@wu529778790/open-im 1.11.10-beta.3 → 1.11.11-beta.0

package/dist/config-web-auth.d.ts

@@ -9,5 +9,5 @@ export declare function consumeLoginToken(loginToken: string): LoginTokenInfo |
 export declare function createLoginToken(ttlMs: number): string;
 export declare function createSession(request: IncomingMessage, ttlMs: number): string;
 export declare function isSessionValid(request: IncomingMessage): boolean;
-export declare function buildSessionCookie(sessionId: string, ttlMs: number): string;
+export declare function buildSessionCookie(sessionId: string, ttlMs: number, isHttps?: boolean): string;
 export declare function generateLoginUrl(host: string, port: number, loginTtlMs: number): string;

package/dist/config-web-auth.js

@@ -1,4 +1,5 @@
 import { randomBytes } from "node:crypto";
+import { parse, serialize } from "cookie";
 const pendingLogins = new Map();
 const activeSessions = new Map();
 export function getWebConfigHost() {
@@ -58,17 +59,16 @@ function parseCookies(request) {
     const header = request.headers.cookie;
     if (!header)
         return {};
-    const cookies = {};
-    const parts = header.split(";");
-    for (const part of parts) {
-        const [rawKey, ...rest] = part.split("=");
-        const key = rawKey.trim();
-        if (!key)
-            continue;
-        const value = rest.join("=").trim();
-        cookies[key] = decodeURIComponent(value);
+    // 使用成熟的 cookie 库，更安全可靠
+    const cookies = parse(header);
+    // 转换为 Record<string, string>，过滤掉 undefined 值
+    const result = {};
+    for (const [key, value] of Object.entries(cookies)) {
+        if (value !== undefined) {
+            result[key] = value;
+        }
     }
-    return cookies;
+    return result;
 }
 function getSessionIdFromRequest(request) {
     const cookies = parseCookies(request);
@@ -94,17 +94,21 @@ export function isSessionValid(request) {
     }
     return true;
 }
-export function buildSessionCookie(sessionId, ttlMs) {
+export function buildSessionCookie(sessionId, ttlMs, isHttps = false) {
     const maxAgeSec = Math.floor(ttlMs / 1000);
-    const parts = [
-        `openim_session=${encodeURIComponent(sessionId)}`,
-        "Path=/",
-        "HttpOnly",
-        "SameSite=Lax",
-        `Max-Age=${maxAgeSec}`,
-    ];
-    // 不设置 Secure，方便本地 http 使用；如果放在 https 反代后，可以在代理层加 Secure
-    return parts.join("; ");
+    const options = {
+        path: "/",
+        httpOnly: true,
+        sameSite: "lax",
+        maxAge: maxAgeSec,
+    };
+    // 根据请求协议动态设置 Secure 标志
+    // 在生产环境（HTTPS 反代后）应该设置为 true
+    if (isHttps || process.env.NODE_ENV === "production") {
+        options.secure = true;
+    }
+    // 使用成熟的 cookie 库的 serialize 函数
+    return serialize("openim_session", sessionId, options);
 }
 export function generateLoginUrl(host, port, loginTtlMs) {
     const loginToken = createLoginToken(loginTtlMs);

package/dist/config-web.js

@@ -68,7 +68,9 @@ export async function startWebConfigServer(options) {
                     // 有效的一次性登录 token：创建会话，设置 Cookie，并重定向到去掉 login_token 的 URL
                     const sessionTtlMs = 24 * 60 * 60 * 1000; // 24 小时
                     const sessionId = createSession(request, sessionTtlMs);
-                    const cookie = buildSessionCookie(sessionId, sessionTtlMs);
+                    // 检查是否通过 HTTPS 反代访问
+                    const isHttps = request.headers["x-forwarded-proto"] === "https";
+                    const cookie = buildSessionCookie(sessionId, sessionTtlMs, isHttps);
                     requestUrl.searchParams.delete("login_token");
                     const redirectPath = requestUrl.pathname + (requestUrl.search ? requestUrl.search : "");
                     response.writeHead(302, mergeCors(request, {

package/dist/index.js

@@ -370,8 +370,8 @@ export async function main() {
             if (existsSync(portFile))
                 unlinkSync(portFile);
         }
-        catch {
-            /* ignore */
+        catch (err) {
+            log.debug('Failed to remove port file:', err);
         }
         // Stop each platform: abort running tasks, then handle.stop() then module.stop()
         for (const platform of successfulPlatforms) {

package/dist/logger.js

@@ -1,10 +1,13 @@
-import { createWriteStream, mkdirSync, existsSync, readdirSync, statSync, unlinkSync } from 'node:fs';
+import { createWriteStream, mkdirSync, existsSync, readdirSync, statSync, unlinkSync, createReadStream } from 'node:fs';
 import { join } from 'node:path';
 import { finished } from 'node:stream/promises';
+import { pipeline } from 'node:stream';
+import { createGzip } from 'node:zlib';
 import { sanitize } from './sanitize.js';
 import { APP_HOME } from './constants.js';
 const DEFAULT_LOG_DIR = join(APP_HOME, 'logs');
 const MAX_LOG_FILES = 10;
+const MAX_LOG_SIZE = 10 * 1024 * 1024; // 10MB
 const LOG_LEVELS = { DEBUG: 0, INFO: 1, WARN: 2, ERROR: 3 };
 let logDir = DEFAULT_LOG_DIR;
 let minLevel = LOG_LEVELS.DEBUG;
@@ -17,10 +20,6 @@ function getLogFileName() {
     const d = new Date();
     return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}.log`;
 }
-function getEventsFileName() {
-    const d = new Date();
-    return `events-${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}.jsonl`;
-}
 function rotateOldLogs() {
     try {
         const files = readdirSync(logDir)
@@ -31,37 +30,71 @@ function rotateOldLogs() {
             unlinkSync(join(logDir, files[i].name));
         }
     }
-    catch {
-        /* ignore */
+    catch (err) {
+        // 日志轮转失败不影响主流程
+        console.error('Failed to rotate log files:', err);
     }
 }
-function rotateOldJsonl() {
+/**
+ * 压缩日志文件
+ */
+function compressFile(filePath) {
     try {
-        const files = readdirSync(logDir)
-            .filter((f) => f.endsWith('.jsonl'))
-            .map((f) => ({ name: f, time: statSync(join(logDir, f)).mtimeMs }))
-            .sort((a, b) => b.time - a.time);
-        for (let i = MAX_LOG_FILES; i < files.length; i++) {
-            unlinkSync(join(logDir, files[i].name));
+        const gzip = createGzip();
+        const source = createReadStream(filePath);
+        const destination = createWriteStream(filePath + '.gz');
+        pipeline(source, gzip, destination, (err) => {
+            if (err) {
+                console.error('Failed to compress log file:', err);
+            }
+            else {
+                // 压缩成功，删除原文件
+                try {
+                    unlinkSync(filePath);
+                }
+                catch (e) {
+                    console.error('Failed to delete original log file:', e);
+                }
+            }
+        });
+    }
+    catch (err) {
+        console.error('Failed to compress log file:', err);
+    }
+}
+/**
+ * 检查日志文件大小，必要时轮转
+ */
+function checkLogSize() {
+    if (!logStream)
+        return;
+    try {
+        const currentLogPath = join(logDir, getLogFileName());
+        const stats = statSync(currentLogPath);
+        if (stats.size > MAX_LOG_SIZE) {
+            // 关闭当前日志流
+            logStream.end();
+            logStream = undefined;
+            // 压缩当前日志文件
+            compressFile(currentLogPath);
+            // 创建新的日志文件
+            logStream = createWriteStream(join(logDir, getLogFileName()), { flags: 'a' });
         }
     }
-    catch {
-        /* ignore */
+    catch (err) {
+        console.error('Failed to check log size:', err);
     }
 }
 export function initLogger(dirOrOpts, level, telemetry) {
     let dir;
     let lev;
-    let tel;
     if (dirOrOpts && typeof dirOrOpts === 'object' && !Array.isArray(dirOrOpts)) {
         dir = dirOrOpts.logDir;
         lev = dirOrOpts.logLevel;
-        tel = dirOrOpts.telemetry;
     }
     else {
         dir = dirOrOpts;
         lev = level;
-        tel = telemetry;
     }
     if (dir)
         logDir = dir;
@@ -90,6 +123,8 @@ function write(level, tag, msg, ...args) {
     else
         process.stdout.write(line);
     logStream?.write(line);
+    // 检查日志文件大小
+    checkLogSize();
 }
 export function createLogger(tag) {
     return {

package/dist/platform/handle-text-flow.js

@@ -20,24 +20,22 @@ import { setChatUser } from '../shared/chat-user-map.js';
 import { createLogger, auditLog } from '../logger.js';
 import { handleEnqueueResult, DEFAULT_QUEUE_FULL_MESSAGE, DEFAULT_QUEUED_MESSAGE } from '../shared/utils.js';
 import { walWrite, walCommit } from '../shared/message-wal.js';
+import { TTLCache } from '@isaacs/ttlcache';
 /* ── 幂等性：消息去重 ── */
 const DEDUP_TTL_MS = 60_000; // 1 分钟内的相同 msgId 视为重复
-const dedupCache = new Map(); // msgId → timestamp
+const DEDUP_MAX_SIZE = 1000; // 最大缓存条目数
+// 使用 TTLCache 自动管理过期条目，避免内存泄漏
+const dedupCache = new TTLCache({
+    max: DEDUP_MAX_SIZE,
+    ttl: DEDUP_TTL_MS,
+    updateAgeOnGet: false, // 访问时不更新过期时间
+});
 function isDuplicate(msgId) {
     if (!msgId)
         return false;
-    const now = Date.now();
-    const prev = dedupCache.get(msgId);
-    if (prev && now - prev < DEDUP_TTL_MS)
+    if (dedupCache.has(msgId))
         return true;
-    dedupCache.set(msgId, now);
-    // 清理过期条目
-    if (dedupCache.size > 1000) {
-        for (const [k, v] of dedupCache) {
-            if (now - v > DEDUP_TTL_MS)
-                dedupCache.delete(k);
-        }
-    }
+    dedupCache.set(msgId, true);
     return false;
 }
 const log = createLogger('TextFlow');

package/dist/sanitize.js

@@ -1,7 +1,30 @@
 const PATTERNS = [
-    [/\b(sk|pk|bot)[-_][a-zA-Z0-9_-]{8,}/gi, (m) => (m.match(/^[a-zA-Z]+/)?.[0] || m.slice(0, 2)) + '_****'],
-    [/\b(AIza|AKIA)[a-zA-Z0-9]{12,}/g, (m) => m.slice(0, 4) + '****'],
-    [/\b[a-zA-Z0-9]{40,}\b/g, (m) => m.slice(0, 6) + '****'],
+    // OpenAI / Anthropic / Claude API keys
+    [/\bsk-[a-zA-Z0-9]{32,}\b/g, (m) => 'sk-****' + m.slice(-4)],
+    // AWS Access Key
+    [/\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, (m) => m.slice(0, 4) + '****'],
+    // GitHub Personal Access Token
+    [/\b(ghp|github_pat)_[a-zA-Z0-9_]{36,}\b/g, (m) => m.slice(0, 4) + '_****'],
+    // GitLab Personal Access Token
+    [/\bglpat-[a-zA-Z0-9_-]{20,}\b/g, (m) => 'glpat-****'],
+    // Telegram Bot Token
+    [/\b[0-9]{8,}:[a-zA-Z0-9_-]{35,}\b/g, (m) => m.split(':')[0] + ':****'],
+    // Anthropic API Key
+    [/\bant-[a-zA-Z0-9]{32,}\b/g, (m) => 'ant-****' + m.slice(-4)],
+    // OpenRouter API Key
+    [/\bsk-or-[a-zA-Z0-9]{32,}\b/g, (m) => 'sk-or-****' + m.slice(-4)],
+    // Google API Key
+    [/\bAIza[a-zA-Z0-9_-]{35}\b/g, (m) => 'AIza****'],
+    // Azure API Key
+    [/\b[a-f0-9]{32}:[a-zA-Z0-9]{44}\b/g, (m) => m.split(':')[0] + ':****'],
+    // 飞书/钉钉等 Bot Token
+    [/\b(bot)[-_][a-zA-Z0-9_-]{20,}\b/gi, (m) => 'bot_****'],
+    // 通用 API Key (更严格的匹配，避免误报)
+    [/\b(api_key|apikey|api-key|API_KEY|APIKEY)[\s]*[:=][\s]*[a-zA-Z0-9_-]{16,}\b/gi,
+        (m) => m.split(/[:=]/)[0] + '=****'],
+    // 密码模式
+    [/\b(password|passwd|pwd)[\s]*[:=][\s]*[^\s]{8,}\b/gi,
+        (m) => m.split(/[:=]/)[0] + '=****'],
 ];
 export function sanitize(text) {
     let result = text;

package/dist/shared/keepalive.js

@@ -51,7 +51,9 @@ async function ping(target, workDir) {
             try {
                 handle.abort();
             }
-            catch { }
+            catch (err) {
+                // 中止失败，忽略错误
+            }
             settle(false, `timeout after ${PING_TIMEOUT_MS}ms`);
         }, PING_TIMEOUT_MS);
     });

package/dist/shared/sentry.js

@@ -9,7 +9,9 @@ import * as Sentry from '@sentry/node';
 import { createLogger } from '../logger.js';
 const log = createLogger('Sentry');
 // 开发者的 Sentry DSN（所有 open-im 实例共享）
-const DEFAULT_DSN = 'https://cc5ad094c1229b2a2ff23ab54b0fd807@o4508612762861568.ingest.us.sentry.io/4511583989727232';
+// 注意：此 DSN 仅用于 open-im 自身的错误追踪
+// 用户可在环境变量中配置自己的 DSN
+const DEFAULT_DSN = process.env.OPEN_IM_SENTRY_DSN ?? 'https://cc5ad094c1229b2a2ff23ab54b0fd807@o4508612762861568.ingest.us.sentry.io/4511583989727232';
 let initialized = false;
 /**
  * 清理 PII（用户数据）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wu529778790/open-im",
-  "version": "1.11.10-beta.3",
+  "version": "1.11.11-beta.0",
   "description": "Your AI coding assistant, in every chat app. Multi-platform IM bridge for Claude Code, Codex, and CodeBuddy.",
   "type": "module",
   "main": "dist/index.js",
@@ -54,11 +54,13 @@
     "@anthropic-ai/claude-agent-sdk": "^0.3.179",
     "@anthropic-ai/sdk": "^0.104.2",
     "@aws-sdk/client-s3": "^3.1035.0",
-    "@larksuiteoapi/node-sdk": "^1.59.0",
+    "@isaacs/ttlcache": "^2.1.5",
+    "@larksuiteoapi/node-sdk": "^1.67.0",
     "@opencode-ai/sdk": "^1.17.9",
     "@sentry/node": "^10.58.0",
     "@types/qrcode": "^1.5.6",
     "centrifuge": "^5.5.3",
+    "cookie": "^1.1.1",
     "dingtalk-stream": "^2.1.4",
     "edge-tts": "^1.0.1",
     "https-proxy-agent": "^9.1.0",
@@ -74,15 +76,20 @@
     "@types/node": "^20.0.0",
     "@types/prompts": "^2.4.9",
     "@types/ws": "^8.5.13",
+    "axios": "^1.18.1",
     "dotenv": "^17.3.1",
     "eslint": "^9.15.0",
     "globals": "^15.12.0",
     "tsx": "^4.0.0",
     "typescript": "^5.0.0",
     "typescript-eslint": "^8.58.0",
+    "vite": "^8.1.0",
     "vitest": "^4.1.2"
   },
   "engines": {
     "node": ">=20"
+  },
+  "overrides": {
+    "axios": "^1.18.1"
   }
 }