opencode-remote-control 0.2.5 → 0.2.8

package/README.md

@@ -1,5 +1,7 @@
 # OpenCode Remote Control
 
+> **Lightning-fast AI coding assistant powered by OpenCode — no Claude Code subscription required!**
+
 <p align="center">
   <a href="https://github.com/ceociocto/opencode-remote-control/actions/workflows/publish.yml?query=branch%3Amain"><img src="https://img.shields.io/github/actions/workflow/status/ceociocto/opencode-remote-control/publish.yml?branch=main&style=for-the-badge" alt="CI status"></a>
   <a href="https://www.npmjs.com/package/opencode-remote-control"><img src="https://img.shields.io/npm/v/opencode-remote-control?style=for-the-badge" alt="npm version"></a>
@@ -11,9 +13,13 @@
   <a href="./README_CN.md">中文文档</a>
 </p>
 
-<p align="center">
-  Control OpenCode from anywhere via Telegram or Feishu.
-</p>
+Control OpenCode from anywhere via Telegram or Feishu.
+
+## What's New in v0.2
+
+- **Feishu Channel** — Now supports Feishu/Lark bot with WebSocket long connection (no tunnel required!)
+- **Faster Responses** — Optimized timeout handling for long AI responses
+- **Better CLI** — Improved configuration experience with existing value display
 
 ## Requirements
 
@@ -21,7 +27,7 @@
 - [OpenCode](https://github.com/opencode-ai/opencode) installed and accessible in PATH
 - Telegram account (for Telegram bot)
 - Feishu account (for Feishu bot)
-- ngrok or cloudflared (for Feishu webhook)
+- **No** ngrok or cloudflared required (Feishu uses WebSocket long connection)
 
 ### Verify OpenCode Installation
 
@@ -68,7 +74,56 @@ Token is saved to `~/.opencode-remote/.env`
 
 ### Feishu Setup
 
-For detailed Feishu setup instructions, see [Feishu Setup Guide](./docs/FEISHU_SETUP_EN.md) or [飞书配置指南](./docs/FEISHU_SETUP.md).
+Feishu uses **WebSocket Long Connection Mode** - no public IP or tunnel required!
+
+#### Step 1: Create Feishu App
+
+1. Visit [Feishu Open Platform](https://open.feishu.cn/) and login
+2. Go to "Developer Console" → "Create Enterprise App"
+3. Get **App ID** and **App Secret** from "Credentials & Basic Info"
+
+#### Step 2: Configure Permissions
+
+Go to "Permission Management" → "API Permissions" and enable:
+
+| Permission | ID |
+|------------|---|
+| Get and send messages | `im:message` |
+| Send messages as bot | `im:message:send_as_bot` |
+| Receive bot messages | `im:message:receive_as_bot` |
+
+#### Step 3: Enable Bot
+
+1. Go to "App Capabilities" → "Bot"
+2. Enable "Enable Bot"
+3. Enable "Bot can proactively send messages to users"
+4. Enable "Users can have private chats with bot"
+
+#### Step 4: Configure Event Subscription (Critical!)
+
+1. Go to "Event Subscription" page
+2. **Subscription Method**: Select "**Use long connection to receive events**"
+   > ⚠️ Important: Choose "Use long connection to receive events", NOT "Send events to developer server"
+3. Click "Add Event" and select:
+   - `im.message.receive_v1` - Receive messages
+4. Save configuration
+
+#### Step 5: Run Config Command
+
+```bash
+opencode-remote config
+```
+
+Select "Feishu" and enter your App ID and App Secret.
+
+#### Step 6: Publish App
+
+1. Go to "Version Management & Publishing"
+2. Create version → Request publishing → Publish
+
+---
+
+For detailed setup instructions, see [Feishu Setup Guide](./docs/FEISHU_SETUP_EN.md) or [飞书配置指南](./docs/FEISHU_SETUP.md).
 
 ## Start Service
 
@@ -145,18 +200,18 @@ Both Telegram and Feishu support the same commands:
 
 The Telegram bot uses **Polling Mode** to fetch messages from Telegram servers, requiring no tunnel or public IP configuration.
 
-### Feishu (Webhook Mode)
+### Feishu (Long Connection Mode)
 
 ```
 ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
-│  Feishu     │───▶│  Feishu     │───▶│   Webhook   │
-│  Client     │    │  Server     │    │  (ngrok)    │
+│  Feishu     │───▶│  Feishu     │───▶│  WebSocket  │
+│  Client     │    │  Server     │    │ (Long Conn) │
 └─────────────┘    └─────────────┘    └──────┬──────┘
                                              │
                                              ▼
                                       ┌─────────────┐
                                       │ Feishu Bot  │
-                                      │  (port 3001)│
+                                      │  (Local)    │
                                       └──────┬──────┘
                                              │
                                              ▼
@@ -166,7 +221,7 @@ The Telegram bot uses **Polling Mode** to fetch messages from Telegram servers,
                                       └─────────────┘
 ```
 
-The Feishu bot uses **Webhook Mode** and requires a tunnel (ngrok/cloudflared) to receive messages.
+The Feishu bot uses **WebSocket Long Connection Mode** - no public IP or tunnel (ngrok/cloudflared) required!
 
 ## Contributing
 

package/dist/cli.js

@@ -103,7 +103,24 @@ async function promptToken() {
     return token;
 }
 async function promptFeishuConfig() {
-    console.log('\n📝 Step 1: Create Feishu App');
+    // Read existing config to show as defaults
+    let existingAppId = '';
+    let existingAppSecret = '';
+    if (existsSync(CONFIG_FILE)) {
+        const content = readFileSync(CONFIG_FILE, 'utf-8');
+        const appIdMatch = content.match(/FEISHU_APP_ID=(.+)/);
+        if (appIdMatch)
+            existingAppId = appIdMatch[1].trim();
+        const appSecretMatch = content.match(/FEISHU_APP_SECRET=(.+)/);
+        if (appSecretMatch)
+            existingAppSecret = appSecretMatch[1].trim();
+    }
+    console.log('');
+    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    console.log('  📁 Config file: ' + CONFIG_FILE);
+    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    console.log('');
+    console.log('📝 Step 1: Create Feishu App');
     console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
     console.log('');
     console.log('  1. Go to https://open.feishu.cn/app');
@@ -111,8 +128,20 @@ async function promptFeishuConfig() {
     console.log('  3. Fill in app name and description');
     console.log('  4. Go to "凭证与基础信息" (Credentials) page');
     console.log('');
-    const promptInput = async (promptText) => {
-        process.stdout.write(promptText);
+    console.log('⚠️  Important: In "事件订阅" (Event Subscription),');
+    console.log('   select "使用长连接接收事件" (Use long connection to receive events)');
+    console.log('   This allows the bot to work without ngrok/cloudflared!');
+    console.log('');
+    const promptInput = async (promptText, defaultValue) => {
+        if (defaultValue) {
+            const masked = defaultValue.length > 8
+                ? defaultValue.slice(0, 4) + '****' + defaultValue.slice(-4)
+                : '****';
+            process.stdout.write(`${promptText} [current: ${masked}]: `);
+        }
+        else {
+            process.stdout.write(promptText);
+        }
         return new Promise((resolve) => {
             process.stdin.resume();
             process.stdin.setEncoding('utf8');
@@ -128,18 +157,20 @@ async function promptFeishuConfig() {
             process.once('SIGINT', onSigint);
             process.stdin.once('data', (chunk) => {
                 cleanup();
-                resolve(chunk.toString().trim());
+                const input = chunk.toString().trim();
+                // If user presses enter without input, use default value
+                resolve(input || defaultValue);
             });
         });
     };
-    const appId = await promptInput('Enter your App ID: ');
+    const appId = await promptInput('Enter your App ID', existingAppId);
     if (!appId) {
-        console.log('\nCancelled');
+        console.log('\n❌ App ID is required. Press Ctrl+C to cancel.');
         process.exit(0);
     }
-    const appSecret = await promptInput('Enter your App Secret: ');
+    const appSecret = await promptInput('Enter your App Secret', existingAppSecret);
     if (!appSecret) {
-        console.log('\nCancelled');
+        console.log('\n❌ App Secret is required. Press Ctrl+C to cancel.');
         process.exit(0);
     }
     return { appId, appSecret };
@@ -150,51 +181,68 @@ function showFeishuSetupGuide() {
     console.log('  📋 Step 2: Configure App Permissions');
     console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
     console.log('');
-    console.log('  Go to "权限管理" (Permission Management) page');
-    console.log('  Search and enable these permissions:');
+    console.log('  Go to: 权限管理 → API权限');
     console.log('');
-    console.log('  ┌────────────────────────────────────────────────────┐');
-    console.log('  │ Permission                              │ Scope    │');
-    console.log('  ├────────────────────────────────────────────────────┤');
-    console.log('  │ im:message                      获取与发送消息  │');
-    console.log('  │ im:message:send_as_bot          以应用身份发消息 │');
-    console.log('  │ im:message:receive_as_bot       接收机器人消息   │');
-    console.log('  └────────────────────────────────────────────────────┘');
-    console.log('');
-    console.log('  💡 TIP: Copy the JSON below and use "批量添加" feature:');
+    console.log('  Click "批量添加" (Batch Add) and paste this JSON:');
     console.log('');
     console.log('  ┌────────────────────────────────────────────────────┐');
-    console.log('  │ [');
-    console.log('  │   "im:message",');
-    console.log('  │   "im:message:send_as_bot",');
-    console.log('  │   "im:message:receive_as_bot"');
-    console.log('  │ ]');
+    console.log('  │                                                    │');
+    console.log('  │   {                                                │');
+    console.log('  │     "im:message",                                  │');
+    console.log('  │     "im:message:send_as_bot",                      │');
+    console.log('  │     "im:message:receive_as_bot"                    │');
+    console.log('  │   }                                                │');
+    console.log('  │                                                    │');
     console.log('  └────────────────────────────────────────────────────┘');
     console.log('');
+    console.log('  📋 Or add manually:');
+    console.log('     • im:message              - 获取与发送消息');
+    console.log('     • im:message:send_as_bot  - 以应用身份发消息');
+    console.log('     • im:message:receive_as_bot - 接收机器人消息');
+    console.log('');
     console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
     console.log('  🤖 Step 3: Enable Robot Capability');
     console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
     console.log('');
-    console.log('  1. Go to "应用能力" (App Capabilities) → "机器人" (Robot)');
-    console.log('  2. Click "启用机器人" (Enable Robot)');
-    console.log('  3. Set robot name and description');
+    console.log('  Go to: 应用能力 → 机器人');
+    console.log('');
+    console.log('  Enable these options:');
+    console.log('     ☑️  启用机器人');
+    console.log('     ☑️  机器人可主动发送消息给用户');
+    console.log('     ☑️  用户可与机器人进行单聊');
+    console.log('');
+    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    console.log('  🚀 Step 4: Start the Bot FIRST! (CRITICAL)');
+    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    console.log('');
+    console.log('  ⚠️  You MUST start the bot BEFORE configuring event subscription!');
+    console.log('');
+    console.log('  Run in another terminal:');
+    console.log('');
+    console.log('       opencode-remote feishu');
+    console.log('');
+    console.log('  Wait for: "ws client ready" (WebSocket connected)');
+    console.log('');
+    console.log('  ✨ Long Connection Mode = NO ngrok/cloudflared needed!');
     console.log('');
     console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-    console.log('  🔗 Step 4: Configure Event Subscription');
+    console.log('  🔗 Step 5: Configure Event Subscription');
     console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
     console.log('');
-    console.log('  1. Start the bot locally:');
-    console.log('     $ opencode-remote feishu');
+    console.log('  (Make sure the bot is running! If not, start it first)');
     console.log('');
-    console.log('  2. Expose webhook with ngrok/cloudflared:');
-    console.log('     $ ngrok http 3001');
+    console.log('  1. Go to "事件订阅" (Event Subscription) page');
+    console.log('  2. 订阅方式: 选择 "使用长连接接收事件"');
+    console.log('     (NOT "将事件发送至开发者服务器"!)');
+    console.log('  3. Click "添加事件" and select:');
+    console.log('     - im.message.receive_v1 (接收消息)');
+    console.log('  4. Save configuration');
     console.log('');
-    console.log('  3. Go to "事件订阅" (Event Subscription) page');
-    console.log('  4. Set Request URL: https://your-ngrok-url/feishu/webhook');
-    console.log('  5. Add event: im.message.receive_v1');
+    console.log('  ❌ If you see "未检测到应用连接信息":');
+    console.log('     → The bot is not running. Start it first!');
     console.log('');
     console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-    console.log('  📤 Step 5: Publish App');
+    console.log('  📤 Step 6: Publish App');
     console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
     console.log('');
     console.log('  1. Go to "版本管理与发布" (Version & Publish)');

package/dist/core/auth.js

@@ -0,0 +1,95 @@
+// Authorization management for OpenCode Remote Control
+// First user to send /start becomes the owner automatically
+const authState = {
+    telegramOwner: null,
+    feishuOwner: null,
+};
+// Auth file path for persistence
+import { homedir } from 'os';
+import { join } from 'path';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+const AUTH_DIR = join(homedir(), '.opencode-remote');
+const AUTH_FILE = join(AUTH_DIR, 'auth.json');
+function ensureAuthDir() {
+    if (!existsSync(AUTH_DIR)) {
+        mkdirSync(AUTH_DIR, { recursive: true });
+    }
+}
+function loadAuth() {
+    try {
+        if (existsSync(AUTH_FILE)) {
+            const data = JSON.parse(readFileSync(AUTH_FILE, 'utf-8'));
+            authState.telegramOwner = data.telegramOwner || null;
+            authState.feishuOwner = data.feishuOwner || null;
+        }
+    }
+    catch (error) {
+        console.warn('Failed to load auth state, starting fresh:', error);
+    }
+}
+function saveAuth() {
+    try {
+        ensureAuthDir();
+        writeFileSync(AUTH_FILE, JSON.stringify(authState, null, 2));
+    }
+    catch (error) {
+        console.error('Failed to save auth state:', error);
+    }
+}
+// Initialize on module load
+loadAuth();
+export function isAuthorized(platform, userId) {
+    if (platform === 'telegram') {
+        return authState.telegramOwner === userId;
+    }
+    else {
+        return authState.feishuOwner === userId;
+    }
+}
+export function hasOwner(platform) {
+    if (platform === 'telegram') {
+        return authState.telegramOwner !== null;
+    }
+    else {
+        return authState.feishuOwner !== null;
+    }
+}
+export function claimOwnership(platform, userId) {
+    if (platform === 'telegram') {
+        if (authState.telegramOwner) {
+            if (authState.telegramOwner === userId) {
+                return { success: true, message: 'already_owner' };
+            }
+            return { success: false, message: 'already_claimed' };
+        }
+        authState.telegramOwner = userId;
+        saveAuth();
+        return { success: true, message: 'claimed' };
+    }
+    else {
+        if (authState.feishuOwner) {
+            if (authState.feishuOwner === userId) {
+                return { success: true, message: 'already_owner' };
+            }
+            return { success: false, message: 'already_claimed' };
+        }
+        authState.feishuOwner = userId;
+        saveAuth();
+        return { success: true, message: 'claimed' };
+    }
+}
+export function getOwner(platform) {
+    if (platform === 'telegram') {
+        return authState.telegramOwner;
+    }
+    else {
+        return authState.feishuOwner;
+    }
+}
+// For debugging/display
+export function getAuthStatus() {
+    return {
+        telegram: authState.telegramOwner !== null,
+        feishu: authState.feishuOwner !== null,
+    };
+}

package/dist/core/types.js

@@ -18,9 +18,6 @@ export function loadConfig() {
         telegramBotToken: process.env.TELEGRAM_BOT_TOKEN || undefined,
         feishuAppId: process.env.FEISHU_APP_ID || undefined,
         feishuAppSecret: process.env.FEISHU_APP_SECRET || undefined,
-        feishuEncryptKey: process.env.FEISHU_ENCRYPT_KEY,
-        feishuVerificationToken: process.env.FEISHU_VERIFICATION_TOKEN,
-        feishuWebhookPort: parseInt(process.env.FEISHU_WEBHOOK_PORT || '3001', 10),
         opencodeServerUrl: process.env.OPENCODE_SERVER_URL || 'http://localhost:3000',
         tunnelUrl: process.env.TUNNEL_URL || '',
         sessionIdleTimeoutMs: parseInt(process.env.SESSION_IDLE_TIMEOUT_MS || '1800000', 10),

package/dist/feishu/bot.js

@@ -1,11 +1,13 @@
 // Feishu bot implementation for OpenCode Remote Control
-import express from 'express';
+// Uses WebSocket long connection mode - no tunnel/ngrok required!
 import * as lark from '@larksuiteoapi/node-sdk';
 import { initSessionManager, getOrCreateSession } from '../core/session.js';
 import { splitMessage } from '../core/notifications.js';
 import { EMOJI } from '../core/types.js';
 import { initOpenCode, createSession, sendMessage, checkConnection } from '../opencode/client.js';
+import { isAuthorized, hasOwner, claimOwnership, getAuthStatus } from '../core/auth.js';
 let feishuClient = null;
+let wsClient = null;
 let config = null;
 let openCodeSessions = null;
 // Map Feishu event to shared MessageContext
@@ -41,8 +43,24 @@ function createFeishuAdapter(client) {
             }
         },
         async sendTypingIndicator(threadId) {
-            // Feishu doesn't have typing indicator
-            // Could optionally send a "thinking..." message, but we'll skip for now
+            // Feishu doesn't have native typing indicator API
+            // We send a "thinking" message that will be deleted later
+            const chatId = threadId.replace('feishu:', '');
+            try {
+                const result = await client.im.message.create({
+                    params: { receive_id_type: 'chat_id' },
+                    data: {
+                        receive_id: chatId,
+                        msg_type: 'text',
+                        content: JSON.stringify({ text: '⏳ 思考中...' }),
+                    },
+                });
+                return result.data?.message_id || '';
+            }
+            catch (error) {
+                console.error('Failed to send typing indicator:', error);
+                return '';
+            }
         },
         async deleteMessage(threadId, messageId) {
             if (!messageId)
@@ -65,9 +83,33 @@ async function handleCommand(adapter, ctx, text) {
     const parts = text.split(/\s+/);
     const command = parts[0].toLowerCase();
     switch (command) {
-        case '/start':
-        case '/help':
-            await adapter.reply(ctx.threadId, `🚀 OpenCode Remote Control ready
+        case '/start': {
+            const result = claimOwnership('feishu', ctx.userId);
+            if (result.success) {
+                if (result.message === 'claimed') {
+                    await adapter.reply(ctx.threadId, `🔐 **Security Setup Complete!**
+
+✅ You are now the authorized owner of this bot.
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+⚠️  **IMPORTANT SECURITY NOTICE**
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Only YOU can control OpenCode through this bot.
+Other users will be blocked automatically.
+
+Your Feishu ID: \`${ctx.userId}\`
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+🚀 **Ready to use!**
+💬 Send me a prompt to start coding
+/help — see all commands
+/status — check OpenCode connection`);
+                }
+                else {
+                    // Already owner
+                    await adapter.reply(ctx.threadId, `🚀 OpenCode Remote Control ready
 
 💬 Send me a prompt to start coding
 /help — see all commands
@@ -83,6 +125,31 @@ Commands:
 /files — List changed files
 /retry — Retry connection
 
+💬 Anything else is treated as a prompt for OpenCode!`);
+                }
+            }
+            else {
+                // Already claimed by someone else
+                await adapter.reply(ctx.threadId, `🚫 **Access Denied**
+
+This bot is already secured by another user.
+
+If you are the owner, check your configuration.`);
+            }
+            break;
+        }
+        case '/help':
+            await adapter.reply(ctx.threadId, `📖 Commands
+
+/start — Claim ownership & Start bot
+/status — Check connection
+/reset — Reset session
+/approve — Approve pending changes
+/reject — Reject pending changes
+/diff — See full diff
+/files — List changed files
+/retry — Retry connection
+
 💬 Anything else is treated as a prompt for OpenCode!`);
             break;
         case '/approve': {
@@ -163,9 +230,26 @@ async function handleMessage(adapter, ctx, text) {
     const session = getOrCreateSession(ctx.threadId, 'feishu');
     // Check if it's a command
     if (text.startsWith('/')) {
+        // Commands are handled by handleCommand which has its own auth logic for /start
         await handleCommand(adapter, ctx, text);
         return;
     }
+    // Authorization check for non-command messages
+    if (!isAuthorized('feishu', ctx.userId)) {
+        if (!hasOwner('feishu')) {
+            await adapter.reply(ctx.threadId, `🔐 **Authorization Required**
+
+This bot is not yet secured.
+
+Please send /start to claim ownership first.`);
+        }
+        else {
+            await adapter.reply(ctx.threadId, `🚫 **Access Denied**
+
+You are not authorized to use this bot.`);
+        }
+        return;
+    }
     // Check OpenCode connection
     const connected = await checkConnection();
     if (!connected) {
@@ -176,13 +260,18 @@ Cannot connect to OpenCode server.
 🔄 /retry — check again`);
         return;
     }
-    // Send typing indicator (Feishu style)
-    const typingMsg = await adapter.reply(ctx.threadId, '⏳');
+    // Send typing indicator
+    console.log('⏳ Sending typing indicator...');
+    const typingMsgId = await adapter.sendTypingIndicator(ctx.threadId);
     // Get or create OpenCode session
     let openCodeSession = openCodeSessions?.get(ctx.threadId);
     if (!openCodeSession) {
         const newSession = await createSession(ctx.threadId, `Feishu chat ${ctx.threadId}`);
         if (!newSession) {
+            // Delete typing indicator before error message
+            if (typingMsgId && adapter.deleteMessage) {
+                await adapter.deleteMessage(ctx.threadId, typingMsgId);
+            }
             await adapter.reply(ctx.threadId, '❌ Failed to create OpenCode session');
             return;
         }
@@ -195,10 +284,12 @@ Cannot connect to OpenCode server.
         }
     }
     try {
+        console.log('🤖 Sending to OpenCode...');
         const response = await sendMessage(openCodeSession, text);
+        console.log('✅ Got response from OpenCode');
         // Delete typing indicator
-        if (adapter.deleteMessage && typingMsg) {
-            await adapter.deleteMessage(ctx.threadId, typingMsg);
+        if (typingMsgId && adapter.deleteMessage) {
+            await adapter.deleteMessage(ctx.threadId, typingMsgId);
         }
         // Split long messages
         const messages = splitMessage(response);
@@ -208,6 +299,10 @@ Cannot connect to OpenCode server.
     }
     catch (error) {
         console.error('Error sending message:', error);
+        // Delete typing indicator on error too
+        if (typingMsgId && adapter.deleteMessage) {
+            await adapter.deleteMessage(ctx.threadId, typingMsgId);
+        }
         await adapter.reply(ctx.threadId, `❌ Error: ${error instanceof Error ? error.message : 'Unknown error'}`);
     }
 }
@@ -228,13 +323,14 @@ function checkRateLimit(chatId) {
     entry.count++;
     return true;
 }
-// Start Feishu bot
+// Start Feishu bot using WebSocket long connection mode
+// No tunnel/ngrok required - just needs internet access!
 export async function startFeishuBot(botConfig) {
     config = botConfig;
     if (!config.feishuAppId || !config.feishuAppSecret) {
-        throw new Error('Feishu credentials not configured');
+        throw new Error('Feishu credentials not configured. Run: opencode-remote config');
     }
-    // Initialize Feishu client
+    // Initialize Feishu client for sending messages
     feishuClient = new lark.Client({
         appId: config.feishuAppId,
         appSecret: config.feishuAppSecret,
@@ -255,103 +351,135 @@ export async function startFeishuBot(botConfig) {
         console.error('❌ Failed to initialize OpenCode:', error);
         console.log('Make sure OpenCode is running');
     }
-    // Create adapter
+    // Create adapter for sending messages
     const adapter = createFeishuAdapter(feishuClient);
-    // Create Express server for webhook
-    const app = express();
-    app.use(express.json());
-    const webhookPath = '/feishu/webhook';
-    const port = config.feishuWebhookPort || 3001;
-    // Webhook endpoint for Feishu events
-    app.post(webhookPath, async (req, res) => {
-        const event = req.body;
-        // Handle URL verification challenge (required for Feishu bot setup)
-        if (event.type === 'url_verification') {
-            res.json({ challenge: event.challenge });
-            return;
-        }
-        // Validate event structure
-        if (!event.header?.event_type) {
-            res.status(400).json({ code: -1, msg: 'Invalid event structure' });
-            return;
-        }
-        // Handle message events
-        if (event.header.event_type === 'im.message.receive_v1') {
+    // Create WebSocket client for long connection
+    wsClient = new lark.WSClient({
+        appId: config.feishuAppId,
+        appSecret: config.feishuAppSecret,
+        // For international Lark, add: domain: lark.Domain.Lark
+    });
+    // Create event dispatcher for handling incoming messages
+    const eventDispatcher = new lark.EventDispatcher({}).register({
+        // Handle incoming messages
+        'im.message.receive_v1': async (data) => {
+            console.log('📩 Received message event:', JSON.stringify(data, null, 2));
             try {
                 // Validate event data
-                if (!event.event?.message) {
-                    res.status(400).json({ code: -1, msg: 'Missing message data' });
-                    return;
+                if (!data?.message) {
+                    console.warn('Received message event without message data');
+                    return { code: 0 };
                 }
-                const ctx = feishuEventToContext(event.event);
-                const chatId = event.event.message.chat_id;
+                const chatId = data.message.chat_id;
+                console.log(`💬 Message from chat: ${chatId}`);
                 // Rate limiting
                 if (!checkRateLimit(chatId)) {
                     console.warn(`Rate limit exceeded for chat: ${chatId}`);
-                    res.status(429).json({ code: -1, msg: 'Rate limit exceeded' });
-                    return;
+                    return { code: 0 };
                 }
                 // Parse message content
                 let text = '';
                 try {
-                    const content = JSON.parse(event.event.message.content);
+                    const content = JSON.parse(data.message.content);
                     text = content.text || '';
+                    console.log(`📝 Message text: ${text}`);
                 }
                 catch {
                     // If not JSON, try to use raw content
-                    text = event.event.message.content || '';
+                    text = data.message.content || '';
+                    console.log(`📝 Raw message content: ${text}`);
                 }
                 // Skip empty messages
                 if (!text.trim()) {
-                    res.json({ code: 0 });
-                    return;
+                    console.log('⏭️ Skipping empty message');
+                    return { code: 0 };
                 }
-                // Handle the message
-                await handleMessage(adapter, ctx, text);
-                res.json({ code: 0 });
+                // Create message context
+                const ctx = feishuEventToContext(data);
+                // Handle the message (async, don't wait)
+                handleMessage(adapter, ctx, text).catch(error => {
+                    console.error('Error handling Feishu message:', error);
+                });
+                return { code: 0 };
             }
             catch (error) {
-                console.error('Feishu webhook error:', error);
-                res.status(500).json({ code: -1, msg: 'Internal error' });
+                console.error('Feishu event handler error:', error);
+                return { code: 0 };
             }
-            return;
-        }
-        // Unknown event type - acknowledge but ignore
-        console.log(`Received Feishu event: ${event.header.event_type}`);
-        res.json({ code: 0 });
-    });
-    // Health check endpoint
-    app.get('/health', (_req, res) => {
-        res.json({ status: 'ok', platform: 'feishu' });
-    });
-    // Start server
-    return new Promise((resolve, reject) => {
-        const server = app.listen(port, () => {
-            console.log(`🚀 Feishu webhook listening on port ${port}`);
-            console.log(`📡 Webhook URL: http://localhost:${port}${webhookPath}`);
-            console.log('\n📝 Setup instructions:');
-            console.log('  1. Use ngrok or cloudflared to expose this endpoint:');
-            console.log('     ngrok http ' + port);
-            console.log('  2. Configure the webhook URL in Feishu admin console');
-            console.log('  3. Subscribe to "im.message.receive_v1" event');
-        });
-        server.on('error', (err) => {
-            reject(err);
-        });
-        // Handle graceful shutdown
-        process.once('SIGINT', () => {
-            console.log('\n🛑 Shutting down Feishu bot...');
-            server.close(() => {
-                console.log('Feishu bot stopped');
-                resolve();
-            });
-        });
-        process.once('SIGTERM', () => {
-            console.log('\n🛑 Shutting down Feishu bot...');
-            server.close(() => {
-                console.log('Feishu bot stopped');
-                resolve();
-            });
-        });
+        },
     });
+    // Start WebSocket long connection
+    console.log('🔗 Starting Feishu WebSocket long connection...');
+    console.log('');
+    console.log('✨ Long connection mode - NO tunnel/ngrok required!');
+    console.log('   Just make sure your computer can access the internet.');
+    console.log('');
+    // Show security status
+    const authStatus = getAuthStatus();
+    if (!authStatus.feishu) {
+        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+        console.log('  🔐 SECURITY NOTICE');
+        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+        console.log('');
+        console.log('  Bot is NOT yet secured!');
+        console.log('  The FIRST user to send /start will become the owner.');
+        console.log('');
+        console.log('  👉 Open Feishu and send /start to YOUR bot NOW!');
+        console.log('');
+        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+        console.log('');
+    }
+    else {
+        console.log('🔒 Bot is secured (owner authorized)');
+        console.log('');
+    }
+    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    console.log('  📋 Configuration Checklist');
+    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    console.log('');
+    console.log('  Step 1: Add Permissions (权限管理 → API权限)');
+    console.log('  ────────────────────────────────────────');
+    console.log('  Click "批量添加" (Batch Add) and paste this JSON:');
+    console.log('');
+    console.log('  ┌────────────────────────────────────────────────────┐');
+    console.log('  │ {                                                  │');
+    console.log('  │   "im:message",                                   │');
+    console.log('  │   "im:message:send_as_bot",                       │');
+    console.log('  │   "im:message:receive_as_bot"                     │');
+    console.log('  │ }                                                  │');
+    console.log('  └────────────────────────────────────────────────────┘');
+    console.log('');
+    console.log('  Step 2: Enable Robot (应用能力 → 机器人)');
+    console.log('  ────────────────────────────────────────');
+    console.log('  - Enable "启用机器人"');
+    console.log('  - Enable "机器人可主动发送消息给用户"');
+    console.log('  - Enable "用户可与机器人进行单聊"');
+    console.log('');
+    console.log('  Step 3: Event Subscription (事件订阅)');
+    console.log('  ────────────────────────────────────────');
+    console.log('  ⚠️  MUST start this bot BEFORE saving event config!');
+    console.log('  - Select "使用长连接接收事件"');
+    console.log('  - Add event: im.message.receive_v1');
+    console.log('  - Then click Save');
+    console.log('');
+    console.log('  Step 4: Publish App (版本管理与发布)');
+    console.log('  ────────────────────────────────────────');
+    console.log('  - Create version → Request publishing → Publish');
+    console.log('');
+    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    console.log('  🔍 Debug: Send a message to your bot in Feishu!');
+    console.log('     You should see: 📩 Received message event');
+    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    console.log('');
+    // The start() method will block the main thread
+    // Handle graceful shutdown
+    const shutdown = () => {
+        console.log('\n🛑 Shutting down Feishu bot...');
+        // WSClient doesn't have a stop method, just let the process exit
+        process.exit(0);
+    };
+    process.once('SIGINT', shutdown);
+    process.once('SIGTERM', shutdown);
+    // Start the WebSocket client - this will block until process is killed
+    await wsClient.start({ eventDispatcher });
 }

package/dist/opencode/client.js

@@ -1,13 +1,40 @@
 // OpenCode SDK client for remote control
-import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
 import { platform } from 'node:os';
 import { createOpencode } from '@opencode-ai/sdk';
+const require = createRequire(import.meta.url);
+const childProcess = require('node:child_process');
+// Patch undici's default HeadersTimeout (30s) to 30 minutes for long AI responses.
+// undici is Node.js's default fetch implementation and enforces headersTimeout on
+// every request. Without this, streaming/processing large AI responses timeout.
+let fetchPatched = false;
+function patchFetchForUnlimitedTimeout() {
+    if (fetchPatched || typeof globalThis.fetch !== 'function')
+        return;
+    fetchPatched = true;
+    const originalFetch = globalThis.fetch;
+    // @ts-ignore - internal API
+    const originalDispatcher = originalFetch[Symbol.for('undici.globalDispatcher.1')];
+    if (originalDispatcher) {
+        // @ts-ignore
+        originalDispatcher.headersTimeout = 30 * 60 * 1000;
+        // @ts-ignore
+        originalDispatcher.bodyTimeout = 30 * 60 * 1000;
+    }
+    globalThis.fetch = function (input, init) {
+        if (init?.signal) {
+            const { signal: _signal, ...rest } = init;
+            return originalFetch(input, rest);
+        }
+        return originalFetch(input, init);
+    };
+}
 // Windows compatibility: patch child_process.spawn to use shell for 'opencode' command
 // This is needed because Windows requires shell: true to execute .cmd files
 if (platform() === 'win32') {
-    const originalSpawn = spawn;
+    const originalSpawn = childProcess.spawn;
     // @ts-ignore - monkey patching for Windows compatibility
-    require('node:child_process').spawn = function (command, args, options = {}) {
+    childProcess.spawn = function (command, args, options = {}) {
         if (command === 'opencode' && !options.shell) {
             options.shell = true;
         }
@@ -22,7 +49,7 @@ export async function verifyOpenCodeInstalled() {
     return new Promise((resolve) => {
         const isWindows = platform() === 'win32';
         const command = isWindows ? 'where' : 'which';
-        const proc = spawn(command, ['opencode'], { shell: isWindows });
+        const proc = childProcess.spawn(command, ['opencode'], { shell: isWindows });
         let output = '';
         let errorOutput = '';
         proc.stdout?.on('data', (chunk) => {
@@ -53,6 +80,7 @@ export async function verifyOpenCodeInstalled() {
 let opencodeInstance = null;
 let verificationDone = false;
 export async function initOpenCode() {
+    patchFetchForUnlimitedTimeout();
     if (opencodeInstance) {
         return opencodeInstance;
     }

package/dist/telegram/bot.js

@@ -4,6 +4,7 @@ import { loadConfig } from '../core/types.js';
 import { initSessionManager, getOrCreateSession } from '../core/session.js';
 import { splitMessage } from '../core/notifications.js';
 import { initOpenCode, createSession, sendMessage, checkConnection } from '../opencode/client.js';
+import { isAuthorized, hasOwner, claimOwnership, getAuthStatus } from '../core/auth.js';
 // Lazy initialization - bot is only created when startBot() is called
 let config = null;
 let bot = null;
@@ -18,11 +19,47 @@ function getThreadId(ctx) {
 function setupBotCommands(bot, openCodeSessions) {
     // Start command
     bot.command('start', async (ctx) => {
-        await ctx.reply(`🚀 OpenCode Remote Control ready
+        const userId = String(ctx.from?.id);
+        const result = claimOwnership('telegram', userId);
+        if (result.success) {
+            if (result.message === 'claimed') {
+                await ctx.reply(`🔐 **Security Setup Complete!**
+
+✅ You are now the authorized owner of this bot.
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+⚠️  **IMPORTANT SECURITY NOTICE**
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Only YOU can control OpenCode through this bot.
+Other users will be blocked automatically.
+
+Your Telegram ID: \`${userId}\`
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+🚀 **Ready to use!**
+💬 Send me a prompt to start coding
+/help — see all commands
+/status — check OpenCode connection`, { parse_mode: 'Markdown' });
+            }
+            else {
+                // Already owner
+                await ctx.reply(`🚀 OpenCode Remote Control ready
 
 💬 Send me a prompt to start coding
 /help — see all commands
 /status — check OpenCode connection`);
+            }
+        }
+        else {
+            // Already claimed by someone else
+            await ctx.reply(`🚫 **Access Denied**
+
+This bot is already secured by another user.
+
+If you are the owner, check your configuration.`, { parse_mode: 'Markdown' });
+        }
     });
     // Help command
     bot.command('help', async (ctx) => {
@@ -132,9 +169,26 @@ Cannot connect to OpenCode server.
     // Handle all other messages as prompts
     bot.on('message:text', async (ctx) => {
         const text = ctx.message.text;
+        const userId = String(ctx.from?.id);
         // Skip if it's a command (already handled)
         if (text.startsWith('/'))
             return;
+        // Authorization check
+        if (!isAuthorized('telegram', userId)) {
+            if (!hasOwner('telegram')) {
+                await ctx.reply(`🔐 **Authorization Required**
+
+This bot is not yet secured.
+
+Please send /start to claim ownership first.`, { parse_mode: 'Markdown' });
+            }
+            else {
+                await ctx.reply(`🚫 **Access Denied**
+
+You are not authorized to use this bot.`, { parse_mode: 'Markdown' });
+            }
+            return;
+        }
         const threadId = getThreadId(ctx);
         // Send typing indicator
         await ctx.api.sendChatAction(ctx.chat.id, 'typing');
@@ -236,6 +290,24 @@ export async function startBot() {
         console.log('Make sure OpenCode is running');
     }
     console.log('🚀 Starting Telegram bot...');
+    // Show security status
+    const authStatus = getAuthStatus();
+    if (!authStatus.telegram) {
+        console.log('');
+        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+        console.log('  🔐 SECURITY NOTICE');
+        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+        console.log('');
+        console.log('  Bot is NOT yet secured!');
+        console.log('  The FIRST user to send /start will become the owner.');
+        console.log('');
+        console.log('  👉 Open Telegram and send /start to YOUR bot NOW!');
+        console.log('');
+        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    }
+    else {
+        console.log('🔒 Bot is secured (owner authorized)');
+    }
     // Handle graceful shutdown
     const shutdown = async () => {
         console.log('\n🛑 Shutting down Telegram bot...');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-remote-control",
-  "version": "0.2.5",
+  "version": "0.2.8",
   "description": "Control OpenCode from anywhere via Telegram or Feishu",
   "type": "module",
   "bin": {