@wenbin_wb/dsh-bridge 2.10.15 → 2.11.1

package/lib/feishu/lark-bundled.mjs

@@ -14,11 +14,7 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  try {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-  } catch (e) {
-    throw mod = 0, e;
-  }
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
 
 // node_modules/delayed-stream/lib/delayed_stream.js
@@ -9300,7 +9296,7 @@ var require_shams = __commonJS({
         return true;
       }
       var obj = {};
-      var sym = /* @__PURE__ */ Symbol("test");
+      var sym = Symbol("test");
       var symObj = Object(sym);
       if (typeof sym === "string") {
         return false;
@@ -9359,7 +9355,7 @@ var require_has_symbols = __commonJS({
       if (typeof origSymbol("foo") !== "symbol") {
         return false;
       }
-      if (typeof /* @__PURE__ */ Symbol("bar") !== "symbol") {
+      if (typeof Symbol("bar") !== "symbol") {
         return false;
       }
       return hasSymbolSham();
@@ -12503,7 +12499,7 @@ var require_axios = __commonJS({
       });
       return byteStringHeaders;
     }
-    var $internals = /* @__PURE__ */ Symbol("internals");
+    var $internals = Symbol("internals");
     function normalizeHeader(header) {
       return header && String(header).trim().toLowerCase();
     }
@@ -13713,7 +13709,7 @@ var require_axios = __commonJS({
         }
       });
     }
-    var kInternals = /* @__PURE__ */ Symbol("internals");
+    var kInternals = Symbol("internals");
     var AxiosTransformStream = class extends stream.Transform {
       constructor(options) {
         options = utils$1.toFlatObject(options, {
@@ -14444,9 +14440,9 @@ var require_axios = __commonJS({
       https: httpsFollow
     } = followRedirects;
     var isHttps = /https:?/;
-    var kAxiosSocketListener = /* @__PURE__ */ Symbol("axios.http.socketListener");
-    var kAxiosCurrentReq = /* @__PURE__ */ Symbol("axios.http.currentReq");
-    var kAxiosInstalledTunnel = /* @__PURE__ */ Symbol("axios.http.installedTunnel");
+    var kAxiosSocketListener = Symbol("axios.http.socketListener");
+    var kAxiosCurrentReq = Symbol("axios.http.currentReq");
+    var kAxiosInstalledTunnel = Symbol("axios.http.installedTunnel");
     var tunnelingAgentCache = /* @__PURE__ */ new Map();
     var tunnelingAgentCacheUser = /* @__PURE__ */ new WeakMap();
     var NODE_NATIVE_ENV_PROXY_SUPPORT = {
@@ -20107,10 +20103,10 @@ var require_constants = __commonJS({
       EMPTY_BUFFER: Buffer.alloc(0),
       GUID: "258EAFA5-E914-47DA-95CA-C5AB0DC85B11",
       hasBlob,
-      kForOnEventAttribute: /* @__PURE__ */ Symbol("kIsForOnEventAttribute"),
-      kListener: /* @__PURE__ */ Symbol("kListener"),
-      kStatusCode: /* @__PURE__ */ Symbol("status-code"),
-      kWebSocket: /* @__PURE__ */ Symbol("websocket"),
+      kForOnEventAttribute: Symbol("kIsForOnEventAttribute"),
+      kListener: Symbol("kListener"),
+      kStatusCode: Symbol("status-code"),
+      kWebSocket: Symbol("websocket"),
       NOOP: () => {
       }
     };
@@ -20196,8 +20192,8 @@ var require_buffer_util = __commonJS({
 var require_limiter = __commonJS({
   "node_modules/ws/lib/limiter.js"(exports, module) {
     "use strict";
-    var kDone = /* @__PURE__ */ Symbol("kDone");
-    var kRun = /* @__PURE__ */ Symbol("kRun");
+    var kDone = Symbol("kDone");
+    var kRun = Symbol("kRun");
     var Limiter = class {
       /**
        * Creates a new `Limiter`.
@@ -20252,11 +20248,11 @@ var require_permessage_deflate = __commonJS({
     var { kStatusCode } = require_constants();
     var FastBuffer = Buffer[Symbol.species];
     var TRAILER = Buffer.from([0, 0, 255, 255]);
-    var kPerMessageDeflate = /* @__PURE__ */ Symbol("permessage-deflate");
-    var kTotalLength = /* @__PURE__ */ Symbol("total-length");
-    var kCallback = /* @__PURE__ */ Symbol("callback");
-    var kBuffers = /* @__PURE__ */ Symbol("buffers");
-    var kError = /* @__PURE__ */ Symbol("error");
+    var kPerMessageDeflate = Symbol("permessage-deflate");
+    var kTotalLength = Symbol("total-length");
+    var kCallback = Symbol("callback");
+    var kBuffers = Symbol("buffers");
+    var kError = Symbol("error");
     var zlibLimiter;
     var PerMessageDeflate = class {
       /**
@@ -21462,7 +21458,7 @@ var require_sender = __commonJS({
     var { EMPTY_BUFFER, kWebSocket, NOOP } = require_constants();
     var { isBlob, isValidStatusCode } = require_validation();
     var { mask: applyMask, toBuffer } = require_buffer_util();
-    var kByteLength = /* @__PURE__ */ Symbol("kByteLength");
+    var kByteLength = Symbol("kByteLength");
     var maskBuffer = Buffer.alloc(4);
     var RANDOM_POOL_SIZE = 8 * 1024;
     var randomPool;
@@ -21947,14 +21943,14 @@ var require_event_target = __commonJS({
   "node_modules/ws/lib/event-target.js"(exports, module) {
     "use strict";
     var { kForOnEventAttribute, kListener } = require_constants();
-    var kCode = /* @__PURE__ */ Symbol("kCode");
-    var kData = /* @__PURE__ */ Symbol("kData");
-    var kError = /* @__PURE__ */ Symbol("kError");
-    var kMessage = /* @__PURE__ */ Symbol("kMessage");
-    var kReason = /* @__PURE__ */ Symbol("kReason");
-    var kTarget = /* @__PURE__ */ Symbol("kTarget");
-    var kType = /* @__PURE__ */ Symbol("kType");
-    var kWasClean = /* @__PURE__ */ Symbol("kWasClean");
+    var kCode = Symbol("kCode");
+    var kData = Symbol("kData");
+    var kError = Symbol("kError");
+    var kMessage = Symbol("kMessage");
+    var kReason = Symbol("kReason");
+    var kTarget = Symbol("kTarget");
+    var kType = Symbol("kType");
+    var kWasClean = Symbol("kWasClean");
     var Event = class {
       /**
        * Create a new `Event`.
@@ -22356,7 +22352,7 @@ var require_websocket = __commonJS({
     } = require_event_target();
     var { format, parse } = require_extension();
     var { toBuffer } = require_buffer_util();
-    var kAborted = /* @__PURE__ */ Symbol("kAborted");
+    var kAborted = Symbol("kAborted");
     var protocolVersions = [8, 13];
     var readyStates = ["CONNECTING", "OPEN", "CLOSING", "CLOSED"];
     var subprotocolRegex = /^[!#$%&'*+\-.0-9A-Z^_`|a-z~]+$/;
@@ -26388,14 +26384,14 @@ var require_index = __commonJS({
       LoggerLevel[LoggerLevel["debug"] = 4] = "debug";
       LoggerLevel[LoggerLevel["trace"] = 5] = "trace";
     })(exports.LoggerLevel || (exports.LoggerLevel = {}));
-    var CEventType = /* @__PURE__ */ Symbol("event-type");
-    var CTenantKey = /* @__PURE__ */ Symbol("tenant-key");
-    var CAppTicket = /* @__PURE__ */ Symbol("app-ticket");
-    var CTenantAccessToken = /* @__PURE__ */ Symbol("tenant-access-token");
-    var CWithHelpdeskAuthorization = /* @__PURE__ */ Symbol("with-helpdesk-authorization");
-    var CWithUserAccessToken = /* @__PURE__ */ Symbol("with-user-access-token");
-    var CUserAccessToken = /* @__PURE__ */ Symbol("user-access-token");
-    var CAilySessionRecord = /* @__PURE__ */ Symbol("aily-session-record");
+    var CEventType = Symbol("event-type");
+    var CTenantKey = Symbol("tenant-key");
+    var CAppTicket = Symbol("app-ticket");
+    var CTenantAccessToken = Symbol("tenant-access-token");
+    var CWithHelpdeskAuthorization = Symbol("with-helpdesk-authorization");
+    var CWithUserAccessToken = Symbol("with-user-access-token");
+    var CUserAccessToken = Symbol("user-access-token");
+    var CAilySessionRecord = Symbol("aily-session-record");
     var string2Base64 = (content) => Buffer.from(content).toString("base64");
     var DefaultCache = class {
       constructor() {
@@ -26457,19 +26453,12 @@ var require_index = __commonJS({
           return domain;
       }
     };
-    var fillApiPath = (apiPath, pathSupplement = {}) => (
-      // Only treat `:name` as a path parameter when it starts a path segment
-      // (string start or right after `/`). Colons inside the URL authority,
-      // e.g. `http://localhost:3000` or `user:pw@host`, must be left untouched.
-      // The separator is captured and re-emitted instead of using a lookbehind
-      // because the compile target (es6) has no lookbehind support.
-      apiPath.replace(/(^|\/):([^/]+)/g, (_, pathPrefix, pathKey) => {
-        if (pathSupplement[pathKey] !== void 0) {
-          return `${pathPrefix}${pathSupplement[pathKey]}`;
-        }
-        throw new Error(`request miss ${pathKey} path argument`);
-      })
-    );
+    var fillApiPath = (apiPath, pathSupplement = {}) => apiPath.replace(/:([^/]+)/g, (_, $1) => {
+      if (pathSupplement[$1] !== void 0) {
+        return pathSupplement[$1];
+      }
+      throw new Error(`request miss ${$1} path argument`);
+    });
     var assert = (predication, callback) => __awaiter(void 0, void 0, void 0, function* () {
       const isInvoke = typeof predication === "function" ? predication() : predication;
       if (isInvoke) {
@@ -119932,8 +119921,6 @@ var require_index = __commonJS({
       }
     };
     var CAppTicketHandle = "app_ticket";
-    var duplicateHandleWarning = (key) => `${key} handle is already registered and has been replaced, call unregister('${key}') first to replace it explicitly`;
-    var appTicketUnregisteredWarning = `the built-in ${CAppTicketHandle} handle is unregistered, pushed app tickets are no longer cached and every app_access_token request of an ISV app will miss the cache and trigger an app_ticket resend`;
     var EventDispatcher = class {
       constructor(params) {
         this.verificationToken = "";
@@ -119967,46 +119954,16 @@ var require_index = __commonJS({
           })
         });
       }
-      /**
-       * Register a handler for each of the given event keys.
-       *
-       * Registering a key that already has a handler replaces it. That is a
-       * supported operation, but the replacement is easier to spot when it is
-       * announced: call `unregister(key)` first and nothing is logged, otherwise
-       * a warning flags what would otherwise be an unnoticed overwrite.
-       */
       register(handles) {
         Object.keys(handles).forEach((key) => {
           if (this.handles.has(key) && key !== CAppTicketHandle) {
-            this.logger.warn(duplicateHandleWarning(key));
+            this.logger.error(`this ${key} handle is registered`);
           }
           this.handles.set(key, handles[key]);
           this.logger.debug(`register ${key} handle`);
         });
         return this;
       }
-      /**
-       * Remove the handler registered for each of the given event keys, so that
-       * the events are no longer dispatched. Keys without a handler are skipped.
-       *
-       * Removing the built-in `app_ticket` handle stops the SDK from caching
-       * pushed app tickets, which makes every app_access_token request of an ISV
-       * app miss the cache and trigger an app_ticket resend -- hence the warning.
-       */
-      unregister(...keys) {
-        keys.forEach((key) => {
-          if (!this.handles.has(key)) {
-            this.logger.debug(`no ${key} handle to unregister`);
-            return;
-          }
-          this.handles.delete(key);
-          this.logger.debug(`unregister ${key} handle`);
-          if (key === CAppTicketHandle) {
-            this.logger.warn(appTicketUnregisteredWarning);
-          }
-        });
-        return this;
-      }
       invoke(data, params) {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
@@ -120729,9 +120686,6 @@ var require_index = __commonJS({
       }
       mergeData(params) {
         const { message_id, sum, seq, trace_id, data } = params;
-        if (!Number.isInteger(sum) || sum <= 0 || !Number.isInteger(seq) || seq < 0 || seq >= sum) {
-          throw new Error(`invalid event fragment metadata (sum: ${sum}, seq: ${seq})`);
-        }
         const cache = this.cache.get(message_id);
         if (!cache) {
           const buffer = new Array(sum).fill(void 0);
@@ -120743,9 +120697,6 @@ var require_index = __commonJS({
             create_time: Date.now()
           });
         } else {
-          if (sum !== cache.buffer.length) {
-            throw new Error(`invalid event fragment metadata (sum: ${sum} differs from first fragment's ${cache.buffer.length}, seq: ${seq})`);
-          }
           cache.buffer[seq] = data;
         }
         const mergedCache = this.cache.get(message_id);
@@ -120836,17 +120787,12 @@ var require_index = __commonJS({
       HttpStatusCode2[HttpStatusCode2["ok"] = 200] = "ok";
       HttpStatusCode2[HttpStatusCode2["internal_server_error"] = 500] = "internal_server_error";
     })(HttpStatusCode || (HttpStatusCode = {}));
-    var describeError = (err) => {
-      const message = err === null || err === void 0 ? void 0 : err.message;
-      return message ? message : String(err);
-    };
     var WSClient = class {
       constructor(params) {
         var _a;
         this.wsConfig = new WSConfig();
         this.reconnectGeneration = 0;
         this.isConnecting = false;
-        this.closed = false;
         this.reconnectInfo = {
           lastConnectTime: 0,
           nextConnectTime: 0
@@ -120915,53 +120861,6 @@ var require_index = __commonJS({
           this.livenessTimer = void 0;
         }
       }
-      /**
-       * Detach a socket we are about to throw away: drop every listener, but
-       * leave one 'error' sink behind.
-       *
-       * `ws` reports the abort of a non-OPEN socket asynchronously — both
-       * `terminate()` and `close()` route through `abortHandshake()`, which
-       * emits 'error' on a later tick — and a non-force `close()` on an OPEN
-       * socket keeps the connection alive until the peer answers (up to `ws`'s
-       * 30s closeTimeout), during which a TCP reset still surfaces as 'error'.
-       * An EventEmitter with no 'error' listener throws instead of emitting, and
-       * that throw lands outside every try/catch, killing the host process.
-       * See https://github.com/larksuite/node-sdk/issues/197
-       *
-       * NOTE: not for the liveness watchdog — that one terminates *on purpose*
-       * and needs its listeners intact so 'close' drives the reconnect.
-       */
-      detachSocket(socket) {
-        socket.removeAllListeners();
-        socket.on("error", (err) => {
-          this.logger.debug("[ws]", "ignored error from discarded socket", err === null || err === void 0 ? void 0 : err.message);
-        });
-      }
-      /**
-       * Throw away whatever the current attempt established — socket *and* the
-       * timers its 'open' handler armed. A handshake that completes after
-       * `close()` runs `pingLoop()`, and that timer is not unref'd: leaving it
-       * behind keeps the event loop alive forever on a client the caller closed.
-       *
-       * Only safe when {@link closed} is set: otherwise a newer session may
-       * already own `wsConfig`'s instance.
-       */
-      discardConnection() {
-        if (this.pingInterval) {
-          clearTimeout(this.pingInterval);
-          this.pingInterval = void 0;
-        }
-        this.clearLiveness();
-        const socket = this.wsConfig.getWSInstance();
-        if (!socket)
-          return;
-        this.detachSocket(socket);
-        try {
-          socket.terminate();
-        } catch (_a) {
-        }
-        this.wsConfig.setWSInstance(null);
-      }
       /**
        * Invoke a user-supplied callback safely: no-op if undefined, swallow any
        * exception to avoid breaking the WS state machine.
@@ -121068,7 +120967,7 @@ var require_index = __commonJS({
           if (this.handshakeTimeoutMs && this.handshakeTimeoutMs > 0) {
             timer = setTimeout(() => {
               this.logger.error("[ws]", `handshake timeout after ${this.handshakeTimeoutMs}ms`);
-              this.detachSocket(wsInstance);
+              wsInstance.removeAllListeners();
               try {
                 wsInstance.terminate();
               } catch (_a) {
@@ -121124,13 +121023,6 @@ var require_index = __commonJS({
             } finally {
               this.isConnecting = false;
             }
-            if (this.closed) {
-              this.discardConnection();
-              return;
-            }
-            if (currentGeneration !== this.reconnectGeneration) {
-              return;
-            }
             if (result.ok) {
               this.hasEverConnected = true;
               this.safeInvoke("onReady", this.onReady);
@@ -121172,10 +121064,6 @@ var require_index = __commonJS({
                 count++;
                 this.currentReconnectAttempts = count;
                 const result = yield tryConnect();
-                if (this.closed) {
-                  this.discardConnection();
-                  return;
-                }
                 if (currentGeneration !== this.reconnectGeneration) {
                   return;
                 }
@@ -121239,17 +121127,13 @@ var require_index = __commonJS({
         const wsInstance = this.wsConfig.getWSInstance();
         wsInstance === null || wsInstance === void 0 ? void 0 : wsInstance.on("message", (buffer) => __awaiter(this, void 0, void 0, function* () {
           this.clearLiveness();
-          try {
-            const data = decode(buffer);
-            const { method } = data;
-            if (method === FrameType.control) {
-              yield this.handleControlData(data);
-            }
-            if (method === FrameType.data) {
-              yield this.handleEventData(data);
-            }
-          } catch (err) {
-            this.logger.error("[ws]", `failed to handle inbound frame: ${describeError(err)}`);
+          const data = decode(buffer);
+          const { method } = data;
+          if (method === FrameType.control) {
+            yield this.handleControlData(data);
+          }
+          if (method === FrameType.data) {
+            yield this.handleEventData(data);
           }
         }));
         wsInstance === null || wsInstance === void 0 ? void 0 : wsInstance.on("error", (e) => {
@@ -121271,15 +121155,8 @@ var require_index = __commonJS({
           }
           if (type === MessageType.pong && payload) {
             this.logger.trace("[ws]", "receive pong");
-            let pong;
-            try {
-              const dataString = new TextDecoder("utf-8").decode(payload);
-              pong = JSON.parse(dataString);
-            } catch (err) {
-              this.logger.error("[ws]", `invalid pong payload: ${describeError(err)}`);
-              return;
-            }
-            const { PingInterval, ReconnectCount, ReconnectInterval, ReconnectNonce } = pong;
+            const dataString = new TextDecoder("utf-8").decode(payload);
+            const { PingInterval, ReconnectCount, ReconnectInterval, ReconnectNonce } = JSON.parse(dataString);
             this.wsConfig.updateWs({
               pingInterval: PingInterval * 1e3,
               reconnectCount: ReconnectCount,
@@ -121302,19 +121179,13 @@ var require_index = __commonJS({
           if (type !== MessageType.event) {
             return;
           }
-          let mergedData;
-          try {
-            mergedData = this.dataCache.mergeData({
-              message_id,
-              sum: Number(sum),
-              seq: Number(seq),
-              trace_id,
-              data: payload
-            });
-          } catch (err) {
-            this.logger.error("[ws]", `failed to merge event fragments, message_id: ${message_id}; trace_id: ${trace_id}; error: ${describeError(err)}`);
-            return;
-          }
+          const mergedData = this.dataCache.mergeData({
+            message_id,
+            sum: Number(sum),
+            seq: Number(seq),
+            trace_id,
+            data: payload
+          });
           if (!mergedData) {
             return;
           }
@@ -121383,7 +121254,6 @@ var require_index = __commonJS({
        */
       close(params = {}) {
         const { force = false } = params;
-        this.closed = true;
         this.reconnectGeneration++;
         if (this.pingInterval) {
           clearTimeout(this.pingInterval);
@@ -121399,7 +121269,7 @@ var require_index = __commonJS({
         this.currentReconnectAttempts = 0;
         const wsInstance = this.wsConfig.getWSInstance();
         if (wsInstance) {
-          this.detachSocket(wsInstance);
+          wsInstance.removeAllListeners();
           if (force) {
             wsInstance.terminate();
           } else {
@@ -121422,7 +121292,6 @@ var require_index = __commonJS({
             return;
           }
           this.terminalError = false;
-          this.closed = false;
           this.currentReconnectAttempts = 0;
           this.dataCache.clearAtInterval();
           this.logger.info("[ws]", `receive events or callbacks through persistent connection only available in self-build & Feishu app, Configured in:
@@ -121842,7 +121711,6 @@ var require_index = __commonJS({
         let domainSwitched = false;
         let pollTimer = null;
         let expireTimer = null;
-        let settled = false;
         const cleanup = () => {
           var _a2;
           if (pollTimer !== null) {
@@ -121855,51 +121723,25 @@ var require_index = __commonJS({
           }
           (_a2 = ctx.signal) === null || _a2 === void 0 ? void 0 : _a2.removeEventListener("abort", onAbort);
         };
-        const succeed = (result) => {
-          if (settled) {
-            return;
-          }
-          settled = true;
-          cleanup();
-          resolve(result);
-        };
-        const fail = (err) => {
-          if (settled) {
-            return;
-          }
-          settled = true;
-          cleanup();
-          reject(err);
-        };
-        const scheduleNextPoll = () => {
-          if (settled) {
-            return;
-          }
-          pollTimer = setTimeout(poll, interval);
-        };
         const onAbort = () => {
-          fail(createError("abort", "Registration was aborted"));
+          cleanup();
+          reject(createError("abort", "Registration was aborted"));
         };
         if ((_a = ctx.signal) === null || _a === void 0 ? void 0 : _a.aborted) {
-          return fail(createError("abort", "Registration was aborted"));
+          return reject(createError("abort", "Registration was aborted"));
         }
         (_b = ctx.signal) === null || _b === void 0 ? void 0 : _b.addEventListener("abort", onAbort, { once: true });
         expireTimer = setTimeout(() => {
-          fail(createError("expired_token", "Polling timed out"));
+          cleanup();
+          reject(createError("expired_token", "Polling timed out"));
         }, ctx.expireIn);
         const poll = () => __awaiter(this, void 0, void 0, function* () {
           var _c, _d, _e, _f, _g, _h;
-          if (settled) {
-            return;
-          }
           try {
             const pollRes = yield requestRegistration(baseUrl, {
               action: "poll",
               device_code: ctx.deviceCode
             });
-            if (settled) {
-              return;
-            }
             if (((_c = pollRes.user_info) === null || _c === void 0 ? void 0 : _c.tenant_brand) === "lark" && !domainSwitched) {
               baseUrl = ctx.larkBaseUrl;
               domainSwitched = true;
@@ -121908,7 +121750,8 @@ var require_index = __commonJS({
               return;
             }
             if (pollRes.client_id && pollRes.client_secret) {
-              succeed({
+              cleanup();
+              resolve({
                 client_id: pollRes.client_id,
                 client_secret: pollRes.client_secret,
                 user_info: pollRes.user_info
@@ -121925,18 +121768,21 @@ var require_index = __commonJS({
                 break;
               case "access_denied":
               case "expired_token":
-                fail(createError(pollRes.error, (_g = pollRes.error_description) !== null && _g !== void 0 ? _g : "Unknown error"));
+                cleanup();
+                reject(createError(pollRes.error, (_g = pollRes.error_description) !== null && _g !== void 0 ? _g : "Unknown error"));
                 return;
               default:
                 if (pollRes.error) {
-                  fail(createError(pollRes.error, (_h = pollRes.error_description) !== null && _h !== void 0 ? _h : "Unknown error"));
+                  cleanup();
+                  reject(createError(pollRes.error, (_h = pollRes.error_description) !== null && _h !== void 0 ? _h : "Unknown error"));
                   return;
                 }
                 break;
             }
-            scheduleNextPoll();
+            pollTimer = setTimeout(poll, interval);
           } catch (e) {
-            fail(e);
+            cleanup();
+            reject(e);
           }
         });
         poll();

package/lib/index.js

@@ -10,7 +10,7 @@ import { get as httpsGet } from 'node:https';
 import { networkInterfaces, homedir, totalmem, freemem, cpus, loadavg, platform, arch, release, hostname, uptime } from 'node:os';
 import { join, dirname, basename, resolve, normalize } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readFileSync, appendFileSync, existsSync, realpathSync } from 'node:fs';
+import { readFileSync, appendFileSync, existsSync, realpathSync, mkdirSync } from 'node:fs';
 import { readFile, writeFile, mkdir, unlink, readdir, stat, access } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
 import QRCode from 'qrcode';
@@ -278,12 +278,18 @@ function sanitizeProxyHeaders(headers, extra) {
  * @returns {string} 单元名，取不到返回空串
  */
 export function parseSystemdUnit(cgroup) {
-  const parts = String(cgroup || '').split('/').filter(Boolean);
-  // 只认**最内层**组件：若最内层不是 .service（例如 .scope、或 docker/k8s 的容器目录），
-  // 说明本进程不是被某个 service 直接托管，绝不能向上游误取祖先单元
-  // （否则会把 docker.service / cron.service 之类重启掉）。
-  const innermost = parts[parts.length - 1] ?? '';
-  return innermost.endsWith('.service') ? innermost : '';
+  const lines = String(cgroup || '').split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+  for (const line of lines) {
+    const parts = line.split('/').map((p) => p.trim()).filter(Boolean);
+    // 只认**最内层**组件：若最内层不是 .service（例如 .scope、或 docker/k8s 的容器目录），
+    // 说明本进程不是被某个 service 直接托管，绝不能向上游误取祖先单元
+    // （否则会把 docker.service / cron.service 之类重启掉）。
+    const innermost = parts[parts.length - 1] ?? '';
+    if (innermost.endsWith('.service')) {
+      return innermost;
+    }
+  }
+  return '';
 }
 
 /**
@@ -304,8 +310,8 @@ export function detectSupervisor({ env = process.env, cgroup = '' } = {}) {
   const systemdMarked = Boolean(env.INVOCATION_ID || env.JOURNAL_STREAM) || text.includes('.slice');
   const unit = systemdMarked ? parseSystemdUnit(text) : '';
   if (unit) {
-    const parts = text.split('/').filter(Boolean);
-    return { kind: 'systemd', scope: parts.includes('user.slice') ? 'user' : 'system', unit, reason: 'cgroup 检出 systemd 单元' };
+    const isUser = text.includes('user.slice') || text.includes('/user@');
+    return { kind: 'systemd', scope: isUser ? 'user' : 'system', unit, reason: 'cgroup 检出 systemd 单元' };
   }
   return { kind: 'self', reason: '未检出托管器（无 DSH_DAEMON/PM2_HOME，也不在 systemd 单元内）' };
 }
@@ -1379,6 +1385,7 @@ class BridgeService {
     const dshHome = env.DSH_HOME ?? join(homedir(), '.dsh');
     const logFile = join(dshHome, 'dsh-bridge', 'restart.log');
     const childLog = join(dshHome, 'dsh-bridge', 'restart-child.log');
+    try { mkdirSync(dirname(logFile), { recursive: true }); } catch { /* 日志目录不可写时忽略 */ }
     const writeLog = (message) => {
       try { appendFileSync(logFile, `[${new Date().toISOString()}] ${message}\n`); } catch { /* 日志不可写时忽略 */ }
     };
@@ -1389,18 +1396,36 @@ class BridgeService {
 
     if (plan.kind === 'systemd') {
       const args = [...(plan.scope === 'user' ? ['--user'] : []), 'restart', '--no-block', plan.unit];
+      const systemctlEnv = { ...env };
+      if (process.platform === 'linux') {
+        const defaultPaths = ['/usr/local/bin', '/usr/bin', '/bin', '/usr/local/sbin', '/usr/sbin', '/sbin'];
+        const existingPath = systemctlEnv.PATH || '';
+        const missingPaths = defaultPaths.filter((p) => !existingPath.split(':').includes(p));
+        if (missingPaths.length > 0) {
+          systemctlEnv.PATH = existingPath ? `${existingPath}:${missingPaths.join(':')}` : missingPaths.join(':');
+        }
+        if (plan.scope === 'user' && !systemctlEnv.XDG_RUNTIME_DIR && typeof process.getuid === 'function') {
+          systemctlEnv.XDG_RUNTIME_DIR = `/run/user/${process.getuid()}`;
+        }
+      }
       // 关键：必须以 **systemctl 的退出码** 判定成败，而不是"派生成功"。
       // `--no-block` 下 systemctl 只发请求就返回（实测往返 ~6ms），但单元名不存在会 rc=5、
       // 权限不足会 rc=1；旧写法只看 'spawn' 事件 → 必然失败也返回 ok:true 再 exit(0)，
       // 而干净退出不满足 Restart=on-failure → DSH 直接下线且不自动拉起。
       const outcome = await new Promise((resolve) => {
         let settled = false;
-        const settle = (value) => { if (!settled) { settled = true; resolve(value); } };
+        const timer = setTimeout(() => settle({ error: new Error('systemctl 执行超时（5s）') }), 5000);
+        const settle = (value) => {
+          if (!settled) {
+            settled = true;
+            clearTimeout(timer);
+            resolve(value);
+          }
+        };
         try {
-          const child = spawnImpl('systemctl', args, { detached: true, stdio: 'ignore', env });
+          const child = spawnImpl('systemctl', args, { detached: true, stdio: 'ignore', env: systemctlEnv });
           child.once?.('error', (err) => settle({ error: err }));
           child.once?.('close', (code) => settle({ code }));
-          child.unref?.();
         } catch (err) {
           settle({ error: err });
         }