auto-save 2026-04-29 16:28 (~3)

src/app.js

@@ -353,6 +353,37 @@ function switchTab(name) {
   }
 }
 
+// ---------- 带认证续期的 fetch ----------
+// nginx 的 hermes_auth cookie 默认 24h 过期；过期后 /api/v1/* 全部 401。
+// 这里在 401 时尝试一次静默续期（浏览器若缓存了 Basic Auth 会自动带上），
+// 续期失败再跳登录页，避免对话直接抛 "HTTP 401"。
+let _renewing = null;
+async function renewAuth() {
+  if (_renewing) return _renewing;
+  _renewing = (async () => {
+    try {
+      const r = await fetch("/_auth/verify", { credentials: "same-origin", cache: "no-store" });
+      return r.ok;
+    } catch (e) {
+      return false;
+    } finally {
+      setTimeout(() => { _renewing = null; }, 0);
+    }
+  })();
+  return _renewing;
+}
+async function apiFetch(url, init) {
+  const res = await fetch(url, init);
+  if (res.status !== 401) return res;
+  if (await renewAuth()) {
+    return fetch(url, init);
+  }
+  if (!location.pathname.endsWith("/login.html")) {
+    location.href = "/login.html";
+  }
+  return res;
+}
+
 // ---------- 健康检查 ----------
 async function pingBackend() {
   const pill = document.getElementById("sideStatus");
@@ -360,7 +391,7 @@ async function pingBackend() {
   const statApi = document.getElementById("statApi");
   const statApiSub = document.getElementById("statApiSub");
   try {
-    const res = await fetch(state.apiBase + "/models", {
+    const res = await apiFetch(state.apiBase + "/models", {
       headers: { "Authorization": "Bearer " + state.apiKey },
       signal: AbortSignal.timeout(4000),
     });
@@ -483,7 +514,7 @@ async function sendMessage(text) {
     if (state.stream) {
       await streamChat(body, assistantMsg);
     } else {
-      const res = await fetch(state.apiBase + "/chat/completions", {
+      const res = await apiFetch(state.apiBase + "/chat/completions", {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -514,7 +545,7 @@ async function sendMessage(text) {
 }
 
 async function streamChat(body, assistantMsg) {
-  const res = await fetch(state.apiBase + "/chat/completions", {
+  const res = await apiFetch(state.apiBase + "/chat/completions", {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -809,7 +840,7 @@ async function refreshDashboard() {
   pingBackend();
   // 模型列表
   try {
-    const res = await fetch(state.apiBase + "/models", {
+    const res = await apiFetch(state.apiBase + "/models", {
       headers: { "Authorization": "Bearer " + state.apiKey },
       signal: AbortSignal.timeout(4000),
     });
@@ -1783,7 +1814,7 @@ async function runClusterOne(agent, prompt, col) {
       { role: "system", content: composeSystemPrompt(agent) },
       { role: "user", content: prompt },
     ];
-    const res = await fetch(state.apiBase + "/chat/completions", {
+    const res = await apiFetch(state.apiBase + "/chat/completions", {
       method: "POST",
       headers: {
         "Content-Type": "application/json",

src/sw.js

@@ -1,6 +1,6 @@
 // 爱马仕 Hermes · 轻量 Service Worker
-// 只缓存静态壳,API 请求始终联网
-const CACHE = "hermes-ui-v6";
+// 静态壳走 network-first（拿不到再回退缓存），API 直通
+const CACHE = "hermes-ui-v7";
 const ASSETS = [
   "./",
   "./index.html",
@@ -26,10 +26,22 @@ self.addEventListener("activate", (e) => {
 
 self.addEventListener("fetch", (e) => {
   const url = new URL(e.request.url);
-  // API 请求直通
+  // API / 鉴权 / skill 索引等动态资源全部直通
   if (url.pathname.startsWith("/api/")) return;
-  // 其他静态资源走 cache-first
+  if (url.pathname.startsWith("/_auth/")) return;
+  if (url.pathname.startsWith("/hermes-skills/")) return;
+  if (e.request.method !== "GET") return;
+
+  // 静态壳：network-first，离线再回退到缓存
   e.respondWith(
-    caches.match(e.request).then((hit) => hit || fetch(e.request))
+    fetch(e.request)
+      .then((res) => {
+        if (res && res.ok) {
+          const copy = res.clone();
+          caches.open(CACHE).then((c) => c.put(e.request, copy)).catch(() => {});
+        }
+        return res;
+      })
+      .catch(() => caches.match(e.request).then((hit) => hit || Response.error()))
   );
 });