mirror of
https://gitcode.com/JianFeeeee/HomeAgent.git
synced 2026-11-01 14:57:38 +00:00
4e70b8d5d8
批 1，不含 SDK 仓与目录改名。 - go.mod 第 1 行 module 路径 - 366 个 .go 文件的完整前缀 github.com/JianFeeeee/HomeAgent 机械替换 （857 处，仅完整前缀；展示名/注释里的 HomeAgent 字样留给批 5） - 未改：third_party 目录名、SDK 自身 go.mod module、go.mod replace 目标、 homed/waiter 可执行名、.hmap 后缀
404 lines
13 KiB
Go
404 lines
13 KiB
Go
package webui
|
||
|
||
import (
|
||
"log"
|
||
"math"
|
||
"sort"
|
||
"strings"
|
||
|
||
"encoding/json"
|
||
sdk "github.com/JianFeeeee/HologramAgent/internal/sdk"
|
||
"github.com/JianFeeeee/HologramAgent/pkg/types"
|
||
"net/http"
|
||
)
|
||
|
||
// 设置与插件面：配置读写、插件列表/详情（含 pluginmgr 反代）。
|
||
|
||
func (h *Handler) handleConfig(w http.ResponseWriter, r *http.Request) {
|
||
if h.config == nil {
|
||
writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "config not available"})
|
||
return
|
||
}
|
||
switch r.Method {
|
||
case http.MethodGet:
|
||
writeJSON(w, http.StatusOK, h.config.Get())
|
||
case http.MethodPut:
|
||
var cfg types.Config
|
||
if err := json.NewDecoder(r.Body).Decode(&cfg); err != nil {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid config"})
|
||
return
|
||
}
|
||
h.config.Put(&cfg)
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "config_updated"})
|
||
default:
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
}
|
||
}
|
||
|
||
// isInternalSetting 判断某个插件的配置键是不是**内部数据**（不是用户设置项）。
|
||
//
|
||
// chathistory 是 webui 自己持久化的整段聊天记录（生产实例实测 5.2MB）。它躺在
|
||
// 插件配置表里，于是会被设置接口当成普通配置项整块吐出：GET /api/v1/settings
|
||
// 因此返回 8MB+，并且前端把它渲染成一个巨大的文本框。它只应由 chat 相关
|
||
// 接口的 handleChatHistory 读，不进设置面。
|
||
func isInternalSetting(plugin, key string) bool {
|
||
return plugin == "webui" && key == "chathistory"
|
||
}
|
||
|
||
func (h *Handler) handleSettings(w http.ResponseWriter, r *http.Request) {
|
||
if h.settings == nil {
|
||
writeJSON(w, http.StatusNotFound, map[string]string{"error": "config registry not available"})
|
||
return
|
||
}
|
||
switch r.Method {
|
||
case http.MethodGet:
|
||
prefix := r.URL.Query().Get("prefix")
|
||
values := make(map[string]interface{})
|
||
meta := make(map[string]*sdk.ConfigDef)
|
||
|
||
if strings.HasPrefix(prefix, "plugin.") {
|
||
// 插件配置：从插件自身 config_<name> 表读取
|
||
pluginName := prefix[7:]
|
||
keys, _ := h.settings.ListPlugin(pluginName, "")
|
||
for _, k := range keys {
|
||
if isInternalSetting(pluginName, k) {
|
||
continue
|
||
}
|
||
v, _ := h.settings.GetPlugin(pluginName, k)
|
||
fullKey := prefix + "." + k
|
||
values[fullKey] = v
|
||
}
|
||
for _, def := range h.settings.DefsPlugin(pluginName, "") {
|
||
fullKey := prefix + "." + def.Key
|
||
meta[fullKey] = def
|
||
}
|
||
} else {
|
||
// 核心配置：从 core config 表读取（键可为任意前缀，如 core.llm.*、webui.*）
|
||
all := h.settings.Dump()
|
||
var keys []string
|
||
for k := range all {
|
||
if strings.HasPrefix(k, prefix) {
|
||
keys = append(keys, k)
|
||
}
|
||
}
|
||
sort.Strings(keys)
|
||
for _, k := range keys {
|
||
values[k] = all[k]
|
||
}
|
||
for _, d := range h.settings.DefsCore(prefix) {
|
||
meta[d.Key] = d
|
||
// 有 def 但 DB 中尚无值的 key，用 default 填充以便在 WebUI 中显示和编辑
|
||
if _, exists := values[d.Key]; !exists {
|
||
values[d.Key] = d.Default
|
||
}
|
||
}
|
||
// 无前缀时同时加载所有插件配置
|
||
if prefix == "" {
|
||
for _, p := range h.settings.Plugins() {
|
||
if p == "core" {
|
||
continue
|
||
}
|
||
pkeys, _ := h.settings.ListPlugin(p, "")
|
||
for _, k := range pkeys {
|
||
if isInternalSetting(p, k) {
|
||
continue
|
||
}
|
||
v, _ := h.settings.GetPlugin(p, k)
|
||
fullKey := "plugin." + p + "." + k
|
||
values[fullKey] = v
|
||
}
|
||
for _, def := range h.settings.DefsPlugin(p, "") {
|
||
fullKey := "plugin." + p + "." + def.Key
|
||
meta[fullKey] = def
|
||
}
|
||
}
|
||
}
|
||
}
|
||
// ★ E-3：列表永远默认屏蔽敏感值。明文揭示必须走单键 reveal 接口。
|
||
h.maskSecretValues(values, false)
|
||
|
||
plugins := []string{"core"}
|
||
for _, p := range h.settings.Plugins() {
|
||
if p != "core" {
|
||
plugins = append(plugins, "plugin."+p)
|
||
}
|
||
}
|
||
var pm map[string]sdk.PluginMeta
|
||
if h.pluginMgr != nil {
|
||
pm = h.pluginMgr.PluginMetas()
|
||
}
|
||
var disabledPlugins []sdk.DisabledPluginInfo
|
||
if h.pluginMgr != nil {
|
||
disabledPlugins = h.pluginMgr.ListDisabledPlugins()
|
||
}
|
||
sort.Strings(plugins)
|
||
writeJSON(w, http.StatusOK, map[string]interface{}{
|
||
"settings": values,
|
||
"meta": meta,
|
||
"plugins": plugins,
|
||
"plugin_meta": pm,
|
||
"disabled_plugins": disabledPlugins,
|
||
})
|
||
case http.MethodPut:
|
||
var body struct {
|
||
Key string `json:"key"`
|
||
Value interface{} `json:"value"`
|
||
}
|
||
if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request"})
|
||
return
|
||
}
|
||
// 整数型 float64（如 QQ 号 2.198972886e+09）规范化为 int64，
|
||
// 避免被 fmt.Sprint 以科学计数法存库导致后续读取/解析失败。
|
||
if f, ok := body.Value.(float64); ok && f == math.Trunc(f) && math.Abs(f) < 1e15 {
|
||
body.Value = int64(f)
|
||
}
|
||
// ★ 掩码占位符**不是值**，绝不能存回内核。
|
||
//
|
||
// 真实故障（2026-10-16）：设置页里点一次「保存」，前端会把同一组字段
|
||
// （含刚被掩码的 api_key）一并回传 ⇒ `••••••••` 被当真实值存进
|
||
// `core.llm.sources.<n>.api_key` ⇒ 下游（commondev 的 pi 源导入器）
|
||
// 把掩码写进 pi 的 auth.json ⇒ 模型调用 401。
|
||
//
|
||
// 这里拒绝并**明确告诉调用方怎么做**：它没说"保存失败"就完了，
|
||
// 否则用户不知道该如何保存其他字段。
|
||
if IsSecretPlaceholder(body.Value) {
|
||
writeJSON(w, http.StatusConflict, map[string]string{
|
||
"error": "该值是**掩码占位符**（列表接口为防泄漏而显示的“已设置”标记），" +
|
||
"不是真实内容；存回它会用标记覆盖真值。" +
|
||
"若未修改此字段请**不要保存它**（只保存你改动的键）；" +
|
||
"若确实要改，请填入新的真值（或先调 reveal 接口取回当前值后再改）。",
|
||
"key": body.Key,
|
||
})
|
||
return
|
||
}
|
||
deleting := body.Value == nil
|
||
if strings.HasPrefix(body.Key, "plugin.") {
|
||
parts := strings.SplitN(body.Key, ".", 3)
|
||
if len(parts) >= 3 {
|
||
if isInternalSetting(parts[1], parts[2]) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "该键属于插件内部数据，不经设置接口读写"})
|
||
return
|
||
}
|
||
var err error
|
||
if deleting {
|
||
err = h.settings.RemovePlugin(parts[1], parts[2])
|
||
} else {
|
||
err = h.settings.SetPlugin(parts[1], parts[2], body.Value)
|
||
}
|
||
if err != nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
}
|
||
} else {
|
||
var err error
|
||
if deleting {
|
||
err = h.settings.RemoveCore(body.Key)
|
||
} else {
|
||
err = h.settings.SetCore(body.Key, body.Value)
|
||
}
|
||
if err != nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
}
|
||
if strings.HasPrefix(body.Key, "core.llm.") && h.llm != nil {
|
||
if err := h.llm.ReloadFromConfig(); err != nil {
|
||
log.Printf("[webui] failed to reload LLM providers: %v", err)
|
||
}
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
|
||
default:
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
}
|
||
}
|
||
|
||
// ======== Plugin Management (proxied to pluginmgr HTTP API) ========
|
||
|
||
func (h *Handler) pluginmgrAddr() string {
|
||
addr := "127.0.0.1:9876"
|
||
if h.settings == nil {
|
||
return addr
|
||
}
|
||
if v, err := h.settings.GetPlugin("pluginmgr", "http_addr"); err == nil {
|
||
if s, ok := v.(string); ok && s != "" {
|
||
addr = s
|
||
}
|
||
}
|
||
return addr
|
||
}
|
||
|
||
func (h *Handler) proxyToPluginmgr(w http.ResponseWriter, r *http.Request, path string) {
|
||
addr := h.pluginmgrAddr()
|
||
url := "http://" + addr + path
|
||
// 与设备网关反代共用同一实现：原来两处各抄一份，于是同一个 bug
|
||
//（跟随 3xx / 不逐帧 flush / 不透传 X-Forwarded）修了两遍还漏了两处。
|
||
h.reverseToUpstream(w, r, url, "")
|
||
}
|
||
|
||
func (h *Handler) handlePlugins(w http.ResponseWriter, r *http.Request) {
|
||
switch r.Method {
|
||
case http.MethodGet:
|
||
h.proxyToPluginmgr(w, r, "/plugins")
|
||
case http.MethodPost:
|
||
h.proxyToPluginmgr(w, r, "/plugins")
|
||
default:
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
}
|
||
}
|
||
|
||
func (h *Handler) handlePluginByID(w http.ResponseWriter, r *http.Request) {
|
||
path := strings.TrimPrefix(r.URL.Path, "/api/v1/plugins/")
|
||
path = strings.TrimSuffix(path, "/")
|
||
|
||
// 插件名白名单：仅允许单段安全名称，阻断路径穿越/空名/嵌套路径
|
||
validPluginName := func(s string) bool {
|
||
if s == "" || len(s) > 128 {
|
||
return false
|
||
}
|
||
// 禁止路径分隔符、连续点(父目录穿越)、冒号、空格等危险字符
|
||
if strings.Contains(s, "..") || strings.ContainsAny(s, "/\\: \t\r\n\x00") {
|
||
return false
|
||
}
|
||
for _, c := range s {
|
||
if !(c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '_' || c == '-' || c == '.') {
|
||
return false
|
||
}
|
||
}
|
||
return true
|
||
}
|
||
|
||
if path == "disabled" && r.Method == http.MethodGet {
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin manager not available"})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]interface{}{"disabled": h.pluginMgr.ListDisabledPlugins()})
|
||
return
|
||
}
|
||
|
||
if path == "reload" {
|
||
if r.Method == http.MethodPost {
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin registry not available"})
|
||
return
|
||
}
|
||
if _, err := h.pluginMgr.ReloadPlugins(); err != nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "reloaded"})
|
||
return
|
||
}
|
||
// reload/disabled 是保留字，不允许 DELETE/GET 等其它操作误把其当作插件名
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
return
|
||
}
|
||
|
||
if idx := strings.LastIndex(path, "/"); idx > 0 {
|
||
name := path[:idx]
|
||
action := path[idx+1:]
|
||
if r.Method == http.MethodPost {
|
||
switch action {
|
||
case "disable":
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin manager not available"})
|
||
return
|
||
}
|
||
if !validPluginName(name) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid plugin name"})
|
||
return
|
||
}
|
||
if err := h.pluginMgr.DisablePlugin(name, "webui"); err != nil {
|
||
// 未安装 → 404；已禁用 → 409；其余为真实内部错误
|
||
status := http.StatusInternalServerError
|
||
msg := err.Error()
|
||
switch {
|
||
case strings.HasSuffix(msg, "not installed"):
|
||
status = http.StatusNotFound
|
||
case strings.HasSuffix(msg, "already disabled"):
|
||
status = http.StatusConflict
|
||
}
|
||
writeJSON(w, status, map[string]string{"error": msg})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "disabled"})
|
||
return
|
||
|
||
case "start":
|
||
// 运行态启动：只拉起，不写持久禁用清单 —— 与「启用」区分。
|
||
// 前端「按需待命」的插件点「启动」走这里，不该顺手改持久配置。
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin manager not available"})
|
||
return
|
||
}
|
||
if !validPluginName(name) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid plugin name"})
|
||
return
|
||
}
|
||
if err := h.pluginMgr.StartPlugin(name); err != nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "started"})
|
||
return
|
||
|
||
case "stop":
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin manager not available"})
|
||
return
|
||
}
|
||
if !validPluginName(name) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid plugin name"})
|
||
return
|
||
}
|
||
if err := h.pluginMgr.StopPlugin(name); err != nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "stopped"})
|
||
return
|
||
|
||
case "enable":
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin manager not available"})
|
||
return
|
||
}
|
||
if !validPluginName(name) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid plugin name"})
|
||
return
|
||
}
|
||
if err := h.pluginMgr.EnablePlugin(name); err != nil {
|
||
// 启用失败多数是“插件不存在/加载失败” → 404 更贴切
|
||
status := http.StatusInternalServerError
|
||
if strings.Contains(err.Error(), "failed") {
|
||
status = http.StatusNotFound
|
||
}
|
||
writeJSON(w, status, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "enabled"})
|
||
return
|
||
}
|
||
}
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
return
|
||
}
|
||
|
||
// 单段插件名路径（GET 详情 / DELETE 卸载）
|
||
if !validPluginName(path) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid plugin name"})
|
||
return
|
||
}
|
||
|
||
switch r.Method {
|
||
case http.MethodGet:
|
||
h.proxyToPluginmgr(w, r, "/plugins/"+path)
|
||
case http.MethodDelete:
|
||
h.proxyToPluginmgr(w, r, "/plugins/"+path)
|
||
default:
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
}
|
||
}
|