dsh-lark-bot 0.19.14 → 0.19.15

package/dist/cli.js

@@ -6190,7 +6190,7 @@ async function runDoctor(options) {
 
 // src/cli/commands/run.ts
 import { mkdir as mkdir22 } from "fs/promises";
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 import { join as join27 } from "path";
 
 // src/bot/active-runs.ts
@@ -11229,6 +11229,9 @@ function abortError() {
   return error;
 }
 
+// src/onboard/sink-qr-providers.ts
+import { createDecipheriv, randomBytes as randomBytes2, randomUUID as randomUUID8 } from "crypto";
+
 // src/notify/sinks/text.ts
 function renderSinkText(message) {
   const zhLine = `${message.title.zh}\uFF08scope \`${message.scope}\`\uFF09${message.detail ? `\uFF1A${message.detail}` : ""}`;
@@ -11310,63 +11313,131 @@ function splitDestination(value) {
 }
 
 // src/onboard/sink-qr-providers.ts
-var WeChatQrProvider = class {
-  constructor(baseUrl = process.env.DSH_LARK_WECHAT_ILINK_URL ?? "https://ilinkai.weixin.qq.com", fetchImpl = fetch) {
-    this.baseUrl = baseUrl;
+var API_HEADERS = { "content-type": "application/json", accept: "application/json" };
+var BIND_STATUS = { NONE: 0, PENDING: 1, COMPLETED: 2, EXPIRED: 3 };
+var QqQrProvider = class {
+  constructor(portalHost = process.env.DSH_LARK_QQ_PORTAL_HOST ?? "q.qq.com", fetchImpl = fetch, genKey = () => randomBytes2(32).toString("base64")) {
+    this.portalHost = portalHost;
     this.fetchImpl = fetchImpl;
+    this.genKey = genKey;
   }
-  baseUrl;
+  portalHost;
   fetchImpl;
-  type = "wechat";
+  genKey;
+  type = "qq";
+  sessions = /* @__PURE__ */ new Map();
   async begin(_options) {
-    const response = await this.fetchImpl(`${this.baseUrl}/ilink/bot/get_bot_qrcode`, { method: "POST" });
+    const aesKey = this.genKey();
+    const response = await this.fetchImpl(`https://${this.portalHost}/lite/create_bind_task`, {
+      method: "POST",
+      headers: API_HEADERS,
+      body: JSON.stringify({ key: aesKey })
+    });
     const payload = await response.json().catch(() => ({}));
-    const qrUrl = payload.qrcode ?? payload.url ?? "";
-    if (!response.ok || !qrUrl) {
-      throw new Error(payload.msg ?? `wechat get_bot_qrcode failed: http ${response.status}`);
+    const taskId = payload.data?.task_id;
+    if (!response.ok || !taskId || payload.retcode !== void 0 && payload.retcode !== 0) {
+      throw new Error(`qq create_bind_task failed: ${payload.msg ?? ""} (http ${response.status})`);
     }
-    return { providerType: this.type, sessionId: qrUrl, qrUrl, expireIn: 180 };
+    const sessionId = randomUUID8();
+    this.sessions.set(sessionId, { taskId, aesKey });
+    const qrUrl = `https://q.qq.com/qqbot/openclaw/connect.html?task_id=${encodeURIComponent(taskId)}&_wv=2&source=dsh-lark-bot`;
+    return { providerType: this.type, sessionId, qrUrl, expireIn: 600 };
   }
   async poll(sessionId, _signal) {
-    const response = await this.fetchImpl(`${this.baseUrl}/ilink/bot/getupdates`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ qrcode: sessionId })
-    }).catch(() => void 0);
-    void response;
+    const state = this.sessions.get(sessionId);
+    if (!state) return { phase: "failed", error: "unknown session" };
+    let data = {};
+    try {
+      const response = await this.fetchImpl(`https://${this.portalHost}/lite/poll_bind_result`, {
+        method: "POST",
+        headers: API_HEADERS,
+        body: JSON.stringify({ task_id: state.taskId })
+      });
+      const payload = await response.json();
+      if (!response.ok || payload.retcode !== void 0 && payload.retcode !== 0) return { phase: "pending" };
+      data = payload.data ?? {};
+    } catch {
+      return { phase: "pending" };
+    }
+    const status = data.status ?? BIND_STATUS.NONE;
+    if (status === BIND_STATUS.COMPLETED && data.bot_appid && data.bot_encrypt_secret) {
+      let clientSecret;
+      try {
+        clientSecret = decryptSecret(data.bot_encrypt_secret, state.aesKey);
+      } catch (error) {
+        this.sessions.delete(sessionId);
+        return { phase: "failed", error: `decrypt failed: ${error instanceof Error ? error.message : String(error)}` };
+      }
+      const target = data.user_openid ? `user:${data.user_openid}` : "";
+      this.sessions.delete(sessionId);
+      return {
+        phase: "completed",
+        channel: {
+          id: "",
+          type: "qq",
+          label: "QQ",
+          destination: target,
+          secret: `${data.bot_appid}:${clientSecret}`
+        }
+      };
+    }
+    if (status === BIND_STATUS.EXPIRED) {
+      this.sessions.delete(sessionId);
+      return { phase: "expired" };
+    }
     return { phase: "pending" };
   }
 };
-var QqQrProvider = class {
-  constructor(portalHost = process.env.DSH_LARK_QQ_PORTAL_HOST ?? "api.sgroup.qq.com", fetchImpl = fetch) {
-    this.portalHost = portalHost;
+var WeChatQrProvider = class {
+  constructor(baseUrl = process.env.DSH_LARK_WECHAT_ILINK_URL ?? "https://ilinkai.weixin.qq.com", fetchImpl = fetch) {
+    this.baseUrl = baseUrl;
     this.fetchImpl = fetchImpl;
   }
-  portalHost;
+  baseUrl;
   fetchImpl;
-  type = "qq";
+  type = "wechat";
+  sessions = /* @__PURE__ */ new Map();
   async begin(_options) {
-    const response = await this.fetchImpl(`https://${this.portalHost}/app/create_bind_task`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({})
+    const response = await this.fetchImpl(`${this.baseUrl}/ilink/bot/get_bot_qrcode?bot_type=3`, {
+      method: "GET"
     });
     const payload = await response.json().catch(() => ({}));
-    const taskId = payload.data?.task_id;
-    if (!response.ok || !taskId || payload.retcode !== void 0 && payload.retcode !== 0) {
-      throw new Error(`qq create_bind_task failed: http ${response.status}`);
+    const qrcode2 = payload.qrcode ?? payload.url ?? "";
+    if (!response.ok || !qrcode2) {
+      throw new Error(payload.msg ?? `wechat get_bot_qrcode failed: http ${response.status}`);
     }
-    const qrUrl = `https://q.qq.com/bot/#/bind-task?key=${encodeURIComponent(taskId)}`;
-    return { providerType: this.type, sessionId: taskId, qrUrl, expireIn: 180 };
+    const sessionId = randomUUID8();
+    this.sessions.set(sessionId, { qrcode: qrcode2 });
+    return { providerType: this.type, sessionId, qrUrl: qrcode2, expireIn: 180 };
   }
   async poll(sessionId, _signal) {
-    const response = await this.fetchImpl(`https://${this.portalHost}/app/poll_bind_result`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ task_id: sessionId })
-    }).catch(() => void 0);
-    void response;
-    return { phase: "pending" };
+    const state = this.sessions.get(sessionId);
+    if (!state) return { phase: "failed", error: "unknown session" };
+    const statusUrl = `${this.baseUrl}/ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(state.qrcode)}`;
+    try {
+      const response = await this.fetchImpl(statusUrl, {
+        method: "GET",
+        headers: { "iLink-App-Id": "bot", "iLink-App-ClientVersion": "131072" }
+      });
+      const payload = await response.json().catch(() => ({}));
+      const status = String(payload.status ?? "wait").toLowerCase();
+      if (status === "confirmed" || status === "success" || status === "scanned" || status === "2") {
+        const token = payload.token ?? payload.access_token ?? "";
+        const userId = payload.openid ?? payload.user_id ?? payload.to_user_id ?? "";
+        this.sessions.delete(sessionId);
+        return {
+          phase: "completed",
+          channel: { id: "", type: "wechat", label: "\u5FAE\u4FE1", destination: userId ? `${userId}|` : "", secret: token }
+        };
+      }
+      if (status === "expired") {
+        this.sessions.delete(sessionId);
+        return { phase: "expired" };
+      }
+      return { phase: "pending" };
+    } catch {
+      return { phase: "pending" };
+    }
   }
 };
 function buildSinkQrProviders() {
@@ -11378,7 +11449,21 @@ function coerceSinkQrChannel(input) {
 }
 function normalizeWechatDestination(value) {
   if (value.includes("|")) return value;
-  return splitDestination(value)[0] ? `${value}|` : value;
+  const [id] = splitDestination(value);
+  return id ? `${id}|` : value;
+}
+function decryptSecret(encryptedBase64, keyBase64) {
+  const key = Buffer.from(keyBase64, "base64");
+  const raw = Buffer.from(encryptedBase64, "base64");
+  if (key.length !== 32) throw new Error("bind key must be 32 bytes");
+  if (raw.length < 12 + 16) throw new Error("ciphertext too short");
+  const iv = raw.subarray(0, 12);
+  const body3 = raw.subarray(12);
+  const tag = body3.subarray(body3.length - 16);
+  const ciphertext = body3.subarray(0, body3.length - 16);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
 
 // src/onboard/qr-image.ts
@@ -13628,7 +13713,7 @@ function safe(value, maxBytes) {
 }
 
 // src/session/projection-protocol.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var WebSessionProjectionSource = class {
   constructor(transport) {
     this.transport = transport;
@@ -13667,7 +13752,7 @@ var WebSessionProjectionSource = class {
     });
     return { events, hasMore: value.hasMore === true };
   }
-  async prompt(sessionId, text, rpcId = randomUUID8()) {
+  async prompt(sessionId, text, rpcId = randomUUID9()) {
     responseValue(await this.transport.rpc("session.prompt", {
       sessionId,
       mode: "queue",
@@ -14340,7 +14425,7 @@ function wait(ms) {
 }
 
 // src/commands/session-projection.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var SessionProjectionController = class {
   constructor(deps) {
     this.deps = deps;
@@ -14480,7 +14565,7 @@ workspace: \`${workspaceCwd}\``
     if (owner && owner.scope !== input.identity.scope && !this.deps.access.isAdmin(input.identity.actorId)) {
       throw new Error("\u8BE5 session \u5DF2\u7ED1\u5B9A\u5176\u4ED6\u98DE\u4E66 scope\uFF1B\u72EC\u5360\u8FC1\u79FB\u4EC5 profile \u7BA1\u7406\u5458\u53EF\u786E\u8BA4");
     }
-    const nonce = randomUUID9();
+    const nonce = randomUUID10();
     const expiresAt = Date.now() + (this.deps.confirmationTtlMs ?? 10 * 6e4);
     const timer = setTimeout(() => this.pending.delete(nonce), expiresAt - Date.now());
     timer.unref?.();
@@ -15517,7 +15602,7 @@ function attachRunCardAnchors(channel, anchors) {
 
 // src/notify/server.ts
 import { createServer } from "http";
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 var NotifyServer = class {
   server;
   token;
@@ -15804,7 +15889,7 @@ function readBody(req) {
   });
 }
 function generateNotifyToken() {
-  return `dsh-lark-${randomBytes2(18).toString("hex")}`;
+  return `dsh-lark-${randomBytes3(18).toString("hex")}`;
 }
 
 // src/notify/ask-handler.ts
@@ -15996,7 +16081,7 @@ async function settleCancelledCard(deps, chatId, cardMessageId, options) {
 }
 
 // src/notify/approval-handler.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 init_tool_policy();
 function buildApprovalHandler(deps) {
   return async (payload, signal) => {
@@ -16039,7 +16124,7 @@ ${policyDenialText(denial)}
       return { ok: true, outcome: "rejected", denial };
     }
     if (payload.lowRisk) return { ok: true, outcome: "allowed-once" };
-    const id = `approval-${randomUUID10().replaceAll("-", "")}`;
+    const id = `approval-${randomUUID11().replaceAll("-", "")}`;
     const request = {
       id,
       ...payload.callId === void 0 ? {} : { callId: payload.callId },
@@ -16368,14 +16453,16 @@ var QqSink = class {
   type = "qq";
   async send(channel, message) {
     const [appId, clientSecret] = splitAppCredential(channel.secret);
-    const groupOpenId = channel.destination;
-    if (!appId || !clientSecret || !groupOpenId) {
+    const target = channel.destination;
+    if (!appId || !clientSecret || !target) {
       log.warn("sink:qq", "missing-credential", { channel: channel.id });
       return false;
     }
+    const isC2c = target.startsWith("user:");
+    const openId = isC2c ? target.slice("user:".length) : target;
+    const url = `${this.apiBase}/v2/${isC2c ? "users" : "groups"}/${encodeURIComponent(openId)}/messages`;
     try {
       const token = await this.fetchAccessToken(appId, clientSecret);
-      const url = `${this.apiBase}/v2/groups/${encodeURIComponent(groupOpenId)}/messages`;
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), 1e4);
       timer.unref?.();
@@ -17045,7 +17132,7 @@ function normalizeContextSnapshot(value) {
 
 // src/session/projection-store.ts
 import { readFile as readFile26 } from "fs/promises";
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 var MAX_RECENT_MESSAGES = 64;
 var MAX_PROMPT_CORRELATIONS = 64;
 var PROMPT_CORRELATION_TTL_MS = 24 * 60 * 6e4;
@@ -17112,7 +17199,7 @@ var SessionProjectionStore = class {
         recentMessages: currentOwner?.scope === input.scope && currentOwner.workspaceCwd === input.workspaceCwd ? structuredClone(currentOwner.recentMessages) : [],
         promptCorrelations: structuredClone(currentOwner?.promptCorrelations ?? []),
         boundAt: (/* @__PURE__ */ new Date()).toISOString(),
-        generationId: randomUUID11()
+        generationId: randomUUID12()
       };
       this.data.bindings[targetKey] = binding;
       return {
@@ -17269,7 +17356,7 @@ function normalizeCorrelation(value) {
 
 // src/session/archive.ts
 import { execFile as execFile2 } from "child_process";
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 import { access, mkdir as mkdir17, readdir as readdir3, readFile as readFile27, unlink, writeFile as writeFile8 } from "fs/promises";
 import { join as join24 } from "path";
 import { promisify } from "util";
@@ -17280,7 +17367,7 @@ function archiveScopeSlug(scope) {
 }
 function timestampId() {
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
-  return `${stamp}-${randomBytes3(3).toString("hex")}`;
+  return `${stamp}-${randomBytes4(3).toString("hex")}`;
 }
 function renderMarkdown(input, record) {
   const lines = [
@@ -17594,7 +17681,7 @@ async function safeRemove(path) {
 
 // src/workspace/git-worktree.ts
 import { execFile as execFile3 } from "child_process";
-import { createHash as createHash2, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes5 } from "crypto";
 import { access as access2, copyFile, mkdir as mkdir18, realpath as realpath2 } from "fs/promises";
 import { dirname as dirname16, join as join25 } from "path";
 import { promisify as promisify2 } from "util";
@@ -17655,7 +17742,7 @@ var GitWorktreeManager = class {
         return { cwd: target, created: false };
       }
     }
-    const branch = `dsh-lark/${slug}-${Date.now().toString(36)}-${randomBytes4(3).toString("hex")}`;
+    const branch = `dsh-lark/${slug}-${Date.now().toString(36)}-${randomBytes5(3).toString("hex")}`;
     await mkdir18(this.options.worktreesRoot, { recursive: true });
     await this.runGit(["worktree", "add", "-b", branch, target, "HEAD"], base);
     await this.ensureProjectRules(base, target);
@@ -18639,7 +18726,7 @@ function projectDiagnosticLogs(lines) {
 }
 
 // src/secret/registry.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 var SecretRequestRegistry = class {
   constructor(writer, options = {}) {
     this.writer = writer;
@@ -18652,7 +18739,7 @@ var SecretRequestRegistry = class {
   now;
   register(input) {
     this.writer.validate(input.target, input.reference);
-    const id = `secret-${randomUUID12().replaceAll("-", "")}`;
+    const id = `secret-${randomUUID13().replaceAll("-", "")}`;
     let resolve6;
     const promise = new Promise((settle) => {
       resolve6 = settle;
@@ -18802,7 +18889,7 @@ function buildSecretHandler(deps) {
 init_own_package();
 
 // src/guardian/update-handoff.ts
-import { createHash as createHash3, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID14 } from "crypto";
 import { spawn as spawn7 } from "child_process";
 import { chmod, mkdir as mkdir21, readFile as readFile32, rm as rm10 } from "fs/promises";
 import { dirname as dirname19, join as join26 } from "path";
@@ -18976,7 +19063,7 @@ var GuardianUpdateHandoff = class {
     this.options = options;
     this.launch = options.launch ?? defaultLaunch;
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-    this.id = options.id ?? randomUUID13;
+    this.id = options.id ?? randomUUID14;
   }
   options;
   launch;
@@ -19092,14 +19179,14 @@ var GuardianUpdateHandoff = class {
 };
 
 // src/upgrade/channel-update.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 var OFFER_TTL_MS = 10 * 6e4;
 var ChannelUpdateController = class {
   constructor(options) {
     this.options = options;
     this.current = options.current ?? currentVersion();
     this.probe = options.probe ?? (() => latestVersion({ cacheMs: 0 }));
-    this.id = options.id ?? randomUUID14;
+    this.id = options.id ?? randomUUID15;
     this.now = options.now ?? Date.now;
     this.ttl = options.offerTtlMs ?? OFFER_TTL_MS;
   }
@@ -19458,7 +19545,7 @@ async function startBridgeEngine(options) {
         ledgerClaimed = await claimJobDispatch({
           jobs,
           messageIds: ledgerMessageIds,
-          runId: `dispatch-${randomUUID15()}`,
+          runId: `dispatch-${randomUUID16()}`,
           first,
           channel: streaming
         });
@@ -20573,7 +20660,7 @@ ${changeLines.join("\n")}
 import { join as join33 } from "path";
 
 // src/guardian/service.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir21 } from "os";
 import { join as join32 } from "path";
@@ -21420,7 +21507,7 @@ var GuardianService = class {
     }
     const transcript = this.transcripts.get(scope) ?? [];
     const prompt = buildSafePrompt(transcript, msg.content);
-    const runId = randomUUID16();
+    const runId = randomUUID17();
     const density = this.options.safeDensity;
     const timeoutMs = this.options.safeTimeoutMs;
     const now = Date.now();