@wenbin_wb/dsh-bridge 2.10.2 → 2.10.4

package/lib/session-strip.js

@@ -0,0 +1,67 @@
+// DSH Bridge - 会话响应投影剥离（共享逻辑）
+//
+// contextHeaders / contextTimeline 是 DSH 会话投影里的两个大字段：每轮完整系统提示
+// + 工具定义（单会话 4.8MB+，session.list 数百会话可达 60MB+），但没有客户端 UI
+// 读取它们（会话打开时通过 WebSocket 实时获取，见 dsh-session-projection-cache 注释）。
+// 剥离后可大幅降低传输体积（session.history gzip 1.2MB -> ~150KB，约 8 倍）。
+//
+// 本模块被两个转发层复用：
+//   - tunnel-client.mjs（自建隧道）
+//   - index.js ProxyServer（局域网 / Cloudflare 隧道 / 外部隧道登记 —— 所有公网入口）
+// 命中失败（非 200 / 解析失败 / 结构不符）时原样返回，绝不破坏响应。
+//
+// DSH web 服务器默认开启 gzip 压缩（compression: gzip, level 1, threshold 1KB），
+// 所以 API 响应可能是 gzip 编码的。必须先解压才能 JSON.parse，否则解析失败，
+// catch {} 静默跳过剥离 → 完整 58MB+ 响应原样传输 → 隧道慢。
+
+import { gunzipSync } from 'node:zlib';
+
+const STRIP_PATHS = new Set(['/api/session.list', '/api/session.history']);
+
+/**
+ * 剥离 session.list / session.history 响应中的 contextHeaders 与 contextTimeline。
+ * @param {string} pathname 请求路径（不含 query）
+ * @param {Buffer} bodyBuf 原始响应体
+ * @param {string} [contentEncoding] 响应的 content-encoding 头值（用于判断是否 gzip）
+ * @returns {{ body: Buffer, stripped: boolean }} stripped=true 表示发生了剥离（调用方需更新 content-length 和 content-encoding）
+ */
+export function stripSessionProjections(pathname, bodyBuf, contentEncoding) {
+  const cleanPath = String(pathname || '').split('?')[0];
+  if (!STRIP_PATHS.has(cleanPath) || !Buffer.isBuffer(bodyBuf)) {
+    return { body: bodyBuf, stripped: false };
+  }
+  try {
+    // 如果 DSH 服务器 gzip 压缩了响应，先解压再解析
+    const isGzipped = String(contentEncoding ?? '').toLowerCase() === 'gzip';
+    const parseBuf = isGzipped ? gunzipSync(bodyBuf) : bodyBuf;
+    const json = JSON.parse(parseBuf.toString('utf8'));
+    if (json?.result?.ok) {
+      const v = json.result.value;
+      let changed = false;
+      // session.list: items[].projections.values
+      if (v?.items) {
+        for (const item of v.items) {
+          const proj = item?.projections?.values;
+          if (proj && (proj.contextHeaders !== undefined || proj.contextTimeline !== undefined)) {
+            delete proj.contextHeaders;
+            delete proj.contextTimeline;
+            changed = true;
+          }
+        }
+      }
+      // session.history: projections.values
+      if (v?.projections?.values) {
+        const proj = v.projections.values;
+        if (proj.contextHeaders !== undefined || proj.contextTimeline !== undefined) {
+          delete proj.contextHeaders;
+          delete proj.contextTimeline;
+          changed = true;
+        }
+      }
+      if (changed) {
+        return { body: Buffer.from(JSON.stringify(json), 'utf8'), stripped: true };
+      }
+    }
+  } catch { /* 解析/解压失败则原样发送 */ }
+  return { body: bodyBuf, stripped: false };
+}

package/lib/telegram/gateway.js

@@ -37,34 +37,36 @@ export function createConnectProxyAgent(proxyUrl) {
     ? 'Basic ' + Buffer.from(`${decodeURIComponent(parsed.username)}:${decodeURIComponent(parsed.password)}`).toString('base64')
     : undefined
 
-  return new https.Agent({
-    keepAlive: true,
-    createConnection(opts, callback) {
-      const connectReq = http.request({
-        host: proxyHost,
-        port: proxyPort,
-        method: 'CONNECT',
-        path: `${opts.host}:${opts.port || 443}`,
-        headers: authHeader ? { 'Proxy-Authorization': authHeader } : {},
-      })
+  // Node >=24 下自定义 createConnection 作为 https.Agent 构造参数会被静默忽略
+  // （https.Agent 不拷贝构造入参中的 createConnection，回退到原型默认直连方法）。
+  // 改为构造后赋值实例属性：实例自有属性会正确覆盖原型方法，Node 22/24 均生效。
+  const agent = new https.Agent({ keepAlive: true })
+  agent.createConnection = function createTunnelConnection(opts, callback) {
+    const connectReq = http.request({
+      host: proxyHost,
+      port: proxyPort,
+      method: 'CONNECT',
+      path: `${opts.host}:${opts.port || 443}`,
+      headers: authHeader ? { 'Proxy-Authorization': authHeader } : {},
+    })
 
-      connectReq.on('connect', (res, socket) => {
-        if (res.statusCode !== 200) {
-          socket.destroy()
-          return callback(new Error(`Proxy CONNECT failed with HTTP ${res.statusCode}`))
-        }
-        const tlsSocket = tls.connect({
-          host: opts.host,
-          socket,
-          servername: opts.servername || opts.host,
-        })
-        callback(null, tlsSocket)
+    connectReq.on('connect', (res, socket) => {
+      if (res.statusCode !== 200) {
+        socket.destroy()
+        return callback(new Error(`Proxy CONNECT failed with HTTP ${res.statusCode}`))
+      }
+      const tlsSocket = tls.connect({
+        host: opts.host,
+        socket,
+        servername: opts.servername || opts.host,
       })
+      callback(null, tlsSocket)
+    })
 
-      connectReq.on('error', (err) => callback(err))
-      connectReq.end()
-    },
-  })
+    connectReq.on('error', (err) => callback(err))
+    connectReq.end()
+  }
+  return agent
 }
 
 /**
@@ -627,4 +629,4 @@ export class TelegramGateway extends Service {
   dispose() {
     void this.stop()
   }
-}
+}

package/lib/telegram/node.js

@@ -206,33 +206,6 @@ export class TelegramConversationNode extends ConversationBridge {
     }
   }
 
-  async sendApprovalCard(approvalId, request) {
-    const peerId = this._lastPeer?.chatId || this.peerId
-    if (!peerId || !this.gateway) return
-
-    const toolName = request?.name || request?.tool || '系统操作'
-    const desc = request?.description || request?.summary || ''
-    const command = request?.command || request?.cmd || ''
-
-    const lines = [
-      `⚠️ **操作权限确认** (ID: <code>${approvalId}</code>)`,
-      '',
-      `• **工具**：<code>${toolName}</code>`,
-    ]
-    if (desc) lines.push(`• **说明**：${desc}`)
-    if (command) lines.push(`• **命令**：<code>${command}</code>`)
-    lines.push('', '请选择审批决议（亦可直接输入 <code>1</code> 批准，<code>2</code> 拒绝）：')
-
-    const buttons = [
-      [
-        { text: '✓ 批准执行', callback_data: `approve:${approvalId}` },
-        { text: '✕ 拒绝执行', callback_data: `reject:${approvalId}` },
-      ],
-    ]
-
-    return this.gateway.sendKeyboard(peerId, lines.join('\n'), buttons)
-  }
-
   async _sendTextNow(text, opts = {}) {
     // T2.3：轮次绑定的 outboundPeer（chat 级目标）优先生效
     const peerId = opts?.outboundPeer?.peerId || this._lastPeer?.chatId || this.peerId

package/lib/tunnel-client.mjs

@@ -4,6 +4,8 @@ import { request as httpRequest } from 'node:http';
 import { connect as netConnect } from 'node:net';
 import { promisify } from 'node:util';
 import { gzip as gzipCallback } from 'node:zlib';
+import { randomBytes as cryptoRandomBytes } from 'node:crypto';
+import { stripSessionProjections } from './session-strip.js';
 
 const gzipAsync = promisify(gzipCallback);
 
@@ -21,7 +23,7 @@ const GZIP_THRESHOLD = 102400; // 100KB
 const COMPRESSIBLE_TYPES = ['text/', 'application/json', 'application/javascript', 'application/xml'];
 
 export class CustomTunnelClient {
-  constructor({ serverUrl, accessToken, localPort, internalTunnelSecret, signal, onStateChange, logger }) {
+  constructor({ serverUrl, accessToken, localPort, internalTunnelSecret, signal, onStateChange, logger, sseStreaming = false }) {
     this.serverUrl = serverUrl;
     this.accessToken = accessToken;
     this.localPort = localPort;
@@ -29,6 +31,7 @@ export class CustomTunnelClient {
     this.signal = signal;
     this.onStateChange = onStateChange;
     this.logger = logger;
+    this.sseStreaming = sseStreaming;
     this.ws = null;
     this.publicUrl = null;
     this.connected = false;
@@ -160,8 +163,33 @@ export class CustomTunnelClient {
       const chunks = [];
 
       if (isSSE) {
-        // SSE 流式响应：隧道协议不支持流式，收集初始数据后立即返回
-        // 避免 SSE 永不 end 导致隧道服务器超时返回 504
+        if (this.sseStreaming) {
+          // ── 流式模式（需服务端支持 response-start/chunk/end 协议）──
+          // 逐 chunk 转发，SSE 长连接持续保持，浏览器端不会断连重连
+          const respHeaders = Object.fromEntries(
+            Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+          );
+          this._sendMessage({
+            type: 'response-start', requestId,
+            statusCode: res.statusCode, headers: respHeaders,
+          });
+          res.on('data', (c) => {
+            this._sendMessage({
+              type: 'response-chunk', requestId,
+              body: c.toString('base64'),
+            });
+          });
+          res.on('error', () => {
+            this._sendMessage({ type: 'response-end', requestId });
+          });
+          res.on('end', () => {
+            this._sendMessage({ type: 'response-end', requestId });
+          });
+          return;
+        }
+
+        // ── 截断模式（默认，兼容老服务端）──
+        // 收集初始数据后立即返回，避免 SSE 永不 end 导致隧道服务器超时 504
         let sseSent = false;
         const sseTimer = setTimeout(() => {
           if (sseSent) return;
@@ -255,40 +283,23 @@ export class CustomTunnelClient {
         );
         let bodyBuf = Buffer.concat(chunks);
 
-        // 剥离 contextHeaders 和 contextTimeline — 这两个投影字段包含每轮完整
-        // 系统提示+工具定义（4.8MB+），但没有任何客户端 UI 读取它们。
-        // session.list: 数百会话 × contextHeaders = 60MB+
-        // session.history: 单会话 contextHeaders = 4.8MB，占响应 80%+
-        // 剥离后 session.history 从 1.2MB gzip 降到 ~150KB（8x 减少）
-        if ((cleanPath === '/api/session.list' || cleanPath === '/api/session.history') && res.statusCode === 200) {
-          try {
-            const json = JSON.parse(bodyBuf.toString('utf8'));
-            if (json?.result?.ok) {
-              const v = json.result.value;
-              // session.list: items[].projections.values
-              if (v?.items) {
-                for (const item of v.items) {
-                  const proj = item?.projections?.values;
-                  if (proj) {
-                    delete proj.contextHeaders;
-                    delete proj.contextTimeline;
-                  }
-                }
-              }
-              // session.history: projections.values
-              if (v?.projections?.values) {
-                delete v.projections.values.contextHeaders;
-                delete v.projections.values.contextTimeline;
-              }
-              bodyBuf = Buffer.from(JSON.stringify(json), 'utf8');
-              respHeaders['content-length'] = String(bodyBuf.length);
-            }
-          } catch {} // 解析失败则原样发送
+        // 剥离 session.list / session.history 的 contextHeaders 投影（无 UI 读取的大字段）
+        // 传入 content-encoding 以便 stripSessionProjections 先 gunzip 再解析
+        if (res.statusCode === 200) {
+          const { body, stripped } = stripSessionProjections(path, bodyBuf, res.headers['content-encoding']);
+          if (stripped) {
+            bodyBuf = body;
+            // 已修改 body，清除原始压缩编码标记，让下方 gzip 逻辑重新压缩
+            delete respHeaders['content-encoding'];
+            respHeaders['content-length'] = String(bodyBuf.length);
+          }
         }
 
         // 大响应 gzip 压缩：异步执行，避免 gzipSync 卡住整个事件循环
         const respCt = String(res.headers['content-type'] ?? '').toLowerCase();
-        const alreadyEncoded = String(res.headers['content-encoding'] ?? '').toLowerCase();
+        // 注意：alreadyEncoded 从 respHeaders 读取（而非 res.headers），
+        // 因为上面的剥离逻辑可能已经删除了 respHeaders['content-encoding']
+        const alreadyEncoded = String(respHeaders['content-encoding'] ?? res.headers['content-encoding'] ?? '').toLowerCase();
         const compressible = COMPRESSIBLE_TYPES.some((t) => respCt.startsWith(t));
         if (bodyBuf.length > GZIP_THRESHOLD && compressible && !alreadyEncoded) {
           gzipAsync(bodyBuf).then((zipped) => {
@@ -337,9 +348,15 @@ export class CustomTunnelClient {
     let headerBuf = '';
     let upgraded = false;
 
+    // WebSocket 帧解析缓冲区 — 拦截 Ping (0x9) 自动回复 Pong (0xA)。
+    // DSH API Gateway 的 /api/remote.mux WebSocket 每 2s 发 Ping，连续 2 次没收到
+    // Pong 就 terminate。隧道用裸 TCP 转发，Pong 往返延迟可能超时，本地直接回复最可靠。
+    let wsFrameBuf = Buffer.alloc(0);
+
     sock.on('data', (chunk) => {
       if (upgraded) {
-        this._sendMessage({ type: 'ws-frame', wsId, data: chunk.toString('base64') });
+        wsFrameBuf = Buffer.concat([wsFrameBuf, chunk]);
+        wsFrameBuf = this._processWsFrames(wsId, wsFrameBuf, sock);
         return;
       }
       headerBuf += chunk.toString('binary');
@@ -347,6 +364,7 @@ export class CustomTunnelClient {
       if (sep === -1) return;
 
       upgraded = true;
+      const statusLine = headerBuf.slice(0, headerBuf.indexOf('\r\n'));
       const replyHeaders = {};
       const headerLines = headerBuf.slice(0, sep).split('\r\n');
       for (let i = 1; i < headerLines.length; i++) {
@@ -356,7 +374,20 @@ export class CustomTunnelClient {
             headerLines[i].slice(ci + 1).trim();
         }
       }
-      this._sendMessage({ type: 'ws-accept', wsId, replyHeaders });
+
+      // 解析状态码，传递给服务端以便正确转发（非 101 时浏览器能看到真实错误）
+      const statusMatch = /^HTTP\/1\.\d\s+(\d+)\s*(.*)/.exec(statusLine);
+      const statusCode = statusMatch ? parseInt(statusMatch[1], 10) : 101;
+      const statusMessage = statusMatch ? statusMatch[2] : '';
+
+      if (statusCode === 101) {
+        this._sendMessage({ type: 'ws-accept', wsId, statusCode, replyHeaders });
+      } else {
+        // 非 101 响应：转发状态码和头，让浏览器看到真实错误（如 401）
+        this._sendMessage({ type: 'ws-accept', wsId, statusCode, statusMessage, replyHeaders });
+        sock.destroy();
+        return;
+      }
 
       // 握手后紧跟的帧数据
       const rest = headerBuf.slice(sep + 4);
@@ -376,6 +407,70 @@ export class CustomTunnelClient {
     });
   }
 
+  // ── WebSocket 帧解析 ─────────────────────────────────────────────────────
+  // 在裸 TCP 层面解析 WebSocket 帧，拦截 Ping (0x9) 自动回复 Pong (0xA)，
+  // 其余帧原样转发。DSH API Gateway 每 2s 发 Ping，2 次没 Pong 就 terminate。
+  _processWsFrames(wsId, buf, sock) {
+    while (buf.length >= 2) {
+      const b0 = buf[0];
+      const b1 = buf[1];
+      const opcode = b0 & 0x0f;
+      const masked = b1 & 0x80;
+      let payloadLen = b1 & 0x7f;
+      let offset = 2;
+
+      if (payloadLen === 126) {
+        if (buf.length < 4) break;
+        payloadLen = buf.readUInt16BE(2);
+        offset = 4;
+      } else if (payloadLen === 127) {
+        if (buf.length < 10) break;
+        payloadLen = Number(buf.readBigUInt64BE(2));
+        offset = 10;
+      }
+      if (masked) offset += 4;
+      if (buf.length < offset + payloadLen) break;
+
+      const frameEnd = offset + payloadLen;
+      const frameBytes = buf.subarray(0, frameEnd);
+
+      if (opcode === 0x9) {
+        // Ping → 自动回复 Pong（同 payload，必须 mask，因为这是 client→server 方向）
+        // WebSocket 协议规定客户端→服务端的帧必须加 mask，否则服务端 ws 库会判定
+        // 协议错误（1002）并关闭连接。
+        const payload = buf.subarray(offset, frameEnd);
+        const mask = cryptoRandomBytes(4);
+        const maskedPayload = Buffer.alloc(payload.length);
+        for (let i = 0; i < payload.length; i++) {
+          maskedPayload[i] = payload[i] ^ mask[i % 4];
+        }
+        if (payload.length < 126) {
+          const hdr = Buffer.alloc(6);
+          hdr[0] = 0x8a; // fin + opcode 0xA (pong)
+          hdr[1] = 0x80 | payload.length; // masked + length
+          mask.copy(hdr, 2);
+          sock.write(Buffer.concat([hdr, maskedPayload]));
+        } else if (payload.length < 65536) {
+          const hdr = Buffer.alloc(8);
+          hdr[0] = 0x8a; hdr[1] = 0x80 | 126;
+          hdr.writeUInt16BE(payload.length, 2);
+          mask.copy(hdr, 4);
+          sock.write(Buffer.concat([hdr, maskedPayload]));
+        } else {
+          const hdr = Buffer.alloc(14);
+          hdr[0] = 0x8a; hdr[1] = 0x80 | 127;
+          hdr.writeBigUInt64BE(BigInt(payload.length), 2);
+          mask.copy(hdr, 10);
+          sock.write(Buffer.concat([hdr, maskedPayload]));
+        }
+      } else {
+        this._sendMessage({ type: 'ws-frame', wsId, data: frameBytes.toString('base64') });
+      }
+      buf = buf.subarray(frameEnd);
+    }
+    return buf;
+  }
+
   _handleWsFrame(msg) {
     const sock = this.localWsSockets.get(msg.wsId);
     if (sock && !sock.destroyed) sock.write(Buffer.from(msg.data, 'base64'));

package/lib/wechat/gateway.js

@@ -84,17 +84,19 @@ function baseInfo() {
 }
 
 /** 带超时与 abort 的 POST JSON。非 2xx 抛出带 HTTP 状态的错误。 */
-async function postJson({ baseUrl = ILINK_BASE_URL, endpoint, payload, token, timeoutMs = API_TIMEOUT_MS }) {
+async function postJson({ baseUrl = ILINK_BASE_URL, endpoint, payload, token, timeoutMs = API_TIMEOUT_MS, signal: externalSignal }) {
   const body = JSON.stringify({ ...payload, base_info: baseInfo() })
   const url = `${baseUrl.replace(/\/+$/, '')}/${endpoint}`
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), timeoutMs)
+  // 外部 signal（如轮询停止）与超时合并：任一触发即中止请求
+  const signal = externalSignal ? AbortSignal.any([externalSignal, controller.signal]) : controller.signal
   try {
     const response = await fetch(url, {
       method: 'POST',
       headers: requestHeaders(token, body),
       body,
-      signal: controller.signal,
+      signal,
     })
     const raw = await response.text()
     if (!response.ok) {
@@ -136,7 +138,7 @@ async function getJson({ baseUrl = ILINK_BASE_URL, endpoint, timeoutMs = QR_TIME
 }
 
 /** 长轮询收消息；超时返回空批次（不算错误）。 */
-async function getUpdates({ baseUrl, token, syncBuf, timeoutMs = LONG_POLL_TIMEOUT_MS }) {
+async function getUpdates({ baseUrl, token, syncBuf, timeoutMs = LONG_POLL_TIMEOUT_MS, signal } = {}) {
   try {
     const raw = await postJson({
       baseUrl,
@@ -144,6 +146,7 @@ async function getUpdates({ baseUrl, token, syncBuf, timeoutMs = LONG_POLL_TIMEO
       payload: { get_updates_buf: syncBuf },
       token,
       timeoutMs,
+      signal,
     })
     return {
       messages: Array.isArray(raw.msgs) ? raw.msgs : [],
@@ -315,6 +318,8 @@ export class WechatGateway extends Service {
     this.syncBuf = ''
     this.pollTask = null
     this.stopPollingLocal = false
+    // 当前轮询循环的中止信号：stop/restart 时 abort 以立即中断 in-flight 长轮询
+    this._pollAbort = null
     this.statusValue = 'idle'
     this.contextTokens = new Map()
     try {
@@ -388,6 +393,7 @@ export class WechatGateway extends Service {
 
   async stop() {
     this.stopPollingLocal = true
+    this._pollAbort?.abort()
     const task = this.pollTask
     this.pollTask = null
     if (task) {
@@ -770,6 +776,8 @@ export class WechatGateway extends Service {
     if (this._restartingPromise) return this._restartingPromise
     this._restartingPromise = (async () => {
       this.stopPollingLocal = true
+      // 立即中断旧循环的 in-flight 长轮询，避免等待最长 35s 才切换
+      this._pollAbort?.abort()
       const previous = this.pollTask
       this.pollTask = null
       if (previous) {
@@ -799,6 +807,9 @@ export class WechatGateway extends Service {
   }
 
   async runPollLoop() {
+    // 每次轮询循环持有一个独立 abort：stop/restart 时中断 in-flight getUpdates（最长 35s）
+    const pollAbort = new AbortController()
+    this._pollAbort = pollAbort
     let consecutiveFailures = 0
     let timeoutMs = this.c.longPollTimeoutMs
     let fatal = false
@@ -809,6 +820,7 @@ export class WechatGateway extends Service {
           token: this.c.token,
           syncBuf: this.syncBuf,
           timeoutMs,
+          signal: pollAbort.signal,
         })
         if (this.stopPollingLocal) break
 
@@ -874,7 +886,8 @@ export class WechatGateway extends Service {
         await sleep(backoff)
       }
     }
-    // 致命错误保持终态；普通停止回到 idle
+    // 清理当前轮询 abort（避免悬挂引用）；致命错误保持终态，普通停止回到 idle
+    if (this._pollAbort === pollAbort) this._pollAbort = null
     if (!fatal) this.setStatus('idle')
   }
 

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.10.2",
+  "version": "2.10.4",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
-  "releaseNotes": "【v2.10.2】\n• 🆕 外部已部署隧道登记（issue #25）：自行部署 cloudflared（Docker 等）可在面板登记公网地址，展示二维码与入口，插件不再重复下载管理\n• 🐞 修复会话列表/历史加载问题：自建隧道下 session.list 502 修复 + 会话历史载入提速（社区 PR #27）",
+  "releaseNotes": "【v2.10.4】\n• 修复：全新安装（未设置任何密码）时远程访问被误锁，需输入『管理密码』（任意输入皆可通过）才可进入——现无密码时远程免锁直进，并明确提示先设置访问密码\n• 修复：Telegram 代理在 Node ≥ 24 下不生效（createConnection 构造参数被忽略，改为构造后赋值）\n• 修复：移动端点击 workspace 分组名误关抽屉、自建隧道 gzip 会话剥离失效、目录弹窗深色模式适配\n• 新功能：自建隧道 SSE 流式传输 + WebSocket Ping/Pong 保活；远程/移动端禁用下拉刷新防误触",
   "type": "module",
   "main": "lib/index.js",
   "exports": {