mu-agent-bridge 1.0.19 → 1.0.21

package/README.md

@@ -31,7 +31,7 @@ Windows 可运行 `start-mab.ps1` 注册并启动登录时自动运行的计划
 本机打开 `http://127.0.0.1:26107/abweb/` 无需配置码。局域网管理页可用一次性配置码配对。
 在 Windows 主机运行 `mab pair`，将显示的 6 位码输入
 abweb 的“配置码”栏；配对码 10 分钟有效，只能使用一次，连续输错 5 次后需重新执行
-`mab pair`。配对成功后登录有效期为 24 小时，浏览器关闭再打开仍可使用；过期后需重新配对。后台重启会使配对登录失效。本机免配对和手动配置的管理令牌按原有规则使用。配置码只能从 Windows 本机的
+`mab pair`。配对成功后登录有效期为 24 小时，浏览器关闭再打开仍可使用；过期后需重新配对。后台重启及升级不会使配对登录提前失效，会话校验信息保存在状态目录的 `paired-sessions.json` 中，磁盘仅保存令牌哈希及原定过期时间；重启不会延长有效期。本机免配对和手动配置的管理令牌按原有规则使用。配置码只能从 Windows 本机的
 `127.0.0.1` 接口取得，远程浏览器不能读取。
 
 环境变量：`AGENT_BRIDGE_PORT`、`AGENT_BRIDGE_HOST`、`AGENT_BRIDGE_TOKEN`、

package/dist/src-ts/cli.js

@@ -182,7 +182,7 @@ async function serve() {
     const fallbackPorts = (process.env.AGENT_BRIDGE_FALLBACK_PORTS ?? "").split(",").map((value) => Number(value.trim())).filter((value) => Number.isInteger(value) && value >= 0);
     if (port > 0 && !fallbackPorts.length)
         fallbackPorts.push(0);
-    const server = new control_server_1.ControlServer({ manager, host, port, fallbackPorts, token: process.env.AGENT_BRIDGE_TOKEN });
+    const server = new control_server_1.ControlServer({ manager, host, port, fallbackPorts, token: process.env.AGENT_BRIDGE_TOKEN, sessionFile: (0, node_path_1.resolve)(stateDirectory(), "paired-sessions.json") });
     const address = await server.start();
     const addressFile = (0, node_path_1.resolve)(stateDirectory(), "daemon-address.json");
     await (0, promises_1.mkdir)(stateDirectory(), { recursive: true });

package/dist/src-ts/control-server.js

@@ -4,6 +4,8 @@ exports.ControlServer = exports.listExistingAids = void 0;
 const node_http_1 = require("node:http");
 const node_child_process_1 = require("node:child_process");
 const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
 const local_aids_1 = require("./local-aids");
 const openai_adapter_1 = require("./plugins/qwenwork/openai-adapter");
 var local_aids_2 = require("./local-aids");
@@ -16,6 +18,7 @@ class ControlServer {
     pairingCode = String((0, node_crypto_1.randomInt)(0, 1_000_000)).padStart(6, "0");
     pairingExpiresAt = Date.now() + 10 * 60 * 1000;
     pairedTokens = new Map();
+    sessionWrite = Promise.resolve();
     pairingUsed = false;
     pairingFailures = 0;
     constructor(options) {
@@ -23,6 +26,21 @@ class ControlServer {
         this.server = (0, node_http_1.createServer)((req, res) => { void this.handle(req, res); });
     }
     async start() {
+        if (this.options.sessionFile) {
+            let stored = {};
+            try {
+                stored = JSON.parse(await (0, promises_1.readFile)(this.options.sessionFile, "utf8"));
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            this.pairedTokens.clear();
+            for (const [hash, expiry] of Object.entries(stored)) {
+                if (/^[a-f0-9]{64}$/.test(hash) && typeof expiry === "number" && Number.isFinite(expiry) && expiry > Date.now())
+                    this.pairedTokens.set(hash, expiry);
+            }
+        }
         const host = this.options.host ?? "127.0.0.1";
         const candidates = [this.options.port ?? 0, ...(this.options.fallbackPorts ?? [])];
         for (const port of candidates) {
@@ -54,6 +72,24 @@ class ControlServer {
     }
     async stop() { if (!this.server.listening)
         return; await new Promise((resolve, reject) => this.server.close((error) => error ? reject(error) : resolve())); }
+    async saveSessions() {
+        const file = this.options.sessionFile;
+        if (!file)
+            return;
+        const pending = this.sessionWrite.catch(() => undefined).then(async () => {
+            await (0, promises_1.mkdir)((0, node_path_1.dirname)(file), { recursive: true });
+            const temporary = `${file}.${(0, node_crypto_1.randomBytes)(8).toString("hex")}.tmp`;
+            try {
+                await (0, promises_1.writeFile)(temporary, JSON.stringify(Object.fromEntries(this.pairedTokens)), { mode: 0o600 });
+                await (0, promises_1.rename)(temporary, file);
+            }
+            finally {
+                await (0, promises_1.rm)(temporary, { force: true });
+            }
+        });
+        this.sessionWrite = pending;
+        await pending;
+    }
     async handle(req, res) {
         try {
             const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
@@ -84,11 +120,19 @@ class ControlServer {
                 for (const [storedToken, expiry] of this.pairedTokens)
                     if (expiry <= Date.now())
                         this.pairedTokens.delete(storedToken);
-                this.pairedTokens.set(token, expiresAt);
+                const hash = (0, node_crypto_1.createHash)("sha256").update(token).digest("hex");
+                this.pairedTokens.set(hash, expiresAt);
+                try {
+                    await this.saveSessions();
+                }
+                catch (error) {
+                    this.pairedTokens.delete(hash);
+                    throw error;
+                }
                 return this.json(res, 200, { ok: true, token, expiresAt });
             }
             const authorization = req.headers.authorization;
-            const authorized = authorization === `Bearer ${this.options.token}` || (authorization?.startsWith("Bearer ") && (this.pairedTokens.get(authorization.slice(7)) ?? 0) > Date.now());
+            const authorized = authorization === `Bearer ${this.options.token}` || (authorization?.startsWith("Bearer ") && (this.pairedTokens.get((0, node_crypto_1.createHash)("sha256").update(authorization.slice(7)).digest("hex")) ?? 0) > Date.now());
             if (this.options.token && !isLoopback(req.socket.remoteAddress) && !authorized && !(method === "GET" && url.pathname.startsWith("/abweb")))
                 return this.json(res, 401, { error: "unauthorized" });
             if (parts[0] === "api" && parts[1] === "agents" && parts[2] && parts[3] === "v1") {

package/dist/src-ts/plugins/abweb/index.js

@@ -5,7 +5,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const MANIFEST = {
     id: "abweb",
-    version: "1.0.5",
+    version: "1.0.6",
     displayName: "Agent Bridge Web",
     entry: "dist/index.js",
     apiVersion: "1",

package/dist/src-ts/plugins/abweb/public/app.js

@@ -145,7 +145,6 @@
                 void loadCatalog().catch((cause) => { catalogNode.textContent = `远程插件目录暂时不可用：${cause instanceof Error ? cause.message : String(cause)}`; });
         }
         catch (cause) {
-            node("#access-panel").hidden = false;
             error(cause instanceof Error ? cause.message : String(cause));
         }
         finally {

package/dist/tests-ts/abweb-login.test.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = __importDefault(require("node:test"));
+const promises_1 = require("node:fs/promises");
+const node_vm_1 = require("node:vm");
+class Element {
+    hidden = true;
+    value = "";
+    textContent = "";
+    options = [];
+    selectedIndex = 0;
+    onclick;
+    replaceChildren() { }
+    append() { }
+    setAttribute() { }
+}
+(0, node_test_1.default)("ABWeb缓存登录在刷新和后台暂时不可用时保留，到期才重新配对", async () => {
+    const script = await (0, promises_1.readFile)("src-ts/plugins/abweb/public/app.js", "utf8");
+    let now = Date.now();
+    const storage = new Map();
+    let unavailable = false;
+    const calls = [];
+    const open = async () => {
+        const nodes = new Map();
+        const node = (selector) => { if (!nodes.has(selector))
+            nodes.set(selector, new Element()); return nodes.get(selector); };
+        (0, node_vm_1.runInNewContext)(script, {
+            document: { querySelector: node, createElement: () => new Element(), hidden: false },
+            localStorage: { getItem: (key) => storage.get(key) ?? null, setItem: (key, value) => storage.set(key, value), removeItem: (key) => storage.delete(key) },
+            Date: class extends Date {
+                static now() { return now; }
+            },
+            setInterval() { }, confirm: () => false,
+            fetch: async (path, options) => {
+                calls.push({ path, token: options.headers.authorization });
+                if (unavailable)
+                    throw new Error("后台正在重启");
+                if (path === "/api/pair")
+                    return { ok: true, status: 200, json: async () => ({ token: "测试会话", expiresAt: now + 86400000 }) };
+                const authorized = options.headers.authorization === "Bearer 测试会话" && Number(storage.get("mab-login-expires-at")) > now;
+                return { ok: authorized, status: authorized ? 200 : 401, json: async () => ({ plugins: [], messages: [], sessions: [], mode: "auto-install" }) };
+            },
+        });
+        await new Promise(resolve => setImmediate(resolve));
+        return node;
+    };
+    const first = await open();
+    strict_1.default.equal(first("#access-panel").hidden, false);
+    first("#pair-code").value = "123456";
+    first("#pair-button").onclick();
+    await new Promise(resolve => setImmediate(resolve));
+    strict_1.default.equal(first("#access-panel").hidden, true);
+    const expiry = storage.get("mab-login-expires-at");
+    now += 23 * 3600000;
+    const refreshed = await open();
+    strict_1.default.equal(refreshed("#access-panel").hidden, true);
+    unavailable = true;
+    const restarting = await open();
+    strict_1.default.equal(restarting("#access-panel").hidden, true, "后台暂时不可用不能提示重新配对");
+    strict_1.default.equal(storage.get("mab-login-token"), "测试会话");
+    unavailable = false;
+    strict_1.default.equal((await open())("#access-panel").hidden, true);
+    strict_1.default.equal(storage.get("mab-login-expires-at"), expiry);
+    now = Number(expiry);
+    strict_1.default.equal((await open())("#access-panel").hidden, false);
+    strict_1.default.equal(storage.has("mab-login-token"), false);
+    strict_1.default.equal(calls.filter(call => call.path === "/api/pair").length, 1);
+});

package/dist/tests-ts/control-server.test.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -11,6 +44,7 @@ const evolcore_1 = require("../src-ts/plugins/aun/evolcore");
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
 const plugin_manager_1 = require("../src-ts/plugin-manager");
 (0, node_test_1.default)("关联 EvolCore AID 时配置相应的 Agent 路由", async () => {
     const calls = [];
@@ -238,13 +272,49 @@ const plugin_manager_1 = require("../src-ts/plugin-manager");
             return response.statusCode;
         };
         strict_1.default.equal(await checkRemote(), 200);
-        server.pairedTokens.set(token, Date.now() - 1);
+        server.pairedTokens.set((0, node_crypto_1.createHash)("sha256").update(token).digest("hex"), Date.now() - 1);
         strict_1.default.equal(await checkRemote(), 401);
     }
     finally {
         await server.stop();
     }
 });
+(0, node_test_1.default)("配对登录重启后保留原24小时期限且过期后拒绝访问", async () => {
+    const directory = await (0, promises_1.mkdtemp)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "mab-login-"));
+    const sessionFile = (0, node_path_1.join)(directory, "paired-sessions.json");
+    const manager = { list: () => [], dispatchHttp: async () => false };
+    const options = { manager, host: "127.0.0.1", port: 0, token: "before", sessionFile };
+    let server = new control_server_1.ControlServer(options);
+    try {
+        const address = await server.start();
+        const base = `http://${address.host}:${address.port}`;
+        const { code } = await (await fetch(`${base}/api/pair-code`)).json();
+        const response = await fetch(`${base}/api/pair`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ code }) });
+        const { token, expiresAt } = await response.json();
+        const check = async () => {
+            const res = { setHeader() { }, end() { } };
+            await server.handle({ url: "/api/health", method: "GET", headers: { host: "localhost", authorization: `Bearer ${token}` }, socket: { remoteAddress: "192.168.31.10" } }, res);
+            return res.statusCode;
+        };
+        await server.stop();
+        server = new control_server_1.ControlServer({ ...options, token: "after" });
+        await server.start();
+        strict_1.default.equal(await check(), 200);
+        const stored = JSON.parse(await Promise.resolve().then(() => __importStar(require("node:fs/promises"))).then(fs => fs.readFile(sessionFile, "utf8")));
+        const hash = (0, node_crypto_1.createHash)("sha256").update(token).digest("hex");
+        strict_1.default.equal(stored[hash], expiresAt);
+        strict_1.default.ok(!JSON.stringify(stored).includes(token), "磁盘不保存原始登录令牌");
+        await server.stop();
+        await (0, promises_1.writeFile)(sessionFile, JSON.stringify({ [hash]: Date.now() - 1 }));
+        server = new control_server_1.ControlServer(options);
+        await server.start();
+        strict_1.default.equal(await check(), 401);
+    }
+    finally {
+        await server.stop();
+        await (0, promises_1.rm)(directory, { recursive: true, force: true });
+    }
+});
 (0, node_test_1.default)("配对码连续失败五次后必须从本机重新获取", async () => {
     const manager = { list: () => [], dispatchHttp: async () => false };
     const server = new control_server_1.ControlServer({ manager, host: "127.0.0.1", port: 0, token: "secret" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mu-agent-bridge",
-  "version": "1.0.19",
+  "version": "1.0.21",
   "description": "将 AUN Agent 连接到本地桌面 AI 客户端的插件平台。",
   "main": "dist/src-ts/cli.js",
   "bin": {

package/plugins/abweb/dist/src-ts/plugins/abweb/index.js

@@ -5,7 +5,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const MANIFEST = {
     id: "abweb",
-    version: "1.0.5",
+    version: "1.0.6",
     displayName: "Agent Bridge Web",
     entry: "dist/index.js",
     apiVersion: "1",

package/plugins/abweb/dist/src-ts/plugins/abweb/public/app.js

@@ -145,7 +145,6 @@
                 void loadCatalog().catch((cause) => { catalogNode.textContent = `远程插件目录暂时不可用：${cause instanceof Error ? cause.message : String(cause)}`; });
         }
         catch (cause) {
-            node("#access-panel").hidden = false;
             error(cause instanceof Error ? cause.message : String(cause));
         }
         finally {

package/plugins/abweb/dist/src-ts/plugins/abweb/public/app.ts

@@ -101,7 +101,7 @@
         sessionTable.append(row);
       }
       if (refreshCatalog) void loadCatalog().catch((cause) => { catalogNode.textContent = `远程插件目录暂时不可用：${cause instanceof Error ? cause.message : String(cause)}`; });
-    } catch (cause) { node<HTMLElement>("#access-panel").hidden = false; error(cause instanceof Error ? cause.message : String(cause)); }
+    } catch (cause) { error(cause instanceof Error ? cause.message : String(cause)); }
     finally { loading = false; }
   }
   function renderChannels(items: Plugin[]): void {

package/plugins/abweb/plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "abweb",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "type": "management",
   "displayName": "Agent Bridge Web",
   "entry": "dist/src-ts/plugins/abweb/index.js",