@rezti/dsh-rez-wechat 0.1.18 → 0.1.20

package/lib/web-shim.d.ts

@@ -9,6 +9,14 @@
  */
 export declare const WECHAT_WORKSPACE_NAME = "\u5FAE\u4FE1";
 export declare const DEFAULT_WEB_URL = "http://127.0.0.1:3080";
+/** Written by suite when dsh web boots; carries ?token= for 0.1.5 browser auth. */
+export declare function dshWebUrlFile(env?: NodeJS.ProcessEnv, home?: string): string;
+/** Origin only (no path/query). API posts go to `${origin}/api/...`. */
+export declare function webBaseUrl(env?: NodeJS.ProcessEnv, home?: string): string;
+/** Launch token from env, REZ_DSH_WEB_URL query, or ~/.dsh/dsh-web.url. */
+export declare function webLaunchToken(env?: NodeJS.ProcessEnv, home?: string): string | undefined;
+/** Exchange launch token for the HttpOnly dsh-auth cookie (dsh 0.1.5+). */
+export declare function mintWebAuthCookie(origin: string, token: string, timeoutMs?: number): Promise<string>;
 /** Seeded only when the inbox folder has no AGENTS.md yet. */
 export declare const WECHAT_INBOX_AGENTS: string;
 export interface ModelRef {
@@ -65,9 +73,18 @@ export declare function wechatWorkspaceDir(env?: NodeJS.ProcessEnv, home?: strin
 /** Write a short inbox AGENTS.md once; never overwrite a living file. Skip non-微信 rooms (企微按房间绑定). */
 export declare function ensureWechatInboxAgents(cwd: string): void;
 export declare function sessionStorePath(env?: NodeJS.ProcessEnv, home?: string): string;
-export declare function webBaseUrl(env?: NodeJS.ProcessEnv): string;
 export declare function loadSessionStore(path: string): SessionStore;
 export declare function saveSessionStore(path: string, store: SessionStore): void;
+/** dsh 0.1.5+ wire endpoint is `namespace/method` (slash), not `namespace.method`. */
+export declare function normalizeRpcEndpoint(method: string): string;
+/**
+ * Typert gateway requires `{ args }` on the wire. Unary Remotes with one
+ * `request` parameter expect `{ args: { request: fields } }`; zero-arg Remotes
+ * expect `{ args: {} }`.
+ */
+export declare function wrapRemoteArgs(params: Record<string, unknown>): {
+    args: Record<string, unknown>;
+};
 export declare function encodeClientRequest(method: string, payload: Record<string, unknown>, rpcId?: string): {
     type: 'client-request';
     rpcId: string;
@@ -104,7 +121,7 @@ export declare function weixinBridgeEnv(opts: {
     launcherPath: string;
     shimScript: string;
 }): NodeJS.ProcessEnv;
-export declare function postRpc(baseUrl: string, method: string, params: Record<string, unknown>, timeoutMs?: number): Promise<unknown>;
+export declare function postRpc(baseUrl: string, method: string, params: Record<string, unknown>, timeoutMs?: number, env?: NodeJS.ProcessEnv): Promise<unknown>;
 export declare function extractArchivedSessionIds(body: unknown): string[];
 /** Stock dsh archives one-way and hides blank sessions. Restore + attach + title. */
 export declare function ensureSessionVisible(rpc: RpcFn, sessionId: string, env?: NodeJS.ProcessEnv, workspaceId?: string, loopback?: boolean): Promise<void>;

package/lib/web-shim.js

@@ -13,6 +13,107 @@ import { homedir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 export const WECHAT_WORKSPACE_NAME = '微信';
 export const DEFAULT_WEB_URL = 'http://127.0.0.1:3080';
+/** Written by suite when dsh web boots; carries ?token= for 0.1.5 browser auth. */
+export function dshWebUrlFile(env = process.env, home = homedir()) {
+    return join(dshHomeDir(env, home), 'dsh-web.url');
+}
+/** Origin only (no path/query). API posts go to `${origin}/api/...`. */
+export function webBaseUrl(env = process.env, home = homedir()) {
+    const fromFile = (() => {
+        try {
+            return readFileSync(dshWebUrlFile(env, home), 'utf8').trim();
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    for (const raw of [env.REZ_DSH_WEB_URL, fromFile, DEFAULT_WEB_URL]) {
+        if (raw === undefined || raw.trim() === '')
+            continue;
+        try {
+            const withScheme = /:\/\//.test(raw.trim()) ? raw.trim() : `http://${raw.trim()}`;
+            const url = new URL(withScheme);
+            return `${url.protocol}//${url.host}`;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    return DEFAULT_WEB_URL;
+}
+/** Launch token from env, REZ_DSH_WEB_URL query, or ~/.dsh/dsh-web.url. */
+export function webLaunchToken(env = process.env, home = homedir()) {
+    const fromEnv = env.REZ_DSH_WEB_TOKEN?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const candidates = [env.REZ_DSH_WEB_URL, (() => {
+            try {
+                return readFileSync(dshWebUrlFile(env, home), 'utf8').trim();
+            }
+            catch {
+                return undefined;
+            }
+        })()];
+    for (const raw of candidates) {
+        if (raw === undefined || raw === '')
+            continue;
+        try {
+            const withScheme = /:\/\//.test(raw) ? raw : `http://${raw}`;
+            const token = new URL(withScheme).searchParams.get('token');
+            if (token !== null && token.length > 0)
+                return token;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    return undefined;
+}
+const authCookies = new Map();
+function collectSetCookies(headers) {
+    const anyHeaders = headers;
+    if (typeof anyHeaders.getSetCookie === 'function') {
+        return anyHeaders.getSetCookie();
+    }
+    const single = headers.get('set-cookie');
+    return single === null ? [] : [single];
+}
+/** Exchange launch token for the HttpOnly dsh-auth cookie (dsh 0.1.5+). */
+export async function mintWebAuthCookie(origin, token, timeoutMs = RPC_TIMEOUT_MS) {
+    const url = `${origin.replace(/\/$/, '')}/?token=${encodeURIComponent(token)}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'GET',
+            redirect: 'manual',
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        throw new Error(`换取 dsh web 认证 cookie 失败（${origin}）：${why}`);
+    }
+    const pairs = collectSetCookies(response.headers)
+        .map((row) => row.split(';', 1)[0]?.trim())
+        .filter((row) => typeof row === 'string' && row.includes('='));
+    if (pairs.length === 0) {
+        throw new Error('dsh web 未下发认证 cookie。请用终端打印的完整地址打开网页（必须带 ?token=），或确认 ~/.dsh/dsh-web.url 已由 suite 写入。');
+    }
+    return pairs.join('; ');
+}
+async function authCookieFor(origin, env, force = false) {
+    if (!force) {
+        const cached = authCookies.get(origin);
+        if (cached !== undefined)
+            return cached;
+    }
+    const token = webLaunchToken(env);
+    if (token === undefined)
+        return undefined;
+    const cookie = await mintWebAuthCookie(origin, token);
+    authCookies.set(origin, cookie);
+    return cookie;
+}
 /** Seeded only when the inbox folder has no AGENTS.md yet. */
 export const WECHAT_INBOX_AGENTS = [
     '# 微信',
@@ -151,9 +252,6 @@ export function sessionStorePath(env = process.env, home = homedir()) {
         return env.REZ_WECHAT_SESSION_STORE;
     return join(dshHomeDir(env, home), 'dsh-rez-weixin', 'web-sessions.json');
 }
-export function webBaseUrl(env = process.env) {
-    return (env.REZ_DSH_WEB_URL ?? DEFAULT_WEB_URL).replace(/\/$/, '');
-}
 export function loadSessionStore(path) {
     try {
         const parsed = JSON.parse(readFileSync(path, 'utf8'));
@@ -172,8 +270,32 @@ export function saveSessionStore(path, store) {
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, JSON.stringify(store, null, 2), 'utf8');
 }
+/** dsh 0.1.5+ wire endpoint is `namespace/method` (slash), not `namespace.method`. */
+export function normalizeRpcEndpoint(method) {
+    if (method.includes('/'))
+        return method;
+    const dot = method.indexOf('.');
+    if (dot <= 0)
+        return method;
+    return `${method.slice(0, dot)}/${method.slice(dot + 1)}`;
+}
+/**
+ * Typert gateway requires `{ args }` on the wire. Unary Remotes with one
+ * `request` parameter expect `{ args: { request: fields } }`; zero-arg Remotes
+ * expect `{ args: {} }`.
+ */
+export function wrapRemoteArgs(params) {
+    const keys = Object.keys(params);
+    if (keys.length === 1 && keys[0] === 'args' && typeof params.args === 'object' && params.args !== null && !Array.isArray(params.args)) {
+        return { args: params.args };
+    }
+    if (keys.length === 0)
+        return { args: {} };
+    return { args: { request: params } };
+}
 export function encodeClientRequest(method, payload, rpcId = randomUUID()) {
-    return { type: 'client-request', rpcId, method, payload };
+    const endpoint = normalizeRpcEndpoint(method);
+    return { type: 'client-request', rpcId, method: endpoint, payload: wrapRemoteArgs(payload) };
 }
 export function unwrapRpc(body) {
     if (typeof body !== 'object' || body === null)
@@ -587,11 +709,21 @@ export function historyEvents(body) {
     if (typeof unwrapped !== 'object' || unwrapped === null)
         return [];
     const rec = unwrapped;
-    const raw = Array.isArray(rec.events) ? rec.events
-        : Array.isArray(rec.messages) ? rec.messages
-            : Array.isArray(rec.items) ? rec.items
-                : Array.isArray(rec.log) ? rec.log
-                    : [];
+    // 0.1.5 session/page → { records: [{ type:'event', event }] }
+    const fromRecords = Array.isArray(rec.records)
+        ? rec.records.map((row) => {
+            if (typeof row === 'object' && row !== null && row.type === 'event') {
+                return row.event ?? row;
+            }
+            return row;
+        })
+        : undefined;
+    const raw = fromRecords
+        ?? (Array.isArray(rec.events) ? rec.events
+            : Array.isArray(rec.messages) ? rec.messages
+                : Array.isArray(rec.items) ? rec.items
+                    : Array.isArray(rec.log) ? rec.log
+                        : []);
     return raw.map(unwrapHistoryItem);
 }
 export function lastAssistantText(events) {
@@ -717,27 +849,61 @@ export function weixinBridgeEnv(opts) {
     env.DSH_BRIDGE_DSH = opts.launcherPath;
     env.REZ_WECHAT_SESSION_STORE = env.REZ_WECHAT_SESSION_STORE ?? join(opts.dataDir, 'web-sessions.json');
     env.REZ_WECHAT_WORKSPACE = env.REZ_WECHAT_WORKSPACE ?? wechatWorkspaceDir(env);
-    env.REZ_DSH_WEB_URL = env.REZ_DSH_WEB_URL ?? DEFAULT_WEB_URL;
+    // Prefer printed/suite URL (port + ?token=); do not force bare :3080 over it.
+    if (env.REZ_DSH_WEB_URL === undefined || env.REZ_DSH_WEB_URL.trim() === '') {
+        try {
+            const printed = readFileSync(dshWebUrlFile(env), 'utf8').trim();
+            if (printed.length > 0)
+                env.REZ_DSH_WEB_URL = printed;
+        }
+        catch {
+            env.REZ_DSH_WEB_URL = DEFAULT_WEB_URL;
+        }
+    }
     return env;
 }
 async function sleep(ms) {
     await new Promise(resolve => setTimeout(resolve, ms));
 }
-export async function postRpc(baseUrl, method, params, timeoutMs = RPC_TIMEOUT_MS) {
-    const url = `${baseUrl.replace(/\/$/, '')}/api/${method}`;
-    const envelope = encodeClientRequest(method, params);
-    let response;
-    try {
-        response = await fetch(url, {
+export async function postRpc(baseUrl, method, params, timeoutMs = RPC_TIMEOUT_MS, env = process.env) {
+    const origin = (() => {
+        try {
+            const withScheme = /:\/\//.test(baseUrl) ? baseUrl : `http://${baseUrl}`;
+            const url = new URL(withScheme);
+            return `${url.protocol}//${url.host}`;
+        }
+        catch {
+            return webBaseUrl(env);
+        }
+    })();
+    const endpoint = normalizeRpcEndpoint(method);
+    const url = `${origin}/api/${endpoint}`;
+    const envelope = encodeClientRequest(endpoint, params);
+    const send = async (cookie) => {
+        const headers = { 'content-type': 'application/json' };
+        if (cookie !== undefined && cookie.length > 0)
+            headers.cookie = cookie;
+        return fetch(url, {
             method: 'POST',
-            headers: { 'content-type': 'application/json' },
+            headers,
             body: JSON.stringify(envelope),
             signal: AbortSignal.timeout(timeoutMs),
         });
+    };
+    let cookie = await authCookieFor(origin, env);
+    let response;
+    try {
+        response = await send(cookie);
+        if (response.status === 401) {
+            authCookies.delete(origin);
+            cookie = await authCookieFor(origin, env, true);
+            if (cookie !== undefined)
+                response = await send(cookie);
+        }
     }
     catch (error) {
         const why = error instanceof Error ? error.message : String(error);
-        throw new Error(`连不上本机 dsh web（${baseUrl}）：${why}。请保持网页端开着。`);
+        throw new Error(`连不上本机 dsh web（${origin}）：${why}。请保持网页端开着。`);
     }
     const raw = await response.text();
     let parsed;
@@ -745,6 +911,9 @@ export async function postRpc(baseUrl, method, params, timeoutMs = RPC_TIMEOUT_M
         parsed = raw === '' ? {} : JSON.parse(raw);
     }
     catch {
+        if (response.status === 401) {
+            throw new Error(`dsh web ${method} 返回 401 unauthorized。请用终端打印的带 ?token= 的完整 URL 打开网页一次，或升级 suite 后确认 ~/.dsh/dsh-web.url 存在。原文: ${raw.slice(0, 160)}`);
+        }
         throw new Error(`dsh web ${method} 返回非 JSON (${response.status}): ${raw.slice(0, 240)}`);
     }
     const body = unwrapRpc(parsed);
@@ -758,35 +927,28 @@ async function ensureWorkspace(rpc, cwd) {
     mkdirSync(cwd, { recursive: true });
     ensureWechatInboxAgents(cwd);
     try {
-        const created = await rpc('workspace.create', { path: cwd });
-        const id = extractWorkspaceId(created) ?? findWorkspaceId(created, cwd);
-        if (id !== undefined)
-            return id;
-    }
-    catch {
-        // create may 409 / invalid-path; list is the reconnect authority
-    }
-    try {
-        return findWorkspaceId(await rpc('workspace.list', {}), cwd);
+        // 0.1.5 workspace/create is upsert-like ({ created: boolean }); list RPC is gone.
+        const created = await rpc('workspace/create', { path: cwd });
+        return extractWorkspaceId(created) ?? findWorkspaceId(created, cwd);
     }
     catch {
         return undefined;
     }
 }
 async function createSession(rpc, cwd, workspaceId) {
-    // Official session.create accepts at most one of workspaceId / cwd.
-    // workspaceId is the one that attachSession-s into the 微信 sidebar.
+    // Official session/create accepts at most one of workspaceId / cwd.
+    // workspaceId is the one that insertSessionBefore-s into the 微信 sidebar.
     const payload = workspaceId !== undefined ? { workspaceId } : { cwd };
-    const created = await rpc('session.create', payload);
+    const created = await rpc('session/create', payload);
     const id = extractSessionId(created);
     if (id === undefined)
-        throw new Error('session.create 没有返回 sessionId');
+        throw new Error('session/create 没有返回 sessionId');
     return id;
 }
 async function maybeSelectModel(rpc, sessionId, env) {
     let models;
     try {
-        models = await rpc('session.models', { sessionId });
+        models = await rpc('session/modelCatalog', {});
     }
     catch {
         models = undefined;
@@ -796,7 +958,7 @@ async function maybeSelectModel(rpc, sessionId, env) {
         return;
     for (const payload of selectModelPayloads(sessionId, ref)) {
         try {
-            await rpc('session.selectModel', payload);
+            await rpc('session/selectModel', payload);
             return;
         }
         catch {
@@ -804,15 +966,31 @@ async function maybeSelectModel(rpc, sessionId, env) {
         }
     }
 }
+/** 0.1.5 replaced session.history with session/page. */
+async function fetchSessionHistory(rpc, sessionId, maxMessages = 40) {
+    return historyEvents(await rpc('session/page', {
+        address: { kind: 'session', sessionId },
+        throughSeq: Number.MAX_SAFE_INTEGER,
+        maxMessages,
+    }));
+}
 async function sessionAlive(rpc, sessionId) {
     try {
-        await rpc('session.history', { sessionId, maxMessages: 1 });
+        await fetchSessionHistory(rpc, sessionId, 1);
         return true;
     }
     catch {
         return false;
     }
 }
+function promptPayload(sessionId, text) {
+    return {
+        requestId: randomUUID(),
+        sessionId,
+        mode: 'queue',
+        content: [{ type: 'text', text }],
+    };
+}
 export function extractArchivedSessionIds(body) {
     const unwrapped = unwrapRpc(body);
     if (typeof unwrapped !== 'object' || unwrapped === null)
@@ -840,15 +1018,19 @@ async function tryRpc(rpc, method, params) {
 }
 /** Stock dsh archives one-way and hides blank sessions. Restore + attach + title. */
 export async function ensureSessionVisible(rpc, sessionId, env = process.env, workspaceId, loopback = true) {
-    await tryRpc(rpc, 'workspace.unarchiveSession', { sessionId });
-    await tryRpc(rpc, 'session.unarchive', { sessionId });
+    // 0.1.5 dropped unarchive/attach RPCs; insertSessionBefore is the sidebar join.
     if (loopback) {
         const workspacePath = wechatWorkspaceDir(env);
-        const url = `${webBaseUrl(env)}/api/dsh-rez-suite/weixin/unarchive`;
+        const origin = webBaseUrl(env);
+        const url = `${origin}/api/dsh-rez-suite/weixin/unarchive`;
         try {
+            const headers = { 'content-type': 'application/json' };
+            const cookie = await authCookieFor(origin, env);
+            if (cookie !== undefined)
+                headers.cookie = cookie;
             await fetch(url, {
                 method: 'POST',
-                headers: { 'content-type': 'application/json' },
+                headers,
                 body: JSON.stringify({ sessionId, workspacePath }),
                 signal: AbortSignal.timeout(3000),
             });
@@ -858,17 +1040,16 @@ export async function ensureSessionVisible(rpc, sessionId, env = process.env, wo
         }
     }
     if (workspaceId !== undefined) {
-        await tryRpc(rpc, 'workspace.attachSession', { workspaceId, sessionId });
-        await tryRpc(rpc, 'workspace.insertSessionBefore', { workspaceId, sessionId });
+        await tryRpc(rpc, 'workspace/insertSessionBefore', { workspaceId, sessionId });
     }
     const title = basename(wechatWorkspaceDir(env)) || WECHAT_WORKSPACE_NAME;
-    await tryRpc(rpc, 'session.rename', { sessionId, title });
+    await tryRpc(rpc, 'session/rename', { sessionId, title });
 }
 async function archiveSession(rpc, sessionId) {
-    await tryRpc(rpc, 'workspace.archiveSession', { sessionId });
+    await tryRpc(rpc, 'workspace/archiveSession', { sessionId });
 }
 async function abortSessionTurn(rpc, sessionId) {
-    for (const method of ['session.abort', 'session.cancel', 'session.stop', 'session.interrupt']) {
+    for (const method of ['session/cancel', 'session/abort', 'session/stop', 'session/interrupt']) {
         if (await tryRpc(rpc, method, { sessionId }))
             return;
     }
@@ -898,7 +1079,7 @@ async function tryAnswerPendingQuestion(rpc, sessionId, choice) {
         { sessionId, answer },
         { sessionId, answers: answer.answers },
     ];
-    for (const method of ['question.respond', 'session.respondQuestion']) {
+    for (const method of ['question/respond', 'session/respondQuestion']) {
         for (const params of payloads) {
             if (await tryRpcQuick(rpc, method, params))
                 return true;
@@ -923,7 +1104,7 @@ async function waitForAssistant(rpc, sessionId, beforeText, timeoutMs, ignorePen
     while (Date.now() < deadline) {
         let events = [];
         try {
-            events = historyEvents(await rpc('session.history', { sessionId, maxMessages: 40 }));
+            events = await fetchSessionHistory(rpc, sessionId, 40);
         }
         catch {
             events = [];
@@ -994,7 +1175,7 @@ export async function runHeadlessViaWeb(opts) {
     let before = '';
     let events = [];
     try {
-        events = historyEvents(await rpc('session.history', { sessionId, maxMessages: 40 }));
+        events = await fetchSessionHistory(rpc, sessionId, 40);
         before = usableAssistantText(lastAssistantText(events));
     }
     catch {
@@ -1013,11 +1194,7 @@ export async function runHeadlessViaWeb(opts) {
             const answered = await tryAnswerPendingQuestion(rpc, sessionId, choice);
             if (!answered) {
                 await abortSessionTurn(rpc, sessionId);
-                await rpc('session.prompt', {
-                    sessionId,
-                    mode: 'queue',
-                    content: [{ type: 'text', text: `用户在微信选择了：${choice.label}` }],
-                });
+                await rpc('session/prompt', promptPayload(sessionId, `用户在微信选择了：${choice.label}`));
             }
             skipUserPrompt = true;
         }
@@ -1026,11 +1203,7 @@ export async function runHeadlessViaWeb(opts) {
         if (!turnIsIdle(events) || turnIsBlocked(events)) {
             await abortSessionTurn(rpc, sessionId);
         }
-        await rpc('session.prompt', {
-            sessionId,
-            mode: 'queue',
-            content: [{ type: 'text', text: promptText }],
-        });
+        await rpc('session/prompt', promptPayload(sessionId, promptText));
     }
     const reply = await waitForAssistant(rpc, sessionId, before, timeoutMs, questions, stuckAck(folder));
     store.sessions[key] = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rezti/dsh-rez-wechat",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "ReZ-TI WeChat/WeCom bridges. Personal WeChat is QClaw/ClawBot scan-and-chat via dsh-wechat-bridge; WeCom AI bots use the official @wecom/aibot-node-sdk (BotID + Secret) bound per Harness room.",
   "type": "module",
   "engines": {