fix: auth bypass, SPA serving, and provider improvements (#97)
* feat(chat): polish syntax highlighting and tool payload rendering (#94) * [verified] feat(chat): polish syntax highlighting and tool payload rendering * [verified] fix(chat): tighten large tool payload rendering * docs: update data volume path in Docker docs Align documentation with docker-compose.yml change: hermes-web-ui-data -> hermes-web-ui, /app/dist/data -> /root/.hermes-web-ui Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: bundle server build and restructure service modules - Add build-server.mjs script for standalone server compilation - Add logger service with structured output - Restructure auth, gateway-manager, hermes-cli, hermes services - Update docker-compose volume mount path - Update tsconfig and entry point for bundled server Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: separate controllers from routes and centralize route registration - Extract business logic from route handlers into controllers/ - Add centralized route registry in routes/index.ts with public/auth/protected layers - Replace global auth whitelist with sequential middleware registration - Extract shared helpers to services/config-helpers.ts - Allow custom provider name to be user-editable in ProviderFormModal - Deduplicate custom providers by poolKey instead of base_url in getAvailable Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: auth bypass via path case, SPA serving, and provider improvements - Fix auth bypass: path case-insensitive check for /api, /v1, /upload - Fix SPA returning 401: skip auth for non-API paths (static files) - Fix profile switch: use local loading state instead of shared store ref - Auto-append /v1 to base_url when fetching models (frontend + backend) - Guard .env writing to built-in providers only - Add builtin field to provider presets, enable base_url input in form - Print auth token to console on startup (pino only writes to file) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Zhicheng Han <43314240+hanzckernel@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
ekko
@@ -33,10 +33,12 @@
|
||||
import { spawn, type ChildProcess } from 'child_process'
|
||||
import { resolve, join } from 'path'
|
||||
import { homedir } from 'os'
|
||||
import { readFileSync, writeFileSync, existsSync } from 'fs'
|
||||
import { readFileSync, writeFileSync, existsSync, readdirSync } from 'fs'
|
||||
import { execFile } from 'child_process'
|
||||
import { promisify } from 'util'
|
||||
import { createServer } from 'net'
|
||||
import yaml from 'js-yaml'
|
||||
import { logger } from '../logger'
|
||||
|
||||
const execFileAsync = promisify(execFile)
|
||||
|
||||
@@ -48,7 +50,7 @@ const HERMES_BASE = resolve(homedir(), '.hermes')
|
||||
const HERMES_BIN = process.env.HERMES_BIN?.trim() || 'hermes'
|
||||
|
||||
// WSL / Docker 没有 systemd 或 launchd，需要用 "gateway run" 代替 "gateway start"
|
||||
const isWsl = existsSync('/proc/version') && require('fs').readFileSync('/proc/version', 'utf-8').toLowerCase().includes('microsoft')
|
||||
const isWsl = existsSync('/proc/version') && readFileSync('/proc/version', 'utf-8').toLowerCase().includes('microsoft')
|
||||
const isDocker = existsSync('/.dockerenv')
|
||||
const needsRunMode = isWsl || isDocker
|
||||
|
||||
@@ -110,7 +112,6 @@ export class GatewayManager {
|
||||
if (!existsSync(configPath)) return { port: 8642, host: '127.0.0.1' }
|
||||
|
||||
try {
|
||||
const yaml = require('js-yaml')
|
||||
const content = readFileSync(configPath, 'utf-8')
|
||||
const cfg = yaml.load(content) as any || {}
|
||||
|
||||
@@ -225,7 +226,6 @@ export class GatewayManager {
|
||||
private writeProfilePort(name: string, port: number, host: string): void {
|
||||
const configPath = join(this.profileDir(name), 'config.yaml')
|
||||
try {
|
||||
const yaml = require('js-yaml')
|
||||
const content = existsSync(configPath) ? readFileSync(configPath, 'utf-8') : ''
|
||||
const cfg = (yaml.load(content) as any) || {}
|
||||
|
||||
@@ -248,9 +248,9 @@ export class GatewayManager {
|
||||
}
|
||||
|
||||
writeFileSync(configPath, yaml.dump(cfg, { lineWidth: -1 }), 'utf-8')
|
||||
console.log(`[GatewayManager] Updated ${configPath}: api_server.extra.port = ${port}`)
|
||||
logger.debug('Updated %s: api_server.extra.port = %d', configPath, port)
|
||||
} catch (err) {
|
||||
console.error(`[GatewayManager] Failed to write config for profile "${name}":`, err)
|
||||
logger.error(err, 'Failed to write config for profile "%s"', name)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -280,7 +280,7 @@ export class GatewayManager {
|
||||
if (usedPorts.has(port)) {
|
||||
// 已管理端口冲突 → 找空闲端口
|
||||
const newPort = await this.findFreePort(port, host)
|
||||
console.log(`[GatewayManager] Port ${port} is in use for profile "${name}", reassigning to ${newPort}`)
|
||||
logger.info('Port %d is in use for profile "%s", reassigning to %d', port, name, newPort)
|
||||
this.writeProfilePort(name, newPort, host)
|
||||
port = newPort
|
||||
} else {
|
||||
@@ -288,7 +288,7 @@ export class GatewayManager {
|
||||
const available = await this.checkPortAvailable(port, host)
|
||||
if (!available) {
|
||||
const newPort = await this.findFreePort(port, host)
|
||||
console.log(`[GatewayManager] Port ${port} is occupied by another process for profile "${name}", reassigning to ${newPort}`)
|
||||
logger.info('Port %d is occupied by another process for profile "%s", reassigning to %d', port, name, newPort)
|
||||
this.writeProfilePort(name, newPort, host)
|
||||
port = newPort
|
||||
} else {
|
||||
@@ -354,7 +354,6 @@ export class GatewayManager {
|
||||
// CLI 不可用时回退到文件系统扫描
|
||||
const profiles = ['default']
|
||||
const profilesDir = join(HERMES_BASE, 'profiles')
|
||||
const { existsSync, readdirSync } = require('fs')
|
||||
if (existsSync(profilesDir)) {
|
||||
for (const entry of readdirSync(profilesDir, { withFileTypes: true })) {
|
||||
if (entry.isDirectory() && existsSync(join(profilesDir, entry.name, 'config.yaml'))) {
|
||||
@@ -423,7 +422,7 @@ export class GatewayManager {
|
||||
child.unref()
|
||||
|
||||
const pid = child.pid ?? 0
|
||||
console.log(`[GatewayManager] Starting gateway for profile "${name}" (run mode, PID: ${pid}, port: ${port})`)
|
||||
logger.info('Starting gateway for profile "%s" (run mode, PID: %d, port: %d)', name, pid, port)
|
||||
|
||||
this.waitForReady(name, pid, port, host, url)
|
||||
.then(resolve)
|
||||
@@ -432,7 +431,7 @@ export class GatewayManager {
|
||||
}
|
||||
|
||||
// 正常系统：先 start，失败则 restart（处理服务已运行的情况）
|
||||
console.log(`[GatewayManager] Starting gateway for profile "${name}" (start mode, port: ${port})`)
|
||||
logger.info('Starting gateway for profile "%s" (start mode, port: %d)', name, port)
|
||||
const env = { ...process.env, HERMES_HOME: hermesHome }
|
||||
try {
|
||||
const { stdout } = await execFileAsync(HERMES_BIN, ['gateway', 'start'], {
|
||||
@@ -440,7 +439,7 @@ export class GatewayManager {
|
||||
env,
|
||||
windowsHide: true,
|
||||
})
|
||||
console.log(`[GatewayManager] gateway start output: ${stdout?.trim()}`)
|
||||
logger.debug('gateway start output: %s', stdout?.trim())
|
||||
} catch {
|
||||
// start 失败（可能服务已运行），用 restart
|
||||
try {
|
||||
@@ -449,9 +448,9 @@ export class GatewayManager {
|
||||
env,
|
||||
windowsHide: true,
|
||||
})
|
||||
console.log(`[GatewayManager] gateway restart output: ${stdout?.trim()}`)
|
||||
logger.debug('gateway restart output: %s', stdout?.trim())
|
||||
} catch (err: any) {
|
||||
console.log(`[GatewayManager] gateway start/restart (non-fatal): ${err.stderr?.trim() || err.message}`)
|
||||
logger.warn(err, 'gateway start/restart (non-fatal)')
|
||||
}
|
||||
}
|
||||
|
||||
@@ -518,14 +517,14 @@ export class GatewayManager {
|
||||
while (Date.now() < deadline) {
|
||||
if (!(await this.checkHealth(url, 1000))) {
|
||||
this.gateways.delete(name)
|
||||
console.log(`[GatewayManager] Stopped gateway for profile "${name}"`)
|
||||
logger.info('Stopped gateway for profile "%s"', name)
|
||||
return
|
||||
}
|
||||
await new Promise(r => setTimeout(r, 300))
|
||||
}
|
||||
// 超时也清理
|
||||
this.gateways.delete(name)
|
||||
console.log(`[GatewayManager] Stopped gateway for profile "${name}" (timeout)`)
|
||||
logger.warn('Stopped gateway for profile "%s" (timeout)', name)
|
||||
}
|
||||
|
||||
/** 停止所有已管理的网关（并行执行） */
|
||||
@@ -540,15 +539,15 @@ export class GatewayManager {
|
||||
|
||||
/** 扫描所有 profile，检测网关运行状态并注册 */
|
||||
async detectAllOnStartup(): Promise<void> {
|
||||
console.log('[GatewayManager] Scanning profiles for running gateways...')
|
||||
logger.info('Scanning profiles for running gateways...')
|
||||
const profiles = await this.listProfiles()
|
||||
|
||||
for (const name of profiles) {
|
||||
const status = await this.detectStatus(name)
|
||||
if (status.running) {
|
||||
console.log(`[GatewayManager] ✓ ${name}: running (PID: ${status.pid}, port: ${status.port})`)
|
||||
logger.info('%s: running (PID: %s, port: %d)', name, status.pid, status.port)
|
||||
} else {
|
||||
console.log(`[GatewayManager] ○ ${name}: stopped`)
|
||||
logger.debug('%s: stopped', name)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -568,14 +567,14 @@ export class GatewayManager {
|
||||
for (const name of profiles) {
|
||||
const existing = this.gateways.get(name)
|
||||
if (existing && this.isProcessAlive(existing.pid)) {
|
||||
console.log(`[GatewayManager] ${name}: already running (PID: ${existing.pid})`)
|
||||
logger.info('%s: already running (PID: %d)', name, existing.pid)
|
||||
continue
|
||||
}
|
||||
|
||||
// 有 PID 文件但进程未在正确端口运行 → 旧进程，先停掉
|
||||
const pid = this.readPidFile(name)
|
||||
if (pid && this.isProcessAlive(pid)) {
|
||||
console.log(`[GatewayManager] ${name}: stale process (PID: ${pid}), stopping`)
|
||||
logger.info('%s: stale process (PID: %d), stopping', name, pid)
|
||||
try { await this.stop(name) } catch { }
|
||||
}
|
||||
|
||||
@@ -588,7 +587,7 @@ export class GatewayManager {
|
||||
try {
|
||||
await this.start(name)
|
||||
} catch (err: any) {
|
||||
console.error(`[GatewayManager] ✗ ${name}: failed to start — ${err.message}`)
|
||||
logger.error(err, '%s: failed to start', name)
|
||||
}
|
||||
})
|
||||
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
import { execFile } from 'child_process'
|
||||
import { execFile, spawn } from 'child_process'
|
||||
import { existsSync } from 'fs'
|
||||
import { promisify } from 'util'
|
||||
import { logger } from '../logger'
|
||||
|
||||
const execFileAsync = promisify(execFile)
|
||||
|
||||
@@ -126,7 +127,7 @@ export async function listSessions(source?: string, limit?: number): Promise<Her
|
||||
}
|
||||
return sessions
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] sessions export failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: sessions export failed')
|
||||
throw new Error(`Failed to list sessions: ${err.message}`)
|
||||
}
|
||||
}
|
||||
@@ -174,7 +175,7 @@ export async function getSession(id: string): Promise<HermesSession | null> {
|
||||
}
|
||||
} catch (err: any) {
|
||||
if (err.code === 1 || err.status === 1) return null
|
||||
console.error('[Hermes CLI] session export failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: session export failed')
|
||||
throw new Error(`Failed to get session: ${err.message}`)
|
||||
}
|
||||
}
|
||||
@@ -190,7 +191,7 @@ export async function deleteSession(id: string): Promise<boolean> {
|
||||
})
|
||||
return true
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] session delete failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: session delete failed')
|
||||
return false
|
||||
}
|
||||
}
|
||||
@@ -206,7 +207,7 @@ export async function renameSession(id: string, title: string): Promise<boolean>
|
||||
})
|
||||
return true
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] session rename failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: session rename failed')
|
||||
return false
|
||||
}
|
||||
}
|
||||
@@ -250,7 +251,6 @@ export async function startGateway(): Promise<string> {
|
||||
* Uses "hermes gateway run" as a detached background process
|
||||
*/
|
||||
export async function startGatewayBackground(): Promise<number | null> {
|
||||
const { spawn } = require('child_process') as typeof import('child_process')
|
||||
const child = spawn(HERMES_BIN, ['gateway', 'run'], {
|
||||
detached: true,
|
||||
stdio: 'ignore',
|
||||
@@ -311,7 +311,7 @@ export async function listLogFiles(): Promise<LogFileInfo[]> {
|
||||
}
|
||||
return files
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] logs list failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: logs list failed')
|
||||
return []
|
||||
}
|
||||
}
|
||||
@@ -339,7 +339,7 @@ export async function readLogs(
|
||||
})
|
||||
return stdout
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] logs read failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: logs read failed')
|
||||
throw new Error(`Failed to read logs: ${err.message}`)
|
||||
}
|
||||
}
|
||||
@@ -396,7 +396,7 @@ export async function listProfiles(): Promise<HermesProfile[]> {
|
||||
|
||||
return profiles
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] profile list failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: profile list failed')
|
||||
throw new Error(`Failed to list profiles: ${err.message}`)
|
||||
}
|
||||
}
|
||||
@@ -437,7 +437,7 @@ export async function getProfile(name: string): Promise<HermesProfileDetail> {
|
||||
if (err.code === 1 || err.status === 1) {
|
||||
throw new Error(`Profile "${name}" not found`)
|
||||
}
|
||||
console.error('[Hermes CLI] profile show failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: profile show failed')
|
||||
throw new Error(`Failed to get profile: ${err.message}`)
|
||||
}
|
||||
}
|
||||
@@ -456,7 +456,7 @@ export async function createProfile(name: string, clone?: boolean): Promise<stri
|
||||
})
|
||||
return stdout || stderr
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] profile create failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: profile create failed')
|
||||
throw new Error(`Failed to create profile: ${err.message}`)
|
||||
}
|
||||
}
|
||||
@@ -472,7 +472,7 @@ export async function deleteProfile(name: string): Promise<boolean> {
|
||||
})
|
||||
return true
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] profile delete failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: profile delete failed')
|
||||
return false
|
||||
}
|
||||
}
|
||||
@@ -488,7 +488,7 @@ export async function renameProfile(oldName: string, newName: string): Promise<b
|
||||
})
|
||||
return true
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] profile rename failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: profile rename failed')
|
||||
return false
|
||||
}
|
||||
}
|
||||
@@ -504,7 +504,7 @@ export async function useProfile(name: string): Promise<string> {
|
||||
})
|
||||
return stdout || stderr
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] profile use failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: profile use failed')
|
||||
throw new Error(`Failed to switch profile: ${err.message}`)
|
||||
}
|
||||
}
|
||||
@@ -523,7 +523,7 @@ export async function exportProfile(name: string, outputPath?: string): Promise<
|
||||
})
|
||||
return stdout || stderr
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] profile export failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: profile export failed')
|
||||
throw new Error(`Failed to export profile: ${err.message}`)
|
||||
}
|
||||
}
|
||||
@@ -539,7 +539,7 @@ export async function setupReset(): Promise<string> {
|
||||
})
|
||||
return stdout || stderr
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] setup reset failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: setup reset failed')
|
||||
throw new Error(`Failed to reset config: ${err.message}`)
|
||||
}
|
||||
}
|
||||
@@ -558,7 +558,7 @@ export async function importProfile(archivePath: string, name?: string): Promise
|
||||
})
|
||||
return stdout || stderr
|
||||
} catch (err: any) {
|
||||
console.error('[Hermes CLI] profile import failed:', err.message)
|
||||
logger.error(err, 'Hermes CLI: profile import failed')
|
||||
throw new Error(`Failed to import profile: ${err.message}`)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
import { config } from '../../config'
|
||||
import { logger } from '../logger'
|
||||
|
||||
const UPSTREAM = config.upstream.replace(/\/$/, '')
|
||||
|
||||
@@ -121,7 +122,7 @@ export function emitWebhook(payload: any) {
|
||||
for (const cb of webhookCallbacks) {
|
||||
const result = cb(payload)
|
||||
if (result && typeof result.catch === 'function') {
|
||||
result.catch((err: Error) => console.error('Webhook callback error:', err))
|
||||
result.catch((err: Error) => logger.error(err, 'Webhook callback error'))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user