pixivflow 2.31.0 → 2.33.0

package/README.md

@@ -4,10 +4,7 @@
 
 **Pixiv 下载、筛选与自动收集工具。**
 
-可以直接下载单个 Pixiv 作品（插画、小说、动图），也可以按标签、热度、日期和收藏数
-批量筛选，并通过 scheduler 定时自动收集。结果既能永久保存在本地，也能按需通过 HTTP
-可靠交付给其他服务——下游是可选的，PixivFlow 自己就能跑完「发现 → 筛选 → 下载 → 保存」
-的完整链路。
+可以直接下载单个 Pixiv 作品（插画、小说、动图），也可以按标签、热度、日期和收藏数等条件批量筛选，并通过 scheduler 定时自动收集。结果既能永久保存在本地，也能按需通过 HTTP 可靠交付给其他服务——下游是可选的，PixivFlow 自己就能跑完「发现 → 筛选 → 下载 → 保存」的完整链路。
 
 [![Version](https://img.shields.io/npm/v/pixivflow?style=flat-square)](https://www.npmjs.com/package/pixivflow)
 [![Node](https://img.shields.io/badge/Node.js-22.13%2B_LTS-green.svg?style=flat-square&logo=node.js)](https://nodejs.org/)
@@ -191,33 +188,34 @@ Email、Telegram、Discord、ntfy 等渠道；PixivFlow 不实现这些通知协
 热重载。完整双 Bot 缓存投递模板见
 [`config/fly-two-bots.example.json`](config/fly-two-bots.example.json)。
 
-### 投递事务发件箱
+### 投递事务发件箱（Outbox）
 
-投递是**事务发件箱（SQLite outbox）**式的，at-least-once 执行、effectively-once
-可见效果：每个外部副作用（一次内容投递、一条通知）在 `outbox` 表落一行，带幂等键和
-行级租约，独立 worker 立即泵送、指数退避重试（默认 5 分钟起步、最长 6 小时），超过
-`maxAttempts` 进 dead 状态并在投递账记 `failed`。进程崩溃 / 机器挂起后重启，残留的
-`processing` 租约过期即被新进程接管，重试同一个幂等意图——下游按
-`idempotent_replay`（同键，ACK 丢失重试）或 `duplicate_existing`（历史重复）收敛，
-频道里仍然只有一条消息。旧版文件型 `delivery-outbox/*.json` 清单在启动时自动一次性
-迁移进 SQLite，迁移幂等。「今天没有可投稿内容」这类通知与内容投递走同一张表、独立泵送，
-审核端暂时挂掉不会互相阻塞。
+投递和通知都先写入 SQLite 发件箱（outbox），再由后台 worker 泵送：对外副作用
+（一次内容投递、一条通知）在 `outbox` 表各占一行，带幂等键和行级租约，保证
+至少一次执行、最终只产生一次可见效果。
 
-配置 `readinessUrl` 后，worker 每次认领都先检查依赖 `/ready`。非 2xx 只把 row 放回 pending，
-不增加 attempt；这与 `/live` 的“进程还活着”语义严格分开。dead letter 通过正式 CLI 恢复：
+- 失败会自动重试：指数退避（默认 5 分钟起步、最长 6 小时）。
+- 超过 `maxAttempts` 进入 `dead` 状态，可用 `pixivflow outbox` 查看和重试。
+- 进程崩溃/重启后，残留的 `processing` 租约过期后会被新进程接管，重复发送同一个
+  幂等意图；下游按幂等键收敛，不会在频道里出现重复消息。
+- 旧的文件型 `delivery-outbox/*.json` 会在启动时自动一次性迁移进 SQLite（迁移幂等）。
+- 「今天没有可投稿内容」这类通知与内容投递走同一张表、独立泵送，互不阻塞。
+
+配置 `readinessUrl` 后，worker 每次认领都会先检查依赖 `/ready`；非 2xx 只把 row
+放回 pending，不增加 attempt。dead letter 通过正式 CLI 管理：
 
 ```bash
 pixivflow outbox list --status dead
 pixivflow outbox inspect <id>
-pixivflow outbox retry <id>   # 只接受 dead row，保留 idempotency key
+pixivflow outbox retry <id>   # 只重试 dead row，保留幂等键
 pixivflow outbox retry --dead
 pixivflow outbox cancel <id>  # 只取消尚未执行的 row
 ```
 
-`run-once` 会重新执行下载计划，不等价于 outbox replay；不要手改 SQLite 的
-`next_attempt_at`。长期运行环境的体检与收敛用 `pixivflow doctor`（卡住的 slot/outbox
-租约、pending 投递、dead 行，`--repair` 收敛）与 `pixivflow reconcile`（把下游已确认的
-历史重复登记进投递账本，默认 dry-run）。
+`run-once` 会重新执行下载计划，不等价于 outbox replay，不要手动改 SQLite 的
+`next_attempt_at`。长期体检与收敛用 `pixivflow doctor`（卡住的 slot/outbox
+租约、pending 投递、dead 行，`--repair` 收敛）与 `pixivflow reconcile`
+（把下游已确认的历史重复登记进投递账本，默认 dry-run）。
 
 ## 常用命令
 

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow",
-  "version": "2.31.0",
+  "version": "2.33.0",
   "private": true
 }

package/dist/version.js

@@ -2,5 +2,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BUILD = void 0;
 // GENERATED by scripts/write-version.js — do not edit manually.
-exports.BUILD = { version: '2.31.0', commit: '4642dce0724a' };
+exports.BUILD = { version: '2.33.0', commit: 'ceb9c345fa1b' };
 //# sourceMappingURL=version.js.map

package/dist/webui/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow-webui-backend",
-  "version": "2.31.0",
+  "version": "2.33.0",
   "description": "PixivFlow WebUI Backend - CommonJS module"
 }

package/dist/webui/server/server-static.d.ts

@@ -1,6 +1,13 @@
 import { Express } from 'express';
 /**
- * Setup static file serving for SPA frontend
+ * Inject a one-time dismissal security notice into the served SPA index.html
+ * when WebUI basic auth is NOT configured (WEBUI_USERNAME / WEBUI_PASSWORD).
+ * First local start needs no credentials; the banner only reminds operators
+ * to set them before exposing the server beyond localhost.
  */
-export declare function setupStaticFiles(app: Express, staticPath?: string): void;
+export declare function injectAuthBanner(indexHtml: string, basicAuthEnabled: boolean): string;
+/**
+ * Setup static file serving for SPA frontend (injects auth-disabled notice when basic auth is off).
+ */
+export declare function setupStaticFiles(app: Express, staticPath?: string, basicAuthEnabled?: boolean): void;
 //# sourceMappingURL=server-static.d.ts.map

package/dist/webui/server/server-static.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.injectAuthBanner = injectAuthBanner;
 exports.setupStaticFiles = setupStaticFiles;
 const express_1 = __importDefault(require("express"));
 const path_1 = __importDefault(require("path"));
@@ -70,9 +71,27 @@ function getPackageVersion() {
     return 'unknown';
 }
 /**
- * Setup static file serving for SPA frontend
+ * Inject a one-time dismissal security notice into the served SPA index.html
+ * when WebUI basic auth is NOT configured (WEBUI_USERNAME / WEBUI_PASSWORD).
+ * First local start needs no credentials; the banner only reminds operators
+ * to set them before exposing the server beyond localhost.
  */
-function setupStaticFiles(app, staticPath) {
+function injectAuthBanner(indexHtml, basicAuthEnabled) {
+    if (basicAuthEnabled || indexHtml.includes('pixivflow-auth-banner')) {
+        return indexHtml;
+    }
+    const banner = [
+        '<div id="pixivflow-auth-banner" style="position:sticky;top:0;z-index:9999;display:flex;align-items:center;gap:12px;padding:8px 16px;background:#fff7e0;border-bottom:1px solid #f0d99a;color:#6b5300;font:14px/1.5 -apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;">',
+        '  <span>⚠️ <strong>安全提醒 / Security:</strong> WebUI 认证未启用（WEBUI_USERNAME / WEBUI_PASSWORD 未设置）。首次本地使用无需设置；若需对外暴露，请先设置用户名密码并重启服务。</span>',
+        '  <button type="button" title="知道了 / Got it" style="margin-left:auto;border:0;background:transparent;color:#6b5300;cursor:pointer;font-size:18px;line-height:1;" onclick="this.parentElement.remove()">✕</button>',
+        '</div>',
+    ].join('\n');
+    return indexHtml.replace('</body>', banner + '\n</body>');
+}
+/**
+ * Setup static file serving for SPA frontend (injects auth-disabled notice when basic auth is off).
+ */
+function setupStaticFiles(app, staticPath, basicAuthEnabled = false) {
     if (!staticPath) {
         // Root path handler when static files are not configured
         app.get('/', (req, res) => {
@@ -95,6 +114,7 @@ function setupStaticFiles(app, staticPath) {
     }
     const resolvedStaticPath = path_1.default.resolve(staticPath);
     const indexPath = path_1.default.join(resolvedStaticPath, 'index.html');
+    let servedIndexHtml = null;
     // Verify static path and index.html exist
     if (!fs_1.default.existsSync(resolvedStaticPath)) {
         logger_1.logger.warn('Static path does not exist', { path: resolvedStaticPath });
@@ -107,6 +127,7 @@ function setupStaticFiles(app, staticPath) {
     }
     else {
         logger_1.logger.info('Serving static files', { path: resolvedStaticPath });
+        servedIndexHtml = injectAuthBanner(fs_1.default.readFileSync(indexPath, 'utf8'), basicAuthEnabled);
     }
     // Serve static files (CSS, JS, images, etc.)
     app.use(express_1.default.static(resolvedStaticPath, {
@@ -116,15 +137,7 @@ function setupStaticFiles(app, staticPath) {
     // Explicitly handle root path first
     app.get('/', (req, res, next) => {
         if (fs_1.default.existsSync(indexPath)) {
-            res.sendFile(indexPath, (err) => {
-                if (err) {
-                    logger_1.logger.error('Failed to send index.html for root path', {
-                        error: err.message,
-                        path: indexPath,
-                    });
-                    next(err);
-                }
-            });
+            res.type('html').send(servedIndexHtml);
         }
         else {
             logger_1.logger.warn('index.html not found, cannot serve frontend', {
@@ -145,16 +158,7 @@ function setupStaticFiles(app, staticPath) {
         }
         // Send index.html for all other routes (SPA routing)
         if (fs_1.default.existsSync(indexPath)) {
-            res.sendFile(indexPath, (err) => {
-                if (err) {
-                    logger_1.logger.error('Failed to send index.html for SPA route', {
-                        error: err.message,
-                        path: indexPath,
-                        requestedPath: req.path,
-                    });
-                    next(err);
-                }
-            });
+            res.type('html').send(servedIndexHtml);
         }
         else {
             next();

package/dist/webui/server/server.js

@@ -94,10 +94,24 @@ class WebUIServer {
         else {
             logger_1.logger.warn('WebUI authentication is DISABLED (set WEBUI_USERNAME and WEBUI_PASSWORD to enable basic auth)');
         }
+        // Fail closed for accidental public exposure: a non-loopback bind without
+        // credentials would expose config secrets, downloaded files and arbitrary
+        // download/exec controls to anyone. Local bind (localhost/127.0.0.1/::1)
+        // remains credential-free. Operators who *really* want a public
+        // unauthenticated server must opt in explicitly.
+        const hostIsLoopback = (h) => h === 'localhost' ||
+            h === '127.0.0.1' ||
+            h === '::1' ||
+            h.startsWith('127.');
+        if (!this.basicAuthEnabled && !hostIsLoopback(this.host) && process.env.WEBUI_ALLOW_PUBLIC_NO_AUTH !== 'true') {
+            throw new Error(`Refusing to bind WebUI to non-loopback host "${this.host}" without authentication. ` +
+                `Set WEBUI_USERNAME and WEBUI_PASSWORD (recommended), or set ` +
+                `WEBUI_ALLOW_PUBLIC_NO_AUTH=true only if you fully understand the risk.`);
+        }
         // Setup API routes
         (0, server_routes_1.setupRoutes)(this.app);
         // Setup static file serving
-        (0, server_static_1.setupStaticFiles)(this.app, options.staticPath);
+        (0, server_static_1.setupStaticFiles)(this.app, options.staticPath, this.basicAuthEnabled);
         // Error handler (must be last)
         this.app.use(server_middleware_1.errorHandler);
         // Create HTTP or HTTPS server (TLS opt-in via WEBUI_TLS_CERT/KEY)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pixivflow",
-  "version": "2.31.0",
+  "version": "2.33.0",
   "description": "🎨 Pixiv 下载、筛选与自动收集工具 - 批量下载插画和小说、按标签/热度/日期筛选、定时任务与可靠 HTTP 交付 | Pixiv downloader and automation toolkit with filtering, scheduling and reliable HTTP delivery",
   "repository": {
     "type": "git",