fix(web-ui): serve copied session links

awsl233777 · awsl233777 · commit 5f269536d20f · 2026-06-04T04:39:46.000Z
diff --git a/cli.js b/cli.js
@@ -10461,6 +10461,7 @@ function assertRequestAuthorized(req, res) {
 
 function isProtectedWebSurfacePath(requestPath) {
     return requestPath === '/'
+        || requestPath === '/session'
         || requestPath === '/web-ui/index.html'
         || requestPath.startsWith('/web-ui/')
         || requestPath.startsWith('/res/');
@@ -11889,8 +11890,8 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
             });
             fs.createReadStream(filePath).pipe(res);
         } else {
-            // Only serve HTML for root path; /web-ui returns 404.
-            if (requestPath === '/') {
+            // Serve the SPA shell for routable entry points. Keep /web-ui as 404.
+            if (requestPath === '/' || requestPath === '/session') {
                 try {
                     const html = readBundledWebUiHtml(htmlPath);
                     res.writeHead(200, {
diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs
@@ -135,10 +135,19 @@ const releaseRunPortIfNeededSource = extractFunctionBySignature(
     'function releaseRunPortIfNeeded(port, host, deps = {}) {',
     'releaseRunPortIfNeeded'
 );
+const isProtectedWebSurfacePathSource = extractFunctionBySignature(
+    cliContent,
+    'function isProtectedWebSurfacePath(requestPath) {',
+    'isProtectedWebSurfacePath'
+);
 const resolveWebHost = instantiateFunction(resolveWebHostSource, 'resolveWebHost', {
     DEFAULT_WEB_HOST: defaultHostMatch[1],
     process: { env: {} }
 });
+const isProtectedWebSurfacePath = instantiateFunction(
+    isProtectedWebSurfacePathSource,
+    'isProtectedWebSurfacePath'
+);
 
 test('resolveWebHost defaults to LAN host', () => {
     assert.strictEqual(resolveWebHost({}), '127.0.0.1');
@@ -891,6 +900,7 @@ function mockWriteJsonResponse(res, statusCode, payload, headers = {}) {
 
 function mockIsProtectedWebSurfacePath(requestPath) {
     return requestPath === '/'
+        || requestPath === '/session'
         || requestPath === '/web-ui/index.html'
         || requestPath.startsWith('/web-ui/')
         || requestPath.startsWith('/res/');
@@ -932,6 +942,11 @@ test('assertRequestAuthorized returns a basic auth challenge for unauthorized re
     assert.strictEqual(response.body, '{\n  "error": "Unauthorized"\n}');
 });
 
+test('isProtectedWebSurfacePath protects standalone session links', () => {
+    assert.strictEqual(isProtectedWebSurfacePath('/session'), true);
+    assert.strictEqual(isProtectedWebSurfacePath('/session/extra'), false);
+});
+
 test('resolveSkillTarget still falls back to default target when target is omitted', () => {
     assert.deepStrictEqual(resolveSkillTarget({}), SKILL_TARGETS[0]);
     assert.deepStrictEqual(resolveSkillTarget({ items: [] }), SKILL_TARGETS[0]);
@@ -984,6 +999,44 @@ test('createWebServer redirects bundled index URL to the canonical root URL', ()
     assert.deepStrictEqual(errors, []);
 });
 
+test('createWebServer serves the SPA shell for standalone session links', () => {
+    const { requestHandler, errors } = createWebServerHarness({
+        htmlReader() {
+            return '<!doctype html><title>standalone session</title>';
+        }
+    });
+    const response = createMockResponse();
+
+    requestHandler({ url: '/session?source=codex&sessionId=session-1' }, response);
+
+    assert.strictEqual(response.statusCode, 200);
+    assert.strictEqual(response.body, '<!doctype html><title>standalone session</title>');
+    assert.deepStrictEqual(errors, []);
+});
+
+test('createWebServer requires auth before serving standalone session links to remote clients', () => {
+    const calls = [];
+    const { requestHandler, errors } = createWebServerHarness({
+        htmlReader() {
+            throw new Error('html should not be read before auth');
+        },
+        authorizeRequest(req, res) {
+            calls.push(req.url);
+            res.writeHead(401, { 'Content-Type': 'application/json; charset=utf-8' });
+            res.end('{"error":"Unauthorized"}');
+            return { ok: false, mode: 'unauthorized' };
+        }
+    });
+    const response = createMockResponse();
+
+    requestHandler({ url: '/session?source=codex&sessionId=session-1', socket: { remoteAddress: '192.0.2.10' } }, response);
+
+    assert.strictEqual(response.statusCode, 401);
+    assert.deepStrictEqual(calls, ['/session?source=codex&sessionId=session-1']);
+    assert.strictEqual(response.body, '{"error":"Unauthorized"}');
+    assert.deepStrictEqual(errors, []);
+});
+
 test('createWebServer requires auth before serving root page to remote clients', () => {
     const calls = [];
     const { requestHandler, errors } = createWebServerHarness({
diff --git a/tests/unit/web-ui-startup-init.test.mjs b/tests/unit/web-ui-startup-init.test.mjs
@@ -203,3 +203,148 @@ test('mounted skips auxiliary startup requests when loadAll fails', async () =>
         assert.strictEqual(syncDefaultOpenclawCalls, 0);
     });
 });
+
+function createStartupMountContext(overrides = {}) {
+    return {
+        mainTab: 'dashboard',
+        configMode: 'codex',
+        settingsTab: 'general',
+        sessionResumeWithYolo: true,
+        claudeConfigs: {},
+        openclawConfigs: {
+            '默认配置': {
+                content: ''
+            }
+        },
+        currentOpenclawConfig: '',
+        switchedTabs: [],
+        initSessionStandaloneCalls: [],
+        initSessionStandalone() {
+            this.initSessionStandaloneCalls.push(window.location.href);
+        },
+        switchMainTab(tab) {
+            this.switchedTabs.push(tab);
+            this.mainTab = tab;
+        },
+        updateCompactLayoutMode() {},
+        restoreSessionFilterCache() {},
+        restoreSessionPinnedMap() {},
+        normalizeShareCommandPrefix(value) {
+            return value || 'npm start';
+        },
+        normalizeSessionTrashEnabled(value) {
+            return value !== '0' && value !== 'false';
+        },
+        normalizeSessionTrashRetentionDays(value) {
+            const numeric = Number(value);
+            if (!Number.isFinite(numeric) || numeric < 1) return 30;
+            return Math.min(365, Math.max(1, Math.floor(numeric)));
+        },
+        onWindowResize() {},
+        handleGlobalKeydown() {},
+        handleBeforeUnload() {},
+        refreshClaudeSelectionFromSettings() {
+            return Promise.resolve();
+        },
+        syncDefaultOpenclawConfigEntry() {
+            return Promise.resolve();
+        },
+        loadAll() {
+            return Promise.resolve(true);
+        },
+        ...overrides
+    };
+}
+
+function createMutableWindowLocation(initialHref) {
+    const location = {
+        href: '',
+        origin: '',
+        pathname: '',
+        search: '',
+        hash: '',
+        replace(nextHref) {
+            apply(nextHref);
+        }
+    };
+    function apply(nextHref) {
+        const url = new URL(nextHref, location.href || initialHref);
+        location.href = url.href;
+        location.origin = url.origin;
+        location.pathname = url.pathname;
+        location.search = url.search;
+        location.hash = url.hash;
+    }
+    apply(initialHref);
+    return { location, apply };
+}
+
+function createStartupMountGlobals(initialHref, replacements = []) {
+    const mutable = createMutableWindowLocation(initialHref);
+    return {
+        document: {
+            readyState: 'complete'
+        },
+        localStorage: {
+            getItem() {
+                return null;
+            },
+            setItem() {},
+            removeItem() {}
+        },
+        window: {
+            location: mutable.location,
+            history: {
+                replaceState(_state, _title, nextHref) {
+                    replacements.push(String(nextHref));
+                    mutable.apply(nextHref);
+                }
+            },
+            addEventListener() {},
+            removeEventListener() {}
+        },
+        requestAnimationFrame(callback) {
+            return callback;
+        },
+        cancelAnimationFrame() {},
+        setTimeout(callback) {
+            return callback;
+        },
+        clearTimeout() {}
+    };
+}
+
+test('mounted preserves standalone session query parameters before standalone initialization', async () => {
+    const appOptions = await captureCurrentBundledAppOptions();
+    const context = createStartupMountContext();
+    const replacements = [];
+
+    await withGlobalOverrides(
+        createStartupMountGlobals('http://127.0.0.1:3737/session?source=codex&sessionId=pr187-browser-link', replacements),
+        async () => {
+            appOptions.mounted.call(context);
+        }
+    );
+
+    assert.deepStrictEqual(replacements, []);
+    assert.deepStrictEqual(context.initSessionStandaloneCalls, [
+        'http://127.0.0.1:3737/session?source=codex&sessionId=pr187-browser-link'
+    ]);
+});
+
+test('mounted consumes shareable sessions tab URLs before canonical cleanup', async () => {
+    const appOptions = await captureCurrentBundledAppOptions();
+    const context = createStartupMountContext();
+    const replacements = [];
+
+    await withGlobalOverrides(
+        createStartupMountGlobals('http://127.0.0.1:3737/?tab=sessions', replacements),
+        async () => {
+            appOptions.mounted.call(context);
+        }
+    );
+
+    assert.deepStrictEqual(replacements, []);
+    assert.deepStrictEqual(context.switchedTabs, ['sessions']);
+    assert.strictEqual(context.mainTab, 'sessions');
+});
diff --git a/web-ui/app.js b/web-ui/app.js
@@ -459,13 +459,9 @@ document.addEventListener('DOMContentLoaded', () => {
                     window.location.replace(url.toString());
                     return;
                 }
-                // 清理任何查询参数和 hash，保持 URL 为 /
-                if (window.location.search || window.location.hash) {
-                    const url = new URL(window.location.href);
-                    url.search = '';
-                    url.hash = '';
-                    window.history.replaceState(null, '', url.toString());
-                }
+                // Do not strip query/hash during startup: /session uses them to identify the
+                // standalone session, and shareable tab/filter URLs are consumed below before
+                // later runtime canonicalization can clean the address bar.
             } catch (_) {}
 
             if (typeof this.initI18n === 'function') {
