@rezti/dsh-rez-wechat 0.1.17 → 0.1.19

package/README.md

@@ -6,7 +6,7 @@
 dsh plugin --profile web add @rezti/dsh-rez-suite
 ```
 
-以后升级只记：`dsh plugin --profile web update @rezti/dsh-rez-suite`。不要再单独 add 本包。
+以后升级只记：`dsh plugin --profile web add @rezti/dsh-rez-suite@latest`。不要再单独 add 本包。
 
 | 能力 | 做法 |
 |---|---|

package/lib/web-shim.d.ts

@@ -9,6 +9,14 @@
  */
 export declare const WECHAT_WORKSPACE_NAME = "\u5FAE\u4FE1";
 export declare const DEFAULT_WEB_URL = "http://127.0.0.1:3080";
+/** Written by suite when dsh web boots; carries ?token= for 0.1.5 browser auth. */
+export declare function dshWebUrlFile(env?: NodeJS.ProcessEnv, home?: string): string;
+/** Origin only (no path/query). API posts go to `${origin}/api/...`. */
+export declare function webBaseUrl(env?: NodeJS.ProcessEnv, home?: string): string;
+/** Launch token from env, REZ_DSH_WEB_URL query, or ~/.dsh/dsh-web.url. */
+export declare function webLaunchToken(env?: NodeJS.ProcessEnv, home?: string): string | undefined;
+/** Exchange launch token for the HttpOnly dsh-auth cookie (dsh 0.1.5+). */
+export declare function mintWebAuthCookie(origin: string, token: string, timeoutMs?: number): Promise<string>;
 /** Seeded only when the inbox folder has no AGENTS.md yet. */
 export declare const WECHAT_INBOX_AGENTS: string;
 export interface ModelRef {
@@ -65,7 +73,6 @@ export declare function wechatWorkspaceDir(env?: NodeJS.ProcessEnv, home?: strin
 /** Write a short inbox AGENTS.md once; never overwrite a living file. Skip non-微信 rooms (企微按房间绑定). */
 export declare function ensureWechatInboxAgents(cwd: string): void;
 export declare function sessionStorePath(env?: NodeJS.ProcessEnv, home?: string): string;
-export declare function webBaseUrl(env?: NodeJS.ProcessEnv): string;
 export declare function loadSessionStore(path: string): SessionStore;
 export declare function saveSessionStore(path: string, store: SessionStore): void;
 export declare function encodeClientRequest(method: string, payload: Record<string, unknown>, rpcId?: string): {
@@ -104,7 +111,7 @@ export declare function weixinBridgeEnv(opts: {
     launcherPath: string;
     shimScript: string;
 }): NodeJS.ProcessEnv;
-export declare function postRpc(baseUrl: string, method: string, params: Record<string, unknown>, timeoutMs?: number): Promise<unknown>;
+export declare function postRpc(baseUrl: string, method: string, params: Record<string, unknown>, timeoutMs?: number, env?: NodeJS.ProcessEnv): Promise<unknown>;
 export declare function extractArchivedSessionIds(body: unknown): string[];
 /** Stock dsh archives one-way and hides blank sessions. Restore + attach + title. */
 export declare function ensureSessionVisible(rpc: RpcFn, sessionId: string, env?: NodeJS.ProcessEnv, workspaceId?: string, loopback?: boolean): Promise<void>;

package/lib/web-shim.js

@@ -13,6 +13,107 @@ import { homedir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 export const WECHAT_WORKSPACE_NAME = '微信';
 export const DEFAULT_WEB_URL = 'http://127.0.0.1:3080';
+/** Written by suite when dsh web boots; carries ?token= for 0.1.5 browser auth. */
+export function dshWebUrlFile(env = process.env, home = homedir()) {
+    return join(dshHomeDir(env, home), 'dsh-web.url');
+}
+/** Origin only (no path/query). API posts go to `${origin}/api/...`. */
+export function webBaseUrl(env = process.env, home = homedir()) {
+    const fromFile = (() => {
+        try {
+            return readFileSync(dshWebUrlFile(env, home), 'utf8').trim();
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    for (const raw of [env.REZ_DSH_WEB_URL, fromFile, DEFAULT_WEB_URL]) {
+        if (raw === undefined || raw.trim() === '')
+            continue;
+        try {
+            const withScheme = /:\/\//.test(raw.trim()) ? raw.trim() : `http://${raw.trim()}`;
+            const url = new URL(withScheme);
+            return `${url.protocol}//${url.host}`;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    return DEFAULT_WEB_URL;
+}
+/** Launch token from env, REZ_DSH_WEB_URL query, or ~/.dsh/dsh-web.url. */
+export function webLaunchToken(env = process.env, home = homedir()) {
+    const fromEnv = env.REZ_DSH_WEB_TOKEN?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const candidates = [env.REZ_DSH_WEB_URL, (() => {
+            try {
+                return readFileSync(dshWebUrlFile(env, home), 'utf8').trim();
+            }
+            catch {
+                return undefined;
+            }
+        })()];
+    for (const raw of candidates) {
+        if (raw === undefined || raw === '')
+            continue;
+        try {
+            const withScheme = /:\/\//.test(raw) ? raw : `http://${raw}`;
+            const token = new URL(withScheme).searchParams.get('token');
+            if (token !== null && token.length > 0)
+                return token;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    return undefined;
+}
+const authCookies = new Map();
+function collectSetCookies(headers) {
+    const anyHeaders = headers;
+    if (typeof anyHeaders.getSetCookie === 'function') {
+        return anyHeaders.getSetCookie();
+    }
+    const single = headers.get('set-cookie');
+    return single === null ? [] : [single];
+}
+/** Exchange launch token for the HttpOnly dsh-auth cookie (dsh 0.1.5+). */
+export async function mintWebAuthCookie(origin, token, timeoutMs = RPC_TIMEOUT_MS) {
+    const url = `${origin.replace(/\/$/, '')}/?token=${encodeURIComponent(token)}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'GET',
+            redirect: 'manual',
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        throw new Error(`换取 dsh web 认证 cookie 失败（${origin}）：${why}`);
+    }
+    const pairs = collectSetCookies(response.headers)
+        .map((row) => row.split(';', 1)[0]?.trim())
+        .filter((row) => typeof row === 'string' && row.includes('='));
+    if (pairs.length === 0) {
+        throw new Error('dsh web 未下发认证 cookie。请用终端打印的完整地址打开网页（必须带 ?token=），或确认 ~/.dsh/dsh-web.url 已由 suite 写入。');
+    }
+    return pairs.join('; ');
+}
+async function authCookieFor(origin, env, force = false) {
+    if (!force) {
+        const cached = authCookies.get(origin);
+        if (cached !== undefined)
+            return cached;
+    }
+    const token = webLaunchToken(env);
+    if (token === undefined)
+        return undefined;
+    const cookie = await mintWebAuthCookie(origin, token);
+    authCookies.set(origin, cookie);
+    return cookie;
+}
 /** Seeded only when the inbox folder has no AGENTS.md yet. */
 export const WECHAT_INBOX_AGENTS = [
     '# 微信',
@@ -151,9 +252,6 @@ export function sessionStorePath(env = process.env, home = homedir()) {
         return env.REZ_WECHAT_SESSION_STORE;
     return join(dshHomeDir(env, home), 'dsh-rez-weixin', 'web-sessions.json');
 }
-export function webBaseUrl(env = process.env) {
-    return (env.REZ_DSH_WEB_URL ?? DEFAULT_WEB_URL).replace(/\/$/, '');
-}
 export function loadSessionStore(path) {
     try {
         const parsed = JSON.parse(readFileSync(path, 'utf8'));
@@ -717,27 +815,60 @@ export function weixinBridgeEnv(opts) {
     env.DSH_BRIDGE_DSH = opts.launcherPath;
     env.REZ_WECHAT_SESSION_STORE = env.REZ_WECHAT_SESSION_STORE ?? join(opts.dataDir, 'web-sessions.json');
     env.REZ_WECHAT_WORKSPACE = env.REZ_WECHAT_WORKSPACE ?? wechatWorkspaceDir(env);
-    env.REZ_DSH_WEB_URL = env.REZ_DSH_WEB_URL ?? DEFAULT_WEB_URL;
+    // Prefer printed/suite URL (port + ?token=); do not force bare :3080 over it.
+    if (env.REZ_DSH_WEB_URL === undefined || env.REZ_DSH_WEB_URL.trim() === '') {
+        try {
+            const printed = readFileSync(dshWebUrlFile(env), 'utf8').trim();
+            if (printed.length > 0)
+                env.REZ_DSH_WEB_URL = printed;
+        }
+        catch {
+            env.REZ_DSH_WEB_URL = DEFAULT_WEB_URL;
+        }
+    }
     return env;
 }
 async function sleep(ms) {
     await new Promise(resolve => setTimeout(resolve, ms));
 }
-export async function postRpc(baseUrl, method, params, timeoutMs = RPC_TIMEOUT_MS) {
-    const url = `${baseUrl.replace(/\/$/, '')}/api/${method}`;
+export async function postRpc(baseUrl, method, params, timeoutMs = RPC_TIMEOUT_MS, env = process.env) {
+    const origin = (() => {
+        try {
+            const withScheme = /:\/\//.test(baseUrl) ? baseUrl : `http://${baseUrl}`;
+            const url = new URL(withScheme);
+            return `${url.protocol}//${url.host}`;
+        }
+        catch {
+            return webBaseUrl(env);
+        }
+    })();
+    const url = `${origin}/api/${method}`;
     const envelope = encodeClientRequest(method, params);
-    let response;
-    try {
-        response = await fetch(url, {
+    const send = async (cookie) => {
+        const headers = { 'content-type': 'application/json' };
+        if (cookie !== undefined && cookie.length > 0)
+            headers.cookie = cookie;
+        return fetch(url, {
             method: 'POST',
-            headers: { 'content-type': 'application/json' },
+            headers,
             body: JSON.stringify(envelope),
             signal: AbortSignal.timeout(timeoutMs),
         });
+    };
+    let cookie = await authCookieFor(origin, env);
+    let response;
+    try {
+        response = await send(cookie);
+        if (response.status === 401) {
+            authCookies.delete(origin);
+            cookie = await authCookieFor(origin, env, true);
+            if (cookie !== undefined)
+                response = await send(cookie);
+        }
     }
     catch (error) {
         const why = error instanceof Error ? error.message : String(error);
-        throw new Error(`连不上本机 dsh web（${baseUrl}）：${why}。请保持网页端开着。`);
+        throw new Error(`连不上本机 dsh web（${origin}）：${why}。请保持网页端开着。`);
     }
     const raw = await response.text();
     let parsed;
@@ -745,6 +876,9 @@ export async function postRpc(baseUrl, method, params, timeoutMs = RPC_TIMEOUT_M
         parsed = raw === '' ? {} : JSON.parse(raw);
     }
     catch {
+        if (response.status === 401) {
+            throw new Error(`dsh web ${method} 返回 401 unauthorized。请用终端打印的带 ?token= 的完整 URL 打开网页一次，或升级 suite 后确认 ~/.dsh/dsh-web.url 存在。原文: ${raw.slice(0, 160)}`);
+        }
         throw new Error(`dsh web ${method} 返回非 JSON (${response.status}): ${raw.slice(0, 240)}`);
     }
     const body = unwrapRpc(parsed);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rezti/dsh-rez-wechat",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "ReZ-TI WeChat/WeCom bridges. Personal WeChat is QClaw/ClawBot scan-and-chat via dsh-wechat-bridge; WeCom AI bots use the official @wecom/aibot-node-sdk (BotID + Secret) bound per Harness room.",
   "type": "module",
   "engines": {
@@ -27,14 +27,14 @@
   ],
   "license": "Apache-2.0",
   "dependencies": {
+    "@rezti/dsh-rez-sso": "^0.1.18",
     "@wecom/aibot-node-sdk": "^1.0.7",
-    "qrcode": "^1.5.4",
-    "@rezti/dsh-rez-sso": "0.1.14"
+    "qrcode": "^1.5.4"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-host-webserver": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.2",
     "@types/node": "^22.20.0",
     "@types/qrcode": "^1.5.5",
     "typescript": "~5.7.2"