@wu529778790/open-im 1.11.8-beta.7 → 1.11.8-beta.8

package/dist/adapters/codebuddy-adapter.js

@@ -1,4 +1,5 @@
 import { runCodeBuddy } from '../codebuddy/cli-runner.js';
+import { isSessionInvalidMessage } from '../shared/session-invalid-detector.js';
 export class CodeBuddyAdapter {
     cliPath;
     toolId = 'codebuddy';
@@ -10,25 +11,10 @@ export class CodeBuddyAdapter {
             onText: callbacks.onText,
             onThinking: callbacks.onThinking,
             onToolUse: callbacks.onToolUse,
-            onComplete: (raw) => {
-                const result = {
-                    success: raw.success,
-                    result: raw.result,
-                    accumulated: raw.accumulated,
-                    cost: raw.cost,
-                    durationMs: raw.durationMs,
-                    model: raw.model,
-                    numTurns: raw.numTurns,
-                    toolStats: raw.toolStats,
-                };
-                callbacks.onComplete(result);
-            },
+            onComplete: callbacks.onComplete,
             onError: (err) => {
                 const msg = typeof err === 'string' ? err : String(err);
-                const friendly = msg.includes('No conversation found') ||
-                    msg.includes('Session not found') ||
-                    msg.includes('Invalid session') ||
-                    msg.includes('Unable to resume')
+                const friendly = isSessionInvalidMessage(msg)
                     ? 'CodeBuddy 会话已失效，旧 session 已清理。请直接重试当前请求。'
                     : msg;
                 callbacks.onError(friendly);

package/dist/adapters/codex-adapter.js

@@ -2,6 +2,7 @@
  * Codex Adapter - run tasks through OpenAI Codex CLI (`codex exec`)
  */
 import { runCodex } from "../codex/cli-runner.js";
+import { isSessionInvalidMessage } from "../shared/session-invalid-detector.js";
 export class CodexAdapter {
     cliPath;
     toolId = "codex";
@@ -21,24 +22,10 @@ export class CodexAdapter {
             onText: callbacks.onText,
             onThinking: callbacks.onThinking,
             onToolUse: callbacks.onToolUse,
-            onComplete: (raw) => {
-                const result = {
-                    success: raw.success,
-                    result: raw.result,
-                    accumulated: raw.accumulated,
-                    cost: raw.cost,
-                    durationMs: raw.durationMs,
-                    model: raw.model,
-                    numTurns: raw.numTurns,
-                    toolStats: raw.toolStats,
-                };
-                callbacks.onComplete(result);
-            },
+            onComplete: callbacks.onComplete,
             onError: (err) => {
                 const msg = typeof err === "string" ? err : String(err);
-                const friendly = msg.includes("No session found") ||
-                    msg.includes("No conversation found") ||
-                    msg.includes("Unable to find session")
+                const friendly = isSessionInvalidMessage(msg)
                     ? "Codex 会话已失效，旧 session 已清理。请直接重试当前请求。"
                     : msg;
                 callbacks.onError(friendly);

package/dist/adapters/opencode-adapter.js

@@ -1,4 +1,5 @@
 import { runOpenCodeSdk } from '../opencode/sdk-runner.js';
+import { isSessionInvalidMessage } from '../shared/session-invalid-detector.js';
 export class OpenCodeAdapter {
     toolId = 'opencode';
     run(prompt, sessionId, workDir, callbacks, options) {
@@ -6,24 +7,10 @@ export class OpenCodeAdapter {
             onText: callbacks.onText,
             onThinking: callbacks.onThinking,
             onToolUse: callbacks.onToolUse,
-            onComplete: (raw) => {
-                const result = {
-                    success: raw.success,
-                    result: raw.result,
-                    accumulated: raw.accumulated,
-                    cost: raw.cost,
-                    durationMs: raw.durationMs,
-                    model: raw.model,
-                    numTurns: raw.numTurns,
-                    toolStats: raw.toolStats,
-                };
-                callbacks.onComplete(result);
-            },
+            onComplete: callbacks.onComplete,
             onError: (err) => {
                 const msg = typeof err === 'string' ? err : String(err);
-                const friendly = msg.includes('session not found') ||
-                    msg.includes('Session not found') ||
-                    msg.includes('no sessions found')
+                const friendly = isSessionInvalidMessage(msg)
                     ? 'OpenCode 会话已失效，旧 session 已清理。请直接重试当前请求。'
                     : msg;
                 callbacks.onError(friendly);

package/dist/codebuddy/cli-runner.d.ts

@@ -1,29 +1,9 @@
-export interface CodeBuddyRunCallbacks {
-    onText: (accumulated: string) => void;
-    onThinking?: (accumulated: string) => void;
-    onToolUse?: (toolName: string, toolInput?: Record<string, unknown>) => void;
-    onComplete: (result: {
-        success: boolean;
-        result: string;
-        accumulated: string;
-        cost: number;
-        durationMs: number;
-        model?: string;
-        numTurns: number;
-        toolStats: Record<string, number>;
-    }) => void;
-    onError: (error: string) => void;
-    onSessionId?: (sessionId: string) => void;
-    onSessionInvalid?: () => void;
-}
+import type { RunCallbacks, RunHandle } from '../adapters/tool-adapter.interface.js';
 export interface CodeBuddyRunOptions {
     skipPermissions?: boolean;
     permissionMode?: 'default' | 'acceptEdits' | 'plan';
     model?: string;
 }
-export interface CodeBuddyRunHandle {
-    abort: () => void;
-}
 export declare function buildCodeBuddyArgs(prompt: string, sessionId: string | undefined, options?: CodeBuddyRunOptions): string[];
 export declare function extractBufferedPayloads(state: {
     buffer: string;
@@ -41,4 +21,4 @@ export declare function flushBufferedPayloads(state: {
  * - 其他情况 → 拼接（不丢内容）
  */
 export declare function mergeAssistantReply(previous: string, incoming: string): string;
-export declare function runCodeBuddy(cliPath: string, prompt: string, sessionId: string | undefined, workDir: string, callbacks: CodeBuddyRunCallbacks, options?: CodeBuddyRunOptions): CodeBuddyRunHandle;
+export declare function runCodeBuddy(cliPath: string, prompt: string, sessionId: string | undefined, workDir: string, callbacks: RunCallbacks, options?: CodeBuddyRunOptions): RunHandle;

package/dist/codebuddy/cli-runner.js

@@ -2,8 +2,9 @@ import { execFileSync, spawn } from 'node:child_process';
 import { accessSync, constants } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import { createLogger } from '../logger.js';
-import { processEnvForNonClaudeCliChild } from '../config/file-io.js';
 import { killProcessTree, trackChild } from '../shared/process-kill.js';
+import { isSessionInvalidMessage } from '../shared/session-invalid-detector.js';
+import { clearWallClockTimeout, buildBaseSpawnOptions } from '../shared/cli-runner-base.js';
 const log = createLogger('CodeBuddyCli');
 export function buildCodeBuddyArgs(prompt, sessionId, options) {
     const args = ['--print', '--output-format', 'stream-json'];
@@ -190,24 +191,12 @@ export function runCodeBuddy(cliPath, prompt, sessionId, workDir, callbacks, opt
         ...options,
         permissionMode: normalizePermissionMode(options?.permissionMode),
     });
-    const env = processEnvForNonClaudeCliChild();
-    if (process.platform === 'win32') {
-        env.LANG = env.LANG || 'C.UTF-8';
-        env.LC_ALL = env.LC_ALL || 'C.UTF-8';
-    }
     const isCmd = process.platform === 'win32' && (/\.(cmd|bat)$/i.test(normalizedCliPath) ||
         normalizedCliPath === 'codebuddy');
     const spawnCmd = isCmd ? 'cmd.exe' : normalizedCliPath;
     const spawnArgs = isCmd ? ['/c', normalizedCliPath, ...args] : args;
     log.info(`Spawning CodeBuddy CLI: path=${normalizedCliPath}, cwd=${workDir}, session=${sessionId ?? 'new'}, args=${args.join(' ')}`);
-    const child = spawn(spawnCmd, spawnArgs, {
-        cwd: workDir,
-        // Unix 上放入独立进程组，使 abort/关停能用 process.kill(-pid) 杀掉整棵子树（含 MCP/shell 孙进程）
-        detached: process.platform !== 'win32',
-        stdio: ['ignore', 'pipe', 'pipe'],
-        env,
-        windowsHide: process.platform === 'win32',
-    });
+    const child = spawn(spawnCmd, spawnArgs, buildBaseSpawnOptions(workDir, ['ignore', 'pipe', 'pipe']));
     trackChild(child);
     let cliTimeoutHandle = null;
     let accumulated = '';
@@ -222,7 +211,7 @@ export function runCodeBuddy(cliPath, prompt, sessionId, workDir, callbacks, opt
     const MAX_STDERR = 8 * 1024;
     let stderrText = '';
     const handleErrorText = (message) => {
-        if (sessionId && /No conversation found|Session not found|Invalid session|Unable to resume/i.test(message)) {
+        if (sessionId && isSessionInvalidMessage(message)) {
             callbacks.onSessionInvalid?.();
         }
         callbacks.onError(message);
@@ -317,10 +306,8 @@ export function runCodeBuddy(cliPath, prompt, sessionId, workDir, callbacks, opt
         }
     });
     child.on('close', (code) => {
-        if (cliTimeoutHandle) {
-            clearTimeout(cliTimeoutHandle);
-            cliTimeoutHandle = null;
-        }
+        clearWallClockTimeout(cliTimeoutHandle);
+        cliTimeoutHandle = null;
         if (completed)
             return;
         if (stdoutState.buffer.trim()) {
@@ -353,10 +340,8 @@ export function runCodeBuddy(cliPath, prompt, sessionId, workDir, callbacks, opt
         });
     });
     child.on('error', (err) => {
-        if (cliTimeoutHandle) {
-            clearTimeout(cliTimeoutHandle);
-            cliTimeoutHandle = null;
-        }
+        clearWallClockTimeout(cliTimeoutHandle);
+        cliTimeoutHandle = null;
         if (completed)
             return;
         completed = true;
@@ -378,10 +363,7 @@ export function runCodeBuddy(cliPath, prompt, sessionId, workDir, callbacks, opt
             if (completed)
                 return;
             completed = true;
-            if (cliTimeoutHandle) {
-                clearTimeout(cliTimeoutHandle);
-                cliTimeoutHandle = null;
-            }
+            clearWallClockTimeout(cliTimeoutHandle);
             killProcessTree(child);
         },
     };

package/dist/codex/cli-runner.d.ts

@@ -1,24 +1,7 @@
 /**
  * Codex CLI runner for `codex exec --json` JSONL output.
  */
-export interface CodexRunCallbacks {
-    onText: (accumulated: string) => void;
-    onThinking?: (accumulated: string) => void;
-    onToolUse?: (toolName: string, toolInput?: Record<string, unknown>) => void;
-    onComplete: (result: {
-        success: boolean;
-        result: string;
-        accumulated: string;
-        cost: number;
-        durationMs: number;
-        model?: string;
-        numTurns: number;
-        toolStats: Record<string, number>;
-    }) => void;
-    onError: (error: string) => void;
-    onSessionId?: (sessionId: string) => void;
-    onSessionInvalid?: () => void;
-}
+import type { RunCallbacks, RunHandle } from '../adapters/tool-adapter.interface.js';
 export interface CodexRunOptions {
     skipPermissions?: boolean;
     permissionMode?: 'default' | 'acceptEdits' | 'plan';
@@ -27,9 +10,6 @@ export interface CodexRunOptions {
     hookPort?: number;
     proxy?: string;
 }
-export interface CodexRunHandle {
-    abort: () => void;
-}
 export declare function extractPromptImagePaths(prompt: string): string[];
 export declare function buildCodexArgs(prompt: string, sessionId: string | undefined, workDir: string, options?: CodexRunOptions): string[];
-export declare function runCodex(cliPath: string, prompt: string, sessionId: string | undefined, workDir: string, callbacks: CodexRunCallbacks, options?: CodexRunOptions): CodexRunHandle;
+export declare function runCodex(cliPath: string, prompt: string, sessionId: string | undefined, workDir: string, callbacks: RunCallbacks, options?: CodexRunOptions): RunHandle;

package/dist/codex/cli-runner.js

@@ -6,8 +6,9 @@ import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { createLogger } from '../logger.js';
-import { processEnvForNonClaudeCliChild } from '../config/file-io.js';
 import { killProcessTree, trackChild } from '../shared/process-kill.js';
+import { isSessionInvalidMessage } from '../shared/session-invalid-detector.js';
+import { createStderrBuffer, appendStderr, reconstructStderr, createFinalizeGate, isFinalizeReady, clearWallClockTimeout, buildBaseSpawnOptions, } from '../shared/cli-runner-base.js';
 const log = createLogger('CodexCli');
 const windowsCodexLaunchCache = new Map();
 const SUPPORTED_IMAGE_EXTENSIONS = new Set([
@@ -163,22 +164,18 @@ function resolveWindowsCodexLaunch(cliPath, args) {
 }
 export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options) {
     const args = buildCodexArgs(prompt, sessionId, workDir, options);
-    const env = processEnvForNonClaudeCliChild();
+    const extraEnv = {};
     if (options?.chatId)
-        env.CC_IM_CHAT_ID = options.chatId;
+        extraEnv.CC_IM_CHAT_ID = options.chatId;
     if (options?.hookPort)
-        env.CC_IM_HOOK_PORT = String(options.hookPort);
+        extraEnv.CC_IM_HOOK_PORT = String(options.hookPort);
     if (options?.proxy) {
-        env.HTTPS_PROXY = options.proxy;
-        env.HTTP_PROXY = options.proxy;
-        env.https_proxy = options.proxy;
-        env.http_proxy = options.proxy;
-        env.ALL_PROXY = options.proxy;
-        env.all_proxy = options.proxy;
-    }
-    if (process.platform === 'win32') {
-        env.LANG = env.LANG || 'C.UTF-8';
-        env.LC_ALL = env.LC_ALL || 'C.UTF-8';
+        extraEnv.HTTPS_PROXY = options.proxy;
+        extraEnv.HTTP_PROXY = options.proxy;
+        extraEnv.https_proxy = options.proxy;
+        extraEnv.http_proxy = options.proxy;
+        extraEnv.ALL_PROXY = options.proxy;
+        extraEnv.all_proxy = options.proxy;
     }
     const argsForLog = args.join(' ');
     log.info(`Spawning Codex CLI: path=${cliPath}, cwd=${workDir}, session=${sessionId ?? 'new'}, args=${argsForLog}`);
@@ -200,14 +197,7 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
                 `chcp 65001>nul && ${formatWindowsCommandName(cliPath)} ${args.map(quoteForWindowsCmd).join(' ')}`,
             ]
             : args;
-    const child = spawn(spawnCmd, spawnArgs, {
-        cwd: workDir,
-        // Unix 上放入独立进程组，使 abort/关停能用 process.kill(-pid) 杀掉整棵子树（含 MCP/shell 孙进程）
-        detached: process.platform !== 'win32',
-        stdio: ['pipe', 'pipe', 'pipe'],
-        env,
-        windowsHide: process.platform === 'win32',
-    });
+    const child = spawn(spawnCmd, spawnArgs, buildBaseSpawnOptions(workDir, ['pipe', 'pipe', 'pipe'], extraEnv));
     trackChild(child);
     child.stdin?.write(prompt);
     child.stdin?.end();
@@ -217,27 +207,10 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
     const toolStats = {};
     const startTime = Date.now();
     const rl = createInterface({ input: child.stdout });
-    const MAX_STDERR_HEAD = 4 * 1024;
-    const MAX_STDERR_TAIL = 6 * 1024;
-    let stderrHead = '';
-    let stderrTail = '';
-    let stderrTotal = 0;
-    let stderrHeadFull = false;
+    const stderrBuf = createStderrBuffer();
     child.stderr?.on('data', (chunk) => {
         const text = chunk.toString();
-        stderrTotal += text.length;
-        if (!stderrHeadFull) {
-            const room = MAX_STDERR_HEAD - stderrHead.length;
-            if (room > 0) {
-                stderrHead += text.slice(0, room);
-                if (stderrHead.length >= MAX_STDERR_HEAD)
-                    stderrHeadFull = true;
-            }
-        }
-        stderrTail += text;
-        if (stderrTail.length > MAX_STDERR_TAIL) {
-            stderrTail = stderrTail.slice(-MAX_STDERR_TAIL);
-        }
+        appendStderr(stderrBuf, text);
         log.debug(`[stderr] ${text.trimEnd()}`);
     });
     rl.on('line', (line) => {
@@ -329,38 +302,18 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
         }
     });
     let exitCode = null;
-    let rlClosed = false;
-    let childClosed = false;
+    const gate = createFinalizeGate();
     let cliTimeoutHandle = null;
     const finalize = () => {
-        if (cliTimeoutHandle) {
-            clearTimeout(cliTimeoutHandle);
-            cliTimeoutHandle = null;
-        }
-        if (!rlClosed || !childClosed)
+        clearWallClockTimeout(cliTimeoutHandle);
+        cliTimeoutHandle = null;
+        if (!isFinalizeReady(gate))
             return;
         if (completed)
             return;
         if (exitCode !== null && exitCode !== 0) {
-            let errMsg = '';
-            if (stderrTotal > 0) {
-                if (!stderrHeadFull) {
-                    errMsg = stderrHead;
-                }
-                else if (stderrTotal <= MAX_STDERR_HEAD + MAX_STDERR_TAIL) {
-                    errMsg = stderrHead + stderrTail.slice(stderrTail.length - (stderrTotal - MAX_STDERR_HEAD));
-                }
-                else {
-                    errMsg =
-                        stderrHead +
-                            `\n\n... (omitted ${stderrTotal - MAX_STDERR_HEAD - MAX_STDERR_TAIL} bytes) ...\n\n` +
-                            stderrTail;
-                }
-            }
-            if (sessionId &&
-                (errMsg.includes('No session found') ||
-                    errMsg.includes('No conversation found') ||
-                    errMsg.includes('Unable to find session'))) {
+            const errMsg = reconstructStderr(stderrBuf);
+            if (sessionId && isSessionInvalidMessage(errMsg)) {
                 callbacks.onSessionInvalid?.();
             }
             callbacks.onError(errMsg || `Codex CLI exited with code ${exitCode}`);
@@ -379,11 +332,11 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
     child.on('close', (code) => {
         log.info(`Codex CLI closed: exitCode=${code}, pid=${child.pid}`);
         exitCode = code;
-        childClosed = true;
+        gate.childClosed = true;
         finalize();
     });
     rl.on('close', () => {
-        rlClosed = true;
+        gate.rlClosed = true;
         finalize();
     });
     child.on('error', (err) => {
@@ -393,7 +346,7 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
             completed = true;
             callbacks.onError(`Failed to start Codex CLI: ${err.message}`);
         }
-        childClosed = true;
+        gate.childClosed = true;
         finalize();
     });
     // 墙钟超时：防止 CLI 挂死（网络卡住、工具死循环等）永久占用用户队列槽
@@ -401,7 +354,6 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
     cliTimeoutHandle = setTimeout(() => {
         if (completed)
             return;
-        log.warn(`Codex CLI 超过 ${cliTimeoutMs}ms，强制终止 (pid=${child.pid})`);
         completed = true;
         rl.close();
         killProcessTree(child);
@@ -413,10 +365,7 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
             if (completed)
                 return;
             completed = true;
-            if (cliTimeoutHandle) {
-                clearTimeout(cliTimeoutHandle);
-                cliTimeoutHandle = null;
-            }
+            clearWallClockTimeout(cliTimeoutHandle);
             rl.close();
             killProcessTree(child);
         },

package/dist/config-web-auth.d.ts

@@ -0,0 +1,13 @@
+import type { IncomingMessage } from "node:http";
+export interface LoginTokenInfo {
+    expiresAt: number;
+}
+export declare function getWebConfigHost(): string;
+/** 设为 true 时，非本机绑定的 Web 配置服务跳过登录 Cookie 校验（仅适用于受信网络；生产建议配合 HTTPS 反向代理） */
+export declare function allowRemoteApiWithoutAuth(): boolean;
+export declare function consumeLoginToken(loginToken: string): LoginTokenInfo | undefined;
+export declare function createLoginToken(ttlMs: number): string;
+export declare function createSession(request: IncomingMessage, ttlMs: number): string;
+export declare function isSessionValid(request: IncomingMessage): boolean;
+export declare function buildSessionCookie(sessionId: string, ttlMs: number): string;
+export declare function generateLoginUrl(host: string, port: number, loginTtlMs: number): string;

package/dist/config-web-auth.js

@@ -0,0 +1,114 @@
+import { randomBytes } from "node:crypto";
+const pendingLogins = new Map();
+const activeSessions = new Map();
+export function getWebConfigHost() {
+    const envHost = process.env.OPEN_IM_WEB_HOST?.trim();
+    if (envHost)
+        return envHost;
+    return "127.0.0.1";
+}
+/** 设为 true 时，非本机绑定的 Web 配置服务跳过登录 Cookie 校验（仅适用于受信网络；生产建议配合 HTTPS 反向代理） */
+export function allowRemoteApiWithoutAuth() {
+    return process.env.OPEN_IM_ALLOW_REMOTE_API === "true";
+}
+function generateRandomToken(bytes = 32) {
+    return randomBytes(bytes).toString("base64url");
+}
+function cleanupExpiredAuth(now) {
+    for (const [token, info] of pendingLogins) {
+        if (info.expiresAt <= now)
+            pendingLogins.delete(token);
+    }
+    for (const [sessionId, info] of activeSessions) {
+        if (info.expiresAt <= now)
+            activeSessions.delete(sessionId);
+    }
+}
+export function consumeLoginToken(loginToken) {
+    const info = pendingLogins.get(loginToken);
+    if (!info)
+        return undefined;
+    pendingLogins.delete(loginToken);
+    const now = Date.now();
+    if (info.expiresAt <= now)
+        return undefined;
+    return info;
+}
+export function createLoginToken(ttlMs) {
+    const now = Date.now();
+    cleanupExpiredAuth(now);
+    const token = generateRandomToken(32);
+    pendingLogins.set(token, { expiresAt: now + ttlMs });
+    return token;
+}
+export function createSession(request, ttlMs) {
+    const now = Date.now();
+    cleanupExpiredAuth(now);
+    const sessionId = generateRandomToken(32);
+    const remoteAddr = request.socket.remoteAddress;
+    const userAgent = typeof request.headers["user-agent"] === "string" ? request.headers["user-agent"] : undefined;
+    activeSessions.set(sessionId, {
+        expiresAt: now + ttlMs,
+        remoteAddr,
+        userAgent,
+    });
+    return sessionId;
+}
+function parseCookies(request) {
+    const header = request.headers.cookie;
+    if (!header)
+        return {};
+    const cookies = {};
+    const parts = header.split(";");
+    for (const part of parts) {
+        const [rawKey, ...rest] = part.split("=");
+        const key = rawKey.trim();
+        if (!key)
+            continue;
+        const value = rest.join("=").trim();
+        cookies[key] = decodeURIComponent(value);
+    }
+    return cookies;
+}
+function getSessionIdFromRequest(request) {
+    const cookies = parseCookies(request);
+    const sessionId = cookies.openim_session;
+    return sessionId && typeof sessionId === "string" && sessionId.length > 0 ? sessionId : null;
+}
+export function isSessionValid(request) {
+    const sessionId = getSessionIdFromRequest(request);
+    if (!sessionId)
+        return false;
+    const info = activeSessions.get(sessionId);
+    if (!info)
+        return false;
+    const now = Date.now();
+    if (info.expiresAt <= now) {
+        activeSessions.delete(sessionId);
+        return false;
+    }
+    // Optional: tie session to basic client fingerprint (remote address)
+    const remoteAddr = request.socket.remoteAddress;
+    if (info.remoteAddr && remoteAddr && remoteAddr !== info.remoteAddr) {
+        return false;
+    }
+    return true;
+}
+export function buildSessionCookie(sessionId, ttlMs) {
+    const maxAgeSec = Math.floor(ttlMs / 1000);
+    const parts = [
+        `openim_session=${encodeURIComponent(sessionId)}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${maxAgeSec}`,
+    ];
+    // 不设置 Secure，方便本地 http 使用；如果放在 https 反代后，可以在代理层加 Secure
+    return parts.join("; ");
+}
+export function generateLoginUrl(host, port, loginTtlMs) {
+    const loginToken = createLoginToken(loginTtlMs);
+    const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+    const baseUrl = `http://${displayHost}:${port}`;
+    return `${baseUrl}/?login_token=${encodeURIComponent(loginToken)}`;
+}

package/dist/config-web-browser.d.ts

@@ -0,0 +1,4 @@
+export declare function openBrowser(url: string): void;
+export declare function getWebConfigPort(): number;
+export declare function getWebConfigUrl(): string;
+export declare function openWebConfigUrl(): void;

package/dist/config-web-browser.js

@@ -0,0 +1,48 @@
+import { spawn } from "node:child_process";
+import { WEB_CONFIG_PORT, getPublicWebDashboardUrl } from "./constants.js";
+import { createLogger } from "./logger.js";
+const log = createLogger("ConfigWeb");
+export function openBrowser(url) {
+    // 显式关闭自动打开浏览器（服务器环境推荐设置）
+    if (process.env.OPEN_IM_NO_BROWSER === "1") {
+        return;
+    }
+    // 在无 TTY 且无图形环境（常见于服务器）时直接跳过，避免无意义的 xdg-open 调用
+    if (!process.stdout.isTTY && !process.env.DISPLAY) {
+        log.info(`Skipping browser launch for URL ${url} (no TTY/DISPLAY detected).`);
+        return;
+    }
+    const safeSpawn = (command, args) => {
+        try {
+            const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: process.platform === "win32" });
+            // 防止 ENOENT 之类的错误变成未捕获异常
+            child.on("error", (error) => {
+                log.warn(`Failed to launch browser command "${command}": ${error.code ?? error.message}`);
+            });
+            child.unref();
+        }
+        catch (error) {
+            log.warn(`Failed to spawn browser command "${command}": ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    if (process.platform === "win32") {
+        safeSpawn("cmd", ["/c", "start", "", url]);
+        return;
+    }
+    if (process.platform === "darwin") {
+        safeSpawn("open", [url]);
+        return;
+    }
+    // linux / 其他 UNIX 平台：优先尝试 xdg-open，失败时仅记录日志，不抛出
+    safeSpawn("xdg-open", [url]);
+}
+export function getWebConfigPort() {
+    const fromEnv = process.env.OPEN_IM_WEB_PORT ? parseInt(process.env.OPEN_IM_WEB_PORT, 10) : NaN;
+    return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : WEB_CONFIG_PORT;
+}
+export function getWebConfigUrl() {
+    return `http://127.0.0.1:${getWebConfigPort()}`;
+}
+export function openWebConfigUrl() {
+    openBrowser(getPublicWebDashboardUrl());
+}

package/dist/config-web-cors.d.ts

@@ -0,0 +1,5 @@
+import type { IncomingMessage, OutgoingHttpHeaders } from "node:http";
+export declare function splitCsv(value: string | undefined): string[];
+/** 有 Origin 时返回 CORS 响应头；无 Origin（如本地 file:// 或同源内置页）不返回，行为与原来一致 */
+export declare function corsHeadersFor(request: IncomingMessage): Record<string, string> | undefined;
+export declare function mergeCors(request: IncomingMessage, headers: OutgoingHttpHeaders): OutgoingHttpHeaders;