@modelzen/feishu-codex-bridge 0.3.12-test.0 → 0.3.12-test.1

package/dist/cli.js

@@ -91,7 +91,10 @@ var paths = {
   inboundDir: join(appDir, "inbound"),
   /** daemon 内嵌 Web 控制台的发现文件 {port, token, pid}（0600，daemon 退出
    * 清理）——`web` 子命令据此直接打开 daemon 控制台而不是再起只读副本。 */
-  webConsoleFile: join(appDir, "web-console.json")
+  webConsoleFile: join(appDir, "web-console.json"),
+  /** 稳定的 Web 控制台 token（0600，**不随进程退出清理**）——让重启 / 预览→daemon
+   * 切换后浏览器里那条带 token 的 URL 始终有效，不再 401。删此文件即轮换 token。 */
+  webTokenFile: join(appDir, "web-token")
 };
 
 // src/config/bots.ts
@@ -12167,7 +12170,7 @@ async function catalogEntryStatus(entry, defaultBackend) {
 }
 async function probeAllBackends() {
   return Promise.all(
-    backendIds().map(async (id) => {
+    visibleCatalog().map((e) => e.id).map(async (id) => {
       const backend = createBackend(id);
       const probe = await backend.doctor({ force: true }).catch(() => void 0);
       return {
@@ -12195,6 +12198,7 @@ function isAlive(pid) {
 }
 
 // src/web/discovery.ts
+import { randomUUID as randomUUID6 } from "crypto";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname12 } from "path";
 function publishWebConsole(rec, file = paths.webConsoleFile) {
@@ -12225,6 +12229,25 @@ function clearWebConsole(file = paths.webConsoleFile) {
   } catch {
   }
 }
+function stableWebConsoleToken(file = paths.webTokenFile) {
+  try {
+    const t = readFileSync5(file, "utf8").trim();
+    if (t) return t;
+  } catch {
+  }
+  const token = randomUUID6();
+  try {
+    mkdirSync2(dirname12(file), { recursive: true });
+    try {
+      unlinkSync(file);
+    } catch {
+    }
+    writeFileSync2(file, `${token}
+`, { mode: 384 });
+  } catch {
+  }
+  return token;
+}
 function isAlive2(pid) {
   try {
     process.kill(pid, 0);
@@ -12347,7 +12370,7 @@ async function doRestart(phase) {
 
 // src/web/server.ts
 import { createServer } from "http";
-import { randomUUID as randomUUID6, timingSafeEqual } from "crypto";
+import { randomUUID as randomUUID7, timingSafeEqual } from "crypto";
 import { mkdirSync as mkdirSync3, watch } from "fs";
 import { open as open2, stat as stat5 } from "fs/promises";
 import { join as join19 } from "path";
@@ -14368,7 +14391,7 @@ ${UI_PURE_JS}
     box.textContent = '';
     box.className = 'note';
     if (!diag) return;
-    box.appendChild(el('div', null, '\u4E8B\u4EF6\u8BA2\u9605\uFF1A' + eventDiagText(diag.event)));
+    box.appendChild(el('div', null, '\u2139\uFE0F \u4E8B\u4EF6\u8BA2\u9605\uFF1A\u8BF7\u81EA\u884C\u5230\u300C\u4E8B\u4EF6\u4E0E\u56DE\u8C03\u300D\u786E\u8BA4\u5DF2\u8BA2\u9605 im.message.receive_v1\uFF08\u957F\u8FDE\u63A5\uFF09\uFF1B\u6B64\u9879\u7CFB\u7EDF\u65E0\u6CD5\u53EF\u9760\u68C0\u6D4B\uFF0C\u4EC5\u4F5C\u63D0\u9192\u3002'));
     var title = el('div', null, '\u{1F9E0} \u540E\u7AEF\u73AF\u5883\uFF1A');
     title.style.marginTop = '6px';
     box.appendChild(title);
@@ -14553,9 +14576,12 @@ ${UI_PURE_JS}
   var wizEs = null;         // \u626B\u7801 SSE EventSource
   var wizQrSessionId = null;
   var wizCountdown = null;  // \u4E8C\u7EF4\u7801\u8FC7\u671F\u5012\u8BA1\u65F6
+  var wizAutoEnabled = false;    // \u65B0 bot \u662F\u5426\u5DF2\u81EA\u52A8\u52A0\u5165\u6D3B\u8DC3\u96C6\uFF08\u4E00\u6B21\u6027\uFF09
+  var wizRestartPrompted = false; // \u5B8C\u6210\u6B65\u662F\u5426\u5DF2\u5F39\u8FC7\u300C\u91CD\u542F\u62C9\u8D77\u300D\u786E\u8BA4\uFF08\u4E00\u6B21\u6027\uFF09
 
   function openWizard() {
     wizStep = 1; wizBotId = null; wizSetup = null; wizManualOpen = false;
+    wizAutoEnabled = false; wizRestartPrompted = false;
     stopWizPoll(); stopWizQr();
     $('wizMask').classList.add('open');
     renderWizard();
@@ -14773,12 +14799,21 @@ ${UI_PURE_JS}
   function startWizPoll() { stopWizPoll(); pollWizSetup(); wizPoll = setInterval(pollWizSetup, 5000); }
   function pollWizSetup() {
     if (!wizBotId) return;
+    // \u65B0 bot \u9ED8\u8BA4\u5C31\u52A0\u5165\u6D3B\u8DC3\u96C6\u2014\u2014\u7528\u6237\u4E0D\u5FC5\u624B\u52A8\u70B9\u6309\u94AE / \u8DD1 bot use\u3002\u4E00\u6B21\u6027\uFF1B\u5931\u8D25\u4E0B\u5468\u671F\u91CD\u8BD5\u3002
+    // \u771F\u6B63\u300C\u62C9\u8D77\u4E0A\u7EBF\u300D\u8981\u91CD\u542F Feishu Bridge\uFF0C\u90A3\u4E00\u6B65\u7559\u5230\u300C\u5B8C\u6210\u300D\u65F6\u5F39\u7A97\u786E\u8BA4\uFF08\u91CD\u542F\u4F1A\u77ED\u6682
+    // \u5F71\u54CD\u5176\u5B83\u5728\u7EBF bot\uFF0C\u6240\u4EE5\u4E0D\u9759\u9ED8\u91CD\u542F\uFF09\u3002
+    if (!wizAutoEnabled) {
+      wizAutoEnabled = true;
+      fetch('/api/bots/' + encodeURIComponent(wizBotId), {
+        method: 'PATCH', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ enabled: true }),
+      }).catch(function () { wizAutoEnabled = false; });
+    }
     fetch('/api/bots/' + encodeURIComponent(wizBotId) + '/setup-status')
       .then(function (r) { return r.json(); })
       .then(function (s) {
         wizSetup = s;
         if (wizStep === 2) renderWizChecklist();
-        if (s.event && s.event.state === 'ok') stopWizPoll();
       })
       .catch(function () { /* \u4E0B\u4E2A\u5468\u671F\u91CD\u8BD5 */ });
   }
@@ -14805,7 +14840,7 @@ ${UI_PURE_JS}
     var s = wizSetup;
     if (!s || !s.credentials) {
       w.appendChild(checkItem('spin', '\u6B63\u5728\u68C0\u6D4B\u2026', '\u9996\u6B21\u62C9\u53D6\u7EA6 2~3 \u79D2'));
-      w.appendChild(wizChecklistActions(false));
+      w.appendChild(wizChecklistActions());
       return;
     }
     w.appendChild(checkItem(
@@ -14833,81 +14868,58 @@ ${UI_PURE_JS}
     } else if (conn.running) {
       w.appendChild(checkItem('spin', 'bridge \u8FD0\u884C\u4E2D', '\u957F\u8FDE\u63A5' + (conn.connection ? '\uFF08' + conn.connection + '\uFF09' : '\u5EFA\u7ACB\u4E2D\u2026')));
     } else {
-      var cmd = el('div');
-      var act = el('div', 'actions');
-      var go1 = el('button', 'btn primary', '\u26A1 \u4E00\u952E\u542F\u7528\u5E76\u62C9\u8D77');
-      go1.onclick = function () { wizEnableAndLaunch(); };
-      act.appendChild(go1);
-      cmd.appendChild(act);
-      cmd.appendChild(el('div', 'note', '\u4E00\u952E\uFF1A\u628A\u5B83\u52A0\u5165\u6D3B\u8DC3\u96C6\u5E76\u81EA\u52A8'
-        + ((daemon && daemon.running) ? '\u91CD\u542F' : '\u542F\u52A8') + ' Feishu Bridge'
-        + ((daemon && daemon.running) ? '\uFF08\u7EA6\u6570\u79D2\uFF0C\u5176\u5B83\u5728\u7EBF\u673A\u5668\u4EBA\u4F1A\u77ED\u6682\u65AD\u8FDE\u540E\u81EA\u52A8\u91CD\u8FDE\uFF09' : '') + '\u3002'));
-      cmd.appendChild(el('div', 'note', '\u6216\u624B\u52A8\u5728\u7EC8\u7AEF\u6267\u884C\uFF1A'));
-      cmd.appendChild(copyRow('feishu-codex-bridge bot use ' + (wizBotId || '<appId>')));
-      cmd.appendChild(copyRow('feishu-codex-bridge start'));
-      w.appendChild(checkItem('\u{1F7E0}', '\u957F\u8FDE\u63A5\u672A\u5EFA\u7ACB', '\u9700\u8981 Feishu Bridge \u62C9\u8D77\u8FD9\u4E2A bot', cmd));
-    }
-    var ev = s.event || { state: 'unchecked' };
-    if (ev.state === 'ok') {
-      w.appendChild(checkItem('\u2705', '\u4E8B\u4EF6\u8BA2\u9605\u5DF2\u751F\u6548', eventDiagText(ev)));
-    } else {
-      var evExtra = el('div');
-      evExtra.appendChild(el('div', 'note', ev.state === 'unchecked'
-        ? '\uFF08\u7F3A application:app_version \u53EA\u8BFB scope \u6216\u7F51\u7EDC\u4E0D\u901A\u65F6\u65E0\u6CD5\u81EA\u52A8\u68C0\u6D4B\uFF1B\u6309\u4E0B\u65B9\u6DF1\u94FE\u624B\u52A8\u6838\u5BF9\u300C\u4E8B\u4EF6\u914D\u7F6E\u300D\u3002\uFF09'
-        : '\u53BB\u5F00\u53D1\u8005\u540E\u53F0\u300C\u4E8B\u4EF6\u4E0E\u56DE\u8C03\u300D\uFF1A\u4E8B\u4EF6\u914D\u7F6E\u6539\u300C\u957F\u8FDE\u63A5\u300D\u2192 \u6DFB\u52A0 im.message.receive_v1 \u2192 \u5E94\u7528\u53D1\u5E03\u91CC\u521B\u5EFA\u5E76\u53D1\u5E03\u7248\u672C\u3002'));
-      var ea = el('a', null, '\u6253\u5F00\u300C\u4E8B\u4EF6\u4E0E\u56DE\u8C03\u300D\u914D\u7F6E\u9875 \u2197');
-      ea.href = s.eventConfigUrl; ea.target = '_blank'; ea.rel = 'noopener';
-      evExtra.appendChild(ea);
-      evExtra.appendChild(el('div', 'note', '\u914D\u7F6E\u597D\u540E\u65E0\u9700\u624B\u52A8\u5237\u65B0\u2014\u2014\u672C\u9875\u6BCF 5 \u79D2\u81EA\u52A8\u590D\u68C0\uFF0C\u751F\u6548\u4F1A\u53D8 \u2705\u3002'));
-      w.appendChild(checkItem(ev.state === 'unchecked' ? '\u26A0\uFE0F' : 'spin',
-        ev.state === 'unchecked' ? '\u4E8B\u4EF6\u8BA2\u9605\u672A\u80FD\u81EA\u52A8\u68C0\u6D4B' : '\u4E8B\u4EF6\u8BA2\u9605\u5C1A\u672A\u751F\u6548',
-        eventDiagText(ev), evExtra));
-    }
-    w.appendChild(wizChecklistActions(ev.state === 'ok'));
+      // \u65B0 bot \u5DF2\u81EA\u52A8\u52A0\u5165\u6D3B\u8DC3\u96C6\uFF08\u89C1 pollWizSetup\uFF09\uFF1B\u4E0D\u518D\u8BA9\u7528\u6237\u70B9\u6309\u94AE / \u590D\u5236\u547D\u4EE4\u3002\u771F\u6B63\u62C9\u8D77
+      // \u4E0A\u7EBF\u9760\u6700\u540E\u4E00\u6B65\u300C\u5B8C\u6210\u300D\u65F6\u5F39\u7A97\u786E\u8BA4\u91CD\u542F Feishu Bridge\u3002
+      w.appendChild(checkItem('spin', '\u5F85\u62C9\u8D77\u4E0A\u7EBF', '\u5DF2\u81EA\u52A8\u52A0\u5165\u6D3B\u8DC3\u96C6 \xB7 \u70B9\u300C\u4E0B\u4E00\u6B65\u300D\u5230\u5B8C\u6210\u9875\uFF0C\u786E\u8BA4\u91CD\u542F Feishu Bridge \u5373\u4E0A\u7EBF\u3002'));
+    }
+    // \u4E8B\u4EF6\u8BA2\u9605\uFF1A\u7CFB\u7EDF\u65E0\u6CD5\u53EF\u9760\u68C0\u6D4B\uFF08\u957F\u8FDE\u63A5\u8BA2\u9605\u5728\u5DF2\u53D1\u5E03\u7248\u672C\u91CC\u7684\u4F53\u73B0\u4E0D\u7A33\u5B9A\uFF09\uFF0C\u6545\u53EA\u505A\u63D0\u9192\u3001\u4E0D\u4E0B\u7ED3\u8BBA\u3001
+    // \u4E0D\u963B\u585E\u300C\u4E0B\u4E00\u6B65\u300D\u3002\u7528\u6237\u81EA\u884C\u53BB\u540E\u53F0\u6838\u5BF9\u3002
+    var evHint = el('div');
+    var ea = el('a', null, '\u6253\u5F00\u300C\u4E8B\u4EF6\u4E0E\u56DE\u8C03\u300D\u914D\u7F6E\u9875 \u2197');
+    ea.href = (s.eventConfigUrl || '#'); ea.target = '_blank'; ea.rel = 'noopener';
+    evHint.appendChild(ea);
+    w.appendChild(checkItem('\u2139\uFE0F', '\u4E8B\u4EF6\u8BA2\u9605\uFF08\u8BF7\u81EA\u884C\u786E\u8BA4\uFF09',
+      '\u8BF7\u5230\u300C\u4E8B\u4EF6\u4E0E\u56DE\u8C03\u300D\u786E\u8BA4\u5DF2\u8BA2\u9605 im.message.receive_v1\uFF08\u957F\u8FDE\u63A5\u6A21\u5F0F\uFF09\u5E76\u5DF2\u53D1\u5E03\u7248\u672C\uFF0C\u5426\u5219 @\u673A\u5668\u4EBA\u4E0D\u4F1A\u6709\u53CD\u5E94\u3002\u6B64\u9879\u7CFB\u7EDF\u65E0\u6CD5\u53EF\u9760\u68C0\u6D4B\uFF0C\u4EC5\u4F5C\u63D0\u9192\u3002', evHint));
+    w.appendChild(wizChecklistActions());
   }
 
-  function wizChecklistActions(eventOk) {
+  function wizChecklistActions() {
     var actions = el('div', 'actions');
     var back = el('button', 'btn', '\u7A0D\u540E\u518D\u8BF4');
     back.onclick = closeWizard;
     actions.appendChild(back);
     actions.appendChild(el('div', 'grow'));
-    var next = el('button', 'btn' + (eventOk ? ' primary' : ''), eventOk ? '\u4E0B\u4E00\u6B65' : '\u4E8B\u4EF6\u751F\u6548\u540E\u518D\u7EE7\u7EED');
-    if (eventOk) { next.onclick = function () { wizStep = 3; stopWizPoll(); renderWizard(); }; }
-    else { next.className = 'btn disabled'; next.disabled = true; }
+    var next = el('button', 'btn primary', '\u4E0B\u4E00\u6B65');
+    next.onclick = function () { wizStep = 3; stopWizPoll(); renderWizard(); };
     actions.appendChild(next);
     return actions;
   }
 
-  // \u300C\u957F\u8FDE\u63A5\u672A\u5EFA\u7ACB\u300D\u4E00\u952E\uFF1A\u542F\u7528\uFF08\u52A0\u5165\u6D3B\u8DC3\u96C6\uFF09\u2192 daemon \u5728\u8DD1\u5C31\u786E\u8BA4\u91CD\u542F\u3001\u6CA1\u8DD1\u5C31\u76F4\u63A5\u542F\u52A8\uFF0C
-  // \u7701\u53BB\u7EC8\u7AEF bot use + start\u3002\u590D\u7528 confirmDialog / postAction\uFF0C\u4E0E\u4EEA\u8868\u76D8\u91CD\u542F\u540C\u4E00\u5957\u3002
-  function wizEnableAndLaunch() {
-    if (!wizBotId) { toast('\u274C \u7F3A\u5C11\u673A\u5668\u4EBA ID'); return; }
-    var who = (wizSetup && wizSetup.botName) || wizBotId;
-    fetch('/api/bots/' + encodeURIComponent(wizBotId), {
-      method: 'PATCH', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ enabled: true }),
-    }).then(function (r) { return r.json().then(function (j) { return { status: r.status, body: j }; }); })
-      .then(function (resp) {
-        if (resp.status !== 200) { toast('\u274C ' + (resp.body.message || ('HTTP ' + resp.status))); return; }
-        toast('\u2705 \u5DF2\u52A0\u5165\u6D3B\u8DC3\u96C6');
-        if (daemon && daemon.running) {
-          confirmDialog({
-            title: '\u{1F504} \u7ACB\u5373\u91CD\u542F Feishu Bridge \u62C9\u8D77\u300C' + who + '\u300D\uFF1F',
-            lines: [
-              '\u5DF2\u52A0\u5165\u6D3B\u8DC3\u96C6\uFF0C\u91CD\u542F\u540E\u5373\u53EF\u4E0A\u7EBF\u3002',
-              '\u91CD\u542F\u7EA6\u6570\u79D2\uFF0C\u671F\u95F4\u6240\u6709\u5728\u7EBF\u673A\u5668\u4EBA\u7684\u957F\u8FDE\u63A5\u4F1A\u77ED\u6682\u65AD\u5F00\u5E76\u81EA\u52A8\u91CD\u8FDE\u3002',
-            ],
-            confirmLabel: '\u7ACB\u5373\u91CD\u542F',
-            onConfirm: function () { postAction('/api/daemon/restart', '\u91CD\u542F'); },
-          });
-        } else {
-          // daemon \u6CA1\u5728\u8DD1\uFF08\u53EA\u8BFB\u9884\u89C8\uFF09\u2192 \u542F\u52A8\u5B83\uFF08read-only preview \u6CE8\u5165\u4E86 startDaemon\uFF09\uFF1B
-          // \u8D77\u6765\u540E /api/console/live \u8F6E\u8BE2\u4F1A\u628A\u9875\u9762\u81EA\u52A8\u5E26\u53BB\u53EF\u5199\u63A7\u5236\u53F0\u3002
-          postAction('/api/daemon/start', '\u542F\u52A8');
-        }
-      })
-      .catch(function () { toast('\u274C \u8BF7\u6C42\u5931\u8D25'); });
+  // \u5B8C\u6210\u6B65\uFF1A\u65B0 bot \u5DF2\u81EA\u52A8\u52A0\u5165\u6D3B\u8DC3\u96C6\uFF0C\u4F46\u8981\u91CD\u542F Feishu Bridge \u624D\u771F\u6B63\u62C9\u8D77\u4E0A\u7EBF\u3002\u5F39\u7A97\u786E\u8BA4
+  // \uFF08\u91CD\u542F\u4F1A\u77ED\u6682\u5F71\u54CD\u5176\u5B83\u5728\u7EBF bot\uFF0C\u6240\u4EE5\u4E0D\u9759\u9ED8\u91CD\u542F\uFF09\uFF1Bdaemon \u6CA1\u5728\u8DD1\u5C31\u6539\u4E3A\u300C\u542F\u52A8\u300D\u3002\u4E00\u6B21\u6027\u3002
+  function maybePromptRestartAtDone() {
+    if (wizRestartPrompted) return;
+    var conn = (wizSetup && wizSetup.connection) || {};
+    if (conn.running && conn.connection === 'connected') return; // \u5DF2\u7ECF\u5728\u7EBF\uFF0C\u65E0\u9700\u91CD\u542F
+    wizRestartPrompted = true;
+    if (daemon && daemon.running) {
+      confirmDialog({
+        title: '\u{1F504} \u7ACB\u5373\u91CD\u542F Feishu Bridge \u8BA9\u65B0\u673A\u5668\u4EBA\u4E0A\u7EBF\uFF1F',
+        lines: [
+          '\u65B0\u673A\u5668\u4EBA\u5DF2\u52A0\u5165\u6D3B\u8DC3\u96C6\uFF0C\u91CD\u542F Feishu Bridge \u540E\u5373\u53EF\u4E0A\u7EBF\u3002',
+          '\u91CD\u542F\u7EA6\u6570\u79D2\uFF0C\u671F\u95F4\u6240\u6709\u5728\u7EBF\u673A\u5668\u4EBA\u7684\u957F\u8FDE\u63A5\u4F1A\u77ED\u6682\u65AD\u5F00\u5E76\u81EA\u52A8\u91CD\u8FDE\u3002',
+        ],
+        confirmLabel: '\u7ACB\u5373\u91CD\u542F',
+        onConfirm: function () { postAction('/api/daemon/restart', '\u91CD\u542F'); },
+      });
+    } else {
+      confirmDialog({
+        title: '\u{1F680} \u7ACB\u5373\u542F\u52A8 Feishu Bridge \u8BA9\u673A\u5668\u4EBA\u4E0A\u7EBF\uFF1F',
+        lines: ['Feishu Bridge \u5F53\u524D\u672A\u5728\u8FD0\u884C\uFF0C\u542F\u52A8\u540E\u65B0\u673A\u5668\u4EBA\u5373\u53EF\u4E0A\u7EBF\u3002'],
+        confirmLabel: '\u7ACB\u5373\u542F\u52A8',
+        onConfirm: function () { postAction('/api/daemon/start', '\u542F\u52A8'); },
+      });
+    }
   }
 
   function copyRow(text) {
@@ -14930,7 +14942,9 @@ ${UI_PURE_JS}
     w.textContent = '';
     w.appendChild(el('h3', null, '\u{1F389} \u63A5\u5165\u5B8C\u6210'));
     w.appendChild(wizStepBar(3));
-    w.appendChild(el('div', 'note', '\u673A\u5668\u4EBA\u300C' + ((wizSetup && wizSetup.botName) || wizBotId || '') + '\u300D\u5DF2\u5C31\u7EEA\uFF0C\u4E8B\u4EF6\u8BA2\u9605\u5DF2\u751F\u6548\u3002'));
+    w.appendChild(el('div', 'note', '\u673A\u5668\u4EBA\u300C' + ((wizSetup && wizSetup.botName) || wizBotId || '') + '\u300D\u5DF2\u52A0\u5165\u6D3B\u8DC3\u96C6\u3002'));
+    // \u8FDB\u5165\u5B8C\u6210\u9875\u5373\u5F39\u7A97\u786E\u8BA4\u91CD\u542F Feishu Bridge \u628A\u65B0 bot \u62C9\u8D77\u4E0A\u7EBF\uFF08\u4E00\u6B21\u6027\uFF1B\u5DF2\u5728\u7EBF\u5219\u4E0D\u5F39\uFF09\u3002
+    maybePromptRestartAtDone();
     var ul = el('div'); ul.style.margin = '12px 0';
     [
       '\u2460 \u5728\u98DE\u4E66\u91CC\u79C1\u804A\u8FD9\u4E2A\u673A\u5668\u4EBA\uFF0C\u70B9\u300C\u2795 \u65B0\u5EFA\u9879\u76EE\u300D\u628A\u4E00\u4E2A\u76EE\u5F55\u7ED1\u6210\u9879\u76EE\u7FA4\uFF1B',
@@ -15037,7 +15051,7 @@ var DEFAULT_WEB_PORT = 51847;
 var COOKIE_NAME = "fcb_console_token";
 var SSE_INITIAL_TAIL_BYTES = 16 * 1024;
 function createWebServer(opts) {
-  const token = opts.token ?? randomUUID6();
+  const token = opts.token ?? randomUUID7();
   const html = opts.html ?? UI_HTML;
   const logDir = opts.logDir ?? join19(paths.appDir, "logs");
   const sseCleanups = /* @__PURE__ */ new Set();
@@ -15380,7 +15394,7 @@ function createWebServer(opts) {
   function handleRegisterQrStream(req, res) {
     qrSession?.abort.abort();
     const abort = new AbortController();
-    const session = { id: randomUUID6(), abort };
+    const session = { id: randomUUID7(), abort };
     qrSession = session;
     res.writeHead(200, {
       "Content-Type": "text/event-stream",
@@ -15657,23 +15671,27 @@ async function readJsonBody(req) {
 }
 
 // src/web/mount.ts
+async function listenCanonical(web, attempts = 25, gapMs = 200) {
+  for (let i = 0; i < attempts; i++) {
+    try {
+      return await web.listen(DEFAULT_WEB_PORT);
+    } catch (err) {
+      if (err.code !== "EADDRINUSE") throw err;
+      if (i < attempts - 1) await new Promise((r) => setTimeout(r, gapMs));
+    }
+  }
+  log.warn("web", "console-port-busy-fallback", { preferred: DEFAULT_WEB_PORT });
+  return web.listen(0);
+}
 async function mountWebConsole(service) {
-  const web = createWebServer({ service });
+  const web = createWebServer({ service, token: stableWebConsoleToken() });
   let port;
   let url;
   try {
-    ({ port, url } = await web.listen(DEFAULT_WEB_PORT));
+    ({ port, url } = await listenCanonical(web));
   } catch (err) {
-    if (err.code !== "EADDRINUSE") {
-      log.fail("web", err, { phase: "console-listen" });
-      return void 0;
-    }
-    try {
-      ({ port, url } = await web.listen(0));
-    } catch (err2) {
-      log.fail("web", err2, { phase: "console-listen-fallback" });
-      return void 0;
-    }
+    log.fail("web", err, { phase: "console-listen" });
+    return void 0;
   }
   publishWebConsole({ port, token: web.token, pid: process.pid, startedAt: Date.now() });
   const exitCleanup = () => clearWebConsole();
@@ -16469,14 +16487,14 @@ async function runWeb(opts = {}) {
     console.log("   \xB7 \u4EC5\u672C\u673A\u53EF\u8BBF\u95EE\uFF08127.0.0.1\uFF09\uFF1BURL \u542B token\uFF0C\u8BF7\u52FF\u5916\u4F20/\u622A\u56FE\u3002");
     return;
   }
-  const port = opts.port ?? DEFAULT_WEB_PORT;
+  const port = opts.port ?? 0;
   if (!Number.isInteger(port) || port < 0 || port > 65535) {
     console.error(`\u2717 \u65E0\u6548\u7AEF\u53E3\uFF1A${opts.port}`);
     process.exitCode = 1;
     return;
   }
   const service = createReadonlyAdminService({ startDaemon: () => spawnDaemonControl("start") });
-  const web = createWebServer({ service, liveConsole: () => readWebConsole() });
+  const web = createWebServer({ service, token: stableWebConsoleToken(), liveConsole: () => readWebConsole() });
   let url;
   try {
     ({ url } = await web.listen(port));

package/dist/index.d.ts

@@ -55,6 +55,9 @@ declare const paths: {
     /** daemon 内嵌 Web 控制台的发现文件 {port, token, pid}（0600，daemon 退出
      * 清理）——`web` 子命令据此直接打开 daemon 控制台而不是再起只读副本。 */
     webConsoleFile: string;
+    /** 稳定的 Web 控制台 token（0600，**不随进程退出清理**）——让重启 / 预览→daemon
+     * 切换后浏览器里那条带 token 的 URL 始终有效，不再 401。删此文件即轮换 token。 */
+    webTokenFile: string;
 };
 
 export { log, newTraceId, paths, withTrace };

package/dist/index.js

@@ -61,7 +61,10 @@ var paths = {
   inboundDir: join(appDir, "inbound"),
   /** daemon 内嵌 Web 控制台的发现文件 {port, token, pid}（0600，daemon 退出
    * 清理）——`web` 子命令据此直接打开 daemon 控制台而不是再起只读副本。 */
-  webConsoleFile: join(appDir, "web-console.json")
+  webConsoleFile: join(appDir, "web-console.json"),
+  /** 稳定的 Web 控制台 token（0600，**不随进程退出清理**）——让重启 / 预览→daemon
+   * 切换后浏览器里那条带 token 的 URL 始终有效，不再 401。删此文件即轮换 token。 */
+  webTokenFile: join(appDir, "web-token")
 };
 
 // src/core/logger.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelzen/feishu-codex-bridge",
-  "version": "0.3.12-test.0",
+  "version": "0.3.12-test.1",
   "description": "Bridge Feishu/Lark messenger with local Codex via app-server (project=group, thread=session)",
   "type": "module",
   "bin": {