@wu529778790/open-im 1.11.8-beta.2 → 1.11.8-beta.21

package/dist/config-web.js

@@ -1,822 +1,30 @@
-import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 import { URL } from "node:url";
-import { randomBytes } from "node:crypto";
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { DWClient } from "dingtalk-stream";
-import { WEB_CONFIG_PORT, getPublicWebDashboardUrl, PLATFORM_TEST_TIMEOUT_MS } from "./constants.js";
-import { CONFIG_PATH, getClaudeConfigHome, loadClaudeSettingsEnv, saveClaudeSettingsEnv, loadConfig, loadFileConfig, saveFileConfig, normalizeAiCommand, CODEX_AUTH_PATHS, } from "./config.js";
+import { getPublicWebDashboardUrl } from "./constants.js";
+import { CONFIG_PATH, getClaudeConfigHome, loadClaudeSettingsEnv, loadConfig, loadFileConfig, saveFileConfig, CODEX_AUTH_PATHS, } from "./config.js";
 import { getWebDistDir, tryServeDashboardStatic } from "./config-web-static.js";
+import { getWebConfigHost, allowRemoteApiWithoutAuth, consumeLoginToken, createSession, isSessionValid, buildSessionCookie, generateLoginUrl, } from "./config-web-auth.js";
+import { corsHeadersFor, mergeCors } from "./config-web-cors.js";
+export { getHealthPlatformSnapshot } from "./config-web-health.js";
+import { getHealthPlatformSnapshot } from "./config-web-health.js";
+import { readJson, jsonResponse as json } from "./config-web-http.js";
+import { openBrowser, getWebConfigPort, } from "./config-web-browser.js";
+export { getWebConfigUrl } from "./config-web-browser.js";
+import { buildInitialPayload, validatePayload, toFileConfig, isMasked, clean, } from "./config-web-payload.js";
+import { testPlatformConfig, toErrorMessage } from "./config-web-probes.js";
+export { testPlatformConfig } from "./config-web-probes.js";
 import { getServiceStatus, startBackgroundService, stopBackgroundService } from "./service-control.js";
-import { initWeWork, stopWeWork } from "./wework/client.js";
 import { createLogger } from "./logger.js";
 const log = createLogger("ConfigWeb");
 // 已移至 constants.ts;
+// getClaudeSettingsPath is used by /api/claude/settings handler
 function getClaudeSettingsPath() {
     const home = getClaudeConfigHome();
     const baseDir = join(home, ".claude");
     return join(baseDir, "settings.json");
 }
-const pendingLogins = new Map();
-const activeSessions = new Map();
-function getWebConfigHost() {
-    const envHost = process.env.OPEN_IM_WEB_HOST?.trim();
-    if (envHost)
-        return envHost;
-    return "127.0.0.1";
-}
-/** 设为 true 时，非本机绑定的 Web 配置服务跳过登录 Cookie 校验（仅适用于受信网络；生产建议配合 HTTPS 反向代理） */
-function allowRemoteApiWithoutAuth() {
-    return process.env.OPEN_IM_ALLOW_REMOTE_API === "true";
-}
-/** 是否允许该浏览器 Origin（与 getPublicWebDashboardUrl() 同源时始终允许，便于反代 / 自定义 OPEN_IM_PUBLIC_WEB_URL） */
-function isCorsOriginAllowed(origin) {
-    const publicWeb = getPublicWebDashboardUrl();
-    try {
-        if (origin === new URL(publicWeb).origin)
-            return true;
-    }
-    catch {
-        if (origin === publicWeb)
-            return true;
-    }
-    const allowlist = splitCsv(process.env.OPEN_IM_CORS_ORIGINS);
-    if (allowlist.length === 0)
-        return true;
-    return allowlist.includes(origin);
-}
-/** 有 Origin 时返回 CORS 响应头；无 Origin（如本地 file:// 或同源内置页）不返回，行为与原来一致 */
-function corsHeadersFor(request) {
-    const originRaw = request.headers.origin;
-    if (!originRaw || typeof originRaw !== "string")
-        return undefined;
-    if (!isCorsOriginAllowed(originRaw))
-        return undefined;
-    const requestedHeaders = request.headers["access-control-request-headers"];
-    const allowHeaders = typeof requestedHeaders === "string" && requestedHeaders.trim()
-        ? requestedHeaders
-        : "Content-Type, Authorization";
-    return {
-        "Access-Control-Allow-Origin": originRaw,
-        "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-        "Access-Control-Allow-Headers": allowHeaders,
-        "Access-Control-Allow-Credentials": "true",
-        "Access-Control-Max-Age": "86400",
-    };
-}
-function mergeCors(request, headers) {
-    const cors = corsHeadersFor(request);
-    if (!cors)
-        return headers;
-    return { ...headers, ...cors };
-}
-function generateRandomToken(bytes = 32) {
-    return randomBytes(bytes).toString("base64url");
-}
-function cleanupExpiredAuth(now) {
-    for (const [token, info] of pendingLogins) {
-        if (info.expiresAt <= now)
-            pendingLogins.delete(token);
-    }
-    for (const [sessionId, info] of activeSessions) {
-        if (info.expiresAt <= now)
-            activeSessions.delete(sessionId);
-    }
-}
-function createLoginToken(ttlMs) {
-    const now = Date.now();
-    cleanupExpiredAuth(now);
-    const token = generateRandomToken(32);
-    pendingLogins.set(token, { expiresAt: now + ttlMs });
-    return token;
-}
-function createSession(request, ttlMs) {
-    const now = Date.now();
-    cleanupExpiredAuth(now);
-    const sessionId = generateRandomToken(32);
-    const remoteAddr = request.socket.remoteAddress;
-    const userAgent = typeof request.headers["user-agent"] === "string" ? request.headers["user-agent"] : undefined;
-    activeSessions.set(sessionId, {
-        expiresAt: now + ttlMs,
-        remoteAddr,
-        userAgent,
-    });
-    return sessionId;
-}
-function parseCookies(request) {
-    const header = request.headers.cookie;
-    if (!header)
-        return {};
-    const cookies = {};
-    const parts = header.split(";");
-    for (const part of parts) {
-        const [rawKey, ...rest] = part.split("=");
-        const key = rawKey.trim();
-        if (!key)
-            continue;
-        const value = rest.join("=").trim();
-        cookies[key] = decodeURIComponent(value);
-    }
-    return cookies;
-}
-function getSessionIdFromRequest(request) {
-    const cookies = parseCookies(request);
-    const sessionId = cookies.openim_session;
-    return sessionId && typeof sessionId === "string" && sessionId.length > 0 ? sessionId : null;
-}
-function isSessionValid(request) {
-    const sessionId = getSessionIdFromRequest(request);
-    if (!sessionId)
-        return false;
-    const info = activeSessions.get(sessionId);
-    if (!info)
-        return false;
-    const now = Date.now();
-    if (info.expiresAt <= now) {
-        activeSessions.delete(sessionId);
-        return false;
-    }
-    // Optional: tie session to basic client fingerprint (remote address)
-    const remoteAddr = request.socket.remoteAddress;
-    if (info.remoteAddr && remoteAddr && remoteAddr !== info.remoteAddr) {
-        return false;
-    }
-    return true;
-}
-function buildSessionCookie(sessionId, ttlMs) {
-    const maxAgeSec = Math.floor(ttlMs / 1000);
-    const parts = [
-        `openim_session=${encodeURIComponent(sessionId)}`,
-        "Path=/",
-        "HttpOnly",
-        "SameSite=Lax",
-        `Max-Age=${maxAgeSec}`,
-    ];
-    // 不设置 Secure，方便本地 http 使用；如果放在 https 反代后，可以在代理层加 Secure
-    return parts.join("; ");
-}
-export function getHealthPlatformSnapshot(file, env = process.env) {
-    const fileTelegram = file.platforms?.telegram;
-    const fileFeishu = file.platforms?.feishu;
-    const fileQQ = file.platforms?.qq;
-    const fileWework = file.platforms?.wework;
-    const fileDingtalk = file.platforms?.dingtalk;
-    const fileWorkbuddy = file.platforms?.workbuddy;
-    const fileClawbot = file.platforms?.clawbot;
-    const telegramBotToken = env.TELEGRAM_BOT_TOKEN ?? fileTelegram?.botToken ?? file.telegramBotToken;
-    const feishuAppId = env.FEISHU_APP_ID ?? fileFeishu?.appId ?? file.feishuAppId;
-    const feishuAppSecret = env.FEISHU_APP_SECRET ?? fileFeishu?.appSecret ?? file.feishuAppSecret;
-    const qqAppId = env.QQ_BOT_APPID ?? env.QQ_APP_ID ?? fileQQ?.appId;
-    const qqSecret = env.QQ_BOT_SECRET ?? env.QQ_SECRET ?? fileQQ?.secret;
-    const weworkCorpId = env.WEWORK_CORP_ID ?? fileWework?.corpId;
-    const weworkSecret = env.WEWORK_SECRET ?? fileWework?.secret;
-    const dingtalkClientId = env.DINGTALK_CLIENT_ID ?? fileDingtalk?.clientId;
-    const dingtalkClientSecret = env.DINGTALK_CLIENT_SECRET ?? fileDingtalk?.clientSecret;
-    const workbuddyAccessToken = fileWorkbuddy?.accessToken;
-    const workbuddyRefreshToken = fileWorkbuddy?.refreshToken;
-    const workbuddyUserId = fileWorkbuddy?.userId;
-    return {
-        telegram: {
-            configured: !!telegramBotToken,
-            enabled: !!telegramBotToken && fileTelegram?.enabled !== false,
-            healthy: !!telegramBotToken,
-            message: telegramBotToken ? "Token configured" : "Token not configured",
-        },
-        feishu: {
-            configured: !!(feishuAppId && feishuAppSecret),
-            enabled: !!(feishuAppId && feishuAppSecret) && fileFeishu?.enabled !== false,
-            healthy: !!(feishuAppId && feishuAppSecret),
-            message: feishuAppId && feishuAppSecret ? "App ID and Secret configured" : "Missing credentials",
-        },
-        qq: {
-            configured: !!(qqAppId && qqSecret),
-            enabled: !!(qqAppId && qqSecret) && fileQQ?.enabled !== false,
-            healthy: !!(qqAppId && qqSecret),
-            message: qqAppId && qqSecret ? "App ID and Secret configured" : "Missing credentials",
-        },
-        wework: {
-            configured: !!(weworkCorpId && weworkSecret),
-            enabled: !!(weworkCorpId && weworkSecret) && fileWework?.enabled !== false,
-            healthy: !!(weworkCorpId && weworkSecret),
-            message: weworkCorpId && weworkSecret ? "Corp ID and Secret configured" : "Missing credentials",
-        },
-        dingtalk: {
-            configured: !!(dingtalkClientId && dingtalkClientSecret),
-            enabled: !!(dingtalkClientId && dingtalkClientSecret) && fileDingtalk?.enabled !== false,
-            healthy: !!(dingtalkClientId && dingtalkClientSecret),
-            message: dingtalkClientId && dingtalkClientSecret ? "Client ID and Secret configured" : "Missing credentials",
-        },
-        workbuddy: {
-            configured: !!(workbuddyAccessToken && workbuddyRefreshToken && workbuddyUserId),
-            enabled: !!(workbuddyAccessToken && workbuddyRefreshToken && workbuddyUserId) && fileWorkbuddy?.enabled !== false,
-            healthy: !!(workbuddyAccessToken && workbuddyRefreshToken && workbuddyUserId),
-            message: workbuddyAccessToken && workbuddyRefreshToken && workbuddyUserId ? "OAuth credentials configured" : "Missing credentials",
-        },
-        clawbot: {
-            configured: !!fileClawbot?.apiToken,
-            enabled: !!fileClawbot?.apiToken && fileClawbot?.enabled !== false,
-            healthy: !!fileClawbot?.apiToken,
-            message: fileClawbot?.apiToken ? "API Token configured" : "Missing API Token",
-        },
-    };
-}
-function splitCsv(value) {
-    if (!value)
-        return [];
-    return value.split(",").map((item) => item.trim()).filter(Boolean);
-}
-function clean(value) {
-    if (!value)
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed ? trimmed : undefined;
-}
-function persistedPlatformAi(v) {
-    // 经 registry 规范化;此前硬编码只认 codex/codebuddy/claude,会把 opencode 降级为 claude。
-    return normalizeAiCommand(clean(v), "claude");
-}
-function isMasked(value) {
-    return typeof value === "string" && value.includes("****");
-}
-/** 如果前端传回的是掩码值（包含 ****），保留 existing 中的真实密钥，避免覆盖 */
-function resolveSecret(incoming, existing) {
-    if (isMasked(incoming))
-        return existing;
-    return clean(incoming);
-}
-const MAX_REQUEST_BODY_BYTES = 1 * 1024 * 1024; // 1 MB
-function readJson(request) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let totalBytes = 0;
-        request.on("data", (chunk) => {
-            totalBytes += chunk.length;
-            if (totalBytes > MAX_REQUEST_BODY_BYTES) {
-                reject(new Error("Request body too large (max 1 MB)"));
-                request.destroy();
-                return;
-            }
-            chunks.push(Buffer.from(chunk));
-        });
-        request.on("end", () => {
-            try {
-                const raw = Buffer.concat(chunks).toString("utf-8");
-                resolve((raw ? JSON.parse(raw) : {}));
-            }
-            catch (error) {
-                reject(error);
-            }
-        });
-        request.on("error", reject);
-    });
-}
-function json(response, statusCode, body, request) {
-    response.writeHead(statusCode, mergeCors(request, { "content-type": "application/json; charset=utf-8" }));
-    response.end(JSON.stringify(body));
-}
-function maskSecret(value) {
-    if (!value || value.length <= 4)
-        return value ? "****" : "";
-    return value.slice(0, 2) + "****" + value.slice(-2);
-}
-function buildInitialPayload(file) {
-    // Load Claude settings from ~/.claude/settings.json
-    const claudeEnv = loadClaudeSettingsEnv();
-    return {
-        platforms: {
-            telegram: {
-                enabled: file.platforms?.telegram?.enabled ?? Boolean(file.platforms?.telegram?.botToken),
-                aiCommand: normalizeAiCommand(file.platforms?.telegram?.aiCommand, "claude"),
-                botToken: maskSecret(file.platforms?.telegram?.botToken),
-                proxy: file.platforms?.telegram?.proxy ?? "",
-                allowedUserIds: (file.platforms?.telegram?.allowedUserIds ?? []).join(", "),
-            },
-            feishu: {
-                enabled: file.platforms?.feishu?.enabled ?? Boolean(file.platforms?.feishu?.appId && file.platforms?.feishu?.appSecret),
-                aiCommand: normalizeAiCommand(file.platforms?.feishu?.aiCommand, "claude"),
-                appId: file.platforms?.feishu?.appId ?? "",
-                appSecret: maskSecret(file.platforms?.feishu?.appSecret),
-                allowedUserIds: (file.platforms?.feishu?.allowedUserIds ?? []).join(", "),
-            },
-            qq: {
-                enabled: file.platforms?.qq?.enabled ?? Boolean(file.platforms?.qq?.appId && file.platforms?.qq?.secret),
-                aiCommand: normalizeAiCommand(file.platforms?.qq?.aiCommand, "claude"),
-                appId: file.platforms?.qq?.appId ?? "",
-                secret: maskSecret(file.platforms?.qq?.secret),
-                allowedUserIds: (file.platforms?.qq?.allowedUserIds ?? []).join(", "),
-            },
-            wework: {
-                enabled: file.platforms?.wework?.enabled ?? Boolean(file.platforms?.wework?.corpId && file.platforms?.wework?.secret),
-                aiCommand: normalizeAiCommand(file.platforms?.wework?.aiCommand, "claude"),
-                corpId: file.platforms?.wework?.corpId ?? "",
-                secret: maskSecret(file.platforms?.wework?.secret),
-                allowedUserIds: (file.platforms?.wework?.allowedUserIds ?? []).join(", "),
-            },
-            dingtalk: {
-                enabled: file.platforms?.dingtalk?.enabled ?? Boolean(file.platforms?.dingtalk?.clientId && file.platforms?.dingtalk?.clientSecret),
-                aiCommand: normalizeAiCommand(file.platforms?.dingtalk?.aiCommand, "claude"),
-                clientId: file.platforms?.dingtalk?.clientId ?? "",
-                clientSecret: maskSecret(file.platforms?.dingtalk?.clientSecret),
-                cardTemplateId: file.platforms?.dingtalk?.cardTemplateId ?? "",
-                allowedUserIds: (file.platforms?.dingtalk?.allowedUserIds ?? []).join(", "),
-            },
-            workbuddy: {
-                enabled: file.platforms?.workbuddy?.enabled ?? Boolean(file.platforms?.workbuddy?.accessToken && file.platforms?.workbuddy?.refreshToken && file.platforms?.workbuddy?.userId),
-                aiCommand: normalizeAiCommand(file.platforms?.workbuddy?.aiCommand, "claude"),
-                accessToken: maskSecret(file.platforms?.workbuddy?.accessToken),
-                refreshToken: maskSecret(file.platforms?.workbuddy?.refreshToken),
-                userId: file.platforms?.workbuddy?.userId ?? "",
-                baseUrl: file.platforms?.workbuddy?.baseUrl ?? "",
-                allowedUserIds: (file.platforms?.workbuddy?.allowedUserIds ?? []).join(", "),
-            },
-            clawbot: {
-                enabled: file.platforms?.clawbot?.enabled ?? Boolean(file.platforms?.clawbot?.apiToken),
-                aiCommand: normalizeAiCommand(file.platforms?.clawbot?.aiCommand, "claude"),
-                apiUrl: file.platforms?.clawbot?.apiUrl ?? "http://127.0.0.1:26322",
-                apiToken: maskSecret(file.platforms?.clawbot?.apiToken),
-                allowedUserIds: (file.platforms?.clawbot?.allowedUserIds ?? []).join(", "),
-            },
-        },
-        ai: {
-            claudeWorkDir: file.tools?.claude?.workDir ?? process.cwd(),
-            claudeConfigPath: process.platform === 'win32'
-                ? getClaudeConfigHome() + "\\.claude\\settings.json"
-                : getClaudeConfigHome() + "/.claude/settings.json",
-            claudeAuthToken: maskSecret(claudeEnv.ANTHROPIC_AUTH_TOKEN),
-            claudeBaseUrl: claudeEnv.ANTHROPIC_BASE_URL ?? "",
-            claudeModel: claudeEnv.ANTHROPIC_MODEL ?? "",
-            claudeProxy: file.tools?.claude?.proxy ?? "",
-            codexCliPath: file.tools?.codex?.cliPath ?? "codex",
-            codebuddyCliPath: file.tools?.codebuddy?.cliPath ?? "codebuddy",
-            opencodeCliPath: file.tools?.opencode?.cliPath ?? "opencode",
-            codexProxy: file.tools?.codex?.proxy ?? "",
-            codexApiKey: (() => {
-                if (process.env.OPENAI_API_KEY)
-                    return maskSecret(process.env.OPENAI_API_KEY);
-                for (const p of CODEX_AUTH_PATHS) {
-                    try {
-                        if (existsSync(p)) {
-                            const raw = JSON.parse(readFileSync(p, "utf-8"));
-                            const key = raw?.openai_api_key ?? raw?.apiKey;
-                            if (typeof key === "string" && key)
-                                return maskSecret(key);
-                        }
-                    }
-                    catch { /* ignore */ }
-                }
-                return "";
-            })(),
-            logDir: file.logDir ?? "",
-            logLevel: file.logLevel ?? "default",
-        },
-    };
-}
-function validatePayload(payload) {
-    const errors = [];
-    const enabledCount = Object.values(payload.platforms).filter((item) => item.enabled).length;
-    if (enabledCount === 0)
-        errors.push("At least one platform must be enabled.");
-    if (payload.platforms.telegram.enabled && !clean(payload.platforms.telegram.botToken))
-        errors.push("Telegram bot token is required.");
-    if (payload.platforms.feishu.enabled && !clean(payload.platforms.feishu.appId))
-        errors.push("Feishu app ID is required.");
-    if (payload.platforms.feishu.enabled && !clean(payload.platforms.feishu.appSecret))
-        errors.push("Feishu app secret is required.");
-    if (payload.platforms.qq.enabled && !clean(payload.platforms.qq.appId))
-        errors.push("QQ app ID is required.");
-    if (payload.platforms.qq.enabled && !clean(payload.platforms.qq.secret))
-        errors.push("QQ app secret is required.");
-    if (payload.platforms.wework.enabled && !clean(payload.platforms.wework.corpId))
-        errors.push("WeWork corp ID is required.");
-    if (payload.platforms.wework.enabled && !clean(payload.platforms.wework.secret))
-        errors.push("WeWork secret is required.");
-    if (payload.platforms.dingtalk.enabled && !clean(payload.platforms.dingtalk.clientId))
-        errors.push("DingTalk client ID is required.");
-    if (payload.platforms.dingtalk.enabled && !clean(payload.platforms.dingtalk.clientSecret))
-        errors.push("DingTalk client secret is required.");
-    if (payload.platforms.workbuddy.enabled && !clean(payload.platforms.workbuddy.accessToken))
-        errors.push("WorkBuddy access token is required.");
-    if (payload.platforms.workbuddy.enabled && !clean(payload.platforms.workbuddy.refreshToken))
-        errors.push("WorkBuddy refresh token is required.");
-    if (payload.platforms.workbuddy.enabled && !clean(payload.platforms.workbuddy.userId))
-        errors.push("WorkBuddy user ID is required.");
-    if (payload.platforms.clawbot.enabled && !clean(payload.platforms.clawbot.apiToken))
-        errors.push("ClawBot API token is required.");
-    if (!clean(payload.ai.claudeWorkDir))
-        errors.push("Default work directory is required.");
-    return errors;
-}
-function validateConfigForPlatform(platform, config) {
-    const errors = [];
-    const c = config;
-    switch (platform) {
-        case "telegram":
-            if (!c.botToken || typeof c.botToken !== "string" || !clean(c.botToken)) {
-                errors.push("Telegram bot token is required and must be a non-empty string.");
-            }
-            if (c.proxy && typeof c.proxy !== "string") {
-                errors.push("Proxy must be a string if provided.");
-            }
-            break;
-        case "feishu":
-            if (!c.appId || typeof c.appId !== "string" || !clean(c.appId)) {
-                errors.push("Feishu app ID is required and must be a non-empty string.");
-            }
-            if (!c.appSecret || typeof c.appSecret !== "string" || !clean(c.appSecret)) {
-                errors.push("Feishu app secret is required and must be a non-empty string.");
-            }
-            break;
-        case "qq":
-            if (!c.appId || typeof c.appId !== "string" || !clean(c.appId)) {
-                errors.push("QQ app ID is required and must be a non-empty string.");
-            }
-            if (!c.secret || typeof c.secret !== "string" || !clean(c.secret)) {
-                errors.push("QQ app secret is required and must be a non-empty string.");
-            }
-            break;
-        case "wework":
-            if (!c.corpId || typeof c.corpId !== "string" || !clean(c.corpId)) {
-                errors.push("WeWork corp ID is required and must be a non-empty string.");
-            }
-            if (!c.secret || typeof c.secret !== "string" || !clean(c.secret)) {
-                errors.push("WeWork secret is required and must be a non-empty string.");
-            }
-            break;
-        case "dingtalk":
-            if (!c.clientId || typeof c.clientId !== "string" || !clean(c.clientId)) {
-                errors.push("DingTalk client ID is required and must be a non-empty string.");
-            }
-            if (!c.clientSecret || typeof c.clientSecret !== "string" || !clean(c.clientSecret)) {
-                errors.push("DingTalk client secret is required and must be a non-empty string.");
-            }
-            break;
-        case "workbuddy":
-            if (!c.accessToken || typeof c.accessToken !== "string" || !clean(c.accessToken)) {
-                errors.push("WorkBuddy access token is required and must be a non-empty string.");
-            }
-            if (!c.refreshToken || typeof c.refreshToken !== "string" || !clean(c.refreshToken)) {
-                errors.push("WorkBuddy refresh token is required and must be a non-empty string.");
-            }
-            if (!c.userId || typeof c.userId !== "string" || !clean(c.userId)) {
-                errors.push("WorkBuddy user ID is required and must be a non-empty string.");
-            }
-            break;
-        case "clawbot":
-            if (!c.apiToken || typeof c.apiToken !== "string" || !clean(c.apiToken)) {
-                errors.push("ClawBot API token is required and must be a non-empty string.");
-            }
-            break;
-        default:
-            errors.push(`Unknown platform: ${platform}`);
-    }
-    return errors;
-}
-function toErrorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-async function readJsonResponse(response) {
-    const text = await response.text();
-    if (!text)
-        return {};
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        throw new Error(`Unexpected non-JSON response: ${text.slice(0, 200)}`);
-    }
-}
-function createProbeConfig(values) {
-    return {
-        enabledPlatforms: [],
-        allowedUserIds: [],
-        telegramAllowedUserIds: [],
-        feishuAllowedUserIds: [],
-        qqAllowedUserIds: [],
-        weworkAllowedUserIds: [],
-        dingtalkAllowedUserIds: [],
-        workbuddyAllowedUserIds: [],
-        clawbotAllowedUserIds: [],
-        codexCliPath: "codex",
-        claudeWorkDir: process.cwd(),
-        claudeSessionIdleTtlMinutes: 30,
-        logDir: "",
-        logLevel: "INFO",
-        telemetry: { enabled: true },
-        codebuddyCliPath: "codebuddy",
-        opencodeCliPath: "opencode",
-        platforms: {},
-        ...values,
-    };
-}
-async function probeTelegram(config) {
-    const botToken = clean(String(config.botToken ?? ""));
-    if (!botToken)
-        throw new Error("Telegram bot token is required.");
-    const response = await fetch(`https://api.telegram.org/bot${botToken}/getMe`, {
-        signal: AbortSignal.timeout(PLATFORM_TEST_TIMEOUT_MS),
-    });
-    const body = await readJsonResponse(response);
-    if (!response.ok || body.ok !== true) {
-        throw new Error(String(body.description ?? body.error_code ?? `HTTP ${response.status}`));
-    }
-    const result = (body.result ?? {});
-    const username = typeof result.username === "string" ? `@${result.username}` : "bot";
-    return `Telegram reachable as ${username}.`;
-}
-async function probeFeishu(config) {
-    const appId = clean(String(config.appId ?? ""));
-    const appSecret = clean(String(config.appSecret ?? ""));
-    if (!appId || !appSecret)
-        throw new Error("Feishu app ID and app secret are required.");
-    const response = await fetch("https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ app_id: appId, app_secret: appSecret }),
-        signal: AbortSignal.timeout(PLATFORM_TEST_TIMEOUT_MS),
-    });
-    const body = await readJsonResponse(response);
-    if (!response.ok || body.code !== 0) {
-        throw new Error(String(body.msg ?? body.message ?? `HTTP ${response.status}`));
-    }
-    return "Feishu credentials are valid.";
-}
-async function probeQQ(config) {
-    const appId = clean(String(config.appId ?? ""));
-    const secret = clean(String(config.secret ?? ""));
-    if (!appId || !secret)
-        throw new Error("QQ app ID and app secret are required.");
-    const response = await fetch("https://bots.qq.com/app/getAppAccessToken", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ appId, clientSecret: secret }),
-        signal: AbortSignal.timeout(PLATFORM_TEST_TIMEOUT_MS),
-    });
-    const body = await readJsonResponse(response);
-    if (!response.ok || typeof body.access_token !== "string" || body.access_token.length === 0) {
-        throw new Error(String(body.message ?? `HTTP ${response.status}`));
-    }
-    return "QQ credentials are valid.";
-}
-async function probeWeWork(config) {
-    const corpId = clean(String(config.corpId ?? ""));
-    const secret = clean(String(config.secret ?? ""));
-    if (!corpId || !secret)
-        throw new Error("WeWork corp ID and secret are required.");
-    try {
-        await initWeWork(createProbeConfig({ weworkCorpId: corpId, weworkSecret: secret }), async () => { });
-        return "WeWork WebSocket authentication succeeded.";
-    }
-    finally {
-        stopWeWork();
-    }
-}
-async function probeDingTalk(config) {
-    const clientId = clean(String(config.clientId ?? ""));
-    const clientSecret = clean(String(config.clientSecret ?? ""));
-    if (!clientId || !clientSecret)
-        throw new Error("DingTalk client ID and client secret are required.");
-    const client = new DWClient({
-        clientId,
-        clientSecret,
-        keepAlive: false,
-        debug: false,
-    });
-    const token = await Promise.race([
-        client.getAccessToken(),
-        new Promise((_, reject) => setTimeout(() => reject(new Error("DingTalk access token request timed out.")), PLATFORM_TEST_TIMEOUT_MS)),
-    ]);
-    if (typeof token !== "string" || token.length === 0) {
-        throw new Error("DingTalk did not return an access token.");
-    }
-    return "DingTalk credentials are valid.";
-}
-async function probeWorkBuddy(config) {
-    const accessToken = clean(String(config.accessToken ?? ""));
-    const refreshToken = clean(String(config.refreshToken ?? ""));
-    const userId = clean(String(config.userId ?? ""));
-    if (!accessToken || !refreshToken || !userId)
-        throw new Error("WorkBuddy access token, refresh token, and user ID are required.");
-    const baseUrl = clean(String(config.baseUrl ?? "")) || "https://copilot.tencent.com";
-    // Validate credentials by attempting to register workspace (same endpoint as runtime)
-    const response = await fetch(`${baseUrl}/v2/agentos/localagent/registerWorkspace`, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            "authorization": `Bearer ${accessToken}`,
-        },
-        body: JSON.stringify({
-            userId,
-            hostId: "open-im-test",
-            workspaceId: "open-im-test-workspace",
-            workspaceName: "OpenIM Test Workspace",
-            localAgentType: "ide",
-        }),
-        signal: AbortSignal.timeout(PLATFORM_TEST_TIMEOUT_MS),
-    });
-    if (!response.ok) {
-        const body = await response.text();
-        throw new Error(`WorkBuddy authentication failed: ${body.slice(0, 200) || `HTTP ${response.status}`}`);
-    }
-    return "WorkBuddy credentials are valid.";
-}
-async function probeClawBot(config) {
-    const apiUrl = clean(String(config.apiUrl ?? "http://127.0.0.1:26322"));
-    const apiToken = clean(String(config.apiToken ?? ""));
-    if (!apiToken)
-        throw new Error("ClawBot API token is required.");
-    const { randomUUID } = await import('node:crypto');
-    const response = await fetch(`${apiUrl}/ilink/bot/getupdates?timeout=1&bot_token=${encodeURIComponent(apiToken)}`, {
-        headers: {
-            'Content-Type': 'application/json',
-            'AuthorizationType': 'ilink_bot_token',
-            'iLink-App-Id': 'bot',
-            'iLink-App-ClientVersion': '131588',
-            'X-WECHAT-UIN': randomUUID(),
-        },
-        signal: AbortSignal.timeout(PLATFORM_TEST_TIMEOUT_MS),
-    });
-    const body = await readJsonResponse(response);
-    const ok = body.ok === true || body.ret === 0 || body.ret === '0';
-    if (!response.ok || !ok) {
-        throw new Error(String(body.error ?? body.description ?? `HTTP ${response.status}`));
-    }
-    return "ClawBot API reachable.";
-}
-export async function testPlatformConfig(platform, config) {
-    const errors = validateConfigForPlatform(platform, config);
-    if (errors.length > 0) {
-        throw new Error(errors.join("; "));
-    }
-    switch (platform) {
-        case "telegram":
-            return probeTelegram(config);
-        case "feishu":
-            return probeFeishu(config);
-        case "qq":
-            return probeQQ(config);
-        case "wework":
-            return probeWeWork(config);
-        case "dingtalk":
-            return probeDingTalk(config);
-        case "workbuddy":
-            return probeWorkBuddy(config);
-        case "clawbot":
-            return probeClawBot(config);
-        default:
-            throw new Error(`Unknown platform: ${platform}`);
-    }
-}
-function toFileConfig(payload, existing) {
-    // Save Claude environment variables to ~/.claude/settings.json
-    const claudeEnv = {};
-    const existingClaudeEnv = loadClaudeSettingsEnv();
-    const resolvedAuthToken = resolveSecret(payload.ai.claudeAuthToken, existingClaudeEnv.ANTHROPIC_AUTH_TOKEN);
-    if (resolvedAuthToken)
-        claudeEnv.ANTHROPIC_AUTH_TOKEN = resolvedAuthToken;
-    if (payload.ai.claudeBaseUrl)
-        claudeEnv.ANTHROPIC_BASE_URL = payload.ai.claudeBaseUrl;
-    if (payload.ai.claudeModel)
-        claudeEnv.ANTHROPIC_MODEL = payload.ai.claudeModel;
-    if (Object.keys(claudeEnv).length > 0) {
-        saveClaudeSettingsEnv(claudeEnv);
-    }
-    // claudeConfigPath is informational only, not saved
-    const { env: _discardLegacyRootEnv, aiCommand: _discardLegacyGlobalAi, ...existingWithoutRootEnv } = existing;
-    return {
-        ...existingWithoutRootEnv,
-        logDir: payload.ai.logDir === undefined ? existing.logDir : clean(payload.ai.logDir),
-        logLevel: payload.ai.logLevel === "default" ? undefined : payload.ai.logLevel,
-        tools: {
-            claude: {
-                ...existing.tools?.claude,
-                workDir: clean(payload.ai.claudeWorkDir) ?? process.cwd(),
-                proxy: clean(payload.ai.claudeProxy),
-                // model is now saved to ~/.claude/settings.json as env var
-            },
-            codex: {
-                ...existing.tools?.codex,
-                cliPath: clean(payload.ai.codexCliPath) ?? "codex",
-                workDir: clean(payload.ai.claudeWorkDir) ?? process.cwd(),
-                proxy: clean(payload.ai.codexProxy),
-            },
-            codebuddy: {
-                ...existing.tools?.codebuddy,
-                cliPath: clean(payload.ai.codebuddyCliPath) ?? "codebuddy",
-            },
-            opencode: {
-                ...existing.tools?.opencode,
-                cliPath: clean(payload.ai.opencodeCliPath) ?? "opencode",
-            },
-        },
-        platforms: {
-            ...existing.platforms,
-            telegram: {
-                ...existing.platforms?.telegram,
-                enabled: payload.platforms.telegram.enabled,
-                aiCommand: persistedPlatformAi(payload.platforms.telegram.aiCommand),
-                botToken: resolveSecret(payload.platforms.telegram.botToken, existing.platforms?.telegram?.botToken),
-                proxy: clean(payload.platforms.telegram.proxy),
-                allowedUserIds: splitCsv(payload.platforms.telegram.allowedUserIds),
-            },
-            feishu: {
-                ...existing.platforms?.feishu,
-                enabled: payload.platforms.feishu.enabled,
-                aiCommand: persistedPlatformAi(payload.platforms.feishu.aiCommand),
-                appId: clean(payload.platforms.feishu.appId),
-                appSecret: resolveSecret(payload.platforms.feishu.appSecret, existing.platforms?.feishu?.appSecret),
-                allowedUserIds: splitCsv(payload.platforms.feishu.allowedUserIds),
-            },
-            qq: {
-                ...existing.platforms?.qq,
-                enabled: payload.platforms.qq.enabled,
-                aiCommand: persistedPlatformAi(payload.platforms.qq.aiCommand),
-                appId: clean(payload.platforms.qq.appId),
-                secret: resolveSecret(payload.platforms.qq.secret, existing.platforms?.qq?.secret),
-                allowedUserIds: splitCsv(payload.platforms.qq.allowedUserIds),
-            },
-            wework: {
-                ...existing.platforms?.wework,
-                enabled: payload.platforms.wework.enabled,
-                aiCommand: persistedPlatformAi(payload.platforms.wework.aiCommand),
-                corpId: clean(payload.platforms.wework.corpId),
-                secret: resolveSecret(payload.platforms.wework.secret, existing.platforms?.wework?.secret),
-                allowedUserIds: splitCsv(payload.platforms.wework.allowedUserIds),
-            },
-            dingtalk: {
-                ...existing.platforms?.dingtalk,
-                enabled: payload.platforms.dingtalk.enabled,
-                aiCommand: persistedPlatformAi(payload.platforms.dingtalk.aiCommand),
-                clientId: clean(payload.platforms.dingtalk.clientId),
-                clientSecret: resolveSecret(payload.platforms.dingtalk.clientSecret, existing.platforms?.dingtalk?.clientSecret),
-                cardTemplateId: clean(payload.platforms.dingtalk.cardTemplateId),
-                allowedUserIds: splitCsv(payload.platforms.dingtalk.allowedUserIds),
-            },
-            workbuddy: {
-                ...existing.platforms?.workbuddy,
-                enabled: payload.platforms.workbuddy.enabled,
-                aiCommand: persistedPlatformAi(payload.platforms.workbuddy.aiCommand),
-                accessToken: resolveSecret(payload.platforms.workbuddy.accessToken, existing.platforms?.workbuddy?.accessToken),
-                refreshToken: resolveSecret(payload.platforms.workbuddy.refreshToken, existing.platforms?.workbuddy?.refreshToken),
-                userId: clean(payload.platforms.workbuddy.userId),
-                baseUrl: clean(payload.platforms.workbuddy.baseUrl),
-                allowedUserIds: splitCsv(payload.platforms.workbuddy.allowedUserIds),
-            },
-            clawbot: {
-                ...existing.platforms?.clawbot,
-                enabled: payload.platforms.clawbot.enabled,
-                aiCommand: persistedPlatformAi(payload.platforms.clawbot.aiCommand),
-                apiUrl: clean(payload.platforms.clawbot.apiUrl) ?? "http://127.0.0.1:26322",
-                apiToken: resolveSecret(payload.platforms.clawbot.apiToken, existing.platforms?.clawbot?.apiToken),
-                allowedUserIds: splitCsv(payload.platforms.clawbot.allowedUserIds),
-            },
-        },
-    };
-}
-function openBrowser(url) {
-    // 显式关闭自动打开浏览器（服务器环境推荐设置）
-    if (process.env.OPEN_IM_NO_BROWSER === "1") {
-        return;
-    }
-    // 在无 TTY 且无图形环境（常见于服务器）时直接跳过，避免无意义的 xdg-open 调用
-    if (!process.stdout.isTTY && !process.env.DISPLAY) {
-        log.info(`Skipping browser launch for URL ${url} (no TTY/DISPLAY detected).`);
-        return;
-    }
-    const safeSpawn = (command, args) => {
-        try {
-            const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: process.platform === "win32" });
-            // 防止 ENOENT 之类的错误变成未捕获异常
-            child.on("error", (error) => {
-                log.warn(`Failed to launch browser command "${command}": ${error.code ?? error.message}`);
-            });
-            child.unref();
-        }
-        catch (error) {
-            log.warn(`Failed to spawn browser command "${command}": ${error instanceof Error ? error.message : String(error)}`);
-        }
-    };
-    if (process.platform === "win32") {
-        safeSpawn("cmd", ["/c", "start", "", url]);
-        return;
-    }
-    if (process.platform === "darwin") {
-        safeSpawn("open", [url]);
-        return;
-    }
-    // linux / 其他 UNIX 平台：优先尝试 xdg-open，失败时仅记录日志，不抛出
-    safeSpawn("xdg-open", [url]);
-}
-export function getWebConfigPort() {
-    const fromEnv = process.env.OPEN_IM_WEB_PORT ? parseInt(process.env.OPEN_IM_WEB_PORT, 10) : NaN;
-    return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : WEB_CONFIG_PORT;
-}
-export function getWebConfigUrl() {
-    return `http://127.0.0.1:${getWebConfigPort()}`;
-}
-function openWebConfigUrl() {
-    openBrowser(getPublicWebDashboardUrl());
-}
 export async function startWebConfigServer(options) {
     let timer = null;
     let settled = false;
@@ -854,11 +62,9 @@ export async function startWebConfigServer(options) {
         if (shouldRequireAuth) {
             const loginToken = requestUrl.searchParams.get("login_token");
             if (loginToken) {
-                const info = pendingLogins.get(loginToken);
-                const now = Date.now();
-                if (info && info.expiresAt > now) {
+                const info = consumeLoginToken(loginToken);
+                if (info) {
                     // 有效的一次性登录 token：创建会话，设置 Cookie，并重定向到去掉 login_token 的 URL
-                    pendingLogins.delete(loginToken);
                     const sessionTtlMs = 24 * 60 * 60 * 1000; // 24 小时
                     const sessionId = createSession(request, sessionTtlMs);
                     const cookie = buildSessionCookie(sessionId, sessionTtlMs);
@@ -1149,7 +355,7 @@ export async function startWebConfigServer(options) {
             try {
                 const { startQRLogin } = await import("./clawbot/qr-login.js");
                 const session = await startQRLogin();
-                json(response, 200, { success: true, qrcodeUrl: session.qrcodeUrl, sessionKey: session.sessionKey }, request);
+                json(response, 200, { success: true, qrcodeUrl: session.qrcodeUrl, qrcodeImage: session.qrcodeImage, qrcode: session.qrcode, sessionKey: session.sessionKey }, request);
             }
             catch (error) {
                 json(response, 500, { success: false, error: toErrorMessage(error) }, request);
@@ -1169,6 +375,33 @@ export async function startWebConfigServer(options) {
             }
             return;
         }
+        if (request.method === "POST" && requestUrl.pathname === "/api/workbuddy/qr-login/start") {
+            try {
+                const { WorkBuddyOAuth } = await import("./workbuddy/oauth.js");
+                const QRCode = (await import("qrcode")).default;
+                const oauth = new WorkBuddyOAuth();
+                const { authUrl, state } = await oauth.fetchAuthState();
+                const qrcodeImage = await QRCode.toDataURL(authUrl, { width: 280, margin: 1 });
+                json(response, 200, { success: true, qrcodeImage, state, authUrl }, request);
+            }
+            catch (error) {
+                json(response, 500, { success: false, error: toErrorMessage(error) }, request);
+            }
+            return;
+        }
+        if (request.method === "POST" && requestUrl.pathname === "/api/workbuddy/qr-login/wait") {
+            try {
+                const body = await readJson(request);
+                const { WorkBuddyOAuth } = await import("./workbuddy/oauth.js");
+                const oauth = new WorkBuddyOAuth();
+                const result = await oauth.pollToken(body.state);
+                json(response, 200, { success: true, accessToken: result.accessToken, refreshToken: result.refreshToken, userId: result.userId }, request);
+            }
+            catch (error) {
+                json(response, 500, { success: false, error: toErrorMessage(error) }, request);
+            }
+            return;
+        }
         if (request.method === "GET" && tryServeDashboardStatic(requestUrl, request, response, mergeCors)) {
             return;
         }
@@ -1209,11 +442,8 @@ export async function startWebConfigServer(options) {
     // 当绑定到非 127.0.0.1（例如 0.0.0.0）时，为远程访问生成一次性登录链接
     if (host !== "127.0.0.1") {
         const loginTtlMs = 15 * 60 * 1000; // 15 分钟内有效
-        const loginToken = createLoginToken(loginTtlMs);
-        const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
-        const baseUrl = `http://${displayHost}:${port}`;
-        const loginUrl = `${baseUrl}/?login_token=${encodeURIComponent(loginToken)}`;
-        loginUrlForReturn = loginUrl;
+        loginUrlForReturn = generateLoginUrl(host, port, loginTtlMs);
+        const loginUrl = loginUrlForReturn;
         log.info("━━━━━━━━ Web Config Login ━━━━━━━━");
         log.info(`Host binding : ${host}`);
         log.info(`Login URL    : ${loginUrl}`);