mu-agent-bridge 1.0.19 → 1.0.20

package/README.md

@@ -31,7 +31,7 @@ Windows 可运行 `start-mab.ps1` 注册并启动登录时自动运行的计划
 本机打开 `http://127.0.0.1:26107/abweb/` 无需配置码。局域网管理页可用一次性配置码配对。
 在 Windows 主机运行 `mab pair`，将显示的 6 位码输入
 abweb 的“配置码”栏；配对码 10 分钟有效，只能使用一次，连续输错 5 次后需重新执行
-`mab pair`。配对成功后登录有效期为 24 小时，浏览器关闭再打开仍可使用；过期后需重新配对。后台重启会使配对登录失效。本机免配对和手动配置的管理令牌按原有规则使用。配置码只能从 Windows 本机的
+`mab pair`。配对成功后登录有效期为 24 小时，浏览器关闭再打开仍可使用；过期后需重新配对。后台重启及升级不会使配对登录提前失效，会话校验信息保存在状态目录的 `paired-sessions.json` 中，磁盘仅保存令牌哈希及原定过期时间；重启不会延长有效期。本机免配对和手动配置的管理令牌按原有规则使用。配置码只能从 Windows 本机的
 `127.0.0.1` 接口取得，远程浏览器不能读取。
 
 环境变量：`AGENT_BRIDGE_PORT`、`AGENT_BRIDGE_HOST`、`AGENT_BRIDGE_TOKEN`、

package/dist/src-ts/cli.js

@@ -182,7 +182,7 @@ async function serve() {
     const fallbackPorts = (process.env.AGENT_BRIDGE_FALLBACK_PORTS ?? "").split(",").map((value) => Number(value.trim())).filter((value) => Number.isInteger(value) && value >= 0);
     if (port > 0 && !fallbackPorts.length)
         fallbackPorts.push(0);
-    const server = new control_server_1.ControlServer({ manager, host, port, fallbackPorts, token: process.env.AGENT_BRIDGE_TOKEN });
+    const server = new control_server_1.ControlServer({ manager, host, port, fallbackPorts, token: process.env.AGENT_BRIDGE_TOKEN, sessionFile: (0, node_path_1.resolve)(stateDirectory(), "paired-sessions.json") });
     const address = await server.start();
     const addressFile = (0, node_path_1.resolve)(stateDirectory(), "daemon-address.json");
     await (0, promises_1.mkdir)(stateDirectory(), { recursive: true });

package/dist/src-ts/control-server.js

@@ -4,6 +4,8 @@ exports.ControlServer = exports.listExistingAids = void 0;
 const node_http_1 = require("node:http");
 const node_child_process_1 = require("node:child_process");
 const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
 const local_aids_1 = require("./local-aids");
 const openai_adapter_1 = require("./plugins/qwenwork/openai-adapter");
 var local_aids_2 = require("./local-aids");
@@ -16,6 +18,7 @@ class ControlServer {
     pairingCode = String((0, node_crypto_1.randomInt)(0, 1_000_000)).padStart(6, "0");
     pairingExpiresAt = Date.now() + 10 * 60 * 1000;
     pairedTokens = new Map();
+    sessionWrite = Promise.resolve();
     pairingUsed = false;
     pairingFailures = 0;
     constructor(options) {
@@ -23,6 +26,21 @@ class ControlServer {
         this.server = (0, node_http_1.createServer)((req, res) => { void this.handle(req, res); });
     }
     async start() {
+        if (this.options.sessionFile) {
+            let stored = {};
+            try {
+                stored = JSON.parse(await (0, promises_1.readFile)(this.options.sessionFile, "utf8"));
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            this.pairedTokens.clear();
+            for (const [hash, expiry] of Object.entries(stored)) {
+                if (/^[a-f0-9]{64}$/.test(hash) && typeof expiry === "number" && Number.isFinite(expiry) && expiry > Date.now())
+                    this.pairedTokens.set(hash, expiry);
+            }
+        }
         const host = this.options.host ?? "127.0.0.1";
         const candidates = [this.options.port ?? 0, ...(this.options.fallbackPorts ?? [])];
         for (const port of candidates) {
@@ -54,6 +72,24 @@ class ControlServer {
     }
     async stop() { if (!this.server.listening)
         return; await new Promise((resolve, reject) => this.server.close((error) => error ? reject(error) : resolve())); }
+    async saveSessions() {
+        const file = this.options.sessionFile;
+        if (!file)
+            return;
+        const pending = this.sessionWrite.catch(() => undefined).then(async () => {
+            await (0, promises_1.mkdir)((0, node_path_1.dirname)(file), { recursive: true });
+            const temporary = `${file}.${(0, node_crypto_1.randomBytes)(8).toString("hex")}.tmp`;
+            try {
+                await (0, promises_1.writeFile)(temporary, JSON.stringify(Object.fromEntries(this.pairedTokens)), { mode: 0o600 });
+                await (0, promises_1.rename)(temporary, file);
+            }
+            finally {
+                await (0, promises_1.rm)(temporary, { force: true });
+            }
+        });
+        this.sessionWrite = pending;
+        await pending;
+    }
     async handle(req, res) {
         try {
             const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
@@ -84,11 +120,19 @@ class ControlServer {
                 for (const [storedToken, expiry] of this.pairedTokens)
                     if (expiry <= Date.now())
                         this.pairedTokens.delete(storedToken);
-                this.pairedTokens.set(token, expiresAt);
+                const hash = (0, node_crypto_1.createHash)("sha256").update(token).digest("hex");
+                this.pairedTokens.set(hash, expiresAt);
+                try {
+                    await this.saveSessions();
+                }
+                catch (error) {
+                    this.pairedTokens.delete(hash);
+                    throw error;
+                }
                 return this.json(res, 200, { ok: true, token, expiresAt });
             }
             const authorization = req.headers.authorization;
-            const authorized = authorization === `Bearer ${this.options.token}` || (authorization?.startsWith("Bearer ") && (this.pairedTokens.get(authorization.slice(7)) ?? 0) > Date.now());
+            const authorized = authorization === `Bearer ${this.options.token}` || (authorization?.startsWith("Bearer ") && (this.pairedTokens.get((0, node_crypto_1.createHash)("sha256").update(authorization.slice(7)).digest("hex")) ?? 0) > Date.now());
             if (this.options.token && !isLoopback(req.socket.remoteAddress) && !authorized && !(method === "GET" && url.pathname.startsWith("/abweb")))
                 return this.json(res, 401, { error: "unauthorized" });
             if (parts[0] === "api" && parts[1] === "agents" && parts[2] && parts[3] === "v1") {

package/dist/tests-ts/control-server.test.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -11,6 +44,7 @@ const evolcore_1 = require("../src-ts/plugins/aun/evolcore");
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
 const plugin_manager_1 = require("../src-ts/plugin-manager");
 (0, node_test_1.default)("关联 EvolCore AID 时配置相应的 Agent 路由", async () => {
     const calls = [];
@@ -238,13 +272,49 @@ const plugin_manager_1 = require("../src-ts/plugin-manager");
             return response.statusCode;
         };
         strict_1.default.equal(await checkRemote(), 200);
-        server.pairedTokens.set(token, Date.now() - 1);
+        server.pairedTokens.set((0, node_crypto_1.createHash)("sha256").update(token).digest("hex"), Date.now() - 1);
         strict_1.default.equal(await checkRemote(), 401);
     }
     finally {
         await server.stop();
     }
 });
+(0, node_test_1.default)("配对登录重启后保留原24小时期限且过期后拒绝访问", async () => {
+    const directory = await (0, promises_1.mkdtemp)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "mab-login-"));
+    const sessionFile = (0, node_path_1.join)(directory, "paired-sessions.json");
+    const manager = { list: () => [], dispatchHttp: async () => false };
+    const options = { manager, host: "127.0.0.1", port: 0, token: "before", sessionFile };
+    let server = new control_server_1.ControlServer(options);
+    try {
+        const address = await server.start();
+        const base = `http://${address.host}:${address.port}`;
+        const { code } = await (await fetch(`${base}/api/pair-code`)).json();
+        const response = await fetch(`${base}/api/pair`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ code }) });
+        const { token, expiresAt } = await response.json();
+        const check = async () => {
+            const res = { setHeader() { }, end() { } };
+            await server.handle({ url: "/api/health", method: "GET", headers: { host: "localhost", authorization: `Bearer ${token}` }, socket: { remoteAddress: "192.168.31.10" } }, res);
+            return res.statusCode;
+        };
+        await server.stop();
+        server = new control_server_1.ControlServer({ ...options, token: "after" });
+        await server.start();
+        strict_1.default.equal(await check(), 200);
+        const stored = JSON.parse(await Promise.resolve().then(() => __importStar(require("node:fs/promises"))).then(fs => fs.readFile(sessionFile, "utf8")));
+        const hash = (0, node_crypto_1.createHash)("sha256").update(token).digest("hex");
+        strict_1.default.equal(stored[hash], expiresAt);
+        strict_1.default.ok(!JSON.stringify(stored).includes(token), "磁盘不保存原始登录令牌");
+        await server.stop();
+        await (0, promises_1.writeFile)(sessionFile, JSON.stringify({ [hash]: Date.now() - 1 }));
+        server = new control_server_1.ControlServer(options);
+        await server.start();
+        strict_1.default.equal(await check(), 401);
+    }
+    finally {
+        await server.stop();
+        await (0, promises_1.rm)(directory, { recursive: true, force: true });
+    }
+});
 (0, node_test_1.default)("配对码连续失败五次后必须从本机重新获取", async () => {
     const manager = { list: () => [], dispatchHttp: async () => false };
     const server = new control_server_1.ControlServer({ manager, host: "127.0.0.1", port: 0, token: "secret" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mu-agent-bridge",
-  "version": "1.0.19",
+  "version": "1.0.20",
   "description": "将 AUN Agent 连接到本地桌面 AI 客户端的插件平台。",
   "main": "dist/src-ts/cli.js",
   "bin": {