@wenbin_wb/dsh-bridge 2.10.2 → 2.10.3

package/lib/session-strip.js

@@ -0,0 +1,57 @@
+// DSH Bridge - 会话响应投影剥离（共享逻辑）
+//
+// contextHeaders / contextTimeline 是 DSH 会话投影里的两个大字段：每轮完整系统提示
+// + 工具定义（单会话 4.8MB+，session.list 数百会话可达 60MB+），但没有客户端 UI
+// 读取它们（会话打开时通过 WebSocket 实时获取，见 dsh-session-projection-cache 注释）。
+// 剥离后可大幅降低传输体积（session.history gzip 1.2MB -> ~150KB，约 8 倍）。
+//
+// 本模块被两个转发层复用：
+//   - tunnel-client.mjs（自建隧道）
+//   - index.js ProxyServer（局域网 / Cloudflare 隧道 / 外部隧道登记 —— 所有公网入口）
+// 命中失败（非 200 / 解析失败 / 结构不符）时原样返回，绝不破坏响应。
+
+const STRIP_PATHS = new Set(['/api/session.list', '/api/session.history']);
+
+/**
+ * 剥离 session.list / session.history 响应中的 contextHeaders 与 contextTimeline。
+ * @param {string} pathname 请求路径（不含 query）
+ * @param {Buffer} bodyBuf 原始响应体
+ * @returns {{ body: Buffer, stripped: boolean }} stripped=true 表示发生了剥离（调用方需更新 content-length）
+ */
+export function stripSessionProjections(pathname, bodyBuf) {
+  const cleanPath = String(pathname || '').split('?')[0];
+  if (!STRIP_PATHS.has(cleanPath) || !Buffer.isBuffer(bodyBuf)) {
+    return { body: bodyBuf, stripped: false };
+  }
+  try {
+    const json = JSON.parse(bodyBuf.toString('utf8'));
+    if (json?.result?.ok) {
+      const v = json.result.value;
+      let changed = false;
+      // session.list: items[].projections.values
+      if (v?.items) {
+        for (const item of v.items) {
+          const proj = item?.projections?.values;
+          if (proj && (proj.contextHeaders !== undefined || proj.contextTimeline !== undefined)) {
+            delete proj.contextHeaders;
+            delete proj.contextTimeline;
+            changed = true;
+          }
+        }
+      }
+      // session.history: projections.values
+      if (v?.projections?.values) {
+        const proj = v.projections.values;
+        if (proj.contextHeaders !== undefined || proj.contextTimeline !== undefined) {
+          delete proj.contextHeaders;
+          delete proj.contextTimeline;
+          changed = true;
+        }
+      }
+      if (changed) {
+        return { body: Buffer.from(JSON.stringify(json), 'utf8'), stripped: true };
+      }
+    }
+  } catch { /* 解析失败则原样发送 */ }
+  return { body: bodyBuf, stripped: false };
+}

package/lib/telegram/node.js

@@ -206,33 +206,6 @@ export class TelegramConversationNode extends ConversationBridge {
     }
   }
 
-  async sendApprovalCard(approvalId, request) {
-    const peerId = this._lastPeer?.chatId || this.peerId
-    if (!peerId || !this.gateway) return
-
-    const toolName = request?.name || request?.tool || '系统操作'
-    const desc = request?.description || request?.summary || ''
-    const command = request?.command || request?.cmd || ''
-
-    const lines = [
-      `⚠️ **操作权限确认** (ID: <code>${approvalId}</code>)`,
-      '',
-      `• **工具**：<code>${toolName}</code>`,
-    ]
-    if (desc) lines.push(`• **说明**：${desc}`)
-    if (command) lines.push(`• **命令**：<code>${command}</code>`)
-    lines.push('', '请选择审批决议（亦可直接输入 <code>1</code> 批准，<code>2</code> 拒绝）：')
-
-    const buttons = [
-      [
-        { text: '✓ 批准执行', callback_data: `approve:${approvalId}` },
-        { text: '✕ 拒绝执行', callback_data: `reject:${approvalId}` },
-      ],
-    ]
-
-    return this.gateway.sendKeyboard(peerId, lines.join('\n'), buttons)
-  }
-
   async _sendTextNow(text, opts = {}) {
     // T2.3：轮次绑定的 outboundPeer（chat 级目标）优先生效
     const peerId = opts?.outboundPeer?.peerId || this._lastPeer?.chatId || this.peerId

package/lib/tunnel-client.mjs

@@ -4,6 +4,7 @@ import { request as httpRequest } from 'node:http';
 import { connect as netConnect } from 'node:net';
 import { promisify } from 'node:util';
 import { gzip as gzipCallback } from 'node:zlib';
+import { stripSessionProjections } from './session-strip.js';
 
 const gzipAsync = promisify(gzipCallback);
 
@@ -255,35 +256,13 @@ export class CustomTunnelClient {
         );
         let bodyBuf = Buffer.concat(chunks);
 
-        // 剥离 contextHeaders 和 contextTimeline — 这两个投影字段包含每轮完整
-        // 系统提示+工具定义（4.8MB+），但没有任何客户端 UI 读取它们。
-        // session.list: 数百会话 × contextHeaders = 60MB+
-        // session.history: 单会话 contextHeaders = 4.8MB，占响应 80%+
-        // 剥离后 session.history 从 1.2MB gzip 降到 ~150KB（8x 减少）
-        if ((cleanPath === '/api/session.list' || cleanPath === '/api/session.history') && res.statusCode === 200) {
-          try {
-            const json = JSON.parse(bodyBuf.toString('utf8'));
-            if (json?.result?.ok) {
-              const v = json.result.value;
-              // session.list: items[].projections.values
-              if (v?.items) {
-                for (const item of v.items) {
-                  const proj = item?.projections?.values;
-                  if (proj) {
-                    delete proj.contextHeaders;
-                    delete proj.contextTimeline;
-                  }
-                }
-              }
-              // session.history: projections.values
-              if (v?.projections?.values) {
-                delete v.projections.values.contextHeaders;
-                delete v.projections.values.contextTimeline;
-              }
-              bodyBuf = Buffer.from(JSON.stringify(json), 'utf8');
-              respHeaders['content-length'] = String(bodyBuf.length);
-            }
-          } catch {} // 解析失败则原样发送
+        // 剥离 session.list / session.history 的 contextHeaders 投影（无 UI 读取的大字段）
+        if (res.statusCode === 200) {
+          const { body, stripped } = stripSessionProjections(path, bodyBuf);
+          if (stripped) {
+            bodyBuf = body;
+            respHeaders['content-length'] = String(bodyBuf.length);
+          }
         }
 
         // 大响应 gzip 压缩：异步执行，避免 gzipSync 卡住整个事件循环

package/lib/wechat/gateway.js

@@ -84,17 +84,19 @@ function baseInfo() {
 }
 
 /** 带超时与 abort 的 POST JSON。非 2xx 抛出带 HTTP 状态的错误。 */
-async function postJson({ baseUrl = ILINK_BASE_URL, endpoint, payload, token, timeoutMs = API_TIMEOUT_MS }) {
+async function postJson({ baseUrl = ILINK_BASE_URL, endpoint, payload, token, timeoutMs = API_TIMEOUT_MS, signal: externalSignal }) {
   const body = JSON.stringify({ ...payload, base_info: baseInfo() })
   const url = `${baseUrl.replace(/\/+$/, '')}/${endpoint}`
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), timeoutMs)
+  // 外部 signal（如轮询停止）与超时合并：任一触发即中止请求
+  const signal = externalSignal ? AbortSignal.any([externalSignal, controller.signal]) : controller.signal
   try {
     const response = await fetch(url, {
       method: 'POST',
       headers: requestHeaders(token, body),
       body,
-      signal: controller.signal,
+      signal,
     })
     const raw = await response.text()
     if (!response.ok) {
@@ -136,7 +138,7 @@ async function getJson({ baseUrl = ILINK_BASE_URL, endpoint, timeoutMs = QR_TIME
 }
 
 /** 长轮询收消息；超时返回空批次（不算错误）。 */
-async function getUpdates({ baseUrl, token, syncBuf, timeoutMs = LONG_POLL_TIMEOUT_MS }) {
+async function getUpdates({ baseUrl, token, syncBuf, timeoutMs = LONG_POLL_TIMEOUT_MS, signal } = {}) {
   try {
     const raw = await postJson({
       baseUrl,
@@ -144,6 +146,7 @@ async function getUpdates({ baseUrl, token, syncBuf, timeoutMs = LONG_POLL_TIMEO
       payload: { get_updates_buf: syncBuf },
       token,
       timeoutMs,
+      signal,
     })
     return {
       messages: Array.isArray(raw.msgs) ? raw.msgs : [],
@@ -315,6 +318,8 @@ export class WechatGateway extends Service {
     this.syncBuf = ''
     this.pollTask = null
     this.stopPollingLocal = false
+    // 当前轮询循环的中止信号：stop/restart 时 abort 以立即中断 in-flight 长轮询
+    this._pollAbort = null
     this.statusValue = 'idle'
     this.contextTokens = new Map()
     try {
@@ -388,6 +393,7 @@ export class WechatGateway extends Service {
 
   async stop() {
     this.stopPollingLocal = true
+    this._pollAbort?.abort()
     const task = this.pollTask
     this.pollTask = null
     if (task) {
@@ -770,6 +776,8 @@ export class WechatGateway extends Service {
     if (this._restartingPromise) return this._restartingPromise
     this._restartingPromise = (async () => {
       this.stopPollingLocal = true
+      // 立即中断旧循环的 in-flight 长轮询，避免等待最长 35s 才切换
+      this._pollAbort?.abort()
       const previous = this.pollTask
       this.pollTask = null
       if (previous) {
@@ -799,6 +807,9 @@ export class WechatGateway extends Service {
   }
 
   async runPollLoop() {
+    // 每次轮询循环持有一个独立 abort：stop/restart 时中断 in-flight getUpdates（最长 35s）
+    const pollAbort = new AbortController()
+    this._pollAbort = pollAbort
     let consecutiveFailures = 0
     let timeoutMs = this.c.longPollTimeoutMs
     let fatal = false
@@ -809,6 +820,7 @@ export class WechatGateway extends Service {
           token: this.c.token,
           syncBuf: this.syncBuf,
           timeoutMs,
+          signal: pollAbort.signal,
         })
         if (this.stopPollingLocal) break
 
@@ -874,7 +886,8 @@ export class WechatGateway extends Service {
         await sleep(backoff)
       }
     }
-    // 致命错误保持终态；普通停止回到 idle
+    // 清理当前轮询 abort（避免悬挂引用）；致命错误保持终态，普通停止回到 idle
+    if (this._pollAbort === pollAbort) this._pollAbort = null
     if (!fatal) this.setStatus('idle')
   }
 

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.10.2",
+  "version": "2.10.3",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
-  "releaseNotes": "【v2.10.2】\n• 🆕 外部已部署隧道登记（issue #25）：自行部署 cloudflared（Docker 等）可在面板登记公网地址，展示二维码与入口，插件不再重复下载管理\n• 🐞 修复会话列表/历史加载问题：自建隧道下 session.list 502 修复 + 会话历史载入提速（社区 PR #27）",
+  "releaseNotes": "【v2.10.3】\n• 兼容 DSH 原生端口 3080 直连（issue #28）：本机直连不再被误判为远程而锁定，走代理与直连行为一致\n• 安全：AI [SEND_FILE] 仅允许发送工作目录内文件，拦截 .ssh/.credentials/.env 等敏感路径\n• 修复：代理响应头透传、QQ 流式重复发送、微信轮询竞态（iLink 403）、飞书群聊审批按钮误拦\n• 会话列表/历史大字段剥离覆盖局域网与 Cloudflare 等全部公网入口",
   "type": "module",
   "main": "lib/index.js",
   "exports": {