memory-eternal 0.10.54 → 0.12.0

package/lib/api.js

@@ -15,6 +15,7 @@ import { gzipSync, brotliCompressSync, constants as zlibConstants } from 'node:z
 import os from 'node:os'
 import fs, { readFileSync } from 'node:fs'
 import path from 'node:path'
+import { spawn } from 'node:child_process'
 import { listCards, countCards, readCard, search, searchAll, graph, graphAll, overview, exportCards, deleteCard, writeCard, parseCard, stats, optimizeCandidates, optimizeApply, addFeedback, dailyCounts, mergeCards, ensureVault, auditQueue, recycleList, purgeExpired, setCardStatus, restoreCard, mainStoreBodies } from './vault.js'
 import { compressExcerpt, DEFAULT_CAPTURE_MAX_TOKENS } from './capture.js'
 import { buildDiagnostics } from './feedback.js'
@@ -30,6 +31,26 @@ export function broadcast(event, data) { return hub.broadcast(event, data) }
 
 export const API_PREFIX = '/memory-eternal/api'
 
+// 浏览器/Electron 里 target=_blank 可能被宿主拦截；由本机 Node 进程调用系统默认浏览器。
+// 只允许项目自己的 GitHub 地址，避免变成任意 URL 打开器。
+function openExternalUrl(raw) {
+  let u
+  try { u = new URL(String(raw || '')) } catch { return { ok: false, error: 'bad url' } }
+  const allowed = u.protocol === 'https:' && u.hostname === 'github.com' && u.pathname.startsWith('/EternalNight996/memory-eternal')
+  if (!allowed) return { ok: false, error: 'url not allowed' }
+  try {
+    let child
+    if (process.platform === 'win32') child = spawn('rundll32', ['url.dll,FileProtocolHandler', u.href], { detached: true, stdio: 'ignore', windowsHide: true })
+    else if (process.platform === 'darwin') child = spawn('open', [u.href], { detached: true, stdio: 'ignore' })
+    else child = spawn('xdg-open', [u.href], { detached: true, stdio: 'ignore' })
+    child.on('error', () => {})
+    child.unref()
+    return { ok: true, url: u.href }
+  } catch (e) {
+    return { ok: false, error: String((e && e.message) || e) }
+  }
+}
+
 // npm 最新版本缓存（避免每次点「检查更新」都打 registry）
 const versionCache = { at: 0, latest: '' }
 
@@ -477,6 +498,10 @@ export function createApi(deps = {}) {
         }, 300)
         return
       }
+      case '/open-external': {
+        if (req.method && req.method !== 'POST') return json(res, 405, { ok: false, error: 'method not allowed' })
+        return json(res, 200, openExternalUrl(query.get('url')))
+      }
       case '/diagnostics': {
         // 「反馈异常」用：返回一段可直接贴进 issue 的**已脱敏**诊断文本。
         // 宿主与独立 web 共用这个实现；home 目录、各类 key/token 全都会被替换掉。