@nanhara/hara 0.123.1 → 0.124.1

package/dist/gateway/weixin.js

@@ -4,11 +4,10 @@
 // `qrcode-terminal` dep (graceful fallback to printing the URL). No encryption is needed on the text path
 // (iLink only uses crypto for media upload/download, which v1 doesn't do).
 import { homedir } from "node:os";
-import { join } from "node:path";
-import { chmodSync, readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, rmSync } from "node:fs";
 import { randomBytes, randomUUID, createHash, createCipheriv, createDecipheriv } from "node:crypto";
 import { chunkText } from "./telegram.js";
 import { INBOUND_MEDIA_MAX_BYTES, INBOUND_MEDIA_TIMEOUT_MS, InboundMediaBudget, cleanupTransientMedia, readResponseBytesLimited, savePrivateMediaBytes, } from "./media.js";
+import { bindPrivateHaraStateFile, readPrivateStateFileSnapshotSync, writePrivateStateFileSync, } from "../security/private-state.js";
 const ILINK_BASE_URL = "https://ilinkai.weixin.qq.com";
 const CHANNEL_VERSION = "2.2.0";
 const ILINK_APP_ID = "bot";
@@ -186,33 +185,53 @@ async function apiGet(baseUrl, endpoint, timeoutMs) {
         throw new Error(`iLink GET ${endpoint} HTTP ${res.status}: ${raw.slice(0, 200)}`);
     return JSON.parse(raw);
 }
-const weixinDir = () => join(homedir(), ".hara", "weixin");
-const credsFile = () => join(weixinDir(), "creds.json");
-export function loadWeixinCreds() {
+function weixinStateFile(filename) {
+    return bindPrivateHaraStateFile(homedir(), ["weixin"], filename);
+}
+function accountStateFilename(accountId, suffix) {
+    const normalized = String(accountId ?? "").trim();
+    const key = /^[A-Za-z0-9_-]{1,128}$/.test(normalized)
+        ? normalized
+        : `account-${createHash("sha256").update(normalized).digest("hex")}`;
+    return `${key}${suffix}`;
+}
+/** Return peer identifiers without exposing token values or bypassing the private-state reader. */
+export function weixinKnownPeers(accountId) {
     try {
-        return existsSync(credsFile()) ? JSON.parse(readFileSync(credsFile(), "utf8")) : null;
+        const binding = weixinStateFile(accountStateFilename(accountId, ".context-tokens.json"));
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, 8 * 1024 * 1024);
+        if (!snapshot)
+            return [];
+        const parsed = JSON.parse(snapshot.text);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return [];
+        return Object.entries(parsed)
+            .slice(-1000)
+            .filter(([peer, token]) => Boolean(peer) && typeof token === "string" && Boolean(token))
+            .map(([peer]) => peer);
     }
     catch {
-        return null;
+        return [];
     }
 }
-function saveWeixinCreds(c) {
-    mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
+export function loadWeixinCreds() {
     try {
-        chmodSync(weixinDir(), 0o700);
+        const binding = weixinStateFile("creds.json");
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, 1024 * 1024);
+        return snapshot ? JSON.parse(snapshot.text) : null;
     }
-    catch { /* best effort */ }
-    writeFileSync(credsFile(), JSON.stringify(c, null, 2), { mode: 0o600 });
-    try {
-        chmodSync(credsFile(), 0o600);
+    catch {
+        return null;
     }
-    catch { /* best effort */ }
+}
+function saveWeixinCreds(c) {
+    writePrivateStateFileSync(weixinStateFile("creds.json"), JSON.stringify(c, null, 2) + "\n");
 }
 // get_updates_buf cursor — persisted so a restart resumes the message stream where it left off.
 function loadCursor(accountId) {
     try {
-        const f = join(weixinDir(), `${accountId}.cursor`);
-        return existsSync(f) ? readFileSync(f, "utf8") : "";
+        const binding = weixinStateFile(accountStateFilename(accountId, ".cursor"));
+        return readPrivateStateFileSnapshotSync(binding.path, 4 * 1024 * 1024)?.text ?? "";
     }
     catch {
         return "";
@@ -220,11 +239,8 @@ function loadCursor(accountId) {
 }
 function saveCursor(accountId, buf) {
     try {
-        mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
-        chmodSync(weixinDir(), 0o700);
-        const file = join(weixinDir(), `${accountId}.cursor`);
-        writeFileSync(file, buf, { mode: 0o600 });
-        chmodSync(file, 0o600);
+        const binding = weixinStateFile(accountStateFilename(accountId, ".cursor"));
+        writePrivateStateFileSync(binding, buf);
     }
     catch {
         /* best-effort */
@@ -237,10 +253,9 @@ class TokenStore {
     constructor(accountId) {
         this.accountId = accountId;
         try {
-            const exists = existsSync(this.file());
-            const parsed = exists ? JSON.parse(readFileSync(this.file(), "utf8")) : {};
-            if (exists)
-                chmodSync(this.file(), 0o600);
+            const binding = this.binding();
+            const snapshot = readPrivateStateFileSnapshotSync(binding.path, 8 * 1024 * 1024);
+            const parsed = snapshot ? JSON.parse(snapshot.text) : {};
             if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
                 for (const [peer, token] of Object.entries(parsed).slice(-1000)) {
                     if (peer && typeof token === "string" && token)
@@ -252,32 +267,19 @@ class TokenStore {
             this.cache.clear();
         }
     }
-    file() {
-        return join(weixinDir(), `${this.accountId}.context-tokens.json`);
+    binding() {
+        return weixinStateFile(accountStateFilename(this.accountId, ".context-tokens.json"));
     }
     peerKey(peer) {
         return String(peer ?? "").trim().slice(0, 256);
     }
     persist() {
-        const temporary = `${this.file()}.${process.pid}.${randomUUID()}.tmp`;
         try {
-            mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
-            chmodSync(weixinDir(), 0o700);
-            writeFileSync(temporary, JSON.stringify(Object.fromEntries(this.cache)), { mode: 0o600, flag: "wx" });
-            renameSync(temporary, this.file());
-            chmodSync(this.file(), 0o600);
+            writePrivateStateFileSync(this.binding(), JSON.stringify(Object.fromEntries(this.cache)) + "\n");
         }
         catch {
             /* best-effort */
         }
-        finally {
-            try {
-                rmSync(temporary, { force: true });
-            }
-            catch {
-                /* best-effort */
-            }
-        }
     }
     get(peer) {
         const key = this.peerKey(peer);