@wenbin_wb/dsh-bridge 2.8.7 → 2.10.0

package/lib/index.js

@@ -26,6 +26,7 @@ import { TelegramService } from './telegram/index.js';
 import { AuthManager } from './auth/manager.js';
 import { renderLoginPage } from './auth/login-template.js';
 import { isSafeWorkspacePath, isSensitiveFolderName } from './security/path-validator.js';
+import { installAbortSignalCompat, BROWSER_ABORT_SIGNAL_POLYFILL } from './compat.js';
 
 const name = 'dsh-bridge';
 // 微信 Bot 会话桥依赖 DSH 提供的会话/agent/审批/工作区/持久化服务，需显式 inject
@@ -182,7 +183,8 @@ const HTML_HEAD_INJECTIONS = `<meta name="viewport" content="width=device-width,
 <link rel="manifest" href="/manifest.webmanifest">
 <link rel="icon" type="image/svg+xml" href="/__dsh_bridge__/pwa-icon.svg">
 <link rel="apple-touch-icon" href="/__dsh_bridge__/pwa-icon.svg">
-<script data-dsh-bridge-polyfill="1">!function(){try{if(self.crypto&&!self.crypto.randomUUID){self.crypto.randomUUID=function(){var b=new Uint8Array(16);self.crypto.getRandomValues(b);b[6]=b[6]&15|64;b[8]=b[8]&63|128;var h="";for(var i=0;i<16;i++){var x=b[i].toString(16);h+=(x.length<2?"0":"")+x;if(i===3||i===5||i===7||i===9)h+="-";}return h;}}}catch(e){}}();</script>`;
+<script data-dsh-bridge-polyfill="1">!function(){try{if(self.crypto&&!self.crypto.randomUUID){self.crypto.randomUUID=function(){var b=new Uint8Array(16);self.crypto.getRandomValues(b);b[6]=b[6]&15|64;b[8]=b[8]&63|128;var h="";for(var i=0;i<16;i++){var x=b[i].toString(16);h+=(x.length<2?"0":"")+x;if(i===3||i===5||i===7||i===9)h+="-";}return h;}}}catch(e){}}();</script>
+${BROWSER_ABORT_SIGNAL_POLYFILL}`;
 const INJECT_MARK = 'data-dsh-bridge-polyfill="1"';
 
 function isCompressed(headers) {
@@ -249,14 +251,15 @@ function loopbackHeaders(headers, targetPort) {
  * 并在未授权时拦截并展示 DSH 风格登录页，阻止未授权 WebSocket 与 API 调用
  */
 class ProxyServer {
-  constructor({ localPort, targetPort, authManager, logger }) {
+  constructor({ localPort, targetPort, authManager, logger, allowedOrigins }) {
     this.localPort = localPort;
     this.targetPort = targetPort;
     this.authManager = authManager;
     this.logger = logger;
+    // 返回 loopback-token 端点允许跨域读取的 Origin 列表（本插件自身生成的面板地址）
+    this.allowedOrigins = allowedOrigins ?? (() => []);
     this.server = null;
     this.clientSockets = new Set();
-    this.activeConnections = 0;
   }
 
   async start() {
@@ -281,11 +284,11 @@ class ProxyServer {
       if (pathname === '/__dsh_bridge__/login' && req.method === 'POST') {
         const chunks = [];
         req.on('data', (c) => chunks.push(c));
-        req.on('end', () => {
+        req.on('end', async () => {
           try {
             const body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
             const clientIp = req.socket?.remoteAddress || '';
-            const verify = this.authManager?.verifyPassword(body.password, clientIp);
+            const verify = await this.authManager?.verifyPassword(body.password, clientIp);
             if (verify?.success) {
               const sessionToken = this.authManager.createSession();
               res.writeHead(200, {
@@ -324,8 +327,21 @@ class ProxyServer {
 
       // 3.1 本机特权 Token 签发：仅限真正物理回环连接（127.0.0.1 / ::1，严禁隧道转发流量伪造）
       if (pathname === '/__dsh_bridge__/loopback-token') {
+        // CORS 收敛（T2.10）：不再使用 *。仅允许本插件自己生成的面板来源（回环/局域网 IP/隧道地址）
+        // 跨域读取响应，防止任意网页在 Firefox/Safari 下借访客浏览器回环领取 adminToken。
+        // 无 Origin 头的请求（curl 等非浏览器客户端）不受影响。
+        let corsOrigin;
+        {
+          const origin = req.headers?.origin;
+          if (origin) {
+            try {
+              const allowed = new Set(this.allowedOrigins());
+              if (allowed.has(origin)) corsOrigin = origin;
+            } catch { /* 来源计算失败则不放开跨域 */ }
+          }
+        }
         const corsHeaders = {
-          'Access-Control-Allow-Origin': '*',
+          ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin, Vary: 'Origin' } : { Vary: 'Origin' }),
           'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
           'Access-Control-Allow-Headers': 'Content-Type',
         };
@@ -355,7 +371,13 @@ class ProxyServer {
       }
 
       // 4. 核心鉴权拦截
-      const auth = this.authManager?.verifyRequest(req) ?? { authenticated: true };
+      // 豁免：authAdminUnlock（管理密码解锁）不要求访问会话——锁屏状态下访问会话可能已失效，
+      // 但用户应能凭管理密码解锁（否则访问会话失效后锁屏永远解不开，死锁）
+      const isAdminUnlockRpc = pathname === '/dsh-bridge/authAdminUnlock'
+        || pathname.endsWith('/dsh-bridge/authAdminUnlock');
+      const auth = isAdminUnlockRpc
+        ? { authenticated: true }
+        : (this.authManager?.verifyRequest(req) ?? { authenticated: true });
 
       // 4.1 若从 URL Token 认证通过：下发 Cookie 并 302 重定向到干净 URL (去掉 ?auth=)
       if (auth.fromToken) {
@@ -513,7 +535,10 @@ class ProxyServer {
     await new Promise((resolve) => this.server.close(() => resolve()));
     this.server = null;
     this.clientSockets.clear();
-    this.activeConnections = 0;
+  }
+
+  get activeConnections() {
+    return this.clientSockets.size;
   }
 
   get port() {
@@ -544,6 +569,62 @@ class BridgeService {
 
     this.cloudflared = null;
     this.cloudflaredState = { phase: 'idle', detail: '' };
+
+    // DSH 宿主版本：惰性探测一次并缓存（进程生命周期内不变，避免频繁 spawn 子进程）
+    this._dshVersion = null;
+    this._dshVersionLoaded = false;
+  }
+
+  /**
+   * 探测 DSH 宿主版本（`dsh --version`，与升级功能同一套增强 PATH 的 spawn 模式）。
+   * 惰性执行 + 结果缓存；失败静默返回 null（不阻塞面板）。
+   * @returns {Promise<string|null>}
+   */
+  async getDshVersion() {
+    if (this._dshVersionLoaded) return this._dshVersion;
+    this._dshVersionLoaded = true; // 只尝试一次，失败也不重试（避免每次 getStatus 都 spawn）
+
+    const isWin = process.platform === 'win32';
+    const nodeDir = dirname(process.execPath);
+    const existingPath = process.env.PATH || process.env.Path || '';
+    const extraPaths = isWin ? [nodeDir] : [nodeDir, '/opt/homebrew/bin', '/opt/homebrew/sbin', '/usr/local/bin', '/usr/bin', '/bin'];
+    const separator = isWin ? ';' : ':';
+    const augmentedEnv = {
+      ...process.env,
+      PATH: [...extraPaths, existingPath].filter(Boolean).join(separator),
+    };
+    if (isWin) augmentedEnv.Path = augmentedEnv.PATH;
+
+    try {
+      const version = await new Promise((resolve, reject) => {
+        let cp;
+        try {
+          // 命令为固定字面量（无用户输入），shell 拼接安全；带 args 的 shell:true 在 Node 24 有弃用警告
+          cp = spawn('dsh --version', {
+            windowsHide: true,
+            shell: true,
+            env: augmentedEnv,
+            timeout: 5000,
+          });
+        } catch (e) {
+          return reject(e);
+        }
+        let stdout = '';
+        let stderr = '';
+        cp.stdout?.on('data', (d) => { stdout += d.toString(); });
+        cp.stderr?.on('data', (d) => { stderr += d.toString(); });
+        cp.on('error', reject);
+        cp.on('close', (code) => {
+          if (code === 0 && stdout.trim()) resolve(stdout.trim());
+          else reject(new Error(stderr || stdout || `退出码 ${code}`));
+        });
+      });
+      this._dshVersion = version;
+    } catch (e) {
+      this.logger?.debug?.('dsh-bridge: 探测 DSH 版本失败: %s', e.message);
+      this._dshVersion = null;
+    }
+    return this._dshVersion;
   }
 
   async setLanIp({ ip } = {}) {
@@ -562,6 +643,17 @@ class BridgeService {
       targetPort: this.dshPort,
       authManager: this.authManager,
       logger: this.logger,
+      // loopback-token 允许跨域的面板来源：回环、当前局域网 IP、隧道公网地址
+      allowedOrigins: () => {
+        const origins = [`http://127.0.0.1:${this.proxyPort}`, `http://localhost:${this.proxyPort}`];
+        try {
+          for (const iface of listAllLanIPv4()) origins.push(`http://${iface.address}:${this.proxyPort}`);
+          if (this.selectedLanIp) origins.push(`http://${this.selectedLanIp}:${this.proxyPort}`);
+          if (this.cloudflared?.url) origins.push(new URL(this.cloudflared.url).origin);
+          if (this.customTunnel?.publicUrl) origins.push(new URL(this.customTunnel.publicUrl).origin);
+        } catch { /* 单项来源解析失败不影响其余 */ }
+        return origins;
+      },
     });
 
     await this.proxy.start();
@@ -601,6 +693,7 @@ class BridgeService {
 
     return {
       version: VERSION,
+      dshVersion: await this.getDshVersion(),
 
       auth: this.authManager?.getStatus({ masked: !adminAuthValid }) ?? { enabled: false },
 
@@ -646,20 +739,19 @@ class BridgeService {
         autoStart: Boolean(this.customTunnelConfig?.autoStart),
       },
 
-      // 轻量摘要，供 UI Tab 状态点使用（完整状态由 wechatGetStatus 提供）
-      wechat: this.wechat ? { status: this.wechat.gateway?.status ?? 'idle' } : null,
-
       // 宿主系统运行监控指标
       system: this.getSystemMetrics(),
     };
   }
 
-  async saveCloudflaredConfig({ token, hostname }) {
-    this.cloudflaredConfig = {
-      ...(this.cloudflaredConfig ?? {}),
-      token: token ? String(token).trim() : '',
-      hostname: hostname ? String(hostname).trim() : '',
-    };
+  async saveCloudflaredConfig({ token, hostname } = {}) {
+    const prev = this.cloudflaredConfig ?? {};
+    const next = { ...prev };
+    // undefined = 客户端未修改不上传；'******' = 非管理员视图的掩码回显。
+    // 两者都保留现值，防止真实 Token 被掩码覆盖；仅显式字符串（含空串=清除）才变更。
+    if (token !== undefined) next.token = token === '******' ? (prev.token ?? '') : String(token).trim();
+    if (hostname !== undefined) next.hostname = String(hostname).trim();
+    this.cloudflaredConfig = next;
     await this.onPersist?.({ cloudflared: this.cloudflaredConfig });
   }
 
@@ -709,7 +801,15 @@ class BridgeService {
       logger: this.logger,
     });
 
-    await this.customTunnel.connect();
+    try {
+      await this.customTunnel.connect();
+    } catch (err) {
+      // 启动失败不留僵尸：断开（阻止其后台重连计时器）并清空引用，用户可立即重试
+      this.customTunnel.disconnect();
+      this.customTunnel = null;
+      this.customTunnelState = { phase: 'error', detail: err.message };
+      throw err;
+    }
   }
 
   async stopCustomTunnel() {
@@ -811,9 +911,10 @@ class BridgeService {
         current: VERSION,
         latest: latestData?.version ?? null,
         releaseNotes: latestData?.releaseNotes ?? null,
+        dshVersion: await this.getDshVersion(),
       };
     } catch (e) {
-      return { current: VERSION, latest: null, error: e.message ?? '检查失败' };
+      return { current: VERSION, latest: null, error: e.message ?? '检查失败', dshVersion: await this.getDshVersion() };
     }
   }
 
@@ -1294,7 +1395,7 @@ class BridgeService {
     // 5. 自建隧道部署服务器连通性检测
     const customServerUrl = this.customTunnelConfig?.serverUrl?.trim();
     if (customServerUrl) {
-      const isRunning = Boolean(this.customTunnelClient?.running);
+      const isRunning = Boolean(this.customTunnel?.connected);
       const ctStart = Date.now();
       try {
         const parsedUrl = new URL(customServerUrl);
@@ -1372,6 +1473,13 @@ function apply(ctx, config = {}) {
   const logger = ctx.logger(name);
   const dshPort = ctx.webServer?.port ?? config.targetPort ?? 3080;
 
+  // 低版本 Node（<20.3）缺少 AbortSignal.any，DSH 核心链路（dsh-timeout ← dsh-llm）
+  // 每次 agent 请求都会调用它——缺失时通过桥接发送消息直接报 "(internal)"。
+  // 插件加载即安装兼容垫片，并在缺失时告警引导升级。
+  if (installAbortSignalCompat()) {
+    logger.warn('dsh-bridge: 当前 Node %s 缺少 AbortSignal.any/timeout，已安装兼容垫片。建议升级 Node 至 22.19+ 或 24+（见 package.json engines）。', process.version);
+  }
+
   if (!dshPort) {
     logger.error('webServer port unavailable');
     return;
@@ -1382,10 +1490,11 @@ function apply(ctx, config = {}) {
   const configFile = join(dshHome, 'dsh-bridge', 'config.json');
   const emergencyResetFile = join(dshHome, 'dsh-bridge', 'reset-auth');
 
-  // 配置写入互斥锁队列，杜绝多平台并发写入造成文件覆盖损坏
-  let configWriteQueue = Promise.resolve();
+  // 配置持久化互斥队列：读-改-写事务整体入队，杜绝多平台并发持久化时
+  // "读到同一份旧配置 → 各自合并 → 后写覆盖先写"的丢失更新问题
+  let configQueue = Promise.resolve();
 
-  // 从 JSON 文件读取持久化配置
+  // 从 JSON 文件读取持久化配置（只读快照；启动恢复等场景使用）
   async function loadConfig() {
     try {
       const raw = await readFile(configFile, 'utf8');
@@ -1395,26 +1504,42 @@ function apply(ctx, config = {}) {
     }
   }
 
-  // 持久化配置到 JSON 文件（排队原子写入）
+  async function writeConfig(data) {
+    await mkdir(join(dshHome, 'dsh-bridge'), { recursive: true });
+    await writeFile(configFile, JSON.stringify(data, null, 2), 'utf8');
+  }
+
+  // 整对象写入（同样入队，避免与进行中的事务交错）
   async function saveConfig(data) {
-    configWriteQueue = configWriteQueue.then(async () => {
-      await mkdir(join(dshHome, 'dsh-bridge'), { recursive: true });
-      await writeFile(configFile, JSON.stringify(data, null, 2), 'utf8');
-    }).catch((err) => {
+    const task = configQueue.then(() => writeConfig(data));
+    configQueue = task.catch((err) => {
       logger.error('saveConfig failed: %s', err.message);
     });
-    return configWriteQueue;
+    return task;
+  }
+
+  // 读-改-写事务：mutate(current) 在队列内执行并返回新配置对象，与其他持久化调用严格串行
+  async function updateConfig(mutate) {
+    const task = configQueue.then(async () => {
+      const current = await loadConfig();
+      const next = (await mutate(current)) ?? current;
+      await writeConfig(next);
+      return next;
+    });
+    configQueue = task.catch((err) => {
+      logger.error('updateConfig failed: %s', err.message);
+    });
+    return task;
   }
 
   // 访问安全认证管理器
   const authManager = new AuthManager({
     config: config.auth ?? {},
     logger,
-    onPersist: async (patch) => {
-      const stored = await loadConfig();
+    onPersist: (patch) => updateConfig((stored) => {
       stored.auth = { ...(stored.auth ?? {}), ...patch };
-      await saveConfig(stored);
-    },
+      return stored;
+    }),
   });
 
   // 保命救急检查：检测到 reset-auth 文件时自动重置全量密码与安全策略
@@ -1430,9 +1555,10 @@ function apply(ctx, config = {}) {
       authManager.mode = 'token_and_password';
       authManager.sessions.clear();
       authManager.adminSessions.clear();
-      const stored = await loadConfig();
-      delete stored.auth;
-      await saveConfig(stored);
+      await updateConfig((stored) => {
+        delete stored.auth;
+        return stored;
+      });
       logger.warn('dsh-bridge: [保命救急] 检测到 reset-auth 标记文件，已成功重置所有访问密码与安全策略！');
     } catch {}
   }
@@ -1444,13 +1570,14 @@ function apply(ctx, config = {}) {
       if (stored.auth.mode) authManager.mode = stored.auth.mode;
       if (stored.auth.scope) authManager.scope = stored.auth.scope;
       if (stored.auth.adminPolicy) authManager.adminPolicy = stored.auth.adminPolicy;
+      if (stored.auth.adminProtection != null) authManager.adminProtection = stored.auth.adminProtection !== false;
       if (stored.auth.passwordHash) authManager.passwordHash = stored.auth.passwordHash;
       if (stored.auth.passwordSalt) authManager.passwordSalt = stored.auth.passwordSalt;
       if (stored.auth.adminPasswordHash) authManager.adminPasswordHash = stored.auth.adminPasswordHash;
       if (stored.auth.adminPasswordSalt) authManager.adminPasswordSalt = stored.auth.adminPasswordSalt;
       if (stored.auth.secretToken) authManager.secretToken = stored.auth.secretToken;
       if (stored.auth.allowLoopback != null) authManager.allowLoopback = Boolean(stored.auth.allowLoopback);
-      logger.info('dsh-bridge: loaded saved auth config (enabled=%s, mode=%s, adminPolicy=%s)', authManager.enabled, authManager.mode, authManager.adminPolicy);
+      logger.info('dsh-bridge: loaded saved auth config (enabled=%s, mode=%s, adminPolicy=%s, adminProtection=%s)', authManager.enabled, authManager.mode, authManager.adminPolicy, authManager.adminProtection);
     }
   }).catch(() => {});
 
@@ -1462,11 +1589,7 @@ function apply(ctx, config = {}) {
     cloudflaredConfig: config.cloudflared ?? null,
     lanConfig: config.lan ?? null,
     authManager,
-    onPersist: async (patch) => {
-      const stored = await loadConfig();
-      Object.assign(stored, patch);
-      await saveConfig(stored);
-    },
+    onPersist: (patch) => updateConfig((stored) => Object.assign(stored, patch)),
     logger,
   });
 
@@ -1502,228 +1625,132 @@ function apply(ctx, config = {}) {
   // 平台管理器：注册/协调所有 IM 平台适配器
   const platformManager = new PlatformManager({ logger });
 
-  // 微信 Bot（ClawBot/iLink）—— 作为 Platform 子类注册进平台管理器
-  const wechat = new WechatService({
-    ctx,
-    logger,
-    config: config.wechat ?? {},
-    onPersist: async (patch) => {
-      const stored = await loadConfig();
-      stored.wechat = { ...(stored.wechat ?? {}), ...patch };
-      await saveConfig(stored);
-    },
-  });
-  platformManager.register(wechat);
-
-  // QQ Bot（OpenAPI v2）—— 作为 Platform 子类注册进平台管理器
-  const qq = new QqService({
-    ctx,
-    logger,
-    config: config.qq ?? {},
-    onPersist: async (patch) => {
-      const stored = await loadConfig();
-      stored.qq = { ...(stored.qq ?? {}), ...patch };
-      await saveConfig(stored);
-    },
-  });
-  platformManager.register(qq);
-
-  // 飞书 Bot（官方 OpenAPI / WebSocket 长连接）—— 作为 Platform 子类注册进平台管理器
-  const feishu = new FeishuService({
-    ctx,
-    logger,
-    config: config.feishu ?? {},
-    onPersist: async (patch) => {
-      const stored = await loadConfig();
-      stored.feishu = { ...(stored.feishu ?? {}), ...patch };
-      await saveConfig(stored);
-    },
-  });
-  platformManager.register(feishu);
-
-  // Telegram Bot（官方 Long Polling + 代理支持）—— 作为 Platform 子类注册进平台管理器
-  const telegram = new TelegramService({
-    ctx,
-    logger,
-    config: config.telegram ?? {},
-    onPersist: async (patch) => {
-      const stored = await loadConfig();
-      stored.telegram = { ...(stored.telegram ?? {}), ...patch };
-      await saveConfig(stored);
-    },
-  });
-  platformManager.register(telegram);
-
-  // 启动时读取已保存的微信 Bot 配置（凭证 + 白名单 + 活动会话）
-  loadConfig().then(async (stored) => {
-    if (stored?.wechat) {
-      const cfg = stored.wechat;
-      wechat.node.config.allowFrom = Array.isArray(cfg.allowFrom) ? cfg.allowFrom : [];
-      if (cfg.digestIntervalSec != null) wechat.node.config.digestIntervalSec = Number(cfg.digestIntervalSec);
-      if (cfg.approvalTimeoutSec != null) wechat.node.config.approvalTimeoutSec = Number(cfg.approvalTimeoutSec);
+  // ---- 平台装配（T3.4：注册 + 统一持久化回调，替代四段逐平台复制的构造块）----
+  // 新增平台只需在此表加一行；持久化、注册、恢复编排与销毁全部自动接入
+  const platformCtors = [
+    ['wechat', WechatService],     // 微信 Bot（ClawBot/iLink）
+    ['qq', QqService],             // QQ Bot（OpenAPI v2）
+    ['feishu', FeishuService],     // 飞书 Bot（官方 OpenAPI / WebSocket 长连接）
+    ['telegram', TelegramService], // Telegram Bot（Long Polling + 代理）
+  ];
+  const platforms = {};
+  for (const [key, Ctor] of platformCtors) {
+    const service = new Ctor({
+      ctx,
+      logger,
+      config: config[key] ?? {},
+      onPersist: (patch) => updateConfig((stored) => {
+        stored[key] = { ...(stored[key] ?? {}), ...patch };
+        return stored;
+      }),
+    });
+    platformManager.register(service);
+    platforms[key] = service;
+  }
+  const { wechat, qq, feishu, telegram } = platforms;
+
+  // ---- 平台配置恢复编排（统一工厂，替代四段逐平台复制的 loadConfig 恢复块）----
+  // 顺序：白名单/数值字段 → 活动会话恢复（_restoringConfig 屏障）→ 凭证注入 → 网关自启
+  function restorePlatform(service, { platformKey, numericFields = [], defaultMaxMessageChars = 2000, hasCredentials, applyCredentials }) {
+    return loadConfig().then(async (stored) => {
+      const cfg = stored?.[platformKey];
+      if (!cfg) return;
+      const node = service.node;
+      node.config.allowFrom = Array.isArray(cfg.allowFrom) ? cfg.allowFrom : [];
+      for (const field of numericFields) {
+        if (cfg[field] != null) node.config[field] = Number(cfg[field]);
+      }
       if (cfg.maxMessageChars != null) {
         const val = Number(cfg.maxMessageChars);
-        wechat.node.config.maxMessageChars = (val >= 200) ? val : 2000;
-      }
-      if (cfg.sendChunkDelayMs != null) wechat.node.config.sendChunkDelayMs = Number(cfg.sendChunkDelayMs);
-
-      wechat.node._restoringConfig = (async () => {
-        try {
-          if (cfg.activeSessionId) {
-            wechat.node.activeSessionId = cfg.activeSessionId;
-            logger.info('dsh-bridge: restored wechat active session: %s', cfg.activeSessionId);
-          } else {
-            await wechat.node._pickDefaultSession().catch(() => {});
-          }
-        } finally {
-          wechat.node._configRestored = true;
-        }
-      })();
-
-      await wechat.node._restoringConfig;
-
-      if (cfg.token && cfg.accountId) {
-        wechat.gateway.setCredentials({
-          token: cfg.token,
-          accountId: cfg.accountId,
-          baseUrl: cfg.baseUrl,
-        });
-        logger.info('dsh-bridge: loaded saved wechat bot config, starting gateway');
-        await wechat.start().catch((err) => {
-          logger.error('dsh-bridge: wechat auto-start failed: %s', err?.message ?? err);
-        });
-      }
-    }
-  }).catch(() => {});
-
-  // 启动时读取已保存的 QQ Bot 配置（凭证 + 白名单 + 活动会话）
-  loadConfig().then(async (stored) => {
-    if (stored?.qq) {
-      const cfg = stored.qq;
-      qq.node.config.allowFrom = Array.isArray(cfg.allowFrom) ? cfg.allowFrom : [];
-
-      qq.node._restoringConfig = (async () => {
-        try {
-          if (cfg.activeSessionId) {
-            qq.node.activeSessionId = cfg.activeSessionId;
-            logger.info('dsh-bridge: restored qq active session: %s', cfg.activeSessionId);
-          } else {
-            await qq.node._pickDefaultSession().catch(() => {});
-          }
-        } finally {
-          qq.node._configRestored = true;
-        }
-      })();
-
-      await qq.node._restoringConfig;
-
-      if (cfg.appId && cfg.clientSecret) {
-        qq.gateway.setCredentials({
-          appId: cfg.appId,
-          clientSecret: cfg.clientSecret,
-          accessToken: cfg.accessToken,
-          accessTokenExpiresAt: cfg.accessTokenExpiresAt,
-          gatewayUrl: cfg.gatewayUrl,
-          accountId: cfg.accountId,
-        });
-        logger.info('dsh-bridge: loaded saved qq bot config, starting gateway');
-        await qq.start().catch((err) => {
-          logger.error('dsh-bridge: qq auto-start failed: %s', err?.message ?? err);
-        });
+        node.config.maxMessageChars = (val >= 200) ? val : defaultMaxMessageChars;
       }
-    }
-  }).catch(() => {});
-
-  // 启动时读取已保存的飞书 Bot 配置（凭证 + 白名单 + 活动会话）
-  loadConfig().then(async (stored) => {
-    if (stored?.feishu) {
-      const cfg = stored.feishu;
-      feishu.node.config.allowFrom = Array.isArray(cfg.allowFrom) ? cfg.allowFrom : [];
+      if (cfg.groupAutoApprove != null) node.config.groupAutoApprove = cfg.groupAutoApprove === true;
 
-      feishu.node._restoringConfig = (async () => {
-        try {
-          if (cfg.activeSessionId) {
-            feishu.node.activeSessionId = cfg.activeSessionId;
-            logger.info('dsh-bridge: restored feishu active session: %s', cfg.activeSessionId);
-          } else {
-            await feishu.node._pickDefaultSession().catch(() => {});
-          }
-        } finally {
-          feishu.node._configRestored = true;
+      node._restoringConfig = (async () => {
+        if (cfg.activeSessionId) {
+          node.activeSessionId = cfg.activeSessionId;
+          logger.info('dsh-bridge: restored %s active session: %s', platformKey, cfg.activeSessionId);
+        } else {
+          await node._pickDefaultSession().catch(() => {});
         }
       })();
 
-      await feishu.node._restoringConfig;
+      await node._restoringConfig;
 
-      if (cfg.appId && cfg.appSecret) {
-        feishu.gateway.updateConfig({
-          appId: cfg.appId,
-          appSecret: cfg.appSecret,
-          domain: cfg.domain || 'feishu',
-        });
-        logger.info('dsh-bridge: loaded saved feishu bot config, starting gateway');
-        await feishu.start().catch((err) => {
-          logger.error('dsh-bridge: feishu auto-start failed: %s', err?.message ?? err);
+      if (hasCredentials(cfg)) {
+        applyCredentials(cfg);
+        logger.info('dsh-bridge: loaded saved %s bot config, starting gateway', platformKey);
+        await service.start().catch((err) => {
+          logger.error('dsh-bridge: %s auto-start failed: %s', platformKey, err?.message ?? err);
         });
       }
-    }
-  }).catch(() => {});
+    }).catch(() => {});
+  }
 
-  // 启动时读取已保存的 Telegram Bot 配置（凭证 + 代理 + 白名单 + 活动会话）
-  loadConfig().then(async (stored) => {
-    if (stored?.telegram) {
-      const cfg = stored.telegram;
-      telegram.node.config.allowFrom = Array.isArray(cfg.allowFrom) ? cfg.allowFrom : [];
-      if (cfg.digestIntervalSec != null) telegram.node.config.digestIntervalSec = Number(cfg.digestIntervalSec);
-      if (cfg.approvalTimeoutSec != null) telegram.node.config.approvalTimeoutSec = Number(cfg.approvalTimeoutSec);
-      if (cfg.maxMessageChars != null) {
-        const val = Number(cfg.maxMessageChars);
-        telegram.node.config.maxMessageChars = (val >= 200) ? val : 4096;
-      }
-      if (cfg.sendChunkDelayMs != null) telegram.node.config.sendChunkDelayMs = Number(cfg.sendChunkDelayMs);
+  restorePlatform(wechat, {
+    platformKey: 'wechat',
+    numericFields: ['digestIntervalSec', 'approvalTimeoutSec', 'sendChunkDelayMs'],
+    hasCredentials: (cfg) => Boolean(cfg.token && cfg.accountId),
+    applyCredentials: (cfg) => wechat.gateway.setCredentials({
+      token: cfg.token,
+      accountId: cfg.accountId,
+      baseUrl: cfg.baseUrl,
+    }),
+  });
 
-      telegram.node._restoringConfig = (async () => {
-        try {
-          if (cfg.activeSessionId) {
-            telegram.node.activeSessionId = cfg.activeSessionId;
-            logger.info('dsh-bridge: restored telegram active session: %s', cfg.activeSessionId);
-          } else {
-            await telegram.node._pickDefaultSession().catch(() => {});
-          }
-        } finally {
-          telegram.node._configRestored = true;
-        }
-      })();
+  restorePlatform(qq, {
+    platformKey: 'qq',
+    hasCredentials: (cfg) => Boolean(cfg.appId && cfg.clientSecret),
+    applyCredentials: (cfg) => qq.gateway.setCredentials({
+      appId: cfg.appId,
+      clientSecret: cfg.clientSecret,
+      accessToken: cfg.accessToken,
+      accessTokenExpiresAt: cfg.accessTokenExpiresAt,
+      gatewayUrl: cfg.gatewayUrl,
+      accountId: cfg.accountId,
+    }),
+  });
 
-      await telegram.node._restoringConfig;
+  restorePlatform(feishu, {
+    platformKey: 'feishu',
+    hasCredentials: (cfg) => Boolean(cfg.appId && cfg.appSecret),
+    applyCredentials: (cfg) => feishu.gateway.updateConfig({
+      appId: cfg.appId,
+      appSecret: cfg.appSecret,
+      domain: cfg.domain || 'feishu',
+    }),
+  });
 
-      if (cfg.botToken) {
-        telegram.gateway.setCredentials({
-          botToken: cfg.botToken,
-          proxy: cfg.proxy || '',
-        });
-        logger.info('dsh-bridge: loaded saved telegram bot config, starting gateway');
-        await telegram.start().catch((err) => {
-          logger.error('dsh-bridge: telegram auto-start failed: %s', err?.message ?? err);
-        });
-      }
-    }
-  }).catch(() => {});
+  restorePlatform(telegram, {
+    platformKey: 'telegram',
+    numericFields: ['digestIntervalSec', 'approvalTimeoutSec', 'sendChunkDelayMs'],
+    defaultMaxMessageChars: 4096,
+    hasCredentials: (cfg) => Boolean(cfg.botToken),
+    applyCredentials: (cfg) => telegram.gateway.setCredentials({
+      botToken: cfg.botToken,
+      proxy: cfg.proxy || '',
+    }),
+  });
 
   const disposeRpc = installBridgeRpc(ctx, {
     service,
     authManager,
-    wechat,
     qq,
     feishu,
     telegram,
     platformManager,
     logger,
     saveCustomTunnelConfig: async (serverUrl, accessToken) => {
-      const stored = await loadConfig();
-      stored.customTunnel = { serverUrl, accessToken };
-      await saveConfig(stored);
-      service.customTunnelConfig = { serverUrl, accessToken };
+      const stored = await updateConfig((current) => {
+        const prev = service.customTunnelConfig ?? {};
+        const next = { ...prev };
+        // 与 saveCloudflaredConfig 同契约：undefined/掩码保留现值，空串清除
+        if (serverUrl !== undefined) next.serverUrl = String(serverUrl).trim();
+        if (accessToken !== undefined) next.accessToken = accessToken === '******' ? (prev.accessToken ?? '') : accessToken;
+        current.customTunnel = next;
+        return current;
+      });
+      service.customTunnelConfig = stored.customTunnel;
     },
     exportBackup: async () => {
       const stored = await loadConfig();
@@ -1746,6 +1773,7 @@ function apply(ctx, config = {}) {
         if (incoming.auth.mode) authManager.mode = incoming.auth.mode;
         if (incoming.auth.scope) authManager.scope = incoming.auth.scope;
         if (incoming.auth.adminPolicy) authManager.adminPolicy = incoming.auth.adminPolicy;
+        if (incoming.auth.adminProtection != null) authManager.adminProtection = incoming.auth.adminProtection !== false;
         if (incoming.auth.passwordHash) authManager.passwordHash = incoming.auth.passwordHash;
         if (incoming.auth.passwordSalt) authManager.passwordSalt = incoming.auth.passwordSalt;
         if (incoming.auth.adminPasswordHash) authManager.adminPasswordHash = incoming.auth.adminPasswordHash;
@@ -1791,10 +1819,9 @@ function apply(ctx, config = {}) {
 
   ctx.effect(() => async () => {
     try { disposeRpc(); } catch {}
-    await wechat.destroy();
-    await qq.destroy();
-    await feishu.destroy();
-    await telegram.destroy();
+    for (const service of Object.values(platforms)) {
+      await service.destroy();
+    }
     platformManager.dispose();
     authManager.dispose();
     await service.dispose();