fix: 修复标题归属并更新发布包

server.js

@@ -83,7 +83,8 @@ const CODEX_PATH = process.env.CODEX_PATH || 'codex';
 const INTERNAL_MCP_TOKEN = process.env.CC_WEB_INTERNAL_MCP_TOKEN || crypto.randomBytes(32).toString('hex');
 const CONFIG_DIR = process.env.CC_WEB_CONFIG_DIR || path.join(APP_DIR, 'config');
 const SESSIONS_DIR = process.env.CC_WEB_SESSIONS_DIR || path.join(APP_DIR, 'sessions');
-const PUBLIC_DIR = process.env.CC_WEB_PUBLIC_DIR || path.join(APP_DIR, 'public');
+const PUBLIC_DIR = path.resolve(process.env.CC_WEB_PUBLIC_DIR || path.join(APP_DIR, 'public'));
+const PUBLIC_INDEX_PATH = path.join(PUBLIC_DIR, 'index.html');
 const LOGS_DIR = process.env.CC_WEB_LOGS_DIR || path.join(APP_DIR, 'logs');
 const ATTACHMENTS_DIR = path.join(SESSIONS_DIR, '_attachments');
 const ATTACHMENT_TTL_MS = 7 * 24 * 60 * 60 * 1000;
@@ -113,6 +114,20 @@ const SESSION_TRANSPORT_MAX_TOOL_CALLS_PER_MESSAGE = readPositiveIntEnv('CC_WEB_
 const HISTORY_PREFETCH_CHUNKS = readPositiveIntEnv('CC_WEB_HISTORY_PREFETCH_CHUNKS', 3, { min: 0, max: 20 });
 const HISTORY_MAX_CHUNKS_PER_LOAD = readPositiveIntEnv('CC_WEB_HISTORY_MAX_CHUNKS_PER_LOAD', 8, { min: 1, max: 100 });
 const CODEX_APP_STATE_MAX_BYTES = readPositiveIntEnv('CC_WEB_CODEX_APP_STATE_MAX_BYTES', 2 * 1024 * 1024, { min: 128 * 1024 });
+
+function computeFrontendAssetVersion() {
+  try {
+    const appSource = fs.readFileSync(path.join(PUBLIC_DIR, 'app.js'));
+    return crypto.createHash('sha256').update(appSource).digest('hex').slice(0, 16);
+  } catch {
+    return '';
+  }
+}
+
+function injectFrontendAssetVersion(indexHtml) {
+  const frontendAssetVersion = computeFrontendAssetVersion();
+  return String(indexHtml || '').replaceAll('__CC_WEB_FRONTEND_ASSET_VERSION__', frontendAssetVersion);
+}
 const CODEX_APP_STATE_LOAD_MAX_BYTES = readPositiveIntEnv('CC_WEB_CODEX_APP_STATE_LOAD_MAX_BYTES', 4 * 1024 * 1024, { min: CODEX_APP_STATE_MAX_BYTES });
 const CODEX_APP_STATE_FULL_TEXT_MAX_CHARS = readPositiveIntEnv('CC_WEB_CODEX_APP_STATE_FULL_TEXT_MAX_CHARS', 192 * 1024, { min: 4096 });
 const CODEX_APP_STATE_MAP_VALUE_MAX_CHARS = readPositiveIntEnv('CC_WEB_CODEX_APP_STATE_MAP_VALUE_MAX_CHARS', 16 * 1024, { min: 1024 });
@@ -6688,7 +6703,7 @@ const server = http.createServer((req, res) => {
   let filePath = path.join(PUBLIC_DIR, url.pathname === '/' ? 'index.html' : url.pathname);
   filePath = path.resolve(filePath);
 
-  if (!filePath.startsWith(PUBLIC_DIR)) {
+  if (!isPathInside(PUBLIC_DIR, filePath)) {
     res.writeHead(403);
     return res.end('Forbidden');
   }
@@ -6699,11 +6714,14 @@ const server = http.createServer((req, res) => {
       return res.end('Not Found');
     }
     const ext = path.extname(filePath);
+    const responseData = filePath === PUBLIC_INDEX_PATH
+      ? Buffer.from(injectFrontendAssetVersion(data), 'utf8')
+      : data;
     res.writeHead(200, {
       'Content-Type': MIME_TYPES[ext] || 'application/octet-stream',
       'Cache-Control': 'no-store, max-age=0',
     });
-    res.end(data);
+    res.end(responseData);
   });
 });
 
@@ -6782,6 +6800,7 @@ wss.on('connection', (ws, req) => {
           success: true,
           token: authToken,
           mustChangePassword: !!authConfig.mustChange,
+          frontendAssetVersion: computeFrontendAssetVersion(),
           features: { usageStatistics: USAGE_STATISTICS_ENABLED },
         });
         sendSessionList(ws);