luckytri 1.2.3 → 1.3.0

package/server/plugins/zip.js

@@ -27,7 +27,19 @@ function safeName(name) {
 
 // Reads a zip the way a stranger's file has to be read: only stored and
 // deflate entries, no encryption, no links, no paths that leave the folder.
-export function readZip(buffer) {
+//
+// Options let another caller (the sticker library) take larger archives:
+// maxFiles / maxBytes bound the whole archive; keep(name) skips an entry
+// without inflating it; an entry over maxEntryBytes is reported, not read.
+export function readZip(
+  buffer,
+  {
+    maxFiles = MAX_FILES,
+    maxBytes = MAX_BYTES,
+    maxEntryBytes = Infinity,
+    keep = () => true,
+  } = {},
+) {
   if (!Buffer.isBuffer(buffer) || buffer.length < 22)
     throw new Error("压缩包无法读取");
   const eocd = findEocd(buffer);
@@ -35,7 +47,7 @@ export function readZip(buffer) {
   if (buffer.readUInt16LE(eocd + 4) !== 0)
     throw new Error("压缩包格式不受支持");
   const entries = buffer.readUInt16LE(eocd + 10);
-  if (!entries || entries > MAX_FILES) throw new Error("压缩包文件过多");
+  if (!entries || entries > maxFiles) throw new Error("压缩包文件过多");
   let offset = buffer.readUInt32LE(eocd + 16);
   if (offset >= buffer.length) throw new Error("压缩包无法读取");
   const files = [];
@@ -68,6 +80,11 @@ export function readZip(buffer) {
     if (method !== 0 && method !== 8) throw new Error("压缩包格式不受支持");
     if (name.endsWith("/") || name.endsWith("\\")) continue;
     const fileName = safeName(name);
+    if (!keep(fileName)) continue;
+    if (size > maxEntryBytes) {
+      files.push({ name: fileName, skipped: "too-large" });
+      continue;
+    }
     if (buffer.readUInt32LE(local) !== 0x04034b50)
       throw new Error("压缩包无法读取");
     const dataAt =
@@ -84,16 +101,27 @@ export function readZip(buffer) {
         method === 0
           ? Buffer.from(compressed)
           : inflateRawSync(compressed, {
-              maxOutputLength: MAX_BYTES - total + 1,
+              maxOutputLength: Math.min(maxBytes - total, maxEntryBytes) + 1,
             });
     } catch (error) {
+      if (
+        error?.code === "ERR_BUFFER_TOO_LARGE" &&
+        maxEntryBytes < maxBytes - total
+      ) {
+        files.push({ name: fileName, skipped: "too-large" });
+        continue;
+      }
       if (error?.code === "ERR_BUFFER_TOO_LARGE")
         throw new Error("压缩包解压后过大");
       throw new Error("压缩包无法读取");
     }
     if (size && bytes.length !== size) throw new Error("压缩包内容不完整");
+    if (bytes.length > maxEntryBytes) {
+      files.push({ name: fileName, skipped: "too-large" });
+      continue;
+    }
     total += bytes.length;
-    if (total > MAX_BYTES) throw new Error("压缩包解压后过大");
+    if (total > maxBytes) throw new Error("压缩包解压后过大");
     files.push({ name: fileName, bytes });
   }
   return files;

package/server/stickers/api.js

@@ -1,11 +1,28 @@
 import express from "express";
+import { createWriteStream, readdirSync, rmSync, statSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { importStickerZipFile, stickerZipLimitMb } from "./zip-import.js";
+import { stickerMaxMb } from "./library.js";
 
 // The owner's sticker library. Uploads arrive as raw bytes, one file per
 // request; everything else is JSON like the rest of the studio API.
 export function mountStickerUpload(app, system) {
+  // An upload cut off by a crash or restart leaves its temporary archive;
+  // anything older than an hour is from a run that is gone.
+  for (const name of readdirSync(tmpdir()))
+    if (/^luckytri-stickers-[\w-]+\.zip$/.test(name))
+      try {
+        const path = join(tmpdir(), name);
+        if (Date.now() - statSync(path).mtimeMs > 3600000) rmSync(path);
+      } catch {
+        /* Already gone or not ours to remove. */
+      }
   app.post(
     "/api/core/stickers/upload",
-    express.raw({ type: "*/*", limit: "3mb" }),
+    express.raw({ type: "*/*", limit: `${Math.ceil(stickerMaxMb()) + 1}mb` }),
     async (req, res) => {
       try {
         const item = await system.stickers.library.add(req.body, {
@@ -19,10 +36,79 @@ export function mountStickerUpload(app, system) {
       }
     },
   );
+  // A big archive is streamed to a temporary file and imported entry by
+  // entry; ?job=<id> lets the studio follow the progress.
+  app.get("/api/core/stickers/upload-zip/progress", (req, res) => {
+    res.json(zipJobs.get(String(req.query.job || "")) || { phase: "unknown" });
+  });
+  app.post("/api/core/stickers/upload-zip", async (req, res) => {
+    const job = String(req.query.job || randomUUID()).slice(0, 64);
+    const limit = stickerZipLimitMb() * 1024 * 1024;
+    const declared = Number(req.headers["content-length"] || 0);
+    const state = {
+      phase: "receiving",
+      received: 0,
+      size: declared,
+      done: 0,
+      total: 0,
+    };
+    zipJobs.set(job, state);
+    const path = join(tmpdir(), `luckytri-stickers-${randomUUID()}.zip`);
+    const forget = () =>
+      setTimeout(() => zipJobs.delete(job), 10 * 60000).unref?.();
+    try {
+      if (declared > limit)
+        throw Object.assign(Error("压缩包过大"), { status: 413 });
+      await new Promise((resolve, reject) => {
+        const out = createWriteStream(path);
+        let failed = false;
+        const fail = (error) => {
+          if (failed) return;
+          failed = true;
+          out.destroy();
+          req.unpipe?.(out);
+          req.resume();
+          reject(error);
+        };
+        req.on("data", (chunk) => {
+          state.received += chunk.length;
+          if (state.received > limit)
+            fail(Object.assign(Error("压缩包过大"), { status: 413 }));
+        });
+        req.on("error", fail);
+        req.on("aborted", () => fail(Error("上传中断")));
+        out.on("error", fail);
+        out.on("finish", () => !failed && resolve());
+        req.pipe(out);
+      });
+      if (!state.received) throw Error("文件为空");
+      state.phase = "importing";
+      const summary = await importStickerZipFile(
+        system.stickers.library,
+        path,
+        {
+          category: String(req.query.category || ""),
+          folderCategory: req.query.folderCategory === "1",
+          queue: (id) => queueDescribe(system, id),
+          progress: ({ done, total }) => Object.assign(state, { done, total }),
+        },
+      );
+      Object.assign(state, { phase: "done", summary });
+      res.json(summary);
+    } catch (error) {
+      Object.assign(state, { phase: "failed", error: error.message });
+      res.status(error.status || 400).json({ error: error.message });
+    } finally {
+      forget();
+      await rm(path, { force: true }).catch(() => {});
+    }
+  });
 }
 
+const zipJobs = new Map();
 const queue = [];
 let running = false;
+let current = null; // the one being analysed right now still counts as pending
 function queueDescribe(system, id) {
   queue.push(id);
   if (running) return;
@@ -30,12 +116,14 @@ function queueDescribe(system, id) {
   (async () => {
     while (queue.length) {
       const next = queue.shift();
+      current = next;
       try {
         await system.stickers.describe(next, { force: true });
       } catch {
         // The item records its own failure; the owner can retry.
       }
     }
+    current = null;
     running = false;
   })();
 }
@@ -68,7 +156,7 @@ export function mountStickers(app, system) {
         }),
         categories: library.categories(),
         settings: system.stickers.settings(),
-        pending: queue.length,
+        pending: queue.length + (current ? 1 : 0),
       }),
     ),
   );

package/server/stickers/library.js

@@ -3,7 +3,13 @@ import sharp from "sharp";
 import { imageMime } from "../core/image-preprocessor.js";
 import { ensureStickerSchema } from "./schema.js";
 
-export const STICKER_MAX_BYTES = 2 * 1024 * 1024;
+// One sticker, whether uploaded alone or inside an archive. 4 MB by default
+// (round 24); STICKER_MAX_MB overrides it, up to 20 MB.
+export function stickerMaxMb(env = process.env) {
+  const n = Number(env.STICKER_MAX_MB);
+  return Number.isFinite(n) && n > 0 ? Math.min(n, 20) : 4;
+}
+export const STICKER_MAX_BYTES = Math.round(stickerMaxMb() * 1024 * 1024);
 const ALLOWED = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
 const clip = (value, n) =>
   String(value ?? "")
@@ -39,7 +45,7 @@ export class StickerLibrary {
   async add(bytes, { name = "", category = "" } = {}) {
     if (!Buffer.isBuffer(bytes) || !bytes.length) throw Error("文件为空");
     if (bytes.length > STICKER_MAX_BYTES)
-      throw Error("表情超过 2MB，请压缩后再上传");
+      throw Error("表情超过单张大小上限，请压缩后再上传");
     const mime = imageMime(bytes);
     if (!ALLOWED.has(mime)) throw Error("只支持 PNG、JPEG、GIF、WebP 图片");
     let meta;

package/server/stickers/offer.js

@@ -1,3 +1,4 @@
+import { actionNote } from "../actions/index.js";
 import { isGroupSession, parseSessionKey } from "../channels/session-key.js";
 
 // Only OneBot can carry an @ segment or a sticker image.
@@ -78,7 +79,8 @@ export function chosenSticker(raw, snapshot) {
 export function expressionInput(snapshot) {
   const stickers = snapshot.stickers || [];
   const canAt = snapshot.canAt || [];
-  if (!stickers.length && !canAt.length) return {};
+  const actions = snapshot.actionsOffered || [];
+  if (!stickers.length && !canAt.length && !actions.length) return {};
   return {
     expression: {
       ...(stickers.length
@@ -95,6 +97,7 @@ export function expressionInput(snapshot) {
               "群里要叫住某个人、让他注意到这句话时，可返回 at:[userId]，最多两人；正在一对一接话、对方自然会看到时不用@。",
           }
         : {}),
+      ...(actions.length ? actionNote(actions) : {}),
     },
   };
 }

package/server/stickers/zip-import.js

@@ -0,0 +1,136 @@
+import { readZip, stripRoot } from "../plugins/zip.js";
+import { readZipFile, zipFileNames } from "../plugins/zip-file.js";
+import { STICKER_MAX_BYTES } from "./library.js";
+
+const MIB = 1024 * 1024;
+const IMAGE = /\.(png|jpe?g|gif|webp)$/i;
+const ARCHIVE_ROOT =
+  /^(?:pack(?:age)?|stickers?(?:[-_ ]?pack)?|emojis?|images?|my[-_ ]stickers|我的表情|表情包|表情)$/i;
+
+function stripArchiveRoot(files) {
+  if (!files.length) return files;
+  const roots = new Set(files.map((file) => file.name.split("/")[0]));
+  if (roots.size !== 1 || !ARCHIVE_ROOT.test([...roots][0])) return files;
+  return stripRoot(files);
+}
+
+// Upload size of one sticker archive; STICKER_ZIP_MAX_MB overrides it.
+export function stickerZipLimitMb(env = process.env) {
+  const n = Number(env.STICKER_ZIP_MAX_MB);
+  return Number.isFinite(n) && n > 0 ? Math.min(n, 4096) : 1024;
+}
+
+const hidden = (name) =>
+  name.split("/").some((part) => part === "__MACOSX" || part.startsWith("."));
+
+// Imports every image in an archive, in memory. Each new one joins the same
+// one-time analysis queue as a single upload; nothing is written to disk.
+export async function importStickerZip(
+  library,
+  buffer,
+  { category = "", folderCategory = false, queue = () => {} } = {},
+  env = process.env,
+) {
+  const limit = stickerZipLimitMb(env) * MIB;
+  if (!Buffer.isBuffer(buffer) || !buffer.length) throw Error("文件为空");
+  if (buffer.length > limit) throw Error("压缩包过大");
+  const summary = { imported: 0, duplicates: 0, skipped: [], failed: [] };
+  const files = stripArchiveRoot(
+    readZip(buffer, {
+      maxFiles: 5000,
+      maxBytes: Math.max(limit * 2, 400 * MIB),
+      maxEntryBytes: STICKER_MAX_BYTES,
+      keep: (name) => {
+        if (hidden(name)) return false;
+        if (!IMAGE.test(name)) {
+          summary.skipped.push({ name, reason: "不是图片" });
+          return false;
+        }
+        return true;
+      },
+    }),
+  );
+  for (const file of files) {
+    if (file.skipped) {
+      summary.skipped.push({ name: file.name, reason: "超过单张大小上限" });
+      continue;
+    }
+    const parts = file.name.split("/");
+    const base = parts.at(-1).replace(/\.[a-z0-9]+$/i, "");
+    // The first folder names the category: 开心/a.png, 开心/more/b.png.
+    const folder = parts.length > 1 ? parts[0] : "";
+    try {
+      const item = await library.add(file.bytes, {
+        name: base,
+        category: (folderCategory && folder) || category,
+      });
+      if (item.duplicate) summary.duplicates++;
+      else {
+        summary.imported++;
+        queue(item.id);
+      }
+    } catch (error) {
+      summary.failed.push({ name: file.name, reason: error.message });
+    }
+  }
+  return summary;
+}
+
+// The same import for an archive already on disk: entries are read and
+// added one at a time, so memory stays at one sticker however big the pack.
+// progress({ done, total }) is called after each entry.
+export async function importStickerZipFile(
+  library,
+  path,
+  {
+    category = "",
+    folderCategory = false,
+    queue = () => {},
+    progress = () => {},
+  } = {},
+) {
+  const summary = { imported: 0, duplicates: 0, skipped: [], failed: [] };
+  const names = (await zipFileNames(path)).filter((name) => !hidden(name));
+  const images = names.filter((name) => IMAGE.test(name));
+  for (const name of names)
+    if (!IMAGE.test(name)) summary.skipped.push({ name, reason: "不是图片" });
+  // The same single-root folder rule as the in-memory import.
+  const roots = new Set(images.map((name) => name.split("/")[0]));
+  const root =
+    roots.size === 1 &&
+    ARCHIVE_ROOT.test([...roots][0]) &&
+    images.every((name) => name.includes("/"))
+      ? [...roots][0]
+      : null;
+  let done = 0;
+  progress({ done, total: images.length });
+  for await (const file of readZipFile(path, {
+    maxEntryBytes: STICKER_MAX_BYTES,
+    keep: (name) => !hidden(name) && IMAGE.test(name),
+  })) {
+    done++;
+    const relative = root ? file.name.slice(root.length + 1) : file.name;
+    if (file.skipped) {
+      summary.skipped.push({ name: file.name, reason: "超过单张大小上限" });
+    } else {
+      const parts = relative.split("/");
+      const base = parts.at(-1).replace(/\.[a-z0-9]+$/i, "");
+      const folder = parts.length > 1 ? parts[0] : "";
+      try {
+        const item = await library.add(file.bytes, {
+          name: base,
+          category: (folderCategory && folder) || category,
+        });
+        if (item.duplicate) summary.duplicates++;
+        else {
+          summary.imported++;
+          queue(item.id);
+        }
+      } catch (error) {
+        summary.failed.push({ name: file.name, reason: error.message });
+      }
+    }
+    progress({ done, total: images.length });
+  }
+  return summary;
+}

package/server/studio/auto-update.js

@@ -0,0 +1,224 @@
+// Automatic updates: off unless the owner turns them on. At the chosen time
+// it checks the registry; with "install" it waits for a safe moment (no
+// backup, cleanup, transfer or update running, and she is not in the middle
+// of a conversation) and then runs the same verified update as the button:
+// backup checked, migrate, restart, health check, roll back on failure.
+import { compareVersions } from "./updates.js";
+
+export const AUTO_UPDATE_DEFAULTS = {
+  enabled: false,
+  mode: "daily", // daily | interval
+  at: "04:00", // daily, in the owner's time zone
+  everyHours: 24, // interval
+  install: "notify", // notify | auto
+  window: "", // optional "02:00-06:00"
+};
+const QUIET_MS = 10 * 60000;
+const DEFER_MAX_MS = 24 * 3600000;
+
+function minutes(hhmm) {
+  const m = /^([01]?\d|2[0-3]):([0-5]\d)$/.exec(String(hhmm || ""));
+  return m ? Number(m[1]) * 60 + Number(m[2]) : null;
+}
+function localMinutes(now, zone) {
+  const parts = new Intl.DateTimeFormat("en-GB", {
+    timeZone: zone || "Asia/Shanghai",
+    hour: "2-digit",
+    minute: "2-digit",
+    hourCycle: "h23",
+  }).formatToParts(new Date(now));
+  const get = (t) => Number(parts.find((p) => p.type === t)?.value || 0);
+  return get("hour") * 60 + get("minute");
+}
+function localDay(now, zone) {
+  return new Intl.DateTimeFormat("en-CA", {
+    timeZone: zone || "Asia/Shanghai",
+  }).format(new Date(now));
+}
+export function inWindow(window, now, zone) {
+  const m = /^(\d{1,2}:\d{2})-(\d{1,2}:\d{2})$/.exec(String(window || ""));
+  if (!m) return true;
+  const [from, to] = [minutes(m[1]), minutes(m[2])];
+  if (from == null || to == null) return true;
+  const at = localMinutes(now, zone);
+  return from <= to ? at >= from && at < to : at >= from || at < to;
+}
+
+export function normalizeAutoUpdate(value = {}) {
+  const v = { ...AUTO_UPDATE_DEFAULTS, ...(value || {}) };
+  return {
+    enabled: v.enabled === true,
+    mode: v.mode === "interval" ? "interval" : "daily",
+    at: minutes(v.at) == null ? AUTO_UPDATE_DEFAULTS.at : v.at,
+    everyHours: [6, 12, 24, 72].includes(Number(v.everyHours))
+      ? Number(v.everyHours)
+      : 24,
+    install: v.install === "auto" ? "auto" : "notify",
+    window: /^\d{1,2}:\d{2}-\d{1,2}:\d{2}$/.test(String(v.window || ""))
+      ? v.window
+      : "",
+  };
+}
+
+export class AutoUpdater {
+  constructor({
+    repo,
+    checker,
+    updater,
+    occupied = () => false,
+    talking = () => false,
+    zone = () => "Asia/Shanghai",
+    now = Date.now,
+  }) {
+    Object.assign(this, {
+      repo,
+      checker,
+      updater,
+      occupied,
+      talking,
+      zone,
+      now,
+    });
+    this.waiting = null; // { version, since, reason }
+  }
+  settings() {
+    return normalizeAutoUpdate(this.repo.config("autoUpdate"));
+  }
+  save(value) {
+    const next = normalizeAutoUpdate(value);
+    this.repo.saveConfig("autoUpdate", next);
+    return next;
+  }
+  state() {
+    return this.repo.config("autoUpdateState", {
+      lastCheckDay: "",
+      lastCheckAt: 0,
+      failedVersions: [],
+      history: [],
+    });
+  }
+  note(entry) {
+    const s = this.state();
+    s.history = [{ time: this.now(), ...entry }, ...(s.history || [])].slice(
+      0,
+      20,
+    );
+    this.repo.saveConfig("autoUpdateState", s);
+  }
+  due(settings, state, now) {
+    const zone = this.zone();
+    if (settings.mode === "interval")
+      return now - (state.lastCheckAt || 0) >= settings.everyHours * 3600000;
+    return (
+      state.lastCheckDay !== localDay(now, zone) &&
+      localMinutes(now, zone) >= minutes(settings.at)
+    );
+  }
+  view() {
+    const s = this.state();
+    return {
+      settings: this.settings(),
+      waiting: this.waiting,
+      lastCheckAt: s.lastCheckAt || null,
+      history: s.history || [],
+    };
+  }
+  // Called from the one-minute maintenance loop.
+  async tick() {
+    const settings = this.settings();
+    if (!settings.enabled) {
+      this.waiting = null;
+      return "off";
+    }
+    const now = this.now();
+    if (this.waiting) return this.tryInstall(settings, now);
+    const state = this.state();
+    if (!this.due(settings, state, now)) return "idle";
+    state.lastCheckAt = now;
+    state.lastCheckDay = localDay(now, this.zone());
+    this.repo.saveConfig("autoUpdateState", state);
+    const info = await this.checker.check();
+    if (info.status !== "available") {
+      this.note({
+        result: info.error ? "check-failed" : "current",
+        to: info.latest || "",
+      });
+      return "checked";
+    }
+    if (settings.install !== "auto" || info.installation !== "npm") {
+      this.note({ result: "available", from: info.current, to: info.latest });
+      return "notified";
+    }
+    if ((state.failedVersions || []).includes(info.latest)) {
+      this.note({
+        result: "skipped",
+        to: info.latest,
+        reason: "这个版本上次自动更新失败过，不再自动重试",
+      });
+      return "skipped";
+    }
+    this.waiting = {
+      version: info.latest,
+      from: info.current,
+      since: now,
+      reason: "",
+    };
+    return this.tryInstall(settings, now);
+  }
+  async tryInstall(settings, now) {
+    const w = this.waiting;
+    if (now - w.since > DEFER_MAX_MS) {
+      this.note({ result: "deferred", to: w.version, reason: w.reason });
+      this.waiting = null;
+      return "deferred";
+    }
+    const block =
+      this.occupied() || this.updater?.busy
+        ? "备份、整理、迁移或更新正在进行"
+        : this.talking(QUIET_MS)
+          ? "她正在聊天，稍后再试"
+          : !inWindow(settings.window, now, this.zone())
+            ? "不在允许的更新时段"
+            : "";
+    if (block) {
+      w.reason = block;
+      return "waiting";
+    }
+    this.waiting = null;
+    try {
+      await this.updater.install(w.version);
+      this.note({ result: "started", from: w.from, to: w.version });
+      return "installing";
+    } catch (error) {
+      const s = this.state();
+      s.failedVersions = [
+        ...new Set([...(s.failedVersions || []), w.version]),
+      ].slice(-10);
+      this.repo.saveConfig("autoUpdateState", s);
+      this.note({ result: "failed", to: w.version, reason: error.message });
+      return "failed";
+    }
+  }
+  // After a restart: an update that rolled back marks its version so it is
+  // not tried again automatically.
+  observe(status) {
+    if (
+      !status?.version ||
+      !/restored|recovery|error|failed/i.test(String(status.status || ""))
+    )
+      return;
+    const s = this.state();
+    if ((s.failedVersions || []).includes(status.version)) return;
+    s.failedVersions = [...(s.failedVersions || []), status.version].slice(-10);
+    this.repo.saveConfig("autoUpdateState", s);
+    this.note({ result: "rolled-back", to: status.version });
+  }
+}
+
+export function newer(a, b) {
+  try {
+    return compareVersions(a, b) > 0;
+  } catch {
+    return false;
+  }
+}