@wenbin_wb/dsh-bridge 2.8.4 → 2.8.6

package/lib/cloudflared-manager.mjs

@@ -1,7 +1,5 @@
-// DSH Bridge - Cloudflared Manager
-
-import { spawn } from 'node:child_process';
-import { createWriteStream, existsSync, mkdirSync } from 'node:fs';
+import { spawn, execSync } from 'node:child_process';
+import { createWriteStream, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { chmod, stat, unlink, rename } from 'node:fs/promises';
 import { homedir, platform, arch } from 'node:os';
 import { join } from 'node:path';
@@ -73,6 +71,27 @@ async function downloadFile(url, dest, onProgress) {
   });
 }
 
+function findSystemCloudflared() {
+  const isWin = platform() === 'win32';
+  const candidates = [];
+  if (isWin) {
+    candidates.push('cloudflared.exe', 'cloudflared', 'C:\\Program Files (x86)\\cloudflared\\cloudflared.exe', 'C:\\Program Files\\cloudflared\\cloudflared.exe');
+  } else {
+    candidates.push('cloudflared', '/opt/homebrew/bin/cloudflared', '/usr/local/bin/cloudflared', '/usr/bin/cloudflared', '/bin/cloudflared');
+  }
+
+  for (const bin of candidates) {
+    try {
+      if (bin.includes('/') || bin.includes('\\')) {
+        if (!existsSync(bin)) continue;
+      }
+      execSync(`"${bin}" --version`, { stdio: 'ignore', timeout: 3000 });
+      return bin;
+    } catch {}
+  }
+  return null;
+}
+
 export class CloudflaredManager {
   constructor({ port, home, token, hostname, onStateChange, logger }) {
     this.port = port;
@@ -104,19 +123,47 @@ export class CloudflaredManager {
   }
 
   async _ensureBinary() {
+    // 1. 优先使用系统环境变量或 Homebrew / 包管理器已安装的全局二进制
+    const systemBin = findSystemCloudflared();
+    if (systemBin) {
+      this.binaryPath = systemBin;
+      this.logger?.info('优先使用系统全局 cloudflared: %s', systemBin);
+      return;
+    }
+
     const { url, name } = getCloudflaredInfo();
     const binDir = join(this.home, 'bin');
     const binPath = join(binDir, name);
     this.binaryPath = binPath;
 
+    // 2. 检查本地 ~/.dsh-bridge/bin/cloudflared 是否已存在且可用
     if (existsSync(binPath)) {
       try {
         const s = await stat(binPath);
         if (s.size > MIN_BINARY_SIZE) { // >5MB 才视为有效二进制
-          this.logger?.info('cloudflared 已存在: %s', binPath);
-          return;
+          // 检查是否为历史残留未解压的 gzip 压缩包 (0x1f 0x8b)
+          const fd = readFileSync(binPath);
+          const isGzip = fd.length >= 2 && fd[0] === 0x1f && fd[1] === 0x8b;
+          if (isGzip) {
+            this.logger?.warn('检测到历史残留的未解压 cloudflared.tgz 压缩包，正在清理重新准备...');
+            await unlink(binPath).catch(() => {});
+          } else {
+            // macOS / Linux 赋予可执行权限并清除 Gatekeeper 隔离属性
+            if (platform() !== 'win32') {
+              await chmod(binPath, 0o755).catch(() => {});
+              if (platform() === 'darwin') {
+                try { execSync(`xattr -d com.apple.quarantine "${binPath}"`, { stdio: 'ignore' }); } catch {}
+              }
+            }
+            // 执行一次 --version 验证是否能正常 spawn
+            execSync(`"${binPath}" --version`, { stdio: 'ignore', timeout: 3000 });
+            this.logger?.info('cloudflared 已存在且验证通过: %s', binPath);
+            return;
+          }
         }
-      } catch {}
+      } catch (verifyErr) {
+        this.logger?.warn('现有 cloudflared 二进制验证失败 (%s)，准备重新下载', verifyErr.message);
+      }
       // 损坏文件，删掉重下
       await unlink(binPath).catch(() => {});
     }
@@ -135,16 +182,32 @@ export class CloudflaredManager {
         this._setState('downloading', `下载 cloudflared: ${mb}/${totalMb} MB (${percent}%)`);
       });
 
-      if (existsSync(binPath)) await unlink(binPath).catch(() => {});
-      await rename(tempPath, binPath);
+      if (url.endsWith('.tgz') || url.endsWith('.tar.gz')) {
+        try {
+          execSync(`tar -xzf "${tempPath}" -C "${binDir}"`);
+          await unlink(tempPath).catch(() => {});
+        } catch (tarErr) {
+          this.logger?.error('解压 cloudflared 压缩包失败: %s', tarErr.message);
+          throw new Error(`解压 cloudflared 失败: ${tarErr.message}`);
+        }
+      } else {
+        if (existsSync(binPath)) await unlink(binPath).catch(() => {});
+        await rename(tempPath, binPath);
+      }
 
       if (platform() !== 'win32') {
-        await chmod(binPath, 0o755);
+        await chmod(binPath, 0o755).catch(() => {});
+        if (platform() === 'darwin') {
+          try { execSync(`xattr -d com.apple.quarantine "${binPath}"`, { stdio: 'ignore' }); } catch {}
+        }
       }
-      this.logger?.info('cloudflared 下载完成');
+
+      // 执行 --version 最终确认
+      execSync(`"${binPath}" --version`, { stdio: 'ignore', timeout: 3000 });
+      this.logger?.info('cloudflared 下载并准备完成');
     } catch (err) {
       await unlink(tempPath).catch(() => {});
-      throw new Error(`下载失败: ${err.message}`);
+      throw new Error(`准备 cloudflared 失败: ${err.message}`);
     }
   }
 

package/lib/feishu/gateway.js

@@ -205,6 +205,7 @@ export class FeishuGateway extends Service {
   // ---- 消息收发 ----
 
   async _handleMessageReceive(data) {
+    if (this._closing || this.status === 'offline') return
     if (!data?.message) return
     const { message, sender } = data
     const messageId = message.message_id

package/lib/feishu/node.js

@@ -107,6 +107,7 @@ export class FeishuConversationNode extends ConversationBridge {
   }
 
   async _handleInbound(event) {
+    if (this.gateway?._closing || this.gateway?.status === 'offline') return
     const { peerId, senderId, isGroup, text, messageId, messageType, contentObj } = event
     this._lastPeer = { peerId, senderId, isGroup }
 

package/lib/index.js

@@ -10,9 +10,10 @@ import { get as httpsGet } from 'node:https';
 import { networkInterfaces, homedir, totalmem, freemem, cpus, loadavg, platform, arch, release, hostname, uptime } from 'node:os';
 import { join, dirname, basename, resolve, normalize } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import { readFile, writeFile, mkdir, unlink, readdir, stat, access } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
+import { createHash, createHmac } from 'node:crypto';
 import QRCode from 'qrcode';
 import { installBridgeRpc } from './bridge-rpc.js';
 import { CustomTunnelClient } from './tunnel-client.mjs';
@@ -42,23 +43,34 @@ function selectLanIPv4() {
   let best = null;
   let bestScore = -1;
 
+  const VIRTUAL_KEYWORDS = [
+    'vethernet', 'wsl', 'hyper-v', 'virtual', 'vmware', 'vbox', 'docker',
+    'tailscale', 'zerotier', 'tap', 'tun', 'utun', 'wireguard', 'loopback', 'bridge',
+  ];
+
   for (const [ifname, addrs] of Object.entries(interfaces)) {
     if (!addrs) continue;
+    const lower = ifname.toLowerCase();
+    const isVirtual = VIRTUAL_KEYWORDS.some((kw) => lower.includes(kw));
 
     for (const addr of addrs) {
       if (addr.family !== 'IPv4' || addr.internal) continue;
 
       let score = 0;
+      // 1. IP 网段优先（家庭/企业物理局域网最常用网段）
       if (addr.address.startsWith('192.168.')) score += 100;
       else if (addr.address.startsWith('10.')) score += 90;
-      else if (addr.address.match(/^172\.(1[6-9]|2[0-9]|3[0-1])\./)) score += 90;
+      else if (addr.address.match(/^172\.(1[6-9]|2[0-9]|3[0-1])\./)) score += 70;
+      else score += 10;
 
-      const lower = ifname.toLowerCase();
-      if (!lower.includes('virtual')) score += 50;
-      if (!lower.includes('vmware')) score += 50;
-      if (!lower.includes('vbox')) score += 50;
-      if (lower.includes('eth')) score += 20;
-      else if (lower.includes('en')) score += 10;
+      // 2. 物理网卡与名称特征优先
+      if (isVirtual) {
+        score -= 200; // 虚拟网卡大幅降权
+      } else {
+        score += 100;
+        if (lower.includes('wi-fi') || lower.includes('wlan') || lower.includes('wireless')) score += 50;
+        else if (lower.includes('ethernet') || lower.includes('以太网') || lower.includes('eth') || lower.includes('en')) score += 40;
+      }
 
       if (score > bestScore) {
         bestScore = score;
@@ -161,6 +173,37 @@ function isCompressed(headers) {
   return /(^|,\s*)(gzip|br|deflate)(\s*,|$)/i.test(String(headers['content-encoding'] ?? ''));
 }
 
+function encodeBase64Url(value) {
+  return Buffer.from(value).toString('base64url');
+}
+
+/**
+ * 读取 DSH 本地凭证并生成 loopback dsh-auth 认证签名 Cookie (适配 DSH 新版原生认证)
+ */
+function getDshLoopbackCookie(targetPort) {
+  try {
+    const dshHome = process.env.DSH_HOME ?? join(homedir(), '.dsh');
+    const credPath = join(dshHome, '.credentials.yaml');
+    if (!existsSync(credPath)) return '';
+    const content = readFileSync(credPath, 'utf8');
+    const match = content.match(/secret:\s*([A-Za-z0-9_-]+)/);
+    if (!match) return '';
+    const secret = Buffer.from(match[1], 'base64url');
+
+    const authority = `127.0.0.1:${targetPort}`;
+    const name = 'dsh-auth-' + encodeBase64Url(createHash('sha256').update(authority).digest());
+    const issuedAt = Date.now() - 1000;
+    const expiresAt = issuedAt + 30 * 24 * 3600 * 1000;
+    const body = encodeBase64Url(Buffer.from(JSON.stringify({
+      version: 1, authority, issuedAt, expiresAt,
+    }), 'utf8'));
+    const sig = encodeBase64Url(createHmac('sha256', secret).update(body).digest());
+    return `${name}=v1.${body}.${sig}`;
+  } catch {
+    return '';
+  }
+}
+
 /** 把请求头中的 Host 和 Origin 改写成 loopback，让 DSH 的安全栅栏放行 */
 function loopbackHeaders(headers, targetPort) {
   const authority = `127.0.0.1:${targetPort}`;
@@ -168,6 +211,19 @@ function loopbackHeaders(headers, targetPort) {
   out['host'] = authority;
   if (out['origin']) out['origin'] = `http://${authority}`;
   if (out['Origin']) out['Origin'] = `http://${authority}`;
+
+  // 1. 注入 DSH 本地认证签名（若有）
+  const dshCookie = getDshLoopbackCookie(targetPort);
+  if (dshCookie) {
+    const existing = out['cookie'] || out['Cookie'] || '';
+    out['cookie'] = existing ? `${existing}; ${dshCookie}` : dshCookie;
+    delete out['Cookie'];
+  }
+
+  // 2. 禁用内部代理流量压缩，确保代理层拿到未压缩 HTML 以稳定注入 ownsHost 和 Polyfill
+  delete out['accept-encoding'];
+  delete out['Accept-Encoding'];
+
   return out;
 }
 
@@ -1254,7 +1310,7 @@ class BridgeService {
  */
 function apply(ctx, config = {}) {
   const logger = ctx.logger(name);
-  const dshPort = ctx.webServer.port;
+  const dshPort = ctx.webServer?.port ?? config.targetPort ?? 3080;
 
   if (!dshPort) {
     logger.error('webServer port unavailable');