@wenbin_wb/dsh-bridge 2.10.13 → 2.10.14

package/lib/cloudflared-manager.mjs

@@ -1,4 +1,4 @@
-import { spawn, execSync } from 'node:child_process';
+import { spawn, execFileSync } from 'node:child_process';
 import { createWriteStream, createReadStream, existsSync, mkdirSync, readFileSync, statSync, renameSync, writeFileSync } from 'node:fs';
 import { chmod, stat, unlink, rename } from 'node:fs/promises';
 import { homedir, platform, arch } from 'node:os';
@@ -8,6 +8,19 @@ import { createHash } from 'node:crypto';
 import { get as httpsGet } from 'node:https';
 import { get as httpGet } from 'node:http';
 
+// 参数化执行外部命令，替代原先的 execSync(`"${path}" --version`) 字符串拼接
+// （CodeQL js/shell-command-constructed-from-input）。execFileSync 不经过 shell，
+// 参数以数组传递，路径里的引号 / $( ) / 反引号不再具备注入语义。
+//
+// Windows 例外：.cmd / .bat 无法被 execFileSync 直接执行（Node 要求经 shell），
+// 官方 cloudflared 在 Windows 是 .exe 走参数化路径，只有测试注入的假二进制是
+// .cmd，故按扩展名决定是否需要 shell。macOS / Linux 恒为 false。
+const IS_WINDOWS = process.platform === 'win32';
+function execBinSync(bin, args, options) {
+  const needsShell = IS_WINDOWS && /\.(cmd|bat)$/i.test(bin);
+  return execFileSync(bin, args, { ...options, shell: needsShell });
+}
+
 const CLOUDFLARED_VERSION = '2024.10.0';
 const DOWNLOAD_TIMEOUT = 5 * 60 * 1000; // 5 分钟
 const MIN_BINARY_SIZE = 5 * 1024 * 1024; // 最小 5MB，防止下到 HTML 错误页
@@ -158,7 +171,7 @@ function findSystemCloudflared() {
       if (bin.includes('/') || bin.includes('\\')) {
         if (!existsSync(bin)) continue;
       }
-      execSync(`"${bin}" --version`, { stdio: 'ignore', timeout: 3000 });
+      execBinSync(bin, ['--version'], { stdio: 'ignore', timeout: 3000 });
       return bin;
     } catch {}
   }
@@ -356,7 +369,7 @@ export class CloudflaredManager {
   // 校验自管理二进制是否匹配期望版本；系统级二进制不校验（尊重用户安装）
   _checkManagedBinaryVersion(binPath) {
     try {
-      const out = execSync(`"${binPath}" --version`, { encoding: 'utf8', timeout: 3000 });
+      const out = execBinSync(binPath, ['--version'], { encoding: 'utf8', timeout: 3000 });
       const ver = parseCloudflaredVersion(out);
       if (!ver) return { ok: false, reason: `无法解析版本输出: ${(out || '').trim().slice(0, 80)}` };
       if (ver !== this.binaryVersion) {
@@ -404,7 +417,7 @@ export class CloudflaredManager {
             if (platform() !== 'win32') {
               await chmod(binPath, 0o755).catch(() => {});
               if (platform() === 'darwin') {
-                try { execSync(`xattr -d com.apple.quarantine "${binPath}"`, { stdio: 'ignore' }); } catch {}
+                try { execBinSync('xattr', ['-d', 'com.apple.quarantine', binPath], { stdio: 'ignore' }); } catch {}
               }
             }
             // 版本钉死校验：cloudflared autoupdate 可能已把钉死的版本自替换成新版，
@@ -440,7 +453,7 @@ export class CloudflaredManager {
 
       if (url.endsWith('.tgz') || url.endsWith('.tar.gz')) {
         try {
-          execSync(`tar -xzf "${tempPath}" -C "${binDir}"`);
+          execBinSync('tar', ['-xzf', tempPath, '-C', binDir]);
           await unlink(tempPath).catch(() => {});
         } catch (tarErr) {
           this.logger?.error('解压 cloudflared 压缩包失败: %s', tarErr.message);
@@ -454,7 +467,7 @@ export class CloudflaredManager {
       if (platform() !== 'win32') {
         await chmod(binPath, 0o755).catch(() => {});
         if (platform() === 'darwin') {
-          try { execSync(`xattr -d com.apple.quarantine "${binPath}"`, { stdio: 'ignore' }); } catch {}
+          try { execBinSync('xattr', ['-d', 'com.apple.quarantine', binPath], { stdio: 'ignore' }); } catch {}
         }
       }
 

package/lib/feishu/lark-bundled.mjs

@@ -14,7 +14,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 
 // node_modules/delayed-stream/lib/delayed_stream.js
@@ -9296,7 +9300,7 @@ var require_shams = __commonJS({
         return true;
       }
       var obj = {};
-      var sym = Symbol("test");
+      var sym = /* @__PURE__ */ Symbol("test");
       var symObj = Object(sym);
       if (typeof sym === "string") {
         return false;
@@ -9355,7 +9359,7 @@ var require_has_symbols = __commonJS({
       if (typeof origSymbol("foo") !== "symbol") {
         return false;
       }
-      if (typeof Symbol("bar") !== "symbol") {
+      if (typeof /* @__PURE__ */ Symbol("bar") !== "symbol") {
         return false;
       }
       return hasSymbolSham();
@@ -12499,7 +12503,7 @@ var require_axios = __commonJS({
       });
       return byteStringHeaders;
     }
-    var $internals = Symbol("internals");
+    var $internals = /* @__PURE__ */ Symbol("internals");
     function normalizeHeader(header) {
       return header && String(header).trim().toLowerCase();
     }
@@ -13709,7 +13713,7 @@ var require_axios = __commonJS({
         }
       });
     }
-    var kInternals = Symbol("internals");
+    var kInternals = /* @__PURE__ */ Symbol("internals");
     var AxiosTransformStream = class extends stream.Transform {
       constructor(options) {
         options = utils$1.toFlatObject(options, {
@@ -14440,9 +14444,9 @@ var require_axios = __commonJS({
       https: httpsFollow
     } = followRedirects;
     var isHttps = /https:?/;
-    var kAxiosSocketListener = Symbol("axios.http.socketListener");
-    var kAxiosCurrentReq = Symbol("axios.http.currentReq");
-    var kAxiosInstalledTunnel = Symbol("axios.http.installedTunnel");
+    var kAxiosSocketListener = /* @__PURE__ */ Symbol("axios.http.socketListener");
+    var kAxiosCurrentReq = /* @__PURE__ */ Symbol("axios.http.currentReq");
+    var kAxiosInstalledTunnel = /* @__PURE__ */ Symbol("axios.http.installedTunnel");
     var tunnelingAgentCache = /* @__PURE__ */ new Map();
     var tunnelingAgentCacheUser = /* @__PURE__ */ new WeakMap();
     var NODE_NATIVE_ENV_PROXY_SUPPORT = {
@@ -20103,10 +20107,10 @@ var require_constants = __commonJS({
       EMPTY_BUFFER: Buffer.alloc(0),
       GUID: "258EAFA5-E914-47DA-95CA-C5AB0DC85B11",
       hasBlob,
-      kForOnEventAttribute: Symbol("kIsForOnEventAttribute"),
-      kListener: Symbol("kListener"),
-      kStatusCode: Symbol("status-code"),
-      kWebSocket: Symbol("websocket"),
+      kForOnEventAttribute: /* @__PURE__ */ Symbol("kIsForOnEventAttribute"),
+      kListener: /* @__PURE__ */ Symbol("kListener"),
+      kStatusCode: /* @__PURE__ */ Symbol("status-code"),
+      kWebSocket: /* @__PURE__ */ Symbol("websocket"),
       NOOP: () => {
       }
     };
@@ -20192,8 +20196,8 @@ var require_buffer_util = __commonJS({
 var require_limiter = __commonJS({
   "node_modules/ws/lib/limiter.js"(exports, module) {
     "use strict";
-    var kDone = Symbol("kDone");
-    var kRun = Symbol("kRun");
+    var kDone = /* @__PURE__ */ Symbol("kDone");
+    var kRun = /* @__PURE__ */ Symbol("kRun");
     var Limiter = class {
       /**
        * Creates a new `Limiter`.
@@ -20248,11 +20252,11 @@ var require_permessage_deflate = __commonJS({
     var { kStatusCode } = require_constants();
     var FastBuffer = Buffer[Symbol.species];
     var TRAILER = Buffer.from([0, 0, 255, 255]);
-    var kPerMessageDeflate = Symbol("permessage-deflate");
-    var kTotalLength = Symbol("total-length");
-    var kCallback = Symbol("callback");
-    var kBuffers = Symbol("buffers");
-    var kError = Symbol("error");
+    var kPerMessageDeflate = /* @__PURE__ */ Symbol("permessage-deflate");
+    var kTotalLength = /* @__PURE__ */ Symbol("total-length");
+    var kCallback = /* @__PURE__ */ Symbol("callback");
+    var kBuffers = /* @__PURE__ */ Symbol("buffers");
+    var kError = /* @__PURE__ */ Symbol("error");
     var zlibLimiter;
     var PerMessageDeflate = class {
       /**
@@ -21458,7 +21462,7 @@ var require_sender = __commonJS({
     var { EMPTY_BUFFER, kWebSocket, NOOP } = require_constants();
     var { isBlob, isValidStatusCode } = require_validation();
     var { mask: applyMask, toBuffer } = require_buffer_util();
-    var kByteLength = Symbol("kByteLength");
+    var kByteLength = /* @__PURE__ */ Symbol("kByteLength");
     var maskBuffer = Buffer.alloc(4);
     var RANDOM_POOL_SIZE = 8 * 1024;
     var randomPool;
@@ -21943,14 +21947,14 @@ var require_event_target = __commonJS({
   "node_modules/ws/lib/event-target.js"(exports, module) {
     "use strict";
     var { kForOnEventAttribute, kListener } = require_constants();
-    var kCode = Symbol("kCode");
-    var kData = Symbol("kData");
-    var kError = Symbol("kError");
-    var kMessage = Symbol("kMessage");
-    var kReason = Symbol("kReason");
-    var kTarget = Symbol("kTarget");
-    var kType = Symbol("kType");
-    var kWasClean = Symbol("kWasClean");
+    var kCode = /* @__PURE__ */ Symbol("kCode");
+    var kData = /* @__PURE__ */ Symbol("kData");
+    var kError = /* @__PURE__ */ Symbol("kError");
+    var kMessage = /* @__PURE__ */ Symbol("kMessage");
+    var kReason = /* @__PURE__ */ Symbol("kReason");
+    var kTarget = /* @__PURE__ */ Symbol("kTarget");
+    var kType = /* @__PURE__ */ Symbol("kType");
+    var kWasClean = /* @__PURE__ */ Symbol("kWasClean");
     var Event = class {
       /**
        * Create a new `Event`.
@@ -22352,7 +22356,7 @@ var require_websocket = __commonJS({
     } = require_event_target();
     var { format, parse } = require_extension();
     var { toBuffer } = require_buffer_util();
-    var kAborted = Symbol("kAborted");
+    var kAborted = /* @__PURE__ */ Symbol("kAborted");
     var protocolVersions = [8, 13];
     var readyStates = ["CONNECTING", "OPEN", "CLOSING", "CLOSED"];
     var subprotocolRegex = /^[!#$%&'*+\-.0-9A-Z^_`|a-z~]+$/;
@@ -26384,14 +26388,14 @@ var require_index = __commonJS({
       LoggerLevel[LoggerLevel["debug"] = 4] = "debug";
       LoggerLevel[LoggerLevel["trace"] = 5] = "trace";
     })(exports.LoggerLevel || (exports.LoggerLevel = {}));
-    var CEventType = Symbol("event-type");
-    var CTenantKey = Symbol("tenant-key");
-    var CAppTicket = Symbol("app-ticket");
-    var CTenantAccessToken = Symbol("tenant-access-token");
-    var CWithHelpdeskAuthorization = Symbol("with-helpdesk-authorization");
-    var CWithUserAccessToken = Symbol("with-user-access-token");
-    var CUserAccessToken = Symbol("user-access-token");
-    var CAilySessionRecord = Symbol("aily-session-record");
+    var CEventType = /* @__PURE__ */ Symbol("event-type");
+    var CTenantKey = /* @__PURE__ */ Symbol("tenant-key");
+    var CAppTicket = /* @__PURE__ */ Symbol("app-ticket");
+    var CTenantAccessToken = /* @__PURE__ */ Symbol("tenant-access-token");
+    var CWithHelpdeskAuthorization = /* @__PURE__ */ Symbol("with-helpdesk-authorization");
+    var CWithUserAccessToken = /* @__PURE__ */ Symbol("with-user-access-token");
+    var CUserAccessToken = /* @__PURE__ */ Symbol("user-access-token");
+    var CAilySessionRecord = /* @__PURE__ */ Symbol("aily-session-record");
     var string2Base64 = (content) => Buffer.from(content).toString("base64");
     var DefaultCache = class {
       constructor() {
@@ -26453,12 +26457,19 @@ var require_index = __commonJS({
           return domain;
       }
     };
-    var fillApiPath = (apiPath, pathSupplement = {}) => apiPath.replace(/:([^/]+)/g, (_, $1) => {
-      if (pathSupplement[$1] !== void 0) {
-        return pathSupplement[$1];
-      }
-      throw new Error(`request miss ${$1} path argument`);
-    });
+    var fillApiPath = (apiPath, pathSupplement = {}) => (
+      // Only treat `:name` as a path parameter when it starts a path segment
+      // (string start or right after `/`). Colons inside the URL authority,
+      // e.g. `http://localhost:3000` or `user:pw@host`, must be left untouched.
+      // The separator is captured and re-emitted instead of using a lookbehind
+      // because the compile target (es6) has no lookbehind support.
+      apiPath.replace(/(^|\/):([^/]+)/g, (_, pathPrefix, pathKey) => {
+        if (pathSupplement[pathKey] !== void 0) {
+          return `${pathPrefix}${pathSupplement[pathKey]}`;
+        }
+        throw new Error(`request miss ${pathKey} path argument`);
+      })
+    );
     var assert = (predication, callback) => __awaiter(void 0, void 0, void 0, function* () {
       const isInvoke = typeof predication === "function" ? predication() : predication;
       if (isInvoke) {
@@ -119921,6 +119932,8 @@ var require_index = __commonJS({
       }
     };
     var CAppTicketHandle = "app_ticket";
+    var duplicateHandleWarning = (key) => `${key} handle is already registered and has been replaced, call unregister('${key}') first to replace it explicitly`;
+    var appTicketUnregisteredWarning = `the built-in ${CAppTicketHandle} handle is unregistered, pushed app tickets are no longer cached and every app_access_token request of an ISV app will miss the cache and trigger an app_ticket resend`;
     var EventDispatcher = class {
       constructor(params) {
         this.verificationToken = "";
@@ -119954,16 +119967,46 @@ var require_index = __commonJS({
           })
         });
       }
+      /**
+       * Register a handler for each of the given event keys.
+       *
+       * Registering a key that already has a handler replaces it. That is a
+       * supported operation, but the replacement is easier to spot when it is
+       * announced: call `unregister(key)` first and nothing is logged, otherwise
+       * a warning flags what would otherwise be an unnoticed overwrite.
+       */
       register(handles) {
         Object.keys(handles).forEach((key) => {
           if (this.handles.has(key) && key !== CAppTicketHandle) {
-            this.logger.error(`this ${key} handle is registered`);
+            this.logger.warn(duplicateHandleWarning(key));
           }
           this.handles.set(key, handles[key]);
           this.logger.debug(`register ${key} handle`);
         });
         return this;
       }
+      /**
+       * Remove the handler registered for each of the given event keys, so that
+       * the events are no longer dispatched. Keys without a handler are skipped.
+       *
+       * Removing the built-in `app_ticket` handle stops the SDK from caching
+       * pushed app tickets, which makes every app_access_token request of an ISV
+       * app miss the cache and trigger an app_ticket resend -- hence the warning.
+       */
+      unregister(...keys) {
+        keys.forEach((key) => {
+          if (!this.handles.has(key)) {
+            this.logger.debug(`no ${key} handle to unregister`);
+            return;
+          }
+          this.handles.delete(key);
+          this.logger.debug(`unregister ${key} handle`);
+          if (key === CAppTicketHandle) {
+            this.logger.warn(appTicketUnregisteredWarning);
+          }
+        });
+        return this;
+      }
       invoke(data, params) {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
@@ -120686,6 +120729,9 @@ var require_index = __commonJS({
       }
       mergeData(params) {
         const { message_id, sum, seq, trace_id, data } = params;
+        if (!Number.isInteger(sum) || sum <= 0 || !Number.isInteger(seq) || seq < 0 || seq >= sum) {
+          throw new Error(`invalid event fragment metadata (sum: ${sum}, seq: ${seq})`);
+        }
         const cache = this.cache.get(message_id);
         if (!cache) {
           const buffer = new Array(sum).fill(void 0);
@@ -120697,6 +120743,9 @@ var require_index = __commonJS({
             create_time: Date.now()
           });
         } else {
+          if (sum !== cache.buffer.length) {
+            throw new Error(`invalid event fragment metadata (sum: ${sum} differs from first fragment's ${cache.buffer.length}, seq: ${seq})`);
+          }
           cache.buffer[seq] = data;
         }
         const mergedCache = this.cache.get(message_id);
@@ -120787,12 +120836,17 @@ var require_index = __commonJS({
       HttpStatusCode2[HttpStatusCode2["ok"] = 200] = "ok";
       HttpStatusCode2[HttpStatusCode2["internal_server_error"] = 500] = "internal_server_error";
     })(HttpStatusCode || (HttpStatusCode = {}));
+    var describeError = (err) => {
+      const message = err === null || err === void 0 ? void 0 : err.message;
+      return message ? message : String(err);
+    };
     var WSClient = class {
       constructor(params) {
         var _a;
         this.wsConfig = new WSConfig();
         this.reconnectGeneration = 0;
         this.isConnecting = false;
+        this.closed = false;
         this.reconnectInfo = {
           lastConnectTime: 0,
           nextConnectTime: 0
@@ -120861,6 +120915,53 @@ var require_index = __commonJS({
           this.livenessTimer = void 0;
         }
       }
+      /**
+       * Detach a socket we are about to throw away: drop every listener, but
+       * leave one 'error' sink behind.
+       *
+       * `ws` reports the abort of a non-OPEN socket asynchronously — both
+       * `terminate()` and `close()` route through `abortHandshake()`, which
+       * emits 'error' on a later tick — and a non-force `close()` on an OPEN
+       * socket keeps the connection alive until the peer answers (up to `ws`'s
+       * 30s closeTimeout), during which a TCP reset still surfaces as 'error'.
+       * An EventEmitter with no 'error' listener throws instead of emitting, and
+       * that throw lands outside every try/catch, killing the host process.
+       * See https://github.com/larksuite/node-sdk/issues/197
+       *
+       * NOTE: not for the liveness watchdog — that one terminates *on purpose*
+       * and needs its listeners intact so 'close' drives the reconnect.
+       */
+      detachSocket(socket) {
+        socket.removeAllListeners();
+        socket.on("error", (err) => {
+          this.logger.debug("[ws]", "ignored error from discarded socket", err === null || err === void 0 ? void 0 : err.message);
+        });
+      }
+      /**
+       * Throw away whatever the current attempt established — socket *and* the
+       * timers its 'open' handler armed. A handshake that completes after
+       * `close()` runs `pingLoop()`, and that timer is not unref'd: leaving it
+       * behind keeps the event loop alive forever on a client the caller closed.
+       *
+       * Only safe when {@link closed} is set: otherwise a newer session may
+       * already own `wsConfig`'s instance.
+       */
+      discardConnection() {
+        if (this.pingInterval) {
+          clearTimeout(this.pingInterval);
+          this.pingInterval = void 0;
+        }
+        this.clearLiveness();
+        const socket = this.wsConfig.getWSInstance();
+        if (!socket)
+          return;
+        this.detachSocket(socket);
+        try {
+          socket.terminate();
+        } catch (_a) {
+        }
+        this.wsConfig.setWSInstance(null);
+      }
       /**
        * Invoke a user-supplied callback safely: no-op if undefined, swallow any
        * exception to avoid breaking the WS state machine.
@@ -120967,7 +121068,7 @@ var require_index = __commonJS({
           if (this.handshakeTimeoutMs && this.handshakeTimeoutMs > 0) {
             timer = setTimeout(() => {
               this.logger.error("[ws]", `handshake timeout after ${this.handshakeTimeoutMs}ms`);
-              wsInstance.removeAllListeners();
+              this.detachSocket(wsInstance);
               try {
                 wsInstance.terminate();
               } catch (_a) {
@@ -121023,6 +121124,13 @@ var require_index = __commonJS({
             } finally {
               this.isConnecting = false;
             }
+            if (this.closed) {
+              this.discardConnection();
+              return;
+            }
+            if (currentGeneration !== this.reconnectGeneration) {
+              return;
+            }
             if (result.ok) {
               this.hasEverConnected = true;
               this.safeInvoke("onReady", this.onReady);
@@ -121064,6 +121172,10 @@ var require_index = __commonJS({
                 count++;
                 this.currentReconnectAttempts = count;
                 const result = yield tryConnect();
+                if (this.closed) {
+                  this.discardConnection();
+                  return;
+                }
                 if (currentGeneration !== this.reconnectGeneration) {
                   return;
                 }
@@ -121127,13 +121239,17 @@ var require_index = __commonJS({
         const wsInstance = this.wsConfig.getWSInstance();
         wsInstance === null || wsInstance === void 0 ? void 0 : wsInstance.on("message", (buffer) => __awaiter(this, void 0, void 0, function* () {
           this.clearLiveness();
-          const data = decode(buffer);
-          const { method } = data;
-          if (method === FrameType.control) {
-            yield this.handleControlData(data);
-          }
-          if (method === FrameType.data) {
-            yield this.handleEventData(data);
+          try {
+            const data = decode(buffer);
+            const { method } = data;
+            if (method === FrameType.control) {
+              yield this.handleControlData(data);
+            }
+            if (method === FrameType.data) {
+              yield this.handleEventData(data);
+            }
+          } catch (err) {
+            this.logger.error("[ws]", `failed to handle inbound frame: ${describeError(err)}`);
           }
         }));
         wsInstance === null || wsInstance === void 0 ? void 0 : wsInstance.on("error", (e) => {
@@ -121155,8 +121271,15 @@ var require_index = __commonJS({
           }
           if (type === MessageType.pong && payload) {
             this.logger.trace("[ws]", "receive pong");
-            const dataString = new TextDecoder("utf-8").decode(payload);
-            const { PingInterval, ReconnectCount, ReconnectInterval, ReconnectNonce } = JSON.parse(dataString);
+            let pong;
+            try {
+              const dataString = new TextDecoder("utf-8").decode(payload);
+              pong = JSON.parse(dataString);
+            } catch (err) {
+              this.logger.error("[ws]", `invalid pong payload: ${describeError(err)}`);
+              return;
+            }
+            const { PingInterval, ReconnectCount, ReconnectInterval, ReconnectNonce } = pong;
             this.wsConfig.updateWs({
               pingInterval: PingInterval * 1e3,
               reconnectCount: ReconnectCount,
@@ -121179,13 +121302,19 @@ var require_index = __commonJS({
           if (type !== MessageType.event) {
             return;
           }
-          const mergedData = this.dataCache.mergeData({
-            message_id,
-            sum: Number(sum),
-            seq: Number(seq),
-            trace_id,
-            data: payload
-          });
+          let mergedData;
+          try {
+            mergedData = this.dataCache.mergeData({
+              message_id,
+              sum: Number(sum),
+              seq: Number(seq),
+              trace_id,
+              data: payload
+            });
+          } catch (err) {
+            this.logger.error("[ws]", `failed to merge event fragments, message_id: ${message_id}; trace_id: ${trace_id}; error: ${describeError(err)}`);
+            return;
+          }
           if (!mergedData) {
             return;
           }
@@ -121254,6 +121383,7 @@ var require_index = __commonJS({
        */
       close(params = {}) {
         const { force = false } = params;
+        this.closed = true;
         this.reconnectGeneration++;
         if (this.pingInterval) {
           clearTimeout(this.pingInterval);
@@ -121269,7 +121399,7 @@ var require_index = __commonJS({
         this.currentReconnectAttempts = 0;
         const wsInstance = this.wsConfig.getWSInstance();
         if (wsInstance) {
-          wsInstance.removeAllListeners();
+          this.detachSocket(wsInstance);
           if (force) {
             wsInstance.terminate();
           } else {
@@ -121292,6 +121422,7 @@ var require_index = __commonJS({
             return;
           }
           this.terminalError = false;
+          this.closed = false;
           this.currentReconnectAttempts = 0;
           this.dataCache.clearAtInterval();
           this.logger.info("[ws]", `receive events or callbacks through persistent connection only available in self-build & Feishu app, Configured in:
@@ -121711,6 +121842,7 @@ var require_index = __commonJS({
         let domainSwitched = false;
         let pollTimer = null;
         let expireTimer = null;
+        let settled = false;
         const cleanup = () => {
           var _a2;
           if (pollTimer !== null) {
@@ -121723,25 +121855,51 @@ var require_index = __commonJS({
           }
           (_a2 = ctx.signal) === null || _a2 === void 0 ? void 0 : _a2.removeEventListener("abort", onAbort);
         };
-        const onAbort = () => {
+        const succeed = (result) => {
+          if (settled) {
+            return;
+          }
+          settled = true;
+          cleanup();
+          resolve(result);
+        };
+        const fail = (err) => {
+          if (settled) {
+            return;
+          }
+          settled = true;
           cleanup();
-          reject(createError("abort", "Registration was aborted"));
+          reject(err);
+        };
+        const scheduleNextPoll = () => {
+          if (settled) {
+            return;
+          }
+          pollTimer = setTimeout(poll, interval);
+        };
+        const onAbort = () => {
+          fail(createError("abort", "Registration was aborted"));
         };
         if ((_a = ctx.signal) === null || _a === void 0 ? void 0 : _a.aborted) {
-          return reject(createError("abort", "Registration was aborted"));
+          return fail(createError("abort", "Registration was aborted"));
         }
         (_b = ctx.signal) === null || _b === void 0 ? void 0 : _b.addEventListener("abort", onAbort, { once: true });
         expireTimer = setTimeout(() => {
-          cleanup();
-          reject(createError("expired_token", "Polling timed out"));
+          fail(createError("expired_token", "Polling timed out"));
         }, ctx.expireIn);
         const poll = () => __awaiter(this, void 0, void 0, function* () {
           var _c, _d, _e, _f, _g, _h;
+          if (settled) {
+            return;
+          }
           try {
             const pollRes = yield requestRegistration(baseUrl, {
               action: "poll",
               device_code: ctx.deviceCode
             });
+            if (settled) {
+              return;
+            }
             if (((_c = pollRes.user_info) === null || _c === void 0 ? void 0 : _c.tenant_brand) === "lark" && !domainSwitched) {
               baseUrl = ctx.larkBaseUrl;
               domainSwitched = true;
@@ -121750,8 +121908,7 @@ var require_index = __commonJS({
               return;
             }
             if (pollRes.client_id && pollRes.client_secret) {
-              cleanup();
-              resolve({
+              succeed({
                 client_id: pollRes.client_id,
                 client_secret: pollRes.client_secret,
                 user_info: pollRes.user_info
@@ -121768,21 +121925,18 @@ var require_index = __commonJS({
                 break;
               case "access_denied":
               case "expired_token":
-                cleanup();
-                reject(createError(pollRes.error, (_g = pollRes.error_description) !== null && _g !== void 0 ? _g : "Unknown error"));
+                fail(createError(pollRes.error, (_g = pollRes.error_description) !== null && _g !== void 0 ? _g : "Unknown error"));
                 return;
               default:
                 if (pollRes.error) {
-                  cleanup();
-                  reject(createError(pollRes.error, (_h = pollRes.error_description) !== null && _h !== void 0 ? _h : "Unknown error"));
+                  fail(createError(pollRes.error, (_h = pollRes.error_description) !== null && _h !== void 0 ? _h : "Unknown error"));
                   return;
                 }
                 break;
             }
-            pollTimer = setTimeout(poll, interval);
+            scheduleNextPoll();
           } catch (e) {
-            cleanup();
-            reject(e);
+            fail(e);
           }
         });
         poll();

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.10.13",
+  "version": "2.10.14",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
-  "releaseNotes": "【v2.10.13】可靠性加固 + 跟随 DSH 0.1.5 目录选择器\n• 新增：cloudflared 运行时健康探针——每 30s 探活官方 /ready，连续 3 次失败（约 90s）面板可见降级，连续 10 次（约 5min）判定假死自动强制重建，重建永不进终态（网络恢复后自愈）\n• 新增：cloudflared 输出落盘 ~/.dsh/dsh-bridge/cloudflared.log（5MB 轮转 .1），Token 跨 chunk 强制脱敏\n• 修复：连接器假死时公网入口静默失效数天无人发现（HTTP 530 / error code 1033），旧逻辑只监听进程退出故永不触发\n• 修复：本机点「添加工作区」误弹插件的远程抽屉（issue #28）——DSH 0.1.5 自带官方目录选择器且 slots 为 shadow 语义，插件同名 Slot 覆盖了官方实现；现本机 + 官方 picker 可用时不再注册该 Slot（macOS/Windows 走系统原生对话框、无桌面 Linux 走官方网页选择器），旧版 DSH 与远程/移动仍由插件兜底\n• 修复：添加工作区弹窗点过「已注册工作区」后永久卡死（PR #42）——switchToWorkspace 只置位 isSubmitting 从不复位，改为与 doSubmit 对称的 try/finally\n• 修复：探针路径任何异常（畸形地址、日志通道抛错）都不会拖垮 DSH 主进程\n• 测试：新增 18 条探针 + 12 条目录选择器让位 + 3 条弹窗状态复位回归测试\n• 说明：本版需重启一次 dsh（systemctl --user restart dsh-web.service）才生效",
+  "releaseNotes": "【v2.10.14】移动端设置页体验修复\n• 修复：手机设置页内容被裁掉、部分页签点不到（含第三方设置页），竖屏改为「分类列表 → 内容页」两级导航，字号与触控行恢复到可读可点，横屏分类不再被切\n• 修复：设置页「✕」回到标题行右上角，页面操作按钮统一收到底部动作栏\n• 修复：插件市场点「安装」没反应（确认框被设置弹窗盖住），横屏下确认框还会超出屏幕、按钮点不到；现均可正常显示与点击\n• 说明：纯前端样式与交互调整，刷新页面即生效（无需重启 dsh）",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -36,10 +36,10 @@
     "ws": "^8.18.0"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.8",
     "@eslint/js": "^10.0.1",
     "@larksuiteoapi/node-sdk": "^1.73.0",
-    "esbuild": "^0.25.9",
+    "esbuild": "^0.28.2",
     "eslint": "^10.9.1",
     "globals": "^17.11.0",
     "puppeteer-core": "^25.8.0"