neoctl-web 0.1.13 → 0.1.14

package/isolation-auth.mjs

@@ -0,0 +1,225 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { randomBytes, scrypt as scryptCallback, timingSafeEqual, createHash } from 'node:crypto';
+import { promisify } from 'node:util';
+
+const scrypt = promisify(scryptCallback);
+const HASH = /^scrypt\$([a-f0-9]{32})\$([a-f0-9]{128})$/;
+const WINDOWS_RESERVED = /^(con|prn|aux|nul|com[0-9]|lpt[0-9])(?:\..*)?$/i;
+export const isolationCookie = 'neo_isolation';
+export const publicUser = user => ({ username: user.username, role: user.role || 'user' });
+export const usernameKey = username => String(username).normalize('NFKC').toLowerCase();
+export const validUsername = username => typeof username === 'string'
+  && username.length >= 1 && username.length <= 100 && Buffer.byteLength(username, 'utf8') <= 240
+  && username === username.trim() && !username.endsWith('.')
+  && username !== '.' && username !== '..' && !WINDOWS_RESERVED.test(username)
+  && !/[\u0000-\u001f<>:"/\\|?*]/.test(username);
+export const jsonReply = (res, value, status = 200) => {
+  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' });
+  res.end(JSON.stringify(value));
+};
+export const httpError = (status, message) => Object.assign(new Error(message), { status });
+
+export async function readBoundedJson(req, maxBytes = 1024 * 1024) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    bytes += chunk.length;
+    if (bytes > maxBytes) throw httpError(413, '请求过大');
+    chunks.push(Buffer.from(chunk));
+  }
+  try { return JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}'); }
+  catch { throw httpError(400, 'JSON 无效'); }
+}
+
+export async function hashPassword(password) {
+  if (typeof password !== 'string' || !password.length || /[^A-Za-z0-9]/.test(password)) throw new Error('密码至少 1 位，仅允许字母和数字');
+  const salt = randomBytes(16).toString('hex');
+  return `scrypt$${salt}$${Buffer.from(await scrypt(password, salt, 64)).toString('hex')}`;
+}
+
+export async function loadIsolationConfig(dataRoot, configFile = process.env.NEO_ISOLATION_CONFIG) {
+  const filename = path.resolve(configFile || path.join(dataRoot, 'isolation.json'));
+  let config;
+  try { config = JSON.parse(await fs.readFile(filename, 'utf8')); }
+  catch (error) {
+    if (error.code === 'ENOENT' && !configFile) return { enabled: false };
+    throw new Error(`无法读取隔离配置: ${filename}`, { cause: error });
+  }
+  if (!config || typeof config.enabled !== 'boolean') throw new Error('isolation.enabled 必须为布尔值');
+  if (!config.enabled) return { enabled: false };
+  if (!Array.isArray(config.users) || !config.users.length || config.users.length > 1000) throw new Error('隔离模式须配置 1–1000 个用户');
+  const users = config.users.map(user => {
+    if (user?.id !== undefined && user.id !== user.username) throw new Error('旧用户 ID 与用户名不同，请先迁移数据目录');
+    const { id: _oldId, ...account } = user || {};
+    return account;
+  });
+  const names = new Set();
+  for (const user of users) {
+    const key = usernameKey(user?.username);
+    if (!user || !validUsername(user.username) || (user.passwordHash !== undefined && !HASH.test(user.passwordHash))
+      || (user.role !== undefined && !['user', 'admin'].includes(user.role)) || names.has(key)) {
+      throw new Error('用户名、角色或密码哈希无效或重复');
+    }
+    names.add(key);
+  }
+  const cookiePath = config.cookiePath || '/';
+  if (!/^\/(?:[a-zA-Z0-9_/-]*)$/.test(cookiePath)) throw new Error('cookiePath 无效');
+  if (config.secureCookie !== undefined && typeof config.secureCookie !== 'boolean') throw new Error('secureCookie 必须为布尔值');
+  const sessionHours = config.sessionHours ?? 12;
+  if (!Number.isFinite(sessionHours) || sessionHours < 0.01 || sessionHours > 168) throw new Error('sessionHours 无效');
+  if (config.retiredUserIds !== undefined && config.retiredUsernames === undefined && config.retiredUserIds.length) {
+    throw new Error('旧 retiredUserIds 非空，请先迁移为 retiredUsernames');
+  }
+  const retiredUsernames = config.retiredUsernames ?? config.retiredUserIds ?? [];
+  const retiredKeys = new Set();
+  if (!Array.isArray(retiredUsernames) || retiredUsernames.some(username => {
+    const key = usernameKey(username);
+    if (!validUsername(username) || names.has(key) || retiredKeys.has(key)) return true;
+    retiredKeys.add(key); return false;
+  })) throw new Error('retiredUsernames 无效');
+  const { retiredUserIds: _oldRetiredUserIds, ...current } = config;
+  return { ...current, enabled: true, filename, users, retiredUsernames, cookiePath, secureCookie: config.secureCookie === true, sessionHours };
+}
+
+export function createIsolationAccounts(config, { dataRoot, onDelete = () => {} }) {
+  let mutation = Promise.resolve();
+  const serial = operation => {
+    const pending = mutation.then(operation);
+    mutation = pending.catch(() => {});
+    return pending;
+  };
+  async function persist(users, retiredUsernames) {
+    const { filename, retiredUserIds: _oldRetiredUserIds, ...stored } = config;
+    const temporary = `${filename}.tmp-${randomBytes(8).toString('hex')}`;
+    try {
+      await fs.writeFile(temporary, JSON.stringify({ ...stored, users, retiredUsernames }, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+      await fs.rename(temporary, filename);
+    } finally { await fs.rm(temporary, { force: true }); }
+    config.users = users;
+    config.retiredUsernames = retiredUsernames;
+  }
+  return {
+    list: () => config.users.map(publicUser),
+    create: body => serial(async () => {
+      const { username, role } = body || {};
+      if (body && (Object.hasOwn(body, 'password') || Object.hasOwn(body, 'passwordHash'))) throw httpError(400, '创建用户只需用户名，不可设置密码');
+      if (!validUsername(username) || (role !== undefined && role !== 'user')) throw httpError(400, '账号信息无效，只能创建普通用户');
+      if (config.users.length >= 1000) throw httpError(400, '用户数量已达上限');
+      const key = usernameKey(username);
+      if (config.users.some(user => usernameKey(user.username) === key) || config.retiredUsernames.some(value => usernameKey(value) === key)) throw httpError(409, '用户名已使用');
+      try { await fs.lstat(path.join(dataRoot, 'isolated-users', username)); throw httpError(409, '该用户名已有历史数据'); }
+      catch (error) { if (error.code !== 'ENOENT') throw error; }
+      const user = { username, role: 'user' };
+      await persist([...config.users, user], config.retiredUsernames);
+      return publicUser(user);
+    }),
+    claim: (user, password) => serial(async () => {
+      const current = config.users.find(value => value.username === user.username);
+      if (!current) return;
+      if (current.passwordHash !== undefined) return current;
+      let passwordHash;
+      try { passwordHash = await hashPassword(password); } catch (error) { throw httpError(400, error.message); }
+      const claimed = { ...current, passwordHash };
+      await persist(config.users.map(value => value === current ? claimed : value), config.retiredUsernames);
+      return claimed;
+    }),
+    remove: username => serial(async () => {
+      if (!validUsername(username)) throw httpError(400, '用户名无效');
+      const key = usernameKey(username);
+      const user = config.users.find(value => usernameKey(value.username) === key);
+      if (!user) throw httpError(404, '用户不存在');
+      if (user.role === 'admin') throw httpError(403, '不能删除超管');
+      await persist(config.users.filter(value => value !== user), [...config.retiredUsernames, user.username]);
+      onDelete(user.username);
+    }),
+  };
+}
+
+export function createIsolationAuth(config, accounts) {
+  const sessions = new Map(), attempts = new Map();
+  let activeLogins = 0;
+  const digest = value => createHash('sha256').update(value).digest('hex');
+  const cookie = (token, maxAge) => `${isolationCookie}=${token}; Path=${config.cookiePath}; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${config.secureCookie ? '; Secure' : ''}`;
+  const tokenFrom = req => {
+    const tokens = String(req.headers.cookie || '').split(';').map(x => x.trim()).filter(x => x.startsWith(isolationCookie + '='));
+    return tokens.length === 1 ? tokens[0].slice(isolationCookie.length + 1) : '';
+  };
+  function revoke(key) {
+    const session = sessions.get(key);
+    if (session) for (const res of session.streams) res.end();
+    sessions.delete(key);
+  }
+  function authenticate(req) {
+    const token = tokenFrom(req);
+    if (!/^[a-f0-9]{64}$/.test(token)) return;
+    const key = digest(token), session = sessions.get(key);
+    if (session && session.expires > Date.now() && config.users.includes(session.user)) return { ...session, key };
+    revoke(key);
+  }
+  function sameOrigin(req) {
+    if (req.headers['sec-fetch-site'] === 'cross-site') return false;
+    if (!req.headers.origin) return true;
+    try { return new URL(req.headers.origin).host === req.headers.host; } catch { return false; }
+  }
+  const timer = setInterval(() => {
+    for (const [key, session] of sessions) if (session.expires <= Date.now()) revoke(key);
+    for (const [key, attempt] of attempts) if (attempt.until <= Date.now()) attempts.delete(key);
+  }, 1000);
+  timer.unref();
+
+  return {
+    authenticate, sameOrigin,
+    revokeUser(username) { for (const [key, session] of sessions) if (session.user.username === username) revoke(key); },
+    close() { clearInterval(timer); for (const key of sessions.keys()) revoke(key); },
+    track(session, res) {
+      if (!sessions.has(session.key) || session.expires <= Date.now()) { res.end(); return false; }
+      session.streams.add(res); res.once('close', () => session.streams.delete(res)); return true;
+    },
+    async route(req, res, url) {
+      const current = authenticate(req);
+      if (!sameOrigin(req)) { jsonReply(res, { error: '跨站请求被拒绝' }, 403); return true; }
+      if (url.pathname === '/api/auth/status' && req.method === 'GET') {
+        jsonReply(res, { isolation: true, user: current ? publicUser(current.user) : null });
+        return true;
+      }
+      if (url.pathname === '/api/auth/logout' && req.method === 'POST') {
+        if (current) revoke(current.key);
+        res.setHeader('Set-Cookie', cookie('', 0));
+        jsonReply(res, { ok: true });
+        return true;
+      }
+      if (url.pathname === '/api/auth/login' && req.method === 'POST') {
+        const body = await readBoundedJson(req);
+        const username = typeof body?.username === 'string' ? body.username : '';
+        const password = typeof body?.password === 'string' ? body.password : '';
+        const rateKey = `${req.socket.remoteAddress}`;
+        let attempt = attempts.get(rateKey);
+        if (!attempt || attempt.until <= Date.now()) attempt = { count: 0, until: Date.now() + 60_000 };
+        if (attempt.count >= 10 || activeLogins >= 4 || attempts.size >= 10000 || sessions.size >= 10000) {
+          res.setHeader('Retry-After', '60'); jsonReply(res, { error: '尝试过多，请稍后重试' }, 429); return true;
+        }
+        attempt.count++; attempts.set(rateKey, attempt);
+        let user = config.users.find(value => value.username === username);
+        activeLogins++;
+        let valid = false;
+        try {
+          if (user && user.passwordHash === undefined) user = await accounts.claim(user, password);
+          const parts = HASH.exec(user?.passwordHash || '') || ['', '0'.repeat(32), '0'.repeat(128)];
+          const derived = await scrypt(password, parts[1], 64);
+          valid = !!user && config.users.includes(user) && timingSafeEqual(derived, Buffer.from(parts[2], 'hex'));
+        } finally { activeLogins--; }
+        if (!valid) { jsonReply(res, { error: '用户名或密码错误' }, 401); return true; }
+        attempts.delete(rateKey);
+        if (current) revoke(current.key);
+        const token = randomBytes(32).toString('hex');
+        const maxAge = Math.round(config.sessionHours * 3600);
+        sessions.set(digest(token), { user, expires: Date.now() + maxAge * 1000, streams: new Set() });
+        res.setHeader('Set-Cookie', cookie(token, maxAge));
+        jsonReply(res, { ok: true, user: publicUser(user) });
+        return true;
+      }
+      return false;
+    },
+  };
+}

package/isolation.example.json

@@ -0,0 +1,8 @@
+{
+  "enabled": false,
+  "secureCookie": false,
+  "cookiePath": "/",
+  "sessionHours": 12,
+  "retiredUsernames": [],
+  "users": []
+}

package/isolation.mjs

@@ -0,0 +1,385 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import { randomUUID } from 'node:crypto';
+import { createIsolationAuth, createIsolationAccounts, publicUser, loadIsolationConfig, jsonReply, readBoundedJson, httpError } from './isolation-auth.mjs';
+
+const SESSION_ID = /^(?!\.{1,2}$)[a-zA-Z0-9_.-]{1,220}$/;
+const GET_ROUTES = new Set(['/api/client-info', '/api/state', '/api/runtime-context', '/api/sessions', '/api/cwd', '/api/tools', '/api/session-tools', '/api/session-plugins', '/api/tool-call-detail', '/api/terminal-output', '/api/agent-content', '/events']);
+const POST_ROUTES = new Set(['/api/submit', '/api/submit-now', '/api/interrupt', '/api/queue/cancel', '/api/queue/send-now', '/api/sessions/resume', '/api/sessions/new', '/api/sessions/delete', '/api/cwd/change', '/api/cwd/create', '/api/cwd/delete', '/api/session-model', '/api/session-tools', '/api/session-plugins', '/api/compact', '/api/fast-mode', '/api/context-window']);
+const SAFE_COMMANDS = new Set(['/help', '/cost', '/compact', '/pure', '/new', '/sessions', '/state', '/reset']);
+const inside = (root, target) => { const relative = path.relative(root, target); return relative === '' || (!relative.startsWith('..' + path.sep) && relative !== '..' && !path.isAbsolute(relative)); };
+
+export async function assertOwnedSession(root, sessionId) {
+  if (typeof sessionId !== 'string' || !SESSION_ID.test(sessionId) || sessionId === 'latest') throw httpError(404, '会话不存在');
+  try {
+    const folder = path.join(root, sessionId);
+    const info = await fs.lstat(folder);
+    if (!info.isDirectory() || info.isSymbolicLink()) throw new Error();
+    const transcript = await fs.lstat(path.join(folder, 'transcript.jsonl')).catch(error => {
+      if (error.code === 'ENOENT') return undefined;
+      throw error;
+    });
+    if (transcript && (!transcript.isFile() || transcript.isSymbolicLink())) throw new Error();
+  } catch { throw httpError(404, '会话不存在'); }
+}
+
+export function sanitizeIsolatedSnapshot(value) {
+  const result = { ...value };
+  if (result.interactive) result.interactive = { sessions: true };
+  if (result.catalog) result.catalog = { ...result.catalog, envPath: undefined, commands: result.catalog.commands?.filter(x => SAFE_COMMANDS.has(x.name)) };
+  result.appPrompt = undefined;
+  return result;
+}
+
+/** Web-only identity boundary. The core receives neither credentials nor user identities. */
+export async function createIsolationMode({ dataRoot, workspaceRoot, pluginDir, configFile, memoryState = () => ({ current: null, history: [] }), cpaQuotaMonitor, pluginSettings, toolSettings }) {
+  const config = await loadIsolationConfig(dataRoot, configFile);
+  if (!config.enabled) return {
+    enabled: false,
+    async route(req, res, url) {
+      if (url.pathname === '/api/auth/status' && req.method === 'GET') {
+        jsonReply(res, { isolation: false, user: null }); return true;
+      }
+      return false;
+    },
+    close() {},
+  };
+  const core = await import('./core-runtime.mjs');
+  if (!core.handleWebRequest) throw new Error('隔离模式需要支持 handleWebRequest 的 core，请先构建或更新 core');
+  if (process.env.AGENT_SESSION_TRANSCRIPT === '0') throw new Error('隔离模式要求启用会话存储');
+  const { installRuntimeRouterIdleCleanup } = await import('./runtime-router-cleanup.mjs');
+  installRuntimeRouterIdleCleanup();
+  const { createWorkspaceRuntimeManager } = await import('./runtime-workspaces.mjs');
+  const { createWebPluginHost } = await import('./plugins.mjs');
+  const { createWebPluginSettings } = await import('./plugin-settings.mjs');
+  const { createWebToolSettings } = await import('./tool-settings.mjs');
+  const { createChunkUploadHandler } = await import('./chunk-uploads.mjs');
+  const { workspaceFs, openWorkspaceRead, containerMode } = await import('./execution-backend.mjs');
+  const globalPlugins = pluginSettings || await createWebPluginSettings(path.join(dataRoot, 'plugins.json'));
+  const globalTools = toolSettings || await createWebToolSettings(path.join(dataRoot, 'tools.json'));
+  const startupPlugins = process.env.NEO_WEB_PLUGINS?.trim() || globalPlugins.globalEnabledIds();
+  const users = new Map();
+  let modelConfigQueue = Promise.resolve();
+  const withModelConfigLock = operation => {
+    const result = modelConfigQueue.then(operation);
+    modelConfigQueue = result.catch(() => {});
+    return result;
+  };
+  const accounts = createIsolationAccounts(config, { dataRoot, onDelete: username => auth.revokeUser(username) });
+  const auth = createIsolationAuth(config, accounts);
+  const allOwners = () => [...config.users, ...config.retiredUsernames.map(username => ({ username, role: 'user', deleted: true }))];
+  async function adminRoute(req, res, url) {
+    if (url.pathname === '/api/admin/users' && req.method === 'GET') {
+      jsonReply(res, { users: accounts.list() }); return;
+    }
+    if (url.pathname === '/api/admin/users' && req.method === 'POST') {
+      jsonReply(res, { user: await accounts.create(await readBoundedJson(req, 8192)) }, 201); return;
+    }
+    if (url.pathname === '/api/admin/users/delete' && req.method === 'POST') {
+      const body = await readBoundedJson(req, 4096);
+      await accounts.remove(body?.username); jsonReply(res, { ok: true }); return;
+    }
+    if (url.pathname === '/api/admin/sessions' && req.method === 'GET') {
+      const groups = [];
+      for (const owner of allOwners()) {
+        const engine = new core.QueryEngine({ agentId: 'main', cwd: path.join(workspaceRoot, 'users', owner.username), session: { rootDir: path.join(dataRoot, 'isolated-users', owner.username, 'sessions') } });
+        groups.push({ user: { ...publicUser(owner), deleted: owner.deleted === true }, sessions: await engine.listSessions(Number.POSITIVE_INFINITY) });
+      }
+      jsonReply(res, { groups }); return;
+    }
+    throw httpError(404, '接口不存在');
+  }
+
+  async function createUser(user) {
+    const root = path.join(dataRoot, 'isolated-users', user.username);
+    const sessionsRoot = path.join(root, 'sessions');
+    const uploadsRoot = path.join(root, 'uploads');
+    const workRoot = path.join(workspaceRoot, 'users', user.username);
+    await fs.mkdir(sessionsRoot, { recursive: true, mode: 0o700 });
+    const pluginEnv = { ...process.env };
+    for (const key of ['NEO_DOWNLOADS_DIR', 'NEO_VIDEO_SHARE_DIR', 'NEO_XHS_ARTIFACTS_DIR']) delete pluginEnv[key];
+    const settings = await createWebPluginSettings(path.join(root, 'plugins.json'));
+    const tools = await createWebToolSettings(path.join(root, 'tools.json'));
+    const pluginHost = createWebPluginHost({
+      plugins: await core.loadNeoPlugins({ directories: pluginDir, appDataDir: root, env: pluginEnv }),
+      enabled: startupPlugins, locked: Boolean(process.env.NEO_WEB_PLUGINS?.trim()),
+      settings: { ...settings, globalEnabledIds: () => globalPlugins.globalEnabledIds(), setGlobalEnabled: ids => globalPlugins.setGlobalEnabled(ids) },
+    });
+    const manager = createWorkspaceRuntimeManager({
+      projectRoot: workRoot, workspaceRoot: workRoot, registryFile: path.join(root, 'workspaces.json'),
+      createRuntime: options => core.createWebRuntime({
+        ...options, sessionId: options.sessionId || randomUUID(), sessionRootDir: sessionsRoot, resume: !!options.sessionId,
+        ...pluginHost.runtimePlugins(options.sessionId),
+        globalToolOverrides: globalTools.globalOverrides(),
+        resolveGlobalToolOverrides: () => globalTools.globalOverrides(),
+        persistGlobalToolOverrides: overrides => globalTools.setGlobalOverrides(overrides),
+        sessionToolOverrides: tools.sessionOverrides(options.sessionId),
+        persistSessionToolOverrides: (id, overrides) => tools.setSessionOverrides(id, overrides),
+        resolveSessionToolOverrides: id => tools.sessionOverrides(id),
+      }),
+    });
+    const router = new core.WebRuntimeRouter({
+      createRuntime: options => manager.createRuntime({ ...options, resume: !!options?.sessionId }),
+      createRepl(runtime) {
+        const repl = manager.createRepl(runtime);
+        const snapshot = repl.snapshot.bind(repl);
+        repl.snapshot = includeCatalog => sanitizeIsolatedSnapshot(snapshot(includeCatalog));
+        // These are public extension methods; no changes to the model/query loop.
+        const resume = repl.resumeSession.bind(repl), remove = repl.deleteSession.bind(repl);
+        repl.resumeSession = async id => { await assertOwnedSession(sessionsRoot, id); return resume(id); };
+        repl.deleteSession = async id => { await assertOwnedSession(sessionsRoot, id); return remove(id); };
+        const browse = repl.browseWorkspace.bind(repl);
+        repl.browseWorkspace = async value => {
+          const result = await browse(value);
+          if (!result.ok) return result;
+          return { ...result, home: workRoot, parent: result.cwd === workRoot ? undefined : result.parent,
+            locations: [{ name: '工作区', path: workRoot }], entries: result.entries.filter(entry => inside(workRoot, entry.path)) };
+        };
+        return repl;
+      },
+    });
+    const getRuntime = router.get.bind(router);
+    router.get = scope => withModelConfigLock(() => getRuntime(scope));
+    async function checkedWorkspace(target, allowMissing = false) {
+      const absolute = path.resolve(target);
+      if (!inside(workRoot, absolute)) throw httpError(403, '工作区访问被拒绝');
+      let cursor = absolute;
+      while (true) {
+        try {
+          const resolved = await workspaceFs.realpath(cursor);
+          if (!inside(workRoot, resolved)) throw httpError(403, '工作区访问被拒绝');
+          return absolute;
+        } catch (error) {
+          if (!allowMissing || error.code !== 'ENOENT' || cursor === workRoot) throw error;
+          cursor = path.dirname(cursor);
+        }
+      }
+    }
+    const scopeFor = url => ({ sessionId: url.searchParams.get('sessionId') || undefined, tabId: url.searchParams.get('tabId') || 'default' });
+    async function finalize(file, url) {
+      if (!containerMode) return file;
+      const repl = await router.get(scopeFor(url));
+      const cwd = await repl.materializeCurrentWorkspace();
+      await checkedWorkspace(cwd);
+      const destination = path.join(cwd, file.storedName);
+      // Existing upload delivery supports a resolved workspace without an HTTP side channel.
+      const { deliverUploadToWorkspace } = await import('./execution-backend.mjs');
+      return deliverUploadToWorkspace(file, destination);
+    }
+    const chunks = createChunkUploadHandler({ uploadsDir: uploadsRoot, baseDir: root, finalize });
+    return { root, sessionsRoot, uploadsRoot, workRoot, router, pluginHost, checkedWorkspace, scopeFor, finalize, chunks };
+  }
+  function userContext(user) {
+    if (!users.has(user.username)) {
+      const pending = createUser(user);
+      users.set(user.username, pending);
+      pending.catch(() => users.delete(user.username));
+    }
+    return users.get(user.username);
+  }
+  async function serveFile(req, res, filename, workspace = false, image = false) {
+    let handle;
+    try {
+      handle = workspace ? await openWorkspaceRead(filename) : await fs.open(filename, 'r');
+      const stat = await handle.stat();
+      if (!stat.isFile()) throw httpError(404, '文件不存在');
+      const types = { '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif', '.webp': 'image/webp' };
+      const type = image ? types[path.extname(filename).toLowerCase()] : 'application/octet-stream';
+      if (!type) throw httpError(404, '图片不存在');
+      res.writeHead(200, { 'Content-Type': type, 'Content-Length': stat.size, 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', ...(image ? {} : { 'Content-Disposition': 'attachment' }) });
+      if (req.method === 'HEAD') { res.end(); return; }
+      for await (const chunk of handle.createReadStream({ autoClose: false })) {
+        if (res.destroyed) break;
+        if (!res.write(chunk)) await new Promise(resolve => { res.once('drain', resolve); res.once('close', resolve); });
+      }
+      res.end();
+    } finally { await handle?.close(); }
+  }
+  return {
+    enabled: true,
+    close: () => auth.close(),
+    async route(req, res, url) {
+      // Static application assets contain no user data. Every dynamic route is handled here.
+      if (!/^\/(api(?:\/|$)|events(?:\/|$)|vendor(?:\/|$))/.test(url.pathname)) return false;
+      try {
+        // Core images and plugin downloads normally use long-lived caches. Do not
+        // let a browser reuse protected content after logout/account switching.
+        const writeHead = res.writeHead;
+        res.writeHead = function (status, message, headers) {
+          const supplied = typeof message === 'string' ? headers : message;
+          const clean = { ...supplied };
+          for (const name of Object.keys(clean)) if (['cache-control', 'vary', 'x-content-type-options'].includes(name.toLowerCase())) delete clean[name];
+          clean['Cache-Control'] = 'private, no-store';
+          clean.Vary = 'Cookie';
+          clean['X-Content-Type-Options'] = 'nosniff';
+          return typeof message === 'string' ? writeHead.call(this, status, message, clean) : writeHead.call(this, status, clean);
+        };
+        res.setHeader('Cache-Control', 'private, no-store');
+        if (await auth.route(req, res, url)) return true;
+        const session = auth.authenticate(req);
+        if (!session) { jsonReply(res, { errorCode: 'AUTH_REQUIRED', error: '请先登录' }, 401); return true; }
+        const isAdmin = session.user.role === 'admin';
+        if (url.pathname.startsWith('/api/admin/')) {
+          if (!isAdmin) throw httpError(403, '仅超管可管理用户');
+          await adminRoute(req, res, url); return true;
+        }
+        if (url.pathname === '/api/memory' && req.method === 'GET') {
+          jsonReply(res, memoryState()); return true;
+        }
+        if (url.pathname === '/api/cpa-quota' && req.method === 'GET') {
+          const state = cpaQuotaMonitor?.getPublicState() || { config: { url: '', hasPassword: false }, quotas: [] };
+          jsonReply(res, isAdmin ? state : { quotas: state.quotas }); return true;
+        }
+        if (['/api/cpa-config', '/api/plugins/global', '/api/prompt-config', '/api/tools/global'].includes(url.pathname) || (isAdmin && ['/api/plugins', '/api/tools'].includes(url.pathname))) {
+          if (!isAdmin) throw httpError(403, '仅超管可修改全局配置');
+          if (!['GET', 'POST'].includes(req.method)) throw httpError(405, '请求方法无效');
+          if (url.pathname === '/api/cpa-config') {
+            if (req.method !== 'POST') throw httpError(405, '请求方法无效');
+            if (!cpaQuotaMonitor) throw httpError(503, 'CPA 监控未启动');
+            const body = await readBoundedJson(req, 65536);
+            const current = cpaQuotaMonitor.getPublicState();
+            const password = body?.preservePassword && current.config.hasPassword ? undefined : String(body?.password || '');
+            const state = await withModelConfigLock(() => cpaQuotaMonitor.updateConfig({ url: body?.url, password, preservePassword: body?.preservePassword }));
+            jsonReply(res, { ok: true, ...state }); return true;
+          }
+          const admin = await userContext(session.user);
+          if (url.pathname === '/api/prompt-config') {
+            // Global prompt protocol is independent of the selected owner/session.
+            const target = new URL(url);
+            for (const key of ['ownerUsername', 'sessionId', 'tabId']) target.searchParams.delete(key);
+            req.url = target.pathname + target.search;
+            await withModelConfigLock(() => core.handleWebRequest(req, res, admin.router)); return true;
+          }
+          if (url.pathname.startsWith('/api/plugins')) {
+            if (!await withModelConfigLock(() => admin.pluginHost.route(req, res, url, { readJsonBody: readBoundedJson, sendJson: jsonReply }))) throw httpError(405, '请求方法无效');
+            return true;
+          }
+          const repl = await admin.router.get({ tabId: 'global-model-config' });
+          if (url.pathname === '/api/tools' && req.method === 'GET') {
+            jsonReply(res, repl.globalTools()); return true;
+          }
+          if (url.pathname !== '/api/tools/global' || req.method !== 'POST') throw httpError(405, '请求方法无效');
+          const body = await readBoundedJson(req, 65536);
+          const result = await withModelConfigLock(async () => {
+            const saved = await repl.setGlobalTools(body?.overrides);
+            if (!saved.ok) return saved;
+            const contexts = await Promise.all([...users.values()]);
+            await Promise.all(contexts.map(user => user.router.reloadGlobalTools(globalTools.globalOverrides())));
+            return saved;
+          });
+          jsonReply(res, result); return true;
+        }
+        if (url.pathname === '/api/login') {
+          if (!isAdmin) throw httpError(403, '仅超管可配置模型');
+          if (!['GET', 'POST'].includes(req.method)) throw httpError(405, '请求方法无效');
+          const admin = await userContext(session.user);
+          const repl = await admin.router.get({ tabId: 'global-model-config' });
+          if (req.method === 'GET') {
+            const form = await withModelConfigLock(() => repl.loginForm(url.searchParams.get('provider') || undefined));
+            jsonReply(res, { ...form, envPath: undefined }); return true;
+          }
+          const body = await readBoundedJson(req, 64 * 1024);
+          if (!body || typeof body.provider !== 'string' || !body.values || typeof body.values !== 'object' || Array.isArray(body.values) || Object.values(body.values).some(value => typeof value !== 'string')) throw httpError(400, '模型配置无效');
+          const result = await withModelConfigLock(async () => {
+            const saved = await repl.saveLogin(body.provider, body.values);
+            if (!saved.ok) return saved;
+            const contexts = await Promise.all([...users.values()]);
+            await Promise.all(contexts.map(user => user.router.reloadModelConfig()));
+            return saved;
+          });
+          jsonReply(res, result); return true;
+        }
+        const ownerUsernames = url.searchParams.getAll('ownerUsername');
+        if (ownerUsernames.length > 1 || (ownerUsernames.length && !ownerUsernames[0])) throw httpError(400, '用户参数无效');
+        let owner = session.user;
+        if (ownerUsernames.length) {
+          if (!isAdmin) throw httpError(403, '不能访问其他用户');
+          owner = allOwners().find(user => user.username === ownerUsernames[0]);
+          if (!owner) throw httpError(404, '用户不存在');
+        }
+        url.searchParams.delete('ownerUsername');
+        const user = await userContext(owner);
+        for (const name of ['sessionId', 'tabId']) {
+          const values = url.searchParams.getAll(name);
+          if (values.length > 1 || (values.length && (!values[0] || !SESSION_ID.test(values[0])))) throw httpError(400, '会话参数无效');
+        }
+        if (url.searchParams.has('sessionId')) await assertOwnedSession(user.sessionsRoot, url.searchParams.get('sessionId'));
+        if (!url.searchParams.has('sessionId') && !url.searchParams.has('tabId')) url.searchParams.set('tabId', 'default');
+        const scope = user.scopeFor(url);
+        if (/^\/api\/(?:prompt-library|prompt-config|session-prompt|app-prompt|login|client-reload|cpa-config|tools\/global)(?:\/|$)/.test(url.pathname)) throw httpError(403, '隔离模式不允许访问此接口');
+        if (url.pathname.startsWith('/api/plugins') && url.pathname !== '/api/plugins') throw httpError(403, '全局配置不可修改');
+        if (await user.pluginHost.route(req, res, url, { readJsonBody: readBoundedJson, sendJson: jsonReply })) return true;
+        if (await user.chunks(req, res, url)) return true;
+        if (url.pathname.startsWith('/api/uploads/') && ['GET', 'HEAD'].includes(req.method)) {
+          const name = decodeURIComponent(url.pathname.slice('/api/uploads/'.length));
+          if (!name || path.basename(name) !== name || name.startsWith('.')) throw httpError(404, '文件不存在');
+          await serveFile(req, res, path.join(user.uploadsRoot, name)); return true;
+        }
+        if (url.pathname.startsWith('/api/local-images/') && req.method === 'GET') {
+          const encoded = decodeURIComponent(url.pathname.slice('/api/local-images/'.length));
+          const filename = Buffer.from(encoded, 'base64url').toString('utf8');
+          await user.checkedWorkspace(filename);
+          await serveFile(req, res, filename, true, true); return true;
+        }
+        if (url.pathname === '/api/uploads' && req.method === 'POST') {
+          const body = await readBoundedJson(req, 32 * 1024 * 1024);
+          const name = path.basename(String(body.name || '').replace(/\\/g, '/')).replace(/[<>:"/\\|?*\u0000-\u001f]/g, '-').slice(0, 180);
+          if (!name || name === '.' || name === '..' || typeof body.data !== 'string') throw httpError(400, '文件无效');
+          const storedName = `${randomUUID()}-${name}`;
+          await fs.mkdir(user.uploadsRoot, { recursive: true });
+          const buffer = Buffer.from(body.data, 'base64');
+          const absolutePath = path.join(user.uploadsRoot, storedName);
+          await fs.writeFile(absolutePath, buffer, { flag: 'wx', mode: 0o600 });
+          const file = await user.finalize({ id: randomUUID(), name, storedName, size: buffer.length, mimeType: String(body.mimeType || 'application/octet-stream'), absolutePath, relativePath: absolutePath, url: `/api/uploads/${encodeURIComponent(storedName)}` }, url);
+          jsonReply(res, { ok: true, file }); return true;
+        }
+        const imageRoute = /^\/api\/images\/(?:by-id\/[^/]+|[^/]+\/\d+)$/.test(url.pathname);
+        const vendorRoute = /^\/vendor\/(marked.esm.js|highlight.min.js|highlight-theme.css)$/.test(url.pathname);
+        if (!(req.method === 'GET' && (GET_ROUTES.has(url.pathname) || imageRoute || vendorRoute)) && !(req.method === 'POST' && POST_ROUTES.has(url.pathname))) throw httpError(403, '隔离模式不允许访问此接口');
+        let body;
+        if (req.method === 'POST') {
+          body = await readBoundedJson(req, 32 * 1024 * 1024);
+          if (!body || typeof body !== 'object' || Array.isArray(body)) throw httpError(400, '请求无效');
+          if (['/api/sessions/resume', '/api/sessions/delete'].includes(url.pathname)) await assertOwnedSession(user.sessionsRoot, body.sessionId);
+          if (url.pathname === '/api/submit' || url.pathname === '/api/submit-now') {
+            const text = String(body.text || '').trim();
+            if (text.startsWith('/') && !SAFE_COMMANDS.has(text.split(/\s/)[0].toLowerCase())) throw httpError(403, '隔离模式不支持此命令');
+            for (const attachment of body.attachments || []) if (attachment?.kind === 'file') {
+              const filename = path.resolve(String(attachment.absolutePath || ''));
+              if (inside(user.uploadsRoot, filename)) {
+                const real = await fs.realpath(filename);
+                if (!inside(user.uploadsRoot, real)) throw httpError(403, '附件访问被拒绝');
+              } else await user.checkedWorkspace(filename);
+            }
+          }
+        }
+        if (url.pathname === '/api/cwd' || url.pathname.startsWith('/api/cwd/')) {
+          const repl = await user.router.get(scope);
+          await workspaceFs.mkdir(user.workRoot, { recursive: true });
+          const current = repl.snapshot().cwd;
+          const target = path.resolve(current, String(body?.path || url.searchParams.get('path') || current));
+          await user.checkedWorkspace(target, true);
+          if (body) body.path = target; else url.searchParams.set('path', target);
+        }
+        let request = req;
+        if (body !== undefined) {
+          request = Readable.from([Buffer.from(JSON.stringify(body))]);
+          Object.assign(request, { method: req.method, headers: req.headers, socket: req.socket });
+        }
+        request.url = url.pathname + url.search;
+        if (url.pathname === '/events') {
+          await user.router.get(scope);
+          if (!auth.track(session, res)) return true;
+        }
+        await core.handleWebRequest(request, res, user.router);
+        return true;
+      } catch (error) {
+        if (res.headersSent) { res.end(); return true; }
+        const status = error.status || (error.code === 'ENOENT' ? 404 : 500);
+        jsonReply(res, { error: status === 500 ? '请求处理失败' : error.message }, status);
+        return true;
+      }
+    },
+  };
+}