Add plugin: mcode-webui (round 5 — supersedes #16)

[modacker]

Supersedes #16 — round 5 fix by @modacker

⚠️ MERGE STRATEGY: Create a merge commit (NOT Squash, NOT Rebase)

Per @Wzdhehe 2026-08-27 18:50 CST — m3 老师 (= MiniMax M3) suggested this.
All 12 commits preserved in history (9 Wzdhehe cherry-picks + modacker round 5/6/7 fixes).
When merging this PR, select "Create a merge commit" in the dropdown.

---

Round 5 of the mcode-webui plugin submission, addressing the
remaining CHANGES_REQUESTED items from @hetaoBackend's 2026-08-27 01:34Z
review on #16 (commit 99dd587). This PR reuses @Wzdhehe's 9 commits
via cherry-pick (authorship preserved) and adds three modacker fix
commits (round 5 + round 6 + round 7 — Token Plan integration).

@Wzdhehe — your round 4 still had two open blockers. Both fixed in
round 5 + round 6. If this lands, #16 will auto-close (see
Closes #16 at the bottom).

---

🆕 Round 7 — Token Plan integration (commit 091dec5, modacker)

This was driven by user-facing bug reports during dogfooding:
the "套餐用量" / Token Plan feature shipped in the round-2 v1.0.1
era was broken on multiple layers. Round 7 fixes 5 independent bugs
and adds 1 feature. All verified end-to-end with the user's real
Subscription Key against the live https://www.minimaxi.com/v1/token_plan/remains
endpoint.

5 core bug fixes

1. SSE clobber wiped quotaEnabled on every push — root cause was
   the SSE snapshot missing quotaEnabled / hasTokenPlanKey /
   tokenPlanApiKeyMasked, so the next state=JSON.parse(ev.data)
   replaced local state with undefined, and btn.classList.toggle('usage-hidden', !undefined)
   re-hidden the button. Fixed in all 4 snapshot sites
   (state-bus.js × 3, routes/state.js × 2) and defensive preserve in
   client SSE onmessage (mirrors the existing askUserAnswers pattern).

2. 4 missing imports in events.js (closeApiKeyModal,
   openApiKeyModal, setLeftOpen, setRightOpen) — ReferenceError
   at attachEvents init crashed the whole JS bootstrap. Modal
   handlers added without updating the import line.

3. server/lib/usage.js parser read wrong field path + had a
   field-name typo:

   • Read data?.current_interval_remaining_percent (top level) —
     always undefined. Real API nests it under
     model_remains[i].current_interval_remaining_percent.
   • Used current_weekly_remaining_pct (with pct suffix) — always
     undefined. Correct name: current_weekly_remaining_percent.
   • Symptom: API call returned 200, but popover always showed "—".
   • Fix: extracted pure parseTokenPlanResponse(data, cs) function
     • added cs.usage.raw (8 KB cap) for future debugging.
   • End-to-end verified with real key: fiveHourPercent: 25, weekly: 51%, fiveHourReset: 1787864400, error: null, raw: 990B.

4. <input type="password" id="api-key-modal-input"> made the whole
   page a "credential form" for Chrome autofill, so EVERY text
   input on the page (including the session search) got email
   autofill injected. The other mitigations
   (autocomplete=off / readonly / data-1p-ignore) were bandaids.

   • Fix: type="password" → type="text" + .secret-input class
   • CSS: -webkit-text-security: disc + monospace + letter-spacing
     (visually a password box, semantically NOT a password field)
   • This is the actual root cause of the stubborn search-input autofill.

5. 5 <label class="lan-card-row-label"> had no associated form
   field (DevTools a11y warning). Converted to <div> (row titles,
   not form labels) and added explicit for= on each toggle's label.

1 new feature: external Token Plan key sources

Per user request ("我不想在前端重复输入 mcode 已经在用的 key"):

• env: MCODE_WEBUI_TOKEN_PLAN_KEY (mirrors the existing
  process.env.TOKEN override pattern for the LAN auth token)
• file: ~/.minimax/credentials/token-plan.json (raw or
  {"key": "..."} JSON), path overridable via
  MCODE_WEBUI_TOKEN_PLAN_KEY_FILE
• Priority chain: env > file > settings.json (env always wins)
• Auto-enable: when env/file provides a key, quotaEnabled
  flips to true automatically — operator who set the env / wrote
  the file already committed to the feature.
• UI surface: popover button text + modal status line show
  source as · env / · file: /path/to/file; "delete" button is
  hidden when source is external (operator must unset at the source,
  not in the webui).

Test coverage (16 new tests, +16 from 393 → 409)

• test/state-bus.test.js: 6 tests — settings / file / env priority
  chain, live downgrade env → file → settings, broadcast carries
  source, empty-state behavior, 3 quota-field regression tests
  (per-cid / broadcast / pushOnlineCount all carry the 3 fields)
• test/usage.test.js (new file): 7 tests — real API fixture pins
  exact wire shape (model_remains[0] / current_*_remaining_percent),
  end_time ms→s conversion, no-general-entry fallback, missing
  fields return null, base_resp.status_code error path

Full suite: 409 pass / 0 fail / 2 skipped (was 393 / 0 / 2)

Files changed in round 7 (15 files, +1815 / -100)

.gitignore (drop .server.err + .webui-sessions.json runtime artifacts)
public/app/events.js
public/app/i18n.js
public/app/render.js
public/app/state.js
public/index.html
public/styles/main.css
server/lib/settings.js
server/lib/state-bus.js
server/lib/usage.js
server/routes/settings.js
server/routes/state.js
test/_setup.js
test/state-bus.test.js
test/usage.test.js

i18n / UX

• 启用 → 显示套餐用量 (en: Enabled → Show usage)
• New strings: quota_source_env, quota_source_file, delete-disabled
  hint, input placeholders for external sources
• Help text: was "关闭后,按钮仍显示,但点开是降级提示" (old
  behavior); now "关闭后,套餐用量按钮在主界面消失" (current
  behavior)

Plugin/host scope note

Per modacker's review (docs/REVIEW-sihankor-baselines-2026-08-28.md,
docs/BORROW-dsh-deepseek-harness-2026-08-28.md — both kept in
modacker's local tree, not part of this PR), Token Plan integration
is plugin-scope only. The mcode host still writes to its own
sqlite without webui gating (out of plugin scope; needs mcode team
to ship event:audit + event:anomaly + permission:request hooks
to enable Baseline 1 + Baseline 4 governance).

Future governance work (upstream issues)

Round 7 closes the immediate Token Plan bugs but the broader
governance gap (SiHankor baselines 1 / 3 / 4 + prohibitions 1 / 4 / 5)
requires follow-on work. Tracked in upstream issues (filed by
@modacker, this PR is the entry point for the series):

• [Stage 1 / P0] governance: event log + per-request authorize + anomaly channel #24 — [Stage 1 / P0] governance: event log + per-request
  authorize + anomaly channel
  → closes Baseline 1 / 3 / 4 + prohibitions 1 / 4 / 5
• [Stage 2 / P0] UX: first-run token modal + drop ?token= on first access #25 — [Stage 2 / P0] UX: first-run token modal + drop
  ?token= on first access
  → removes stdout token leak
• [Stage 2 / P1] UX: slash command autocomplete + settings card grouping #26 — [Stage 2 / P1] UX: slash command autocomplete + settings
  card grouping
• [Stage 3 / P2] refactor: split slash.js into interaction/ + feedback/ subsystems #27 — [Stage 3 / P2] refactor: split slash.js into
  interaction/ + feedback/ subsystems
• [host-scope] mcode team hooks: event:audit + event:anomaly + permission:request #28 — [host-scope] mcode team hooks: event:audit +
  event:anomaly + permission:request
  → not a plugin task; flagged ⚠️ for forwarding to the mcode team.
  Plugin-side issues [Stage 1 / P0] governance: event log + per-request authorize + anomaly channel #24 / [Stage 2 / P1] UX: slash command autocomplete + settings card grouping #26 will reference [host-scope] mcode team hooks: event:audit + event:anomaly + permission:request #28 as a dependency
  before merging the "combined audit view" UI work.

Plugin maintainer (@Wzdhehe) does not need to action all 5 — only
the plugin-scope ones (24, 25, 26, 27). Issue #28 is for the mcode
team.

---

Round 5 fixes (commit 0dbdacd) — preserved from prior PR body

[unchanged from prior PR body — round 5 content preserved below]

Round 5 of the mcode-webui plugin submission, addressing the
remaining CHANGES_REQUESTED items from @hetaoBackend's 2026-08-27 01:34Z
review on #16 (commit 99dd587). This PR reuses @Wzdhehe's 9 commits
via cherry-pick (authorship preserved) and adds two modacker fix
commits (round 5 + round 6).

✅ Test verification (modacker real mcode env, no env override)

Before round 6: 387 pass / 4 fail / 2 skipped
After round 6:  391 pass / 0 fail / 2 skipped
After round 7:  409 pass / 0 fail / 2 skipped

All integration tests (happy path × 2, table-missing × 2) now find
and load better-sqlite3 via the new ~/.minimax-code/lib/node_modules/...
standard-install candidate.

What's in this PR

• 9 cherry-picked commits by @Wzdhehe (a9d8aa1 → 99dd587), unchanged:
  • Add plugin: mcode-webui
  • docs: rename product name mcode → Mcode in plugin tree docs
  • fix: revert SKILL.md frontmatter name to mcode-webui; strip CRLF
  • fix: revert path references to mcode-webui (directory name is fixed lowercase by spec)
  • chore: update GitHub URLs after Mcode-webui rename
  • feat: v1.0.1 — token auth gate + LAN sub-card + read-only mode
  • fix: CORS preflight exemption + cross-origin Authorization support
  • fix: round 3 review fixes (auth.js setters + startup smoke test + doc sync)
  • fix: round 4 — db.js better-sqlite3 path resolver for non-canonical install layouts
• 3 modacker fix commits:
  • round 5 (0dbdacd): fix better-sqlite3 resolver MCODE_CMD path traversal + deleteMcodeSessionFromDb error priority
  • round 6 (c448424): add standard install candidate (npm-style + flat + ~/.minimax-code/lib/...) so macOS dev box integration tests find better-sqlite3
  • round 7 (091dec5): Token Plan integration end-to-end (5 fixes + 1 feature, 16 new tests)

Round 5 fixes (commit 0dbdacd)

1. better-sqlite3 candidate resolver — MCODE_CMD path traversal

server/lib/db.js::_getBetterSqlite3Candidates was using:

join(MCODE_CMD, "..", "..", "node_modules", "@minimax-ai", "code", "node_modules", "better-sqlite3")

MCODE_CMD is the mcode executable file (e.g. ~/.minimax-code/mcode.cmd or /usr/local/bin/mcode).
The code treated it as a directory and went 3 levels above the install root,
landing at e.g. /Users/moc/node_modules/... instead of /Users/moc/.minimax-code/node_modules/....

Tests

lib-db-resolver.test.js: 10/10 pass (5 existing + 5 install-layout: mcode.cmd, /usr/local/bin/mcode, PATH placeholder, standard install, npm-style + flat both)
lib-db.test.js input validation: 5/5 pass (including the previously-failing
mcode_db_not_found priority test that round 5 unblocks)
lib-db.test.js happy-path / table-missing: 2/2 pass (round 6 fixes)
sessions.test.js: all deleteMcodeSessionFromDb tests pass

Full npm test after round 7: 409 pass / 0 fail / 2 skipped (skipped are pre-existing).

Co-authored-by

9 cherry-picked commits retain @Wzdhehe as author.
Round 5, round 6, and round 7 commits are by @modacker.

Closes #16
Reviewers: @Wzdhehe @hetaoBackend

[Wzdhehe]

@modacker 谢谢老哥，不过合并时能不能用 "Create a merge commit"（不要 Squash），m3老师建议我这样评论 @hetaoBackend

[modacker]

@Wzdhehe @hetaoBackend

Round 6 落地 + 整合测全过(modacker 本机 mcode 环境下验证)

Round 5 之后我跑测试发现 4 个 fail,本以为是环境问题(没装 mcode)— 后来确认本机 mcode 装着的,是我之前没找对路径。Round 6 加了 标准安装候选 + npm-style 布局候选,现在:

Before round 6: 387 pass / 4 fail / 2 skipped
After round 6:  391 pass / 0 fail / 2 skipped

修的具体点:

• MCODE_CMD 在 macOS 上解析为 PATH 占位符 "mcode"(不是路径),因为 config.js 检测链只认 mcode.cmd,本机是 mcode。Round 5 的 MCODE_CMD-derived 分支整个跳过,dev layout fallback 又指错位置
• Round 6 加了 <home>/.minimax-code/lib/node_modules/... 始终尝试,不依赖 MCODE_CMD
• MCODE_CMD 若是真路径(Win/Linux),同时尝试 npm-style(<root>/bin/mcode → <root>/lib/node_modules/...)和 flat(<root>/node_modules/...)两种布局

测试在真实 mcode 安装的 modacker 本机跑(无 env override),全部通过。

合并策略

收到 @Wzdhehe 2026-08-27 18:50 CST 评论,用 "Create a merge commit",不要 Squash。这条是给 maintainer 看的——点 merge 时下拉选 Create a merge commit,保留全部 11 个 commit 历史。

请 @hetaoBackend 复核

特别是 09:34 那条 CHANGES_REQUESTED 指出的两点:

1. ✓ MCODE_CMD 当目录用 → 修(round 5 + round 6 都涉及)
2. ✓ deleteMcodeSessionFromDb 错误优先级反了 → 修(round 5 把 db path 检查前移,lib-db.test.js:65 那个测现在过)

跑一遍 npm test 应该直接全绿。

cc @Wzdhehe 合并策略已记。

[Wzdhehe]

加油老哥，不过他们开放的东西就是有点少，我提交过反馈了，你可以关注tui更新日志，他们有时候会开放更多权限

[hetaoBackend]

Current head 091dec5 has passing local unit coverage, but the router has a CSRF/token-disclosure blocker. server/router.js:279-309 sets Access-Control-Allow-Origin: * and allows API requests from local addresses without a token; server/lib/auth.js:113-120 makes every local request authorized; server/routes/settings.js:28-30 returns the settings snapshot, including the bootstrap token before acknowledgement. I reproduced this with HOST=127.0.0.1: a POST /api/settings with Origin: https://evil.example and no Authorization returned 200 with Access-Control-Allow-Origin: * and the bootstrap-token field. A malicious webpage can therefore read the local token and issue state-changing API requests. Please remove the local browser bypass or add strict Origin/CSRF protection, never return bootstrap tokens to cross-origin callers, and add regression tests for unauthenticated cross-origin GET/POST/DELETE. [code]smith is SKIPPED.