@wenbin_wb/dsh-bridge 2.4.0 → 2.5.1

package/lib/index.js

@@ -12,7 +12,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { readFileSync } from 'node:fs';
 import { readFile, writeFile, mkdir, unlink } from 'node:fs/promises';
-import { exec } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import QRCode from 'qrcode';
 import { installBridgeRpc } from './bridge-rpc.js';
 import { CustomTunnelClient } from './tunnel-client.mjs';
@@ -22,6 +22,8 @@ import { WechatService } from './wechat/index.js';
 import { QqService } from './qq/index.js';
 import { FeishuService } from './feishu/index.js';
 import { TelegramService } from './telegram/index.js';
+import { AuthManager } from './auth/manager.js';
+import { renderLoginPage } from './auth/login-template.js';
 
 const name = 'dsh-bridge';
 // 微信 Bot 会话桥依赖 DSH 提供的会话/agent/审批/工作区/持久化服务，需显式 inject
@@ -127,14 +129,15 @@ function loopbackHeaders(headers, targetPort) {
 }
 
 /**
- * HTTP + WebSocket 代理服务器
+ * HTTP + WebSocket 代理服务器（带安全认证守门）
  * 关键：改写 Host + Origin，注入 crypto.randomUUID polyfill
- * 否则手机通过局域网访问时 DSH 会把它当未登录的外部请求处理
+ * 并在未授权时拦截并展示 DSH 风格登录页，阻止未授权 WebSocket 与 API 调用
  */
 class ProxyServer {
-  constructor({ localPort, targetPort, logger }) {
+  constructor({ localPort, targetPort, authManager, logger }) {
     this.localPort = localPort;
     this.targetPort = targetPort;
+    this.authManager = authManager;
     this.logger = logger;
     this.server = null;
     this.clientSockets = new Set();
@@ -145,6 +148,101 @@ class ProxyServer {
     if (this.server) return;
 
     this.server = createServer((req, res) => {
+      // 1. 处理登录 API: POST /__dsh_bridge__/login
+      if (req.url === '/__dsh_bridge__/login' && req.method === 'POST') {
+        const chunks = [];
+        req.on('data', (c) => chunks.push(c));
+        req.on('end', () => {
+          try {
+            const body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+            const clientIp = req.socket?.remoteAddress || '';
+            const verify = this.authManager?.verifyPassword(body.password, clientIp);
+            if (verify?.success) {
+              const sessionToken = this.authManager.createSession();
+              res.writeHead(200, {
+                'Content-Type': 'application/json; charset=utf-8',
+                'Set-Cookie': `dsh_bridge_auth=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`,
+              });
+              res.end(JSON.stringify({ ok: true }));
+            } else {
+              res.writeHead(401, { 'Content-Type': 'application/json; charset=utf-8' });
+              res.end(JSON.stringify({ ok: false, error: verify?.error || '访问密码错误' }));
+            }
+          } catch (e) {
+            res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8' });
+            res.end(JSON.stringify({ ok: false, error: '无效请求' }));
+          }
+        });
+        return;
+      }
+
+      // 2. 处理登出 API: POST /__dsh_bridge__/logout
+      if (req.url === '/__dsh_bridge__/logout' && req.method === 'POST') {
+        res.writeHead(200, {
+          'Content-Type': 'application/json; charset=utf-8',
+          'Set-Cookie': 'dsh_bridge_auth=; Path=/; HttpOnly; Max-Age=0',
+        });
+        res.end(JSON.stringify({ ok: true }));
+        return;
+      }
+
+      // 3. 处理鉴权状态 API: GET /__dsh_bridge__/auth-status (严格脱敏，不暴露 secretToken)
+      if (req.url === '/__dsh_bridge__/auth-status' && req.method === 'GET') {
+        res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+        res.end(JSON.stringify(this.authManager?.getPublicStatus() ?? { enabled: false }));
+        return;
+      }
+
+      // 4. 核心鉴权拦截
+      const auth = this.authManager?.verifyRequest(req) ?? { authenticated: true };
+
+      // 4.1 若从 URL Token 认证通过：下发 Cookie 并 302 重定向到干净 URL (去掉 ?auth=)
+      if (auth.fromToken) {
+        const sessionToken = this.authManager.createSession();
+        try {
+          const urlObj = new URL(req.url, 'http://localhost');
+          urlObj.searchParams.delete('auth');
+          urlObj.searchParams.delete('token');
+          const cleanPath = (urlObj.pathname || '/') + (urlObj.search || '');
+          res.writeHead(302, {
+            'Location': cleanPath,
+            'Set-Cookie': `dsh_bridge_auth=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`,
+          });
+          res.end();
+          return;
+        } catch {
+          res.writeHead(302, {
+            'Location': '/',
+            'Set-Cookie': `dsh_bridge_auth=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`,
+          });
+          res.end();
+          return;
+        }
+      }
+
+      // 4.2 若未通过认证：根据请求类型渲染 DSH 登录页或返回 401 JSON
+      if (!auth.authenticated) {
+        const accept = String(req.headers['accept'] || '');
+        const isHtml = accept.includes('text/html') || (!req.url.startsWith('/api/') && !req.url.includes('.'));
+        if (isHtml) {
+          const clientIp = req.socket?.remoteAddress || '';
+          const isLocked = this.authManager?.isIpBlocked(clientIp);
+          const html = renderLoginPage({
+            hasPassword: this.authManager?.hasPassword,
+            locked: isLocked,
+            error: isLocked ? '尝试次数过多，请 60 秒后再试' : '',
+          });
+          res.writeHead(401, { 'Content-Type': 'text/html; charset=utf-8' });
+          res.end(html);
+          return;
+        } else {
+          res.writeHead(401, { 'Content-Type': 'application/json; charset=utf-8' });
+          res.end(JSON.stringify({ error: 'unauthorized', message: '需要访问认证，请先登录' }));
+          return;
+        }
+      }
+
+      // 5. 认证通过：正常执行反向代理转发
       const headers = loopbackHeaders(req.headers, this.targetPort);
       const proxyReq = httpRequest(
         { host: '127.0.0.1', port: this.targetPort, method: req.method, path: req.url, headers, agent: false },
@@ -185,8 +283,15 @@ class ProxyServer {
       req.pipe(proxyReq);
     });
 
-    // WebSocket upgrade（DSH 的 /api/events.mux 等流式通道）
+    // WebSocket upgrade 鉴权与代理
     this.server.on('upgrade', (req, socket, head) => {
+      const auth = this.authManager?.verifyRequest(req) ?? { authenticated: true };
+      if (!auth.authenticated) {
+        socket.write('HTTP/1.1 401 Unauthorized\r\nContent-Type: text/plain\r\n\r\nUnauthorized\r\n');
+        socket.destroy();
+        return;
+      }
+
       const headers = loopbackHeaders(req.headers, this.targetPort);
       const proxyReq = httpRequest({
         host: '127.0.0.1', port: this.targetPort, method: req.method, path: req.url, headers, agent: false,
@@ -259,11 +364,12 @@ class ProxyServer {
  * Bridge Service
  */
 class BridgeService {
-  constructor({ dshPort, proxyPort, home, customTunnelConfig, logger }) {
+  constructor({ dshPort, proxyPort, home, customTunnelConfig, authManager, logger }) {
     this.dshPort = dshPort;
     this.proxyPort = proxyPort;
     this.home = home;
     this.customTunnelConfig = customTunnelConfig ?? null;
+    this.authManager = authManager ?? null;
     this.logger = logger;
 
     this.qrCache = new QrCache();
@@ -282,6 +388,7 @@ class BridgeService {
     this.proxy = new ProxyServer({
       localPort: this.proxyPort,
       targetPort: this.dshPort,
+      authManager: this.authManager,
       logger: this.logger,
     });
 
@@ -289,13 +396,40 @@ class BridgeService {
     return this.proxy;
   }
 
-  async getStatus() {
+  async getStatus({ adminAuthValid = false } = {}) {
     const lanIp = selectLanIPv4();
-    const lanUrl = lanIp ? `http://${lanIp}:${this.proxyPort}` : null;
+    const token = adminAuthValid ? this.authManager?.secretToken : null;
+    const isAuthEnabled = Boolean(this.authManager?.enabled && this.authManager?.mode !== 'password_only' && token);
+
+    const isLanProtected = isAuthEnabled && this.authManager?.scope !== 'public_only';
+    const isPublicProtected = isAuthEnabled && this.authManager?.scope !== 'lan_only';
+
+    const appendToken = (url, shouldAppend) => {
+      if (!url || !shouldAppend || !token) return url;
+      try {
+        const u = new URL(url);
+        u.searchParams.set('auth', token);
+        return u.toString();
+      } catch {
+        const sep = url.includes('?') ? '&' : '?';
+        return `${url}${sep}auth=${encodeURIComponent(token)}`;
+      }
+    };
+
+    const baseLanUrl = lanIp ? `http://${lanIp}:${this.proxyPort}` : null;
+    const lanUrl = appendToken(baseLanUrl, isLanProtected);
+
+    const baseCloudflaredUrl = this.cloudflared?.url || null;
+    const cloudflaredUrl = appendToken(baseCloudflaredUrl, isPublicProtected);
+
+    const baseCustomUrl = this.customTunnel?.publicUrl || null;
+    const customUrl = appendToken(baseCustomUrl, isPublicProtected);
 
     return {
       version: VERSION,
 
+      auth: this.authManager?.getStatus({ masked: !adminAuthValid }) ?? { enabled: false },
+
       proxy: {
         running: !!this.proxy,
         port: this.proxyPort,
@@ -305,14 +439,16 @@ class BridgeService {
       lan: {
         ip: lanIp,
         url: lanUrl,
+        rawUrl: baseLanUrl,
         qr: lanUrl ? await this.qrCache.get(lanUrl) : null,
       },
 
       cloudflared: {
         running: !!this.cloudflared,
-        url: this.cloudflared?.url || null,
-        qr: this.cloudflared?.url
-          ? await this.qrCache.get(this.cloudflared.url)
+        url: cloudflaredUrl,
+        rawUrl: baseCloudflaredUrl,
+        qr: cloudflaredUrl
+          ? await this.qrCache.get(cloudflaredUrl)
           : null,
         state: this.cloudflaredState,
       },
@@ -321,9 +457,10 @@ class BridgeService {
         configured: !!(this.customTunnelConfig?.serverUrl && this.customTunnelConfig?.accessToken),
         serverUrl: this.customTunnelConfig?.serverUrl ?? '',
         running: !!this.customTunnel?.connected,
-        url: this.customTunnel?.publicUrl || null,
-        qr: this.customTunnel?.publicUrl
-          ? await this.qrCache.get(this.customTunnel.publicUrl)
+        url: customUrl,
+        rawUrl: baseCustomUrl,
+        qr: customUrl
+          ? await this.qrCache.get(customUrl)
           : null,
         state: this.customTunnelState,
       },
@@ -349,6 +486,7 @@ class BridgeService {
       serverUrl,
       accessToken,
       localPort: this.proxyPort,
+      internalTunnelSecret: this.authManager?.internalTunnelSecret,
       onStateChange: (state) => {
         this.customTunnelState = state;
       },
@@ -438,29 +576,57 @@ class BridgeService {
     }
   }
 
-  // 一键直接升级插件（执行 dsh plugin / pnpm / npm 自动升级）
+  // 一键直接升级插件（执行 dsh / npx / npm 自动升级，使用安全的参数数组彻底杜绝 shell 注入）
   async upgradePlugin({ version } = {}) {
     const targetVersion = version ? String(version).trim() : 'latest';
+    // 严格 SemVer 白名单正则校验
+    if (!/^(latest|\d+\.\d+\.\d+(-[a-zA-Z0-9.]+)?)$/.test(targetVersion)) {
+      return { ok: false, error: `非法的版本号格式: ${targetVersion}`, version: targetVersion };
+    }
     const pkgSpec = `@wenbin_wb/dsh-bridge@${targetVersion}`;
-    const commands = [
-      `dsh plugin --profile web add ${pkgSpec}`,
-      `npx --yes @deepseek-ai/dsh plugin --profile web add ${pkgSpec}`,
-      `npm install ${pkgSpec}`,
+    const isWin = process.platform === 'win32';
+
+    const tasks = [
+      { cmd: isWin ? 'dsh.cmd' : 'dsh', fallbackCmd: 'dsh', args: ['plugin', '--profile', 'web', 'add', pkgSpec] },
+      { cmd: isWin ? 'npx.cmd' : 'npx', fallbackCmd: 'npx', args: ['--yes', '@deepseek-ai/dsh', 'plugin', '--profile', 'web', 'add', pkgSpec] },
+      { cmd: isWin ? 'npm.cmd' : 'npm', fallbackCmd: 'npm', args: ['install', pkgSpec] },
     ];
 
     let lastError = null;
-    let output = '';
 
-    for (const cmd of commands) {
+    for (const task of tasks) {
       try {
         const res = await new Promise((resolve, reject) => {
-          exec(cmd, { timeout: 90000, windowsHide: true }, (err, stdout, stderr) => {
-            if (err) return reject(new Error(stderr || err.message));
-            resolve({ stdout, stderr });
-          });
+          const runExecutable = (executable) => {
+            const cp = spawn(executable, task.args, {
+              windowsHide: true,
+              shell: false,
+              timeout: 90000,
+            });
+            let stdout = '';
+            let stderr = '';
+            cp.stdout?.on('data', (d) => { stdout += d.toString(); });
+            cp.stderr?.on('data', (d) => { stderr += d.toString(); });
+            cp.on('error', (err) => {
+              if (executable !== task.fallbackCmd) {
+                runExecutable(task.fallbackCmd);
+              } else {
+                reject(err);
+              }
+            });
+            cp.on('close', (code) => {
+              if (code === 0) {
+                resolve({ stdout, stderr });
+              } else {
+                reject(new Error(stderr || stdout || `进程退出码 ${code}`));
+              }
+            });
+          };
+          runExecutable(task.cmd);
         });
-        output = res.stdout || res.stderr || '升级成功';
-        return { ok: true, command: cmd, output, version: targetVersion };
+
+        const output = res.stdout || res.stderr || '升级成功';
+        return { ok: true, command: `${task.cmd} ${task.args.join(' ')}`, output, version: targetVersion };
       } catch (err) {
         lastError = err;
       }
@@ -495,6 +661,10 @@ function apply(ctx, config = {}) {
   const proxyPort = config.port ?? 3082;
   const dshHome = process.env.DSH_HOME ?? join(homedir(), '.dsh');
   const configFile = join(dshHome, 'dsh-bridge', 'config.json');
+  const emergencyResetFile = join(dshHome, 'dsh-bridge', 'reset-auth');
+
+  // 配置写入互斥锁队列，杜绝多平台并发写入造成文件覆盖损坏
+  let configWriteQueue = Promise.resolve();
 
   // 从 JSON 文件读取持久化配置
   async function loadConfig() {
@@ -506,17 +676,71 @@ function apply(ctx, config = {}) {
     }
   }
 
-  // 持久化配置到 JSON 文件
+  // 持久化配置到 JSON 文件（排队原子写入）
   async function saveConfig(data) {
-    await mkdir(join(dshHome, 'dsh-bridge'), { recursive: true });
-    await writeFile(configFile, JSON.stringify(data, null, 2), 'utf8');
+    configWriteQueue = configWriteQueue.then(async () => {
+      await mkdir(join(dshHome, 'dsh-bridge'), { recursive: true });
+      await writeFile(configFile, JSON.stringify(data, null, 2), 'utf8');
+    }).catch((err) => {
+      logger.error('saveConfig failed: %s', err.message);
+    });
+    return configWriteQueue;
   }
 
+  // 访问安全认证管理器
+  const authManager = new AuthManager({
+    config: config.auth ?? {},
+    logger,
+    onPersist: async (patch) => {
+      const stored = await loadConfig();
+      stored.auth = { ...(stored.auth ?? {}), ...patch };
+      await saveConfig(stored);
+    },
+  });
+
+  // 保命救急检查：检测到 reset-auth 文件时自动重置全量密码与安全策略
+  async function checkEmergencyReset() {
+    try {
+      await unlink(emergencyResetFile);
+      authManager.enabled = false;
+      authManager.passwordHash = '';
+      authManager.passwordSalt = '';
+      authManager.adminPasswordHash = '';
+      authManager.adminPasswordSalt = '';
+      authManager.adminPolicy = 'password_unlock';
+      authManager.mode = 'token_and_password';
+      authManager.sessions.clear();
+      authManager.adminSessions.clear();
+      const stored = await loadConfig();
+      delete stored.auth;
+      await saveConfig(stored);
+      logger.warn('dsh-bridge: [保命救急] 检测到 reset-auth 标记文件，已成功重置所有访问密码与安全策略！');
+    } catch {}
+  }
+
+  // 启动时读取已保存的 auth 配置并执行保命标记检查
+  checkEmergencyReset().then(() => loadConfig()).then((stored) => {
+    if (stored?.auth) {
+      if (stored.auth.enabled != null) authManager.enabled = Boolean(stored.auth.enabled);
+      if (stored.auth.mode) authManager.mode = stored.auth.mode;
+      if (stored.auth.scope) authManager.scope = stored.auth.scope;
+      if (stored.auth.adminPolicy) authManager.adminPolicy = stored.auth.adminPolicy;
+      if (stored.auth.passwordHash) authManager.passwordHash = stored.auth.passwordHash;
+      if (stored.auth.passwordSalt) authManager.passwordSalt = stored.auth.passwordSalt;
+      if (stored.auth.adminPasswordHash) authManager.adminPasswordHash = stored.auth.adminPasswordHash;
+      if (stored.auth.adminPasswordSalt) authManager.adminPasswordSalt = stored.auth.adminPasswordSalt;
+      if (stored.auth.secretToken) authManager.secretToken = stored.auth.secretToken;
+      if (stored.auth.allowLoopback != null) authManager.allowLoopback = Boolean(stored.auth.allowLoopback);
+      logger.info('dsh-bridge: loaded saved auth config (enabled=%s, mode=%s, adminPolicy=%s)', authManager.enabled, authManager.mode, authManager.adminPolicy);
+    }
+  }).catch(() => {});
+
   const service = new BridgeService({
     dshPort,
     proxyPort,
     home: config.home,
     customTunnelConfig: config.customTunnel ?? null,
+    authManager,
     logger,
   });
 
@@ -735,6 +959,7 @@ function apply(ctx, config = {}) {
 
   const disposeRpc = installBridgeRpc(ctx, {
     service,
+    authManager,
     wechat,
     qq,
     feishu,
@@ -761,8 +986,9 @@ function apply(ctx, config = {}) {
     await feishu.destroy();
     await telegram.destroy();
     platformManager.dispose();
+    authManager.dispose();
     await service.dispose();
-  }, 'dsh-bridge: stop wechat, qq, feishu, telegram, proxy and tunnels');
+  }, 'dsh-bridge: stop wechat, qq, feishu, telegram, proxy, auth and tunnels');
 }
 
-export { name, inject, apply };
+export { name, inject, apply, ProxyServer, BridgeService, selectLanIPv4 };

package/lib/qq/node.js

@@ -147,8 +147,8 @@ export class QqConversationNode extends ConversationBridge {
     this._replyMsgId = null // 被动回复用的用户消息 ID（事件 d.id）
 
     // 订阅网关入站事件
-    this.ctx.on('qq/message', (event) => this._handleInbound(event))
-    this.ctx.on('qq/interaction', (event) => this._handleInteraction(event))
+    this.disposers.push(this.ctx.on('qq/message', (event) => this._handleInbound(event)))
+    this.disposers.push(this.ctx.on('qq/interaction', (event) => this._handleInteraction(event)))
   }
 
   // ---- 出站：覆盖 sendText / sendTyping，正确处理 scope 与被动回复 ----
@@ -350,6 +350,13 @@ export class QqConversationNode extends ConversationBridge {
     })
   }
 
+  /** 发送多媒体附件，正确传递 c2c 或 group 范围 */
+  async sendMediaFile(filePath, opts = {}) {
+    const peerInfo = this._currentPeer()
+    if (!peerInfo) return
+    return this.gateway.sendMediaFile(peerInfo.peerId, filePath, { scope: peerInfo.scope, ...opts })
+  }
+
   // ---- 入站 ----
 
   async _handleInbound(event) {

package/lib/telegram/node.js

@@ -68,13 +68,13 @@ export class TelegramConversationNode extends ConversationBridge {
     this._inTurn = false
 
     // 订阅网关入站消息事件
-    this.ctx.on('telegram/message', (event) => this._handleInbound(event))
+    this.disposers.push(this.ctx.on('telegram/message', (event) => this._handleInbound(event)))
 
     // 订阅 Inline 按钮点击交互事件（审批确认）
-    this.ctx.on('telegram/action', (event) => this._handleAction(event))
+    this.disposers.push(this.ctx.on('telegram/action', (event) => this._handleAction(event)))
 
     // 监听轮次事件：turn/start 开启流式打字机，turn/end 最终刷新并重置
-    this.ctx.on('session/event', (session, event) => {
+    this.disposers.push(this.ctx.on('session/event', (session, event) => {
       if (session.id !== this.activeSessionId) return
       if (event.type === 'turn/start') {
         this._inTurn = true
@@ -91,7 +91,7 @@ export class TelegramConversationNode extends ConversationBridge {
         this._streamMsgId = null
         this._streamContent = ''
       }
-    })
+    }))
   }
 
   async _handleInbound(event) {

package/lib/tunnel-client.mjs

@@ -8,10 +8,11 @@ const RECONNECT_DELAY = 5000;
 const MAX_RECONNECT_ATTEMPTS = 5;
 
 export class CustomTunnelClient {
-  constructor({ serverUrl, accessToken, localPort, signal, onStateChange, logger }) {
+  constructor({ serverUrl, accessToken, localPort, internalTunnelSecret, signal, onStateChange, logger }) {
     this.serverUrl = serverUrl;
     this.accessToken = accessToken;
     this.localPort = localPort;
+    this.internalTunnelSecret = internalTunnelSecret;
     this.signal = signal;
     this.onStateChange = onStateChange;
     this.logger = logger;
@@ -126,10 +127,15 @@ export class CustomTunnelClient {
       Object.entries(headers ?? {}).filter(([k]) => !SKIP.has(k.toLowerCase()))
     );
 
+    const reqHeaders = { ...safeHeaders, host: `127.0.0.1:${this.localPort}` };
+    if (this.internalTunnelSecret) {
+      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
+    }
+
     const req = httpRequest({
       host: '127.0.0.1', port: this.localPort,
       method, path: path || '/',
-      headers: { ...safeHeaders, host: `127.0.0.1:${this.localPort}` },
+      headers: reqHeaders,
     }, (res) => {
       const chunks = [];
       res.on('data', c => chunks.push(c));
@@ -168,6 +174,9 @@ export class CustomTunnelClient {
     const reqHeaders = { ...headers, host: `127.0.0.1:${this.localPort}` };
     delete reqHeaders['proxy-connection'];
     delete reqHeaders['proxy-authorization'];
+    if (this.internalTunnelSecret) {
+      reqHeaders['x-dsh-internal-tunnel'] = this.internalTunnelSecret;
+    }
 
     const lines = [`GET ${path || '/'} HTTP/1.1`];
     for (const [k, v] of Object.entries(reqHeaders)) lines.push(`${k}: ${v}`);

package/lib/wechat/media.js

@@ -187,9 +187,15 @@ export async function downloadMedia({
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), timeoutMs)
   try {
-    const response = await fetch(url, { signal: controller.signal })
-    if (!response.ok) throw new Error(`media download HTTP ${response.status}`)
+    const MAX_DOWNLOAD_BYTES = 25 * 1024 * 1024; // 25MB
+    const contentLength = Number(response.headers.get('content-length') || 0);
+    if (contentLength > MAX_DOWNLOAD_BYTES) {
+      throw new Error(`Media file exceeds maximum allowed size (${contentLength} > 25MB)`);
+    }
     const raw = Buffer.from(await response.arrayBuffer())
+    if (raw.length > MAX_DOWNLOAD_BYTES) {
+      throw new Error(`Media file exceeds maximum allowed size (${raw.length} > 25MB)`);
+    }
     if (aesKeyBase64) {
       const key = parseAesKey(aesKeyBase64)
       return aes128EcbDecrypt(raw, key)

package/lib/wechat/node.js

@@ -59,9 +59,9 @@ export class WechatConversationNode extends ConversationBridge {
       onActiveSessionChange,
     })
 
-    this.ctx.on('wechat/message', (message) => {
+    this.disposers.push(this.ctx.on('wechat/message', (message) => {
       void this._handleInbound(message)
-    })
+    }))
   }
 
   // ---- 入站 ----

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
   "type": "module",
   "main": "lib/index.js",
@@ -18,15 +18,11 @@
     "README.md",
     "README.en.md",
     "LICENSE",
-    "docs/banner.jpg",
-    "docs/custom-tunnel.md",
-    "docs/wechat-usage.md",
-    "docs/qq-usage.md",
-    "docs/feishu-usage.md",
-    "docs/telegram-usage.md"
+    "docs"
   ],
   "scripts": {
     "build:client": "node client/build.mjs",
+    "prepack": "npm run build:client",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
@@ -42,7 +38,7 @@
     "@deepseek-ai/cordis": "^4.0.1"
   },
   "engines": {
-    "node": ">=22"
+    "node": "^22.19.0 || >=24.0.0"
   },
   "license": "MIT",
   "keywords": [
@@ -62,7 +58,8 @@
     "bot",
     "wechat",
     "qq",
-    "feishu"
+    "feishu",
+    "telegram"
   ],
   "dsh": {
     "bundle": {