@cjhyy/code-shell-chat 0.8.9 → 0.8.10

package/dist/config.js

@@ -1,7 +1,10 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, openSync, readFileSync, statSync, } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { defaultWechatDataDirectory, FileWechatCredentialStore } from "./wechat-storage.js";
+const MAX_CONFIG_BYTES = 4 * 1024 * 1024;
+const MAX_CONFIG_STRING_CHARS = 32_768;
+const MAX_CONFIG_LIST_ITEMS = 10_000;
 export function defaultGatewayConfigPath(env = process.env) {
     return join(resolveHome(env), ".code-shell", "im-gateway", "config.json");
 }
@@ -131,12 +134,12 @@ export function loadGatewayConfig(opts = {}) {
             autoLaunch: raw.desktop?.autoLaunch !== false,
             command: configuredCommand ?? defaultLaunch.command,
             args: configuredArgs ?? (configuredCommand ? [] : defaultLaunch.args),
-            startupTimeoutMs: readPositiveNumber(raw.desktop?.startupTimeoutMs) ?? 30_000,
+            startupTimeoutMs: readPositiveNumber(raw.desktop?.startupTimeoutMs, 5 * 60_000) ?? 30_000,
         },
         webhook: {
             host: readNonEmptyString(raw.webhook?.host) ?? "127.0.0.1",
             port: readPort(raw.webhook?.port) ?? 8787,
-            maxBodyBytes: readPositiveNumber(raw.webhook?.maxBodyBytes) ?? 1_048_576,
+            maxBodyBytes: readPositiveNumber(raw.webhook?.maxBodyBytes, 16 * 1024 * 1024) ?? 1_048_576,
         },
         runtime: {
             lockPath: readNonEmptyString(raw.runtime?.lockPath) ??
@@ -145,12 +148,12 @@ export function loadGatewayConfig(opts = {}) {
                 join(resolveHome(env), ".code-shell", "im-gateway", "inbox.json"),
             eventCursorPath: readNonEmptyString(raw.runtime?.eventCursorPath) ??
                 join(resolveHome(env), ".code-shell", "im-gateway", "desktop-events.json"),
-            maxPending: readPositiveInteger(raw.runtime?.maxPending) ?? 1_000,
-            maxConcurrent: readPositiveInteger(raw.runtime?.maxConcurrent) ?? 4,
-            maxPerTarget: readPositiveInteger(raw.runtime?.maxPerTarget) ?? 1,
-            maxMessagesPerUserPerMinute: readPositiveInteger(raw.runtime?.maxMessagesPerUserPerMinute) ?? 20,
-            adapterRestartBaseMs: readPositiveInteger(raw.runtime?.adapterRestartBaseMs) ?? 1_000,
-            adapterRestartMaxMs: readPositiveInteger(raw.runtime?.adapterRestartMaxMs) ?? 30_000,
+            maxPending: readPositiveInteger(raw.runtime?.maxPending, 100_000) ?? 1_000,
+            maxConcurrent: readPositiveInteger(raw.runtime?.maxConcurrent, 64) ?? 4,
+            maxPerTarget: readPositiveInteger(raw.runtime?.maxPerTarget, 16) ?? 1,
+            maxMessagesPerUserPerMinute: readPositiveInteger(raw.runtime?.maxMessagesPerUserPerMinute, 100_000) ?? 20,
+            adapterRestartBaseMs: readPositiveInteger(raw.runtime?.adapterRestartBaseMs, 24 * 60 * 60_000) ?? 1_000,
+            adapterRestartMaxMs: readPositiveInteger(raw.runtime?.adapterRestartMaxMs, 24 * 60 * 60_000) ?? 30_000,
         },
         notifications: [],
     };
@@ -398,18 +401,32 @@ function loadAllowlist(name, raw, env, targetEnv, userEnv, rawTargetKey) {
     return { allowedTargetIds, allowedUserIds };
 }
 function readRawConfig(configPath) {
-    if (!existsSync(configPath))
-        return {};
+    let fd;
     try {
-        const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+        const entry = lstatSync(configPath);
+        if (entry.isSymbolicLink() || !entry.isFile() || entry.size > MAX_CONFIG_BYTES) {
+            throw new Error(`config must be a regular file no larger than ${MAX_CONFIG_BYTES} bytes`);
+        }
+        fd = openSync(configPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const opened = fstatSync(fd);
+        if (!opened.isFile() || opened.size > MAX_CONFIG_BYTES) {
+            throw new Error(`config must be a regular file no larger than ${MAX_CONFIG_BYTES} bytes`);
+        }
+        const parsed = JSON.parse(readFileSync(fd, "utf-8"));
         if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
             throw new Error("top-level value must be an object");
         }
         return parsed;
     }
     catch (error) {
+        if (error.code === "ENOENT")
+            return {};
         throw new Error(`无法读取 IM gateway 配置 ${configPath}：${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
 }
 function sectionEnabled(raw, ...values) {
     if (raw?.enabled === false)
@@ -425,13 +442,18 @@ function envString(env, key) {
     return readNonEmptyString(env[key]);
 }
 function readNonEmptyString(value) {
-    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+    return typeof value === "string" && value.length <= MAX_CONFIG_STRING_CHARS && value.trim()
+        ? value.trim()
+        : undefined;
 }
 function readStringList(value, fallbackToEmpty = true) {
     if (value === undefined && !fallbackToEmpty)
         return undefined;
     if (!Array.isArray(value))
         return [];
+    if (value.length > MAX_CONFIG_LIST_ITEMS) {
+        throw new Error(`配置列表最多包含 ${MAX_CONFIG_LIST_ITEMS} 项`);
+    }
     return [
         ...new Set(value.map(readNonEmptyString).filter((item) => Boolean(item))),
     ];
@@ -439,18 +461,28 @@ function readStringList(value, fallbackToEmpty = true) {
 function readCsvOverride(value) {
     if (value === undefined)
         return undefined;
-    return [
+    if (value.length > MAX_CONFIG_BYTES)
+        throw new Error("环境变量白名单过长");
+    const result = [
         ...new Set(value
             .split(",")
             .map((item) => item.trim())
             .filter(Boolean)),
     ];
+    if (result.length > MAX_CONFIG_LIST_ITEMS) {
+        throw new Error(`环境变量白名单最多包含 ${MAX_CONFIG_LIST_ITEMS} 项`);
+    }
+    return result;
 }
-function readPositiveNumber(value) {
-    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
+function readPositiveNumber(value, max) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 && value <= max
+        ? value
+        : undefined;
 }
-function readPositiveInteger(value) {
-    return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+function readPositiveInteger(value, max) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= max
+        ? value
+        : undefined;
 }
 function readPort(value) {
     return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65_535

package/dist/delivery-queue.d.ts

@@ -52,6 +52,7 @@ export declare class DeliveryQueue {
     private readonly targetInFlight;
     private mutation;
     private retryTimer?;
+    private persistRetryTimer?;
     private stopped;
     constructor(config: DeliveryQueueConfig, deliver: (adapterId: string, message: ChannelMessage) => Promise<void>, onError: (error: unknown, message: ChannelMessage) => void);
     start(): Promise<void>;
@@ -60,6 +61,7 @@ export declare class DeliveryQueue {
     enqueue(adapterId: string, message: ChannelMessage): Promise<"queued" | "duplicate">;
     private pump;
     private process;
+    private schedulePersistRetry;
     /** Directory holding spooled attachment bytes, or undefined when not durable. */
     private spoolDir;
     /**

package/dist/delivery-queue.js

@@ -1,6 +1,12 @@
 import { randomUUID } from "node:crypto";
-import { chmod, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
+const MAX_DELIVERY_STATE_BYTES = 64 * 1024 * 1024;
+const MAX_COMPLETED_KEYS = 100_000;
+const MAX_SPOOLED_ATTACHMENTS = 32;
+const MAX_SPOOL_SCAN_ENTRIES = 100_000;
+const SPOOL_FILE_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.\d{1,3}$/iu;
 export class DeliveryBackpressureError extends Error {
     constructor(limit) {
         super(`Chat Gateway inbox 已满（上限 ${limit}）`);
@@ -33,6 +39,7 @@ export class DeliveryQueue {
     targetInFlight = new Map();
     mutation = Promise.resolve();
     retryTimer;
+    persistRetryTimer;
     stopped = true;
     constructor(config, deliver, onError) {
         this.config = config;
@@ -53,6 +60,9 @@ export class DeliveryQueue {
         if (this.retryTimer)
             clearTimeout(this.retryTimer);
         this.retryTimer = undefined;
+        if (this.persistRetryTimer)
+            clearTimeout(this.persistRetryTimer);
+        this.persistRetryTimer = undefined;
     }
     status() {
         const now = Date.now();
@@ -84,20 +94,44 @@ export class DeliveryQueue {
             // the adapter had already acked it. Spool the bytes instead: the record
             // then persists like any other, carrying file paths in place of closures.
             const spooled = await this.spoolAttachments(id, message);
-            const persistent = Boolean(this.config.path && (!message.attachments?.length || spooled !== undefined));
-            const safeMessage = persistent ? serializableMessage(message, spooled) : message;
-            this.pending.push({
-                id,
-                ...(dedupeKey ? { dedupeKey } : {}),
-                adapterId,
-                message: safeMessage,
-                attempts: 0,
-                nextAttemptAt: Date.now(),
-                persistent,
-                ...(spooled ? { spooled } : {}),
-            });
-            if (persistent)
-                await this.persist();
+            let record;
+            try {
+                const persistent = Boolean(this.config.path && (!message.attachments?.length || spooled !== undefined));
+                const safeMessage = persistent ? serializableMessage(message, spooled) : message;
+                record = {
+                    id,
+                    ...(dedupeKey ? { dedupeKey } : {}),
+                    adapterId,
+                    message: safeMessage,
+                    attempts: 0,
+                    nextAttemptAt: Date.now(),
+                    persistent,
+                    ...(spooled ? { spooled } : {}),
+                };
+                this.pending.push(record);
+                if (persistent)
+                    await this.persist();
+            }
+            catch (error) {
+                if (record) {
+                    const index = this.pending.findIndex((candidate) => candidate.id === record?.id);
+                    if (index >= 0)
+                        this.pending.splice(index, 1);
+                    await this.discardSpool(record);
+                }
+                else if (spooled) {
+                    await this.discardSpool({
+                        id,
+                        adapterId,
+                        message,
+                        attempts: 0,
+                        nextAttemptAt: 0,
+                        persistent: false,
+                        spooled,
+                    });
+                }
+                throw error;
+            }
         });
         this.pump();
         return result;
@@ -139,39 +173,66 @@ export class DeliveryQueue {
             error = caught;
             this.onError(caught, entry.message);
         }
-        await this.withMutation(async () => {
-            this.inFlight.delete(entry.id);
-            const key = targetKey(entry.message);
-            const targetCount = (this.targetInFlight.get(key) ?? 1) - 1;
-            if (targetCount <= 0)
-                this.targetInFlight.delete(key);
-            else
-                this.targetInFlight.set(key, targetCount);
-            if (error === undefined || error instanceof UnroutableDeliveryError) {
-                // Success, or a permanently unroutable record: drop it so a message
-                // that can never be delivered does not retry (and re-log) forever.
-                const index = this.pending.findIndex((candidate) => candidate.id === entry.id);
-                if (index >= 0)
-                    this.pending.splice(index, 1);
-                if (error === undefined && entry.dedupeKey)
-                    this.completed.set(entry.dedupeKey, Date.now());
-                // Terminal outcome — the bytes will never be needed again. Cleaning up
-                // here (rather than on a TTL sweep) keeps the spool bounded by what is
-                // actually pending.
-                await this.discardSpool(entry);
-            }
-            else {
-                entry.attempts += 1;
-                entry.nextAttemptAt =
-                    Date.now() +
-                        Math.min(this.config.retryMaxMs, this.config.retryBaseMs * 2 ** Math.min(entry.attempts - 1, 10));
-            }
-            this.pruneCompleted();
-            if (entry.persistent)
-                await this.persist();
-        });
+        const terminal = error === undefined || error instanceof UnroutableDeliveryError;
+        try {
+            await this.withMutation(async () => {
+                this.inFlight.delete(entry.id);
+                const key = targetKey(entry.message);
+                const targetCount = (this.targetInFlight.get(key) ?? 1) - 1;
+                if (targetCount <= 0)
+                    this.targetInFlight.delete(key);
+                else
+                    this.targetInFlight.set(key, targetCount);
+                if (terminal) {
+                    // Success, or a permanently unroutable record: drop it so a message
+                    // that can never be delivered does not retry (and re-log) forever.
+                    const index = this.pending.findIndex((candidate) => candidate.id === entry.id);
+                    if (index >= 0)
+                        this.pending.splice(index, 1);
+                    if (error === undefined && entry.dedupeKey)
+                        this.completed.set(entry.dedupeKey, Date.now());
+                }
+                else {
+                    entry.attempts += 1;
+                    entry.nextAttemptAt =
+                        Date.now() +
+                            Math.min(this.config.retryMaxMs, this.config.retryBaseMs * 2 ** Math.min(entry.attempts - 1, 10));
+                }
+                this.pruneCompleted();
+                // Persist the terminal removal BEFORE deleting attachment bytes. If the
+                // state write fails, the durable record still has everything needed for
+                // at-least-once recovery after a crash.
+                if (entry.persistent)
+                    await this.persist();
+                if (terminal)
+                    await this.discardSpool(entry);
+            });
+        }
+        catch (persistError) {
+            this.onError(persistError, entry.message);
+            this.schedulePersistRetry(entry.message, terminal ? entry : undefined);
+        }
         this.pump();
     }
+    schedulePersistRetry(message, cleanup) {
+        if (this.stopped || !this.config.path || this.persistRetryTimer)
+            return;
+        const delay = Math.max(10, Math.min(this.config.retryBaseMs, this.config.retryMaxMs));
+        this.persistRetryTimer = setTimeout(() => {
+            this.persistRetryTimer = undefined;
+            if (this.stopped)
+                return;
+            void this.withMutation(async () => {
+                await this.persist();
+                if (cleanup)
+                    await this.discardSpool(cleanup);
+            }).catch((error) => {
+                this.onError(error, message);
+                this.schedulePersistRetry(message, cleanup);
+            });
+        }, delay);
+        this.persistRetryTimer.unref?.();
+    }
     /** Directory holding spooled attachment bytes, or undefined when not durable. */
     spoolDir() {
         if (!this.config.path)
@@ -191,17 +252,22 @@ export class DeliveryQueue {
         if (!attachments?.length || !dir)
             return undefined;
         const limit = this.config.maxSpooledAttachmentBytes ?? 16 * 1024 * 1024;
+        const written = [];
         try {
-            await mkdir(dir, { recursive: true, mode: 0o700 });
+            if (attachments.length > MAX_SPOOLED_ATTACHMENTS)
+                return undefined;
+            await ensureRealDirectory(dir);
             const spooled = [];
             for (const [index, attachment] of attachments.entries()) {
                 const bytes = await attachment.load();
                 // Oversized payloads stay in memory: spooling them would trade a lost
                 // message for unbounded disk use.
                 if (bytes.byteLength > limit)
-                    return undefined;
+                    throw new Error("attachment exceeds spool limit");
                 const file = `${recordId}.${index}`;
-                await writeFile(`${dir}/${file}`, bytes, { mode: 0o600 });
+                const target = `${dir}/${file}`;
+                await writeFile(target, bytes, { mode: 0o600, flag: "wx" });
+                written.push(target);
                 spooled.push({
                     id: attachment.id,
                     kind: attachment.kind,
@@ -215,6 +281,7 @@ export class DeliveryQueue {
         }
         catch {
             // Spooling is an availability improvement, never a new failure mode.
+            await Promise.all(written.map((target) => rm(target, { force: true }).catch(() => undefined)));
             return undefined;
         }
     }
@@ -229,7 +296,7 @@ export class DeliveryQueue {
             ...(entry.name ? { name: entry.name } : {}),
             ...(entry.mimeType ? { mimeType: entry.mimeType } : {}),
             size: entry.size,
-            load: async () => new Uint8Array(await readFile(`${dir}/${entry.file}`)),
+            load: async () => new Uint8Array(await readBoundedSpoolFile(dir, entry.file, entry.size, this.config.maxSpooledAttachmentBytes ?? 16 * 1024 * 1024)),
         }));
     }
     /**
@@ -254,32 +321,66 @@ export class DeliveryQueue {
         }
         let files;
         try {
-            files = await readdir(dir);
+            await assertRealDirectory(dir);
+            files = await readdir(dir, { withFileTypes: true });
         }
-        catch {
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
             return; // No spool directory yet — nothing to sweep.
         }
+        if (files.length > MAX_SPOOL_SCAN_ENTRIES) {
+            throw new Error("Chat Gateway attachment spool has too many entries");
+        }
         await Promise.all(files
-            .filter((file) => !referenced.has(file))
-            .map((file) => rm(`${dir}/${file}`, { force: true }).catch(() => undefined)));
+            .filter((entry) => entry.isFile() && SPOOL_FILE_RE.test(entry.name) && !referenced.has(entry.name))
+            .map((entry) => rm(`${dir}/${entry.name}`, { force: true }).catch(() => undefined)));
     }
     /** Delete a record's spooled files once it will never be delivered again. */
     async discardSpool(entry) {
         const dir = this.spoolDir();
         if (!entry.spooled?.length || !dir)
             return;
-        await Promise.all(entry.spooled.map((attachment) => rm(`${dir}/${attachment.file}`, { force: true }).catch(() => undefined)));
+        try {
+            await assertRealDirectory(dir);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        await Promise.all(entry.spooled
+            .filter((attachment) => SPOOL_FILE_RE.test(attachment.file))
+            .map(async (attachment) => {
+            const target = `${dir}/${attachment.file}`;
+            try {
+                const info = await lstat(target);
+                if (!info.isSymbolicLink() && info.isFile())
+                    await rm(target, { force: true });
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }));
     }
     async load() {
         if (!this.config.path)
             return;
         try {
-            const parsed = JSON.parse(await readFile(this.config.path, "utf-8"));
-            if (parsed.version !== 1 || !Array.isArray(parsed.pending) || !parsed.completed)
-                return;
+            const parsed = JSON.parse(await readBoundedRegularFile(this.config.path, MAX_DELIVERY_STATE_BYTES, "Chat Gateway inbox"));
+            if (parsed.version !== 1 ||
+                !Array.isArray(parsed.pending) ||
+                parsed.pending.length > this.config.maxPending ||
+                !parsed.completed ||
+                typeof parsed.completed !== "object" ||
+                Array.isArray(parsed.completed)) {
+                throw new Error("invalid delivery state root");
+            }
             for (const entry of parsed.pending) {
-                if (!validStoredEntry(entry))
+                if (!validStoredEntry(entry, this.config.maxSpooledAttachmentBytes ?? 16 * 1024 * 1024)) {
                     continue;
+                }
                 // Turn spooled metadata back into real attachments whose load() reads
                 // the file. This is the whole point of the spool: after a restart the
                 // upstream will not resend, so the bytes have to come from disk.
@@ -291,9 +392,16 @@ export class DeliveryQueue {
                     nextAttemptAt: Date.now(),
                 });
             }
-            for (const [key, timestamp] of Object.entries(parsed.completed)) {
-                if (typeof timestamp === "number")
+            const completed = Object.entries(parsed.completed);
+            if (completed.length > MAX_COMPLETED_KEYS)
+                throw new Error("too many completed deliveries");
+            for (const [key, timestamp] of completed) {
+                if (key.length <= 16_384 &&
+                    typeof timestamp === "number" &&
+                    Number.isSafeInteger(timestamp) &&
+                    timestamp >= 0) {
                     this.completed.set(key, timestamp);
+                }
             }
             this.pruneCompleted();
         }
@@ -324,10 +432,15 @@ export class DeliveryQueue {
             completed: Object.fromEntries(this.completed),
         };
         const serialized = `${JSON.stringify(state)}\n`;
-        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        if (Buffer.byteLength(serialized, "utf8") > MAX_DELIVERY_STATE_BYTES) {
+            throw new DeliveryBackpressureError(this.config.maxPending);
+        }
+        const parent = dirname(path);
+        await ensureRealDirectory(parent);
+        await assertSafeRegularTarget(path);
         const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
         try {
-            await writeFile(temporary, serialized, { encoding: "utf-8", mode: 0o600 });
+            await writeFile(temporary, serialized, { encoding: "utf-8", mode: 0o600, flag: "wx" });
             await rename(temporary, path);
             await chmod(path, 0o600).catch(() => undefined);
         }
@@ -384,18 +497,128 @@ function serializableMessage(message, spooled) {
     }
     return parsed;
 }
-function validStoredEntry(entry) {
-    if (!entry || typeof entry !== "object")
+function validStoredEntry(entry, maxAttachmentBytes) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
         return false;
     const value = entry;
-    return (typeof value.id === "string" &&
-        typeof value.adapterId === "string" &&
-        typeof value.attempts === "number" &&
-        typeof value.nextAttemptAt === "number" &&
-        Boolean(value.message) &&
-        typeof value.message?.channel === "string" &&
-        typeof value.message?.target === "string" &&
-        typeof value.message?.senderId === "string" &&
-        typeof value.message?.text === "string" &&
-        !value.message?.attachments);
+    if (typeof value.id !== "string" ||
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value.id) ||
+        typeof value.adapterId !== "string" ||
+        value.adapterId.length === 0 ||
+        value.adapterId.length > 256 ||
+        !Number.isSafeInteger(value.attempts) ||
+        (value.attempts ?? -1) < 0 ||
+        (value.attempts ?? 0) > 10_000 ||
+        !Number.isSafeInteger(value.nextAttemptAt) ||
+        (value.nextAttemptAt ?? -1) < 0 ||
+        !value.message ||
+        typeof value.message !== "object" ||
+        typeof value.message.channel !== "string" ||
+        value.message.channel.length === 0 ||
+        value.message.channel.length > 64 ||
+        typeof value.message.target !== "string" ||
+        value.message.target.length === 0 ||
+        value.message.target.length > 4_096 ||
+        typeof value.message.senderId !== "string" ||
+        value.message.senderId.length === 0 ||
+        value.message.senderId.length > 4_096 ||
+        typeof value.message.text !== "string" ||
+        value.message.text.length > 1_048_576 ||
+        value.message.attachments) {
+        return false;
+    }
+    if (value.dedupeKey !== undefined && (typeof value.dedupeKey !== "string" || value.dedupeKey.length > 16_384)) {
+        return false;
+    }
+    if (value.spooled === undefined)
+        return true;
+    if (!Array.isArray(value.spooled) || value.spooled.length > MAX_SPOOLED_ATTACHMENTS)
+        return false;
+    const files = new Set();
+    for (const attachment of value.spooled) {
+        if (!attachment ||
+            typeof attachment !== "object" ||
+            typeof attachment.id !== "string" ||
+            attachment.id.length === 0 ||
+            attachment.id.length > 4_096 ||
+            typeof attachment.kind !== "string" ||
+            attachment.kind.length === 0 ||
+            attachment.kind.length > 64 ||
+            (attachment.name !== undefined &&
+                (typeof attachment.name !== "string" || attachment.name.length > 4_096)) ||
+            (attachment.mimeType !== undefined &&
+                (typeof attachment.mimeType !== "string" || attachment.mimeType.length > 1_024)) ||
+            !Number.isSafeInteger(attachment.size) ||
+            attachment.size < 0 ||
+            attachment.size > maxAttachmentBytes ||
+            typeof attachment.file !== "string" ||
+            !SPOOL_FILE_RE.test(attachment.file) ||
+            !attachment.file.startsWith(`${value.id}.`) ||
+            files.has(attachment.file)) {
+            return false;
+        }
+        files.add(attachment.file);
+    }
+    return true;
+}
+async function ensureRealDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    await assertRealDirectory(path);
+}
+async function assertRealDirectory(path) {
+    const info = await lstat(path);
+    if (info.isSymbolicLink() || !info.isDirectory()) {
+        throw new Error(`Chat Gateway storage path is not a real directory: ${path}`);
+    }
+}
+async function assertSafeRegularTarget(path) {
+    try {
+        const info = await lstat(path);
+        if (info.isSymbolicLink() || !info.isFile()) {
+            throw new Error(`Chat Gateway storage target is not a regular file: ${path}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+async function readBoundedRegularFile(path, maxBytes, label) {
+    const entry = await lstat(path);
+    if (entry.isSymbolicLink() || !entry.isFile() || entry.size > maxBytes) {
+        throw new Error(`${label} is not a bounded regular file`);
+    }
+    const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.size > maxBytes) {
+            throw new Error(`${label} is not a bounded regular file`);
+        }
+        return await handle.readFile("utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function readBoundedSpoolFile(dir, file, expectedBytes, maxBytes) {
+    if (!SPOOL_FILE_RE.test(file) || expectedBytes < 0 || expectedBytes > maxBytes) {
+        throw new Error("invalid Chat Gateway attachment spool reference");
+    }
+    await assertRealDirectory(dir);
+    const target = `${dir}/${file}`;
+    const entry = await lstat(target);
+    if (entry.isSymbolicLink() || !entry.isFile() || entry.size !== expectedBytes) {
+        throw new Error("Chat Gateway attachment spool file is invalid");
+    }
+    const handle = await open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.size !== expectedBytes || opened.size > maxBytes) {
+            throw new Error("Chat Gateway attachment spool file is invalid");
+        }
+        return await handle.readFile();
+    }
+    finally {
+        await handle.close();
+    }
 }

package/dist/instance-lock.js

@@ -1,6 +1,8 @@
 import { randomUUID } from "node:crypto";
-import { chmodSync, closeSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { chmodSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
+const MAX_LOCK_FILE_BYTES = 64 * 1024;
+const MAX_LOCK_OWNER_CHARS = 256;
 export class GatewayAlreadyRunningError extends Error {
     path;
     current;
@@ -21,7 +23,15 @@ export class GatewayAlreadyRunningError extends Error {
 export function acquireGatewayInstanceLock(path, owner) {
     if (!path || !owner)
         throw new Error("gateway lock path and owner are required");
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    if (owner.length > MAX_LOCK_OWNER_CHARS || /[\0\r\n]/u.test(owner)) {
+        throw new Error("gateway lock owner is invalid");
+    }
+    const parent = dirname(path);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const parentInfo = lstatSync(parent);
+    if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory()) {
+        throw new Error("gateway lock parent must be a real directory");
+    }
     const record = {
         version: 1,
         pid: process.pid,
@@ -31,8 +41,10 @@ export function acquireGatewayInstanceLock(path, owner) {
     };
     for (let attempt = 0; attempt < 3; attempt++) {
         let fd;
+        let created = false;
         try {
             fd = openSync(path, "wx", 0o600);
+            created = true;
             writeFileSync(fd, `${JSON.stringify(record)}\n`, "utf-8");
             closeSync(fd);
             fd = undefined;
@@ -53,6 +65,8 @@ export function acquireGatewayInstanceLock(path, owner) {
         catch (error) {
             if (fd !== undefined)
                 closeSync(fd);
+            if (created)
+                rmSync(path, { force: true });
             if (error.code !== "EEXIST")
                 throw error;
             const existing = readLock(path);
@@ -68,13 +82,26 @@ export function acquireGatewayInstanceLock(path, owner) {
     throw new GatewayAlreadyRunningError(path);
 }
 function readLock(path) {
+    let fd;
     try {
-        const value = JSON.parse(readFileSync(path, "utf-8"));
+        const entry = lstatSync(path);
+        if (entry.isSymbolicLink() || !entry.isFile() || entry.size > MAX_LOCK_FILE_BYTES) {
+            return undefined;
+        }
+        fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const opened = fstatSync(fd);
+        if (!opened.isFile() || opened.size > MAX_LOCK_FILE_BYTES)
+            return undefined;
+        const value = JSON.parse(readFileSync(fd, "utf-8"));
         if (value.version !== 1 ||
             !Number.isSafeInteger(value.pid) ||
             (value.pid ?? 0) <= 0 ||
             typeof value.owner !== "string" ||
+            value.owner.length === 0 ||
+            value.owner.length > MAX_LOCK_OWNER_CHARS ||
+            /[\0\r\n]/u.test(value.owner) ||
             typeof value.token !== "string" ||
+            !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value.token) ||
             typeof value.startedAt !== "number") {
             return undefined;
         }
@@ -83,6 +110,10 @@ function readLock(path) {
     catch {
         return undefined;
     }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
 }
 function isProcessAlive(pid) {
     try {

package/dist/service-manager.js

@@ -1,5 +1,6 @@
 import { execFile as nodeExecFile } from "node:child_process";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { chmod, lstat, mkdir, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { promisify } from "node:util";
@@ -96,7 +97,7 @@ export class GatewayServiceManager {
     async installLaunchd() {
         const path = this.launchdPath();
         const logDir = join(this.home, ".code-shell", "im-gateway", "logs");
-        await mkdir(logDir, { recursive: true, mode: 0o700 });
+        await ensureRealDirectory(logDir);
         await writeOwnerFile(path, renderLaunchdService({
             executable: this.executable,
             cliPath: this.cliPath,
@@ -192,20 +193,51 @@ WantedBy=default.target
 `;
 }
 async function writeOwnerFile(path, contents) {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await writeFile(path, contents, { encoding: "utf-8", mode: 0o600 });
-    if (process.platform !== "win32")
-        await chmod(path, 0o600);
+    const parent = dirname(path);
+    await ensureRealDirectory(parent);
+    try {
+        const targetInfo = await lstat(path);
+        if (targetInfo.isSymbolicLink() || !targetInfo.isFile()) {
+            throw new Error(`service definition must be a regular file: ${path}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, contents, {
+            encoding: "utf-8",
+            mode: 0o600,
+            flag: "wx",
+        });
+        await rename(temporary, path);
+        if (process.platform !== "win32")
+            await chmod(path, 0o600);
+    }
+    finally {
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
 }
 async function fileExists(path) {
     try {
-        await readFile(path);
-        return true;
+        const info = await lstat(path);
+        return !info.isSymbolicLink() && info.isFile();
     }
     catch {
         return false;
     }
 }
+async function ensureRealDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    const info = await lstat(path);
+    if (info.isSymbolicLink() || !info.isDirectory()) {
+        throw new Error(`service directory must be a real directory: ${path}`);
+    }
+    if (process.platform !== "win32")
+        await chmod(path, 0o700);
+}
 function escapeXml(value) {
     return value
         .replaceAll("&", "&")

package/dist/teams.js

@@ -1,10 +1,14 @@
-import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
 import { ActivityTypes, CloudAdapter, ConfigurationBotFrameworkAuthentication, TurnContext, } from "botbuilder";
 import { BUILTIN_CHANNEL_CAPABILITIES } from "./channel.js";
 import { formatOutgoingMarkdown, waitForAbort } from "./lifecycle.js";
 import { mediaKind, outgoingAttachments, remoteAttachment, safeAttachmentName } from "./media.js";
 import { readRequestBody, sendResponse } from "./webhook.js";
+const MAX_TEAMS_STATE_BYTES = 4 * 1024 * 1024;
+const MAX_TEAMS_REFERENCES = 1_000;
+const MAX_TEAMS_REFERENCE_BYTES = 64 * 1024;
 export class TeamsAdapter {
     channel = "teams";
     capabilities = BUILTIN_CHANNEL_CAPABILITIES.teams;
@@ -135,12 +139,20 @@ export class TeamsAdapter {
     loadReferences() {
         if (!this.statePath)
             return;
+        let fd;
         try {
-            const parsed = JSON.parse(readFileSync(this.statePath, "utf-8"));
+            const entry = lstatSync(this.statePath);
+            if (entry.isSymbolicLink() || !entry.isFile() || entry.size > MAX_TEAMS_STATE_BYTES)
+                return;
+            fd = openSync(this.statePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = fstatSync(fd);
+            if (!opened.isFile() || opened.size > MAX_TEAMS_STATE_BYTES)
+                return;
+            const parsed = JSON.parse(readFileSync(fd, "utf-8"));
             if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
                 return;
-            for (const [target, reference] of Object.entries(parsed).slice(0, 1_000)) {
-                if (target && reference && typeof reference === "object" && !Array.isArray(reference)) {
+            for (const [target, reference] of Object.entries(parsed).slice(0, MAX_TEAMS_REFERENCES)) {
+                if (validTeamsConversationReference(target, reference)) {
                     this.references.set(target, reference);
                 }
             }
@@ -148,21 +160,86 @@ export class TeamsAdapter {
         catch {
             // First run, malformed legacy state, or an unavailable home directory.
         }
+        finally {
+            if (fd !== undefined)
+                closeSync(fd);
+        }
     }
     saveReferences() {
         if (!this.statePath)
             return;
-        const entries = [...this.references.entries()].slice(-1_000);
-        mkdirSync(dirname(this.statePath), { recursive: true, mode: 0o700 });
-        const temporary = `${this.statePath}.${process.pid}.tmp`;
-        writeFileSync(temporary, `${JSON.stringify(Object.fromEntries(entries))}\n`, {
-            encoding: "utf-8",
-            mode: 0o600,
-        });
-        renameSync(temporary, this.statePath);
-        if (process.platform !== "win32")
-            chmodSync(this.statePath, 0o600);
+        const entries = [...this.references.entries()]
+            .filter(([target, reference]) => validTeamsConversationReference(target, reference))
+            .slice(-MAX_TEAMS_REFERENCES);
+        const serialized = `${JSON.stringify(Object.fromEntries(entries))}\n`;
+        if (Buffer.byteLength(serialized, "utf8") > MAX_TEAMS_STATE_BYTES) {
+            throw new Error("Teams conversation state is too large");
+        }
+        const parent = dirname(this.statePath);
+        mkdirSync(parent, { recursive: true, mode: 0o700 });
+        const parentInfo = lstatSync(parent);
+        if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory()) {
+            throw new Error("Teams conversation state parent must be a real directory");
+        }
+        try {
+            const targetInfo = lstatSync(this.statePath);
+            if (targetInfo.isSymbolicLink() || !targetInfo.isFile()) {
+                throw new Error("Teams conversation state must be a regular file");
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const temporary = `${this.statePath}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            writeFileSync(temporary, serialized, { encoding: "utf-8", mode: 0o600, flag: "wx" });
+            renameSync(temporary, this.statePath);
+            if (process.platform !== "win32")
+                chmodSync(this.statePath, 0o600);
+        }
+        finally {
+            rmSync(temporary, { force: true });
+        }
+    }
+}
+function validTeamsConversationReference(target, value) {
+    if (!target || target.length > 4_096 || /[\0\r\n]/u.test(target))
+        return false;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    let serialized;
+    try {
+        serialized = JSON.stringify(value);
+    }
+    catch {
+        return false;
+    }
+    if (Buffer.byteLength(serialized, "utf8") > MAX_TEAMS_REFERENCE_BYTES)
+        return false;
+    const reference = value;
+    if (reference.channelId !== "msteams" || typeof reference.serviceUrl !== "string")
+        return false;
+    if (reference.serviceUrl.length > 2_048)
+        return false;
+    try {
+        const url = new URL(reference.serviceUrl);
+        if (url.protocol !== "https:" || url.username || url.password || !url.hostname)
+            return false;
+        if (url.hostname === "localhost" || url.hostname.endsWith(".localhost"))
+            return false;
+        if (/^(?:127\.|0\.|10\.|169\.254\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.)/u.test(url.hostname)) {
+            return false;
+        }
+    }
+    catch {
+        return false;
     }
+    const conversation = reference.conversation;
+    return (Boolean(conversation) &&
+        typeof conversation === "object" &&
+        !Array.isArray(conversation) &&
+        conversation.id === target);
 }
 class BotFrameworkResponse {
     response;

package/dist/wechat-login.js

@@ -1,8 +1,10 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
+import { chmodSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { dirname, resolve } from "node:path";
 import { defaultGatewayConfigPath } from "./config.js";
 import { loginWechatWithQr, } from "./wechat.js";
 import { defaultWechatDataDirectory, FileWechatCredentialStore, wechatCredentialFingerprint, } from "./wechat-storage.js";
+const MAX_GATEWAY_CONFIG_BYTES = 4 * 1024 * 1024;
 /**
  * Complete the personal-WeChat QR flow and persist both the owner-only token
  * and the matching CodeShell gateway configuration. Shared by the CLI and the
@@ -11,6 +13,10 @@ import { defaultWechatDataDirectory, FileWechatCredentialStore, wechatCredential
 export async function loginCodeShellWechat(options = {}) {
     const configPath = resolve(options.configPath ?? defaultGatewayConfigPath());
     const credentialsDir = resolve(options.credentialsDir ?? defaultWechatDataDirectory());
+    // Validate the destination before starting a remote login or mutating local
+    // credentials/state. A linked, oversized, malformed, or insecure config must
+    // not leave a half-applied successful QR login behind.
+    readGatewayConfigObject(configPath);
     const store = new FileWechatCredentialStore(credentialsDir);
     const login = options.login ?? loginWechatWithQr;
     const result = await login({
@@ -65,17 +71,7 @@ export async function loginCodeShellWechat(options = {}) {
     return { accountId: credentials.accountId, configPath };
 }
 function updateWechatConfig(options) {
-    let raw = {};
-    if (existsSync(options.configPath)) {
-        if (process.platform !== "win32" && (statSync(options.configPath).mode & 0o077) !== 0) {
-            throw new Error(`Chat gateway 配置权限必须为 0600：${options.configPath}`);
-        }
-        const parsed = JSON.parse(readFileSync(options.configPath, "utf8"));
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            throw new Error(`Chat gateway 配置不是 JSON object：${options.configPath}`);
-        }
-        raw = parsed;
-    }
+    const raw = readGatewayConfigObject(options.configPath);
     const existing = raw.wechat && typeof raw.wechat === "object" && !Array.isArray(raw.wechat)
         ? raw.wechat
         : {};
@@ -88,10 +84,86 @@ function updateWechatConfig(options) {
             ...(options.credentialsDir ? { credentialsDir: options.credentialsDir } : {}),
         },
     };
-    mkdirSync(dirname(options.configPath), { recursive: true, mode: 0o700 });
-    const temporary = `${options.configPath}.${process.pid}.tmp`;
-    writeFileSync(temporary, `${JSON.stringify(updated, null, 2)}\n`, { mode: 0o600 });
-    renameSync(temporary, options.configPath);
-    if (process.platform !== "win32")
-        chmodSync(options.configPath, 0o600);
+    const serialized = `${JSON.stringify(updated, null, 2)}\n`;
+    if (Buffer.byteLength(serialized, "utf8") > MAX_GATEWAY_CONFIG_BYTES) {
+        throw new Error("Chat gateway 配置过大");
+    }
+    assertSafeConfigTarget(options.configPath);
+    const temporary = `${options.configPath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, serialized, { mode: 0o600, flag: "wx" });
+        renameSync(temporary, options.configPath);
+        if (process.platform !== "win32")
+            chmodSync(options.configPath, 0o600);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+function readGatewayConfigObject(configPath) {
+    const parent = dirname(configPath);
+    try {
+        const parentInfo = lstatSync(parent);
+        if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory()) {
+            throw new Error("Chat gateway 配置目录必须是普通目录");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (!existsSync(configPath)) {
+        try {
+            const linked = lstatSync(configPath);
+            if (linked.isSymbolicLink())
+                throw new Error("linked config is not allowed");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        return {};
+    }
+    let fd;
+    try {
+        const entry = lstatSync(configPath);
+        if (entry.isSymbolicLink() || !entry.isFile() || entry.size > MAX_GATEWAY_CONFIG_BYTES) {
+            throw new Error(`Chat gateway 配置必须是有限大小的普通文件：${configPath}`);
+        }
+        if (process.platform !== "win32" && (entry.mode & 0o077) !== 0) {
+            throw new Error(`Chat gateway 配置权限必须为 0600：${configPath}`);
+        }
+        fd = openSync(configPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const opened = fstatSync(fd);
+        if (!opened.isFile() || opened.size > MAX_GATEWAY_CONFIG_BYTES) {
+            throw new Error(`Chat gateway 配置必须是有限大小的普通文件：${configPath}`);
+        }
+        const parsed = JSON.parse(readFileSync(fd, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error(`Chat gateway 配置不是 JSON object：${configPath}`);
+        }
+        return parsed;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+function assertSafeConfigTarget(configPath) {
+    const parent = dirname(configPath);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const parentInfo = lstatSync(parent);
+    if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory()) {
+        throw new Error("Chat gateway 配置目录必须是普通目录");
+    }
+    try {
+        const targetInfo = lstatSync(configPath);
+        if (targetInfo.isSymbolicLink() || !targetInfo.isFile()) {
+            throw new Error("Chat gateway 配置必须是普通文件");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
 }

package/dist/wechat.d.ts

@@ -70,6 +70,8 @@ export declare class WechatAdapter implements ChannelAdapter {
     /** Preserve visible ordering and keep context/media state mutations single-writer. */
     private outboundQueue;
     private readonly seenMessageIds;
+    /** Cursor whose batch was rejected by the handler and therefore must retry even after max age. */
+    private heldCursor?;
     private readonly delivery;
     constructor(config: WechatAdapterConfig, options?: WechatAdapterOptions);
     run(handler: ChannelMessageHandler, signal: AbortSignal): Promise<void>;

package/dist/wechat.js

@@ -66,6 +66,8 @@ export class WechatAdapter {
     /** Preserve visible ordering and keep context/media state mutations single-writer. */
     outboundQueue = Promise.resolve();
     seenMessageIds = new Set();
+    /** Cursor whose batch was rejected by the handler and therefore must retry even after max age. */
+    heldCursor;
     delivery = new OutgoingDeliveryTracker();
     constructor(config, options = {}) {
         this.config = config;
@@ -106,6 +108,8 @@ export class WechatAdapter {
                     throw new Error("微信状态文件已被新的扫码绑定接管，长轮询停止；请重启 Gateway 使用新凭据");
                 }
                 try {
+                    const requestedCursor = this.state.cursor ?? "";
+                    const retryingHeldBatch = this.heldCursor === requestedCursor;
                     const response = await this.post("ilink/bot/getupdates", {
                         get_updates_buf: this.state.cursor ?? "",
                         base_info: this.baseInfo(),
@@ -123,7 +127,7 @@ export class WechatAdapter {
                     }
                     let batchAccepted = true;
                     for (const raw of response.msgs ?? []) {
-                        const message = this.normalizeInbound(raw);
+                        const message = this.normalizeInbound(raw, retryingHeldBatch);
                         if (!message || this.isDuplicate(message.messageId))
                             continue;
                         try {
@@ -141,11 +145,14 @@ export class WechatAdapter {
                         }
                     }
                     if (!batchAccepted) {
+                        this.heldCursor = requestedCursor;
                         throw new Error("微信消息未被上层接收，保留游标等待重投");
                     }
                     if (response.get_updates_buf) {
                         await this.commitCursor(response.get_updates_buf);
                     }
+                    if (this.heldCursor === requestedCursor)
+                        this.heldCursor = undefined;
                 }
                 catch (error) {
                     if (signal.aborted)
@@ -428,7 +435,7 @@ export class WechatAdapter {
         }
         throw lastError instanceof Error ? lastError : new Error("微信附件上传失败");
     }
-    normalizeInbound(raw) {
+    normalizeInbound(raw, allowExpiredRetry = false) {
         if (raw.message_type !== undefined && raw.message_type !== MESSAGE_TYPE_USER)
             return undefined;
         if (raw.message_state === MESSAGE_STATE_GENERATING)
@@ -437,6 +444,7 @@ export class WechatAdapter {
         if (!senderId)
             return undefined;
         if (raw.create_time_ms !== undefined &&
+            !allowExpiredRetry &&
             this.maxMessageAgeMs >= 0 &&
             this.now() - raw.create_time_ms > this.maxMessageAgeMs) {
             return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-chat",
-  "version": "0.8.9",
+  "version": "0.8.10",
   "description": "A standalone, transport-agnostic multi-channel chat gateway for Node.js and Bun.",
   "type": "module",
   "main": "./dist/index.js",