@unlinearity/cli-wechat-bridge 1.1.0 → 1.1.2

package/dist/utils/version-checker.js

@@ -1,48 +1,70 @@
 import fs from "node:fs";
 import path from "node:path";
-import { execSync } from "node:child_process";
 import { CHANNEL_DATA_DIR, ensureChannelDataDir } from "../wechat/channel-config.js";
 const UPDATE_CHECK_FILE = path.join(CHANNEL_DATA_DIR, "update-check.json");
 const CACHE_DURATION_MS = 24 * 60 * 60 * 1000; // 24小时
-/**
- * 使用 git 命令获取远程仓库最新版本号
- */
-export async function fetchLatestVersion() {
+// npm registry 是权威更新源——它是用户实际安装的渠道;GitHub tags 作为回退,
+// 以便在 registry 暂时不可达或包尚未发布时仍能给出最新版本。
+const NPM_PACKAGE_NAME = "cli-wechat-bridge";
+const DEFAULT_NPM_REGISTRY_URL = `https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`;
+const DEFAULT_GITHUB_TAGS_URL = "https://api.github.com/repos/UNLINEARITY/CLI-WeChat-Bridge/tags?per_page=20";
+const FETCH_TIMEOUT_MS = 10_000;
+function resolveFetchDeps(options) {
+    return {
+        fetch: options.fetchImpl ?? globalThis.fetch,
+        npmRegistryUrl: options.npmRegistryUrl ?? DEFAULT_NPM_REGISTRY_URL,
+        githubTagsUrl: options.githubTagsUrl ?? DEFAULT_GITHUB_TAGS_URL,
+        timeoutMs: options.timeoutMs ?? FETCH_TIMEOUT_MS,
+    };
+}
+async function fetchJsonWithTimeout(url, deps) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.timeoutMs);
     try {
-        // 尝试使用 git ls-remote 获取所有 tags
-        const tagsOutput = execSync('git ls-remote --tags origin', {
-            cwd: path.resolve(import.meta.dirname, "..", ".."),
-            encoding: 'utf-8',
-            stdio: ['ignore', 'pipe', 'ignore']
+        const res = await deps.fetch(url, {
+            method: "GET",
+            signal: controller.signal,
+            headers: { Accept: "application/json" },
         });
-        if (!tagsOutput) {
-            return null;
-        }
-        // 解析 tags，找到版本号格式（如 0.1.0, 0.2.0 等）
-        const versionTags = tagsOutput
-            .split('\n')
-            .filter(line => {
-            // 匹配 refs/tags/0.5.0 格式（不是 v0.5.0）
-            return line.includes('refs/tags/') &&
-                !line.includes('^{}') &&
-                /^\w+\s+refs\/tags\/\d+\.\d+\.\d+$/.test(line);
-        })
-            .map(line => {
-            const match = line.match(/refs\/tags\/(\d+\.\d+\.\d+)$/);
-            return match ? match[1] : null;
-        })
-            .filter((v) => v !== null);
-        if (versionTags.length === 0) {
+        if (!res.ok) {
             return null;
         }
-        // 按版本号排序，返回最新的
-        versionTags.sort((a, b) => compareVersions(b, a));
-        return versionTags[0] ?? null;
+        return await res.json();
     }
-    catch (error) {
-        // 如果 git 命令失败，静默返回 null
+    catch {
+        // 网络/超时/解析失败一律视为该源不可用,交由调用方回退。
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function fetchVersionFromNpm(deps) {
+    const data = await fetchJsonWithTimeout(deps.npmRegistryUrl, deps);
+    if (!data || typeof data !== "object") {
         return null;
     }
+    const version = data.version;
+    return typeof version === "string" ? parseVersion(version) : null;
+}
+async function fetchVersionFromGithub(deps) {
+    const data = await fetchJsonWithTimeout(deps.githubTagsUrl, deps);
+    if (!Array.isArray(data)) {
+        return null;
+    }
+    const versions = data
+        .map((tag) => parseVersion(tag.name))
+        .filter((v) => v !== null)
+        .sort((a, b) => compareVersions(b, a));
+    return versions[0] ?? null;
+}
+/**
+ * 从 npm registry 获取最新版本号(回退到 GitHub tags)。
+ * 通过 HTTPS 请求而非本地 git 命令,因此对全局安装的命令(wechat-check-update)同样可用。
+ */
+export async function fetchLatestVersion(options = {}) {
+    const deps = resolveFetchDeps(options);
+    return (await fetchVersionFromNpm(deps)) ?? (await fetchVersionFromGithub(deps));
 }
 /**
  * 从本地 package.json 读取当前版本
@@ -85,6 +107,17 @@ function writeUpdateCache(cache) {
         // 静默失败，不影响正常使用
     }
 }
+const VERSION_PATTERN = /(\d+\.\d+\.\d+)/;
+/**
+ * 从任意字符串中提取版本号,兼容带 "v" 前缀的 tag(如 "v1.1.1")。
+ */
+export function parseVersion(raw) {
+    if (typeof raw !== "string") {
+        return null;
+    }
+    const match = VERSION_PATTERN.exec(raw.trim());
+    return match ? (match[1] ?? null) : null;
+}
 /**
  * 比较两个版本号
  * @returns 返回值 > 0 表示 version1 更新，< 0 表示 version2 更新，= 0 表示相等
@@ -146,16 +179,16 @@ export async function checkForUpdate(forceCheck = false) {
  */
 export function formatUpdateMessage(versionInfo) {
     const { current, latest } = versionInfo;
-    return `
-[Update Available] Version ${latest} is available (current: ${current})
-
-Update instructions:
-   cd CLI-WeChat-Bridge
-   git pull
-   bun install
-   npm install -g .
-
-For more information:
-   https://github.com/UNLINEARITY/CLI-WeChat-Bridge/releases
+    return `
+[Update Available] Version ${latest} is available (current: ${current})
+
+Update instructions:
+   cd CLI-WeChat-Bridge
+   git pull
+   bun install
+   npm install -g .
+
+For more information:
+   https://github.com/UNLINEARITY/CLI-WeChat-Bridge/releases
 `;
 }

package/dist/wechat/channel-config.js

@@ -18,6 +18,34 @@ export const SYNC_BUF_FILE = path.join(CHANNEL_DATA_DIR, "sync_buf.txt");
 export const CONTEXT_CACHE_FILE = path.join(CHANNEL_DATA_DIR, "context_tokens.json");
 export const BRIDGE_STATE_FILE = path.join(CHANNEL_DATA_DIR, "bridge-state.json");
 export const BRIDGE_LOG_FILE = path.join(CHANNEL_DATA_DIR, "bridge.log");
+// Hard cap for bridge.log. Long-running daemons otherwise grow it without bound.
+export const BRIDGE_LOG_MAX_BYTES = 5 * 1024 * 1024; // 5 MiB
+/**
+ * Append a line to a log file, trimming it down to the tail half whenever it
+ * exceeds BRIDGE_LOG_MAX_BYTES. Trimming is best-effort under concurrent
+ * writers (a few lines may be lost during a trim) but keeps the file bounded.
+ */
+export function appendBoundedLog(filePath, line) {
+    try {
+        const stat = fs.statSync(filePath);
+        if (stat.size > BRIDGE_LOG_MAX_BYTES) {
+            const keepSize = Math.floor(BRIDGE_LOG_MAX_BYTES / 2);
+            const fd = fs.openSync(filePath, "r");
+            try {
+                const tail = Buffer.alloc(keepSize);
+                const bytesRead = fs.readSync(fd, tail, 0, keepSize, stat.size - keepSize);
+                fs.writeFileSync(filePath, tail.subarray(0, bytesRead));
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+    }
+    catch {
+        // File missing or unreadable: fall through to a plain append.
+    }
+    fs.appendFileSync(filePath, line);
+}
 export const BRIDGE_LOCK_FILE = path.join(CHANNEL_DATA_DIR, "bridge.lock.json");
 export const DAEMON_ENDPOINT_FILE = path.join(CHANNEL_DATA_DIR, "daemon-endpoint.json");
 export const CODEX_PANEL_ENDPOINT_FILE = path.join(CHANNEL_DATA_DIR, "codex-panel-endpoint.json");

package/dist/wechat/wechat-transport.js

@@ -306,7 +306,12 @@ export function classifyWechatTransportError(error) {
 }
 function writeJsonFile(filePath, value) {
     ensureChannelDataDir();
-    fs.writeFileSync(filePath, JSON.stringify(value, null, 2), "utf-8");
+    const data = JSON.stringify(value, null, 2);
+    // Atomic write via temp file + rename, so a crash mid-write cannot leave a
+    // truncated/half-written JSON that would break readers on the next launch.
+    const tempPath = `${filePath}.${process.pid}.tmp`;
+    fs.writeFileSync(tempPath, data, "utf-8");
+    fs.renameSync(tempPath, filePath);
 }
 function randomWechatUin() {
     const uint32 = crypto.randomBytes(4).readUInt32BE(0);
@@ -445,7 +450,15 @@ async function getUploadUrl(account, params) {
         token: account.token,
         timeoutMs: SEND_TIMEOUT_MS,
     });
-    return JSON.parse(raw);
+    try {
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        // A 200-OK but non-JSON body (e.g. an HTML error page, empty body) would
+        // otherwise throw an unclassified SyntaxError that bypasses transport error
+        // classification/retry. Surface it as a meaningful error instead.
+        throw new Error(`getUploadUrl returned a non-JSON response (${raw.length} bytes): ${String(error)}`, { cause: error });
+    }
 }
 function buildCdnUploadUrl(cdnBaseUrl, uploadParam, filekey) {
     return `${cdnBaseUrl}/upload?encrypted_query_param=${encodeURIComponent(uploadParam)}&filekey=${encodeURIComponent(filekey)}`;
@@ -678,11 +691,25 @@ export function buildInboundMessageClaimPath(messageKey, claimsDir = INBOUND_MES
     return path.join(claimsDir, fileName);
 }
 export function clearInboundMessageClaims(claimsDir = INBOUND_MESSAGE_CLAIMS_DIR) {
+    // Delete claim files individually from a directory snapshot rather than
+    // `rmSync(claimsDir, { recursive })`. A recursive rmdir can remove a file a
+    // concurrent process just created via tryClaimInboundMessage, silently
+    // invalidating its claim and letting the same message be double-processed.
+    // Per-file removal only deletes files present at snapshot time.
+    let entries;
     try {
-        fs.rmSync(claimsDir, { recursive: true, force: true });
+        entries = fs.readdirSync(claimsDir);
     }
     catch {
-        // Best effort cleanup.
+        return; // directory does not exist; nothing to clear
+    }
+    for (const entry of entries) {
+        try {
+            fs.rmSync(path.join(claimsDir, entry), { force: true });
+        }
+        catch {
+            // best effort
+        }
     }
 }
 export function tryClaimInboundMessage(messageKey, options = {}) {
@@ -719,7 +746,11 @@ export function tryClaimInboundMessage(messageKey, options = {}) {
             ? error.code
             : "";
         if (code !== "EEXIST") {
-            return true;
+            // Real persistence failure (permissions, disk full, missing dir, ...).
+            // Returning true here would claim success WITHOUT writing the claim file,
+            // letting concurrent processes all think they own this message and
+            // double-process it. Fail closed so the message is retried instead.
+            return false;
         }
     }
     try {
@@ -849,23 +880,28 @@ export class WeChatTransport {
             if (!extracted.text && extracted.attachments.length === 0) {
                 continue;
             }
-            const messageKey = buildMessageKey(rawMessage);
-            if (!this.rememberMessage(messageKey)) {
-                continue;
-            }
-            if (!tryClaimInboundMessage(buildScopedMessageClaimKey(account.accountId, messageKey))) {
-                continue;
-            }
             const senderId = rawMessage.from_user_id ?? "unknown";
             if (rawMessage.context_token) {
                 this.cacheContextToken(senderId, rawMessage.context_token);
             }
+            // Filter pre-start backlog BEFORE claiming/remembering the message so a
+            // skipped message is not permanently locked away from other processes.
+            // A missing create_time_ms is treated as fresh rather than dropped.
             const createdAtMs = rawMessage.create_time_ms ?? 0;
             if (typeof options.minCreatedAtMs === "number" &&
-                (!Number.isFinite(createdAtMs) || createdAtMs < options.minCreatedAtMs)) {
+                Number.isFinite(createdAtMs) &&
+                createdAtMs > 0 &&
+                createdAtMs < options.minCreatedAtMs) {
                 ignoredBacklogCount += 1;
                 continue;
             }
+            const messageKey = buildMessageKey(rawMessage);
+            if (!this.rememberMessage(messageKey)) {
+                continue;
+            }
+            if (!tryClaimInboundMessage(buildScopedMessageClaimKey(account.accountId, messageKey))) {
+                continue;
+            }
             const { attachments, failureLines } = await this.downloadInboundAttachments(extracted.attachments, rawMessage);
             const text = appendInboundAttachmentFailureText(extracted.text, failureLines);
             messages.push({

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@unlinearity/cli-wechat-bridge",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "CLI WeChat Bridge for Codex, Claude Code, OpenCode, and PowerShell over WeChat",
   "type": "module",
   "files": [
     "bin/",
     "dist/",
+    "scripts/ensure-node-pty-permissions.mjs",
     "README.md",
     "LICENSE.txt"
   ],