From 92cae0c76ff359ebb5984975d4f25d45c1627866 Mon Sep 17 00:00:00 2001 From: moc Date: Fri, 4 Sep 2026 20:31:08 +0800 Subject: [PATCH 1/2] sync: pull plugins/Wzdhehe/mcode-webui/ to PR #23 head (091dec5) Upstream 96ff886 (8/22) is 7 commits behind MiniMax-AI/MiniMax-Code-Plugins#23 head 091dec5 (8/27). This sync brings the plugin distribution tree to parity with PR #23 so all Round 8+ governance work has an upstream home. == Pulled-in commits (in chronological order) == Wzdhehe (9): 33a5861 Add plugin: mcode-webui (initial v1.0.0 release) f81e1e1 docs: rename product name mcode -> Mcode in plugin tree docs d4a886e fix: revert SKILL.md frontmatter name to mcode-webui; strip CRLF 7d21634 fix: revert path references to mcode-webui cae2a80 chore: update GitHub URLs after Mcode-webui rename 5ade9c7 feat(mcode-webui): v1.0.1 - token auth gate + LAN sub-card + read-only mode f2b1c8f fix(mcode-webui): CORS preflight exemption + cross-origin Authorization ffacf58 fix(mcode-webui): round 3 review fixes (auth.js setters + startup smoke test) afd4167 fix(mcode-webui): round 4 - db.js better-sqlite3 path resolver modacker (3): 0dbdacd fix(mcode-webui): round 5 - fix better-sqlite3 resolver + error priority c448424 fix(mcode-webui): round 6 - add standard install candidate 091dec5 feat(mcode-webui): Token Plan key integration end-to-end == File scope (37 files) == 8 added: .gitignore, server/lib/auth.js, test/lib-auth.test.js, test/lib-db-resolver.test.js, test/router-cors.test.js, test/router-readonly.test.js, test/server-startup.test.js, test/usage.test.js 29 modified: server/{router,lib/db,lib/settings,lib/state-bus,lib/usage,lib/config, routes/settings,routes/state,js}, test/{_setup, state-bus,lib-settings,routes-settings}, public/{app/{events,i18n,render,state},index.html, styles/main.css}, docs/{API,ARCHITECTURE,CAPABILITIES, DEVELOPMENT,TROUBLESHOOTING}, package.json, references/SECURITY-NOTES.md, CONTRIBUTING.md, README.md, README.zh-CN.md, server.js == Statistics == 37 files changed, +5195 / -281 == Known gaps (out of scope for this commit) == - Upstream root server/public/test/ stays at 96ff886. The plugin tree is independently maintained; root is for self-hosting. Future sync would require applying Round 5/6/7 deltas to root server/lib/db.js etc. - PR #23 (MiniMax-AI) blocker from hetaoBackend 9/1 (CSRF token disclosure in server/router.js:280 Access-Control-Allow-Origin: *) is NOT addressed here. Planned as Round 8 on a follow-up branch. == Why one commit (not 12) == modacker/MiniMax-Code-Plugins and Wzdhehe/Mcode-webui have no common ancestor (merge-base fails). Cherry-pick is impossible. Wholesale tree copy with attribution in commit body is the honest equivalent. Co-authored-by: Wzdhehe Co-authored-by: modacker <2918882+modacker@users.noreply.github.com> --- plugins/Wzdhehe/mcode-webui/.gitignore | 4 + plugins/Wzdhehe/mcode-webui/CONTRIBUTING.md | 190 ++++- plugins/Wzdhehe/mcode-webui/README.md | 58 +- plugins/Wzdhehe/mcode-webui/README.zh-CN.md | 18 +- plugins/Wzdhehe/mcode-webui/docs/API.md | 57 +- .../Wzdhehe/mcode-webui/docs/ARCHITECTURE.md | 53 +- .../Wzdhehe/mcode-webui/docs/CAPABILITIES.md | 17 +- .../Wzdhehe/mcode-webui/docs/DEVELOPMENT.md | 34 +- .../mcode-webui/docs/TROUBLESHOOTING.md | 18 +- plugins/Wzdhehe/mcode-webui/package.json | 4 +- .../Wzdhehe/mcode-webui/public/app/events.js | 435 ++++++++++- .../Wzdhehe/mcode-webui/public/app/i18n.js | 108 +++ .../Wzdhehe/mcode-webui/public/app/render.js | 106 +++ .../Wzdhehe/mcode-webui/public/app/state.js | 268 ++++++- plugins/Wzdhehe/mcode-webui/public/index.html | 124 +++- .../mcode-webui/public/styles/main.css | 468 ++++++++++++ .../mcode-webui/references/SECURITY-NOTES.md | 119 ++- plugins/Wzdhehe/mcode-webui/server.js | 38 +- .../Wzdhehe/mcode-webui/server/lib/auth.js | 152 ++++ .../Wzdhehe/mcode-webui/server/lib/config.js | 5 + plugins/Wzdhehe/mcode-webui/server/lib/db.js | 113 ++- .../mcode-webui/server/lib/settings.js | 698 +++++++++++++++++- .../mcode-webui/server/lib/state-bus.js | 117 ++- .../Wzdhehe/mcode-webui/server/lib/usage.js | 258 +++++-- plugins/Wzdhehe/mcode-webui/server/router.js | 76 +- .../mcode-webui/server/routes/settings.js | 134 +++- .../mcode-webui/server/routes/state.js | 51 ++ plugins/Wzdhehe/mcode-webui/test/_setup.js | 163 +++- .../test/csrf-token-disclosure.test.js | 203 +++++ .../Wzdhehe/mcode-webui/test/lib-auth.test.js | 357 +++++++++ .../mcode-webui/test/lib-db-resolver.test.js | 189 +++++ .../mcode-webui/test/lib-settings.test.js | 230 +++++- .../mcode-webui/test/router-cors.test.js | 110 +++ .../mcode-webui/test/router-readonly.test.js | 97 +++ .../mcode-webui/test/routes-settings.test.js | 134 ++++ .../mcode-webui/test/server-startup.test.js | 68 ++ .../mcode-webui/test/state-bus.test.js | 218 ++++++ .../Wzdhehe/mcode-webui/test/usage.test.js | 187 +++++ 38 files changed, 5398 insertions(+), 281 deletions(-) create mode 100644 plugins/Wzdhehe/mcode-webui/.gitignore create mode 100644 plugins/Wzdhehe/mcode-webui/server/lib/auth.js create mode 100644 plugins/Wzdhehe/mcode-webui/test/csrf-token-disclosure.test.js create mode 100644 plugins/Wzdhehe/mcode-webui/test/lib-auth.test.js create mode 100644 plugins/Wzdhehe/mcode-webui/test/lib-db-resolver.test.js create mode 100644 plugins/Wzdhehe/mcode-webui/test/router-cors.test.js create mode 100644 plugins/Wzdhehe/mcode-webui/test/router-readonly.test.js create mode 100644 plugins/Wzdhehe/mcode-webui/test/server-startup.test.js create mode 100644 plugins/Wzdhehe/mcode-webui/test/usage.test.js diff --git a/plugins/Wzdhehe/mcode-webui/.gitignore b/plugins/Wzdhehe/mcode-webui/.gitignore new file mode 100644 index 0000000..b17d5fa --- /dev/null +++ b/plugins/Wzdhehe/mcode-webui/.gitignore @@ -0,0 +1,4 @@ + +# v2026-08-28 modacker: webui runtime artifacts (server.err + sessions json) +.server.err +.webui-sessions.json diff --git a/plugins/Wzdhehe/mcode-webui/CONTRIBUTING.md b/plugins/Wzdhehe/mcode-webui/CONTRIBUTING.md index e48dbfa..f302fab 100644 --- a/plugins/Wzdhehe/mcode-webui/CONTRIBUTING.md +++ b/plugins/Wzdhehe/mcode-webui/CONTRIBUTING.md @@ -1,37 +1,171 @@ -# Contributing to Mcode-webui plugin +# Contributing to Mcode Web UI -This is the packaged plugin view of the project. The full -contribution guide lives in the **source repo**: +Thanks for your interest in Mcode Web UI! This document covers +the day-to-day contribution workflow. For the bigger picture (plugin +packaging, release process), see [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md) +and [`plugins/Wzdhehe/mcode-webui/README.md`](plugins/Wzdhehe/mcode-webui/README.md). -**[github.com/Wzdhehe/Mcode-webui → CONTRIBUTING.md](https://github.com/Wzdhehe/Mcode-webui/blob/main/CONTRIBUTING.md)** +## Code of conduct -## Quick reference +Be kind. We review for substance, not for style preferences. If a +change makes the webui more correct / faster / easier to use, it's +in scope. -| Need to … | Read | -|-----------|------| -| Add a route, event, or UI panel | [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) | -| Update a config / env var | [server/lib/config.js](server/lib/config.js) + [docs/API.md](docs/API.md) | -| Bump the version | `package.json` (root + plugin copy) + `plugin.json` | -| Update capability list | [docs/CAPABILITIES.md](docs/CAPABILITIES.md) + `plugin.json#extensions.capabilities` | -| Change a security disclosure | [references/SECURITY-NOTES.md](references/SECURITY-NOTES.md) (the single source of truth) | +## Development setup -## Sync rule +Requirements: -The plugin tree here (`server/`, `public/`, `test/`, `docs/`) is a -**real copy** of the source-repo root. When you change a file at -the root, mirror the same change here in the same commit, or run -`npm run package:plugin` at the source repo to regenerate the -plugin tree. +- **Node 22.19+** (uses `node:test`, `URL.parse`, `Blob.stream`) +- **Mcode CLI 0.1.4+** on `PATH` (or `MCODE_CMD` pointing to it) +- A POSIX-like shell on Windows: PowerShell 7+ or Git Bash -## Submitting to the community registry +Clone and run: -The official -[MiniMax-Code-Plugins](https://github.com/MiniMax-AI/MiniMax-Code-Plugins) -repo accepts plugin submissions as folders under -`plugins///`. The `plugins/Wzdhehe/mcode-webui/` -tree in this repo is the unit of submission — fork the registry, -copy this folder in, open a PR. +```bash +git clone https://github.com/Wzdhehe/Mcode-webui.git +cd Mcode-webui +npm install # only devDeps (eslint, prettier, c8) +npm test # 382 unit tests + 1 skipped (383 total) +npm run lint # eslint flat config, must be 0 warnings +npm run dev # node server.js +# → http://127.0.0.1:8080/ +``` -The official gate is `npm run check` at the registry root. This -repo ships a mirror (`npm run validate:plugin`) that runs the same -checks locally before you push. +`npm test` and `npm run lint` **must pass** before opening a PR. + +## Repository layout + +This repo has a **dual layout** — both copies are kept in sync: + +``` +Mcode-webui/ # ← the development tree (root) +├── server/ public/ test/ # Node + frontend + tests +├── docs/ # ARCHITECTURE, API, CAPABILITIES, … +├── acp.mjs, server.js, package.json +│ +└── plugins/Wzdhehe/mcode-webui/ # ← the plugin artifact + ├── server/ public/ test/ # ↑ real copies, not symlinks + ├── docs/ references/ skills/ + ├── plugin.json package.json LICENSE + ├── README.md PR_DESCRIPTION.md + └── SKILL.md # lives at skills/mcode-webui/SKILL.md +``` + +**Why two copies?** The community plugin registry takes the +`plugins/.../Mcode-webui/` tree as the submission. We keep it as a +real directory copy (not a junction or symlink — those break +zip-packaging and confuse `git log`). + +`npm run setup:plugin` is a no-op on the current layout (it used to +create junctions; the trees have been expanded since). + +## Editing flow + +1. **Edit at the repo root** (`server/`, `public/`, `test/`). +2. **Mirror the change to the plugin tree** — copy the changed files + from `/server/...` to `plugins/Wzdhehe/mcode-webui/server/...`, + and the same for `public/`, `test/`, `docs/`. + (The `package:plugin` script does this for you, but a + per-PR manual sync is fine for small changes.) +3. **Run the gate**: + ```bash + npm test + npm run lint + npm run validate:plugin + ``` +4. **Commit** with a conventional message (see below). +5. **Push** to a feature branch and open a PR. + +## Commit message format + +We loosely follow [Conventional Commits](https://www.conventionalcommits.org/): + +``` +(): + + +