@wu529778790/open-im 1.7.0-beta.3 → 1.7.0-beta.5

package/README.md

@@ -14,19 +14,6 @@ Multi-platform IM bridge for AI CLI tools. Connect Telegram, Feishu, WeCom, Ding
 - Isolated sessions: each user gets an independent local session, and `/new` resets it
 - Built-in commands: `/help`, `/new`, `/cd`, `/pwd`, `/status`
 
-## Coverage Matrix
-
-Capability levels: `Native` = fully supported in-channel, `Fallback` = degraded behavior or text fallback, `None` = not currently supported.
-
-| Platform | Text Inbound | Image Inbound | File Inbound | Voice Inbound | Video Inbound | Streaming Reply | Image Reply | Card Reply |
-| ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |
-| Telegram | Native | Native | Native | Native | Native | Native | Native | Native |
-| Feishu | Native | Native | Native | Fallback | Fallback | Native | Native | Native |
-| QQ | Native | Fallback | Fallback | Fallback | Fallback | None | Fallback | Fallback |
-| WeCom | Native | Fallback | Fallback | Fallback | Fallback | Native | Native | Native |
-| DingTalk | Native | Fallback | Fallback | Fallback | Fallback | Native | Fallback | Native |
-| WeChat (experimental) | Native | Fallback | Fallback | Fallback | Fallback | Native | Fallback | Native |
-
 ## Requirements
 
 - Node.js >= 20
@@ -50,27 +37,66 @@ The config file is stored at `~/.open-im/config.json` by default.
 
 ## CLI Commands
 
-| Command | Description |
-| ---- | ---- |
-| `open-im init` | Initialize or append configuration without starting the service |
-| `open-im start` | Run the service in the background |
-| `open-im stop` | Stop the background service |
-| `open-im dev` | Run in the foreground for development/debugging |
+| Command           | Description                                                      |
+| ----------------- | ---------------------------------------------------------------- |
+| `open-im init`    | Initialize or append configuration without starting the service |
+| `open-im start`   | Run the service in the background                                |
+| `open-im stop`    | Stop the background service                                      |
+| `open-im dev`     | Run in the foreground for development/debugging                  |
+| `open-im dashboard` | Run only the config web UI (no bridge)                        |
+
+## Server Deployment & Config Page
 
-## Graphical Config Page
+### Local (with browser)
 
-Open the config page at **http://127.0.0.1:39282** (or the URL shown after `open-im start`). The page includes:
+Open the config page at [`http://127.0.0.1:39282`](http://127.0.0.1:39282) (or the URL shown after `open-im start`). The page includes:
 
 - **Dashboard** – Configured / Enabled platform count and service status (Idle or Running)
 - **Platforms** – Enable and configure Telegram, Feishu, QQ, WeCom, and DingTalk (credentials, proxy, per-platform AI tool, allowed user IDs). Each platform has a “Test Configuration” button.
-- **AI Tooling** – **General**: default AI tool (Claude / Codex / CodeBuddy), work directory, hook port, log level. **Per-tool tabs**: Claude (CLI path, timeout, proxy, config path, ANTHROPIC_* fields), Codex (CLI path, timeout, proxy), CodeBuddy (CLI path, timeout).
+- **AI Tooling** – **General**: default AI tool (Claude / Codex / CodeBuddy), work directory, hook port, log level. **Per-tool tabs**: Claude (CLI path, timeout, proxy, config path, ANTHROPIC\_\* fields), Codex (CLI path, timeout, proxy), CodeBuddy (CLI path, timeout).
 - **Service control** – Validate config, Save, Start bridge, Stop bridge.
 
 WeChat is not in the web UI; configure it in `~/.open-im/config.json` or via `open-im init` if needed.
 
-- `open-im start` serves the config page and the bridge.
+- `open-im start` serves both the config page and the bridge on your local machine.
 - `open-im dev` opens the page automatically only when setup is incomplete.
-- To open the page when config already exists, run `open-im start` and visit the URL above.
+- To open the page when config already exists, you can also run `open-im dashboard` to launch the config UI only (without starting the bridge).
+
+### Recommended server workflow
+
+On a remote server, the simplest and safest pattern is:
+
+1. **Use `dashboard` to configure via browser**
+
+   On the server:
+
+   ```bash
+   export OPEN_IM_NO_BROWSER=1
+   # Optional: bind to all interfaces if you want to open from another device
+   # export OPEN_IM_WEB_HOST=0.0.0.0
+   open-im dashboard
+   ```
+
+   - This starts only the config web UI (no bridge yet).
+   - If `OPEN_IM_WEB_HOST` is `0.0.0.0`, the server will print a one-time login URL like:
+
+     ```text
+     http://your-server-ip:39282/?login_token=xxxx
+     ```
+
+   - Open this URL in your browser, complete all platform/AI settings, then click **Start bridge** in the web UI.
+
+2. **Run the bridge as a background service**
+
+   After configuration is saved, you have two options:
+   - Start from the web UI: use the **Start bridge** button on the Service panel.
+   - Or start from the CLI:
+
+     ```bash
+     open-im start
+     ```
+
+   This runs the full bridge in the background using the saved config.
 
 ## Session Behavior
 
@@ -221,46 +247,46 @@ The following is valid JSON and can be saved directly as `~/.open-im/config.json
 
 ### Common Environment Variables
 
-| Variable | Description |
-| ---- | ---- |
-| `AI_COMMAND` | Select `claude`, `codex`, or `codebuddy` |
-| `CLAUDE_WORK_DIR` | Default session working directory |
-| `LOG_DIR` | Log directory |
-| `LOG_LEVEL` | Log level |
-| `HOOK_PORT` | Permission service port |
-| `CODEX_PROXY` | Proxy used by Codex to access `chatgpt.com` |
-| `OPENAI_API_KEY` | Codex API key, can replace `codex login` |
-| `CODEBUDDY_CLI_PATH` | Override CodeBuddy CLI path |
-| `CODEBUDDY_TIMEOUT_MS` | Override CodeBuddy timeout |
-| `CODEBUDDY_SKIP_PERMISSIONS` | Override CodeBuddy skip-permissions behavior |
-| `CODEBUDDY_IDLE_TIMEOUT_MS` | Abort CodeBuddy when it stays silent for too long |
-| `CODEBUDDY_API_KEY` | CodeBuddy API key, can replace `codebuddy login` |
-| `CODEBUDDY_AUTH_TOKEN` | CodeBuddy auth token, can replace `codebuddy login` |
-| `TELEGRAM_BOT_TOKEN` | Telegram bot token |
-| `TELEGRAM_PROXY` | Telegram proxy URL |
-| `TELEGRAM_ALLOWED_USER_IDS` | Telegram allowlist |
-| `FEISHU_APP_ID` | Feishu app ID |
-| `FEISHU_APP_SECRET` | Feishu app secret |
-| `FEISHU_ALLOWED_USER_IDS` | Feishu allowlist |
-| `QQ_BOT_APPID` | QQ bot app ID |
-| `QQ_BOT_SECRET` | QQ bot app secret |
-| `QQ_BOT_SANDBOX` | QQ bot sandbox mode (`1` / `true` to enable, disabled by default) |
-| `QQ_ALLOWED_USER_IDS` | QQ allowlist |
-| `DINGTALK_CLIENT_ID` | DingTalk client ID / AppKey |
-| `DINGTALK_CLIENT_SECRET` | DingTalk client secret / AppSecret |
-| `DINGTALK_CARD_TEMPLATE_ID` | DingTalk AI card template ID; enables single-message streaming replies |
-| `DINGTALK_ALLOWED_USER_IDS` | DingTalk allowlist |
-| `WEWORK_CORP_ID` | WeCom bot ID |
-| `WEWORK_SECRET` | WeCom secret |
-| `WEWORK_WS_URL` | WeCom WebSocket URL |
-| `WEWORK_ALLOWED_USER_IDS` | WeCom allowlist |
-| `WECHAT_APP_ID` | WeChat standard mode app ID |
-| `WECHAT_APP_SECRET` | WeChat standard mode app secret |
-| `WECHAT_TOKEN` | WeChat AGP mode token |
-| `WECHAT_GUID` | WeChat AGP mode GUID |
-| `WECHAT_USER_ID` | WeChat AGP mode user ID |
-| `WECHAT_WS_URL` | WeChat WebSocket URL |
-| `WECHAT_ALLOWED_USER_IDS` | WeChat allowlist |
+| Variable                     | Description                                                            |
+| ---------------------------- | ---------------------------------------------------------------------- |
+| `AI_COMMAND`                 | Select `claude`, `codex`, or `codebuddy`                               |
+| `CLAUDE_WORK_DIR`            | Default session working directory                                      |
+| `LOG_DIR`                    | Log directory                                                          |
+| `LOG_LEVEL`                  | Log level                                                              |
+| `HOOK_PORT`                  | Permission service port                                                |
+| `CODEX_PROXY`                | Proxy used by Codex to access `chatgpt.com`                            |
+| `OPENAI_API_KEY`             | Codex API key, can replace `codex login`                               |
+| `CODEBUDDY_CLI_PATH`         | Override CodeBuddy CLI path                                            |
+| `CODEBUDDY_TIMEOUT_MS`       | Override CodeBuddy timeout                                             |
+| `CODEBUDDY_SKIP_PERMISSIONS` | Override CodeBuddy skip-permissions behavior                           |
+| `CODEBUDDY_IDLE_TIMEOUT_MS`  | Abort CodeBuddy when it stays silent for too long                      |
+| `CODEBUDDY_API_KEY`          | CodeBuddy API key, can replace `codebuddy login`                       |
+| `CODEBUDDY_AUTH_TOKEN`       | CodeBuddy auth token, can replace `codebuddy login`                    |
+| `TELEGRAM_BOT_TOKEN`         | Telegram bot token                                                     |
+| `TELEGRAM_PROXY`             | Telegram proxy URL                                                     |
+| `TELEGRAM_ALLOWED_USER_IDS`  | Telegram allowlist                                                     |
+| `FEISHU_APP_ID`              | Feishu app ID                                                          |
+| `FEISHU_APP_SECRET`          | Feishu app secret                                                      |
+| `FEISHU_ALLOWED_USER_IDS`    | Feishu allowlist                                                       |
+| `QQ_BOT_APPID`               | QQ bot app ID                                                          |
+| `QQ_BOT_SECRET`              | QQ bot app secret                                                      |
+| `QQ_BOT_SANDBOX`             | QQ bot sandbox mode (`1` / `true` to enable, disabled by default)      |
+| `QQ_ALLOWED_USER_IDS`        | QQ allowlist                                                           |
+| `DINGTALK_CLIENT_ID`         | DingTalk client ID / AppKey                                            |
+| `DINGTALK_CLIENT_SECRET`     | DingTalk client secret / AppSecret                                     |
+| `DINGTALK_CARD_TEMPLATE_ID`  | DingTalk AI card template ID; enables single-message streaming replies |
+| `DINGTALK_ALLOWED_USER_IDS`  | DingTalk allowlist                                                     |
+| `WEWORK_CORP_ID`             | WeCom bot ID                                                           |
+| `WEWORK_SECRET`              | WeCom secret                                                           |
+| `WEWORK_WS_URL`              | WeCom WebSocket URL                                                    |
+| `WEWORK_ALLOWED_USER_IDS`    | WeCom allowlist                                                        |
+| `WECHAT_APP_ID`              | WeChat standard mode app ID                                            |
+| `WECHAT_APP_SECRET`          | WeChat standard mode app secret                                        |
+| `WECHAT_TOKEN`               | WeChat AGP mode token                                                  |
+| `WECHAT_GUID`                | WeChat AGP mode GUID                                                   |
+| `WECHAT_USER_ID`             | WeChat AGP mode user ID                                                |
+| `WECHAT_WS_URL`              | WeChat WebSocket URL                                                   |
+| `WECHAT_ALLOWED_USER_IDS`    | WeChat allowlist                                                       |
 
 ### Platform Setup Sources
 
@@ -281,15 +307,15 @@ DingTalk AI card templates are already compatible with the official "Search Resu
 
 ## IM Commands
 
-| Command | Description |
-| ---- | ---- |
-| `/help` | Show help |
-| `/new` | Start a new session |
-| `/status` | Show AI tool, version, session directory, and session ID |
-| `/cd <path>` | Change the session working directory |
-| `/pwd` | Show the current session working directory |
-| `/allow` `/y` | Approve a permission request |
-| `/deny` `/n` | Reject a permission request |
+| Command       | Description                                              |
+| ------------- | -------------------------------------------------------- |
+| `/help`       | Show help                                                |
+| `/new`        | Start a new session                                      |
+| `/status`     | Show AI tool, version, session directory, and session ID |
+| `/cd <path>`  | Change the session working directory                     |
+| `/pwd`        | Show the current session working directory               |
+| `/allow` `/y` | Approve a permission request                             |
+| `/deny` `/n`  | Reject a permission request                              |
 
 ## Troubleshooting
 

package/README.zh-CN.md

@@ -14,19 +14,6 @@
 - 会话隔离：每个用户独立维护本地会话，`/new` 可重置
 - 常用命令：支持 `/help`、`/new`、`/cd`、`/pwd`、`/status`
 
-## 覆盖矩阵
-
-能力等级说明：`Native` 表示平台内原生支持，`Fallback` 表示有降级方案或文本兜底，`None` 表示当前暂不支持。
-
-| 平台 | 文本输入 | 图片输入 | 文件输入 | 语音输入 | 视频输入 | 流式回复 | 图片回复 | 卡片回复 |
-| ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |
-| Telegram | Native | Native | Native | Native | Native | Native | Native | Native |
-| 飞书 | Native | Native | Native | Fallback | Fallback | Native | Native | Native |
-| QQ | Native | Fallback | Fallback | Fallback | Fallback | None | Fallback | Fallback |
-| 企业微信 | Native | Fallback | Fallback | Fallback | Fallback | Native | Native | Native |
-| 钉钉 | Native | Fallback | Fallback | Fallback | Fallback | Native | Fallback | Native |
-| 微信（测试中） | Native | Fallback | Fallback | Fallback | Fallback | Native | Fallback | Native |
-
 ## 环境要求
 
 - Node.js >= 20
@@ -50,27 +37,72 @@ open-im start
 
 ## CLI 命令
 
-| 命令 | 说明 |
-| ---- | ---- |
-| `open-im init` | 初始化或追加配置，不启动服务 |
-| `open-im start` | 后台运行服务 |
-| `open-im stop` | 停止后台服务 |
-| `open-im dev` | 前台运行（调试模式） |
+| 命令              | 说明                           |
+| ----------------- | ------------------------------ |
+| `open-im init`    | 初始化或追加配置，不启动服务   |
+| `open-im start`   | 后台运行服务                   |
+| `open-im stop`    | 停止后台服务                   |
+| `open-im dev`     | 前台运行（调试模式）           |
+| `open-im dashboard` | 仅启动 Web 配置页（不启动桥接服务） |
 
-## 图形化配置页面
+## 服务器部署与图形化配置
 
-在浏览器中打开 **http://127.0.0.1:39282**（或执行 `open-im start` 后提示的地址），页面结构如下：
+### 本机（带浏览器）使用
+
+在本机直接运行：
+
+```bash
+open-im start
+```
+
+然后在浏览器中打开 [`http://127.0.0.1:39282`](http://127.0.0.1:39282)（或命令行里提示的地址），页面结构如下：
 
 - **概览** – 已配置/已启用平台数量、服务状态（未启动或运行中）
 - **平台配置** – 启用并填写 Telegram、飞书、QQ、企业微信、钉钉的凭证（Bot Token/App ID/Secret、代理、该平台使用的 AI 工具、白名单用户 ID）。每个平台提供「校验配置」按钮
-- **AI 工具配置** – **公共**：默认 AI 工具（Claude / Codex / CodeBuddy）、工作目录、Hook 端口、日志级别。**分工具**：Claude（CLI 路径、超时、代理、配置路径、ANTHROPIC_* 等）、Codex（CLI 路径、超时、代理）、CodeBuddy（CLI 路径、超时）
+- **AI 工具配置** – **公共**：默认 AI 工具（Claude / Codex / CodeBuddy）、工作目录、Hook 端口、日志级别。**分工具**：Claude（CLI 路径、超时、代理、配置路径、ANTHROPIC\_\* 等）、Codex（CLI 路径、超时、代理）、CodeBuddy（CLI 路径、超时）
 - **服务控制** – 校验配置、保存、启动桥接、停止桥接
 
 微信暂不在网页中配置，如需使用请在 `~/.open-im/config.json` 中手动配置或通过 `open-im init` 引导。
 
-- `open-im start` 会同时启动桥接服务并提供该配置页
-- `open-im dev` 仅在未完成配置时自动打开页面
-- 已有配置但想手动打开时，执行 `open-im start` 后访问上述地址即可
+- `open-im start` 会同时启动桥接服务并提供该配置页（本机场景）。
+- `open-im dev` 仅在未完成配置时自动打开页面。
+- 已有配置但想单独打开配置页时，可以使用 `open-im dashboard` 启动仅 Web 配置服务。
+
+### 推荐的服务器端使用方式
+
+在远程服务器上，建议的最简单、安全的方式是：
+
+1. **先通过 `dashboard` 在浏览器里完成配置**
+
+   在服务器上执行：
+
+   ```bash
+   export OPEN_IM_NO_BROWSER=1
+   # 可选：如果希望从其他设备访问配置页，可以绑定到所有网卡
+   # export OPEN_IM_WEB_HOST=0.0.0.0
+   open-im dashboard
+   ```
+
+   - 这只会启动 Web 配置页，不会同时启动桥接服务。
+   - 若设置了 `OPEN_IM_WEB_HOST=0.0.0.0`，服务端会输出一次性登录链接，例如：
+
+     ```text
+     http://your-server-ip:39282/?login_token=xxxx
+     ```
+
+   - 在浏览器中打开该链接，按照页面提示完成各个平台 / AI 工具配置，最后在页面中点击 **「Start bridge」** 按钮启动桥接服务。
+
+2. **后台运行桥接服务**
+
+   配置保存后，有两种启动方式：
+   - 在 Web 页面 Service 面板中直接点击 **「Start bridge」**；
+   - 或者在服务器上运行：
+
+     ```bash
+     open-im start
+     ```
+
+   这会根据已保存的配置，在后台长期运行桥接服务。
 
 ## 会话说明
 
@@ -221,46 +253,46 @@ codebuddy login
 
 ### 常用环境变量
 
-| 变量 | 说明 |
-| ---- | ---- |
-| `AI_COMMAND` | 选择 `claude` / `codex` / `codebuddy` |
-| `CLAUDE_WORK_DIR` | 默认会话目录 |
-| `LOG_DIR` | 日志目录 |
-| `LOG_LEVEL` | 日志级别 |
-| `HOOK_PORT` | 权限服务端口 |
-| `CODEX_PROXY` | Codex 访问 `chatgpt.com` 的代理 |
-| `OPENAI_API_KEY` | Codex API Key，可替代 `codex login` |
-| `CODEBUDDY_CLI_PATH` | 覆盖 CodeBuddy CLI 路径 |
-| `CODEBUDDY_TIMEOUT_MS` | 覆盖 CodeBuddy 超时 |
-| `CODEBUDDY_SKIP_PERMISSIONS` | 覆盖 CodeBuddy 的跳过权限确认行为 |
-| `CODEBUDDY_IDLE_TIMEOUT_MS` | CodeBuddy 长时间无输出时自动终止 |
-| `CODEBUDDY_API_KEY` | CodeBuddy API Key，可替代 `codebuddy login` |
-| `CODEBUDDY_AUTH_TOKEN` | CodeBuddy Auth Token，可替代 `codebuddy login` |
-| `TELEGRAM_BOT_TOKEN` | Telegram Bot Token |
-| `TELEGRAM_PROXY` | Telegram 代理地址 |
-| `TELEGRAM_ALLOWED_USER_IDS` | Telegram 白名单 |
-| `FEISHU_APP_ID` | 飞书 App ID |
-| `FEISHU_APP_SECRET` | 飞书 App Secret |
-| `FEISHU_ALLOWED_USER_IDS` | 飞书白名单 |
-| `QQ_BOT_APPID` | QQ 机器人 App ID |
-| `QQ_BOT_SECRET` | QQ 机器人 App Secret |
-| `QQ_BOT_SANDBOX` | QQ 机器人沙箱模式（`1`/`true` 启用，默认关闭） |
-| `QQ_ALLOWED_USER_IDS` | QQ 白名单 |
-| `DINGTALK_CLIENT_ID` | 钉钉应用 Client ID / AppKey |
-| `DINGTALK_CLIENT_SECRET` | 钉钉应用 Client Secret / AppSecret |
-| `DINGTALK_CARD_TEMPLATE_ID` | 钉钉 AI 卡片模板 ID，配置后启用单条流式回复 |
-| `DINGTALK_ALLOWED_USER_IDS` | 钉钉白名单 |
-| `WEWORK_CORP_ID` | 企业微信 Bot ID |
-| `WEWORK_SECRET` | 企业微信 Secret |
-| `WEWORK_WS_URL` | 企业微信 WebSocket 地址 |
-| `WEWORK_ALLOWED_USER_IDS` | 企业微信白名单 |
-| `WECHAT_APP_ID` | 微信标准模式 App ID |
-| `WECHAT_APP_SECRET` | 微信标准模式 App Secret |
-| `WECHAT_TOKEN` | 微信 AGP 模式 Token |
-| `WECHAT_GUID` | 微信 AGP 模式 GUID |
-| `WECHAT_USER_ID` | 微信 AGP 模式 User ID |
-| `WECHAT_WS_URL` | 微信 WebSocket 地址 |
-| `WECHAT_ALLOWED_USER_IDS` | 微信白名单 |
+| 变量                         | 说明                                           |
+| ---------------------------- | ---------------------------------------------- |
+| `AI_COMMAND`                 | 选择 `claude` / `codex` / `codebuddy`          |
+| `CLAUDE_WORK_DIR`            | 默认会话目录                                   |
+| `LOG_DIR`                    | 日志目录                                       |
+| `LOG_LEVEL`                  | 日志级别                                       |
+| `HOOK_PORT`                  | 权限服务端口                                   |
+| `CODEX_PROXY`                | Codex 访问 `chatgpt.com` 的代理                |
+| `OPENAI_API_KEY`             | Codex API Key，可替代 `codex login`            |
+| `CODEBUDDY_CLI_PATH`         | 覆盖 CodeBuddy CLI 路径                        |
+| `CODEBUDDY_TIMEOUT_MS`       | 覆盖 CodeBuddy 超时                            |
+| `CODEBUDDY_SKIP_PERMISSIONS` | 覆盖 CodeBuddy 的跳过权限确认行为              |
+| `CODEBUDDY_IDLE_TIMEOUT_MS`  | CodeBuddy 长时间无输出时自动终止               |
+| `CODEBUDDY_API_KEY`          | CodeBuddy API Key，可替代 `codebuddy login`    |
+| `CODEBUDDY_AUTH_TOKEN`       | CodeBuddy Auth Token，可替代 `codebuddy login` |
+| `TELEGRAM_BOT_TOKEN`         | Telegram Bot Token                             |
+| `TELEGRAM_PROXY`             | Telegram 代理地址                              |
+| `TELEGRAM_ALLOWED_USER_IDS`  | Telegram 白名单                                |
+| `FEISHU_APP_ID`              | 飞书 App ID                                    |
+| `FEISHU_APP_SECRET`          | 飞书 App Secret                                |
+| `FEISHU_ALLOWED_USER_IDS`    | 飞书白名单                                     |
+| `QQ_BOT_APPID`               | QQ 机器人 App ID                               |
+| `QQ_BOT_SECRET`              | QQ 机器人 App Secret                           |
+| `QQ_BOT_SANDBOX`             | QQ 机器人沙箱模式（`1`/`true` 启用，默认关闭） |
+| `QQ_ALLOWED_USER_IDS`        | QQ 白名单                                      |
+| `DINGTALK_CLIENT_ID`         | 钉钉应用 Client ID / AppKey                    |
+| `DINGTALK_CLIENT_SECRET`     | 钉钉应用 Client Secret / AppSecret             |
+| `DINGTALK_CARD_TEMPLATE_ID`  | 钉钉 AI 卡片模板 ID，配置后启用单条流式回复    |
+| `DINGTALK_ALLOWED_USER_IDS`  | 钉钉白名单                                     |
+| `WEWORK_CORP_ID`             | 企业微信 Bot ID                                |
+| `WEWORK_SECRET`              | 企业微信 Secret                                |
+| `WEWORK_WS_URL`              | 企业微信 WebSocket 地址                        |
+| `WEWORK_ALLOWED_USER_IDS`    | 企业微信白名单                                 |
+| `WECHAT_APP_ID`              | 微信标准模式 App ID                            |
+| `WECHAT_APP_SECRET`          | 微信标准模式 App Secret                        |
+| `WECHAT_TOKEN`               | 微信 AGP 模式 Token                            |
+| `WECHAT_GUID`                | 微信 AGP 模式 GUID                             |
+| `WECHAT_USER_ID`             | 微信 AGP 模式 User ID                          |
+| `WECHAT_WS_URL`              | 微信 WebSocket 地址                            |
+| `WECHAT_ALLOWED_USER_IDS`    | 微信白名单                                     |
 
 ### 平台配置来源
 
@@ -281,15 +313,15 @@ codebuddy login
 
 ## IM 内命令
 
-| 命令 | 说明 |
-| ---- | ---- |
-| `/help` | 显示帮助 |
-| `/new` | 开始新会话 |
-| `/status` | 显示 AI 工具、版本、会话目录、会话 ID |
-| `/cd <路径>` | 切换会话目录 |
-| `/pwd` | 显示当前会话目录 |
-| `/allow` `/y` | 允许权限请求 |
-| `/deny` `/n` | 拒绝权限请求 |
+| 命令          | 说明                                  |
+| ------------- | ------------------------------------- |
+| `/help`       | 显示帮助                              |
+| `/new`        | 开始新会话                            |
+| `/status`     | 显示 AI 工具、版本、会话目录、会话 ID |
+| `/cd <路径>`  | 切换会话目录                          |
+| `/pwd`        | 显示当前会话目录                      |
+| `/allow` `/y` | 允许权限请求                          |
+| `/deny` `/n`  | 拒绝权限请求                          |
 
 ## 故障排除
 

package/dist/cli.js

@@ -60,6 +60,13 @@ async function cmdStart() {
     console.log("\nopen-im started in the background.");
     console.log(`  pid: ${child.pid}`);
     console.log(`  config page: ${getWebConfigUrl()}`);
+    if (process.env.OPEN_IM_WEB_HOST && process.env.OPEN_IM_WEB_HOST !== "127.0.0.1") {
+        console.log("");
+        console.log("NOTE:");
+        console.log("  The config page is bound to OPEN_IM_WEB_HOST.");
+        console.log("  A one-time login URL (with login_token) has been printed by the config-web server logger.");
+        console.log("  Please use that URL (replacing 127.0.0.1 with your server IP/hostname) for the first login.");
+    }
 }
 async function cmdStop() {
     const status = getManagerStatus();
@@ -113,11 +120,11 @@ async function cmdDev() {
 }
 async function cmdDashboard() {
     // Start web config server in persistent mode (no timeout)
-    const { startWebConfigServer, openWebConfigUrl } = await import("./config-web.js");
+    const { startWebConfigServer } = await import("./config-web.js");
     const server = await startWebConfigServer({ mode: "dev", cwd: process.cwd(), persistent: true });
-    console.log(`\nDashboard: ${server.url}`);
+    const url = server.loginUrl ?? server.url;
+    console.log(`\nDashboard: ${url}`);
     console.log("Press Ctrl+C to close.\n");
-    openWebConfigUrl();
     await server.waitForResult;
 }
 function showHelp(exitCode = 0) {

package/dist/config-web-page-i18n.d.ts

@@ -207,9 +207,6 @@ export declare const PAGE_TEXTS: {
         readonly codexProxy: "Codex 代理";
         readonly claudeTimeout: "Claude 超时（毫秒）";
         readonly claudeConfigPath: "配置文件位置";
-        readonly claudeAuthToken: "ANTHROPIC_AUTH_TOKEN";
-        readonly claudeBaseUrl: "ANTHROPIC_BASE_URL";
-        readonly claudeModel: "ANTHROPIC_MODEL";
         readonly claudeProxy: "代理（可选）";
         readonly codexTimeout: "Codex 超时（毫秒）";
         readonly codebuddyTimeout: "CodeBuddy 超时（毫秒）";

package/dist/config-web-page-i18n.js

@@ -207,9 +207,6 @@ export const PAGE_TEXTS = {
         codexProxy: "Codex \u4ee3\u7406",
         claudeTimeout: "Claude \u8d85\u65f6\uff08\u6beb\u79d2\uff09",
         claudeConfigPath: "\u914d\u7f6e\u6587\u4ef6\u4f4d\u7f6e",
-        claudeAuthToken: "ANTHROPIC_AUTH_TOKEN",
-        claudeBaseUrl: "ANTHROPIC_BASE_URL",
-        claudeModel: "ANTHROPIC_MODEL",
         claudeProxy: "\u4ee3\u7406\uff08\u53ef\u9009\uff09",
         codexTimeout: "Codex \u8d85\u65f6\uff08\u6beb\u79d2\uff09",
         codebuddyTimeout: "CodeBuddy \u8d85\u65f6\uff08\u6beb\u79d2\uff09",

package/dist/config-web-page-script.js

@@ -201,9 +201,6 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
           { id: "ai-claudeWorkDir-label", key: "workDir" },
           { id: "ai-claudeTimeoutMs-label", key: "claudeTimeout" },
           { id: "ai-claudeConfigPath-label", key: "claudeConfigPath" },
-          { id: "ai-claudeAuthToken-label", key: "claudeAuthToken" },
-          { id: "ai-claudeBaseUrl-label", key: "claudeBaseUrl" },
-          { id: "ai-claudeModel-label", key: "claudeModel" },
           { id: "ai-claudeProxy-label", key: "claudeProxy" },
           { id: "ai-codexCliPath-label", key: "codexCli" },
           { id: "ai-codexTimeoutMs-label", key: "codexTimeout" },
@@ -405,15 +402,55 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
         return body;
       }
 
+      async function loadClaudeSettings() {
+        const textarea = document.getElementById("claudeSettingsEditor");
+        if (!(textarea instanceof HTMLTextAreaElement)) return;
+        try {
+          const data = await request("/api/claude/settings");
+          const raw = (data.contents || "").trim();
+          const target = raw || "{\n}\n";
+          try {
+            const parsed = JSON.parse(target);
+            textarea.value = JSON.stringify(parsed, null, 2) + "\n";
+          } catch {
+            // 如果后端返回的不是合法 JSON，就原样展示，方便用户手动修
+            textarea.value = target;
+          }
+        } catch (error) {
+          setMessage(error.message || String(error), "error");
+        }
+      }
+
+      async function saveClaudeSettings() {
+        const textarea = document.getElementById("claudeSettingsEditor");
+        if (!(textarea instanceof HTMLTextAreaElement)) return;
+        const edited = textarea.value;
+        // Validate JSON before sending
+        try {
+          const parsed = JSON.parse(edited);
+          textarea.value = JSON.stringify(parsed, null, 2) + "\n";
+        } catch (err) {
+          setMessage("Invalid JSON: " + (err && err.message ? err.message : String(err)), "error");
+          return;
+        }
+
+        try {
+          await request("/api/claude/settings", {
+            method: "POST",
+            body: JSON.stringify({ contents: edited }),
+          });
+          setMessage("Claude settings.json saved.", "success");
+        } catch (error) {
+          setMessage(error.message || String(error), "error");
+        }
+      }
+
       // Fill form with data
       const AI_FIELD_MAPPINGS = [
         { id: "ai-aiCommand", key: "aiCommand" },
         { id: "ai-claudeWorkDir", key: "claudeWorkDir" },
         { id: "ai-claudeTimeoutMs", key: "claudeTimeoutMs" },
         { id: "ai-claudeConfigPath", key: "claudeConfigPath" },
-        { id: "ai-claudeAuthToken", key: "claudeAuthToken" },
-        { id: "ai-claudeBaseUrl", key: "claudeBaseUrl" },
-        { id: "ai-claudeModel", key: "claudeModel" },
         { id: "ai-claudeProxy", key: "claudeProxy" },
         { id: "ai-codexCliPath", key: "codexCliPath" },
         { id: "ai-codexTimeoutMs", key: "codexTimeoutMs" },
@@ -460,6 +497,7 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
           applyLanguage();
           const data = await request("/api/config");
           fill(data.payload, data.meta);
+          await loadClaudeSettings();
           // Initialize current AI tool panel from dropdown value
           currentAiToolPanel = el("ai-aiCommand")?.value || "claude";
           await refreshStatus();
@@ -499,6 +537,16 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
           }
         });
 
+        // Claude settings.json editor (advanced, inline & collapsible)
+        const claudeSettingsContainer = document.getElementById("claudeSettingsContainer");
+        if (claudeSettingsContainer && claudeSettingsContainer instanceof HTMLDetailsElement) {
+          claudeSettingsContainer.addEventListener("toggle", () => {
+            if (claudeSettingsContainer.open) {
+              void loadClaudeSettings();
+            }
+          });
+        }
+
         // AI tool switcher
         document.querySelectorAll(".tab[data-tool]").forEach((tab) => {
           tab.addEventListener("click", () => {
@@ -531,8 +579,16 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
 
         // Service buttons
         el("validateButton").onclick = validate;
-        el("saveButton").onclick = save;
-        el("startButton").onclick = startService;
+        el("saveButton").onclick = async () => {
+          // 先保存 JSON，再保存主配置
+          await saveClaudeSettings();
+          await save();
+        };
+        el("startButton").onclick = async () => {
+          // 启动前也顺带保存 JSON
+          await saveClaudeSettings();
+          await startService();
+        };
         el("stopButton").onclick = stopService;
 
         // Platform test buttons
@@ -650,12 +706,8 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
         ai: {
           aiCommand: getValue("ai-aiCommand"),
           claudeWorkDir: getValue("ai-claudeWorkDir"),
-          claudeSkipPermissions: true,
           claudeTimeoutMs: getNumber("ai-claudeTimeoutMs"),
           claudeConfigPath: getValue("ai-claudeConfigPath"),
-          claudeAuthToken: getValue("ai-claudeAuthToken"),
-          claudeBaseUrl: getValue("ai-claudeBaseUrl"),
-          claudeModel: getValue("ai-claudeModel"),
           claudeProxy: getValue("ai-claudeProxy"),
           codexTimeoutMs: getNumber("ai-codexTimeoutMs"),
           codebuddyTimeoutMs: getNumber("ai-codebuddyTimeoutMs"),

package/dist/config-web-page-template.js

@@ -1128,19 +1128,20 @@ export const PAGE_HTML_PREFIX = String.raw `<!doctype html>
                       <div class="form-hint" id="ai-claudeConfigPath-hint">Environment variables are saved to ~/.claude/settings.json</div>
                     </div>
                     <div class="form-group">
-                      <label class="form-label" id="ai-claudeAuthToken-label">ANTHROPIC_AUTH_TOKEN</label>
-                      <input id="ai-claudeAuthToken" class="form-input mono" type="password" />
-                      <div class="form-hint" id="ai-claudeAuthToken-hint">Auth token for API access (optional, overrides env)</div>
-                    </div>
-                    <div class="form-group">
-                      <label class="form-label" id="ai-claudeBaseUrl-label">ANTHROPIC_BASE_URL</label>
-                      <input id="ai-claudeBaseUrl" class="form-input mono" type="text" />
-                      <div class="form-hint" id="ai-claudeBaseUrl-hint">Custom API base URL (optional, overrides env)</div>
-                    </div>
-                    <div class="form-group">
-                      <label class="form-label" id="ai-claudeModel-label">ANTHROPIC_MODEL</label>
-                      <input id="ai-claudeModel" class="form-input mono" type="text" />
-                      <div class="form-hint" id="ai-claudeModel-hint">Model name (optional, overrides env)</div>
+                      <details id="claudeSettingsContainer">
+                        <summary class="form-label" style="cursor: pointer;">Edit ~/.claude/settings.json (advanced)</summary>
+                        <div class="form-hint" style="margin-top: 8px; margin-bottom: 8px;">
+                          JSON will be auto-formatted; invalid JSON 会提示错误。
+                        </div>
+                        <textarea
+                          id="claudeSettingsEditor"
+                          class="form-input mono"
+                          style="min-height: 200px; white-space: pre; font-family: var(--font-mono);"
+                        ></textarea>
+                        <div class="form-hint" style="margin-top: 4px;">
+                          折叠/展开以隐藏或查看完整配置。
+                        </div>
+                      </details>
                     </div>
                   </div>
 

package/dist/config-web.d.ts

@@ -5,6 +5,7 @@ export interface StartedWebConfigServer {
     close: () => Promise<void>;
     url: string;
     waitForResult: Promise<WebFlowResult>;
+    loginUrl?: string;
 }
 export declare function getHealthPlatformSnapshot(file: FileConfig, env?: NodeJS.ProcessEnv): Record<string, {
     configured: boolean;

package/dist/config-web.js

@@ -1,6 +1,9 @@
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 import { URL } from "node:url";
+import { randomBytes } from "node:crypto";
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
 import { DWClient } from "dingtalk-stream";
 import { WEB_CONFIG_PORT } from "./constants.js";
 import { CONFIG_PATH, getClaudeConfigHome, loadClaudeSettingsEnv, saveClaudeSettingsEnv, loadConfig, loadFileConfig, saveFileConfig } from "./config.js";
@@ -10,6 +13,104 @@ import { initWeWork, stopWeWork } from "./wework/client.js";
 import { createLogger } from "./logger.js";
 const log = createLogger("ConfigWeb");
 const TEST_TIMEOUT_MS = 10000;
+function getClaudeSettingsPath() {
+    const home = getClaudeConfigHome();
+    const baseDir = join(home, ".claude");
+    return join(baseDir, "settings.json");
+}
+const pendingLogins = new Map();
+const activeSessions = new Map();
+function getWebConfigHost() {
+    const envHost = process.env.OPEN_IM_WEB_HOST?.trim();
+    if (envHost)
+        return envHost;
+    return "127.0.0.1";
+}
+function generateRandomToken(bytes = 32) {
+    return randomBytes(bytes).toString("base64url");
+}
+function cleanupExpiredAuth(now) {
+    for (const [token, info] of pendingLogins) {
+        if (info.expiresAt <= now)
+            pendingLogins.delete(token);
+    }
+    for (const [sessionId, info] of activeSessions) {
+        if (info.expiresAt <= now)
+            activeSessions.delete(sessionId);
+    }
+}
+function createLoginToken(ttlMs) {
+    const now = Date.now();
+    cleanupExpiredAuth(now);
+    const token = generateRandomToken(32);
+    pendingLogins.set(token, { expiresAt: now + ttlMs });
+    return token;
+}
+function createSession(request, ttlMs) {
+    const now = Date.now();
+    cleanupExpiredAuth(now);
+    const sessionId = generateRandomToken(32);
+    const remoteAddr = request.socket.remoteAddress;
+    const userAgent = typeof request.headers["user-agent"] === "string" ? request.headers["user-agent"] : undefined;
+    activeSessions.set(sessionId, {
+        expiresAt: now + ttlMs,
+        remoteAddr,
+        userAgent,
+    });
+    return sessionId;
+}
+function parseCookies(request) {
+    const header = request.headers.cookie;
+    if (!header)
+        return {};
+    const cookies = {};
+    const parts = header.split(";");
+    for (const part of parts) {
+        const [rawKey, ...rest] = part.split("=");
+        const key = rawKey.trim();
+        if (!key)
+            continue;
+        const value = rest.join("=").trim();
+        cookies[key] = decodeURIComponent(value);
+    }
+    return cookies;
+}
+function getSessionIdFromRequest(request) {
+    const cookies = parseCookies(request);
+    const sessionId = cookies.openim_session;
+    return sessionId && typeof sessionId === "string" && sessionId.length > 0 ? sessionId : null;
+}
+function isSessionValid(request) {
+    const sessionId = getSessionIdFromRequest(request);
+    if (!sessionId)
+        return false;
+    const info = activeSessions.get(sessionId);
+    if (!info)
+        return false;
+    const now = Date.now();
+    if (info.expiresAt <= now) {
+        activeSessions.delete(sessionId);
+        return false;
+    }
+    // Optional: tie session to basic client fingerprint (remote address)
+    const remoteAddr = request.socket.remoteAddress;
+    if (info.remoteAddr && remoteAddr && remoteAddr !== info.remoteAddr) {
+        return false;
+    }
+    return true;
+}
+function buildSessionCookie(sessionId, ttlMs) {
+    const maxAgeSec = Math.floor(ttlMs / 1000);
+    const parts = [
+        `openim_session=${encodeURIComponent(sessionId)}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${maxAgeSec}`,
+    ];
+    // 不设置 Secure，方便本地 http 使用；如果放在 https 反代后，可以在代理层加 Secure
+    return parts.join("; ");
+}
 export function getHealthPlatformSnapshot(file, env = process.env) {
     const fileTelegram = file.platforms?.telegram;
     const fileFeishu = file.platforms?.feishu;
@@ -459,18 +560,38 @@ function toFileConfig(payload, existing) {
     };
 }
 function openBrowser(url) {
+    // 显式关闭自动打开浏览器（服务器环境推荐设置）
     if (process.env.OPEN_IM_NO_BROWSER === "1") {
         return;
     }
+    // 在无 TTY 且无图形环境（常见于服务器）时直接跳过，避免无意义的 xdg-open 调用
+    if (!process.stdout.isTTY && !process.env.DISPLAY) {
+        log.info(`Skipping browser launch for URL ${url} (no TTY/DISPLAY detected).`);
+        return;
+    }
+    const safeSpawn = (command, args) => {
+        try {
+            const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: process.platform === "win32" });
+            // 防止 ENOENT 之类的错误变成未捕获异常
+            child.on("error", (error) => {
+                log.warn(`Failed to launch browser command "${command}": ${error.code ?? error.message}`);
+            });
+            child.unref();
+        }
+        catch (error) {
+            log.warn(`Failed to spawn browser command "${command}": ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
     if (process.platform === "win32") {
-        spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore", windowsHide: true }).unref();
+        safeSpawn("cmd", ["/c", "start", "", url]);
         return;
     }
     if (process.platform === "darwin") {
-        spawn("open", [url], { detached: true, stdio: "ignore" }).unref();
+        safeSpawn("open", [url]);
         return;
     }
-    spawn("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
+    // linux / 其他 UNIX 平台：优先尝试 xdg-open，失败时仅记录日志，不抛出
+    safeSpawn("xdg-open", [url]);
 }
 export function getWebConfigPort() {
     const fromEnv = process.env.OPEN_IM_WEB_PORT ? parseInt(process.env.OPEN_IM_WEB_PORT, 10) : NaN;
@@ -494,6 +615,7 @@ export async function startWebConfigServer(options) {
             resolve(value);
         };
     });
+    const host = getWebConfigHost();
     const server = createServer(async (request, response) => {
         const requestUrl = new URL(request.url ?? "/", "http://127.0.0.1");
         const finishFlow = (result) => {
@@ -502,6 +624,43 @@ export async function startWebConfigServer(options) {
             server.close();
             settle(result);
         };
+        // Auth gating:
+        // - 当仅绑定 127.0.0.1 时，保持完全本地免登录（向后兼容）
+        // - 当绑定到 0.0.0.0 或其他地址时，启用一次性登录 + Session Cookie 机制
+        const isLocalOnly = host === "127.0.0.1";
+        const hasLoginTokenFeature = !isLocalOnly;
+        if (hasLoginTokenFeature) {
+            const loginToken = requestUrl.searchParams.get("login_token");
+            if (loginToken) {
+                const info = pendingLogins.get(loginToken);
+                const now = Date.now();
+                if (info && info.expiresAt > now) {
+                    // 有效的一次性登录 token：创建会话，设置 Cookie，并重定向到去掉 login_token 的 URL
+                    pendingLogins.delete(loginToken);
+                    const sessionTtlMs = 24 * 60 * 60 * 1000; // 24 小时
+                    const sessionId = createSession(request, sessionTtlMs);
+                    const cookie = buildSessionCookie(sessionId, sessionTtlMs);
+                    requestUrl.searchParams.delete("login_token");
+                    const redirectPath = requestUrl.pathname + (requestUrl.search ? requestUrl.search : "");
+                    response.writeHead(302, {
+                        Location: redirectPath || "/",
+                        "Set-Cookie": cookie,
+                    });
+                    response.end();
+                    return;
+                }
+                // 无效或过期的一次性 token
+                response.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
+                response.end("Invalid or expired login link. Please generate a new one from the server.");
+                return;
+            }
+            // 其他请求：必须已有有效 session
+            if (!isSessionValid(request)) {
+                response.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
+                response.end("Unauthorized. Please open the latest login URL from the server output.");
+                return;
+            }
+        }
         if (request.method === "GET" && requestUrl.pathname === "/") {
             response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
             response.end(PAGE_HTML);
@@ -553,6 +712,57 @@ export async function startWebConfigServer(options) {
             json(response, 200, getServiceStatus());
             return;
         }
+        if (request.method === "GET" && requestUrl.pathname === "/api/claude/settings") {
+            try {
+                const settingsPath = getClaudeSettingsPath();
+                let contents = "{}";
+                if (existsSync(settingsPath)) {
+                    contents = readFileSync(settingsPath, "utf-8");
+                }
+                else {
+                    // Try to synthesize from env if file doesn't exist yet
+                    const env = loadClaudeSettingsEnv();
+                    if (Object.keys(env).length > 0) {
+                        contents = JSON.stringify({ env }, null, 2);
+                    }
+                }
+                json(response, 200, { path: settingsPath, contents });
+            }
+            catch (error) {
+                json(response, 500, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
+        if (request.method === "POST" && requestUrl.pathname === "/api/claude/settings") {
+            try {
+                const body = await readJson(request);
+                const raw = body.contents ?? "";
+                if (!raw.trim()) {
+                    json(response, 400, { error: "contents is required" });
+                    return;
+                }
+                let parsed;
+                try {
+                    parsed = JSON.parse(raw);
+                }
+                catch (err) {
+                    json(response, 400, { error: `Invalid JSON: ${err instanceof Error ? err.message : String(err)}` });
+                    return;
+                }
+                const pretty = JSON.stringify(parsed, null, 2);
+                const settingsPath = getClaudeSettingsPath();
+                const dir = dirname(settingsPath);
+                if (!existsSync(dir)) {
+                    mkdirSync(dir, { recursive: true });
+                }
+                writeFileSync(settingsPath, pretty, "utf-8");
+                json(response, 200, { message: "Claude settings.json saved.", path: settingsPath });
+            }
+            catch (error) {
+                json(response, 500, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
         if (request.method === "GET" && requestUrl.pathname === "/api/health") {
             const file = loadFileConfig();
             const fileTelegram = file.platforms?.telegram;
@@ -656,7 +866,7 @@ export async function startWebConfigServer(options) {
             }
             reject(error);
         });
-        server.listen(port, "127.0.0.1", () => resolve());
+        server.listen(port, host, () => resolve());
     });
     const address = server.address();
     if (!address || typeof address === "string") {
@@ -678,6 +888,24 @@ export async function startWebConfigServer(options) {
         if (timer)
             clearTimeout(timer);
     });
+    let loginUrlForReturn;
+    // 当绑定到非 127.0.0.1（例如 0.0.0.0）时，为远程访问生成一次性登录链接
+    if (host !== "127.0.0.1") {
+        const loginTtlMs = 15 * 60 * 1000; // 15 分钟内有效
+        const loginToken = createLoginToken(loginTtlMs);
+        const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+        const baseUrl = `http://${displayHost}:${port}`;
+        const loginUrl = `${baseUrl}/?login_token=${encodeURIComponent(loginToken)}`;
+        loginUrlForReturn = loginUrl;
+        log.info("━━━━━━━━ Web Config Login ━━━━━━━━");
+        log.info(`Host binding : ${host}`);
+        log.info(`Login URL    : ${loginUrl}`);
+        if (host === "0.0.0.0") {
+            log.info("Note: replace 127.0.0.1 with your server IP or hostname when opening from another device.");
+        }
+        log.info(`This login link is valid for approximately ${Math.floor(loginTtlMs / 60000)} minutes and can be used only once.`);
+        log.info("After login, subsequent requests will use a short-lived session cookie.");
+    }
     return {
         close: async () => {
             if (timer)
@@ -686,13 +914,15 @@ export async function startWebConfigServer(options) {
             settle("cancel");
         },
         url: `http://127.0.0.1:${port}`,
+        loginUrl: loginUrlForReturn,
         waitForResult,
     };
 }
 export async function runWebConfigFlow(options) {
     const started = await startWebConfigServer(options);
-    openBrowser(started.url);
-    log.info(`Opened local configuration page: ${started.url}`);
+    const targetUrl = started.loginUrl ?? started.url;
+    openBrowser(targetUrl);
+    log.info(`Opened local configuration page: ${targetUrl}`);
     log.info(process.env.OPEN_IM_NO_BROWSER === "1" ? "Browser launch disabled. Open the URL manually." : "Save the configuration in your browser to continue.");
     return started.waitForResult;
 }

package/dist/index.js

@@ -103,6 +103,7 @@ function buildShutdownMessage(uptimeMinutes) {
     ].join("\n");
 }
 export async function main() {
+    const startupCwd = process.cwd();
     if (needsSetup()) {
         const saved = process.stdin.isTTY
             ? (await runWebConfigFlow({ mode: "dev", cwd: process.cwd() })) === "saved"
@@ -158,9 +159,12 @@ export async function main() {
     });
     log.info("Starting open-im bridge...");
     log.info(`AI 工具: ${getConfiguredAiCommands(config).join(", ")}`);
-    log.info(`默认会话目录: ${config.claudeWorkDir}`);
+    log.info(`默认会话目录(本次启动 cwd): ${startupCwd}`);
+    if (startupCwd !== config.claudeWorkDir) {
+        log.info(`历史默认会话目录(配置中的 claudeWorkDir): ${config.claudeWorkDir}`);
+    }
     log.info(`启用平台: ${config.enabledPlatforms.join(", ")}`);
-    const sessionManager = new SessionManager(config.claudeWorkDir);
+    const sessionManager = new SessionManager(startupCwd, config.claudeWorkDir);
     // CLI 工具（Codex/CodeBuddy）的 session 是进程级别的，服务重启后一定无效。
     // 启动时仅清除 CLI 工具自己的 sessionId，保留 Claude 的持久上下文。
     sessionManager.clearAllCliSessionIds();
@@ -241,7 +245,7 @@ export async function main() {
     log.info(`Successfully initialized platforms: ${successfulPlatforms.join(", ")}`);
     // Send notification only to successfully initialized platforms
     for (const platform of successfulPlatforms) {
-        const startupMsg = buildStartupMessage(platform, APP_VERSION, resolvePlatformAiCommand(config, platform), config.claudeWorkDir, sessionManager);
+        const startupMsg = buildStartupMessage(platform, APP_VERSION, resolvePlatformAiCommand(config, platform), startupCwd, sessionManager);
         await sendLifecycleNotification(platform, startupMsg).catch((err) => {
             log.warn(`Failed to send startup notification to ${platform}:`, err);
         });

package/dist/session/session-manager.d.ts

@@ -5,7 +5,11 @@ export declare class SessionManager {
     private convSessionMap;
     private defaultWorkDir;
     private saveTimer;
-    constructor(defaultWorkDir: string);
+    /**
+     * @param defaultWorkDir 本次进程的默认工作目录（通常为进程启动时的 cwd）
+     * @param previousDefaultWorkDir 旧版本/旧配置使用的默认目录（用于迁移仍跟随默认值的会话）
+     */
+    constructor(defaultWorkDir: string, previousDefaultWorkDir?: string);
     getSessionIdForConv(userId: string, convId: string, toolId: ToolId): string | undefined;
     setSessionIdForConv(userId: string, convId: string, toolId: ToolId, sessionId: string): void;
     /** 清除指定会话的 sessionId（用于 SDK 报 "No conversation found" 时） */

package/dist/session/session-manager.js

@@ -30,9 +30,13 @@ export class SessionManager {
     convSessionMap = new Map();
     defaultWorkDir;
     saveTimer = null;
-    constructor(defaultWorkDir) {
+    /**
+     * @param defaultWorkDir 本次进程的默认工作目录（通常为进程启动时的 cwd）
+     * @param previousDefaultWorkDir 旧版本/旧配置使用的默认目录（用于迁移仍跟随默认值的会话）
+     */
+    constructor(defaultWorkDir, previousDefaultWorkDir) {
         this.defaultWorkDir = defaultWorkDir;
-        this.load();
+        this.load(previousDefaultWorkDir);
     }
     getSessionIdForConv(userId, convId, toolId) {
         const s = this.sessions.get(userId);
@@ -234,12 +238,16 @@ export class SessionManager {
             throw new Error(`目录不存在: \`${resolved}\``);
         return realpath(resolved);
     }
-    load() {
+    load(previousDefaultWorkDir) {
         try {
             if (existsSync(SESSIONS_FILE)) {
                 const data = JSON.parse(readFileSync(SESSIONS_FILE, 'utf-8'));
                 for (const [k, v] of Object.entries(data)) {
                     if (v && typeof v.workDir === 'string') {
+                        // 如果该会话目录等于旧默认目录，则迁移到新的默认目录（认为用户没有手动 /cd 过）
+                        if (previousDefaultWorkDir && v.workDir === previousDefaultWorkDir) {
+                            v.workDir = this.defaultWorkDir;
+                        }
                         if (!v.activeConvId)
                             v.activeConvId = randomBytes(4).toString('hex');
                         if (!v.sessionIds)

package/dist/shared/ai-task.js

@@ -35,6 +35,7 @@ export function runAITask(deps, ctx, prompt, toolAdapter, platformAdapter) {
         let wasThinking = false;
         let thinkingText = '';
         let currentSessionId = ctx.sessionId;
+        let hadSessionInvalid = false;
         let activeHandle = null;
         const toolLines = [];
         const minDelta = platformAdapter.minContentDeltaChars ?? 0;
@@ -105,8 +106,11 @@ export function runAITask(deps, ctx, prompt, toolAdapter, platformAdapter) {
                         log.info(`[AITask] No threadId or convId, sessionId not persisted to storage`);
                 },
                 onSessionInvalid: () => {
+                    hadSessionInvalid = true;
                     if (ctx.convId)
                         sessionManager.clearSessionForConv(ctx.userId, ctx.convId, aiCommand);
+                    const ok = sessionManager.newSession(ctx.userId);
+                    log.info(`[AITask] Session invalid for user ${ctx.userId}, aiCommand=${aiCommand}; auto /new applied, ok=${ok}`);
                 },
                 onThinking: (t) => {
                     if (!firstContentLogged) {
@@ -208,8 +212,11 @@ export function runAITask(deps, ctx, prompt, toolAdapter, platformAdapter) {
                     else if (aiCommand === 'codex' && isUsageLimitError(error)) {
                         log.info(`Keeping codex session for user ${ctx.userId} after usage limit error`);
                     }
+                    const friendlyError = hadSessionInvalid
+                        ? '当前 Claude 会话已失效，已自动执行 /new 重置会话，请重新发送刚才的问题。'
+                        : error;
                     try {
-                        await platformAdapter.sendError(error);
+                        await platformAdapter.sendError(friendlyError);
                     }
                     catch (err) {
                         log.error('Failed to send error:', err);
@@ -221,6 +228,8 @@ export function runAITask(deps, ctx, prompt, toolAdapter, platformAdapter) {
                 timeoutMs,
                 model: sessionManager.getModel(ctx.userId, ctx.threadId) ?? config.claudeModel,
                 chatId: ctx.chatId,
+                // Claude 默认跳过权限确认，保持与之前 CLI 行为一致（全自动执行）
+                ...(aiCommand === 'claude' ? { skipPermissions: true } : {}),
                 ...(aiCommand === 'codex' && config.codexProxy ? { proxy: config.codexProxy } : {}),
             });
             return activeHandle;

package/dist/shared/ai-task.test.js

@@ -35,13 +35,10 @@ describe("runAITask", () => {
                 aiCommand: "codex",
                 platforms: {},
                 enabledPlatforms: [],
-                defaultPermissionMode: "ask",
                 codexTimeoutMs: 600000,
                 claudeTimeoutMs: 600000,
                 codebuddyTimeoutMs: 600000,
-                claudeSkipPermissions: false,
                 claudeModel: "",
-                hookPort: 35801,
                 codexProxy: "",
                 wechatToken: "",
                 wechatGuid: "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wu529778790/open-im",
-  "version": "1.7.0-beta.3",
+  "version": "1.7.0-beta.5",
   "description": "Multi-platform IM bridge for AI CLI tools (Claude, Codex, CodeBuddy)",
   "type": "module",
   "main": "dist/index.js",