claude-codex-wechat 0.1.13 → 0.1.15

package/dist/server/cli.js

@@ -2,7 +2,7 @@
 import { createRequire as __cjsCreateRequire } from 'node:module'; const require = __cjsCreateRequire(import.meta.url);
 
 // src/cli.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname12, join as join12 } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -80,6 +80,7 @@ function normalizeBridgeConfig(raw, env, path) {
   return {
     wechat: normalizeWechatConfig(record.wechat, env),
     bridge: normalizeBridgeDefaultsConfig(record.bridge),
+    tunnel: normalizeTunnelConfig(record.tunnel),
     providers: normalizeProvidersConfig(record.providers, env)
   };
 }
@@ -103,6 +104,20 @@ function normalizeBridgeDefaultsConfig(raw) {
     ...defaultWorkspace ? { defaultWorkspace } : {}
   };
 }
+function normalizeTunnelConfig(raw) {
+  const record = raw && typeof raw === "object" ? raw : {};
+  const enabled = record.enabled === true;
+  const relayRecord = record.relay && typeof record.relay === "object" ? record.relay : void 0;
+  const relay = relayRecord ? {
+    ...typeof relayRecord.serverUrl === "string" && relayRecord.serverUrl.trim() ? { serverUrl: relayRecord.serverUrl } : {},
+    ...typeof relayRecord.authToken === "string" && relayRecord.authToken.trim() ? { authToken: relayRecord.authToken } : {}
+  } : void 0;
+  if (!enabled && !relay) return void 0;
+  return {
+    enabled,
+    ...relay ? { relay } : {}
+  };
+}
 function normalizeProviderCommand(raw, envFallback) {
   const record = raw && typeof raw === "object" ? raw : {};
   const command = typeof record.command === "string" && record.command ? record.command : typeof envFallback === "string" && envFallback ? envFallback : void 0;
@@ -125,6 +140,8 @@ function normalizeWechatConfig(raw, env) {
 
 // src/daemon/configPersistence.ts
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 async function persistWechatCredentialsToConfigFile(input) {
   const currentConfig = await readConfigFile(input.configPath);
@@ -152,18 +169,52 @@ async function deleteConfigFile(configPath) {
 }
 async function persistBridgeDefaultsToConfigFile(input) {
   const currentConfig = await readConfigFile(input.configPath);
+  const currentBridge = isRecord(currentConfig.bridge) ? currentConfig.bridge : void 0;
   const nextConfig = {
     ...currentConfig,
     bridge: {
-      ...isRecord(currentConfig.bridge) ? currentConfig.bridge : {},
-      defaultProvider: input.defaultProvider,
-      defaultWorkspace: input.defaultWorkspace
-    }
+      ...currentBridge ?? {},
+      ...input.defaultProvider ? { defaultProvider: input.defaultProvider } : {},
+      ...input.defaultWorkspace ? { defaultWorkspace: input.defaultWorkspace } : {}
+    },
+    ...input.tunnel ? {
+      tunnel: {
+        enabled: input.tunnel.enabled === true,
+        ...input.tunnel.relay ? {
+          relay: {
+            ...input.tunnel.relay.serverUrl ? { serverUrl: input.tunnel.relay.serverUrl } : {},
+            ...input.tunnel.relay.authToken ? { authToken: input.tunnel.relay.authToken } : {}
+          }
+        } : {}
+      }
+    } : {}
   };
   await mkdir(dirname(input.configPath), { recursive: true });
   await writeFile(input.configPath, `${JSON.stringify(nextConfig, null, 2)}
 `, "utf8");
 }
+function ensureRelayAuthTokenSync(input) {
+  const currentConfig = readConfigFileSync(input.configPath);
+  const currentTunnel = isRecord(currentConfig.tunnel) ? currentConfig.tunnel : void 0;
+  const currentRelay = isRecord(currentTunnel?.relay) ? currentTunnel.relay : void 0;
+  const existing = typeof currentRelay?.authToken === "string" && currentRelay.authToken.trim() ? currentRelay.authToken.trim() : "";
+  if (existing) return existing;
+  const authToken = `clrt_${randomBytes(12).toString("hex")}`;
+  const nextConfig = {
+    ...currentConfig,
+    tunnel: {
+      ...currentTunnel ?? {},
+      relay: {
+        ...currentRelay ?? {},
+        authToken
+      }
+    }
+  };
+  mkdirSync(dirname(input.configPath), { recursive: true });
+  writeFileSync(input.configPath, `${JSON.stringify(nextConfig, null, 2)}
+`, "utf8");
+  return authToken;
+}
 async function persistProviderCommandsToConfigFile(input) {
   const currentConfig = await readConfigFile(input.configPath);
   const normalizedProviders = normalizeProvidersForPersistence(input.providers);
@@ -185,6 +236,17 @@ async function readConfigFile(path) {
     throw error;
   }
 }
+function readConfigFileSync(path) {
+  try {
+    if (!existsSync2(path)) return {};
+    const raw = readFileSync2(path, "utf8");
+    const parsed = JSON.parse(raw);
+    return isRecord(parsed) ? parsed : {};
+  } catch (error) {
+    if (isMissingFileError(error)) return {};
+    throw error;
+  }
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -202,7 +264,7 @@ function normalizeProvidersForPersistence(providers) {
 }
 
 // src/channels/weixin-direct/weixinStateStore.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 var PUSH_QUOTA_LIMIT = 10;
 var PUSH_WINDOW_MS = 24 * 60 * 60 * 1e3;
@@ -296,9 +358,9 @@ var FileWeixinStateStore = class {
     return this.readState().bridge?.weixinChannel ?? {};
   }
   readState() {
-    if (!existsSync2(this.configPath)) return {};
+    if (!existsSync3(this.configPath)) return {};
     try {
-      const raw = JSON.parse(readFileSync2(this.configPath, "utf8"));
+      const raw = JSON.parse(readFileSync3(this.configPath, "utf8"));
       return raw && typeof raw === "object" ? raw : {};
     } catch {
       return {};
@@ -309,8 +371,8 @@ var FileWeixinStateStore = class {
       ...state,
       bridge: { ...state.bridge ?? {}, weixinChannel: channel }
     };
-    mkdirSync(dirname2(this.configPath), { recursive: true });
-    writeFileSync(this.configPath, `${JSON.stringify(next, null, 2)}
+    mkdirSync2(dirname2(this.configPath), { recursive: true });
+    writeFileSync2(this.configPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   }
 };
@@ -608,7 +670,7 @@ async function normalizeClaudeSessionFileForResume(sessionPath) {
 // src/providers/codex/nativeSessions.ts
 import Database from "better-sqlite3";
 import { readdir as readdir2, readFile as readFile3, stat as stat2 } from "node:fs/promises";
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { basename as basename2, join as join3 } from "node:path";
 function resolveCodexSessionsRoot(env = process.env) {
@@ -710,7 +772,7 @@ async function readCodexSessionIndex(env) {
 function readCodexThreadMetadata(env) {
   const dbPath = join3(env.CODEX_HOME || join3(env.HOME || homedir3(), ".codex"), "state_5.sqlite");
   const metadata = /* @__PURE__ */ new Map();
-  if (!existsSync3(dbPath)) return metadata;
+  if (!existsSync4(dbPath)) return metadata;
   let db = null;
   try {
     db = new Database(dbPath, { readonly: true });
@@ -814,7 +876,7 @@ async function upsertCodexSessionIndexEntry(input, env = process.env) {
 
 // src/providers/codex/nativeThreads.ts
 import Database2 from "better-sqlite3";
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { join as join5 } from "node:path";
@@ -824,7 +886,7 @@ function resolveCodexStateDbPath(env = process.env) {
 async function syncCodexThreadForResume(input) {
   const env = input.env ?? process.env;
   const dbPath = resolveCodexStateDbPath(env);
-  if (!existsSync4(dbPath)) return false;
+  if (!existsSync5(dbPath)) return false;
   for (let attempt = 0; attempt < 50; attempt += 1) {
     const db = new Database2(dbPath);
     try {
@@ -863,7 +925,7 @@ async function syncCodexThreadForResume(input) {
   return false;
 }
 async function syncCodexRolloutSessionMeta(rolloutPath) {
-  if (!existsSync4(rolloutPath)) return;
+  if (!existsSync5(rolloutPath)) return;
   const content = await readFile5(rolloutPath, "utf8");
   const lines = content.split(/\r?\n/);
   if (!lines[0]?.trim()) return;
@@ -1405,6 +1467,40 @@ async function resolveRecoverableProviderResumeHistorySynced(session) {
   });
 }
 
+// src/admin/tunnelRoutes.ts
+function registerTunnelRoutes(input) {
+  const getStatus = async () => await input.tunnelManager.getStatus();
+  input.app.get("/api/tunnel/status", getStatus);
+  const start = async () => {
+    input.defaults.tunnel.enabled = true;
+    await persistBridgeDefaultsToConfigFile({
+      configPath: input.configPath,
+      tunnel: input.defaults.tunnel
+    });
+    return await input.tunnelManager.start();
+  };
+  input.app.post("/api/tunnel/start", start);
+  const stop = async () => {
+    input.defaults.tunnel.enabled = false;
+    await persistBridgeDefaultsToConfigFile({
+      configPath: input.configPath,
+      tunnel: input.defaults.tunnel
+    });
+    return await input.tunnelManager.stop();
+  };
+  input.app.post("/api/tunnel/stop", stop);
+  const setEnabled = async (request) => {
+    const enabled = request.body?.enabled === true;
+    input.defaults.tunnel.enabled = enabled;
+    await persistBridgeDefaultsToConfigFile({
+      configPath: input.configPath,
+      tunnel: input.defaults.tunnel
+    });
+    return await input.tunnelManager.setEnabled(enabled);
+  };
+  input.app.post("/api/tunnel/settings", setEnabled);
+}
+
 // src/admin/settingsRoutes.ts
 function registerSettingsRoutes(input) {
   input.app.get("/api/settings", async () => input.defaults);
@@ -1412,22 +1508,53 @@ function registerSettingsRoutes(input) {
     const current = { ...input.defaults };
     const next = normalizeSettings({
       ...current,
-      ...request.body
+      ...request.body,
+      tunnel: {
+        ...current.tunnel,
+        ...request.body.tunnel && typeof request.body.tunnel === "object" ? request.body.tunnel : {},
+        relay: {
+          ...current.tunnel?.relay ?? {},
+          ...request.body.tunnel && typeof request.body.tunnel === "object" && "relay" in request.body.tunnel && request.body.tunnel.relay && typeof request.body.tunnel.relay === "object" ? request.body.tunnel.relay : {}
+        }
+      }
     }, current.defaultWorkspace);
+    if (!next.tunnel.relay?.authToken) {
+      const authToken = ensureRelayAuthTokenSync({ configPath: input.configPath });
+      next.tunnel = {
+        ...next.tunnel,
+        relay: {
+          ...next.tunnel.relay ?? {},
+          authToken
+        }
+      };
+    }
     input.defaults.defaultProvider = next.defaultProvider;
     input.defaults.defaultWorkspace = next.defaultWorkspace;
+    input.defaults.tunnel = next.tunnel;
     await persistBridgeDefaultsToConfigFile({
       configPath: input.configPath,
       defaultProvider: next.defaultProvider,
-      defaultWorkspace: next.defaultWorkspace
+      defaultWorkspace: next.defaultWorkspace,
+      tunnel: next.tunnel
     });
     return { ok: true };
   });
 }
 function normalizeSettings(input, defaultWorkspace) {
+  const tunnel = input.tunnel && typeof input.tunnel === "object" ? input.tunnel : {};
+  const relay = tunnel.relay && typeof tunnel.relay === "object" ? tunnel.relay : {};
   return {
     defaultProvider: input.defaultProvider === "codex" ? "codex" : "claude-code",
-    defaultWorkspace: typeof input.defaultWorkspace === "string" && input.defaultWorkspace.trim() ? input.defaultWorkspace : defaultWorkspace
+    defaultWorkspace: typeof input.defaultWorkspace === "string" && input.defaultWorkspace.trim() ? input.defaultWorkspace : defaultWorkspace,
+    tunnel: {
+      enabled: tunnel.enabled === true,
+      ...typeof relay.serverUrl === "string" && relay.serverUrl.trim() || typeof relay.authToken === "string" && relay.authToken.trim() ? {
+        relay: {
+          ...typeof relay.serverUrl === "string" && relay.serverUrl.trim() ? { serverUrl: relay.serverUrl } : {},
+          ...typeof relay.authToken === "string" && relay.authToken.trim() ? { authToken: relay.authToken } : {}
+        }
+      } : {}
+    }
   };
 }
 
@@ -1967,7 +2094,7 @@ function chunkText(text, limit) {
 }
 
 // src/channels/weixin-direct/mediaDownloader.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
 
 // src/channels/weixin-direct/mediaCrypto.ts
@@ -2031,8 +2158,8 @@ var WeixinMediaDownloader = class {
     } catch {
       return { ok: false, reason: "decrypt_failed" };
     }
-    mkdirSync2(dirname6(input.destPath), { recursive: true });
-    writeFileSync2(input.destPath, plaintext);
+    mkdirSync3(dirname6(input.destPath), { recursive: true });
+    writeFileSync3(input.destPath, plaintext);
     return { ok: true, localPath: input.destPath, bytes: plaintext.length };
   }
 };
@@ -3132,8 +3259,11 @@ var BRIDGE_COMMAND_HELP_GROUPS = [
     ]
   }
 ];
-function buildBridgeCommandHelpMarkdown() {
+function buildBridgeCommandHelpMarkdown(input) {
   const lines = ["**\u53EF\u7528\u547D\u4EE4**", "", BRIDGE_COMMAND_HELP_INTRO];
+  if (input?.publicUrl) {
+    lines.push("", `**\u8BBF\u95EE\u5730\u5740**`, "", `[${input.publicUrl}](${input.publicUrl})`);
+  }
   for (const group of BRIDGE_COMMAND_HELP_GROUPS) {
     lines.push("", `**${group.title}**${group.note ? `\uFF08${group.note}\uFF09` : ""}`);
     for (const entry of group.entries) {
@@ -3144,7 +3274,7 @@ function buildBridgeCommandHelpMarkdown() {
 }
 
 // src/session/currentConversationStore.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname7 } from "node:path";
 import { nanoid as nanoid2 } from "nanoid";
 var CurrentConversationStore = class {
@@ -3204,8 +3334,8 @@ var CurrentConversationStore = class {
     this.writeState(state);
   }
   readState() {
-    if (!existsSync5(this.configPath)) return {};
-    const raw = JSON.parse(readFileSync3(this.configPath, "utf8"));
+    if (!existsSync6(this.configPath)) return {};
+    const raw = JSON.parse(readFileSync4(this.configPath, "utf8"));
     return raw && typeof raw === "object" ? raw : {};
   }
   writeCurrent(record) {
@@ -3227,8 +3357,8 @@ var CurrentConversationStore = class {
     this.writeState(state);
   }
   writeState(state) {
-    mkdirSync3(dirname7(this.configPath), { recursive: true });
-    writeFileSync3(this.configPath, `${JSON.stringify(state, null, 2)}
+    mkdirSync4(dirname7(this.configPath), { recursive: true });
+    writeFileSync4(this.configPath, `${JSON.stringify(state, null, 2)}
 `, "utf8");
   }
 };
@@ -3518,10 +3648,11 @@ var MessageRouter = class _MessageRouter {
   }
   async handleCommand(chatId, user, command) {
     if (command.kind === "help") {
+      const helpAddress = await this.options.getHelpAddress?.();
       await this.sendToChat({
         chatId,
         kind: "markdown",
-        text: buildBridgeCommandHelpMarkdown()
+        text: buildBridgeCommandHelpMarkdown({ publicUrl: helpAddress })
       });
       return;
     }
@@ -3672,6 +3803,13 @@ var MessageRouter = class _MessageRouter {
       providerSessionId: session.providerSessionId,
       cwd: session.cwd
     });
+    if (session.providerId === "codex") {
+      await upsertCodexSessionIndexEntry({
+        sessionId: session.providerSessionId,
+        threadName: session.resumeTitle
+      });
+      return;
+    }
     if (session.providerId === "claude-code") {
       await ensureClaudeSessionBridgeMetadata({
         sessionId: session.providerSessionId,
@@ -3733,7 +3871,7 @@ function composeInboundText(content) {
 }
 
 // src/storage/lastProviderSessionStore.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 var LastProviderSessionStore = class {
   constructor(configPath) {
@@ -3760,19 +3898,19 @@ var LastProviderSessionStore = class {
     return this.readState().bridge?.lastProviderSessions ?? {};
   }
   readState() {
-    if (!existsSync6(this.configPath)) return {};
-    const raw = JSON.parse(readFileSync4(this.configPath, "utf8"));
+    if (!existsSync7(this.configPath)) return {};
+    const raw = JSON.parse(readFileSync5(this.configPath, "utf8"));
     return raw && typeof raw === "object" ? raw : {};
   }
   writeState(state) {
-    mkdirSync4(dirname8(this.configPath), { recursive: true });
-    writeFileSync4(this.configPath, `${JSON.stringify(state, null, 2)}
+    mkdirSync5(dirname8(this.configPath), { recursive: true });
+    writeFileSync5(this.configPath, `${JSON.stringify(state, null, 2)}
 `, "utf8");
   }
 };
 
 // src/storage/runtimeUserStore.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "node:fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "node:fs";
 import { dirname as dirname9 } from "node:path";
 import { nanoid as nanoid3 } from "nanoid";
 var RuntimeUserStore = class {
@@ -3833,13 +3971,13 @@ var RuntimeUserStore = class {
     return { ok: true };
   }
   readState() {
-    if (!existsSync7(this.configPath)) return {};
-    const raw = JSON.parse(readFileSync5(this.configPath, "utf8"));
+    if (!existsSync8(this.configPath)) return {};
+    const raw = JSON.parse(readFileSync6(this.configPath, "utf8"));
     return raw && typeof raw === "object" ? raw : {};
   }
   writeState(state) {
-    mkdirSync5(dirname9(this.configPath), { recursive: true });
-    writeFileSync5(this.configPath, `${JSON.stringify(state, null, 2)}
+    mkdirSync6(dirname9(this.configPath), { recursive: true });
+    writeFileSync6(this.configPath, `${JSON.stringify(state, null, 2)}
 `, "utf8");
   }
 };
@@ -3861,15 +3999,232 @@ var BridgeEventHub = class {
   }
 };
 
+// src/runtime/relayTunnelProvider.ts
+var RelayTunnelProvider = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  socket = null;
+  status = {
+    installed: true,
+    enabled: false,
+    running: false,
+    status: "stopped"
+  };
+  static defaultCreateSocket(url) {
+    const socket = new WebSocket(url);
+    return {
+      get readyState() {
+        return socket.readyState;
+      },
+      send(payload) {
+        socket.send(payload);
+      },
+      close() {
+        socket.close();
+      },
+      on(event, listener) {
+        socket.addEventListener(event, listener);
+      }
+    };
+  }
+  async getStatus() {
+    return { ...this.status };
+  }
+  async start() {
+    this.status = {
+      ...this.status,
+      enabled: true,
+      status: "starting"
+    };
+    const socket = this.options.createSocket(this.options.serverUrl);
+    this.socket = socket;
+    return await new Promise((resolve2, reject) => {
+      let settled = false;
+      const finishResolve = (value) => {
+        if (settled) return;
+        settled = true;
+        resolve2(value);
+      };
+      const finishReject = (error) => {
+        if (settled) return;
+        settled = true;
+        reject(error);
+      };
+      socket.on("open", () => {
+        socket.send(JSON.stringify({
+          type: "register",
+          clientVersion: "0.1.0",
+          targetBaseUrl: this.options.targetBaseUrl,
+          authToken: this.options.authToken
+        }));
+      });
+      socket.on("message", (raw) => {
+        const payload = typeof raw === "string" ? JSON.parse(raw) : typeof raw?.data === "string" ? JSON.parse(raw.data) : raw;
+        if (payload?.type === "error") {
+          const message = typeof payload?.error === "string" && payload.error ? payload.error : "relay_error";
+          this.status = {
+            ...this.status,
+            running: false,
+            status: "error",
+            error: message
+          };
+          finishReject(new Error(message));
+          return;
+        }
+        if (payload?.type === "registered") {
+          const publicUrl = typeof payload?.token === "string" ? `${derivePublicBaseUrl(this.options.serverUrl)}/${payload.token}` : void 0;
+          this.status = {
+            installed: true,
+            enabled: true,
+            running: true,
+            status: "running",
+            ...publicUrl ? { publicUrl } : {}
+          };
+          finishResolve({ ...this.status });
+          return;
+        }
+        if (payload?.type === "request") {
+          void this.handleRequest(payload);
+        }
+      });
+      socket.on("close", () => {
+        this.status = {
+          ...this.status,
+          running: false,
+          status: "error",
+          error: "relay_disconnected"
+        };
+        finishReject(new Error("relay_disconnected"));
+      });
+      socket.on("error", (error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        this.status = {
+          ...this.status,
+          running: false,
+          status: "error",
+          error: message
+        };
+        finishReject(error);
+      });
+    });
+  }
+  async stop() {
+    this.socket?.close();
+    this.socket = null;
+    this.status = {
+      installed: true,
+      enabled: false,
+      running: false,
+      status: "stopped"
+    };
+    return { ...this.status };
+  }
+  async setEnabled(enabled) {
+    return enabled ? await this.start() : await this.stop();
+  }
+  async handleRequest(payload) {
+    const fetchImpl = this.options.fetchImpl ?? fetch;
+    const response = await fetchImpl(`${this.options.targetBaseUrl}${payload.path}`, {
+      method: payload.method,
+      headers: payload.headers,
+      body: payload.bodyBase64 ? Buffer.from(payload.bodyBase64, "base64") : void 0
+    });
+    const bodyBuffer = Buffer.from(await response.arrayBuffer());
+    this.socket?.send(JSON.stringify({
+      type: "response",
+      requestId: payload.requestId,
+      status: response.status,
+      headers: Object.fromEntries(response.headers.entries()),
+      bodyBase64: bodyBuffer.toString("base64")
+    }));
+  }
+};
+function derivePublicBaseUrl(serverUrl) {
+  return serverUrl.replace(/^ws:\/\//, "http://").replace(/^wss:\/\//, "https://").replace(/\/agent\/?$/, "").replace(/\/+$/, "");
+}
+
+// src/runtime/relayTunnelRouter.ts
+var RelayTunnelRouter = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  relayProvider = null;
+  relayKey = "";
+  async getStatus() {
+    const provider = this.getOrCreateRelayProvider();
+    if (!provider) return this.notConfiguredStatus();
+    return await provider.getStatus();
+  }
+  async start() {
+    const provider = this.getOrCreateRelayProvider();
+    if (!provider) return this.notConfiguredStatus();
+    return await provider.start();
+  }
+  async stop() {
+    const provider = this.getOrCreateRelayProvider();
+    if (!provider) return this.notConfiguredStatus();
+    return await provider.stop();
+  }
+  async setEnabled(enabled) {
+    const provider = this.getOrCreateRelayProvider();
+    if (!provider) return this.notConfiguredStatus();
+    return await provider.setEnabled(enabled);
+  }
+  getOrCreateRelayProvider() {
+    const relay = this.options.defaults.tunnel.relay;
+    if (!relay?.serverUrl || !relay.authToken) return null;
+    const key = `${relay.serverUrl}|${relay.authToken}|${this.options.bridgePort}`;
+    if (this.relayProvider && this.relayKey === key) return this.relayProvider;
+    this.relayKey = key;
+    this.relayProvider = new RelayTunnelProvider({
+      serverUrl: relay.serverUrl,
+      authToken: relay.authToken,
+      targetBaseUrl: `http://127.0.0.1:${this.options.bridgePort}`,
+      createSocket: RelayTunnelProvider.defaultCreateSocket
+    });
+    return this.relayProvider;
+  }
+  notConfiguredStatus() {
+    return {
+      installed: false,
+      enabled: false,
+      running: false,
+      status: "error",
+      error: "relay_not_configured"
+    };
+  }
+};
+
 // src/daemon/server.ts
 function createDaemonServer(options = {}) {
   const app = Fastify({ logger: true });
   const events = new BridgeEventHub();
+  const configPath = options.configPath ?? process.env.BRIDGE_CONFIG ?? join9(mkdtempSync(join9(tmpdir2(), "claude-codex-wechat-")), "config.json");
+  const persistedConfig = loadBridgeConfig(configPath);
   const bridgeDefaults = {
-    defaultProvider: options.bridgeDefaults?.defaultProvider ?? "claude-code",
-    defaultWorkspace: options.bridgeDefaults?.defaultWorkspace ?? process.cwd()
+    defaultProvider: options.bridgeDefaults?.defaultProvider ?? persistedConfig.bridge?.defaultProvider ?? "claude-code",
+    defaultWorkspace: options.bridgeDefaults?.defaultWorkspace ?? persistedConfig.bridge?.defaultWorkspace ?? process.cwd(),
+    tunnel: options.bridgeDefaults?.tunnel ?? {
+      enabled: persistedConfig.tunnel?.enabled === true,
+      ...persistedConfig.tunnel?.relay ? { relay: persistedConfig.tunnel.relay } : {}
+    }
   };
-  const configPath = options.configPath ?? process.env.BRIDGE_CONFIG ?? join9(mkdtempSync(join9(tmpdir2(), "claude-codex-wechat-")), "config.json");
+  const existingRelayAuthToken = bridgeDefaults.tunnel.relay?.authToken?.trim();
+  if (existingRelayAuthToken) {
+    bridgeDefaults.tunnel.relay = {
+      ...bridgeDefaults.tunnel.relay ?? {},
+      authToken: existingRelayAuthToken
+    };
+  } else {
+    const authToken = ensureRelayAuthTokenSync({ configPath });
+    bridgeDefaults.tunnel.relay = {
+      ...bridgeDefaults.tunnel.relay ?? {},
+      authToken
+    };
+  }
   const conversation = new CurrentConversationStore(configPath, {
     defaultCwd: bridgeDefaults.defaultWorkspace,
     defaultProviderId: bridgeDefaults.defaultProvider
@@ -3911,6 +4266,10 @@ function createDaemonServer(options = {}) {
       await managedWechatChannel.sendMessage({ chatId, kind: msg.kind, text: msg.text });
     }
   }) : void 0;
+  const tunnelProvider = options.tunnelProvider ?? new RelayTunnelRouter({
+    bridgePort: Number(process.env.BRIDGE_PORT ?? 8787),
+    defaults: bridgeDefaults
+  });
   const messageRouter = channel ? new MessageRouter({
     channel,
     providers: providerAdapters,
@@ -3963,7 +4322,14 @@ function createDaemonServer(options = {}) {
     },
     lastProviderSessions,
     events,
-    defaults: bridgeDefaults
+    defaults: bridgeDefaults,
+    getHelpAddress: async () => {
+      const tunnel = await tunnelProvider?.getStatus().catch(() => null);
+      if (tunnel?.running && tunnel.publicUrl) return tunnel.publicUrl;
+      const lan = listLanIpv4Addresses()[0];
+      if (lan) return `http://${lan}:${process.env.BRIDGE_PORT ?? 8787}`;
+      return `http://127.0.0.1:${process.env.BRIDGE_PORT ?? 8787}`;
+    }
   }) : void 0;
   if (channel && messageRouter) {
     channel.onMessage(async (message) => {
@@ -3992,10 +4358,24 @@ function createDaemonServer(options = {}) {
     defaults: bridgeDefaults,
     configPath
   });
+  if (tunnelProvider) {
+    registerTunnelRoutes({
+      app,
+      configPath,
+      defaults: { tunnel: bridgeDefaults.tunnel },
+      tunnelManager: tunnelProvider
+    });
+  }
   registerFsBrowseRoutes({ app });
   app.get("/api/status", async () => ({
     ok: true,
-    sessions: conversation.getCurrent() ? [conversation.getCurrent()] : []
+    sessions: conversation.getCurrent() ? [conversation.getCurrent()] : [],
+    preferredLocalUrl: (() => {
+      const lan = listLanIpv4Addresses()[0];
+      const port = process.env.BRIDGE_PORT ?? 8787;
+      if (lan) return `http://${lan}:${port}`;
+      return `http://127.0.0.1:${port}`;
+    })()
   }));
   app.get("/api/providers/status", async () => providers.getStatus());
   app.post("/api/bridge-events", async (request, reply) => {
@@ -4029,7 +4409,7 @@ function createDaemonServer(options = {}) {
   app.addHook("onClose", async () => {
     await channel?.stop();
   });
-  return { app, conversation, sessions: conversation, events, activeUserStore };
+  return { app, conversation, sessions: conversation, events, activeUserStore, tunnelProvider };
 }
 
 // src/daemon/bootstrap.ts
@@ -4043,24 +4423,35 @@ async function startDaemon(options) {
     configPath,
     providers: providerCommands
   });
-  const { app } = createDaemonServer({
+  const bridgeDefaults = {
+    defaultProvider: config.bridge?.defaultProvider ?? "claude-code",
+    defaultWorkspace: config.bridge?.defaultWorkspace ?? process.cwd(),
+    tunnel: {
+      enabled: config.tunnel?.enabled === true,
+      ...config.tunnel?.relay ? { relay: config.tunnel.relay } : {}
+    }
+  };
+  const { app, tunnelProvider: resolvedTunnelProvider } = createDaemonServer({
     wechat: config.wechat,
     providerCommands,
-    bridgeDefaults: {
-      defaultProvider: config.bridge?.defaultProvider ?? "claude-code",
-      defaultWorkspace: config.bridge?.defaultWorkspace ?? process.cwd()
-    },
-    configPath
+    bridgeDefaults,
+    configPath,
+    ...options.tunnelProvider ? { tunnelProvider: options.tunnelProvider } : {}
   });
   await options.attachFrontend(app);
   await app.listen({ host, port });
+  const address = app.server.address();
+  const actualPort = typeof address === "object" && address ? address.port : port;
+  if (config.tunnel?.enabled === true) {
+    await resolvedTunnelProvider?.start().catch(() => void 0);
+  }
   console.log("claude-codex-wechat listening:");
-  console.log(`  Local:   http://127.0.0.1:${port}`);
+  console.log(`  Local:   http://127.0.0.1:${actualPort}`);
   for (const ip of listLanIpv4Addresses()) {
-    console.log(`  Network: http://${ip}:${port}`);
+    console.log(`  Network: http://${ip}:${actualPort}`);
   }
   console.log(`config path: ${configPath}`);
-  return { app, port, host, configPath };
+  return { app, port: actualPort, host, configPath };
 }
 function listLanIpv4Addresses() {
   return Object.values(networkInterfaces()).flat().filter((iface) => Boolean(iface)).filter((iface) => iface.family === "IPv4" && !iface.internal).map((iface) => iface.address);
@@ -4076,7 +4467,7 @@ async function resolveProviderCommands(providers) {
 }
 
 // src/daemon/staticFrontend.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { join as join10 } from "node:path";
 import fastifyStatic from "@fastify/static";
 function attachStaticFrontend(webRoot2) {
@@ -4085,7 +4476,7 @@ function attachStaticFrontend(webRoot2) {
       root: webRoot2,
       wildcard: false
     });
-    const indexHtml = readFileSync6(join10(webRoot2, "index.html"), "utf8");
+    const indexHtml = readFileSync7(join10(webRoot2, "index.html"), "utf8");
     app.setNotFoundHandler((request, reply) => {
       if (request.url.startsWith("/api")) {
         reply.code(404).send({ error: "not_found" });
@@ -4097,7 +4488,7 @@ function attachStaticFrontend(webRoot2) {
 }
 
 // src/daemon/service.ts
-import { existsSync as existsSync8, statSync } from "node:fs";
+import { existsSync as existsSync9, statSync } from "node:fs";
 import { mkdir as mkdir4, readFile as readFile6, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
 import { dirname as dirname11, join as join11 } from "node:path";
@@ -4147,13 +4538,13 @@ async function startService(context) {
 async function stopService(context) {
   if (process.platform === "darwin") {
     const spec = buildLaunchdSpec(context);
-    if (!existsSync8(spec.plistPath)) return await readServiceStatus(context);
+    if (!existsSync9(spec.plistPath)) return await readServiceStatus(context);
     await runLaunchctl(["bootout", `gui/${process.getuid?.() ?? 0}`, spec.plistPath]).catch(() => void 0);
     return await readServiceStatus(context);
   }
   if (process.platform === "linux") {
     const spec = buildSystemdUserSpec(context);
-    if (!existsSync8(spec.unitPath)) return await readServiceStatus(context);
+    if (!existsSync9(spec.unitPath)) return await readServiceStatus(context);
     await runSystemctl(["--user", "stop", spec.unitName]).catch(() => void 0);
     return await readServiceStatus(context);
   }
@@ -4162,7 +4553,7 @@ async function stopService(context) {
 async function uninstallService(context) {
   if (process.platform === "darwin") {
     const spec = buildLaunchdSpec(context);
-    if (existsSync8(spec.plistPath)) {
+    if (existsSync9(spec.plistPath)) {
       await runLaunchctl(["bootout", `gui/${process.getuid?.() ?? 0}`, spec.plistPath]).catch(() => void 0);
       await rm2(spec.plistPath, { force: true });
     }
@@ -4170,7 +4561,7 @@ async function uninstallService(context) {
   }
   if (process.platform === "linux") {
     const spec = buildSystemdUserSpec(context);
-    if (existsSync8(spec.unitPath)) {
+    if (existsSync9(spec.unitPath)) {
       await runSystemctl(["--user", "disable", "--now", spec.unitName]).catch(() => void 0);
       await rm2(spec.unitPath, { force: true });
       await runSystemctl(["--user", "daemon-reload"]).catch(() => void 0);
@@ -4213,7 +4604,7 @@ async function tailServiceLogs(context) {
 async function readServiceStatus(context) {
   if (process.platform === "darwin") {
     const spec = buildLaunchdSpec(context);
-    const installed = existsSync8(spec.plistPath);
+    const installed = existsSync9(spec.plistPath);
     const running = installed ? await runLaunchctl(["print", `gui/${process.getuid?.() ?? 0}/${spec.label}`]).then(() => true, () => false) : false;
     return {
       manager: "launchd",
@@ -4227,7 +4618,7 @@ async function readServiceStatus(context) {
   }
   if (process.platform === "linux") {
     const spec = buildSystemdUserSpec(context);
-    const installed = existsSync8(spec.unitPath);
+    const installed = existsSync9(spec.unitPath);
     const running = installed ? await runSystemctl(["--user", "is-active", "--quiet", spec.unitName]).then(() => true, () => false) : false;
     return {
       manager: "systemd-user",
@@ -4363,16 +4754,16 @@ async function runSystemctl(args) {
   await execFileAsync("systemctl", args);
 }
 async function ensureFileExists(path, errorCode) {
-  if (!existsSync8(path)) throw new Error(errorCode);
+  if (!existsSync9(path)) throw new Error(errorCode);
   await readFile6(path, "utf8");
 }
 async function tailFile(path, lines) {
-  if (!existsSync8(path)) return "";
+  if (!existsSync9(path)) return "";
   const content = await readFile6(path, "utf8");
   return content.split(/\r?\n/).slice(-lines).join("\n").trim();
 }
 async function tailFiles(paths) {
-  const readers = paths.filter((path) => existsSync8(path)).map((path) => {
+  const readers = paths.filter((path) => existsSync9(path)).map((path) => {
     const rl = createInterface({
       input: createReadStream(path, { encoding: "utf8", start: Math.max(0, fileSizeHint(path) - 8192) }),
       crlfDelay: Infinity
@@ -4386,7 +4777,7 @@ async function tailFiles(paths) {
   if (process.platform !== "linux" && process.platform !== "darwin") {
     return;
   }
-  const child = spawn6("tail", ["-f", ...paths.filter((path) => existsSync8(path))], { stdio: ["ignore", "pipe", "inherit"] });
+  const child = spawn6("tail", ["-f", ...paths.filter((path) => existsSync9(path))], { stdio: ["ignore", "pipe", "inherit"] });
   child.stdout.on("data", (chunk) => {
     process.stdout.write(String(chunk));
   });
@@ -4459,7 +4850,7 @@ async function main() {
   }
 }
 async function cmdStart() {
-  if (!existsSync9(webRoot)) {
+  if (!existsSync10(webRoot)) {
     console.error(`\u627E\u4E0D\u5230\u524D\u7AEF\u6784\u5EFA\u4EA7\u7269: ${webRoot}`);
     console.error("\u8BF7\u91CD\u65B0\u5B89\u88C5\u5B8C\u6574\u7684 npm \u5305\u3002");
     process.exitCode = 1;
@@ -4489,7 +4880,7 @@ async function cmdTail() {
   await tailServiceLogs(createServiceContext());
 }
 async function cmdDaemon() {
-  if (!existsSync9(webRoot)) {
+  if (!existsSync10(webRoot)) {
     console.error(`\u627E\u4E0D\u5230\u524D\u7AEF\u6784\u5EFA\u4EA7\u7269: ${webRoot}`);
     process.exitCode = 1;
     return;
@@ -4501,8 +4892,8 @@ async function cmdDaemon() {
 function cmdInit() {
   const configPath = process.env.BRIDGE_CONFIG ?? defaultConfigPath();
   const dir = dirname12(configPath);
-  mkdirSync6(dir, { recursive: true });
-  if (existsSync9(configPath)) {
+  mkdirSync7(dir, { recursive: true });
+  if (existsSync10(configPath)) {
     console.log(`\u914D\u7F6E\u5DF2\u5B58\u5728\uFF0C\u672A\u8986\u76D6: ${configPath}`);
     return;
   }
@@ -4519,7 +4910,7 @@ function cmdInit() {
       defaultWorkspace: process.cwd()
     }
   };
-  writeFileSync6(configPath, `${JSON.stringify(template, null, 2)}
+  writeFileSync7(configPath, `${JSON.stringify(template, null, 2)}
 `, "utf8");
   console.log(`\u5DF2\u521B\u5EFA\u914D\u7F6E: ${configPath}`);
   console.log("\u8BF7\u586B\u5165\u5FAE\u4FE1 token / accountId \u540E\u8FD0\u884C: claude-codex-wechat start");
@@ -4527,13 +4918,13 @@ function cmdInit() {
 async function cmdDoctor() {
   const configPath = process.env.BRIDGE_CONFIG ?? defaultConfigPath();
   console.log("claude-codex-wechat doctor\n");
-  report("\u914D\u7F6E\u6587\u4EF6", existsSync9(configPath) ? configPath : `\u7F3A\u5931 (${configPath})\uFF0C\u8FD0\u884C init \u521B\u5EFA`);
-  report("\u524D\u7AEF\u4EA7\u7269", existsSync9(webRoot) ? webRoot : `\u7F3A\u5931 (${webRoot})`);
+  report("\u914D\u7F6E\u6587\u4EF6", existsSync10(configPath) ? configPath : `\u7F3A\u5931 (${configPath})\uFF0C\u8FD0\u884C init \u521B\u5EFA`);
+  report("\u524D\u7AEF\u4EA7\u7269", existsSync10(webRoot) ? webRoot : `\u7F3A\u5931 (${webRoot})`);
   const claude = await findExecutable("claude");
   report("claude \u53EF\u6267\u884C", claude ?? "\u672A\u627E\u5230\uFF0C\u9700\u5148\u5B89\u88C5\u5E76\u767B\u5F55 Claude Code");
   const codex = await findExecutable("codex");
   report("codex \u53EF\u6267\u884C", codex ?? "\u672A\u627E\u5230\uFF08\u4EC5\u4F7F\u7528 Claude \u65F6\u53EF\u5FFD\u7565\uFF09");
-  if (existsSync9(configPath)) {
+  if (existsSync10(configPath)) {
     const config = loadBridgeConfig(configPath);
     const wechat = config.wechat;
     report("\u5FAE\u4FE1\u542F\u7528", wechat?.enabled ? "\u662F" : "\u5426");
@@ -4543,12 +4934,12 @@ async function cmdDoctor() {
 }
 function cmdPrintConfig() {
   const configPath = process.env.BRIDGE_CONFIG ?? defaultConfigPath();
-  if (!existsSync9(configPath)) {
+  if (!existsSync10(configPath)) {
     console.error(`\u914D\u7F6E\u4E0D\u5B58\u5728: ${configPath}\uFF08\u8FD0\u884C init \u521B\u5EFA\uFF09`);
     process.exitCode = 1;
     return;
   }
-  console.log(readFileSync7(configPath, "utf8"));
+  console.log(readFileSync8(configPath, "utf8"));
 }
 async function cmdUninstall() {
   const status = await uninstallService(createServiceContext());