SakuraByteCore
diff --git a/‎cli.js‎
Lines changed: 53 additions & 42 deletions b/‎cli.js‎
Lines changed: 53 additions & 42 deletions
diff --git a/‎package-lock.json‎
Lines changed: 3 additions & 12 deletions b/‎package-lock.json‎
Lines changed: 3 additions & 12 deletions
diff --git a/‎package.json‎
Lines changed: 2 additions & 1 deletion b/‎package.json‎
Lines changed: 2 additions & 1 deletion
@@ -10058,9 +10058,10 @@ function watchPathsForRestart(targets, onChange) {
 }
 // #endregion watchPathsForRestart
 
-function writeJsonResponse(res, statusCode, payload) {
+function writeJsonResponse(res, statusCode, payload, headers = {}) {
     const body = JSON.stringify(payload, null, 2);
     res.writeHead(statusCode, {
+        ...headers,
         'Content-Type': 'application/json; charset=utf-8',
         'Content-Length': Buffer.byteLength(body, 'utf-8')
     });
@@ -10620,7 +10621,7 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
         const securityHeaders = {
             'X-Content-Type-Options': 'nosniff',
             'X-Frame-Options': 'DENY',
-            'Content-Security-Policy': "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ws: wss:"
+            'Content-Security-Policy': "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ws: wss:"
         };
         const origWriteHead = res.writeHead.bind(res);
         res.writeHead = function (statusCode, headers) {
@@ -10649,34 +10650,15 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
             || requestPath.startsWith('/download/')
         ) {
             const remoteAddr = req && req.socket ? req.socket.remoteAddress : '';
-            const isLoopback = !remoteAddr
-                || remoteAddr === '127.0.0.1'
-                || remoteAddr === '::1'
-                || remoteAddr === '::ffff:127.0.0.1';
+            const isLoopback = !remoteAddr || isLoopbackRemoteAddress(remoteAddr);
             if (!isLoopback) {
                 const rateLimitKey = (remoteAddr || 'unknown') + ':' + requestPath;
                 if (!checkRateLimit(rateLimitKey)) {
-                    res.writeHead(429, { 'Content-Type': 'application/json; charset=utf-8', 'Retry-After': '60' });
-                    res.end(JSON.stringify({ error: 'Rate limit exceeded' }));
+                    writeJsonResponse(res, 429, { error: 'Rate limit exceeded' }, { 'Retry-After': '60' });
                     return;
                 }
-                const expected = typeof process.env.CODEXMATE_HTTP_TOKEN === 'string'
-                    ? process.env.CODEXMATE_HTTP_TOKEN.trim()
-                    : '';
-                if (!expected) {
-                    sendJson(403, {
-                        error: 'Remote access is disabled (set CODEXMATE_HTTP_TOKEN or use --host 127.0.0.1)'
-                    });
-                    return;
-                }
-                const headers = req && req.headers && typeof req.headers === 'object' ? req.headers : {};
-                const rawAuth = typeof headers.authorization === 'string' ? headers.authorization.trim() : '';
-                const match = rawAuth ? rawAuth.match(/^bearer\s+(.+)$/i) : null;
-                const actual = match && match[1]
-                    ? match[1].trim()
-                    : (rawAuth ? rawAuth : (typeof headers['x-codexmate-token'] === 'string' ? String(headers['x-codexmate-token']).trim() : ''));
-                if (!actual || !safeTimingEqual(actual, expected)) {
-                    sendJson(401, { error: 'Unauthorized' });
+                const auth = assertRequestAuthorized(req, res);
+                if (!auth.ok) {
                     return;
                 }
             }
@@ -11408,15 +11390,18 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                     res.end(errorBody, 'utf-8');
                 }
             });
-        } else if (requestPath === '/web-ui') {
-            try {
-                const html = readBundledWebUiHtml(htmlPath);
-                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                res.end(html);
-            } catch (error) {
-                writeWebUiAssetError(res, requestPath, error);
-            }
+        } else if (requestPath === '/web-ui/index.html') {
+            const rawUrl = typeof req.url === 'string' ? req.url : '';
+            const queryIndex = rawUrl.indexOf('?');
+            const query = queryIndex >= 0 ? rawUrl.slice(queryIndex) : '';
+            res.writeHead(302, {
+                'Location': `/${query}`,
+                'Content-Type': 'text/plain; charset=utf-8',
+                'Cache-Control': 'no-store, max-age=0'
+            });
+            res.end('Found');
         } else if (requestPath.startsWith('/web-ui/')) {
+            // Skip the /web-ui/ directory itself, which is handled above
             const normalized = path.normalize(requestPath).replace(/^([\\.\\/])+/, '');
             const filePath = path.join(__dirname, normalized);
             if (!isPathInside(filePath, webDir)) {
@@ -11425,11 +11410,22 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                 return;
             }
             const relativePath = path.relative(webDir, filePath).replace(/\\/g, '/');
+
+            // Empty relativePath means direct /web-ui/ access - return 404
+            if (relativePath === '' || relativePath === 'index.html') {
+                res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+                res.end('Not Found');
+                return;
+            }
+
             const dynamicAsset = PUBLIC_WEB_UI_DYNAMIC_ASSETS.get(relativePath);
             if (dynamicAsset) {
                 try {
                     const assetBody = dynamicAsset.reader(filePath);
-                    res.writeHead(200, { 'Content-Type': dynamicAsset.mime });
+                    res.writeHead(200, {
+                        'Content-Type': dynamicAsset.mime,
+                        'Cache-Control': 'no-store, max-age=0'
+                    });
                     res.end(assetBody, 'utf-8');
                 } catch (error) {
                     writeWebUiAssetError(res, requestPath, error);
@@ -11456,7 +11452,10 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                         : ext === '.json'
                             ? 'application/json; charset=utf-8'
                             : 'application/octet-stream';
-            res.writeHead(200, { 'Content-Type': mime });
+            res.writeHead(200, {
+                'Content-Type': mime,
+                'Cache-Control': 'no-store, max-age=0'
+            });
             fs.createReadStream(filePath).pipe(res);
         } else if (requestPath.startsWith('/download/')) {
             const fileName = requestPath.slice('/download/'.length);
@@ -11517,15 +11516,27 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                     : ext === '.json'
                         ? 'application/json; charset=utf-8'
                         : 'application/octet-stream';
-            res.writeHead(200, { 'Content-Type': mime });
+            res.writeHead(200, {
+                'Content-Type': mime,
+                'Cache-Control': 'no-store, max-age=0'
+            });
             fs.createReadStream(filePath).pipe(res);
         } else {
-            try {
-                const html = readBundledWebUiHtml(htmlPath);
-                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                res.end(html);
-            } catch (error) {
-                writeWebUiAssetError(res, requestPath, error);
+            // Only serve HTML for root path; /web-ui returns 404.
+            if (requestPath === '/') {
+                try {
+                    const html = readBundledWebUiHtml(htmlPath);
+                    res.writeHead(200, {
+                        'Content-Type': 'text/html; charset=utf-8',
+                        'Cache-Control': 'no-store, max-age=0'
+                    });
+                    res.end(html);
+                } catch (error) {
+                    writeWebUiAssetError(res, requestPath, error);
+                }
+            } else {
+                res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+                res.end('Not Found');
             }
         }
     });
 
@@ -1,6 +1,6 @@
 {
   "name": "codexmate",
-  "version": "0.1.0",
+  "version": "0.0.35",
   "description": "Codex/Claude Code/OpenClaw 配置、会话与任务编排 CLI + Web 工具",
   "main": "cli.js",
   "bin": {
@@ -46,6 +46,7 @@
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",
+    "@vue/compiler-dom": "^3.5.30",
     "json5": "^2.2.3",
     "yauzl": "^3.2.1",
     "zip-lib": "^1.2.1"