codex-to-im 1.0.28 → 1.0.30

package/dist/ui-server.mjs

@@ -4566,7 +4566,7 @@ var require_lib = __commonJS({
 
 // src/ui-server.ts
 import http from "node:http";
-import crypto4 from "node:crypto";
+import crypto5 from "node:crypto";
 import net from "node:net";
 import os5 from "node:os";
 
@@ -5646,6 +5646,30 @@ function isProcessAlive(pid) {
     return false;
   }
 }
+function collectTrackedBridgePids(bridgePid, statusPid) {
+  const unique = /* @__PURE__ */ new Set();
+  for (const pid of [bridgePid, statusPid]) {
+    if (Number.isFinite(pid) && pid > 0) {
+      unique.add(pid);
+    }
+  }
+  return [...unique];
+}
+function resolveTrackedBridgePid(bridgePid, statusPid, isAlive = isProcessAlive) {
+  if (isAlive(bridgePid)) return bridgePid;
+  if (isAlive(statusPid)) return statusPid;
+  return bridgePid ?? statusPid;
+}
+function getTrackedBridgePids(status) {
+  const resolvedStatus = status ?? readJsonFile(bridgeStatusFile, { running: false });
+  return collectTrackedBridgePids(readPid(bridgePidFile), resolvedStatus.pid);
+}
+function clearBridgePidFile() {
+  try {
+    fs3.unlinkSync(bridgePidFile);
+  } catch {
+  }
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -5700,7 +5724,7 @@ function getUiServerUrl(port2 = uiPort) {
 }
 function getBridgeStatus() {
   const status = readJsonFile(bridgeStatusFile, { running: false });
-  const pid = readPid(bridgePidFile) ?? status.pid;
+  const pid = resolveTrackedBridgePid(readPid(bridgePidFile), status.pid);
   if (!isProcessAlive(pid)) {
     return {
       ...status,
@@ -5738,6 +5762,27 @@ function buildDaemonEnv() {
   delete env.CLAUDECODE;
   return env;
 }
+function describeBridgeStartupPreflightFailure(channels) {
+  const configured = Array.isArray(channels) ? channels : [];
+  if (configured.length === 0) {
+    return "\u672A\u914D\u7F6E\u4EFB\u4F55\u901A\u9053\u5B9E\u4F8B\u3002\u8BF7\u5148\u5728 Web \u63A7\u5236\u53F0\u521B\u5EFA\u5E76\u4FDD\u5B58\u81F3\u5C11\u4E00\u4E2A\u98DE\u4E66\u6216\u5FAE\u4FE1\u901A\u9053\uFF0C\u7136\u540E\u518D\u542F\u52A8\u6865\u63A5\u670D\u52A1\u3002";
+  }
+  const enabled = configured.filter((channel) => channel.enabled !== false);
+  if (enabled.length === 0) {
+    return "\u5F53\u524D\u6240\u6709\u901A\u9053\u5B9E\u4F8B\u90FD\u5DF2\u7981\u7528\u3002\u8BF7\u5148\u542F\u7528\u81F3\u5C11\u4E00\u4E2A\u901A\u9053\u5B9E\u4F8B\uFF0C\u7136\u540E\u518D\u542F\u52A8\u6865\u63A5\u670D\u52A1\u3002";
+  }
+  return null;
+}
+function describeBridgeActivationFailure(status, channels) {
+  const statusReason = status.lastExitReason?.trim();
+  if (statusReason) return statusReason;
+  const preflightFailure = describeBridgeStartupPreflightFailure(channels);
+  if (preflightFailure) return preflightFailure;
+  const enabled = (channels || []).filter((channel) => channel.enabled !== false);
+  if (enabled.length === 0) return null;
+  const labels = enabled.map((channel) => channel.alias?.trim() || channel.id).join("\u3001");
+  return `\u6CA1\u6709\u4EFB\u4F55\u901A\u9053\u9002\u914D\u5668\u542F\u52A8\u6210\u529F\u3002\u8BF7\u68C0\u67E5\u901A\u9053\u914D\u7F6E\u3001\u51ED\u636E\u548C\u65E5\u5FD7\u3002\u5F53\u524D\u5DF2\u542F\u7528\u901A\u9053\uFF1A${labels}`;
+}
 async function waitForBridgeRunning(timeoutMs = 2e4) {
   const startedAt = Date.now();
   while (Date.now() - startedAt < timeoutMs) {
@@ -5750,7 +5795,16 @@ async function waitForBridgeRunning(timeoutMs = 2e4) {
 async function startBridge() {
   ensureDirs();
   const current = getBridgeStatus();
-  if (current.running) return current;
+  const extraAlivePids = getTrackedBridgePids(current).filter((pid) => pid !== current.pid && isProcessAlive(pid));
+  if (current.running && extraAlivePids.length === 0) return current;
+  if (current.running && extraAlivePids.length > 0) {
+    await stopBridge();
+  }
+  const config = loadConfig();
+  const preflightFailure = describeBridgeStartupPreflightFailure(config.channels);
+  if (preflightFailure) {
+    throw new Error(preflightFailure);
+  }
   const daemonEntry = path4.join(packageRoot, "dist", "daemon.mjs");
   if (!fs3.existsSync(daemonEntry)) {
     throw new Error(`Daemon bundle not found at ${daemonEntry}. Run npm run build first.`);
@@ -5767,36 +5821,45 @@ async function startBridge() {
   child.unref();
   const status = await waitForBridgeRunning();
   if (!status.running) {
-    throw new Error(status.lastExitReason || "Bridge failed to report running=true.");
+    throw new Error(
+      describeBridgeActivationFailure(status, config.channels) || "Bridge failed to report running=true."
+    );
   }
   return status;
 }
 async function stopBridge() {
-  const status = getBridgeStatus();
-  if (!status.pid || !isProcessAlive(status.pid)) {
-    return { ...status, running: false };
-  }
-  if (process.platform === "win32") {
-    await new Promise((resolve) => {
-      const killer = spawn("cmd", ["/c", "taskkill", "/PID", String(status.pid), "/T", "/F"], {
-        stdio: "ignore",
-        ...WINDOWS_HIDE
+  const status = readJsonFile(bridgeStatusFile, { running: false });
+  const pids = getTrackedBridgePids(status).filter((pid) => isProcessAlive(pid));
+  if (pids.length === 0) {
+    clearBridgePidFile();
+    return { ...getBridgeStatus(), running: false };
+  }
+  for (const pid of pids) {
+    if (process.platform === "win32") {
+      await new Promise((resolve) => {
+        const killer = spawn("cmd", ["/c", "taskkill", "/PID", String(pid), "/T", "/F"], {
+          stdio: "ignore",
+          ...WINDOWS_HIDE
+        });
+        killer.on("exit", () => resolve());
+        killer.on("error", () => resolve());
       });
-      killer.on("exit", () => resolve());
-      killer.on("error", () => resolve());
-    });
-  } else {
-    try {
-      process.kill(status.pid, "SIGTERM");
-    } catch {
+    } else {
+      try {
+        process.kill(pid, "SIGTERM");
+      } catch {
+      }
     }
   }
   const startedAt = Date.now();
   while (Date.now() - startedAt < 1e4) {
-    const next = getBridgeStatus();
-    if (!next.running) return next;
+    if (pids.every((pid) => !isProcessAlive(pid))) {
+      clearBridgePidFile();
+      return getBridgeStatus();
+    }
     await sleep(300);
   }
+  clearBridgePidFile();
   return getBridgeStatus();
 }
 async function restartBridge() {
@@ -6429,6 +6492,7 @@ var JsonFileStore = class {
 var import_qrcode = __toESM(require_lib(), 1);
 import fs6 from "node:fs";
 import path7 from "node:path";
+import crypto4 from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
 
 // src/adapters/weixin/weixin-api.ts
@@ -6510,11 +6574,8 @@ function now2() {
 function getAccountRecency(account) {
   return account.lastLoginAt ?? account.updatedAt ?? account.createdAt;
 }
-function normalizeAccounts(accounts) {
-  if (accounts.length <= 1) {
-    return { accounts, removedAccountIds: [] };
-  }
-  const sorted = [...accounts].sort((a, b) => {
+function sortAccountsByRecency(accounts) {
+  return [...accounts].sort((a, b) => {
     const recencyDiff = getAccountRecency(b).localeCompare(getAccountRecency(a));
     if (recencyDiff !== 0) return recencyDiff;
     const updatedDiff = b.updatedAt.localeCompare(a.updatedAt);
@@ -6523,25 +6584,20 @@ function normalizeAccounts(accounts) {
     if (createdDiff !== 0) return createdDiff;
     return 0;
   });
-  const kept = sorted[0];
-  const removedAccountIds = [
-    ...new Set(
-      sorted.slice(1).map((account) => account.accountId).filter((accountId) => accountId !== kept.accountId)
-    )
-  ];
-  return {
-    accounts: [kept],
-    removedAccountIds
-  };
+}
+function normalizeAccounts(accounts) {
+  const deduped = /* @__PURE__ */ new Map();
+  for (const account of sortAccountsByRecency(accounts)) {
+    if (!account?.accountId || deduped.has(account.accountId)) continue;
+    deduped.set(account.accountId, account);
+  }
+  return Array.from(deduped.values());
 }
 function persistAccounts(accounts) {
   ensureDir2(DATA_DIR2);
   const normalized = normalizeAccounts(accounts);
-  atomicWrite2(ACCOUNTS_PATH, JSON.stringify(normalized.accounts, null, 2));
-  for (const accountId of normalized.removedAccountIds) {
-    deleteWeixinContextTokensByAccount(accountId);
-  }
-  return normalized.accounts;
+  atomicWrite2(ACCOUNTS_PATH, JSON.stringify(normalized, null, 2));
+  return normalized;
 }
 function readStoredAccounts() {
   ensureDir2(DATA_DIR2);
@@ -6549,21 +6605,13 @@ function readStoredAccounts() {
   return Array.isArray(raw) ? raw : [];
 }
 function readAccounts() {
-  return normalizeAccounts(readStoredAccounts()).accounts;
+  return normalizeAccounts(readStoredAccounts());
 }
 function writeAccounts(accounts) {
   persistAccounts(accounts);
 }
-function readContextTokens() {
-  ensureDir2(DATA_DIR2);
-  return readJson2(CONTEXT_TOKENS_PATH, {});
-}
-function writeContextTokens(tokens) {
-  ensureDir2(DATA_DIR2);
-  atomicWrite2(CONTEXT_TOKENS_PATH, JSON.stringify(tokens, null, 2));
-}
 function listWeixinAccounts() {
-  return readAccounts().sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+  return sortAccountsByRecency(readAccounts());
 }
 function upsertWeixinAccount(params) {
   const accounts = readAccounts();
@@ -6598,20 +6646,15 @@ function upsertWeixinAccount(params) {
   writeAccounts(nextAccounts);
   return account;
 }
-function deleteWeixinContextTokensByAccount(accountId) {
-  const tokens = readContextTokens();
-  const nextTokens = Object.fromEntries(
-    Object.entries(tokens).filter(([key]) => !key.startsWith(`${accountId}::`))
-  );
-  writeContextTokens(nextTokens);
-}
 
 // src/weixin-login.ts
 var MAX_REFRESHES = 3;
 var QR_TTL_MS = 5 * 6e4;
 var POLL_INTERVAL_MS = 3e3;
+var WEB_SESSION_TTL_MS = 15 * 6e4;
 var RUNTIME_DIR = path7.join(CTI_HOME, "runtime");
 var HTML_PATH = path7.join(RUNTIME_DIR, "weixin-login.html");
+var webLoginSessions = /* @__PURE__ */ new Map();
 function ensureRuntimeDir() {
   fs6.mkdirSync(RUNTIME_DIR, { recursive: true });
 }
@@ -6705,14 +6748,227 @@ function buildQrHtml(session, qrSvg) {
 </html>
 `;
 }
+function buildWeixinLoginPopupHtml(sessionId) {
+  const escapedSessionId = escapeHtml(sessionId);
+  return `<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>\u5FAE\u4FE1\u626B\u7801\u767B\u5F55</title>
+    <style>
+      :root { color-scheme: light; }
+      body {
+        margin: 0;
+        font-family: -apple-system, BlinkMacSystemFont, "PingFang SC", "Helvetica Neue", sans-serif;
+        background: linear-gradient(180deg, #f6fbf8 0%, #eef5ff 100%);
+        color: #14213d;
+      }
+      .wrap {
+        min-height: 100vh;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 28px 18px;
+      }
+      .card {
+        width: min(100%, 420px);
+        background: rgba(255,255,255,0.95);
+        border: 1px solid rgba(20,33,61,0.08);
+        border-radius: 24px;
+        box-shadow: 0 20px 50px rgba(36, 82, 167, 0.14);
+        padding: 24px;
+      }
+      h1 {
+        margin: 0 0 8px;
+        font-size: 24px;
+      }
+      p {
+        margin: 0;
+        color: #5b6b86;
+        line-height: 1.6;
+      }
+      .status {
+        margin-top: 16px;
+        padding: 10px 12px;
+        border-radius: 12px;
+        background: #f8fafc;
+        border: 1px solid rgba(20,33,61,0.08);
+        font-size: 14px;
+        color: #1f2937;
+      }
+      .status.success {
+        color: #166534;
+        background: #f0fdf4;
+        border-color: rgba(22, 101, 52, 0.16);
+      }
+      .status.error {
+        color: #b91c1c;
+        background: #fef2f2;
+        border-color: rgba(185, 28, 28, 0.16);
+      }
+      .qr {
+        display: flex;
+        justify-content: center;
+        margin: 22px 0;
+        min-height: 332px;
+        align-items: center;
+      }
+      .qr svg {
+        width: 300px;
+        height: 300px;
+        border-radius: 18px;
+        background: white;
+        border: 1px solid rgba(20,33,61,0.08);
+        padding: 16px;
+      }
+      .qr-placeholder {
+        width: 300px;
+        height: 300px;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        border-radius: 18px;
+        border: 1px dashed rgba(20,33,61,0.18);
+        color: #64748b;
+        background: rgba(248, 250, 252, 0.88);
+        text-align: center;
+        padding: 20px;
+        box-sizing: border-box;
+      }
+      ol {
+        margin: 0;
+        padding-left: 22px;
+        color: #334155;
+        line-height: 1.75;
+      }
+      .meta {
+        margin-top: 16px;
+        font-size: 12px;
+        color: #64748b;
+      }
+      .actions {
+        margin-top: 18px;
+        display: flex;
+        justify-content: flex-end;
+      }
+      button {
+        border: 1px solid rgba(20,33,61,0.12);
+        border-radius: 10px;
+        background: white;
+        color: #14213d;
+        padding: 9px 14px;
+        font: inherit;
+        cursor: pointer;
+      }
+      button:hover {
+        border-color: #2452a7;
+        color: #2452a7;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="wrap">
+      <div class="card">
+        <h1>\u5FAE\u4FE1\u626B\u7801\u767B\u5F55</h1>
+        <p>\u8BF7\u4F7F\u7528\u624B\u673A\u5FAE\u4FE1\u626B\u63CF\u4E8C\u7EF4\u7801\uFF0C\u5E76\u5728\u624B\u673A\u4E0A\u5B8C\u6210\u767B\u5F55\u786E\u8BA4\u3002</p>
+        <div id="status" class="status">\u6B63\u5728\u52A0\u8F7D\u4E8C\u7EF4\u7801\u2026</div>
+        <div class="qr" id="qrHost">
+          <div class="qr-placeholder">\u6B63\u5728\u51C6\u5907\u4E8C\u7EF4\u7801\uFF0C\u8BF7\u7A0D\u5019\u2026</div>
+        </div>
+        <ol>
+          <li>\u6253\u5F00\u624B\u673A\u5FAE\u4FE1\u626B\u4E00\u626B</li>
+          <li>\u626B\u63CF\u4E8C\u7EF4\u7801</li>
+          <li>\u5728\u624B\u673A\u4E0A\u786E\u8BA4\u6388\u6743</li>
+          <li>\u770B\u5230\u201C\u767B\u5F55\u6210\u529F\u201D\u540E\u5373\u53EF\u5173\u95ED\u5F53\u524D\u7A97\u53E3</li>
+        </ol>
+        <div class="meta" id="meta"></div>
+        <div class="actions">
+          <button type="button" id="closeBtn">\u5173\u95ED\u7A97\u53E3</button>
+        </div>
+      </div>
+    </div>
+    <script>
+      const sessionId = ${JSON.stringify(sessionId)};
+      const statusNode = document.getElementById('status');
+      const qrHost = document.getElementById('qrHost');
+      const meta = document.getElementById('meta');
+      const closeBtn = document.getElementById('closeBtn');
+      let timer = null;
+
+      function renderStatus(payload) {
+        const session = payload && payload.session ? payload.session : null;
+        if (!session) {
+          statusNode.className = 'status error';
+          statusNode.textContent = '\u626B\u7801\u4F1A\u8BDD\u4E0D\u5B58\u5728\u6216\u5DF2\u8FC7\u671F\u3002';
+          qrHost.innerHTML = '<div class="qr-placeholder">\u5F53\u524D\u4E8C\u7EF4\u7801\u5DF2\u5931\u6548\uFF0C\u8BF7\u56DE\u5230\u5DE5\u4F5C\u53F0\u91CD\u65B0\u53D1\u8D77\u626B\u7801\u3002</div>';
+          meta.textContent = '\u4F1A\u8BDD\uFF1A${escapedSessionId}';
+          return true;
+        }
+
+        statusNode.className = 'status';
+        if (session.status === 'confirmed') statusNode.classList.add('success');
+        if (session.status === 'failed') statusNode.classList.add('error');
+        statusNode.textContent = session.message || '\u7B49\u5F85\u626B\u7801\u2026';
+
+        if (session.qrSvg && session.status !== 'confirmed') {
+          qrHost.innerHTML = session.qrSvg;
+        } else if (session.status === 'confirmed') {
+          qrHost.innerHTML = '<div class="qr-placeholder">\u5F53\u524D\u8D26\u53F7\u5DF2\u7ED1\u5B9A\u6210\u529F\uFF0C\u53EF\u4EE5\u5173\u95ED\u5F53\u524D\u7A97\u53E3\u3002</div>';
+        } else {
+          qrHost.innerHTML = '<div class="qr-placeholder">\u4E8C\u7EF4\u7801\u6682\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002</div>';
+        }
+
+        meta.textContent = '\u4F1A\u8BDD\uFF1A' + session.id + ' \xB7 \u5DF2\u5237\u65B0 ' + session.refreshCount + ' \u6B21';
+
+        if (window.opener && window.location.origin) {
+          try {
+            window.opener.postMessage({
+              source: 'codex-to-im-weixin-login',
+              sessionId: session.id,
+              status: session.status,
+              accountId: session.accountId || '',
+            }, window.location.origin);
+          } catch {}
+        }
+
+        return session.status === 'confirmed' || session.status === 'failed';
+      }
+
+      async function tick() {
+        try {
+          const response = await fetch('/api/channels/weixin-login/' + encodeURIComponent(sessionId), {
+            headers: { 'Content-Type': 'application/json' },
+          });
+          const data = await response.json();
+          if (!response.ok) {
+            throw new Error(data.error || '\u52A0\u8F7D\u5FAE\u4FE1\u626B\u7801\u72B6\u6001\u5931\u8D25');
+          }
+          if (renderStatus(data) && timer) {
+            clearInterval(timer);
+            timer = null;
+          }
+        } catch (error) {
+          statusNode.className = 'status error';
+          statusNode.textContent = error && error.message ? error.message : '\u52A0\u8F7D\u5FAE\u4FE1\u626B\u7801\u72B6\u6001\u5931\u8D25';
+          qrHost.innerHTML = '<div class="qr-placeholder">\u65E0\u6CD5\u8BFB\u53D6\u626B\u7801\u72B6\u6001\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002</div>';
+          if (timer) {
+            clearInterval(timer);
+            timer = null;
+          }
+        }
+      }
+
+      closeBtn.addEventListener('click', () => window.close());
+      tick();
+      timer = window.setInterval(tick, 2000);
+    </script>
+  </body>
+</html>`;
+}
 async function writeQrHtml(session) {
   ensureRuntimeDir();
-  const qrSvg = await import_qrcode.default.toString(session.qrImageUrl, {
-    type: "svg",
-    errorCorrectionLevel: "M",
-    margin: 0,
-    width: 300
-  });
+  const qrSvg = await buildQrSvg(session.qrImageUrl);
   fs6.writeFileSync(HTML_PATH, buildQrHtml(session, qrSvg), "utf-8");
 }
 function openQrHtml() {
@@ -6740,6 +6996,43 @@ function normalizeAccountId(rawAccountId) {
 function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function buildQrSvg(qrImageUrl) {
+  return await import_qrcode.default.toString(qrImageUrl, {
+    type: "svg",
+    errorCorrectionLevel: "M",
+    margin: 0,
+    width: 300
+  });
+}
+function pruneWebLoginSessions() {
+  const now3 = Date.now();
+  for (const [sessionId, session] of webLoginSessions) {
+    if (now3 - session.updatedAt > WEB_SESSION_TTL_MS) {
+      webLoginSessions.delete(sessionId);
+    }
+  }
+}
+function toWebSessionState(session) {
+  return {
+    id: session.id,
+    channelId: session.channelId,
+    status: session.status,
+    startedAt: session.startedAt,
+    refreshCount: session.refreshCount,
+    updatedAt: session.updatedAt,
+    qrSvg: session.qrSvg,
+    message: session.message,
+    accountId: session.accountId
+  };
+}
+function updateWebSession(sessionId, updater) {
+  const current = webLoginSessions.get(sessionId);
+  if (!current) return null;
+  const next = updater(current);
+  next.updatedAt = Date.now();
+  webLoginSessions.set(sessionId, next);
+  return next;
+}
 async function createSession(refreshCount, baseUrl) {
   const response = await startLoginQr(baseUrl);
   if (!response.qrcode || !response.qrcode_img_content) {
@@ -6753,16 +7046,137 @@ async function createSession(refreshCount, baseUrl) {
     refreshCount
   };
 }
-async function refreshSession(previous, baseUrl) {
+async function createRefreshedSession(previous, baseUrl) {
   if (previous.refreshCount >= MAX_REFRESHES) {
     throw new Error("QR code expired too many times. Please run the login helper again.");
   }
-  const next = await createSession(previous.refreshCount + 1, baseUrl);
+  return await createSession(previous.refreshCount + 1, baseUrl);
+}
+async function refreshCliSession(previous, baseUrl) {
+  const next = await createRefreshedSession(previous, baseUrl);
   await writeQrHtml(next);
   openQrHtml();
   console.log(`[weixin-login] QR code refreshed (${next.refreshCount}/${MAX_REFRESHES})`);
   return next;
 }
+function persistConfirmedLogin(response, config = {}) {
+  if (!response.bot_token || !response.ilink_bot_id) {
+    throw new Error("QR login confirmed, but WeChat did not return bot credentials.");
+  }
+  const accountId = normalizeAccountId(response.ilink_bot_id);
+  upsertWeixinAccount({
+    accountId,
+    userId: response.ilink_user_id || "",
+    baseUrl: config.baseUrl || response.baseurl || DEFAULT_BASE_URL,
+    cdnBaseUrl: config.cdnBaseUrl || DEFAULT_CDN_BASE_URL,
+    token: response.bot_token,
+    name: accountId,
+    enabled: true
+  });
+  return { accountId };
+}
+async function runWeixinLoginWebSession(sessionId, config, onConfirmed) {
+  let lastStatus = "waiting";
+  try {
+    while (true) {
+      const active = webLoginSessions.get(sessionId);
+      if (!active) return;
+      if (Date.now() - active.startedAt > QR_TTL_MS) {
+        const next = await createRefreshedSession(active, config.baseUrl);
+        const qrSvg = await buildQrSvg(next.qrImageUrl);
+        updateWebSession(sessionId, (current) => ({
+          ...current,
+          ...next,
+          qrSvg,
+          message: `\u4E8C\u7EF4\u7801\u5DF2\u5237\u65B0\uFF08${next.refreshCount}/${MAX_REFRESHES}\uFF09\uFF0C\u8BF7\u4F7F\u7528\u65B0\u7684\u4E8C\u7EF4\u7801\u626B\u7801\u3002`
+        }));
+        lastStatus = "waiting";
+        continue;
+      }
+      const response = await pollLoginQrStatus(active.qrcode, config.baseUrl);
+      switch (response.status) {
+        case "wait":
+          if (lastStatus !== "waiting") {
+            updateWebSession(sessionId, (current) => ({
+              ...current,
+              status: "waiting",
+              message: "\u7B49\u5F85\u626B\u7801\u2026"
+            }));
+            lastStatus = "waiting";
+          }
+          break;
+        case "scaned":
+          if (lastStatus !== "scanned") {
+            updateWebSession(sessionId, (current) => ({
+              ...current,
+              status: "scanned",
+              message: "\u4E8C\u7EF4\u7801\u5DF2\u626B\u7801\uFF0C\u8BF7\u5728\u624B\u673A\u4E0A\u786E\u8BA4\u767B\u5F55\u3002"
+            }));
+            lastStatus = "scanned";
+          }
+          break;
+        case "confirmed": {
+          const persisted = persistConfirmedLogin(response, config);
+          if (onConfirmed) {
+            await onConfirmed(persisted.accountId);
+          }
+          updateWebSession(sessionId, (current) => ({
+            ...current,
+            status: "confirmed",
+            accountId: persisted.accountId,
+            message: `\u5FAE\u4FE1\u626B\u7801\u6210\u529F\uFF0C\u8D26\u53F7 ${persisted.accountId} \u5DF2\u4FDD\u5B58\u3002`
+          }));
+          return;
+        }
+        case "expired": {
+          const next = await createRefreshedSession(active, config.baseUrl);
+          const qrSvg = await buildQrSvg(next.qrImageUrl);
+          updateWebSession(sessionId, (current) => ({
+            ...current,
+            ...next,
+            qrSvg,
+            message: `\u4E8C\u7EF4\u7801\u5DF2\u8FC7\u671F\uFF0C\u5DF2\u81EA\u52A8\u5237\u65B0\uFF08${next.refreshCount}/${MAX_REFRESHES}\uFF09\u3002`
+          }));
+          lastStatus = "waiting";
+          continue;
+        }
+        default:
+          break;
+      }
+      await sleep2(POLL_INTERVAL_MS);
+    }
+  } catch (error) {
+    updateWebSession(sessionId, (current) => ({
+      ...current,
+      status: "failed",
+      message: error instanceof Error ? error.message : String(error)
+    }));
+  }
+}
+async function startWeixinLoginWebSession(options = {}) {
+  pruneWebLoginSessions();
+  ensureRuntimeDir();
+  const config = options.config || {};
+  const seed = await createSession(0, config.baseUrl);
+  const sessionId = crypto4.randomUUID();
+  const qrSvg = await buildQrSvg(seed.qrImageUrl);
+  const session = {
+    id: sessionId,
+    channelId: options.channelId,
+    ...seed,
+    qrSvg,
+    updatedAt: Date.now(),
+    message: "\u7B49\u5F85\u626B\u7801\u2026"
+  };
+  webLoginSessions.set(sessionId, session);
+  void runWeixinLoginWebSession(sessionId, config, options.onConfirmed);
+  return toWebSessionState(session);
+}
+function getWeixinLoginWebSession(sessionId) {
+  pruneWebLoginSessions();
+  const session = webLoginSessions.get(sessionId);
+  return session ? toWebSessionState(session) : void 0;
+}
 async function runWeixinLogin(config = {}) {
   ensureRuntimeDir();
   let session = await createSession(0, config.baseUrl);
@@ -6776,7 +7190,7 @@ async function runWeixinLogin(config = {}) {
   let lastStatus = session.status;
   while (true) {
     if (Date.now() - session.startedAt > QR_TTL_MS) {
-      session = await refreshSession(session, config.baseUrl);
+      session = await refreshCliSession(session, config.baseUrl);
       lastStatus = session.status;
     }
     const response = await pollLoginQrStatus(session.qrcode, config.baseUrl);
@@ -6788,30 +7202,15 @@ async function runWeixinLogin(config = {}) {
         session.status = "scanned";
         break;
       case "confirmed": {
-        if (!response.bot_token || !response.ilink_bot_id) {
-          throw new Error("QR login confirmed, but WeChat did not return bot credentials.");
-        }
         session.status = "confirmed";
-        const accountId = normalizeAccountId(response.ilink_bot_id);
-        const previousAccount = listWeixinAccounts()[0];
-        upsertWeixinAccount({
-          accountId,
-          userId: response.ilink_user_id || "",
-          baseUrl: config.baseUrl || response.baseurl || DEFAULT_BASE_URL,
-          cdnBaseUrl: config.cdnBaseUrl || DEFAULT_CDN_BASE_URL,
-          token: response.bot_token,
-          name: accountId,
-          enabled: true
-        });
+        const persisted = persistConfirmedLogin(response, config);
+        const accountId = persisted.accountId;
         console.log(`[weixin-login] Login successful. Saved linked account ${accountId}`);
-        if (previousAccount && previousAccount.accountId !== accountId) {
-          console.log(`[weixin-login] Replaced previous local account ${previousAccount.accountId}`);
-        }
         console.log("[weixin-login] You can now enable the `weixin` channel and start the bridge.");
         return { accountId, htmlPath: HTML_PATH };
       }
       case "expired":
-        session = await refreshSession(session, config.baseUrl);
+        session = await refreshCliSession(session, config.baseUrl);
         lastStatus = session.status;
         continue;
       default:
@@ -6967,6 +7366,11 @@ function asString(value) {
   const trimmed = value.trim();
   return trimmed ? trimmed : void 0;
 }
+function getPathSuffix(pathname, prefix) {
+  if (!pathname.startsWith(prefix)) return void 0;
+  const suffix = pathname.slice(prefix.length);
+  return suffix ? decodeURIComponent(suffix) : void 0;
+}
 function parseCsv(value) {
   const text2 = asString(value);
   if (!text2) return void 0;
@@ -7010,6 +7414,15 @@ function parseChannelProvider(value) {
   if (value === "feishu" || value === "weixin") return value;
   return void 0;
 }
+function getWeixinAccountConflict(config, accountId, currentChannelId) {
+  return (config.channels || []).find((channel) => channel.provider === "weixin" && channel.id !== currentChannelId && channel.config.accountId === accountId);
+}
+function assertWeixinAccountAvailable(config, accountId, currentChannelId) {
+  if (!accountId) return;
+  const conflict = getWeixinAccountConflict(config, accountId, currentChannelId);
+  if (!conflict) return;
+  throw new Error(`\u5FAE\u4FE1\u8D26\u53F7 ${accountId} \u5DF2\u88AB\u901A\u9053 ${getChannelLabel(conflict)} \u4F7F\u7528\uFF0C\u8BF7\u5148\u89E3\u7ED1\u6216\u6539\u7528\u5176\u4ED6\u8D26\u53F7\u3002`);
+}
 function createUiStore() {
   return new JsonFileStore(configToSettings(loadConfig()));
 }
@@ -7031,14 +7444,14 @@ function channelToPayload(channel) {
   };
 }
 function generateAccessToken() {
-  return crypto4.randomBytes(18).toString("base64url");
+  return crypto5.randomBytes(18).toString("base64url");
 }
 function timingSafeMatch(left, right) {
   if (!left || !right) return false;
   const leftBuffer = Buffer.from(left);
   const rightBuffer = Buffer.from(right);
   if (leftBuffer.length !== rightBuffer.length) return false;
-  return crypto4.timingSafeEqual(leftBuffer, rightBuffer);
+  return crypto5.timingSafeEqual(leftBuffer, rightBuffer);
 }
 function parseCookies(request) {
   const header = request.headers.cookie;
@@ -7162,8 +7575,10 @@ function mergeChannelInstance(payload, current) {
       feedbackMarkdownEnabled: payload.feedbackMarkdownEnabled !== false
     };
   } else {
+    const accountId = asString(payload.accountId);
+    assertWeixinAccountAvailable(current, accountId, existing?.id);
     nextConfig = {
-      accountId: asString(payload.accountId),
+      accountId,
       baseUrl: asString(payload.baseUrl),
       cdnBaseUrl: asString(payload.cdnBaseUrl),
       mediaEnabled: payload.mediaEnabled === true,
@@ -8239,6 +8654,87 @@ function renderHtml() {
         overflow: hidden;
       }
 
+      .channel-workspace .panel-header {
+        margin-bottom: 20px;
+        padding-bottom: 18px;
+        border-bottom: 1px solid var(--border);
+        gap: 18px;
+        align-items: stretch;
+      }
+
+      .channel-header-copy {
+        max-width: 620px;
+      }
+
+      .channel-header-actions {
+        display: grid;
+        grid-template-columns: repeat(2, minmax(0, max-content));
+        align-items: stretch;
+        justify-content: flex-end;
+        gap: 12px;
+      }
+
+      .channel-action-group {
+        min-width: 220px;
+        padding: 14px 16px;
+        border: 1px solid var(--border);
+        border-radius: 12px;
+        background: linear-gradient(180deg, #ffffff 0%, var(--surface-soft) 100%);
+        box-shadow: 0 10px 24px rgba(15, 23, 42, 0.05);
+        display: grid;
+        gap: 8px;
+      }
+
+      .channel-action-label {
+        font-size: 12px;
+        font-weight: 600;
+        color: var(--muted);
+      }
+
+      .channel-action-row {
+        display: flex;
+        align-items: center;
+        gap: 10px;
+      }
+
+      .channel-action-hint {
+        font-size: 12px;
+        color: var(--muted);
+        line-height: 1.5;
+      }
+
+      .channel-action-row select {
+        min-width: 110px;
+        height: 40px;
+        padding: 0 12px;
+        border: 1px solid var(--border-strong);
+        border-radius: 8px;
+        background: #ffffff;
+        color: var(--text);
+      }
+
+      .channel-create-button,
+      .channel-refresh-button {
+        min-height: 40px;
+        font-weight: 600;
+        white-space: nowrap;
+        margin-top: 0;
+      }
+
+      .channel-create-button {
+        min-width: 128px;
+      }
+
+      .channel-refresh-button {
+        width: auto;
+        padding-inline: 16px;
+        background: var(--surface);
+      }
+
+      .channel-refresh-button:hover {
+        background: #f8fafc;
+      }
+
       .channel-layout {
         display: grid;
         grid-template-columns: 280px minmax(0, 1fr);
@@ -8652,6 +9148,11 @@ function renderHtml() {
         .main { padding: 20px 20px 28px; }
         .channel-layout { grid-template-columns: 1fr; }
         .channel-sidebar { border-right: 0; padding-right: 0; }
+        .channel-header-actions {
+          grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+          justify-content: stretch;
+        }
+        .channel-action-group { min-width: 0; }
         .channel-editor-summary { grid-template-columns: 1fr; }
         .field-row,
         .field-row.triple,
@@ -8669,6 +9170,13 @@ function renderHtml() {
         .project-group-head,
         .binding-head,
         .session-section-head { flex-direction: column; align-items: stretch; }
+        .channel-header-actions,
+        .channel-action-row { width: 100%; }
+        .channel-action-group,
+        .channel-refresh-button,
+        .channel-create-button { width: 100%; }
+        .channel-action-row { display: grid; grid-template-columns: 1fr; }
+        .channel-action-row select { width: 100%; }
         .session-head { grid-template-columns: 1fr; }
         .session-simple-item { grid-template-columns: 1fr; }
         .session-actions { justify-content: flex-start; }
@@ -9008,24 +9516,33 @@ function renderHtml() {
             </div>
           </div>
 
-          <section class="panel channel-workspace">
-            <div class="panel-header">
-              <div>
-                <h2>\u901A\u9053\u5B9E\u4F8B</h2>
-                <p>\u8FD9\u91CC\u7BA1\u7406\u591A\u4E2A\u98DE\u4E66\u6216\u5FAE\u4FE1\u673A\u5668\u4EBA\u5B9E\u4F8B\u3002\u5B9E\u4F8B\u53EA\u662F\u4E0D\u540C\u804A\u5929\u5165\u53E3\uFF0C\u4E0D\u4F1A\u6539\u53D8 Codex \u7684\u4F1A\u8BDD\u8BED\u4E49\u3002</p>
-              </div>
-              <div class="toolbar">
-                <label class="inline-select">
-                  \u65B0\u901A\u9053
+        <section class="panel channel-workspace">
+          <div class="panel-header">
+            <div class="channel-header-copy">
+              <h2>\u901A\u9053\u5B9E\u4F8B</h2>
+              <p>\u8FD9\u91CC\u7BA1\u7406\u591A\u4E2A\u98DE\u4E66\u6216\u5FAE\u4FE1\u673A\u5668\u4EBA\u5B9E\u4F8B\u3002\u5B9E\u4F8B\u53EA\u662F\u4E0D\u540C\u804A\u5929\u5165\u53E3\uFF0C\u4E0D\u4F1A\u6539\u53D8 Codex \u7684\u4F1A\u8BDD\u8BED\u4E49\u3002</p>
+            </div>
+            <div class="channel-header-actions">
+              <div class="channel-action-group">
+                <div class="channel-action-label">\u65B0\u901A\u9053</div>
+                <div class="channel-action-row">
                   <select id="newChannelProvider">
                     <option value="feishu">\u98DE\u4E66</option>
                     <option value="weixin">\u5FAE\u4FE1</option>
                   </select>
-                </label>
-                <button id="createChannelBtn">\u65B0\u589E\u901A\u9053</button>
-                <button id="refreshChannelsBtn">\u5237\u65B0\u72B6\u6001</button>
+                  <button class="primary channel-create-button" id="createChannelBtn">\u65B0\u589E\u901A\u9053</button>
+                </div>
+                <div class="channel-action-hint">\u5148\u9009\u62E9\u901A\u9053\u7C7B\u578B\uFF0C\u518D\u521B\u5EFA\u4E00\u4E2A\u65B0\u7684\u673A\u5668\u4EBA\u5B9E\u4F8B\u3002</div>
+              </div>
+              <div class="channel-action-group">
+                <div class="channel-action-label">\u72B6\u6001\u540C\u6B65</div>
+                <div class="channel-action-row">
+                  <button class="channel-refresh-button" id="refreshChannelsBtn">\u5237\u65B0\u72B6\u6001</button>
+                </div>
+                <div class="channel-action-hint">\u624B\u52A8\u62C9\u53D6\u6700\u65B0\u901A\u9053\u72B6\u6001\u548C\u5F53\u524D\u7ED1\u5B9A\u4FE1\u606F\u3002</div>
               </div>
             </div>
+          </div>
 
             <div class="channel-layout">
               <aside class="channel-sidebar">
@@ -9075,6 +9592,7 @@ function renderHtml() {
         activePage: 'overview',
         activeChannelId: '',
         channelDraft: null,
+        weixinLoginPollers: {},
       };
 
       function escapeHtml(value) {
@@ -10211,7 +10729,63 @@ function renderHtml() {
         showMessage('channelMessage', result.ok ? 'success' : 'error', result.message);
       }
 
+      function buildWeixinLoginPopupUrl(sessionId) {
+        return '/weixin-login/' + encodeURIComponent(sessionId);
+      }
+
+      function stopWeixinLoginWatcher(sessionId) {
+        const timer = state.weixinLoginPollers[sessionId];
+        if (!timer) return;
+        window.clearInterval(timer);
+        delete state.weixinLoginPollers[sessionId];
+      }
+
+      async function watchWeixinLoginSession(sessionId) {
+        stopWeixinLoginWatcher(sessionId);
+
+        const tick = async () => {
+          try {
+            const result = await api('/api/channels/weixin-login/' + encodeURIComponent(sessionId));
+            const session = result.session || null;
+            if (!session) {
+              stopWeixinLoginWatcher(sessionId);
+              showMessage('channelMessage', 'error', '\u5FAE\u4FE1\u626B\u7801\u4F1A\u8BDD\u4E0D\u5B58\u5728\u6216\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u626B\u7801\u3002');
+              return;
+            }
+
+            if (session.status === 'confirmed') {
+              stopWeixinLoginWatcher(sessionId);
+              if (result.config) {
+                fillForm(result.config);
+              } else {
+                await loadStatus();
+              }
+              showMessage('channelMessage', 'success', session.message || ('\u5FAE\u4FE1\u626B\u7801\u6210\u529F\uFF0C\u8D26\u53F7 ' + (session.accountId || '') + ' \u5DF2\u4FDD\u5B58\u3002'));
+              return;
+            }
+
+            if (session.status === 'failed') {
+              stopWeixinLoginWatcher(sessionId);
+              showMessage('channelMessage', 'error', session.message || '\u5FAE\u4FE1\u626B\u7801\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u626B\u7801\u3002');
+            }
+          } catch (error) {
+            stopWeixinLoginWatcher(sessionId);
+            showMessage('channelMessage', 'error', error.message);
+          }
+        };
+
+        await tick();
+        if (!state.weixinLoginPollers[sessionId]) {
+          state.weixinLoginPollers[sessionId] = window.setInterval(tick, 2000);
+        }
+      }
+
       async function loginWeixinForChannel(channel) {
+        let popup = null;
+        try {
+          popup = window.open('about:blank', '_blank', 'popup=yes,width=520,height=760');
+        } catch {}
+
         if (String(channel.id || '').startsWith('__draft__:')) {
           const saved = await saveChannel(channel);
           channel = getChannelById(saved.channel.id);
@@ -10219,13 +10793,25 @@ function renderHtml() {
           await saveChannel(channel);
           channel = getChannelById(channel.id);
         }
-        const result = await api('/api/channels/weixin-login', {
+
+        const result = await api('/api/channels/weixin-login/start', {
           method: 'POST',
           body: JSON.stringify({ channelId: channel.id }),
         });
-        fillForm(result.config || state.config);
-        await loadStatus();
-        showMessage('channelMessage', result.ok ? 'success' : 'error', result.message);
+
+        const popupUrl = result.popupUrl || buildWeixinLoginPopupUrl(result.sessionId);
+        if (popup && !popup.closed) {
+          popup.location.replace(popupUrl);
+        } else {
+          const fallback = window.open(popupUrl, '_blank', 'popup=yes,width=520,height=760');
+          if (!fallback) {
+            showMessage('channelMessage', 'error', '\u6D4F\u89C8\u5668\u963B\u6B62\u4E86\u626B\u7801\u5F39\u7A97\uFF0C\u8BF7\u5141\u8BB8\u5F53\u524D\u7AD9\u70B9\u6253\u5F00\u5F39\u7A97\u540E\u91CD\u8BD5\u3002');
+            return;
+          }
+        }
+
+        showMessage('channelMessage', 'success', result.message || '\u5FAE\u4FE1\u626B\u7801\u7A97\u53E3\u5DF2\u6253\u5F00\uFF0C\u8BF7\u5728\u5F39\u7A97\u4E2D\u5B8C\u6210\u626B\u7801\u3002');
+        void watchWeixinLoginSession(result.sessionId);
       }
 
       async function handleChannelEditorAction(event) {
@@ -10526,6 +11112,21 @@ var server = http.createServer(async (request, response) => {
       html(response, renderLoginHtml());
       return;
     }
+    const weixinLoginPageSessionId = request.method === "GET" ? getPathSuffix(url.pathname, "/weixin-login/") : void 0;
+    if (request.method === "GET" && weixinLoginPageSessionId) {
+      if (!localRequest) {
+        if (config.uiAllowLan !== true) {
+          html(response, renderAccessDeniedHtml());
+          return;
+        }
+        if (!isRemoteAuthenticated(request, config)) {
+          html(response, renderLoginHtml());
+          return;
+        }
+      }
+      html(response, buildWeixinLoginPopupHtml(weixinLoginPageSessionId));
+      return;
+    }
     if (request.method === "POST" && url.pathname === "/api/auth/login") {
       if (config.uiAllowLan !== true) {
         json(response, 403, { error: "\u5F53\u524D\u672A\u5F00\u542F\u5C40\u57DF\u7F51\u8BBF\u95EE\u3002" });
@@ -10711,6 +11312,63 @@ var server = http.createServer(async (request, response) => {
       });
       return;
     }
+    if (request.method === "POST" && url.pathname === "/api/channels/weixin-login/start") {
+      const payload = await readJsonBody(request);
+      const channelId = asString(payload.channelId);
+      if (!channelId) {
+        json(response, 400, { error: "channelId \u4E0D\u80FD\u4E3A\u7A7A\u3002" });
+        return;
+      }
+      const current = loadConfig();
+      const channel = findChannelInstance(channelId, current);
+      if (!channel || channel.provider !== "weixin") {
+        json(response, 404, { error: "\u6307\u5B9A\u7684\u5FAE\u4FE1\u901A\u9053\u4E0D\u5B58\u5728\u3002" });
+        return;
+      }
+      const loginConfig = channel.config;
+      const session = await startWeixinLoginWebSession({
+        channelId: channel.id,
+        config: loginConfig,
+        onConfirmed: async (accountId) => {
+          const latest = loadConfig();
+          const latestChannel = findChannelInstance(channel.id, latest);
+          if (!latestChannel || latestChannel.provider !== "weixin") return;
+          const merged = mergeChannelInstance({
+            id: latestChannel.id,
+            provider: latestChannel.provider,
+            alias: latestChannel.alias,
+            enabled: latestChannel.enabled,
+            accountId,
+            baseUrl: latestChannel.config.baseUrl,
+            cdnBaseUrl: latestChannel.config.cdnBaseUrl,
+            mediaEnabled: latestChannel.config.mediaEnabled === true,
+            feedbackMarkdownEnabled: latestChannel.config.feedbackMarkdownEnabled === true
+          }, latest);
+          saveConfig(merged.config);
+        }
+      });
+      json(response, 200, {
+        ok: true,
+        sessionId: session.id,
+        popupUrl: `/weixin-login/${encodeURIComponent(session.id)}`,
+        message: "\u5FAE\u4FE1\u626B\u7801\u7A97\u53E3\u5DF2\u6253\u5F00\uFF0C\u8BF7\u5728\u5F39\u7A97\u4E2D\u5B8C\u6210\u626B\u7801\u3002"
+      });
+      return;
+    }
+    const weixinLoginStatusSessionId = request.method === "GET" ? getPathSuffix(url.pathname, "/api/channels/weixin-login/") : void 0;
+    if (request.method === "GET" && weixinLoginStatusSessionId) {
+      const session = getWeixinLoginWebSession(weixinLoginStatusSessionId);
+      if (!session) {
+        json(response, 404, { error: "\u5FAE\u4FE1\u626B\u7801\u4F1A\u8BDD\u4E0D\u5B58\u5728\u6216\u5DF2\u8FC7\u671F\u3002" });
+        return;
+      }
+      json(response, 200, {
+        ok: true,
+        session,
+        config: session.status === "confirmed" ? configToPayload(loadConfig()) : void 0
+      });
+      return;
+    }
     if (request.method === "POST" && url.pathname === "/api/install-codex-integration") {
       const result = await installCodexIntegration();
       json(response, 200, result);