feihong-code 0.2.3 → 0.6.0

package/dist/web/auth.js

@@ -1,7 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionStore = exports.WELCOME_TASKS = void 0;
 exports.requireToken = requireToken;
 const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const os_1 = require("os");
+const secure_store_1 = require("../shared/secure-store");
 /** 计时安全的字符串比较，避免令牌逐字节泄露的计时攻击面 */
 function safeEqual(a, b) {
     const ab = Buffer.from(a);
@@ -10,16 +15,186 @@ function safeEqual(a, b) {
         return false;
     return (0, crypto_1.timingSafeEqual)(ab, bb);
 }
+/** 会话默认有效期：30 天 */
+const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** 引导任务列表：新用户首次登录时自动创建 */
+exports.WELCOME_TASKS = [
+    {
+        id: 'welcome-task-1',
+        goal: '请读取当前工作区的 package.json，告诉我其中的 name 与 version 字段值是什么？',
+        title: '探索工作区',
+        description: '了解如何读取文件信息',
+    },
+    {
+        id: 'welcome-task-2',
+        goal: '请列出当前目录下的文件和文件夹结构',
+        title: '查看目录结构',
+        description: '学习如何使用 ls 命令',
+    },
+    {
+        id: 'welcome-task-3',
+        goal: '请在当前目录创建一个名为 hello.txt 的文件，写入内容"Hello, 飞虹 Code!"',
+        title: '创建第一个文件',
+        description: '体验文件创建功能',
+    },
+];
+/** 会话落盘位置：$FH_HOME/web-sessions.json，缺省 ~/.feihong-code/web-sessions.json */
+function defaultSessionFile() {
+    const home = process.env.FH_HOME?.trim() || (0, path_1.join)((0, os_1.homedir)(), '.feihong-code');
+    return (0, path_1.join)(home, 'web-sessions.json');
+}
+/**
+ * 会话存储（内存 + 落盘）。
+ *
+ * 为什么要落盘：此前会话仅存在进程内 Map，服务一旦重启（升级、崩溃恢复、
+ * 改完前端重启）所有已登录令牌立即失效，前端轮询拿到 401 后会清 token 并
+ * 弹回登录页——表现为「用着突然自己跳回登录界面」。落盘后重启可续用会话。
+ *
+ * 安全：文件以 0600 权限写入，仅当前用户可读；超过 TTL 的会话在加载与写入时清理。
+ *
+ * 新特性：新用户首次登录自动创建引导任务。
+ */
+class SessionStore {
+    sessions = new Map();
+    file;
+    ttlMs;
+    constructor(opts) {
+        this.file = opts?.file ?? defaultSessionFile();
+        this.ttlMs = opts?.ttlMs ?? SESSION_TTL_MS;
+        this.load();
+    }
+    isExpired(s) {
+        const t = Date.parse(s.createdAt);
+        if (!Number.isFinite(t))
+            return true;
+        return Date.now() - t > this.ttlMs;
+    }
+    /** 从磁盘恢复会话；文件缺失或损坏时静默降级为空存储（fail-safe，不阻断启动） */
+    load() {
+        try {
+            if (!(0, fs_1.existsSync)(this.file))
+                return;
+            let raw = (0, fs_1.readFileSync)(this.file, 'utf8');
+            // 三重加密·存储层：会话文件 AES-256-GCM 加密（enc: 前缀），密钥变更时解密失败则视为空
+            if (raw.startsWith('enc:')) {
+                const key = (0, secure_store_1.getMasterKey)((0, path_1.dirname)(this.file));
+                raw = (0, secure_store_1.decryptText)(raw.slice(4), key);
+                if (!raw)
+                    return;
+            }
+            const parsed = JSON.parse(raw);
+            if (!Array.isArray(parsed))
+                return;
+            for (const item of parsed) {
+                const s = item;
+                if (!s || typeof s.token !== 'string' || typeof s.phone !== 'string')
+                    continue;
+                if (this.isExpired(s))
+                    continue;
+                this.sessions.set(s.token, s);
+            }
+        }
+        catch {
+            /* 损坏的会话文件不应影响服务启动 */
+        }
+    }
+    /** 写回磁盘，顺带剔除过期会话；文件 AES-256-GCM 加密，防磁盘窃取 */
+    persist() {
+        try {
+            for (const [token, s] of this.sessions) {
+                if (this.isExpired(s))
+                    this.sessions.delete(token);
+            }
+            (0, fs_1.mkdirSync)((0, path_1.dirname)(this.file), { recursive: true });
+            const key = (0, secure_store_1.getMasterKey)((0, path_1.dirname)(this.file));
+            const payload = 'enc:' + (0, secure_store_1.encryptText)(JSON.stringify([...this.sessions.values()]), key);
+            (0, fs_1.writeFileSync)(this.file, payload, { encoding: 'utf8', mode: 0o600 });
+        }
+        catch {
+            /* 落盘失败不影响本次登录，退化为进程内会话 */
+        }
+    }
+    /**
+     * 创建新会话。
+     * @param phone 手机号
+     * @returns 会话令牌
+     */
+    create(phone) {
+        const token = (0, crypto_1.randomBytes)(32).toString('hex');
+        const session = { phone, token, createdAt: new Date().toISOString() };
+        this.sessions.set(token, session);
+        this.persist();
+        return token;
+    }
+    /**
+     * 登录接口专用方法：检查是否首次登录并返回是否为新用户。
+     * @param phone 手机号
+     * @returns 登录结果，包含是否首次登录
+     */
+    login(phone) {
+        // 查找是否已有该手机号的活跃会话
+        for (const [token, session] of this.sessions) {
+            if (session.phone === phone) {
+                // 老用户登录，返回现有令牌
+                return { token, isFirstLogin: false };
+            }
+        }
+        // 新用户，创建新会话并标记首次登录
+        const newToken = this.create(phone);
+        // 更新标记为首次登录
+        const session = this.sessions.get(newToken);
+        if (session) {
+            session.isFirstLogin = true;
+            this.persist();
+        }
+        return { token: newToken, isFirstLogin: true };
+    }
+    has(token) {
+        const s = this.sessions.get(token);
+        if (!s)
+            return false;
+        if (this.isExpired(s)) {
+            this.sessions.delete(token);
+            this.persist();
+            return false;
+        }
+        return true;
+    }
+    get(token) {
+        return this.has(token) ? this.sessions.get(token) : undefined;
+    }
+    revoke(token) {
+        const ok = this.sessions.delete(token);
+        if (ok)
+            this.persist();
+        return ok;
+    }
+}
+exports.SessionStore = SessionStore;
 /** 返回 Express 中间件：校验 Authorization: Bearer <token> */
-function requireToken(token) {
+function requireToken(masterToken, sessions) {
     return (req, res, next) => {
         const header = req.header('authorization') || '';
         const m = /^Bearer\s+(.+)$/i.exec(header);
-        if (!m || !safeEqual(m[1], token)) {
+        if (!m) {
             res.status(401).json({ ok: false, error: 'unauthorized' });
             return;
         }
-        next();
+        const token = m[1];
+        if (safeEqual(token, masterToken)) {
+            next();
+            return;
+        }
+        if (sessions?.has(token)) {
+            const session = sessions.get(token);
+            if (session) {
+                // 通过索引签名附加用户信息，供 /api/auth/me 等后续接口读取
+                req.user = session;
+            }
+            next();
+            return;
+        }
+        res.status(401).json({ ok: false, error: 'unauthorized' });
     };
 }
 //# sourceMappingURL=auth.js.map

package/dist/web/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/web/auth.ts"],"names":[],"mappings":";;AAmBA,oCAUC;AArBD,mCAAyC;AAEzC,iCAAiC;AACjC,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,IAAA,wBAAe,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,sDAAsD;AACtD,SAAgB,YAAY,CAAC,KAAa;IACxC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/web/auth.ts"],"names":[],"mappings":";;;AAgMA,oCAwBC;AA7MD,mCAAsD;AACtD,2BAAwE;AACxE,+BAAqC;AACrC,2BAA6B;AAC7B,yDAAgF;AAEhF,iCAAiC;AACjC,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,IAAA,wBAAe,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAUD,mBAAmB;AACnB,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,0BAA0B;AACb,QAAA,aAAa,GAAG;IAC3B;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,sDAAsD;QAC5D,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,YAAY;KAC1B;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,cAAc;KAC5B;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,kDAAkD;QACxD,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,UAAU;KACxB;CACF,CAAC;AAEF,6EAA6E;AAC7E,SAAS,kBAAkB;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,eAAe,CAAC,CAAC;IAC7E,OAAO,IAAA,WAAI,EAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAa,YAAY;IACN,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IACtC,IAAI,CAAS;IACb,KAAK,CAAS;IAE/B,YAAY,IAAwC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,kBAAkB,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,cAAc,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,CAAU;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACrC,CAAC;IAED,gDAAgD;IACxC,IAAI;QACV,IAAI,CAAC;YACH,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YACnC,IAAI,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1C,sDAAsD;YACtD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,IAAA,2BAAY,EAAC,IAAA,cAAO,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7C,GAAG,GAAG,IAAA,0BAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,GAAG;oBAAE,OAAO;YACnB,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO;YACnC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,IAAe,CAAC;gBAC1B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBAC/E,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAED,4CAA4C;IACpC,OAAO;QACb,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrD,CAAC;YACD,IAAA,cAAS,EAAC,IAAA,cAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,IAAA,2BAAY,EAAC,IAAA,cAAO,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,GAAG,IAAA,0BAAW,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACvF,IAAA,kBAAa,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAa;QACjB,kBAAkB;QAClB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,eAAe;gBACf,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,YAAY;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,GAAG,CAAC,KAAa;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,EAAE;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AAlHD,oCAkHC;AAED,sDAAsD;AACtD,SAAgB,YAAY,CAAC,WAAmB,EAAE,QAAuB;IACvE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YAClC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,sCAAsC;gBACrC,GAAoC,CAAC,IAAI,GAAG,OAAO,CAAC;YACvD,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC"}

package/dist/web/channels.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageChannels = void 0;
+exports.telegramConfig = telegramConfig;
+exports.wecomKeys = wecomKeys;
+exports.allowedChannels = allowedChannels;
+exports.isChannelAllowed = isChannelAllowed;
+exports.verifyHmacSignature = verifyHmacSignature;
+exports.verifyWecomSignature = verifyWecomSignature;
+exports.formatTaskMessage = formatTaskMessage;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * P5-6/P6-O6 消息渠道（对齐 OpenClaw 的"多渠道消息接入"，此处作为调度通知出口）：
+ *  - Telegram 机器人：FH_CHANNEL_TELEGRAM_BOT_TOKEN + FH_CHANNEL_TELEGRAM_CHAT_ID
+ *  - 企业微信群机器人：FH_CHANNEL_WECOM_KEY（逗号分隔可多个）
+ *  - 任务状态变化时把紧凑消息推送到已启用渠道
+ * O6 安全前置：
+ *  - 出站白名单 FH_CHANNEL_ALLOW（逗号分隔，缺省全部放行；显式配置后仅白名单渠道可发）
+ *  - 入站签名校验工具（供 M3 入站 webhook 复用）：verifyHmacSignature（HMAC-SHA256）、
+ *    verifyWecomSignature（企微回调 SHA1 排序校验）
+ *
+ * 设计：
+ *  - 零依赖（全局 fetch + AbortController 超时），fire-and-forget 容错
+ *  - 未配置渠道 = 无操作（保持离线/内网无感）
+ *  - 文本消息统一由 formatTaskMessage 生成，渠道只负责投递
+ */
+const crypto_1 = require("crypto");
+const logger_1 = require("../shared/logger");
+/** 环境变量开关 */
+function telegramConfig() {
+    const token = process.env.FH_CHANNEL_TELEGRAM_BOT_TOKEN?.trim() || '';
+    const chatId = process.env.FH_CHANNEL_TELEGRAM_CHAT_ID?.trim() || '';
+    return token && chatId ? { token, chatId } : null;
+}
+function wecomKeys() {
+    return (process.env.FH_CHANNEL_WECOM_KEY || '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+/** O6：出站渠道白名单（FH_CHANNEL_ALLOW 逗号分隔；空 = 全部放行） */
+function allowedChannels() {
+    return (process.env.FH_CHANNEL_ALLOW || '')
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+}
+function isChannelAllowed(channel) {
+    const allow = allowedChannels();
+    if (allow.length === 0)
+        return true;
+    return allow.includes(channel.toLowerCase());
+}
+/**
+ * O6：HMAC-SHA256 签名校验（入站 webhook 防伪造）。
+ * 调用方约定签名头格式，如 `X-Fhcode-Signature: sha256=<hex>`。
+ */
+function verifyHmacSignature(secret, payload, signatureHex) {
+    if (!secret || !signatureHex)
+        return false;
+    const expected = (0, crypto_1.createHmac)('sha256', secret).update(payload).digest('hex');
+    const got = signatureHex.replace(/^sha256=/i, '').toLowerCase();
+    if (expected.length !== got.length)
+        return false;
+    try {
+        return (0, crypto_1.timingSafeEqual)(Buffer.from(expected, 'hex'), Buffer.from(got, 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * O6：企业微信回调签名校验（SHA1 排序拼接 token/timestamp/nonce/echoStr）。
+ * 按企微规范：signature = sha1(sort([token, timestamp, nonce, echoStr]).join(''))。
+ */
+function verifyWecomSignature(token, timestamp, nonce, echoStr, signature) {
+    if (!token || !signature)
+        return false;
+    const sorted = [token, timestamp, nonce, echoStr].sort().join('');
+    const expected = (0, crypto_1.createHash)('sha1').update(sorted).digest('hex');
+    if (expected.length !== signature.length)
+        return false;
+    try {
+        return (0, crypto_1.timingSafeEqual)(Buffer.from(expected, 'hex'), Buffer.from(signature.toLowerCase(), 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+/** 生成任务状态通知文本（渠道无关） */
+function formatTaskMessage(record, status) {
+    const emoji = { queued: '🕐', running: '⚙️', done: '✅', failed: '❌' };
+    const r = record.result;
+    const lines = [
+        `${emoji[status] ?? 'ℹ️'} [fhcode] 任务状态: ${status}`,
+        `📋 目标: ${record.goal.slice(0, 120)}`,
+        `🆔 任务: ${record.id.slice(0, 8)}`,
+    ];
+    if (r) {
+        lines.push(`⚙️ 迭代: ${r.iterations} · 成本: $${r.costUsd.toFixed(6)}`);
+    }
+    if (record.error)
+        lines.push(`⚠️ 错误: ${record.error.slice(0, 200)}`);
+    return lines.join('\n');
+}
+async function postJson(url, body, timeoutMs = 10000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** 消息渠道聚合器：按环境变量启用 Telegram / 企业微信，投递失败仅告警 */
+class MessageChannels {
+    /** 是否配置了任何渠道 */
+    get enabled() {
+        return !!telegramConfig() || wecomKeys().length > 0;
+    }
+    /** 向所有已启用渠道推送任务状态（受 FH_CHANNEL_ALLOW 白名单约束） */
+    async notify(record, status) {
+        if (!this.enabled)
+            return;
+        const text = formatTaskMessage(record, status);
+        const tg = telegramConfig();
+        if (tg && isChannelAllowed('telegram')) {
+            await this.safe('telegram', async () => {
+                await postJson(`https://api.telegram.org/bot${tg.token}/sendMessage`, {
+                    chat_id: tg.chatId,
+                    text,
+                });
+            });
+        }
+        const keys = wecomKeys();
+        for (const key of keys) {
+            if (!isChannelAllowed('wecom'))
+                break;
+            await this.safe('wecom', async () => {
+                await postJson(`https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=${key}`, {
+                    msgtype: 'text',
+                    text: { content: text },
+                });
+            });
+        }
+    }
+    /** 单渠道投递容错 */
+    async safe(name, fn) {
+        try {
+            await fn();
+        }
+        catch (e) {
+            logger_1.logger.warn('message channel delivery failed', {
+                channel: name,
+                error: e instanceof Error ? e.message : String(e),
+            });
+        }
+    }
+}
+exports.MessageChannels = MessageChannels;
+//# sourceMappingURL=channels.js.map

package/dist/web/channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../src/web/channels.ts"],"names":[],"mappings":";;;AAuBA,wCAIC;AAED,8BAKC;AAGD,0CAKC;AAED,4CAIC;AAMD,kDAUC;AAMD,oDAUC;AAGD,8CAaC;AAhGD;;;;;;;;;;;;;;;;;GAiBG;AACH,mCAAiE;AACjE,6CAA0C;AAG1C,aAAa;AACb,SAAgB,cAAc;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,SAAgB,SAAS;IACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;SAC5C,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,iDAAiD;AACjD,SAAgB,eAAe;IAC7B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACxC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAc,EAAE,OAAwB,EAAE,YAAqB;IACjG,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,KAAa,EAAE,SAAiB,EAAE,KAAa,EAAE,OAAe,EAAE,SAAiB;IACtH,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uBAAuB;AACvB,SAAgB,iBAAiB,CAAC,MAAkB,EAAE,MAAc;IAClE,MAAM,KAAK,GAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC9F,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,mBAAmB,MAAM,EAAE;QACnD,UAAU,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;QACrC,UAAU,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;KAClC,CAAC;IACF,IAAI,CAAC,EAAE,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,WAAW,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,IAAa,EAAE,SAAS,GAAG,KAAK;IACnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,8CAA8C;AAC9C,MAAa,eAAe;IAC1B,gBAAgB;IAChB,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,cAAc,EAAE,IAAI,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,MAAM,CAAC,MAAkB,EAAE,MAAc;QAC7C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE/C,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QAC5B,IAAI,EAAE,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrC,MAAM,QAAQ,CAAC,+BAA+B,EAAE,CAAC,KAAK,cAAc,EAAE;oBACpE,OAAO,EAAE,EAAE,CAAC,MAAM;oBAClB,IAAI;iBACL,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;gBAAE,MAAM;YACtC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,QAAQ,CAAC,wDAAwD,GAAG,EAAE,EAAE;oBAC5E,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,cAAc;IACN,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,EAAuB;QACtD,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,eAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC7C,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AA5CD,0CA4CC"}