npm - @wu529778790/open-im - Versions diffs - 1.7.1-beta.1 → 1.7.1-beta.10 - Mend

@wu529778790/open-im 1.7.1-beta.1 → 1.7.1-beta.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/README.md +83 -104
package/README.zh-CN.md +84 -105
package/dist/cli.js +10 -3
package/dist/config-web-page-i18n.d.ts +0 -3
package/dist/config-web-page-i18n.js +0 -3
package/dist/config-web-page-script.js +64 -11
package/dist/config-web-page-template.js +14 -13
package/dist/config-web.d.ts +1 -0
package/dist/config-web.js +215 -5
package/dist/config.d.ts +7 -1
package/dist/config.js +16 -7
package/package.json +1 -1

package/README.md CHANGED Viewed

@@ -14,19 +14,6 @@ Multi-platform IM bridge for AI CLI tools. Connect Telegram, Feishu, WeCom, Ding
 - Isolated sessions: each user gets an independent local session, and `/new` resets it
 - Built-in commands: `/help`, `/new`, `/cd`, `/pwd`, `/status`
-## Coverage Matrix
-Capability levels: `Native` = fully supported in-channel, `Fallback` = degraded behavior or text fallback, `None` = not currently supported.
-| Platform | Text Inbound | Image Inbound | File Inbound | Voice Inbound | Video Inbound | Streaming Reply | Image Reply | Card Reply |
-| ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |
-| Telegram | Native | Native | Native | Native | Native | Native | Native | Native |
-| Feishu | Native | Native | Native | Fallback | Fallback | Native | Native | Native |
-| QQ | Native | Fallback | Fallback | Fallback | Fallback | None | Fallback | Fallback |
-| WeCom | Native | Fallback | Fallback | Fallback | Fallback | Native | Native | Native |
-| DingTalk | Native | Fallback | Fallback | Fallback | Fallback | Native | Fallback | Native |
-| WeChat (experimental) | Native | Fallback | Fallback | Fallback | Fallback | Native | Fallback | Native |
 ## Requirements
 - Node.js >= 20
@@ -50,12 +37,13 @@ The config file is stored at `~/.open-im/config.json` by default.
 ## CLI Commands
-| Command | Description |
-| ---- | ---- |
-| `open-im init` | Initialize or append configuration without starting the service |
-| `open-im start` | Run the service in the background |
-| `open-im stop` | Stop the background service |
-| `open-im dev` | Run in the foreground for development/debugging |
+| Command           | Description                                                      |
+| ----------------- | ---------------------------------------------------------------- |
+| `open-im init`    | Initialize or append configuration without starting the service |
+| `open-im start`   | Run the service in the background                                |
+| `open-im stop`    | Stop the background service                                      |
+| `open-im dev`     | Run in the foreground for development/debugging                  |
+| `open-im dashboard` | Run only the config web UI (no bridge)                        |
 ## Server Deployment & Config Page
@@ -65,59 +53,50 @@ Open the config page at [`http://127.0.0.1:39282`](http://127.0.0.1:39282) (or t
 - **Dashboard** – Configured / Enabled platform count and service status (Idle or Running)
 - **Platforms** – Enable and configure Telegram, Feishu, QQ, WeCom, and DingTalk (credentials, proxy, per-platform AI tool, allowed user IDs). Each platform has a “Test Configuration” button.
-- **AI Tooling** – **General**: default AI tool (Claude / Codex / CodeBuddy), work directory, hook port, log level. **Per-tool tabs**: Claude (CLI path, timeout, proxy, config path, ANTHROPIC_* fields), Codex (CLI path, timeout, proxy), CodeBuddy (CLI path, timeout).
+- **AI Tooling** – **General**: default AI tool (Claude / Codex / CodeBuddy), work directory, hook port, log level. **Per-tool tabs**: Claude (CLI path, timeout, proxy, config path, ANTHROPIC\_\* fields), Codex (CLI path, timeout, proxy), CodeBuddy (CLI path, timeout).
 - **Service control** – Validate config, Save, Start bridge, Stop bridge.
 WeChat is not in the web UI; configure it in `~/.open-im/config.json` or via `open-im init` if needed.
-- `open-im start` serves both the config page and the bridge.
+- `open-im start` serves both the config page and the bridge on your local machine.
 - `open-im dev` opens the page automatically only when setup is incomplete.
-- To open the page when config already exists, run `open-im start` and visit the URL above.
-### On a headless server (no GUI)
-Many servers do not have a desktop environment or browser. In that case, trying to auto-launch a browser (`xdg-open`, `open`, `start`) is unnecessary and may even fail. Use this pattern instead:
-- **1) Disable automatic browser launch**
-  On the server:
-  ```bash
-  export OPEN_IM_NO_BROWSER=1
-  open-im start
-  ```
+- To open the page when config already exists, you can also run `open-im dashboard` to launch the config UI only (without starting the bridge).
-  This starts the bridge and the config web server in the background without attempting to open a browser.
+### Recommended server workflow
-- **2) Verify that the config page is listening on the server**
+On a remote server, the simplest and safest pattern is:
-  On the server:
+1. **Use `dashboard` to configure via browser**
-  ```bash
-  ss -lntp | grep 39282        # or: netstat -lntp | grep 39282
-  curl -v http://127.0.0.1:39282/
-  ```
+   On the server:
-  If you see a `LISTEN` line for `127.0.0.1:39282` and `curl` returns HTML, the config UI is running.
+   ```bash
+   export OPEN_IM_NO_BROWSER=1
+   # Optional: bind to all interfaces if you want to open from another device
+   # export OPEN_IM_WEB_HOST=0.0.0.0
+   open-im dashboard
+   ```
-- **3) Access the config UI from your local machine via SSH tunnel**
+   - This starts only the config web UI (no bridge yet).
+   - If `OPEN_IM_WEB_HOST` is `0.0.0.0`, the server will print a one-time login URL like:
-  Instead of exposing port 39282 to the public internet, use SSH port forwarding:
+     ```text
+     http://your-server-ip:39282/?login_token=xxxx
+     ```
-  ```bash
-  # On your local machine:
-  ssh -L 39282:127.0.0.1:39282 user@your-server-ip
-  ```
+   - Open this URL in your browser, complete all platform/AI settings, then click **Start bridge** in the web UI.
-  Then open in your local browser:
+2. **Run the bridge as a background service**
-  ```text
-  http://127.0.0.1:39282/
-  ```
+   After configuration is saved, you have two options:
+   - Start from the web UI: use the **Start bridge** button on the Service panel.
+   - Or start from the CLI:
-  This safely tunnels the config page from the server to your local browser.
+     ```bash
+     open-im start
+     ```
-> If you really want to expose the config UI directly, you can change the listener in `config-web.ts` from `server.listen(port, "127.0.0.1", ...)` to `0.0.0.0` and open port 39282 in your firewall / security group. For security reasons, SSH tunneling is strongly recommended instead.
+   This runs the full bridge in the background using the saved config.
 ## Session Behavior
@@ -268,46 +247,46 @@ The following is valid JSON and can be saved directly as `~/.open-im/config.json
 ### Common Environment Variables
-| Variable | Description |
-| ---- | ---- |
-| `AI_COMMAND` | Select `claude`, `codex`, or `codebuddy` |
-| `CLAUDE_WORK_DIR` | Default session working directory |
-| `LOG_DIR` | Log directory |
-| `LOG_LEVEL` | Log level |
-| `HOOK_PORT` | Permission service port |
-| `CODEX_PROXY` | Proxy used by Codex to access `chatgpt.com` |
-| `OPENAI_API_KEY` | Codex API key, can replace `codex login` |
-| `CODEBUDDY_CLI_PATH` | Override CodeBuddy CLI path |
-| `CODEBUDDY_TIMEOUT_MS` | Override CodeBuddy timeout |
-| `CODEBUDDY_SKIP_PERMISSIONS` | Override CodeBuddy skip-permissions behavior |
-| `CODEBUDDY_IDLE_TIMEOUT_MS` | Abort CodeBuddy when it stays silent for too long |
-| `CODEBUDDY_API_KEY` | CodeBuddy API key, can replace `codebuddy login` |
-| `CODEBUDDY_AUTH_TOKEN` | CodeBuddy auth token, can replace `codebuddy login` |
-| `TELEGRAM_BOT_TOKEN` | Telegram bot token |
-| `TELEGRAM_PROXY` | Telegram proxy URL |
-| `TELEGRAM_ALLOWED_USER_IDS` | Telegram allowlist |
-| `FEISHU_APP_ID` | Feishu app ID |
-| `FEISHU_APP_SECRET` | Feishu app secret |
-| `FEISHU_ALLOWED_USER_IDS` | Feishu allowlist |
-| `QQ_BOT_APPID` | QQ bot app ID |
-| `QQ_BOT_SECRET` | QQ bot app secret |
-| `QQ_BOT_SANDBOX` | QQ bot sandbox mode (`1` / `true` to enable, disabled by default) |
-| `QQ_ALLOWED_USER_IDS` | QQ allowlist |
-| `DINGTALK_CLIENT_ID` | DingTalk client ID / AppKey |
-| `DINGTALK_CLIENT_SECRET` | DingTalk client secret / AppSecret |
-| `DINGTALK_CARD_TEMPLATE_ID` | DingTalk AI card template ID; enables single-message streaming replies |
-| `DINGTALK_ALLOWED_USER_IDS` | DingTalk allowlist |
-| `WEWORK_CORP_ID` | WeCom bot ID |
-| `WEWORK_SECRET` | WeCom secret |
-| `WEWORK_WS_URL` | WeCom WebSocket URL |
-| `WEWORK_ALLOWED_USER_IDS` | WeCom allowlist |
-| `WECHAT_APP_ID` | WeChat standard mode app ID |
-| `WECHAT_APP_SECRET` | WeChat standard mode app secret |
-| `WECHAT_TOKEN` | WeChat AGP mode token |
-| `WECHAT_GUID` | WeChat AGP mode GUID |
-| `WECHAT_USER_ID` | WeChat AGP mode user ID |
-| `WECHAT_WS_URL` | WeChat WebSocket URL |
-| `WECHAT_ALLOWED_USER_IDS` | WeChat allowlist |
+| Variable                     | Description                                                            |
+| ---------------------------- | ---------------------------------------------------------------------- |
+| `AI_COMMAND`                 | Select `claude`, `codex`, or `codebuddy`                               |
+| `CLAUDE_WORK_DIR`            | Default session working directory                                      |
+| `LOG_DIR`                    | Log directory                                                          |
+| `LOG_LEVEL`                  | Log level                                                              |
+| `HOOK_PORT`                  | Permission service port                                                |
+| `CODEX_PROXY`                | Proxy used by Codex to access `chatgpt.com`                            |
+| `OPENAI_API_KEY`             | Codex API key, can replace `codex login`                               |
+| `CODEBUDDY_CLI_PATH`         | Override CodeBuddy CLI path                                            |
+| `CODEBUDDY_TIMEOUT_MS`       | Override CodeBuddy timeout                                             |
+| `CODEBUDDY_SKIP_PERMISSIONS` | Override CodeBuddy skip-permissions behavior                           |
+| `CODEBUDDY_IDLE_TIMEOUT_MS`  | Abort CodeBuddy when it stays silent for too long                      |
+| `CODEBUDDY_API_KEY`          | CodeBuddy API key, can replace `codebuddy login`                       |
+| `CODEBUDDY_AUTH_TOKEN`       | CodeBuddy auth token, can replace `codebuddy login`                    |
+| `TELEGRAM_BOT_TOKEN`         | Telegram bot token                                                     |
+| `TELEGRAM_PROXY`             | Telegram proxy URL                                                     |
+| `TELEGRAM_ALLOWED_USER_IDS`  | Telegram allowlist                                                     |
+| `FEISHU_APP_ID`              | Feishu app ID                                                          |
+| `FEISHU_APP_SECRET`          | Feishu app secret                                                      |
+| `FEISHU_ALLOWED_USER_IDS`    | Feishu allowlist                                                       |
+| `QQ_BOT_APPID`               | QQ bot app ID                                                          |
+| `QQ_BOT_SECRET`              | QQ bot app secret                                                      |
+| `QQ_BOT_SANDBOX`             | QQ bot sandbox mode (`1` / `true` to enable, disabled by default)      |
+| `QQ_ALLOWED_USER_IDS`        | QQ allowlist                                                           |
+| `DINGTALK_CLIENT_ID`         | DingTalk client ID / AppKey                                            |
+| `DINGTALK_CLIENT_SECRET`     | DingTalk client secret / AppSecret                                     |
+| `DINGTALK_CARD_TEMPLATE_ID`  | DingTalk AI card template ID; enables single-message streaming replies |
+| `DINGTALK_ALLOWED_USER_IDS`  | DingTalk allowlist                                                     |
+| `WEWORK_CORP_ID`             | WeCom bot ID                                                           |
+| `WEWORK_SECRET`              | WeCom secret                                                           |
+| `WEWORK_WS_URL`              | WeCom WebSocket URL                                                    |
+| `WEWORK_ALLOWED_USER_IDS`    | WeCom allowlist                                                        |
+| `WECHAT_APP_ID`              | WeChat standard mode app ID                                            |
+| `WECHAT_APP_SECRET`          | WeChat standard mode app secret                                        |
+| `WECHAT_TOKEN`               | WeChat AGP mode token                                                  |
+| `WECHAT_GUID`                | WeChat AGP mode GUID                                                   |
+| `WECHAT_USER_ID`             | WeChat AGP mode user ID                                                |
+| `WECHAT_WS_URL`              | WeChat WebSocket URL                                                   |
+| `WECHAT_ALLOWED_USER_IDS`    | WeChat allowlist                                                       |
 ### Platform Setup Sources
@@ -328,15 +307,15 @@ DingTalk AI card templates are already compatible with the official "Search Resu
 ## IM Commands
-| Command | Description |
-| ---- | ---- |
-| `/help` | Show help |
-| `/new` | Start a new session |
-| `/status` | Show AI tool, version, session directory, and session ID |
-| `/cd <path>` | Change the session working directory |
-| `/pwd` | Show the current session working directory |
-| `/allow` `/y` | Approve a permission request |
-| `/deny` `/n` | Reject a permission request |
+| Command       | Description                                              |
+| ------------- | -------------------------------------------------------- |
+| `/help`       | Show help                                                |
+| `/new`        | Start a new session                                      |
+| `/status`     | Show AI tool, version, session directory, and session ID |
+| `/cd <path>`  | Change the session working directory                     |
+| `/pwd`        | Show the current session working directory               |
+| `/allow` `/y` | Approve a permission request                             |
+| `/deny` `/n`  | Reject a permission request                              |
 ## Troubleshooting

package/README.zh-CN.md CHANGED Viewed

@@ -14,19 +14,6 @@
 - 会话隔离：每个用户独立维护本地会话，`/new` 可重置
 - 常用命令：支持 `/help`、`/new`、`/cd`、`/pwd`、`/status`
-## 覆盖矩阵
-能力等级说明：`Native` 表示平台内原生支持，`Fallback` 表示有降级方案或文本兜底，`None` 表示当前暂不支持。
-| 平台 | 文本输入 | 图片输入 | 文件输入 | 语音输入 | 视频输入 | 流式回复 | 图片回复 | 卡片回复 |
-| ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |
-| Telegram | Native | Native | Native | Native | Native | Native | Native | Native |
-| 飞书 | Native | Native | Native | Fallback | Fallback | Native | Native | Native |
-| QQ | Native | Fallback | Fallback | Fallback | Fallback | None | Fallback | Fallback |
-| 企业微信 | Native | Fallback | Fallback | Fallback | Fallback | Native | Native | Native |
-| 钉钉 | Native | Fallback | Fallback | Fallback | Fallback | Native | Fallback | Native |
-| 微信（测试中） | Native | Fallback | Fallback | Fallback | Fallback | Native | Fallback | Native |
 ## 环境要求
 - Node.js >= 20
@@ -50,12 +37,13 @@ open-im start
 ## CLI 命令
-| 命令 | 说明 |
-| ---- | ---- |
-| `open-im init` | 初始化或追加配置，不启动服务 |
-| `open-im start` | 后台运行服务 |
-| `open-im stop` | 停止后台服务 |
-| `open-im dev` | 前台运行（调试模式） |
+| 命令              | 说明                           |
+| ----------------- | ------------------------------ |
+| `open-im init`    | 初始化或追加配置，不启动服务   |
+| `open-im start`   | 后台运行服务                   |
+| `open-im stop`    | 停止后台服务                   |
+| `open-im dev`     | 前台运行（调试模式）           |
+| `open-im dashboard` | 仅启动 Web 配置页（不启动桥接服务） |
 ## 服务器部署与图形化配置
@@ -71,59 +59,50 @@ open-im start
 - **概览** – 已配置/已启用平台数量、服务状态（未启动或运行中）
 - **平台配置** – 启用并填写 Telegram、飞书、QQ、企业微信、钉钉的凭证（Bot Token/App ID/Secret、代理、该平台使用的 AI 工具、白名单用户 ID）。每个平台提供「校验配置」按钮
-- **AI 工具配置** – **公共**：默认 AI 工具（Claude / Codex / CodeBuddy）、工作目录、Hook 端口、日志级别。**分工具**：Claude（CLI 路径、超时、代理、配置路径、ANTHROPIC_* 等）、Codex（CLI 路径、超时、代理）、CodeBuddy（CLI 路径、超时）
+- **AI 工具配置** – **公共**：默认 AI 工具（Claude / Codex / CodeBuddy）、工作目录、Hook 端口、日志级别。**分工具**：Claude（CLI 路径、超时、代理、配置路径、ANTHROPIC\_\* 等）、Codex（CLI 路径、超时、代理）、CodeBuddy（CLI 路径、超时）
 - **服务控制** – 校验配置、保存、启动桥接、停止桥接
 微信暂不在网页中配置，如需使用请在 `~/.open-im/config.json` 中手动配置或通过 `open-im init` 引导。
-- `open-im start` 会同时启动桥接服务并提供该配置页
-- `open-im dev` 仅在未完成配置时自动打开页面
-- 已有配置但想手动打开时，执行 `open-im start` 后访问上述地址即可
-### 在服务器上部署（无图形界面）
-很多服务器没有桌面环境和浏览器，此时「自动打开浏览器」既没意义，还可能因为缺少 `xdg-open` 报错。推荐如下用法：
-- **1）关闭自动打开浏览器**
-  在服务器上设置环境变量，然后启动：
-  ```bash
-  export OPEN_IM_NO_BROWSER=1
-  open-im start
-  ```
+- `open-im start` 会同时启动桥接服务并提供该配置页（本机场景）。
+- `open-im dev` 仅在未完成配置时自动打开页面。
+- 已有配置但想单独打开配置页时，可以使用 `open-im dashboard` 启动仅 Web 配置服务。
-  这样只会在后台启动服务与配置页面，不会尝试执行 `xdg-open` / `open` / `start`。
+### 推荐的服务器端使用方式
-- **2）检查配置页面是否已在服务器本机监听**
+在远程服务器上，建议的最简单、安全的方式是：
-  在服务器上执行：
+1. **先通过 `dashboard` 在浏览器里完成配置**
-  ```bash
-  ss -lntp | grep 39282        # 或 netstat -lntp | grep 39282
-  curl -v http://127.0.0.1:39282/
-  ```
+   在服务器上执行：
-  若看到 `LISTEN 0 ... 127.0.0.1:39282` 且 `curl` 返回 HTML，则说明 Web 配置页已正常启动。
+   ```bash
+   export OPEN_IM_NO_BROWSER=1
+   # 可选：如果希望从其他设备访问配置页，可以绑定到所有网卡
+   # export OPEN_IM_WEB_HOST=0.0.0.0
+   open-im dashboard
+   ```
-- **3）通过 SSH 隧道在本地浏览器访问**
+   - 这只会启动 Web 配置页，不会同时启动桥接服务。
+   - 若设置了 `OPEN_IM_WEB_HOST=0.0.0.0`，服务端会输出一次性登录链接，例如：
-  不建议直接对外开放 39282 端口，而是使用 SSH 端口转发：
+     ```text
+     http://your-server-ip:39282/?login_token=xxxx
+     ```
-  ```bash
-  # 在本地电脑执行，将本地 39282 转发到服务器 127.0.0.1:39282
-  ssh -L 39282:127.0.0.1:39282 user@your-server-ip
-  ```
+   - 在浏览器中打开该链接，按照页面提示完成各个平台 / AI 工具配置，最后在页面中点击 **「Start bridge」** 按钮启动桥接服务。
-  然后在本地浏览器访问：
+2. **后台运行桥接服务**
-  ```text
-  http://127.0.0.1:39282/
-  ```
+   配置保存后，有两种启动方式：
+   - 在 Web 页面 Service 面板中直接点击 **「Start bridge」**；
+   - 或者在服务器上运行：
-  即可打开服务器上的配置页面。
+     ```bash
+     open-im start
+     ```
-> 如确有需要，也可以自行修改 `config-web.ts` 中的监听地址，将 `server.listen(port, "127.0.0.1", ...)` 调整为 `0.0.0.0`，并在防火墙/安全组放行 39282 端口。但出于安全考虑，官方推荐使用 SSH 隧道方式。
+   这会根据已保存的配置，在后台长期运行桥接服务。
 ## 会话说明
@@ -274,46 +253,46 @@ codebuddy login
 ### 常用环境变量
-| 变量 | 说明 |
-| ---- | ---- |
-| `AI_COMMAND` | 选择 `claude` / `codex` / `codebuddy` |
-| `CLAUDE_WORK_DIR` | 默认会话目录 |
-| `LOG_DIR` | 日志目录 |
-| `LOG_LEVEL` | 日志级别 |
-| `HOOK_PORT` | 权限服务端口 |
-| `CODEX_PROXY` | Codex 访问 `chatgpt.com` 的代理 |
-| `OPENAI_API_KEY` | Codex API Key，可替代 `codex login` |
-| `CODEBUDDY_CLI_PATH` | 覆盖 CodeBuddy CLI 路径 |
-| `CODEBUDDY_TIMEOUT_MS` | 覆盖 CodeBuddy 超时 |
-| `CODEBUDDY_SKIP_PERMISSIONS` | 覆盖 CodeBuddy 的跳过权限确认行为 |
-| `CODEBUDDY_IDLE_TIMEOUT_MS` | CodeBuddy 长时间无输出时自动终止 |
-| `CODEBUDDY_API_KEY` | CodeBuddy API Key，可替代 `codebuddy login` |
-| `CODEBUDDY_AUTH_TOKEN` | CodeBuddy Auth Token，可替代 `codebuddy login` |
-| `TELEGRAM_BOT_TOKEN` | Telegram Bot Token |
-| `TELEGRAM_PROXY` | Telegram 代理地址 |
-| `TELEGRAM_ALLOWED_USER_IDS` | Telegram 白名单 |
-| `FEISHU_APP_ID` | 飞书 App ID |
-| `FEISHU_APP_SECRET` | 飞书 App Secret |
-| `FEISHU_ALLOWED_USER_IDS` | 飞书白名单 |
-| `QQ_BOT_APPID` | QQ 机器人 App ID |
-| `QQ_BOT_SECRET` | QQ 机器人 App Secret |
-| `QQ_BOT_SANDBOX` | QQ 机器人沙箱模式（`1`/`true` 启用，默认关闭） |
-| `QQ_ALLOWED_USER_IDS` | QQ 白名单 |
-| `DINGTALK_CLIENT_ID` | 钉钉应用 Client ID / AppKey |
-| `DINGTALK_CLIENT_SECRET` | 钉钉应用 Client Secret / AppSecret |
-| `DINGTALK_CARD_TEMPLATE_ID` | 钉钉 AI 卡片模板 ID，配置后启用单条流式回复 |
-| `DINGTALK_ALLOWED_USER_IDS` | 钉钉白名单 |
-| `WEWORK_CORP_ID` | 企业微信 Bot ID |
-| `WEWORK_SECRET` | 企业微信 Secret |
-| `WEWORK_WS_URL` | 企业微信 WebSocket 地址 |
-| `WEWORK_ALLOWED_USER_IDS` | 企业微信白名单 |
-| `WECHAT_APP_ID` | 微信标准模式 App ID |
-| `WECHAT_APP_SECRET` | 微信标准模式 App Secret |
-| `WECHAT_TOKEN` | 微信 AGP 模式 Token |
-| `WECHAT_GUID` | 微信 AGP 模式 GUID |
-| `WECHAT_USER_ID` | 微信 AGP 模式 User ID |
-| `WECHAT_WS_URL` | 微信 WebSocket 地址 |
-| `WECHAT_ALLOWED_USER_IDS` | 微信白名单 |
+| 变量                         | 说明                                           |
+| ---------------------------- | ---------------------------------------------- |
+| `AI_COMMAND`                 | 选择 `claude` / `codex` / `codebuddy`          |
+| `CLAUDE_WORK_DIR`            | 默认会话目录                                   |
+| `LOG_DIR`                    | 日志目录                                       |
+| `LOG_LEVEL`                  | 日志级别                                       |
+| `HOOK_PORT`                  | 权限服务端口                                   |
+| `CODEX_PROXY`                | Codex 访问 `chatgpt.com` 的代理                |
+| `OPENAI_API_KEY`             | Codex API Key，可替代 `codex login`            |
+| `CODEBUDDY_CLI_PATH`         | 覆盖 CodeBuddy CLI 路径                        |
+| `CODEBUDDY_TIMEOUT_MS`       | 覆盖 CodeBuddy 超时                            |
+| `CODEBUDDY_SKIP_PERMISSIONS` | 覆盖 CodeBuddy 的跳过权限确认行为              |
+| `CODEBUDDY_IDLE_TIMEOUT_MS`  | CodeBuddy 长时间无输出时自动终止               |
+| `CODEBUDDY_API_KEY`          | CodeBuddy API Key，可替代 `codebuddy login`    |
+| `CODEBUDDY_AUTH_TOKEN`       | CodeBuddy Auth Token，可替代 `codebuddy login` |
+| `TELEGRAM_BOT_TOKEN`         | Telegram Bot Token                             |
+| `TELEGRAM_PROXY`             | Telegram 代理地址                              |
+| `TELEGRAM_ALLOWED_USER_IDS`  | Telegram 白名单                                |
+| `FEISHU_APP_ID`              | 飞书 App ID                                    |
+| `FEISHU_APP_SECRET`          | 飞书 App Secret                                |
+| `FEISHU_ALLOWED_USER_IDS`    | 飞书白名单                                     |
+| `QQ_BOT_APPID`               | QQ 机器人 App ID                               |
+| `QQ_BOT_SECRET`              | QQ 机器人 App Secret                           |
+| `QQ_BOT_SANDBOX`             | QQ 机器人沙箱模式（`1`/`true` 启用，默认关闭） |
+| `QQ_ALLOWED_USER_IDS`        | QQ 白名单                                      |
+| `DINGTALK_CLIENT_ID`         | 钉钉应用 Client ID / AppKey                    |
+| `DINGTALK_CLIENT_SECRET`     | 钉钉应用 Client Secret / AppSecret             |
+| `DINGTALK_CARD_TEMPLATE_ID`  | 钉钉 AI 卡片模板 ID，配置后启用单条流式回复    |
+| `DINGTALK_ALLOWED_USER_IDS`  | 钉钉白名单                                     |
+| `WEWORK_CORP_ID`             | 企业微信 Bot ID                                |
+| `WEWORK_SECRET`              | 企业微信 Secret                                |
+| `WEWORK_WS_URL`              | 企业微信 WebSocket 地址                        |
+| `WEWORK_ALLOWED_USER_IDS`    | 企业微信白名单                                 |
+| `WECHAT_APP_ID`              | 微信标准模式 App ID                            |
+| `WECHAT_APP_SECRET`          | 微信标准模式 App Secret                        |
+| `WECHAT_TOKEN`               | 微信 AGP 模式 Token                            |
+| `WECHAT_GUID`                | 微信 AGP 模式 GUID                             |
+| `WECHAT_USER_ID`             | 微信 AGP 模式 User ID                          |
+| `WECHAT_WS_URL`              | 微信 WebSocket 地址                            |
+| `WECHAT_ALLOWED_USER_IDS`    | 微信白名单                                     |
 ### 平台配置来源
@@ -334,15 +313,15 @@ codebuddy login
 ## IM 内命令
-| 命令 | 说明 |
-| ---- | ---- |
-| `/help` | 显示帮助 |
-| `/new` | 开始新会话 |
-| `/status` | 显示 AI 工具、版本、会话目录、会话 ID |
-| `/cd <路径>` | 切换会话目录 |
-| `/pwd` | 显示当前会话目录 |
-| `/allow` `/y` | 允许权限请求 |
-| `/deny` `/n` | 拒绝权限请求 |
+| 命令          | 说明                                  |
+| ------------- | ------------------------------------- |
+| `/help`       | 显示帮助                              |
+| `/new`        | 开始新会话                            |
+| `/status`     | 显示 AI 工具、版本、会话目录、会话 ID |
+| `/cd <路径>`  | 切换会话目录                          |
+| `/pwd`        | 显示当前会话目录                      |
+| `/allow` `/y` | 允许权限请求                          |
+| `/deny` `/n`  | 拒绝权限请求                          |
 ## 故障排除

package/dist/cli.js CHANGED Viewed

@@ -60,6 +60,13 @@ async function cmdStart() {
     console.log("\nopen-im started in the background.");
     console.log(`  pid: ${child.pid}`);
     console.log(`  config page: ${getWebConfigUrl()}`);
+    if (process.env.OPEN_IM_WEB_HOST && process.env.OPEN_IM_WEB_HOST !== "127.0.0.1") {
+        console.log("");
+        console.log("NOTE:");
+        console.log("  The config page is bound to OPEN_IM_WEB_HOST.");
+        console.log("  A one-time login URL (with login_token) has been printed by the config-web server logger.");
+        console.log("  Please use that URL (replacing 127.0.0.1 with your server IP/hostname) for the first login.");
+    }
 }
 async function cmdStop() {
     const status = getManagerStatus();
@@ -113,11 +120,11 @@ async function cmdDev() {
 }
 async function cmdDashboard() {
     // Start web config server in persistent mode (no timeout)
-    const { startWebConfigServer, openWebConfigUrl } = await import("./config-web.js");
+    const { startWebConfigServer } = await import("./config-web.js");
     const server = await startWebConfigServer({ mode: "dev", cwd: process.cwd(), persistent: true });
-    console.log(`\nDashboard: ${server.url}`);
+    const url = server.loginUrl ?? server.url;
+    console.log(`\nDashboard: ${url}`);
     console.log("Press Ctrl+C to close.\n");
-    openWebConfigUrl();
     await server.waitForResult;
 }
 function showHelp(exitCode = 0) {

package/dist/config-web-page-i18n.d.ts CHANGED Viewed

@@ -207,9 +207,6 @@ export declare const PAGE_TEXTS: {
         readonly codexProxy: "Codex 代理";
         readonly claudeTimeout: "Claude 超时（毫秒）";
         readonly claudeConfigPath: "配置文件位置";
-        readonly claudeAuthToken: "ANTHROPIC_AUTH_TOKEN";
-        readonly claudeBaseUrl: "ANTHROPIC_BASE_URL";
-        readonly claudeModel: "ANTHROPIC_MODEL";
         readonly claudeProxy: "代理（可选）";
         readonly codexTimeout: "Codex 超时（毫秒）";
         readonly codebuddyTimeout: "CodeBuddy 超时（毫秒）";

package/dist/config-web-page-i18n.js CHANGED Viewed

@@ -207,9 +207,6 @@ export const PAGE_TEXTS = {
         codexProxy: "Codex \u4ee3\u7406",
         claudeTimeout: "Claude \u8d85\u65f6\uff08\u6beb\u79d2\uff09",
         claudeConfigPath: "\u914d\u7f6e\u6587\u4ef6\u4f4d\u7f6e",
-        claudeAuthToken: "ANTHROPIC_AUTH_TOKEN",
-        claudeBaseUrl: "ANTHROPIC_BASE_URL",
-        claudeModel: "ANTHROPIC_MODEL",
         claudeProxy: "\u4ee3\u7406\uff08\u53ef\u9009\uff09",
         codexTimeout: "Codex \u8d85\u65f6\uff08\u6beb\u79d2\uff09",
         codebuddyTimeout: "CodeBuddy \u8d85\u65f6\uff08\u6beb\u79d2\uff09",

package/dist/config-web-page-script.js CHANGED Viewed

@@ -201,9 +201,6 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
           { id: "ai-claudeWorkDir-label", key: "workDir" },
           { id: "ai-claudeTimeoutMs-label", key: "claudeTimeout" },
           { id: "ai-claudeConfigPath-label", key: "claudeConfigPath" },
-          { id: "ai-claudeAuthToken-label", key: "claudeAuthToken" },
-          { id: "ai-claudeBaseUrl-label", key: "claudeBaseUrl" },
-          { id: "ai-claudeModel-label", key: "claudeModel" },
           { id: "ai-claudeProxy-label", key: "claudeProxy" },
           { id: "ai-codexCliPath-label", key: "codexCli" },
           { id: "ai-codexTimeoutMs-label", key: "codexTimeout" },
@@ -405,15 +402,55 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
         return body;
       }
+      async function loadClaudeSettings() {
+        const textarea = document.getElementById("claudeSettingsEditor");
+        if (!(textarea instanceof HTMLTextAreaElement)) return;
+        try {
+          const data = await request("/api/claude/settings");
+          const raw = (data.contents || "").trim();
+          const target = raw || "{\n}\n";
+          try {
+            const parsed = JSON.parse(target);
+            textarea.value = JSON.stringify(parsed, null, 2) + "\n";
+          } catch {
+            // 如果后端返回的不是合法 JSON，就原样展示，方便用户手动修
+            textarea.value = target;
+          }
+        } catch (error) {
+          setMessage(error.message || String(error), "error");
+        }
+      }
+      async function saveClaudeSettings() {
+        const textarea = document.getElementById("claudeSettingsEditor");
+        if (!(textarea instanceof HTMLTextAreaElement)) return;
+        const edited = textarea.value;
+        // Validate JSON before sending
+        try {
+          const parsed = JSON.parse(edited);
+          textarea.value = JSON.stringify(parsed, null, 2) + "\n";
+        } catch (err) {
+          setMessage("Invalid JSON: " + (err && err.message ? err.message : String(err)), "error");
+          return;
+        }
+        try {
+          await request("/api/claude/settings", {
+            method: "POST",
+            body: JSON.stringify({ contents: edited }),
+          });
+          setMessage("Claude settings.json saved.", "success");
+        } catch (error) {
+          setMessage(error.message || String(error), "error");
+        }
+      }
       // Fill form with data
       const AI_FIELD_MAPPINGS = [
         { id: "ai-aiCommand", key: "aiCommand" },
         { id: "ai-claudeWorkDir", key: "claudeWorkDir" },
         { id: "ai-claudeTimeoutMs", key: "claudeTimeoutMs" },
         { id: "ai-claudeConfigPath", key: "claudeConfigPath" },
-        { id: "ai-claudeAuthToken", key: "claudeAuthToken" },
-        { id: "ai-claudeBaseUrl", key: "claudeBaseUrl" },
-        { id: "ai-claudeModel", key: "claudeModel" },
         { id: "ai-claudeProxy", key: "claudeProxy" },
         { id: "ai-codexCliPath", key: "codexCliPath" },
         { id: "ai-codexTimeoutMs", key: "codexTimeoutMs" },
@@ -460,6 +497,7 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
           applyLanguage();
           const data = await request("/api/config");
           fill(data.payload, data.meta);
+          await loadClaudeSettings();
           // Initialize current AI tool panel from dropdown value
           currentAiToolPanel = el("ai-aiCommand")?.value || "claude";
           await refreshStatus();
@@ -499,6 +537,16 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
           }
         });
+        // Claude settings.json editor (advanced, inline & collapsible)
+        const claudeSettingsContainer = document.getElementById("claudeSettingsContainer");
+        if (claudeSettingsContainer && claudeSettingsContainer instanceof HTMLDetailsElement) {
+          claudeSettingsContainer.addEventListener("toggle", () => {
+            if (claudeSettingsContainer.open) {
+              void loadClaudeSettings();
+            }
+          });
+        }
         // AI tool switcher
         document.querySelectorAll(".tab[data-tool]").forEach((tab) => {
           tab.addEventListener("click", () => {
@@ -531,8 +579,16 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
         // Service buttons
         el("validateButton").onclick = validate;
-        el("saveButton").onclick = save;
-        el("startButton").onclick = startService;
+        el("saveButton").onclick = async () => {
+          // 先保存 JSON，再保存主配置
+          await saveClaudeSettings();
+          await save();
+        };
+        el("startButton").onclick = async () => {
+          // 启动前也顺带保存 JSON
+          await saveClaudeSettings();
+          await startService();
+        };
         el("stopButton").onclick = stopService;
         // Platform test buttons
@@ -652,9 +708,6 @@ export const PAGE_SCRIPT = String.raw `      const platformDefinitions = [
           claudeWorkDir: getValue("ai-claudeWorkDir"),
           claudeTimeoutMs: getNumber("ai-claudeTimeoutMs"),
           claudeConfigPath: getValue("ai-claudeConfigPath"),
-          claudeAuthToken: getValue("ai-claudeAuthToken"),
-          claudeBaseUrl: getValue("ai-claudeBaseUrl"),
-          claudeModel: getValue("ai-claudeModel"),
           claudeProxy: getValue("ai-claudeProxy"),
           codexTimeoutMs: getNumber("ai-codexTimeoutMs"),
           codebuddyTimeoutMs: getNumber("ai-codebuddyTimeoutMs"),

package/dist/config-web-page-template.js CHANGED Viewed

@@ -1128,19 +1128,20 @@ export const PAGE_HTML_PREFIX = String.raw `<!doctype html>
                       <div class="form-hint" id="ai-claudeConfigPath-hint">Environment variables are saved to ~/.claude/settings.json</div>
                     </div>
                     <div class="form-group">
-                      <label class="form-label" id="ai-claudeAuthToken-label">ANTHROPIC_AUTH_TOKEN</label>
-                      <input id="ai-claudeAuthToken" class="form-input mono" type="password" />
-                      <div class="form-hint" id="ai-claudeAuthToken-hint">Auth token for API access (optional, overrides env)</div>
-                    </div>
-                    <div class="form-group">
-                      <label class="form-label" id="ai-claudeBaseUrl-label">ANTHROPIC_BASE_URL</label>
-                      <input id="ai-claudeBaseUrl" class="form-input mono" type="text" />
-                      <div class="form-hint" id="ai-claudeBaseUrl-hint">Custom API base URL (optional, overrides env)</div>
-                    </div>
-                    <div class="form-group">
-                      <label class="form-label" id="ai-claudeModel-label">ANTHROPIC_MODEL</label>
-                      <input id="ai-claudeModel" class="form-input mono" type="text" />
-                      <div class="form-hint" id="ai-claudeModel-hint">Model name (optional, overrides env)</div>
+                      <details id="claudeSettingsContainer">
+                        <summary class="form-label" style="cursor: pointer;">Edit ~/.claude/settings.json (advanced)</summary>
+                        <div class="form-hint" style="margin-top: 8px; margin-bottom: 8px;">
+                          JSON will be auto-formatted; invalid JSON 会提示错误。
+                        </div>
+                        <textarea
+                          id="claudeSettingsEditor"
+                          class="form-input mono"
+                          style="min-height: 200px; white-space: pre; font-family: var(--font-mono);"
+                        ></textarea>
+                        <div class="form-hint" style="margin-top: 4px;">
+                          折叠/展开以隐藏或查看完整配置。
+                        </div>
+                      </details>
                     </div>
                   </div>

package/dist/config-web.d.ts CHANGED Viewed

@@ -5,6 +5,7 @@ export interface StartedWebConfigServer {
     close: () => Promise<void>;
     url: string;
     waitForResult: Promise<WebFlowResult>;
+    loginUrl?: string;
 }
 export declare function getHealthPlatformSnapshot(file: FileConfig, env?: NodeJS.ProcessEnv): Record<string, {
     configured: boolean;

package/dist/config-web.js CHANGED Viewed

@@ -1,6 +1,9 @@
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 import { URL } from "node:url";
+import { randomBytes } from "node:crypto";
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
 import { DWClient } from "dingtalk-stream";
 import { WEB_CONFIG_PORT } from "./constants.js";
 import { CONFIG_PATH, getClaudeConfigHome, loadClaudeSettingsEnv, saveClaudeSettingsEnv, loadConfig, loadFileConfig, saveFileConfig } from "./config.js";
@@ -10,6 +13,104 @@ import { initWeWork, stopWeWork } from "./wework/client.js";
 import { createLogger } from "./logger.js";
 const log = createLogger("ConfigWeb");
 const TEST_TIMEOUT_MS = 10000;
+function getClaudeSettingsPath() {
+    const home = getClaudeConfigHome();
+    const baseDir = join(home, ".claude");
+    return join(baseDir, "settings.json");
+}
+const pendingLogins = new Map();
+const activeSessions = new Map();
+function getWebConfigHost() {
+    const envHost = process.env.OPEN_IM_WEB_HOST?.trim();
+    if (envHost)
+        return envHost;
+    return "127.0.0.1";
+}
+function generateRandomToken(bytes = 32) {
+    return randomBytes(bytes).toString("base64url");
+}
+function cleanupExpiredAuth(now) {
+    for (const [token, info] of pendingLogins) {
+        if (info.expiresAt <= now)
+            pendingLogins.delete(token);
+    }
+    for (const [sessionId, info] of activeSessions) {
+        if (info.expiresAt <= now)
+            activeSessions.delete(sessionId);
+    }
+}
+function createLoginToken(ttlMs) {
+    const now = Date.now();
+    cleanupExpiredAuth(now);
+    const token = generateRandomToken(32);
+    pendingLogins.set(token, { expiresAt: now + ttlMs });
+    return token;
+}
+function createSession(request, ttlMs) {
+    const now = Date.now();
+    cleanupExpiredAuth(now);
+    const sessionId = generateRandomToken(32);
+    const remoteAddr = request.socket.remoteAddress;
+    const userAgent = typeof request.headers["user-agent"] === "string" ? request.headers["user-agent"] : undefined;
+    activeSessions.set(sessionId, {
+        expiresAt: now + ttlMs,
+        remoteAddr,
+        userAgent,
+    });
+    return sessionId;
+}
+function parseCookies(request) {
+    const header = request.headers.cookie;
+    if (!header)
+        return {};
+    const cookies = {};
+    const parts = header.split(";");
+    for (const part of parts) {
+        const [rawKey, ...rest] = part.split("=");
+        const key = rawKey.trim();
+        if (!key)
+            continue;
+        const value = rest.join("=").trim();
+        cookies[key] = decodeURIComponent(value);
+    }
+    return cookies;
+}
+function getSessionIdFromRequest(request) {
+    const cookies = parseCookies(request);
+    const sessionId = cookies.openim_session;
+    return sessionId && typeof sessionId === "string" && sessionId.length > 0 ? sessionId : null;
+}
+function isSessionValid(request) {
+    const sessionId = getSessionIdFromRequest(request);
+    if (!sessionId)
+        return false;
+    const info = activeSessions.get(sessionId);
+    if (!info)
+        return false;
+    const now = Date.now();
+    if (info.expiresAt <= now) {
+        activeSessions.delete(sessionId);
+        return false;
+    }
+    // Optional: tie session to basic client fingerprint (remote address)
+    const remoteAddr = request.socket.remoteAddress;
+    if (info.remoteAddr && remoteAddr && remoteAddr !== info.remoteAddr) {
+        return false;
+    }
+    return true;
+}
+function buildSessionCookie(sessionId, ttlMs) {
+    const maxAgeSec = Math.floor(ttlMs / 1000);
+    const parts = [
+        `openim_session=${encodeURIComponent(sessionId)}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${maxAgeSec}`,
+    ];
+    // 不设置 Secure，方便本地 http 使用；如果放在 https 反代后，可以在代理层加 Secure
+    return parts.join("; ");
+}
 export function getHealthPlatformSnapshot(file, env = process.env) {
     const fileTelegram = file.platforms?.telegram;
     const fileFeishu = file.platforms?.feishu;
@@ -140,7 +241,7 @@ function buildInitialPayload(file) {
                 : getClaudeConfigHome() + "/.claude/settings.json",
             claudeAuthToken: claudeEnv.ANTHROPIC_AUTH_TOKEN ?? "",
             claudeBaseUrl: claudeEnv.ANTHROPIC_BASE_URL ?? "",
-            claudeModel: file.tools?.claude?.model ?? claudeEnv.ANTHROPIC_MODEL ?? "",
+            claudeModel: claudeEnv.ANTHROPIC_MODEL ?? "",
             claudeProxy: file.tools?.claude?.proxy ?? "",
             codexTimeoutMs: file.tools?.codex?.timeoutMs ?? 600000,
             codebuddyTimeoutMs: file.tools?.codebuddy?.timeoutMs ?? 600000,
@@ -397,7 +498,7 @@ function toFileConfig(payload, existing) {
                 workDir: clean(payload.ai.claudeWorkDir) ?? process.cwd(),
                 timeoutMs: payload.ai.claudeTimeoutMs,
                 proxy: clean(payload.ai.claudeProxy),
-                // model is now saved to ~/.claude/settings.json as ANTHROPIC_MODEL
+                // model is now saved to ~/.claude/settings.json as env var
             },
             codex: {
                 ...existing.tools?.codex,
@@ -514,6 +615,7 @@ export async function startWebConfigServer(options) {
             resolve(value);
         };
     });
+    const host = getWebConfigHost();
     const server = createServer(async (request, response) => {
         const requestUrl = new URL(request.url ?? "/", "http://127.0.0.1");
         const finishFlow = (result) => {
@@ -522,6 +624,43 @@ export async function startWebConfigServer(options) {
             server.close();
             settle(result);
         };
+        // Auth gating:
+        // - 当仅绑定 127.0.0.1 时，保持完全本地免登录（向后兼容）
+        // - 当绑定到 0.0.0.0 或其他地址时，启用一次性登录 + Session Cookie 机制
+        const isLocalOnly = host === "127.0.0.1";
+        const hasLoginTokenFeature = !isLocalOnly;
+        if (hasLoginTokenFeature) {
+            const loginToken = requestUrl.searchParams.get("login_token");
+            if (loginToken) {
+                const info = pendingLogins.get(loginToken);
+                const now = Date.now();
+                if (info && info.expiresAt > now) {
+                    // 有效的一次性登录 token：创建会话，设置 Cookie，并重定向到去掉 login_token 的 URL
+                    pendingLogins.delete(loginToken);
+                    const sessionTtlMs = 24 * 60 * 60 * 1000; // 24 小时
+                    const sessionId = createSession(request, sessionTtlMs);
+                    const cookie = buildSessionCookie(sessionId, sessionTtlMs);
+                    requestUrl.searchParams.delete("login_token");
+                    const redirectPath = requestUrl.pathname + (requestUrl.search ? requestUrl.search : "");
+                    response.writeHead(302, {
+                        Location: redirectPath || "/",
+                        "Set-Cookie": cookie,
+                    });
+                    response.end();
+                    return;
+                }
+                // 无效或过期的一次性 token
+                response.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
+                response.end("Invalid or expired login link. Please generate a new one from the server.");
+                return;
+            }
+            // 其他请求：必须已有有效 session
+            if (!isSessionValid(request)) {
+                response.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
+                response.end("Unauthorized. Please open the latest login URL from the server output.");
+                return;
+            }
+        }
         if (request.method === "GET" && requestUrl.pathname === "/") {
             response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
             response.end(PAGE_HTML);
@@ -573,6 +712,57 @@ export async function startWebConfigServer(options) {
             json(response, 200, getServiceStatus());
             return;
         }
+        if (request.method === "GET" && requestUrl.pathname === "/api/claude/settings") {
+            try {
+                const settingsPath = getClaudeSettingsPath();
+                let contents = "{}";
+                if (existsSync(settingsPath)) {
+                    contents = readFileSync(settingsPath, "utf-8");
+                }
+                else {
+                    // Try to synthesize from env if file doesn't exist yet
+                    const env = loadClaudeSettingsEnv();
+                    if (Object.keys(env).length > 0) {
+                        contents = JSON.stringify({ env }, null, 2);
+                    }
+                }
+                json(response, 200, { path: settingsPath, contents });
+            }
+            catch (error) {
+                json(response, 500, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
+        if (request.method === "POST" && requestUrl.pathname === "/api/claude/settings") {
+            try {
+                const body = await readJson(request);
+                const raw = body.contents ?? "";
+                if (!raw.trim()) {
+                    json(response, 400, { error: "contents is required" });
+                    return;
+                }
+                let parsed;
+                try {
+                    parsed = JSON.parse(raw);
+                }
+                catch (err) {
+                    json(response, 400, { error: `Invalid JSON: ${err instanceof Error ? err.message : String(err)}` });
+                    return;
+                }
+                const pretty = JSON.stringify(parsed, null, 2);
+                const settingsPath = getClaudeSettingsPath();
+                const dir = dirname(settingsPath);
+                if (!existsSync(dir)) {
+                    mkdirSync(dir, { recursive: true });
+                }
+                writeFileSync(settingsPath, pretty, "utf-8");
+                json(response, 200, { message: "Claude settings.json saved.", path: settingsPath });
+            }
+            catch (error) {
+                json(response, 500, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
         if (request.method === "GET" && requestUrl.pathname === "/api/health") {
             const file = loadFileConfig();
             const fileTelegram = file.platforms?.telegram;
@@ -676,7 +866,7 @@ export async function startWebConfigServer(options) {
             }
             reject(error);
         });
-        server.listen(port, "127.0.0.1", () => resolve());
+        server.listen(port, host, () => resolve());
     });
     const address = server.address();
     if (!address || typeof address === "string") {
@@ -698,6 +888,24 @@ export async function startWebConfigServer(options) {
         if (timer)
             clearTimeout(timer);
     });
+    let loginUrlForReturn;
+    // 当绑定到非 127.0.0.1（例如 0.0.0.0）时，为远程访问生成一次性登录链接
+    if (host !== "127.0.0.1") {
+        const loginTtlMs = 15 * 60 * 1000; // 15 分钟内有效
+        const loginToken = createLoginToken(loginTtlMs);
+        const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+        const baseUrl = `http://${displayHost}:${port}`;
+        const loginUrl = `${baseUrl}/?login_token=${encodeURIComponent(loginToken)}`;
+        loginUrlForReturn = loginUrl;
+        log.info("━━━━━━━━ Web Config Login ━━━━━━━━");
+        log.info(`Host binding : ${host}`);
+        log.info(`Login URL    : ${loginUrl}`);
+        if (host === "0.0.0.0") {
+            log.info("Note: replace 127.0.0.1 with your server IP or hostname when opening from another device.");
+        }
+        log.info(`This login link is valid for approximately ${Math.floor(loginTtlMs / 60000)} minutes and can be used only once.`);
+        log.info("After login, subsequent requests will use a short-lived session cookie.");
+    }
     return {
         close: async () => {
             if (timer)
@@ -706,13 +914,15 @@ export async function startWebConfigServer(options) {
             settle("cancel");
         },
         url: `http://127.0.0.1:${port}`,
+        loginUrl: loginUrlForReturn,
         waitForResult,
     };
 }
 export async function runWebConfigFlow(options) {
     const started = await startWebConfigServer(options);
-    openBrowser(started.url);
-    log.info(`Opened local configuration page: ${started.url}`);
+    const targetUrl = started.loginUrl ?? started.url;
+    openBrowser(targetUrl);
+    log.info(`Opened local configuration page: ${targetUrl}`);
     log.info(process.env.OPEN_IM_NO_BROWSER === "1" ? "Browser launch disabled. Open the URL manually." : "Save the configuration in your browser to continue.");
     return started.waitForResult;
 }

package/dist/config.d.ts CHANGED Viewed

@@ -32,6 +32,8 @@ export interface Config {
     aiCommand: AiCommand;
     codexCliPath: string;
     codebuddyCliPath: string;
+    /** Claude 访问 API 的代理（如 http://127.0.0.1:7890） */
+    claudeProxy?: string;
     /** Codex 访问 chatgpt.com 的代理（如 http://127.0.0.1:7890） */
     codexProxy?: string;
     claudeTimeoutMs: number;
@@ -133,10 +135,14 @@ export interface FilePlatformDingtalk {
     cardTemplateId?: string;
 }
 export interface FileToolClaude {
+    cliPath?: string;
     workDir?: string;
     timeoutMs?: number;
-    model?: string;
+    skipPermissions?: boolean;
+    /** HTTP/HTTPS 代理，用于访问 Claude API（如 http://127.0.0.1:7890） */
     proxy?: string;
+    /** Claude API 配置（优先级：环境变量 > tools.claude.env > ~/.claude/settings.json） */
+    env?: Record<string, string>;
 }
 export interface FileToolCodex {
     cliPath?: string;

package/dist/config.js CHANGED Viewed

@@ -55,7 +55,8 @@ function migrateToNewConfigFormat(raw) {
             ...tc,
             workDir: tc.workDir ?? raw.claudeWorkDir ?? process.cwd(),
             timeoutMs: tc.timeoutMs ?? raw.claudeTimeoutMs ?? 600000,
-            model: tc.model ?? raw.claudeModel,
+            proxy: tc.proxy,
+            // model 现在通过 env 配置，不再在这里处理
         },
         codex: {
             ...tcod,
@@ -216,11 +217,16 @@ export function loadConfig() {
             }
         }
     };
+    // 1. 全局 env（最低优先级之一）
     if (file.env)
         mergeEnv(file.env);
-    // 从 Claude Code 配置合并 API 凭证（~/.claude/settings.json 或 ~/.claude.json，最低优先级）
-    const claudeEnv = loadClaudeSettingsEnv();
-    mergeEnv(claudeEnv);
+    // 2. tools.claude.env（优先级高于 Claude settings）
+    const claudeToolEnv = file.tools?.claude?.env;
+    if (claudeToolEnv)
+        mergeEnv(claudeToolEnv);
+    // 3. 从 Claude Code 配置合并（最低优先级）
+    const claudeSettingsEnv = loadClaudeSettingsEnv();
+    mergeEnv(claudeSettingsEnv);
     const fileTelegram = file.platforms?.telegram;
     const fileFeishu = file.platforms?.feishu;
     const fileQQ = file.platforms?.qq;
@@ -331,6 +337,7 @@ export function loadConfig() {
     const tc = file.tools?.claude ?? {};
     const tcod = file.tools?.codex ?? {};
     const tcb = file.tools?.codebuddy ?? {};
+    const claudeProxy = process.env.CLAUDE_PROXY ?? tc.proxy;
     const codexProxy = process.env.CODEX_PROXY ?? tcod.proxy;
     let codexCliPath = process.env.CODEX_CLI_PATH ?? tcod.cliPath ?? 'codex';
     if (process.platform === 'win32' && codexCliPath === 'codex') {
@@ -400,8 +407,9 @@ export function loadConfig() {
                 '方式 2：运行配置向导',
                 '  open-im init',
                 '',
-                '方式 3：编辑 ~/.open-im/config.json 的 env 字段',
-                '  或 ~/.claude/settings.json（与 Claude Code 共用）',
+                '方式 3：编辑配置文件',
+                '  ~/.open-im/config.json: tools.claude.env.ANTHROPIC_MODEL = "..."',
+                '  ~/.claude/settings.json: env.ANTHROPIC_MODEL = "..."（与 Claude Code 共用）',
                 '',
             ].join('\n');
             throw new Error(errorMsg);
@@ -603,12 +611,13 @@ export function loadConfig() {
         aiCommand,
         codexCliPath,
         codebuddyCliPath,
+        claudeProxy,
         codexProxy,
         claudeWorkDir,
         claudeTimeoutMs,
         codexTimeoutMs,
         codebuddyTimeoutMs,
-        claudeModel: process.env.CLAUDE_MODEL ?? tc.model,
+        claudeModel: process.env.ANTHROPIC_MODEL,
         logDir,
         logLevel,
         platforms,

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@wu529778790/open-im",
-  "version": "1.7.1-beta.1",
+  "version": "1.7.1-beta.10",
   "description": "Multi-platform IM bridge for AI CLI tools (Claude, Codex, CodeBuddy)",
   "type": "module",
   "main": "dist/index.js",