karin-plugin-kkk 2.45.1-beta.3 → 2.45.1-beta.4

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 # Changelog
 
+## [2.45.1-beta.4](https://github.com/ikenxuan/karin-plugin-kkk/compare/v2.45.1-beta.3...v2.45.1-beta.4) (2026-10-17)
+
+
+### 🧰 其他更新
+
+* 添加风控验证处理逻辑，支持失败重放与动态导入 ([ba32b48](https://github.com/ikenxuan/karin-plugin-kkk/commit/ba32b48aa3f79225439522756cc9e702543420d6))
+
 ## [2.45.1-beta.3](https://github.com/ikenxuan/karin-plugin-kkk/compare/v2.45.1-beta.2...v2.45.1-beta.3) (2026-10-16)
 
 

package/lib/build-metadata.json

@@ -1,10 +1,10 @@
 {
-  "version": "2.45.1-beta.3",
-  "buildTime": "2026-10-16T15:33:36.385Z",
-  "buildTimestamp": 1792164816385,
+  "version": "2.45.1-beta.4",
+  "buildTime": "2026-10-16T18:08:24.609Z",
+  "buildTimestamp": 1792174104609,
   "name": "karin-plugin-kkk",
   "description": "Karin 的「抖音」「B 站」视频解析/动态推送插件",
   "homepage": "https://github.com/ikenxuan/karin-plugin-kkk",
-  "commitHash": "96f2fb735c6a9a7f1d15d6fac453ba4851b2f918",
-  "shortCommitHash": "96f2fb73"
+  "commitHash": "0a9385f0228e74edb394719ef42ccf11b8b4d5fa",
+  "shortCommitHash": "0a9385f0"
 }

package/lib/core_chunk/RiskVerify.js

@@ -0,0 +1,3 @@
+globalThis.__KTR_BUNDLED__ = true;
+import { N as handleRiskChallenge } from "./main.js";
+export { handleRiskChallenge };

package/lib/core_chunk/amagiClient.js

@@ -1,3 +1,3 @@
 globalThis.__KTR_BUNDLED__ = true;
-import { nt as reloadAmagiConfig } from "./main.js";
+import { it as reloadAmagiConfig } from "./main.js";
 export { reloadAmagiConfig };

package/lib/core_chunk/db.js

@@ -1,3 +1,3 @@
 globalThis.__KTR_BUNDLED__ = true;
-import { R as getBilibiliDB, z as getDouyinDB } from "./main.js";
+import { B as getBilibiliDB, V as getDouyinDB } from "./main.js";
 export { getBilibiliDB, getDouyinDB };

package/lib/core_chunk/main.js

@@ -19,6 +19,7 @@ import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import _ from "node-karin/lodash";
 import util from "node:util";
+import { AsyncLocalStorage } from "node:async_hooks";
 import os from "node:os";
 //#region src/index.ts
 globalThis.__kkkLoadStart ??= process.hrtime.bigint();
@@ -461,20 +462,58 @@ var isFailureEnvelope = (value) => {
 /** 判断是不是 thenable，用来只包装异步方法 */
 var isThenable = (value) => !!value && (typeof value === "object" || typeof value === "function") && typeof value.then === "function";
 /**
+* 把一次 fetcher 调用的结果收口：成功原样返回，失败信封先给 RiskVerify 一次「发码并轮询」的机会。
+*
+* `handleRiskChallenge` 对不带 `challenge.url` 的失败会立刻返回 false（是不是风控由它判定），
+* 所以这里不用先判。过码成功后按它的契约**再重放一次**原调用，这次的返回值就是结果；
+* 没放行（超时 / 没有消息上下文 / 达并发上限）则把原错误抛出去。
+*
+* RiskVerify 用**动态 import** 取，不能提成顶层静态 import：它的链上有
+* `Render → @/module（barrel）→ ./utils → Base → amagiClient`，静态边会让「先加载 amagiClient」
+* 的模块求值顺序撞上 `Base extends AmagiBase` 的 TDZ（dev 下必崩），本文件与 Base 之间就成环了。
+* 挪到运行期后，这条边只在失败路径、模块图就绪之后才走。
+* @param returned - 原调用的返回值（已排除同步方法）
+* @param platform - 平台名，RiskVerify 用它做去重键与提示文案
+* @param call - 原调用的重放：同一方法、同一参数、同一份 CK
+*/
+var settleFailure = async (returned, platform, call) => {
+	const result = await returned;
+	if (!isFailureEnvelope(result)) return result;
+	const failure = new AmagiError(result);
+	const { handleRiskChallenge } = await import("./RiskVerify.js");
+	if (!await handleRiskChallenge(failure, platform, () => probeReplay(call))) throw failure;
+	const replayed = await call();
+	if (isFailureEnvelope(replayed)) throw new AmagiError(replayed);
+	return replayed;
+};
+/**
+* 给 RiskVerify 轮询用的重放探针。
+*
+* 判定权在它那边：true = 已放行；仍被同一类风控拦住返回 false（继续等）；
+* 冒出其它失败就抛，RiskVerify 据此停止等待、把错误交回原调用方处理。
+*/
+var probeReplay = async (call) => {
+	const result = await call();
+	if (!isFailureEnvelope(result)) return true;
+	if (result.error.challenge?.url) return false;
+	throw new AmagiError(result);
+};
+/**
 * 递归代理一个 fetcher 对象，把失败信封转成 `throw AmagiError`。返回类型与入参同形 ——
 * 「只保留成功分支」是**类型层**由 {@link ThrowingClient} 声明的，这里只管运行时行为。
+*
+* 带风控挑战的失败不直接抛：先交给 `RiskVerify` 走完整条验证流程（发二维码给主人 → 轮询重放），
+* 过码成功就重放拿正常结果，没成功再把原错误抛出去 —— 见 {@link settleFailure}。
 */
-var throwOnFailure = (target) => new Proxy(target, { get(obj, prop) {
+var throwOnFailure = (target, platform) => new Proxy(target, { get(obj, prop) {
 	const value = obj[prop];
 	if (typeof value === "function") return (...args) => {
-		const returned = value.apply(obj, args);
+		const call = () => value.apply(obj, args);
+		const returned = call();
 		if (!isThenable(returned)) return returned;
-		return returned.then((result) => {
-			if (isFailureEnvelope(result)) throw new AmagiError(result);
-			return result;
-		});
+		return settleFailure(returned, platform, call);
 	};
-	if (value && typeof value === "object" && !Array.isArray(value)) return throwOnFailure(value);
+	if (value && typeof value === "object" && !Array.isArray(value)) return throwOnFailure(value, platform);
 	return value;
 } });
 /** 解析库基类 */
@@ -534,19 +573,19 @@ var AmagiBase = class {
 		...client,
 		bilibili: {
 			...client.bilibili,
-			fetcher: throwOnFailure(client.bilibili.fetcher)
+			fetcher: throwOnFailure(client.bilibili.fetcher, "bilibili")
 		},
 		douyin: {
 			...client.douyin,
-			fetcher: throwOnFailure(client.douyin.fetcher)
+			fetcher: throwOnFailure(client.douyin.fetcher, "douyin")
 		},
 		kuaishou: {
 			...client.kuaishou,
-			fetcher: throwOnFailure(client.kuaishou.fetcher)
+			fetcher: throwOnFailure(client.kuaishou.fetcher, "kuaishou")
 		},
 		xiaohongshu: {
 			...client.xiaohongshu,
-			fetcher: throwOnFailure(client.xiaohongshu.fetcher)
+			fetcher: throwOnFailure(client.xiaohongshu.fetcher, "xiaohongshu")
 		}
 	});
 };
@@ -29947,6 +29986,159 @@ var buildErrorPrefix = async (ctx, isPush, botId) => {
 	return `群：${(await karin.getBot(botId)?.getGroupInfo(groupId))?.groupName || "未知"}(${groupId})\n${options.businessName} 任务执行出错\n请尽快解决以消除警告`;
 };
 //#endregion
+//#region src/module/utils/RiskVerify/index.ts
+/**
+* 风控验证（人机验证）自动监听。
+*
+* ## 立场
+*
+* 过码的人是**主人**（CK 所有者），不是触发解析的群友 —— 风控绑的是机器人这份 CK 的会话，
+* 只有账号主人能在自己手机上过码。群友全程不参与、也不用回复任何消息。
+*
+* ## 判定靠轮询，不靠用户回执
+*
+* 平台没有「过码完成」的推送通道，验证是服务端按 `fp`（抖音）/`did`（快手）/`verifyUuid`
+* （小红书）解除的。所以过码完成的唯一可观测信号是：**用同一份 CK、同一组参数重放原请求，
+* 它不再被拦** —— 这就是 amagi 文档里那句「过完由调用方用同一份 CK 重发」的自然实现。
+*
+* ## 撤回预算（硬约束）
+*
+* 消息撤回窗口 120s，本模块的决策线是 {@link VERIFY_WINDOW_MS} = 110s，留 10s 给网络与
+* 程序时延。**超过决策线一律不再尝试撤回**（必然失败），改为补一条状态说明。
+*
+* ## AsyncLocalStorage 的纪律（本仓首例，照做）
+*
+* - 只用 `run()`，**绝不用 `enterWith()`** —— 后者会污染不相关的后续任务。
+* - store 里只放渲染/投递要用的几个字段，**不放整个 `e`**：这样即使一条流程挂满 110s，
+*   被钉住的也只有几百字节（handler 的闭包本来就持有 `e`，ALS 不额外延长它的生命周期）。
+* - 本模块是唯一的模块级状态（{@link pending}），条目在 `finally` 里清理，且**有硬上限**。
+*/
+/** 一条验证流程的时间窗：撤回窗口 120s − 10s 余量 */
+var VERIFY_WINDOW_MS = 11e4;
+/** 重放间隔 */
+var POLL_INTERVAL_MS = 1e4;
+/** 超时后的冷却窗：这段时间内再撞风控不再发图（防刷屏） */
+var COOLDOWN_MS = 6e4;
+/** pending 表硬上限：极端高频时直接放弃自动验证，抛原错误 */
+var MAX_PENDING = 8;
+var storage = new AsyncLocalStorage();
+/** 在命令入口包一层，把渲染上下文带进这条异步链 */
+var runWithVerifyContext = (event, fn) => storage.run({ event }, fn);
+/** 当前是否处于某个消息处理链里（定时推送等场景为空） */
+var currentContext = () => storage.getStore();
+var pending = /* @__PURE__ */ new Map();
+var cooldownUntil = 0;
+/** challenge 的稳定键：平台 + 票据/地址，用于并发去重 */
+var keyOf = (platform, url, session) => `${platform}:${session ?? ""}:${url}`;
+/**
+* 把验证页渲染成图片：有渲染上下文走模板（视觉优先），没有就退回纯二维码。
+* @param platform - 平台名（用于模板标签）
+* @param url - 平台官方验证页地址
+* @param context - ALS 里的渲染上下文，可能为空（定时推送）
+* @returns 可直接发送的图片消息段
+*/
+var renderVerifyImage = async (platform, url, context) => {
+	if (context) try {
+		const images = await Render(context.event, "other/verifyQr", {
+			share_url: url,
+			platform,
+			expiresHint: "请在 2 分钟内完成"
+		});
+		if (images.length > 0) return images;
+	} catch (error) {
+		logger$1.warn(`[风控验证] 模板渲染失败，退回纯二维码: ${error}`);
+	}
+	return [segment.image(generateQRCode(url, false))];
+};
+/**
+* 私聊主人：验证二维码 + 说明。主人不在配置里时不发，直接返回 false。
+* @param platform - 平台名
+* @param url - 验证页地址
+* @returns 是否成功送达
+*/
+var notifyMaster = async (platform, url) => {
+	const context = currentContext();
+	if (!context) {
+		logger$1.warn(`[风控验证] ${platform} 需要人机验证，但当前调用没有消息上下文，无法通知主人`);
+		return false;
+	}
+	const images = await renderVerifyImage(platform, url, context);
+	const target = await resolveSingleMasterTarget(context.event, false);
+	if (!target) {
+		logger$1.warn(`[风控验证] ${platform} 需要人机验证，但没有可用的主人私聊目标`);
+		return false;
+	}
+	await karin$1.sendMaster(target.botId, target.master, [segment.text(`【${platform}】需要一次人机验证\n请用手机扫码，在打开的官方页面里完成验证。
+完成后不需要回复：我会自动检测到并继续刚才的解析。
+超过 ${VERIFY_WINDOW_MS / 1e3} 秒未完成会自动放弃，可稍后重新触发。`), ...images]);
+	return true;
+};
+/**
+* 跑一条验证流程：发图 → 每 {@link POLL_INTERVAL_MS} 重放一次 → 成功即收口。
+* @param key - 去重键
+* @param platform - 平台名
+* @param url - 验证页地址
+* @param replay - 用同一份 CK 重放原调用，返回 true 表示已放行
+* @returns 是否在决策线内过码成功
+*/
+var runVerify = async (key, platform, url, replay) => {
+	const deadline = Date.now() + VERIFY_WINDOW_MS;
+	const notified = await notifyMaster(platform, url);
+	while (Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+		try {
+			if (await replay()) {
+				logger$1.mark(`[风控验证] ${platform} 已放行（${key}）`);
+				return true;
+			}
+		} catch (error) {
+			logger$1.debug(`[风控验证] ${platform} 重放返回其它错误，停止等待: ${error}`);
+			return false;
+		}
+	}
+	cooldownUntil = Date.now() + COOLDOWN_MS;
+	logger$1.warn(`[风控验证] ${platform} 在 ${VERIFY_WINDOW_MS / 1e3}s 内未完成${notified ? "（已通知主人）" : ""}`);
+	return false;
+};
+/**
+* 判断这个错误是不是「可交给主人过码」的风控，并在需要时跑完整条验证流程。
+*
+* 调用方（amagiClient 的失败代理）拿到 `false` 就照原样抛出原错误；
+* 拿到 `true` 说明已经放行，**重放一次原调用即可拿到正常结果**。
+* @param error - 代理捕获到的 AmagiError
+* @param platform - 平台名
+* @param replay - 重放原调用（同一方法、同一参数、同一份 CK）
+* @returns 是否已放行
+*/
+var handleRiskChallenge = async (error, platform, replay) => {
+	const url = error.rawError?.challenge?.url;
+	if (!url) return false;
+	if (!currentContext()) return false;
+	if (pending.size >= MAX_PENDING) {
+		logger$1.warn(`[风控验证] 进行中的验证已达上限 ${MAX_PENDING}，本次不做自动验证`);
+		return false;
+	}
+	if (Date.now() < cooldownUntil) {
+		logger$1.debug(`[风控验证] ${platform} 处于冷却窗内，跳过`);
+		return false;
+	}
+	const key = keyOf(platform, url, error.rawError?.challenge?.session);
+	const existing = pending.get(key);
+	if (existing) {
+		existing.joined += 1;
+		return existing.settled;
+	}
+	const entry = {
+		joined: 1,
+		settled: Promise.resolve(false)
+	};
+	entry.settled = runVerify(key, platform, url, replay).finally(() => {
+		pending.delete(key);
+	});
+	pending.set(key, entry);
+	return entry.settled;
+};
+//#endregion
 //#region src/module/utils/ErrorHandler/handler.ts
 var handleBusinessError = async (error, options, logs, event) => {
 	try {
@@ -29991,7 +30183,8 @@ var wrapWithErrorHandler = (fn, options) => {
 				emojiManager.add("PROCESSING").catch(() => {});
 			}, 1500);
 		}
-		const ctx = logger$1.runContext(async () => fn(normalizedEvent, normalizedNext));
+		const runHandler = () => fn(normalizedEvent, normalizedNext);
+		const ctx = logger$1.runContext(async () => rawEvent ? runWithVerifyContext(rawEvent, runHandler) : runHandler());
 		try {
 			const result = await ctx.run();
 			if (emojiManager) successTimer = setTimeout(() => {
@@ -42907,4 +43100,4 @@ mkdirSync(`${karinPathBase}/${Root.pluginName}/data`);
 mkdirSync(Common.tempDri.images);
 mkdirSync(Common.tempDri.video);
 //#endregion
-export { isSoftFailure as $, task as A, getStatisticsDB as B, help as C, dylogin as D, biRefreshLogin as E, bilibiliDBInstance as F, DouyinDBBase as G, METRIC_BUCKETS as H, cleanOldDynamicCache as I, AmagiError as J, BilibiliDBBase as K, douyinDBInstance as L, xhsLogin as M, templates as N, ksLogin as O, webConfig as P, getAmagiClient as Q, getBilibiliDB as R, changelog as S, biLogin as T, StatisticsDBBase as U, initAllDatabases as V, resolveMetricBucket as W, bilibiliFetcher as X, SOFT_ERROR_CODES as Y, douyinFetcher as Z, douyinPushList as _, bilibiliAPP as a, Root as at, setbiliPush as b, prefix as c, globalStatistics as d, kuaishouFetcher as et, groupStatistics as f, douyinPush as g, bilibiliPushList as h, update as i, xiaohongshuFetcher as it, testWrapWithErrorHandler as j, removeOldFiles as k, xiaohongshuAPP as l, bilibiliPush as m, kkkUpdateCommand as n, reloadAmagiConfig as nt, douyinAPP as o, qrLogin as p, AmagiBase as q, kkkUpdateTest as r, softFetch as rt, kuaishouAPP as s, kkkUpdate as t, registerAmagiReloadListener as tt, testPush as u, forcePush as v, version as w, setdyPush as x, globalIgnore as y, getDouyinDB as z };
+export { douyinFetcher as $, task as A, getBilibiliDB as B, help as C, dylogin as D, biRefreshLogin as E, templates as F, StatisticsDBBase as G, getStatisticsDB as H, webConfig as I, BilibiliDBBase as J, resolveMetricBucket as K, bilibiliDBInstance as L, xhsLogin as M, handleRiskChallenge as N, ksLogin as O, runWithVerifyContext as P, bilibiliFetcher as Q, cleanOldDynamicCache as R, changelog as S, biLogin as T, initAllDatabases as U, getDouyinDB as V, METRIC_BUCKETS as W, AmagiError as X, AmagiBase as Y, SOFT_ERROR_CODES as Z, douyinPushList as _, bilibiliAPP as a, softFetch as at, setbiliPush as b, prefix as c, globalStatistics as d, getAmagiClient as et, groupStatistics as f, douyinPush as g, bilibiliPushList as h, update as i, reloadAmagiConfig as it, testWrapWithErrorHandler as j, removeOldFiles as k, xiaohongshuAPP as l, bilibiliPush as m, kkkUpdateCommand as n, kuaishouFetcher as nt, douyinAPP as o, xiaohongshuFetcher as ot, qrLogin as p, DouyinDBBase as q, kkkUpdateTest as r, registerAmagiReloadListener as rt, kuaishouAPP as s, Root as st, kkkUpdate as t, isSoftFailure as tt, testPush as u, forcePush as v, version as w, setdyPush as x, globalIgnore as y, douyinDBInstance as z };

package/lib/root.js

@@ -1,3 +1,3 @@
 globalThis.__KTR_BUNDLED__ = true;
-import { at as Root } from "./core_chunk/main.js";
+import { st as Root } from "./core_chunk/main.js";
 export { Root };

package/lib/template-registry.js

@@ -1,3 +1,3 @@
 globalThis.__KTR_BUNDLED__ = true;
-import { N as templates } from "./core_chunk/main.js";
+import { F as templates } from "./core_chunk/main.js";
 export { templates };

package/lib/web.config.js

@@ -1,3 +1,3 @@
 globalThis.__KTR_BUNDLED__ = true;
-import { P as webConfig } from "./core_chunk/main.js";
+import { I as webConfig } from "./core_chunk/main.js";
 export { webConfig as default, webConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karin-plugin-kkk",
-  "version": "2.45.1-beta.3",
+  "version": "2.45.1-beta.4",
   "description": "Karin 的「抖音」「B 站」视频解析/动态推送插件",
   "keywords": [
     "karin",
@@ -83,7 +83,7 @@
     "@lobehub/webfont-harmony-sans-sc": "^1.0.0",
     "emoji-datasource-apple": "16.0.0"
   },
-  "timestamp": "2026-10-16T15:32:45.381Z",
+  "timestamp": "2026-10-16T18:07:33.612Z",
   "engines": {
     "node": ">=18.0.0"
   }