@unlinearity/cli-wechat-bridge 1.0.3 → 1.0.5

package/dist/wechat/wechat-transport.js

@@ -1,14 +1,15 @@
 import crypto from "node:crypto";
-import { createCipheriv } from "node:crypto";
+import { createCipheriv, createDecipheriv } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { CONTEXT_CACHE_FILE, CREDENTIALS_FILE, ensureChannelDataDir, INBOUND_MESSAGE_CLAIMS_DIR, migrateLegacyChannelFiles, SYNC_BUF_FILE, } from "./channel-config.js";
+import { CONTEXT_CACHE_FILE, CREDENTIALS_FILE, ensureChannelDataDir, INBOUND_ATTACHMENTS_DIR, INBOUND_MESSAGE_CLAIMS_DIR, migrateLegacyChannelFiles, SYNC_BUF_FILE, } from "./channel-config.js";
 export const DEFAULT_LONG_POLL_TIMEOUT_MS = 35_000;
 const CDN_BASE_URL = "https://novac2c.cdn.weixin.qq.com/c2c";
 const CHANNEL_VERSION = "0.3.0";
 const RECENT_MESSAGE_CACHE_SIZE = 500;
 const BYTES_PER_MB = 1024 * 1024;
 const SEND_TIMEOUT_MS = 15_000;
+const INBOUND_DOWNLOAD_TIMEOUT_MS = 30_000;
 const CDN_MAX_RETRIES = 3;
 const ERROR_CAUSE_DEPTH_LIMIT = 4;
 const INBOUND_MESSAGE_CLAIM_TTL_MS = 10 * 60 * 1000;
@@ -29,6 +30,26 @@ export function isWechatSyncSessionTimeout(response) {
     return (response.errcode === SYNC_SESSION_TIMEOUT_ERRCODE &&
         /session timeout/i.test(response.errmsg ?? ""));
 }
+export class WechatApiResponseError extends Error {
+    endpoint;
+    ret;
+    errcode;
+    errmsg;
+    constructor(params) {
+        const errmsg = params.errmsg ?? "";
+        super(`${params.endpoint} failed: ret=${params.ret} errcode=${params.errcode} errmsg=${errmsg}`);
+        this.name = "WechatApiResponseError";
+        this.endpoint = params.endpoint;
+        this.ret = params.ret;
+        this.errcode = params.errcode;
+        this.errmsg = errmsg;
+    }
+}
+export function isWechatContextTokenStaleError(error) {
+    return (error instanceof WechatApiResponseError &&
+        error.endpoint === "sendmessage" &&
+        error.ret === -2);
+}
 const DEFAULT_MEDIA_UPLOAD_LIMIT_MB = {
     image: 20,
     file: 50,
@@ -41,6 +62,14 @@ const MEDIA_UPLOAD_LIMIT_ENV_KEYS = {
     voice: "WECHAT_MAX_VOICE_MB",
     video: "WECHAT_MAX_VIDEO_MB",
 };
+const DEFAULT_MEDIA_INBOUND_LIMIT_MB = {
+    image: 20,
+    file: 50,
+};
+const MEDIA_INBOUND_LIMIT_ENV_KEYS = {
+    image: "WECHAT_MAX_INBOUND_IMAGE_MB",
+    file: "WECHAT_MAX_INBOUND_FILE_MB",
+};
 const RETRYABLE_HTTP_STATUS_CODES = new Set([408, 425, 429]);
 const RETRYABLE_NETWORK_ERROR_CODES = new Set([
     "ECONNABORTED",
@@ -88,6 +117,49 @@ function readJsonFile(filePath) {
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
+function readNumericResponseField(response, key) {
+    const value = response[key];
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === "string" && value.trim()) {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+    return undefined;
+}
+function readStringResponseField(response, key) {
+    const value = response[key];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+export function assertWechatApiResponseOk(endpoint, raw) {
+    const trimmed = raw.trim();
+    if (!trimmed) {
+        return;
+    }
+    let response;
+    try {
+        response = JSON.parse(trimmed);
+    }
+    catch {
+        return;
+    }
+    if (!isRecord(response)) {
+        return;
+    }
+    const ret = readNumericResponseField(response, "ret");
+    const errcode = readNumericResponseField(response, "errcode");
+    const failed = (ret !== undefined && ret !== 0) ||
+        (errcode !== undefined && errcode !== 0);
+    if (!failed) {
+        return;
+    }
+    const errmsg = readStringResponseField(response, "errmsg") ??
+        readStringResponseField(response, "message") ??
+        readStringResponseField(response, "msg") ??
+        "";
+    throw new WechatApiResponseError({ endpoint, ret, errcode, errmsg });
+}
 function describeErrorNode(value) {
     if (value instanceof Error) {
         const error = value;
@@ -282,9 +354,34 @@ function encryptAesEcb(plaintext, key) {
     const cipher = createCipheriv("aes-128-ecb", key, null);
     return Buffer.concat([cipher.update(plaintext), cipher.final()]);
 }
+function decryptAesEcb(ciphertext, key) {
+    const decipher = createDecipheriv("aes-128-ecb", key, null);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
 function aesEcbPaddedSize(plaintextSize) {
     return Math.ceil((plaintextSize + 1) / 16) * 16;
 }
+function isHexAesKey(value) {
+    return /^[a-f0-9]{32}$/i.test(value);
+}
+export function decodeInboundMediaAesKey(value) {
+    const trimmed = value.trim();
+    if (isHexAesKey(trimmed)) {
+        return Buffer.from(trimmed, "hex");
+    }
+    const decoded = Buffer.from(trimmed, "base64");
+    if (decoded.length === 16) {
+        return decoded;
+    }
+    const decodedText = decoded.toString("utf8").trim();
+    if (isHexAesKey(decodedText)) {
+        return Buffer.from(decodedText, "hex");
+    }
+    throw new Error("Unsupported inbound media aes key format.");
+}
+export function decryptInboundMediaPayload(ciphertext, aesKey) {
+    return decryptAesEcb(ciphertext, decodeInboundMediaAesKey(aesKey));
+}
 export function formatByteSize(bytes) {
     if (!Number.isFinite(bytes) || bytes < 0) {
         return "0 B";
@@ -307,6 +404,14 @@ export function resolveMediaUploadLimitBytes(label, env = process.env) {
     const limitMb = Number.isFinite(parsedMb) && parsedMb > 0 ? parsedMb : fallbackMb;
     return Math.floor(limitMb * BYTES_PER_MB);
 }
+export function resolveInboundMediaDownloadLimitBytes(label, env = process.env) {
+    const envKey = MEDIA_INBOUND_LIMIT_ENV_KEYS[label];
+    const raw = env[envKey];
+    const fallbackMb = DEFAULT_MEDIA_INBOUND_LIMIT_MB[label];
+    const parsedMb = raw ? Number(raw) : Number.NaN;
+    const limitMb = Number.isFinite(parsedMb) && parsedMb > 0 ? parsedMb : fallbackMb;
+    return Math.floor(limitMb * BYTES_PER_MB);
+}
 export function assertMediaUploadSizeAllowed(label, rawsize, env = process.env) {
     const limitBytes = resolveMediaUploadLimitBytes(label, env);
     if (rawsize <= limitBytes) {
@@ -316,6 +421,15 @@ export function assertMediaUploadSizeAllowed(label, rawsize, env = process.env)
     const labelName = label.charAt(0).toUpperCase() + label.slice(1);
     throw new Error(`${labelName} too large: ${formatByteSize(rawsize)} exceeds ${formatByteSize(limitBytes)} limit. Set ${envKey} to override.`);
 }
+function assertInboundMediaDownloadSizeAllowed(label, rawsize, env = process.env) {
+    const limitBytes = resolveInboundMediaDownloadLimitBytes(label, env);
+    if (rawsize <= limitBytes) {
+        return;
+    }
+    const envKey = MEDIA_INBOUND_LIMIT_ENV_KEYS[label];
+    const labelName = label.charAt(0).toUpperCase() + label.slice(1);
+    throw new Error(`${labelName} too large: ${formatByteSize(rawsize)} exceeds ${formatByteSize(limitBytes)} inbound limit. Set ${envKey} to override.`);
+}
 function encodeMessageAesKey(aeskey) {
     return Buffer.from(aeskey.toString("hex")).toString("base64");
 }
@@ -336,6 +450,32 @@ async function getUploadUrl(account, params) {
 function buildCdnUploadUrl(cdnBaseUrl, uploadParam, filekey) {
     return `${cdnBaseUrl}/upload?encrypted_query_param=${encodeURIComponent(uploadParam)}&filekey=${encodeURIComponent(filekey)}`;
 }
+export function buildCdnDownloadUrl(cdnBaseUrl, downloadParam) {
+    return `${cdnBaseUrl}/download?encrypted_query_param=${encodeURIComponent(downloadParam)}`;
+}
+function isTrustedCdnDownloadUrl(url) {
+    const trustedHost = new URL(CDN_BASE_URL).hostname;
+    return url.protocol === "https:" && url.hostname === trustedHost;
+}
+function resolveCdnDownloadUrl(media) {
+    const fullUrl = media.full_url?.trim();
+    if (fullUrl) {
+        try {
+            const url = new URL(fullUrl);
+            if (isTrustedCdnDownloadUrl(url)) {
+                return url.toString();
+            }
+        }
+        catch {
+            // Fall back to the encrypted query param below.
+        }
+    }
+    const downloadParam = media.encrypt_query_param?.trim();
+    if (!downloadParam) {
+        throw new Error("Inbound media is missing encrypt_query_param.");
+    }
+    return buildCdnDownloadUrl(CDN_BASE_URL, downloadParam);
+}
 async function uploadBufferToCdn(params) {
     const ciphertext = encryptAesEcb(params.buf, params.aeskey);
     const cdnUrl = buildCdnUploadUrl(CDN_BASE_URL, params.uploadParam, params.filekey);
@@ -378,6 +518,47 @@ async function uploadBufferToCdn(params) {
     }
     return { downloadParam };
 }
+async function downloadBufferFromCdn(params) {
+    const cdnUrl = resolveCdnDownloadUrl(params.media);
+    const limitBytes = resolveInboundMediaDownloadLimitBytes(params.kind);
+    let lastError;
+    for (let attempt = 1; attempt <= CDN_MAX_RETRIES; attempt += 1) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), INBOUND_DOWNLOAD_TIMEOUT_MS);
+        try {
+            const res = await fetch(cdnUrl, {
+                method: "GET",
+                signal: controller.signal,
+            });
+            clearTimeout(timer);
+            if (res.status >= 400 && res.status < 500) {
+                const errMsg = res.headers.get("x-error-message") ?? (await res.text());
+                throw new Error(`CDN client error ${res.status}: ${errMsg}`);
+            }
+            if (res.status !== 200) {
+                const errMsg = res.headers.get("x-error-message") ?? `status ${res.status}`;
+                throw new Error(`CDN server error: ${errMsg}`);
+            }
+            const contentLength = Number(res.headers.get("content-length") ?? "");
+            if (Number.isFinite(contentLength) && contentLength > aesEcbPaddedSize(limitBytes)) {
+                throw new Error(`${params.kind} download too large: ${formatByteSize(contentLength)} encrypted payload exceeds ${formatByteSize(limitBytes)} inbound limit.`);
+            }
+            return Buffer.from(await res.arrayBuffer());
+        }
+        catch (err) {
+            clearTimeout(timer);
+            lastError = err;
+            if (err instanceof Error && err.message.includes("client error")) {
+                throw err;
+            }
+            if (attempt >= CDN_MAX_RETRIES) {
+                break;
+            }
+            params.onRetry?.(attempt);
+        }
+    }
+    throw lastError instanceof Error ? lastError : new Error("CDN download failed");
+}
 function extractReferenceLabel(item) {
     const ref = item.ref_msg;
     if (!ref) {
@@ -393,11 +574,53 @@ function extractReferenceLabel(item) {
     }
     return parts.length ? `Quoted: ${parts.join(" | ")}` : null;
 }
-function extractTextFromMessage(message) {
+function parseExpectedSize(value) {
+    const parsed = typeof value === "number"
+        ? value
+        : typeof value === "string"
+            ? Number(value)
+            : Number.NaN;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;
+}
+function buildInboundAttachmentDescriptor(kind, item) {
+    if (kind === "image") {
+        const imageItem = item.image_item;
+        const media = imageItem?.media;
+        const aesKey = media?.aes_key ?? media?.aeskey ?? imageItem?.aes_key ?? imageItem?.aeskey;
+        if (!media || !aesKey?.trim()) {
+            return null;
+        }
+        return {
+            kind,
+            fileName: imageItem?.file_name?.trim() || "wechat-image.jpg",
+            media,
+            aesKey,
+            expectedSizeBytes: parseExpectedSize(imageItem?.mid_size),
+        };
+    }
+    const fileItem = item.file_item;
+    const media = fileItem?.media;
+    const aesKey = media?.aes_key ?? media?.aeskey ?? fileItem?.aes_key ?? fileItem?.aeskey;
+    if (!media || !aesKey?.trim()) {
+        return null;
+    }
+    return {
+        kind,
+        fileName: fileItem?.file_name?.trim() || "wechat-file",
+        media,
+        aesKey,
+        expectedSizeBytes: parseExpectedSize(fileItem?.len),
+    };
+}
+function formatUnsupportedInboundAttachment(kind) {
+    return `[WeChat ${kind} attachment could not be downloaded: missing media metadata]`;
+}
+export function extractInboundMessageContent(message) {
     if (!message.item_list?.length) {
-        return "";
+        return { text: "", attachments: [] };
     }
     const lines = [];
+    const attachments = [];
     for (const item of message.item_list) {
         const reference = extractReferenceLabel(item);
         if (reference && !lines.includes(reference)) {
@@ -415,8 +638,29 @@ function extractTextFromMessage(message) {
                 lines.push(transcript);
             }
         }
+        if (item.type === MSG_ITEM_IMAGE) {
+            const attachment = buildInboundAttachmentDescriptor("image", item);
+            if (attachment) {
+                attachments.push(attachment);
+            }
+            else {
+                lines.push(formatUnsupportedInboundAttachment("image"));
+            }
+        }
+        if (item.type === MSG_ITEM_FILE) {
+            const attachment = buildInboundAttachmentDescriptor("file", item);
+            if (attachment) {
+                attachments.push(attachment);
+            }
+            else {
+                lines.push(formatUnsupportedInboundAttachment("file"));
+            }
+        }
     }
-    return lines.join("\n").trim();
+    return {
+        text: lines.join("\n").trim(),
+        attachments,
+    };
 }
 function buildMessageKey(message) {
     return [
@@ -499,15 +743,42 @@ function formatTimestamp(timestampMs) {
     }
     return new Date(timestampMs).toISOString();
 }
+function appendInboundAttachmentFailureText(text, failureLines) {
+    if (failureLines.length === 0) {
+        return text;
+    }
+    return [text, ...failureLines].filter(Boolean).join("\n").trim();
+}
+function sanitizeInboundAttachmentFileName(fileName, fallback) {
+    const lastSegment = fileName.trim().replace(/\\/g, "/").split("/").pop() ?? "";
+    const withoutControlChars = Array.from(lastSegment)
+        .map((character) => (character.charCodeAt(0) < 32 ? "_" : character))
+        .join("");
+    const sanitized = withoutControlChars
+        .replace(/[<>:"/\\|?*]+/g, "_")
+        .replace(/\s+/g, " ")
+        .trim();
+    return sanitized.slice(0, 160) || fallback;
+}
+function buildInboundAttachmentFilePath(params) {
+    const timestamp = formatTimestamp(params.createdAtMs);
+    const day = timestamp.slice(0, 10);
+    const directory = path.join(INBOUND_ATTACHMENTS_DIR, day);
+    const fallback = params.kind === "image" ? "wechat-image.jpg" : "wechat-file";
+    const safeFileName = sanitizeInboundAttachmentFileName(params.fileName, fallback);
+    const uniquePrefix = `${timestamp.replace(/[:.]/g, "-")}-${crypto.randomBytes(4).toString("hex")}`;
+    return path.join(directory, `${uniquePrefix}-${safeFileName}`);
+}
 export class WeChatTransport {
     logger;
     recentMessageKeys = new Set();
     recentMessageOrder = [];
-    contextTokenCache = new Map(Object.entries(readJsonFile(CONTEXT_CACHE_FILE) ?? {}));
+    contextTokenCache;
     syncBuffer = "";
     constructor(logger) {
         this.logger = logger;
         migrateLegacyChannelFiles((message) => this.logger.log(message));
+        this.contextTokenCache = new Map(Object.entries(readJsonFile(CONTEXT_CACHE_FILE) ?? {}));
         this.syncBuffer = this.readSyncBuffer();
     }
     getCredentials() {
@@ -529,6 +800,8 @@ export class WeChatTransport {
             `max_file_mb: ${resolveMediaUploadLimitBytes("file") / BYTES_PER_MB}`,
             `max_voice_mb: ${resolveMediaUploadLimitBytes("voice") / BYTES_PER_MB}`,
             `max_video_mb: ${resolveMediaUploadLimitBytes("video") / BYTES_PER_MB}`,
+            `max_inbound_image_mb: ${resolveInboundMediaDownloadLimitBytes("image") / BYTES_PER_MB}`,
+            `max_inbound_file_mb: ${resolveInboundMediaDownloadLimitBytes("file") / BYTES_PER_MB}`,
             `account_id: ${account?.accountId ?? "(none)"}`,
             `user_id: ${account?.userId ?? "(none)"}`,
             `saved_at: ${account?.savedAt ?? "(none)"}`,
@@ -572,8 +845,8 @@ export class WeChatTransport {
             if (rawMessage.message_type !== MSG_TYPE_USER) {
                 continue;
             }
-            const text = extractTextFromMessage(rawMessage);
-            if (!text) {
+            const extracted = extractInboundMessageContent(rawMessage);
+            if (!extracted.text && extracted.attachments.length === 0) {
                 continue;
             }
             const messageKey = buildMessageKey(rawMessage);
@@ -587,17 +860,20 @@ export class WeChatTransport {
             if (rawMessage.context_token) {
                 this.cacheContextToken(senderId, rawMessage.context_token);
             }
-            const createdAtMs = rawMessage.create_time_ms;
+            const createdAtMs = rawMessage.create_time_ms ?? 0;
             if (typeof options.minCreatedAtMs === "number" &&
                 (!Number.isFinite(createdAtMs) || createdAtMs < options.minCreatedAtMs)) {
                 ignoredBacklogCount += 1;
                 continue;
             }
+            const { attachments, failureLines } = await this.downloadInboundAttachments(extracted.attachments, rawMessage);
+            const text = appendInboundAttachmentFailureText(extracted.text, failureLines);
             messages.push({
                 senderId,
                 sender: normalizeSender(senderId),
                 sessionId: rawMessage.session_id ?? "",
                 text,
+                attachments,
                 contextToken: rawMessage.context_token,
                 createdAt: formatTimestamp(rawMessage.create_time_ms),
                 createdAtMs,
@@ -605,6 +881,46 @@ export class WeChatTransport {
         }
         return { messages, ignoredBacklogCount };
     }
+    async downloadInboundAttachments(descriptors, rawMessage) {
+        const attachments = [];
+        const failureLines = [];
+        for (const descriptor of descriptors) {
+            try {
+                const encrypted = await downloadBufferFromCdn({
+                    media: descriptor.media,
+                    kind: descriptor.kind,
+                    onRetry: (attempt) => {
+                        this.logger.log(`CDN download attempt ${attempt} failed for inbound ${descriptor.kind}, retrying...`);
+                    },
+                });
+                const plaintext = decryptInboundMediaPayload(encrypted, descriptor.aesKey);
+                assertInboundMediaDownloadSizeAllowed(descriptor.kind, plaintext.length);
+                if (descriptor.expectedSizeBytes !== undefined &&
+                    plaintext.length !== descriptor.expectedSizeBytes) {
+                    this.logger.log(`Inbound ${descriptor.kind} size differs from metadata: expected=${descriptor.expectedSizeBytes} actual=${plaintext.length}`);
+                }
+                const filePath = buildInboundAttachmentFilePath({
+                    kind: descriptor.kind,
+                    fileName: descriptor.fileName,
+                    createdAtMs: rawMessage.create_time_ms,
+                });
+                fs.mkdirSync(path.dirname(filePath), { recursive: true });
+                fs.writeFileSync(filePath, plaintext);
+                attachments.push({
+                    kind: descriptor.kind,
+                    path: filePath,
+                    fileName: path.basename(filePath),
+                    sizeBytes: plaintext.length,
+                });
+            }
+            catch (error) {
+                const message = `Failed to download inbound WeChat ${descriptor.kind} (${descriptor.fileName}): ${describeWechatTransportError(error)}`;
+                this.logger.logError(message);
+                failureLines.push(`[${message}]`);
+            }
+        }
+        return { attachments, failureLines };
+    }
     async sendText(senderId, text) {
         const trimmed = text.trim();
         if (!trimmed) {
@@ -736,7 +1052,7 @@ export class WeChatTransport {
         ]);
     }
     async sendMessage(account, recipientId, contextToken, itemList) {
-        await apiFetch({
+        const raw = await apiFetch({
             baseUrl: account.baseUrl,
             endpoint: "ilink/bot/sendmessage",
             body: JSON.stringify({
@@ -754,6 +1070,7 @@ export class WeChatTransport {
             token: account.token,
             timeoutMs: SEND_TIMEOUT_MS,
         });
+        assertWechatApiResponseOk("sendmessage", raw);
     }
     async prepareUpload(account, recipientId, filePath, mediaType, label) {
         const stat = this.requireExistingFile(filePath);
@@ -881,6 +1198,15 @@ export class WeChatTransport {
             fs.rmSync(CONTEXT_CACHE_FILE, { force: true });
         }
     }
+    clearCachedContextToken(recipientId) {
+        const normalizedRecipientId = recipientId.trim();
+        if (!normalizedRecipientId || !this.contextTokenCache.has(normalizedRecipientId)) {
+            return false;
+        }
+        this.contextTokenCache.delete(normalizedRecipientId);
+        writeJsonFile(CONTEXT_CACHE_FILE, Object.fromEntries(this.contextTokenCache));
+        return true;
+    }
     generateClientId() {
         return `wechat-bridge:${Date.now()}-${crypto.randomBytes(4).toString("hex")}`;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unlinearity/cli-wechat-bridge",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "CLI WeChat Bridge for Codex, Claude Code, OpenCode, and PowerShell over WeChat",
   "type": "module",
   "files": [
@@ -43,6 +43,7 @@
     "wechat-bridge-opencode": "bin/wechat-bridge-opencode.mjs",
     "wechat-opencode": "bin/wechat-opencode.mjs",
     "wechat-opencode-start": "bin/wechat-opencode-start.mjs",
+    "wechat-daemon": "bin/wechat-daemon.mjs",
     "wechat-setup": "bin/wechat-setup.mjs",
     "wechat-check-update": "bin/wechat-check-update.mjs"
   },
@@ -50,10 +51,16 @@
     "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
     "build": "npm run clean && tsc -p tsconfig.build.json",
     "prepack": "npm run build",
+    "lint": "eslint bin src test",
+    "lint:fix": "eslint bin src test --fix",
+    "typecheck:src": "tsc -p tsconfig.typecheck.src.json --noEmit --pretty false",
+    "quality": "npm run lint && npm run typecheck:src && bun test test && npm run build",
+    "smoke:global": "node scripts/smoke-global-install.mjs",
     "setup": "node --no-warnings --experimental-strip-types src/wechat/setup.ts",
     "start": "node --no-warnings --experimental-strip-types src/wechat/wechat-channel.ts",
     "check": "node --no-warnings --experimental-strip-types src/wechat/wechat-channel.ts --check",
     "bridge": "node --no-warnings --experimental-strip-types src/bridge/wechat-bridge.ts",
+    "daemon": "node --no-warnings --experimental-strip-types src/daemon/wechat-daemon.ts",
     "bridge:codex": "node --no-warnings --experimental-strip-types src/bridge/wechat-bridge.ts --adapter codex",
     "codex:panel": "node --no-warnings --experimental-strip-types src/companion/codex-remote-client.ts",
     "codex:start": "node --no-warnings --experimental-strip-types src/companion/local-companion-start.ts",
@@ -80,8 +87,11 @@
     "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/bun": "latest",
-    "typescript": "^6.0.2"
+    "eslint": "^10.3.0",
+    "typescript": "^6.0.2",
+    "typescript-eslint": "^8.59.3"
   },
   "engines": {
     "bun": ">=1.0.0",