@wu529778790/open-im 1.11.10 → 1.11.11-beta.1

package/README.md

@@ -74,6 +74,8 @@ open-im start
 | `/context` | 查看上下文用量 |
 | `/plugins` | 查看已安装插件 |
 | `/status` | 显示状态信息 |
+| `/a` | 查看当前 AI 工具及可选列表 |
+| `/a <工具名>` | 切换当前平台的 AI 工具（claude/codex/codebuddy/opencode） |
 | `/cd <路径>` / `/pwd` | 切换/查看工作目录 |
 
 ### 快捷命令
@@ -90,29 +92,26 @@ open-im start
 
 ### 权限与确认
 
-Claude 使用 Agent SDK 集成，open-im 默认不替 Claude 做额外的允许/拒绝协议。Claude 需要用户确认时，会按它自己的原生交互语义发问；你在 IM 里回复选项、确认或补充说明即可继续同一个会话。
+Claude（Agent SDK）、Codex、CodeBuddy、OpenCode 默认都进入**自动执行模式**：AI 工具需要权限时直接放行，不会在 IM 里卡住等待确认。
 
-如果你希望 Claude 也进入自动执行模式，可以在 Web 控制台的 **AI 工具配置 → Claude Code → 跳过 Claude 权限确认** 打开，或在配置文件里设置：
+> ⚠️ open-im 目前没有把 Claude SDK 的权限确认弹窗转发到 IM。一旦开启原生确认流程，请求会因无人应答而卡死，所以默认全部跳过。未来接入权限 hook 后会提供细粒度控制。
+
+如果需要恢复 Claude 的原生确认流程，可在配置文件里设置：
 
 ```json
 {
   "tools": {
     "claude": {
-      "skipPermissions": true
+      "skipPermissions": false
     }
   }
 }
 ```
 
-也可以用环境变量临时覆盖：
-
 ```bash
-OPEN_IM_SKIP_PERMISSIONS=true open-im start   # 跳过权限确认
-OPEN_IM_SKIP_PERMISSIONS=false open-im start  # 使用 Claude 原生确认
+OPEN_IM_SKIP_PERMISSIONS=false open-im start  # 恢复 Claude 原生确认
 ```
 
-Codex、CodeBuddy、OpenCode 仍保持原来的自动执行默认行为。
-
 ## 会话接力
 
 open-im 和 Claude Code CLI 共享 session 存储。同一目录下，手机和电脑无缝切换：
@@ -136,11 +135,14 @@ claude -c             # 接上手机端的对话
 
 - 配置所有平台凭证
 - 启动/停止桥接服务
-- 编辑配置文件
+- 编辑配置文件（open-im / Claude / Codex / CodeBuddy / OpenCode，含 Codex 的 `auth.json` 与 `config.toml`）
+- API 保活设置（定期发送请求延续 5 小时滚动配额，避免 token 浪费）
 - 首次运行自动弹出设置向导
 - 平台卡片支持展开/折叠
 - 一键保存并启动
 
+> 💡 通过 IM 命令 `/a <工具名>` 切换 AI 工具，或 Web 控制台修改平台配置后，**下一条消息立即生效，无需重启**桥接服务。
+
 局域网访问：`export OPEN_IM_WEB_HOST=0.0.0.0`
 
 ## CLI 命令

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { main, needsSetup, runInteractiveSetup } from "./index.js";
+import { main, needsSetup } from "./index.js";
 import { loadConfig } from "./config.js";
 import { checkAndUpdate } from "./check-update.js";
 import { getPublicWebDashboardUrl } from "./constants.js";
@@ -20,23 +20,6 @@ function logWebDashboardAndApi() {
     }
 }
 async function ensureConfigured(mode) {
-    if (mode === "init") {
-        if (!process.stdin.isTTY) {
-            console.error("CLI setup requires an interactive terminal.");
-            return false;
-        }
-        const saved = await runInteractiveSetup();
-        if (!saved)
-            return false;
-        try {
-            loadConfig();
-            return true;
-        }
-        catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
-            return false;
-        }
-    }
     if (!needsSetup()) {
         try {
             loadConfig();
@@ -123,18 +106,6 @@ async function cmdRestart() {
     logWebDashboardAndApi();
     process.exit(0);
 }
-async function cmdInit() {
-    console.log("\nopen-im CLI setup\n");
-    const saved = await ensureConfigured("init");
-    if (!saved) {
-        console.log("\nConfiguration was not completed.");
-        process.exit(1);
-    }
-    console.log("\nConfiguration saved.");
-    console.log("\nYou can start the app with:");
-    console.log("  open-im start");
-    console.log("  open-im dev");
-}
 async function cmdDev() {
     if (!(await ensureConfigured("dev"))) {
         console.log("Configuration was not completed.");
@@ -165,7 +136,6 @@ Commands:
   start     Run the full app in the background and serve the dashboard
   stop      Stop the full app
   restart   Restart the full app in the background
-  init      Run CLI setup
   dev       Run in the foreground for debugging
   dashboard Open the web dashboard (keeps running until Ctrl+C)
 
@@ -185,7 +155,6 @@ const commands = {
     start: cmdStart,
     stop: cmdStop,
     restart: cmdRestart,
-    init: cmdInit,
     dev: cmdDev,
     dashboard: cmdDashboard,
 };

package/dist/config-web-auth.d.ts

@@ -9,5 +9,5 @@ export declare function consumeLoginToken(loginToken: string): LoginTokenInfo |
 export declare function createLoginToken(ttlMs: number): string;
 export declare function createSession(request: IncomingMessage, ttlMs: number): string;
 export declare function isSessionValid(request: IncomingMessage): boolean;
-export declare function buildSessionCookie(sessionId: string, ttlMs: number): string;
+export declare function buildSessionCookie(sessionId: string, ttlMs: number, isHttps?: boolean): string;
 export declare function generateLoginUrl(host: string, port: number, loginTtlMs: number): string;

package/dist/config-web-auth.js

@@ -1,4 +1,5 @@
 import { randomBytes } from "node:crypto";
+import { parse, serialize } from "cookie";
 const pendingLogins = new Map();
 const activeSessions = new Map();
 export function getWebConfigHost() {
@@ -58,17 +59,16 @@ function parseCookies(request) {
     const header = request.headers.cookie;
     if (!header)
         return {};
-    const cookies = {};
-    const parts = header.split(";");
-    for (const part of parts) {
-        const [rawKey, ...rest] = part.split("=");
-        const key = rawKey.trim();
-        if (!key)
-            continue;
-        const value = rest.join("=").trim();
-        cookies[key] = decodeURIComponent(value);
+    // 使用成熟的 cookie 库，更安全可靠
+    const cookies = parse(header);
+    // 转换为 Record<string, string>，过滤掉 undefined 值
+    const result = {};
+    for (const [key, value] of Object.entries(cookies)) {
+        if (value !== undefined) {
+            result[key] = value;
+        }
     }
-    return cookies;
+    return result;
 }
 function getSessionIdFromRequest(request) {
     const cookies = parseCookies(request);
@@ -94,17 +94,21 @@ export function isSessionValid(request) {
     }
     return true;
 }
-export function buildSessionCookie(sessionId, ttlMs) {
+export function buildSessionCookie(sessionId, ttlMs, isHttps = false) {
     const maxAgeSec = Math.floor(ttlMs / 1000);
-    const parts = [
-        `openim_session=${encodeURIComponent(sessionId)}`,
-        "Path=/",
-        "HttpOnly",
-        "SameSite=Lax",
-        `Max-Age=${maxAgeSec}`,
-    ];
-    // 不设置 Secure，方便本地 http 使用；如果放在 https 反代后，可以在代理层加 Secure
-    return parts.join("; ");
+    const options = {
+        path: "/",
+        httpOnly: true,
+        sameSite: "lax",
+        maxAge: maxAgeSec,
+    };
+    // 根据请求协议动态设置 Secure 标志
+    // 在生产环境（HTTPS 反代后）应该设置为 true
+    if (isHttps || process.env.NODE_ENV === "production") {
+        options.secure = true;
+    }
+    // 使用成熟的 cookie 库的 serialize 函数
+    return serialize("openim_session", sessionId, options);
 }
 export function generateLoginUrl(host, port, loginTtlMs) {
     const loginToken = createLoginToken(loginTtlMs);

package/dist/config-web.js

@@ -68,7 +68,9 @@ export async function startWebConfigServer(options) {
                     // 有效的一次性登录 token：创建会话，设置 Cookie，并重定向到去掉 login_token 的 URL
                     const sessionTtlMs = 24 * 60 * 60 * 1000; // 24 小时
                     const sessionId = createSession(request, sessionTtlMs);
-                    const cookie = buildSessionCookie(sessionId, sessionTtlMs);
+                    // 检查是否通过 HTTPS 反代访问
+                    const isHttps = request.headers["x-forwarded-proto"] === "https";
+                    const cookie = buildSessionCookie(sessionId, sessionTtlMs, isHttps);
                     requestUrl.searchParams.delete("login_token");
                     const redirectPath = requestUrl.pathname + (requestUrl.search ? requestUrl.search : "");
                     response.writeHead(302, mergeCors(request, {

package/dist/index.js

@@ -370,8 +370,8 @@ export async function main() {
             if (existsSync(portFile))
                 unlinkSync(portFile);
         }
-        catch {
-            /* ignore */
+        catch (err) {
+            log.debug('Failed to remove port file:', err);
         }
         // Stop each platform: abort running tasks, then handle.stop() then module.stop()
         for (const platform of successfulPlatforms) {

package/dist/logger.js

@@ -1,10 +1,13 @@
-import { createWriteStream, mkdirSync, existsSync, readdirSync, statSync, unlinkSync } from 'node:fs';
+import { createWriteStream, mkdirSync, existsSync, readdirSync, statSync, unlinkSync, createReadStream } from 'node:fs';
 import { join } from 'node:path';
 import { finished } from 'node:stream/promises';
+import { pipeline } from 'node:stream';
+import { createGzip } from 'node:zlib';
 import { sanitize } from './sanitize.js';
 import { APP_HOME } from './constants.js';
 const DEFAULT_LOG_DIR = join(APP_HOME, 'logs');
 const MAX_LOG_FILES = 10;
+const MAX_LOG_SIZE = 10 * 1024 * 1024; // 10MB
 const LOG_LEVELS = { DEBUG: 0, INFO: 1, WARN: 2, ERROR: 3 };
 let logDir = DEFAULT_LOG_DIR;
 let minLevel = LOG_LEVELS.DEBUG;
@@ -17,10 +20,6 @@ function getLogFileName() {
     const d = new Date();
     return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}.log`;
 }
-function getEventsFileName() {
-    const d = new Date();
-    return `events-${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}.jsonl`;
-}
 function rotateOldLogs() {
     try {
         const files = readdirSync(logDir)
@@ -31,37 +30,71 @@ function rotateOldLogs() {
             unlinkSync(join(logDir, files[i].name));
         }
     }
-    catch {
-        /* ignore */
+    catch (err) {
+        // 日志轮转失败不影响主流程
+        console.error('Failed to rotate log files:', err);
     }
 }
-function rotateOldJsonl() {
+/**
+ * 压缩日志文件
+ */
+function compressFile(filePath) {
     try {
-        const files = readdirSync(logDir)
-            .filter((f) => f.endsWith('.jsonl'))
-            .map((f) => ({ name: f, time: statSync(join(logDir, f)).mtimeMs }))
-            .sort((a, b) => b.time - a.time);
-        for (let i = MAX_LOG_FILES; i < files.length; i++) {
-            unlinkSync(join(logDir, files[i].name));
+        const gzip = createGzip();
+        const source = createReadStream(filePath);
+        const destination = createWriteStream(filePath + '.gz');
+        pipeline(source, gzip, destination, (err) => {
+            if (err) {
+                console.error('Failed to compress log file:', err);
+            }
+            else {
+                // 压缩成功，删除原文件
+                try {
+                    unlinkSync(filePath);
+                }
+                catch (e) {
+                    console.error('Failed to delete original log file:', e);
+                }
+            }
+        });
+    }
+    catch (err) {
+        console.error('Failed to compress log file:', err);
+    }
+}
+/**
+ * 检查日志文件大小，必要时轮转
+ */
+function checkLogSize() {
+    if (!logStream)
+        return;
+    try {
+        const currentLogPath = join(logDir, getLogFileName());
+        const stats = statSync(currentLogPath);
+        if (stats.size > MAX_LOG_SIZE) {
+            // 关闭当前日志流
+            logStream.end();
+            logStream = undefined;
+            // 压缩当前日志文件
+            compressFile(currentLogPath);
+            // 创建新的日志文件
+            logStream = createWriteStream(join(logDir, getLogFileName()), { flags: 'a' });
         }
     }
-    catch {
-        /* ignore */
+    catch (err) {
+        console.error('Failed to check log size:', err);
     }
 }
 export function initLogger(dirOrOpts, level, telemetry) {
     let dir;
     let lev;
-    let tel;
     if (dirOrOpts && typeof dirOrOpts === 'object' && !Array.isArray(dirOrOpts)) {
         dir = dirOrOpts.logDir;
         lev = dirOrOpts.logLevel;
-        tel = dirOrOpts.telemetry;
     }
     else {
         dir = dirOrOpts;
         lev = level;
-        tel = telemetry;
     }
     if (dir)
         logDir = dir;
@@ -90,6 +123,8 @@ function write(level, tag, msg, ...args) {
     else
         process.stdout.write(line);
     logStream?.write(line);
+    // 检查日志文件大小
+    checkLogSize();
 }
 export function createLogger(tag) {
     return {

package/dist/platform/handle-text-flow.js

@@ -20,24 +20,22 @@ import { setChatUser } from '../shared/chat-user-map.js';
 import { createLogger, auditLog } from '../logger.js';
 import { handleEnqueueResult, DEFAULT_QUEUE_FULL_MESSAGE, DEFAULT_QUEUED_MESSAGE } from '../shared/utils.js';
 import { walWrite, walCommit } from '../shared/message-wal.js';
+import { TTLCache } from '@isaacs/ttlcache';
 /* ── 幂等性：消息去重 ── */
 const DEDUP_TTL_MS = 60_000; // 1 分钟内的相同 msgId 视为重复
-const dedupCache = new Map(); // msgId → timestamp
+const DEDUP_MAX_SIZE = 1000; // 最大缓存条目数
+// 使用 TTLCache 自动管理过期条目，避免内存泄漏
+const dedupCache = new TTLCache({
+    max: DEDUP_MAX_SIZE,
+    ttl: DEDUP_TTL_MS,
+    updateAgeOnGet: false, // 访问时不更新过期时间
+});
 function isDuplicate(msgId) {
     if (!msgId)
         return false;
-    const now = Date.now();
-    const prev = dedupCache.get(msgId);
-    if (prev && now - prev < DEDUP_TTL_MS)
+    if (dedupCache.has(msgId))
         return true;
-    dedupCache.set(msgId, now);
-    // 清理过期条目
-    if (dedupCache.size > 1000) {
-        for (const [k, v] of dedupCache) {
-            if (now - v > DEDUP_TTL_MS)
-                dedupCache.delete(k);
-        }
-    }
+    dedupCache.set(msgId, true);
     return false;
 }
 const log = createLogger('TextFlow');

package/dist/sanitize.js

@@ -1,7 +1,30 @@
 const PATTERNS = [
-    [/\b(sk|pk|bot)[-_][a-zA-Z0-9_-]{8,}/gi, (m) => (m.match(/^[a-zA-Z]+/)?.[0] || m.slice(0, 2)) + '_****'],
-    [/\b(AIza|AKIA)[a-zA-Z0-9]{12,}/g, (m) => m.slice(0, 4) + '****'],
-    [/\b[a-zA-Z0-9]{40,}\b/g, (m) => m.slice(0, 6) + '****'],
+    // OpenAI / Anthropic / Claude API keys
+    [/\bsk-[a-zA-Z0-9]{32,}\b/g, (m) => 'sk-****' + m.slice(-4)],
+    // AWS Access Key
+    [/\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, (m) => m.slice(0, 4) + '****'],
+    // GitHub Personal Access Token
+    [/\b(ghp|github_pat)_[a-zA-Z0-9_]{36,}\b/g, (m) => m.slice(0, 4) + '_****'],
+    // GitLab Personal Access Token
+    [/\bglpat-[a-zA-Z0-9_-]{20,}\b/g, (m) => 'glpat-****'],
+    // Telegram Bot Token
+    [/\b[0-9]{8,}:[a-zA-Z0-9_-]{35,}\b/g, (m) => m.split(':')[0] + ':****'],
+    // Anthropic API Key
+    [/\bant-[a-zA-Z0-9]{32,}\b/g, (m) => 'ant-****' + m.slice(-4)],
+    // OpenRouter API Key
+    [/\bsk-or-[a-zA-Z0-9]{32,}\b/g, (m) => 'sk-or-****' + m.slice(-4)],
+    // Google API Key
+    [/\bAIza[a-zA-Z0-9_-]{35}\b/g, (m) => 'AIza****'],
+    // Azure API Key
+    [/\b[a-f0-9]{32}:[a-zA-Z0-9]{44}\b/g, (m) => m.split(':')[0] + ':****'],
+    // 飞书/钉钉等 Bot Token
+    [/\b(bot)[-_][a-zA-Z0-9_-]{20,}\b/gi, (m) => 'bot_****'],
+    // 通用 API Key (更严格的匹配，避免误报)
+    [/\b(api_key|apikey|api-key|API_KEY|APIKEY)[\s]*[:=][\s]*[a-zA-Z0-9_-]{16,}\b/gi,
+        (m) => m.split(/[:=]/)[0] + '=****'],
+    // 密码模式
+    [/\b(password|passwd|pwd)[\s]*[:=][\s]*[^\s]{8,}\b/gi,
+        (m) => m.split(/[:=]/)[0] + '=****'],
 ];
 export function sanitize(text) {
     let result = text;

package/dist/shared/keepalive.js

@@ -51,7 +51,9 @@ async function ping(target, workDir) {
             try {
                 handle.abort();
             }
-            catch { }
+            catch (err) {
+                // 中止失败，忽略错误
+            }
             settle(false, `timeout after ${PING_TIMEOUT_MS}ms`);
         }, PING_TIMEOUT_MS);
     });

package/dist/shared/sentry.js

@@ -9,7 +9,9 @@ import * as Sentry from '@sentry/node';
 import { createLogger } from '../logger.js';
 const log = createLogger('Sentry');
 // 开发者的 Sentry DSN（所有 open-im 实例共享）
-const DEFAULT_DSN = 'https://cc5ad094c1229b2a2ff23ab54b0fd807@o4508612762861568.ingest.us.sentry.io/4511583989727232';
+// 注意：此 DSN 仅用于 open-im 自身的错误追踪
+// 用户可在环境变量中配置自己的 DSN
+const DEFAULT_DSN = process.env.OPEN_IM_SENTRY_DSN ?? 'https://cc5ad094c1229b2a2ff23ab54b0fd807@o4508612762861568.ingest.us.sentry.io/4511583989727232';
 let initialized = false;
 /**
  * 清理 PII（用户数据）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wu529778790/open-im",
-  "version": "1.11.10",
+  "version": "1.11.11-beta.1",
   "description": "Your AI coding assistant, in every chat app. Multi-platform IM bridge for Claude Code, Codex, and CodeBuddy.",
   "type": "module",
   "main": "dist/index.js",
@@ -54,11 +54,13 @@
     "@anthropic-ai/claude-agent-sdk": "^0.3.179",
     "@anthropic-ai/sdk": "^0.104.2",
     "@aws-sdk/client-s3": "^3.1035.0",
-    "@larksuiteoapi/node-sdk": "^1.59.0",
+    "@isaacs/ttlcache": "^2.1.5",
+    "@larksuiteoapi/node-sdk": "^1.67.0",
     "@opencode-ai/sdk": "^1.17.9",
     "@sentry/node": "^10.58.0",
     "@types/qrcode": "^1.5.6",
     "centrifuge": "^5.5.3",
+    "cookie": "^1.1.1",
     "dingtalk-stream": "^2.1.4",
     "edge-tts": "^1.0.1",
     "https-proxy-agent": "^9.1.0",
@@ -74,15 +76,20 @@
     "@types/node": "^20.0.0",
     "@types/prompts": "^2.4.9",
     "@types/ws": "^8.5.13",
+    "axios": "^1.18.1",
     "dotenv": "^17.3.1",
     "eslint": "^9.15.0",
     "globals": "^15.12.0",
     "tsx": "^4.0.0",
     "typescript": "^5.0.0",
     "typescript-eslint": "^8.58.0",
+    "vite": "^8.1.0",
     "vitest": "^4.1.2"
   },
   "engines": {
     "node": ">=20"
+  },
+  "overrides": {
+    "axios": "^1.18.1"
   }
 }