@peng272/dsh-wechat-ilink 0.8.0 → 0.9.1

package/CHANGELOG.md

@@ -15,6 +15,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > documentation this project has: every one of them was an assumed DSH contract
 > that turned out to be wrong.
 
+## [0.9.0]
+
+### Added
+
+- **`dsh-wechat-ilink share <path>` — deliver a file as a link.** The file is
+  published into a share directory and a plain text message carrying an
+  unguessable download URL is sent to the bound user.
+
+### Why not an attachment
+
+  0.8.0 tried to send media items. They do not work, and the measurements are
+  unambiguous:
+
+  | Path | Gateway | CDN | Chat |
+  | --- | --- | --- | --- |
+  | `media_type: 1` (image) | issues an upload URL | **HTTP 400 `x-error-code -5102031`** | — |
+  | `media_type: 3` (file) | issues an upload URL | HTTP 200 + `x-encrypted-param` | **nothing appears** |
+  | text | — | — | arrives |
+
+  `sendmessage` returns a `message_id` for file items, so the gateway accepts
+  them; the ClawBot chat UI simply does not render attachment messages. Two
+  variants were tested against a live chat and neither appeared: an image item
+  over a file-type upload (to isolate the renderer), and a file item carrying
+  `create_time_ms` + `is_completed` (to rule out missing fields).
+
+  Text is the only channel proven to arrive, so a file becomes a link.
+  `send` is kept for completeness but is documented as not rendering.
+
+- **`dsh-wechat-ilink serve [port]`** — the LAN share server (default port
+  8791). It serves only the share directory, requires the token embedded in
+  every URL, refuses traversal outside the share directory, and is intended to
+  run under a scheduled task.
 ## [0.8.0]
 
 ### Added

package/lib/cli.js

@@ -20,6 +20,7 @@ import path from 'node:path'
 import { AccountStore, resolveStateDir } from './accounts.js'
 import { ILinkClient, QrLoginManager, DEFAULT_BASE_URL, renderQrPng, sendLocalFile } from './ilink.js'
 import { redactToken, readLogTail } from './support.js'
+import { DEFAULT_PORT, publishFile, shareUrl, startShareServer, lanAddress } from './share.js'
 
 const CHANNEL_VERSION = '2.4.9'
 
@@ -195,13 +196,98 @@ async function cmdSend(args) {
   }
 }
 
+/**
+ * Publish a file into the share directory and send the download link as text.
+ *
+ * This is the route that actually reaches the phone: text always renders, media
+ * items never do (see lib/share.js for the measurements).
+ */
+async function cmdShare(args) {
+  const target = args[0]
+  if (!target) {
+    out('用法: dsh-wechat-ilink share <文件路径> [端口]')
+    out('     把文件发布成一条链接并发送给已绑定的微信用户。')
+    return 1
+  }
+  const abs = path.resolve(target)
+  if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) {
+    out(`文件不存在或不是文件: ${abs}`)
+    return 1
+  }
+
+  const { store, client } = makeRuntime()
+  const ids = store.listAccountIds()
+  if (ids.length === 0) {
+    out('还没有绑定微信账号。先运行: dsh-wechat-ilink login')
+    return 1
+  }
+  const account = store.load(ids[0])
+  const inboundFile = path.join(store.dir, 'outbound.json')
+  if (!fs.existsSync(inboundFile)) {
+    out('还拿不到 context_token —— 请先在微信里给机器人发一条消息，再重试。')
+    return 1
+  }
+  const inbound = JSON.parse(fs.readFileSync(inboundFile, 'utf-8'))
+  if (!inbound?.userId || !inbound?.contextToken) {
+    out(`${inboundFile} 里缺少 userId / contextToken。`)
+    return 1
+  }
+
+  const shareDir = resolveShareDir()
+  const port = Number(args[1]) || DEFAULT_PORT
+  const published = publishFile(shareDir, abs)
+  const urlLan = shareUrl(shareDir, published.storedName, port)
+  const urlV6 = shareUrlV6(shareDir, published.storedName, port)
+
+  out(`已发布  ${published.originalName}  (${published.bytes} 字节)`)
+  out(`存放于  ${shareDir}`)
+  out(`局域网  ${urlLan}`)
+  out(`公网v6  ${urlV6 ?? '（本机没有公网 IPv6）'}`)
+  if (!lanAddress()) out('⚠️ 本机没有局域网 IPv4 地址。')
+
+  // Two links on purpose: which one works depends on where the phone is, and the
+  // phone is the only place that can decide. Same Wi-Fi -> the LAN link; mobile
+  // data -> the IPv6 link (if the carrier routes inbound).
+  const lines = [`📎 ${published.originalName}（${published.bytes} 字节）`, '', '手机和电脑在同一个 Wi-Fi 时，点这个：', urlLan]
+  if (urlV6) lines.push('', '手机用流量（不同网络）时，点这个：', urlV6)
+  else lines.push('', '（本机没有公网 IPv6，离开局域网需要别的通道）')
+
+  const res = await client.sendText(account.token, inbound.userId, lines.join('\n'), inbound.contextToken)
+  if (res?.message_id) {
+    out(`✅ 链接消息已发送  message_id=${res.message_id}`)
+    return 0
+  }
+  out(`⚠️ 发送返回: ${JSON.stringify(res)}`)
+  return 1
+}
+
+/** Run the LAN share server in the foreground. */
+function cmdServe(args) {
+  const port = Number(args[0]) || DEFAULT_PORT
+  const shareDir = resolveShareDir()
+  const server = startShareServer({ shareDir, port, log: (m) => out(`[${new Date().toISOString()}] ${m}`) })
+  server.on('error', (error) => {
+    out(`❌ 共享服务启动失败: ${error?.message ?? error}`)
+    process.exit(1)
+  })
+  // Keep the process alive.
+  return new Promise(() => {})
+}
+
+/** Share directory: next to the credentials, overridable for tests. */
+function resolveShareDir() {
+  return process.env.DSH_WECHAT_SHARE_DIR?.trim() || path.join(resolveStateDir(), 'share')
+}
+
 function usage() {
   out('dsh-wechat-ilink — 微信 ClawBot 通道')
   out('')
   out('用法：')
   out('  dsh-wechat-ilink login         扫码绑定一个微信账号')
   out('  dsh-wechat-ilink status        显示绑定状态与游标')
-  out('  dsh-wechat-ilink send <路径>   把本机文件发送给已绑定的微信用户')
+  out('  dsh-wechat-ilink share <路径>  把本机文件发布成一条可点击的下载链接（推荐）')
+  out('  dsh-wechat-ilink send <路径>   以附件形式发送（实测微信 ClawBot 不显示附件）')
+  out('  dsh-wechat-ilink serve [端口]  启动局域网文件共享服务（供 share 使用）')
   out('  dsh-wechat-ilink logs [n]      打印通道日志尾部')
   out('  dsh-wechat-ilink logout        解除全部绑定')
   return 0
@@ -220,6 +306,12 @@ try {
     case 'send':
       code = await cmdSend(rest)
       break
+    case 'share':
+      code = await cmdShare(rest)
+      break
+    case 'serve':
+      code = await cmdServe(rest)
+      break
     case 'logs':
       code = cmdLogs(rest)
       break

package/lib/share.js

@@ -0,0 +1,207 @@
+/**
+ * LAN file share for the WeChat channel.
+ *
+ * Why this exists: the WeChat ClawBot chat UI does not render attachment
+ * messages. Measured behaviour —
+ *   - uploads of `media_type: 3` succeed and `sendmessage` returns a
+ *     `message_id`, yet nothing appears in the chat;
+ *   - uploads of `media_type: 1` are rejected outright by the CDN
+ *     (`HTTP 400 x-error-code -5102031`).
+ * Text, by contrast, always arrives. So instead of fighting the media format,
+ * a file becomes a plain text message containing a link the phone can open.
+ *
+ * The share directory holds only files deliberately published through
+ * `dsh-wechat-ilink share`, and every URL carries an unguessable token, so the
+ * port being reachable on the LAN does not expose the rest of the machine.
+ */
+import fs from 'node:fs'
+import http from 'node:http'
+import os from 'node:os'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+export const DEFAULT_PORT = 8791
+
+/** First non-loopback IPv4 address, or null when there is none. */
+export function lanAddress() {
+  const ifaces = os.networkInterfaces()
+  for (const list of Object.values(ifaces)) {
+    for (const entry of list ?? []) {
+      if (entry.family === 'IPv4' && !entry.internal) return entry.address
+    }
+  }
+  return null
+}
+
+/**
+ * Global (public) IPv6 address, or null.
+ *
+ * Prefers a stable interface identifier (`SuffixOrigin: link`, i.e. EUI-64 style)
+ * over a privacy-extension one, because the prefix may rotate while the suffix
+ * does not. Falls back to any global unicast address.
+ */
+export function publicV6Address() {
+  const ifaces = os.networkInterfaces()
+  const globals = []
+  for (const list of Object.values(ifaces)) {
+    for (const entry of list ?? []) {
+      if (entry.family !== 'IPv6' || entry.internal) continue
+      if (!/^(2|3)/.test(entry.address)) continue // global unicast only (2000::/3)
+      globals.push(entry)
+    }
+  }
+  if (globals.length === 0) return null
+  const stable = globals.find((e) => e.scopeid === 0 && /^(240e|2400|2401|2409|2408)/.test(e.address))
+  return (stable ?? globals[0]).address
+}
+
+/** Read the share token, creating it on first use. */
+export function ensureToken(shareDir) {
+  fs.mkdirSync(shareDir, { recursive: true })
+  const file = path.join(shareDir, '.token')
+  try {
+    const existing = fs.readFileSync(file, 'utf-8').trim()
+    if (existing) return existing
+  } catch {
+    /* create below */
+  }
+  const token = crypto.randomBytes(16).toString('hex')
+  fs.writeFileSync(file, token, 'utf-8')
+  return token
+}
+
+/**
+ * Publish one local file into the share directory.
+ *
+ * The stored name carries a short random prefix so a link cannot be guessed from
+ * the original file name alone.
+ *
+ * @returns {{storedName: string, bytes: number, originalName: string}}
+ */
+export function publishFile(shareDir, sourcePath) {
+  fs.mkdirSync(shareDir, { recursive: true })
+  const originalName = path.basename(sourcePath)
+  const safe = originalName.replace(/[^\w.\-\u4e00-\u9fa5]+/g, '_').slice(0, 80) || 'file'
+  const storedName = `${crypto.randomBytes(4).toString('hex')}-${safe}`
+  fs.copyFileSync(sourcePath, path.join(shareDir, storedName))
+  return { storedName, bytes: fs.statSync(sourcePath).size, originalName }
+}
+
+/** Build the URL a phone can open over the local network. */
+export function shareUrl(shareDir, storedName, port = DEFAULT_PORT) {
+  const token = ensureToken(shareDir)
+  const host = lanAddress() ?? '127.0.0.1'
+  return `http://${host}:${port}/f/${token}/${encodeURIComponent(storedName)}`
+}
+
+/** Same file over the public IPv6 address (reachable when the phone is NOT on the LAN). */
+export function shareUrlV6(shareDir, storedName, port = DEFAULT_PORT) {
+  const host = publicV6Address()
+  if (!host) return null
+  const token = ensureToken(shareDir)
+  return `http://[${host}]:${port}/f/${token}/${encodeURIComponent(storedName)}`
+}
+
+function escapeHtml(text) {
+  return String(text).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c])
+}
+
+const MIME = {
+  '.txt': 'text/plain; charset=utf-8',
+  '.md': 'text/markdown; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.pdf': 'application/pdf',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.webp': 'image/webp',
+  '.zip': 'application/zip',
+  '.csv': 'text/csv; charset=utf-8',
+  '.log': 'text/plain; charset=utf-8',
+}
+
+/**
+ * Start the share server.
+ *
+ * @param {{shareDir: string, port?: number, log?: (m: string) => void}} options
+ * @returns {import('node:http').Server}
+ */
+export function startShareServer({ shareDir, port = DEFAULT_PORT, log = () => {} }) {
+  const token = ensureToken(shareDir)
+
+  const server = http.createServer((req, res) => {
+    let url
+    try {
+      url = new URL(req.url ?? '/', 'http://localhost')
+    } catch {
+      res.writeHead(400).end('bad request')
+      return
+    }
+    const parts = url.pathname.split('/').filter(Boolean)
+    // /f/<token>/<name>  and  /f/<token>/  (index)
+    if (parts[0] !== 'f' || parts[1] !== token) {
+      log(`denied ${req.method} ${url.pathname} from ${req.socket.remoteAddress}`)
+      res.writeHead(404).end('not found')
+      return
+    }
+
+    if (parts.length === 2) {
+      let entries = []
+      try {
+        entries = fs.readdirSync(shareDir).filter((n) => !n.startsWith('.'))
+      } catch {
+        /* empty */
+      }
+      const items = entries
+        .map((n) => {
+          const st = fs.statSync(path.join(shareDir, n))
+          return `<li><a href="/f/${token}/${encodeURIComponent(n)}">${escapeHtml(n)}</a> <small>${st.size} B</small></li>`
+        })
+        .join('')
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+      res.end(`<!doctype html><meta name="viewport" content="width=device-width,initial-scale=1"><h3>共享文件</h3><ul>${items || '<li>（空）</li>'}</ul>`)
+      log(`index served (${entries.length} file(s))`)
+      return
+    }
+
+    const name = decodeURIComponent(parts.slice(2).join('/'))
+    // Never let a crafted name escape the share directory.
+    const resolved = path.resolve(shareDir, name)
+    if (!resolved.startsWith(path.resolve(shareDir) + path.sep)) {
+      log(`escape attempt blocked: ${name}`)
+      res.writeHead(403).end('forbidden')
+      return
+    }
+    let st
+    try {
+      st = fs.statSync(resolved)
+    } catch {
+      res.writeHead(404).end('not found')
+      return
+    }
+    if (!st.isFile()) {
+      res.writeHead(404).end('not found')
+      return
+    }
+
+    log(`served ${name} (${st.size} B) to ${req.socket.remoteAddress}`)
+    res.writeHead(200, {
+      'Content-Type': MIME[path.extname(resolved).toLowerCase()] ?? 'application/octet-stream',
+      'Content-Length': st.size,
+      'Content-Disposition': `attachment; filename*=UTF-8''${encodeURIComponent(path.basename(resolved))}`,
+    })
+    fs.createReadStream(resolved).pipe(res)
+  })
+
+  // Dual-stack: bind the IPv6 wildcard, which also accepts IPv4 on Windows, so
+  // the same port serves the LAN URL and the public IPv6 URL.
+  server.listen(port, '::', () => {
+    log(`share server listening on [::]:${port}  dir=${shareDir}`)
+    log(`LAN URL base  : http://${lanAddress() ?? '<no-lan-ip>'}:${port}/f/${token}/`)
+    const v6 = publicV6Address()
+    log(`public V6 base: ${v6 ? `http://[${v6}]:${port}/f/${token}/` : '(no global IPv6)'}`)
+  })
+
+  return server
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peng272/dsh-wechat-ilink",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "WeChat ClawBot (Tencent iLink) channel for DeepSeek Harness 0.2.0-rc.2 — talk to DSH from WeChat.",
   "type": "module",
   "main": "lib/index.js",
@@ -11,6 +11,7 @@
     ".": "./lib/index.js",
     "./schema": "./lib/schema.js",
     "./cdn": "./lib/cdn.js",
+    "./share": "./lib/share.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },