",
+  "BOT_USERNAME",
+  "GITEA_WEBHOOK_SECRET",
+  "OPENCODE_BASE_WORKDIR",
+  "OPENCODE_BINARY",
+] as const;
+
+function resolveDaemonEnvPath(): string | null {
+  const dataDir = process.env.WORK_DAEMON_DATA_DIR;
+  if (dataDir) {
+    const p = join(dataDir, ".env");
+    return existsSync(p) ? p : null;
+  }
+  const candidates = [
+    join(homedir(), ".local", "share", "ework-aio", "ework-daemon", ".env"),
+    join(homedir(), ".local", "share", "ework-daemon", ".env"),
+  ];
+  for (const c of candidates) {
+    if (existsSync(c)) return c;
+  }
+  return null;
+}
+
+function parseEnvFile(content: string): Map<string, string> {
+  const out = new Map<string, string>();
+  for (const line of content.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    if (!key || key.startsWith("#")) continue;
+    const val = line.slice(eq + 1).replace(/^["']|["']$/g, "");
+    out.set(key, val);
+  }
+  return out;
+}
+
+function buildEnvBlock(env: Map<string, string>, opts: DeployOpts): string {
+  const lines: string[] = [];
+  for (const k of FORWARD_KEYS) {
+    const v = env.get(k);
+    if (v === undefined) continue;
+    lines.push(`${k}=${v}`);
+  }
+  lines.push(`WORK_DB_HOST=${opts.mysqlHost}`);
+  lines.push(`DAEMON_PORT=${String(opts.daemonPort ?? 3101)}`);
+  lines.push(`DAEMON_HOST=0.0.0.0`);
+  lines.push(`DAEMON_ENV=production`);
+  return lines.join("\n");
+}
+
+function buildSetupScript(envBlock: string): string {
+  return [
+    "set -e",
+    `command -v npm >/dev/null 2>&1 || { curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash -; sudo apt-get install -y nodejs; }`,
+    `command -v bun >/dev/null 2>&1 || { curl -fsSL https://bun.sh/install | bash; export BUN_INSTALL="$HOME/.bun"; export PATH="$BUN_INSTALL/bin:$PATH"; }`,
+    `npm install -g ework-aio`,
+    `mkdir -p ~/.local/share/ework-aio/ework-daemon`,
+    `cat > ~/.local/share/ework-aio/ework-daemon/.env <<'EWORK_DAEMON_ENV_EOF'`,
+    envBlock,
+    `EWORK_DAEMON_ENV_EOF`,
+    `ework-aio start daemon`,
+    `echo DAEMON_STARTED`,
+  ].join("\n");
+}
+
+export async function deployRemoteDaemon(opts: DeployOpts): Promise<DeployResult> {
+  const envPath = resolveDaemonEnvPath();
+  if (!envPath) {
+    return {
+      ok: false,
+      output: "",
+      error: "找不到本地 daemon .env（设置 WORK_DAEMON_DATA_DIR 或将 .env 放到 ~/.local/share/ework-aio/ework-daemon/.env）",
+    };
+  }
+  let envContent: string;
+  try {
+    envContent = readFileSync(envPath, "utf8");
+  } catch (e) {
+    return { ok: false, output: "", error: e instanceof Error ? e.message : String(e) };
+  }
+  const env = parseEnvFile(envContent);
+  const envBlock = buildEnvBlock(env, opts);
+  const script = buildSetupScript(envBlock);
+
+  const args = [
+    "ssh",
+    "-o", "StrictHostKeyChecking=accept-new",
+    "-p", String(opts.sshPort),
+    "-i", opts.sshKeyFile ?? "~/.ssh/id_rsa",
+    `${opts.sshUser}@${opts.sshHost}`,
+    "bash -s",
+  ];
+
+  let proc;
+  try {
+    proc = Bun.spawn(args, {
+      stdin: new TextEncoder().encode(script),
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+  } catch (e) {
+    return { ok: false, output: "", error: e instanceof Error ? e.message : String(e) };
+  }
+
+  const ac = new AbortController();
+  const timer = setTimeout(() => {
+    ac.abort();
+    try { proc.kill(); } catch { /* already dead */ }
+  }, 60_000);
+
+  let stdoutText = "";
+  let stderrText = "";
+  let exitCode: number | null = null;
+  let timedOut = false;
+  try {
+    ac.signal.addEventListener("abort", () => { timedOut = true; });
+    [stdoutText, stderrText, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ]);
+  } catch (e) {
+    return {
+      ok: false,
+      output: stdoutText + stderrText,
+      error: e instanceof Error ? e.message : String(e),
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+
+  if (timedOut) {
+    return {
+      ok: false,
+      output: stdoutText + stderrText,
+      error: "SSH 部署超时（60s）",
+    };
+  }
+  const combined = stdoutText + (stderrText ? "\n--- stderr ---\n" + stderrText : "");
+  return {
+    ok: exitCode === 0,
+    output: combined,
+    error: exitCode === 0 ? undefined : `ssh 退出码 ${String(exitCode)}`,
+  };
+}

package/src/index.ts

@@ -5,8 +5,8 @@ import { spawn } from "child_process";
 import { homedir } from "os";
 import { loadConfig, DB_OVERRIDABLE, parseOverride, resolveTtsBackend } from "./config";
 import type { Config } from "./config";
-import { setConfig, initDB } from "./db";
-import { getActiveDaemons } from "./coordination";
+import { setConfig, initDB, getDB } from "./db";
+import { getActiveDaemons, listAllDaemons } from "./coordination";
 import { testMysqlConnection, migrateSqliteToMysql, writeMysqlEnv, migrateMysqlToSqlite, writeSqliteEnv, migrateDaemonSqliteToMysql } from "./db-admin";
 import type { MysqlTargetOpts } from "./db-admin";
 import { checkAuth, makeAuthCookieHeader, clearAuthCookieHeader, loginHTML, sanitizeNext, ensureBootstrapAdmin, ensureBootstrapSystem, isReservedSystemLogin } from "./auth";
@@ -93,6 +93,7 @@ import { buildProjectMembersPage } from "./views/projectMembers";
 import { buildProjectUpstreamsPage, trySetUpstreamUrls } from "./views/projectUpstreams";
 import { buildProjectModelPage } from "./views/projectModel";
 import { handleGiteaApi } from "./giteaApi";
+import { deployRemoteDaemon } from "./daemon-deploy";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const STATIC_DIR = join(__dirname, "static");
@@ -411,6 +412,7 @@ function chunkTextTTS(text: string, max = 120): string[] {
 async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean; user: UserRow | null }): Promise<Response> {
   if (url.pathname === "/static/app.js") return staticAsset("app.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/db-wizard.js") return staticAsset("db-wizard.js", "text/javascript; charset=utf-8", req);
+  if (url.pathname === "/static/daemon-mgr.js") return staticAsset("daemon-mgr.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/session.js") return staticAsset("session.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/file.js") return staticAsset("file.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/tts.js") return staticAsset("tts.js", "text/javascript; charset=utf-8", req);
@@ -831,6 +833,96 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     return json({ ...result, targetPath, restarting: true });
   }
 
+  if (req.method === "GET" && url.pathname === "/api/daemons") {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    return json(await listAllDaemons());
+  }
+
+  if (req.method === "POST" && url.pathname === "/api/daemons") {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    if (!rateLimit(`daemons-add:${ip}`, 5, 5 / 3600)) return json({ error: "rate limited" }, 429);
+    const payload = await req.json().catch(() => ({} as unknown));
+    const port = (payload && typeof payload === "object" && "port" in payload
+      ? (payload as { port?: unknown }).port
+      : undefined);
+    const args = ["add-daemon"];
+    if (typeof port === "number" && Number.isFinite(port) && port > 0 && port < 65536) {
+      args.push(String(Math.trunc(port)));
+    } else if (port !== undefined && port !== null) {
+      return json({ ok: false, error: "invalid port" }, 400);
+    }
+    let child: import("child_process").ChildProcessByStdio<null, import("stream").Readable, import("stream").Readable>;
+    try {
+      child = spawn("ework-aio", args, { stdio: ["ignore", "pipe", "pipe"] });
+    } catch {
+      return json({ ok: false, error: "ework-aio not found" });
+    }
+    const result = await new Promise<{ ok: boolean; output?: string; error?: string }>((resolve) => {
+      const ac = new AbortController();
+      const timer = setTimeout(() => {
+        ac.abort();
+        try { child.kill("SIGKILL"); } catch { /* already dead */ }
+      }, 30_000);
+      let stdout = "";
+      let stderr = "";
+      let settled = false;
+      const finish = (r: { ok: boolean; output?: string; error?: string }) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(r);
+      };
+      child.stdout.on("data", (b: Buffer) => { stdout += b.toString("utf-8"); });
+      child.stderr.on("data", (b: Buffer) => { stderr += b.toString("utf-8"); });
+      child.once("error", () => finish({ ok: false, error: "ework-aio not found" }));
+      child.once("exit", (code) => {
+        if (code === 0) finish({ ok: true, output: stdout });
+        else finish({ ok: false, error: stderr.trim() || `ework-aio add-daemon exited with code ${code}` });
+      });
+      ac.signal.addEventListener("abort", () => {
+        finish({ ok: false, error: "timeout: ework-aio add-daemon did not exit within 30s" });
+      });
+    });
+    return json(result, result.ok ? 200 : 422);
+  }
+
+  const daemonIdRe = /^\/api\/daemons\/(\d+)$/;
+  if (req.method === "DELETE" && daemonIdRe.test(url.pathname)) {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    const match = url.pathname.match(daemonIdRe);
+    const id = match ? Number(match[1]) : NaN;
+    if (!Number.isFinite(id)) return json({ error: "invalid id" }, 400);
+    try {
+      await getDB().run(`UPDATE {{d_daemons}} SET status = 'drained' WHERE id = ?`, [id]);
+    } catch (e) {
+      return json({ ok: false, error: errMsg(e) });
+    }
+    return json({ ok: true });
+  }
+
+  if (req.method === "POST" && url.pathname === "/api/daemons/deploy") {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    if (!rateLimit(`daemons-deploy:${ip}`, 3, 3 / 3600)) return json({ error: "rate limited" }, 429);
+    const payload = await req.json().catch(() => ({} as unknown));
+    if (!payload || typeof payload !== "object") return json({ ok: false, error: "invalid body" }, 400);
+    const obj = payload as Record<string, unknown>;
+    const sshHost = typeof obj.sshHost === "string" ? obj.sshHost.trim() : "";
+    const sshUser = typeof obj.sshUser === "string" ? obj.sshUser.trim() : "";
+    const mysqlHost = typeof obj.mysqlHost === "string" ? obj.mysqlHost.trim() : "";
+    if (!sshHost || !sshUser || !mysqlHost) {
+      return json({ ok: false, error: "sshHost, sshUser, mysqlHost 必填" }, 400);
+    }
+    const sshPort = typeof obj.sshPort === "number" && Number.isFinite(obj.sshPort) && obj.sshPort > 0 && obj.sshPort < 65536
+      ? Math.trunc(obj.sshPort)
+      : 22;
+    const sshKeyFile = typeof obj.sshKeyFile === "string" && obj.sshKeyFile.trim() ? obj.sshKeyFile.trim() : undefined;
+    const daemonPort = typeof obj.daemonPort === "number" && Number.isFinite(obj.daemonPort) && obj.daemonPort > 0 && obj.daemonPort < 65536
+      ? Math.trunc(obj.daemonPort)
+      : undefined;
+    const result = await deployRemoteDaemon({ sshHost, sshUser, sshPort, sshKeyFile, daemonPort, mysqlHost });
+    return json(result, result.ok ? 200 : 422);
+  }
+
   if (url.pathname === "/settings") {
     if (req.method === "GET") {
       return html(buildSettingsPage(cfg, url.searchParams.get("saved") === "1", ctx.user!, await listCachedModels()).html);

package/src/static/daemon-mgr.js

@@ -0,0 +1,211 @@
+// Daemon cluster manager (settings page). External file because CSP
+// script-src 'self' blocks inline scripts — see index.ts SEC_HEADERS.
+(function () {
+  "use strict";
+  var listEl = document.getElementById('daemon-list');
+  if (!listEl) return;
+  var resultEl = document.getElementById('daemon-result');
+  var addBtn = document.getElementById('daemon-add');
+  var portInput = document.getElementById('daemon-port');
+  var deployBtn = document.getElementById('daemon-deploy');
+  var deployResultEl = document.getElementById('deploy-result');
+  var refreshTimer = null;
+  var inFlight = false;
+
+  function esc(s) {
+    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
+      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
+    });
+  }
+
+  function fmtTime(s) {
+    if (!s) return '—';
+    var t = Date.parse(String(s).includes('T') ? s : String(s).replace(' ', 'T') + 'Z');
+    if (Number.isNaN(t)) return esc(s);
+    var d = new Date(t);
+    var pad = function (n) { return n < 10 ? '0' + n : '' + n; };
+    return esc(d.getFullYear() + '-' + pad(d.getMonth() + 1) + '-' + pad(d.getDate()) +
+      ' ' + pad(d.getHours()) + ':' + pad(d.getMinutes()) + ':' + pad(d.getSeconds()));
+  }
+
+  function statusPill(status) {
+    var raw = String(status || 'unknown').toLowerCase();
+    var cls = raw === 'active' ? 'active' : raw === 'drained' ? 'drained' : (raw === 'dead' ? 'dead' : 'unknown');
+    return '<span class="pill ' + cls + '">' + esc(raw) + '</span>';
+  }
+
+  function isLocalhostEndpoint(endpoint) {
+    var host = String(endpoint || '').replace(/^https?:\/\//, '').split(':')[0] || '';
+    return /^(127\.|localhost$|0\.0\.0\.0$|::1$|\[::1\]$)/.test(host);
+  }
+
+  function locationCell(endpoint) {
+    if (isLocalhostEndpoint(endpoint)) {
+      return '<span class="pill loc-local">本机</span>';
+    }
+    return '<span class="pill loc-remote">🌐 远程</span>';
+  }
+
+  function render(daemons) {
+    if (!Array.isArray(daemons) || daemons.length === 0) {
+      listEl.innerHTML = '<div class="daemon-empty">暂无 daemon 注册。可在下方启动新实例。</div>';
+      return;
+    }
+    var rows = daemons.map(function (d) {
+      var stopBtn = String(d.status || '').toLowerCase() === 'active'
+        ? '<button type="button" class="stop" data-id="' + d.id + '">停止</button>'
+        : '';
+      return '<tr>' +
+        '<td class="cap">' + d.id + '</td>' +
+        '<td class="loc">' + locationCell(d.endpoint) + '</td>' +
+        '<td class="endpoint">' + esc(d.endpoint || '') + '</td>' +
+        '<td class="cap">' + esc(d.capacity != null ? d.capacity : '') + '</td>' +
+        '<td class="heartbeat">' + fmtTime(d.lastHeartbeat) + '</td>' +
+        '<td class="registered">' + fmtTime(d.registeredAt) + '</td>' +
+        '<td>' + statusPill(d.status) + '</td>' +
+        '<td>' + stopBtn + '</td>' +
+        '</tr>';
+    }).join('');
+    listEl.innerHTML =
+      '<table><thead><tr>' +
+      '<th>ID</th><th>位置</th><th>Endpoint</th><th>容量</th><th>心跳</th><th>注册于</th><th>状态</th><th></th>' +
+      '</tr></thead><tbody>' + rows + '</tbody></table>';
+    listEl.querySelectorAll('button.stop').forEach(function (b) {
+      b.addEventListener('click', function () { stopDaemon(Number(b.getAttribute('data-id'))); });
+    });
+  }
+
+  function setResult(text, kind) {
+    if (!resultEl) return;
+    resultEl.className = 'db-result db-' + (kind === 'ok' ? 'ok' : kind === 'err' ? 'err' : 'loading');
+    resultEl.textContent = text;
+  }
+
+  async function loadDaemons() {
+    if (inFlight) return;
+    inFlight = true;
+    try {
+      var res = await fetch('/api/daemons', { headers: { 'Accept': 'application/json' } });
+      if (!res.ok) {
+        var errBody = await res.json().catch(function () { return { error: 'HTTP ' + res.status }; });
+        listEl.innerHTML = '<div class="daemon-empty">加载失败：' + esc(errBody.error || res.status) + '</div>';
+        return;
+      }
+      render(await res.json());
+    } catch (e) {
+      listEl.innerHTML = '<div class="daemon-empty">加载失败：' + esc(e.message || String(e)) + '</div>';
+    } finally {
+      inFlight = false;
+    }
+  }
+
+  async function addDaemon() {
+    if (addBtn) addBtn.disabled = true;
+    setResult('正在启动 daemon…', 'loading');
+    var body = {};
+    var portVal = portInput && portInput.value ? Number(portInput.value) : NaN;
+    if (portInput && portInput.value.trim() !== '' && Number.isFinite(portVal)) {
+      body.port = portVal;
+    }
+    try {
+      var res = await fetch('/api/daemons', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body)
+      });
+      var data = await res.json();
+      if (data.ok) {
+        setResult('✓ daemon 启动成功' + (data.output ? ':\n' + data.output : ''), 'ok');
+        if (portInput) portInput.value = '';
+        await loadDaemons();
+      } else {
+        setResult('✗ ' + (data.error || '未知错误'), 'err');
+      }
+    } catch (e) {
+      setResult('✗ ' + (e.message || String(e)), 'err');
+    } finally {
+      if (addBtn) addBtn.disabled = false;
+    }
+  }
+
+  async function stopDaemon(id) {
+    if (!confirm('确认停止 daemon #' + id + '？\n只会标记为 drained（不再接新任务），需手动 kill 进程。')) return;
+    setResult('正在标记 daemon #' + id + ' 为 drained…', 'loading');
+    try {
+      var res = await fetch('/api/daemons/' + id, { method: 'DELETE' });
+      var data = await res.json();
+      if (data.ok) {
+        setResult('✓ daemon #' + id + ' 已标记为 drained', 'ok');
+        await loadDaemons();
+      } else {
+        setResult('✗ ' + (data.error || '未知错误'), 'err');
+      }
+    } catch (e) {
+      setResult('✗ ' + (e.message || String(e)), 'err');
+    }
+  }
+
+  function setDeployResult(text, kind) {
+    if (!deployResultEl) return;
+    deployResultEl.className = 'db-result db-' + (kind === 'ok' ? 'ok' : kind === 'err' ? 'err' : 'loading');
+    deployResultEl.textContent = text;
+  }
+
+  function val(id) {
+    var el = document.getElementById(id);
+    return el && el.value != null ? el.value.trim() : '';
+  }
+
+  async function deployRemote() {
+    if (deployBtn) deployBtn.disabled = true;
+    setDeployResult('正在通过 SSH 部署（最长 60s）…', 'loading');
+    var body = {
+      sshHost: val('deploy-host'),
+      sshUser: val('deploy-user'),
+      mysqlHost: val('deploy-mysql-host')
+    };
+    var sshPort = Number(val('deploy-ssh-port'));
+    if (Number.isFinite(sshPort) && sshPort > 0) body.sshPort = sshPort;
+    var dPort = Number(val('deploy-daemon-port'));
+    if (Number.isFinite(dPort) && dPort > 0) body.daemonPort = dPort;
+    var keyFile = val('deploy-key');
+    if (keyFile) body.sshKeyFile = keyFile;
+    if (!body.sshHost || !body.sshUser || !body.mysqlHost) {
+      setDeployResult('✗ SSH 主机、SSH 用户、MySQL 主机 必填', 'err');
+      if (deployBtn) deployBtn.disabled = false;
+      return;
+    }
+    try {
+      var res = await fetch('/api/daemons/deploy', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body)
+      });
+      var data = await res.json();
+      if (data.ok) {
+        setDeployResult('✓ 部署成功' + (data.output ? '\n' + data.output : ''), 'ok');
+        await loadDaemons();
+      } else {
+        setDeployResult('✗ ' + (data.error || '未知错误') + (data.output ? '\n' + data.output : ''), 'err');
+      }
+    } catch (e) {
+      setDeployResult('✗ ' + (e.message || String(e)), 'err');
+    } finally {
+      if (deployBtn) deployBtn.disabled = false;
+    }
+  }
+
+  if (addBtn) addBtn.addEventListener('click', addDaemon);
+  if (deployBtn) deployBtn.addEventListener('click', deployRemote);
+  document.addEventListener('visibilitychange', function () {
+    if (document.hidden) {
+      if (refreshTimer) { clearInterval(refreshTimer); refreshTimer = null; }
+    } else if (!refreshTimer) {
+      loadDaemons();
+      refreshTimer = setInterval(loadDaemons, 10000);
+    }
+  });
+
+  loadDaemons();
+  refreshTimer = setInterval(loadDaemons, 10000);
+})();

package/src/views/settings.ts

@@ -67,6 +67,34 @@ ${isMysql ? `<hr style="border:0;border-top:1px solid var(--border);margin:1rem
 </section>`;
 }
 
+function buildDaemonSection(viewer: UserRow): string {
+  if (viewer.is_admin !== 1) return "";
+  return `<section class="sg daemon-section">
+<h2>Daemon 集群</h2>
+<p class="db-badge">运行中的 daemon 实例。新 daemon 通过 <code>ework-aio add-daemon</code> 启动；停止只标记为 drained，需手动结束进程。</p>
+<div id="daemon-list" class="daemon-list">加载中…</div>
+<div class="db-controls">
+<label class="sf" style="margin:0"><span>端口（可选）</span><input type="number" id="daemon-port" min="1" max="65535" placeholder="自动分配" autocomplete="off"></label>
+<button type="button" id="daemon-add">添加 Daemon</button>
+</div>
+<div id="daemon-result" class="db-result"></div>
+<details style="margin-top:.7rem">
+<summary style="cursor:pointer;font-size:13px;color:var(--text-muted)">📡 SSH 远程部署</summary>
+<div style="margin-top:.5rem">
+<label class="sf"><span>SSH 主机</span><input type="text" id="deploy-host" placeholder="192.168.1.100" autocomplete="off"></label>
+<label class="sf"><span>SSH 用户</span><input type="text" id="deploy-user" placeholder="root" value="root" autocomplete="off"></label>
+<label class="sf"><span>SSH 端口</span><input type="number" id="deploy-ssh-port" value="22" min="1" max="65535" autocomplete="off"></label>
+<label class="sf"><span>SSH 密钥</span><input type="text" id="deploy-key" placeholder="~/.ssh/id_rsa" autocomplete="off"></label>
+<label class="sf"><span>Daemon 端口</span><input type="number" id="deploy-daemon-port" placeholder="3101" min="1" max="65535" autocomplete="off"></label>
+<label class="sf"><span>MySQL 主机（远程可见）</span><input type="text" id="deploy-mysql-host" placeholder="192.168.1.1" autocomplete="off"></label>
+<div class="db-controls"><button type="button" id="daemon-deploy">部署到远程</button></div>
+</div>
+</details>
+<div id="deploy-result" class="db-result"></div>
+<script src="/static/daemon-mgr.js"></script>
+</section>`;
+}
+
 export function buildSettingsPage(cfg: Config, saved: boolean, viewer: UserRow, models: CachedModel[]): { html: string } {
   const groups = SETTINGS_GROUPS.map(
     (g) =>
@@ -109,6 +137,23 @@ button.secondary{background:transparent;color:var(--text-muted);border:1px solid
 .db-result.db-loading{background:var(--bg);color:var(--text-muted)}
 .db-result.db-ok{background:rgba(40,167,69,.15);color:#5eb88a}
 .db-result.db-err{background:rgba(220,53,69,.15);color:#e87c7c}
+.daemon-list{margin-bottom:.7rem}
+.daemon-list table{width:100%;border-collapse:collapse;font-size:12px}
+.daemon-list th,.daemon-list td{padding:.35rem .4rem;border-bottom:1px solid var(--border);text-align:left;vertical-align:top}
+.daemon-list th{color:var(--text-muted);font-weight:normal;font-size:11px;text-transform:uppercase;letter-spacing:.03em}
+.daemon-list td.endpoint{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:11px;word-break:break-all}
+.daemon-list td.cap{text-align:right;font-variant-numeric:tabular-nums}
+.daemon-list td.heartbeat,.daemon-list td.registered{color:var(--text-muted);font-size:11px;white-space:nowrap}
+.daemon-list .pill{display:inline-block;padding:.12rem .5rem;border-radius:99px;font-size:11px;line-height:1.4}
+.daemon-list .pill.active{background:rgba(40,167,69,.18);color:#5eb88a}
+.daemon-list .pill.drained{background:rgba(255,193,7,.18);color:#d4a942}
+.daemon-list .pill.dead,.daemon-list .pill.unknown{background:rgba(220,53,69,.18);color:#e87c7c}
+.daemon-list .pill.loc-local{background:rgba(40,167,69,.18);color:#5eb88a}
+.daemon-list .pill.loc-remote{background:rgba(13,110,253,.18);color:#6ea8fe}
+.daemon-list td.loc{white-space:nowrap}
+.daemon-list button.stop{padding:.25rem .6rem;font-size:11px;background:transparent;color:#e87c7c;border:1px solid rgba(220,53,69,.4)}
+.daemon-list button.stop:hover{background:rgba(220,53,69,.12)}
+.daemon-empty{color:var(--text-muted);font-size:13px;padding:.5rem 0}
 </style></head><body>
 <header class="nav"><a href="/" style="color:var(--header-text)">🏠 ework-web</a><span style="opacity:.8"> · 设置</span></header>
 <main class="wrap">
@@ -116,11 +161,12 @@ button.secondary{background:transparent;color:var(--text-muted);border:1px solid
 <p class="hint">改完保存立即生效，无需重启。密钥/启动项（token、端口等）仍在 <code>.env</code>，不在此处。</p>
 ${banner}
 <form method="POST" action="/settings">${groups}
+${modelRefreshForm}
 <div class="bar"><button type="submit">保存</button><a class="a-back" href="/">返回</a></div>
 </form>
-${modelRefreshForm}
 ${ttsLink}
 ${buildDbSection(viewer)}
+${buildDaemonSection(viewer)}
 </main></body></html>`;
   return { html };
 }