mioku-service-webui 4.4.0 → 4.4.2

package/auth.ts

@@ -2,6 +2,16 @@ import * as crypto from "node:crypto";
 import type { Context, Next } from "hono";
 import type { AuthConfig } from "./types";
 import { AUTH_PATH, WEEK_MS, readJsonFile, writeJsonFile } from "./utils";
+import { notifyOwnersAuthTokenRefreshed } from "./system";
+
+function safeEqual(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(bufA, bufB);
+}
 
 export function ensureAuthConfig(): AuthConfig {
   const now = Date.now();
@@ -14,6 +24,10 @@ export function ensureAuthConfig(): AuthConfig {
       expiresAt: now + WEEK_MS,
     };
     writeJsonFile(AUTH_PATH, generated);
+    void notifyOwnersAuthTokenRefreshed(
+      generated.token,
+      generated.expiresAt,
+    ).catch(() => {});
     return generated;
   }
 
@@ -28,7 +42,7 @@ export function verifyAuthHeader(c: Context): boolean {
   }
 
   const authConfig = ensureAuthConfig();
-  return token === authConfig.token && Date.now() < authConfig.expiresAt;
+  return safeEqual(token, authConfig.token) && Date.now() < authConfig.expiresAt;
 }
 
 export async function requireAuth(c: Context, next: Next): Promise<Response | void> {
@@ -40,7 +54,7 @@ export async function requireAuth(c: Context, next: Next): Promise<Response | vo
 
 export function loginWithToken(inputToken: string): { ok: boolean; expiresAt?: number } {
   const authConfig = ensureAuthConfig();
-  if (inputToken !== authConfig.token) {
+  if (!safeEqual(inputToken, authConfig.token)) {
     return { ok: false };
   }
 

package/index.ts

@@ -30,6 +30,7 @@ import {
   createStrangerRoutes,
   createAccessControlRoutes,
 } from "./routes";
+import { freePort } from "./port-utils";
 
 export interface WebUIServiceAPI {
   getSettings(): WebUISettings;
@@ -44,7 +45,7 @@ class WebUIRuntime {
     logger.info(`[webui-action] ${action}${text}`);
   }
 
-  public initRoutes(): void {
+  public async initRoutes(): Promise<void> {
     const { upgradeWebSocket, injectWebSocket } = createNodeWebSocket({
       app: this.app,
     });
@@ -60,6 +61,16 @@ class WebUIRuntime {
       );
     });
 
+    this.app.use("*", async (c, next) => {
+      await next();
+      c.header("X-Robots-Tag", "noindex, nofollow");
+    });
+
+    this.app.get("/robots.txt", (c) => {
+      c.header("content-type", "text/plain");
+      return c.body("User-agent: *\nDisallow: /\n");
+    });
+
     this.app.notFound((c) => {
       if (c.req.path.startsWith("/api/")) {
         return c.json({ ok: false, error: "API_NOT_FOUND" }, 404);
@@ -172,6 +183,12 @@ class WebUIRuntime {
     });
 
     const settings = getWebUISettings();
+    const freed = await freePort(settings.port);
+    if (freed.remainingPids.length > 0) {
+      throw new Error(
+        `webui 端口 ${settings.port} 被占用且无法结束 (PID: ${freed.remainingPids.join(", ")})`,
+      );
+    }
     const server = serve({
       fetch: this.app.fetch,
       port: settings.port,
@@ -232,7 +249,7 @@ const webUIService: MiokuService = {
     initBuiltinDatasources();
     ensureAuthConfig();
     await ensureWebUIDist();
-    runtime.initRoutes();
+    await runtime.initRoutes();
   },
 
   async dispose() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mioku-service-webui",
-  "version": "4.4.0",
+  "version": "4.4.2",
   "description": "Mioku WebUI 服务",
   "main": "index.ts",
   "type": "module",

package/port-utils.ts

@@ -0,0 +1,159 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { logger } from "mioki";
+
+const execFileAsync = promisify(execFile);
+
+export interface FreePortLogger {
+  info: (msg: string) => void;
+  warn: (msg: string) => void;
+  error: (msg: string) => void;
+}
+
+export interface FreePortOptions {
+  logger?: FreePortLogger;
+  graceMs?: number;
+  sigkillDelayMs?: number;
+}
+
+export interface FreePortResult {
+  port: number;
+  wasOccupied: boolean;
+  killedPids: number[];
+  remainingPids: number[];
+  lsofAvailable: boolean;
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function parsePids(raw: string): number[] {
+  const pids = new Set<number>();
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const pid = Number(trimmed);
+    if (Number.isFinite(pid) && pid > 0 && Math.floor(pid) === pid) {
+      pids.add(pid);
+    }
+  }
+  return Array.from(pids);
+}
+
+async function listListeningPids(
+  port: number,
+): Promise<{ pids: number[]; lsofAvailable: boolean }> {
+  try {
+    const { stdout } = await execFileAsync("lsof", [
+      "-nP",
+      `-iTCP:${port}`,
+      "-sTCP:LISTEN",
+      "-t",
+    ]);
+    return { pids: parsePids(stdout), lsofAvailable: true };
+  } catch (err: any) {
+    if (err?.code === "ENOENT") {
+      return { pids: [], lsofAvailable: false };
+    }
+    return { pids: [], lsofAvailable: true };
+  }
+}
+
+async function sendSignal(
+  pid: number,
+  signal: NodeJS.Signals,
+): Promise<boolean> {
+  if (pid === process.pid) return false;
+  try {
+    process.kill(pid, signal);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function freePort(
+  port: number,
+  options: FreePortOptions = {},
+): Promise<FreePortResult> {
+  const log = options.logger ?? (logger as unknown as FreePortLogger);
+  const graceMs = options.graceMs ?? 1500;
+  const sigkillDelayMs = options.sigkillDelayMs ?? 500;
+
+  const initial = await listListeningPids(port);
+
+  if (!initial.lsofAvailable) {
+    log.warn(
+      `未检测到 lsof 命令，无法定位端口 ${port} 的占用进程，建议安装 lsof`,
+    );
+    return {
+      port,
+      wasOccupied: false,
+      killedPids: [],
+      remainingPids: [],
+      lsofAvailable: false,
+    };
+  }
+
+  const occupied = initial.pids.filter((pid) => pid !== process.pid);
+  if (occupied.length === 0) {
+    return {
+      port,
+      wasOccupied: false,
+      killedPids: [],
+      remainingPids: [],
+      lsofAvailable: true,
+    };
+  }
+
+  log.warn(
+    `端口 ${port} 被占用，进程 PID: ${occupied.join(", ")}，正在尝试结束...`,
+  );
+
+  const killed: number[] = [];
+  for (const pid of occupied) {
+    if (await sendSignal(pid, "SIGTERM")) {
+      killed.push(pid);
+    }
+  }
+
+  if (killed.length > 0) {
+    await sleep(graceMs);
+  }
+
+  let remaining = (await listListeningPids(port)).pids.filter(
+    (pid) => pid !== process.pid,
+  );
+
+  if (remaining.length > 0) {
+    log.warn(
+      `端口 ${port} 仍被占用 (PID: ${remaining.join(", ")})，发送 SIGKILL 强制结束...`,
+    );
+    for (const pid of remaining) {
+      if (await sendSignal(pid, "SIGKILL")) {
+        killed.push(pid);
+      }
+    }
+    await sleep(sigkillDelayMs);
+    remaining = (await listListeningPids(port)).pids.filter(
+      (pid) => pid !== process.pid,
+    );
+  }
+
+  if (remaining.length > 0) {
+    log.error(
+      `端口 ${port} 仍被占用，无法结束进程 PID: ${remaining.join(", ")}`,
+    );
+  } else {
+    log.info(`端口 ${port} 已释放`);
+  }
+
+  return {
+    port,
+    wasOccupied: true,
+    killedPids: killed,
+    remainingPids: remaining,
+    lsofAvailable: true,
+  };
+}

package/routes/data-management.ts

@@ -514,7 +514,7 @@ export function createDataManagementRoutes() {
 
   app.post("/node-modules/refresh", async (c) => {
     const settings = getWebUISettings();
-    const command = getInstallCommand(settings.packageManager);
+    const command = getInstallCommand();
     const startedAt = Date.now();
     const result = await runCommand(command.cmd, command.args, process.cwd());
     const finishedAt = Date.now();

package/routes/db.ts

@@ -187,6 +187,18 @@ export function createPluginConfigRoutes() {
 export function createMemeRoutes() {
   const app = new Hono();
 
+  const memeRoot = path.resolve(CHAT_DATA_DIR, "meme");
+  const isInsideMeme = (target: string): boolean => {
+    const resolved = path.resolve(target);
+    return resolved === memeRoot || resolved.startsWith(`${memeRoot}${path.sep}`);
+  };
+  const isSafeSegment = (value: string): boolean =>
+    Boolean(value) &&
+    !value.includes("/") &&
+    !value.includes("\\") &&
+    value !== "." &&
+    value !== "..";
+
   app.get("/tree", (c) =>
     c.json({ ok: true, data: listMemeTree() }),
   );
@@ -200,11 +212,22 @@ export function createMemeRoutes() {
       return c.json({ ok: false, error: "FILE_REQUIRED" }, 400);
     }
 
-    const dir = path.join(CHAT_DATA_DIR, "meme", character, emotion);
-    fs.mkdirSync(dir, { recursive: true });
-
     const fileName = file.name || `upload-${Date.now()}.png`;
+    if (
+      !isSafeSegment(character) ||
+      !isSafeSegment(emotion) ||
+      !isSafeSegment(fileName)
+    ) {
+      return c.json({ ok: false, error: "INVALID_NAME" }, 400);
+    }
+
+    const dir = path.join(memeRoot, character, emotion);
     const filePath = path.join(dir, fileName);
+    if (!isInsideMeme(filePath)) {
+      return c.json({ ok: false, error: "INVALID_PATH" }, 400);
+    }
+
+    fs.mkdirSync(dir, { recursive: true });
     const buffer = Buffer.from(await file.arrayBuffer());
     fs.writeFileSync(filePath, buffer);
 
@@ -213,7 +236,10 @@ export function createMemeRoutes() {
 
   app.delete("/", async (c) => {
     const body = await c.req.json();
-    const filePath = path.join(process.cwd(), String(body.path || ""));
+    const filePath = path.resolve(process.cwd(), String(body.path || ""));
+    if (!isInsideMeme(filePath)) {
+      return c.json({ ok: false, error: "INVALID_PATH" }, 400);
+    }
     if (!fs.existsSync(filePath)) {
       return c.json({ ok: false, error: "NOT_FOUND" }, 404);
     }

package/system.ts

@@ -96,6 +96,66 @@ const BOOT_CONFIG_PATH = path.join(
   "base.json",
 );
 
+export interface BootSystemCommandsConfig {
+  update: {
+    enabled: boolean;
+    selectTimeoutMs: number;
+  };
+  install: {
+    enabled: boolean;
+  };
+  market: {
+    enabled: boolean;
+  };
+  restart: {
+    enabled: boolean;
+  };
+}
+
+const DEFAULT_BOOT_SYSTEM_COMMANDS_CONFIG: BootSystemCommandsConfig = {
+  update: {
+    enabled: true,
+    selectTimeoutMs: 60000,
+  },
+  install: {
+    enabled: true,
+  },
+  market: {
+    enabled: true,
+  },
+  restart: {
+    enabled: true,
+  },
+};
+
+function normalizeBootSystemCommandsConfig(
+  input: any,
+): BootSystemCommandsConfig {
+  const merged = deepMerge(
+    cloneJson(DEFAULT_BOOT_SYSTEM_COMMANDS_CONFIG),
+    input || {},
+  );
+  const rawTimeout = Number(merged?.update?.selectTimeoutMs);
+  return {
+    update: {
+      enabled: Boolean(merged?.update?.enabled),
+      selectTimeoutMs:
+        Number.isFinite(rawTimeout) && rawTimeout >= 1000
+          ? Math.floor(rawTimeout)
+          : DEFAULT_BOOT_SYSTEM_COMMANDS_CONFIG.update.selectTimeoutMs,
+    },
+    install: {
+      enabled: Boolean(merged?.install?.enabled),
+    },
+    market: {
+      enabled: Boolean(merged?.market?.enabled),
+    },
+    restart: {
+      enabled: Boolean(merged?.restart?.enabled),
+    },
+  };
+}
+
 interface AccessRuleConfig {
   whitelist: Array<string | number>;
   blacklist: Array<string | number>;
@@ -1345,8 +1405,7 @@ export async function getManagedPackageDetail(
   const missingServices = checkDependentServices(pkg);
 
   const isSystemPlugin = target === "plugin" ? isSystemPluginName(name) : false;
-  const isSystemService =
-    target === "service" ? isSystemServiceName(name) : false;
+  const isSystemService = false;
   return {
     ok: true,
     data: {
@@ -1755,6 +1814,57 @@ async function notifyOwnerWebUIDownloaded(version: string): Promise<void> {
   }
 }
 
+export async function notifyOwnersAuthTokenRefreshed(
+  token: string,
+  expiresAt: number,
+): Promise<void> {
+  const owners = getMiokuConfig()?.owners || [];
+  if (owners.length === 0) {
+    return;
+  }
+
+  const MAX_ATTEMPTS = 24;
+  const RETRY_INTERVAL_MS = 5000;
+
+  let bots: any[] = [];
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt += 1) {
+    bots = Array.from(connectedBots.values()).filter(Boolean);
+    if (bots.length > 0) {
+      break;
+    }
+    await sleep(RETRY_INTERVAL_MS);
+  }
+
+  if (bots.length === 0) {
+    logger.warn("[webui] 密钥已刷新，但暂无在线 Bot，未能通知主人");
+    return;
+  }
+
+  const bot = bots[0];
+  const settings = getWebUISettings();
+  const url = `http://${settings.host}:${settings.port}`;
+  const expireText = new Date(expiresAt).toLocaleString("zh-CN");
+  const message = [
+    "🔑 WebUI 鉴权密钥已更新",
+    `地址: ${url}`,
+    `新密钥: ${token}`,
+    `有效期至: ${expireText}`,
+  ].join("\n");
+
+  for (const ownerId of owners) {
+    try {
+      await bot.api("send_private_msg", {
+        user_id: Number(ownerId),
+        message,
+      });
+    } catch (err: any) {
+      logger.warn(
+        `[webui] 通知主人 ${ownerId} 密钥更新失败: ${err?.message || err}`,
+      );
+    }
+  }
+}
+
 export async function updateWebUIDistFromRelease(): Promise<
   Record<string, any>
 > {

package/utils.ts

@@ -36,7 +36,7 @@ export const BACKUP_DIR = path.join(process.cwd(), "backup");
 
 export const defaultWebUISettings: WebUISettings = {
   port: 3339,
-  host: "0.0.0.0",
+  host: "127.0.0.1",
   packageManager: "bun" as PackageManager,
 };
 
@@ -125,8 +125,32 @@ export function normalizePackageManager(): PackageManager {
 }
 
 export function isValidRepoUrl(url: string): boolean {
-  const gitLike = /^(https?:\/\/|git@|ssh:\/\/).+/;
-  return gitLike.test(url.trim());
+  const trimmed = url.trim();
+  // 拒绝空白字符：堵 `ssh://host -o ProxyCommand=...` 之类参数注入
+  if (!trimmed || /\s/.test(trimmed)) {
+    return false;
+  }
+
+  if (/^https?:\/\//.test(trimmed)) {
+    try {
+      const parsed = new URL(trimmed);
+      return Boolean(parsed.hostname) && !parsed.hostname.startsWith("-");
+    } catch {
+      return false;
+    }
+  }
+
+  const sshMatch = trimmed.match(/^ssh:\/\/(?:[^@/]+@)?([^/:]+)/);
+  if (sshMatch) {
+    return !sshMatch[1].startsWith("-");
+  }
+
+  const scpMatch = trimmed.match(/^git@([^:]+):.+/);
+  if (scpMatch) {
+    return !scpMatch[1].startsWith("-");
+  }
+
+  return false;
 }
 
 export function isNpmPackageName(name: string): boolean {