weflow-cli 1.5.0 → 1.6.0

package/src/core/dbPathService.ts

@@ -1,5 +1,5 @@
-import { join, basename } from 'path'
-import { existsSync, readdirSync, statSync, readFileSync } from 'fs'
+import { join, basename, dirname } from 'path'
+import { existsSync, readdirSync, statSync, lstatSync, readFileSync } from 'fs'
 import { homedir } from 'os'
 import { createDecipheriv } from 'crypto'
 import { expandHomePath } from '../utils/pathUtils.js'
@@ -12,6 +12,100 @@ export interface WxidInfo {
 }
 
 export class DbPathService {
+  /**
+   * Validate a user-selected WeChat data location. WeChat's picker may expose
+   * either the data root, an account folder, or that account's db_storage.
+   */
+  resolveDataRoot(inputPath: string): string | null {
+    const rootPath = expandHomePath(inputPath)
+    if (!rootPath || !existsSync(rootPath)) return null
+
+    const ancestorPath = this.findAccountAncestor(rootPath)
+    if (ancestorPath) return dirname(ancestorPath)
+
+    const descendantPath = this.findAccountDescendant(rootPath, 3)
+    if (descendantPath) {
+      return dirname(descendantPath)
+    }
+
+    return null
+  }
+
+  private findAccountAncestor(inputPath: string): string | null {
+    let currentPath = inputPath
+    for (let level = 0; level <= 4; level++) {
+      if (this.isAccountDir(currentPath)) return currentPath
+      const parentPath = dirname(currentPath)
+      if (parentPath === currentPath) break
+      currentPath = parentPath
+    }
+    return null
+  }
+
+  private findAccountDescendant(rootPath: string, maxDepth: number): string | null {
+    if (maxDepth < 0) return null
+    if (this.isAccountDir(rootPath)) return rootPath
+
+    try {
+      for (const entry of readdirSync(rootPath)) {
+        const entryPath = join(rootPath, entry)
+        let stat: ReturnType<typeof statSync>
+        try {
+          if (lstatSync(entryPath).isSymbolicLink()) continue
+          stat = statSync(entryPath)
+        } catch {
+          continue
+        }
+        if (!stat.isDirectory()) continue
+        if (this.shouldSkipSearchDirectory(entry)) continue
+        const accountPath = this.findAccountDescendant(entryPath, maxDepth - 1)
+        if (accountPath) return accountPath
+      }
+    } catch { }
+
+    return null
+  }
+
+  private shouldSkipSearchDirectory(name: string): boolean {
+    return [
+      '$recycle.bin', 'node_modules', 'windows', 'program files',
+      'program files (x86)', 'programdata', 'system volume information',
+    ].includes(name.toLowerCase())
+  }
+
+  private findKnownDataRoots(basePath: string, maxDepth: number): string[] {
+    const roots: string[] = []
+    const visit = (currentPath: string, depth: number): void => {
+      if (depth > maxDepth) return
+      let entries: string[]
+      try {
+        entries = readdirSync(currentPath)
+      } catch {
+        return
+      }
+
+      for (const entry of entries) {
+        const entryPath = join(currentPath, entry)
+        try {
+          if (lstatSync(entryPath).isSymbolicLink()) continue
+        } catch {
+          continue
+        }
+        if (!this.isDirectory(entryPath)) continue
+        const lower = entry.toLowerCase()
+        if (lower === 'xwechat_files' || lower === 'wechat files') {
+          roots.push(entryPath)
+          continue
+        }
+        if (depth < maxDepth && !this.shouldSkipSearchDirectory(lower) && lower !== 'appdata') {
+          visit(entryPath, depth + 1)
+        }
+      }
+    }
+    if (this.isDirectory(basePath)) visit(basePath, 0)
+    return roots
+  }
+
   private readVarint(buf: Buffer, offset: number): { value: number, length: number } {
     let value = 0;
     let length = 0;
@@ -89,7 +183,7 @@ export class DbPathService {
   /**
    * 自动检测微信数据库根目录
    */
-  async autoDetect(): Promise<{ success: boolean; path?: string; error?: string }> {
+  async autoDetect(options: { searchDrives?: boolean; fullScan?: boolean } = {}): Promise<{ success: boolean; path?: string; error?: string }> {
     try {
       const possiblePaths: string[] = []
       const home = homedir()
@@ -110,6 +204,12 @@ export class DbPathService {
         }
         // macOS 旧路径兜底
         possiblePaths.push(join(home, 'Library', 'Containers', 'com.tencent.xinWeChat', 'Data', 'Documents', 'xwechat_files'))
+      } else if (process.platform === 'linux') {
+        // Linux 原生微信 4.x：数据结构与 Windows 相同（xwechat_files），XDG 文档目录随 locale 变化
+        possiblePaths.push(join(home, '.local', 'share', 'xwechat_files'))
+        possiblePaths.push(join(home, 'xwechat_files'))
+        possiblePaths.push(join(home, 'Documents', 'xwechat_files'))
+        possiblePaths.push(join(home, '文档', 'xwechat_files'))
       } else {
         // Windows: 优先检测 NT 格式 (xwechat_files)
         possiblePaths.push(join(home, 'xwechat_files'))
@@ -117,20 +217,36 @@ export class DbPathService {
         possiblePaths.push(join(home, 'Documents', 'xwechat_files'))
         // Windows 微信3.x 数据目录
         possiblePaths.push(join(home, 'Documents', 'WeChat Files'))
+        for (const basePath of [
+          process.env.LOCALAPPDATA,
+          process.env.APPDATA,
+          process.env.USERPROFILE,
+          process.env.OneDrive,
+        ]) {
+          if (basePath) possiblePaths.push(...this.findKnownDataRoots(basePath, 3))
+        }
       }
 
       for (const path of possiblePaths) {
-        if (!existsSync(path)) continue
+        const dataRoot = this.resolveDataRoot(path)
+        if (dataRoot) {
+          return { success: true, path: dataRoot }
+        }
+      }
 
-        // 检查是否有有效的账号目录，或本身就是账号目录
-        const accounts = this.findAccountDirs(path)
-        if (accounts.length > 0) {
-          return { success: true, path }
+      if (process.platform === 'win32' && (options.searchDrives || options.fullScan)) {
+        for (const volumeRoot of this.getVolumeRoots()) {
+          for (const dataRootPath of this.findKnownDataRoots(volumeRoot, 12)) {
+            const dataRoot = this.resolveDataRoot(dataRootPath)
+            if (dataRoot) return { success: true, path: dataRoot }
+          }
         }
+      }
 
-        // 如果该目录本身就是账号目录（直接包含 db_storage 等）
-        if (this.isAccountDir(path)) {
-          return { success: true, path }
+      if (options.fullScan) {
+        for (const volumeRoot of this.getVolumeRoots()) {
+          const accountPath = this.findAccountDescendant(volumeRoot, 32)
+          if (accountPath) return { success: true, path: dirname(accountPath) }
         }
       }
 
@@ -175,13 +291,31 @@ export class DbPathService {
 
   private isAccountDir(entryPath: string): boolean {
     return (
-      existsSync(join(entryPath, 'db_storage')) ||  // WeChat 4.x
-      existsSync(join(entryPath, 'Msg')) ||          // WeChat 3.x
-      existsSync(join(entryPath, 'FileStorage', 'Image')) ||
-      existsSync(join(entryPath, 'FileStorage', 'Image2'))
+      this.isDirectory(join(entryPath, 'db_storage')) ||  // WeChat 4.x
+      this.isDirectory(join(entryPath, 'Msg')) ||          // WeChat 3.x
+      this.isDirectory(join(entryPath, 'FileStorage', 'Image')) ||
+      this.isDirectory(join(entryPath, 'FileStorage', 'Image2'))
     )
   }
 
+  private getVolumeRoots(): string[] {
+    if (process.platform !== 'win32') return [homedir()]
+    const roots: string[] = []
+    for (let code = 65; code <= 90; code++) {
+      const volumeRoot = `${String.fromCharCode(code)}:\\`
+      if (this.isDirectory(volumeRoot)) roots.push(volumeRoot)
+    }
+    return roots
+  }
+
+  private isDirectory(entryPath: string): boolean {
+    try {
+      return statSync(entryPath).isDirectory()
+    } catch {
+      return false
+    }
+  }
+
   private isPotentialAccountName(name: string): boolean {
     const lower = name.toLowerCase()
     if (lower.startsWith('all') || lower.startsWith('applet') || lower.startsWith('backup') || lower.startsWith('wmpf')) {
@@ -223,7 +357,7 @@ export class DbPathService {
    * 扫描目录名候选（仅包含下划线的文件夹，排除 all_users）
    */
   scanWxidCandidates(rootPath: string): WxidInfo[] {
-    const resolvedRootPath = expandHomePath(rootPath)
+    const resolvedRootPath = this.resolveDataRoot(rootPath) || expandHomePath(rootPath)
     const wxids: WxidInfo[] = []
 
     try {
@@ -237,6 +371,7 @@ export class DbPathService {
           const lower = entry.toLowerCase()
           if (lower === 'all_users') continue
           if (!entry.includes('_')) continue
+          if (!this.isAccountDir(entryPath)) continue
           wxids.push({ wxid: entry, modifiedTime: stat.mtimeMs })
         }
       }
@@ -244,7 +379,7 @@ export class DbPathService {
 
       if (wxids.length === 0) {
         const rootName = basename(resolvedRootPath)
-        if (rootName.includes('_') && rootName.toLowerCase() !== 'all_users') {
+        if (rootName.includes('_') && rootName.toLowerCase() !== 'all_users' && this.isAccountDir(resolvedRootPath)) {
           const rootStat = statSync(resolvedRootPath)
           wxids.push({ wxid: rootName, modifiedTime: rootStat.mtimeMs })
         }
@@ -274,7 +409,7 @@ export class DbPathService {
    * 扫描 wxid 列表
    */
   scanWxids(rootPath: string): WxidInfo[] {
-    const resolvedRootPath = expandHomePath(rootPath)
+    const resolvedRootPath = this.resolveDataRoot(rootPath) || expandHomePath(rootPath)
     const wxids: WxidInfo[] = []
 
     try {
@@ -332,6 +467,16 @@ export class DbPathService {
       // 旧版本路径兜底
       return join(home, 'Library', 'Containers', 'com.tencent.xinWeChat', 'Data', 'Documents', 'xwechat_files')
     }
+    if (process.platform === 'linux') {
+      for (const p of [
+        join(home, '.local', 'share', 'xwechat_files'),
+        join(home, 'xwechat_files'),
+        join(home, 'Documents', 'xwechat_files'),
+        join(home, '文档', 'xwechat_files'),
+      ]) {
+        if (existsSync(p)) return p
+      }
+    }
     // 优先返回 4.x 路径
     const xwechatPath = join(home, 'Documents', 'xwechat_files')
     if (existsSync(xwechatPath)) return xwechatPath

package/src/core/keyService.ts

@@ -1,13 +1,23 @@
 import { join } from 'path'
 import { existsSync, copyFileSync, mkdirSync } from 'fs'
-import { execFile, execSync } from 'child_process'
+import { execFile } from 'child_process'
 import { promisify } from 'util'
 import { createRequire } from 'module'
 import os from 'os'
 import type { DbKeyResult } from '../types.js'
+import { configService } from '../services/configService.js'
+import { getPythonCommand } from '../utils/python.js'
+import { createPythonProcessEnv } from '../utils/pythonProcessEnv.js'
+import { resolvePackageRoot } from '../utils/packageRoot.js'
 
 const require = createRequire(import.meta.url)
 const execFileAsync = promisify(execFile)
+const PACKAGE_ROOT = resolvePackageRoot(import.meta.url)
+
+/** 基于模块位置定位包根目录（全局安装时 process.cwd() 不可靠） */
+function resolveScriptPath(scriptName: string): string {
+  return join(PACKAGE_ROOT, 'scripts', scriptName)
+}
 
 export class KeyService {
   private koffi: any = null
@@ -26,6 +36,8 @@ export class KeyService {
   private QueryFullProcessImageNameW: any = null
 
   private readonly PROCESS_ALL_ACCESS = 0x1F0FFF
+  private readonly PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
+  private readonly exitedPids = new Set<number>()
 
   private getDllPath(): string {
     const archDir = process.arch === 'arm64' ? 'arm64' : 'x64'
@@ -35,10 +47,15 @@ export class KeyService {
       candidates.push(process.env.WX_KEY_DLL_PATH)
     }
 
+    // 基于模块位置定位（全局安装时 cwd 不是包根）
+    candidates.push(join(PACKAGE_ROOT, 'resources', 'key', 'win32', archDir, 'wx_key.dll'))
+    candidates.push(join(PACKAGE_ROOT, 'resources', 'key', 'win32', 'x64', 'wx_key.dll'))
+    candidates.push(join(PACKAGE_ROOT, 'resources', 'key', 'win32', 'wx_key.dll'))
+    candidates.push(join(PACKAGE_ROOT, 'resources', 'wx_key.dll'))
+
+    // cwd 兜底（开发模式在项目根运行）
     const cwd = process.cwd()
     candidates.push(join(cwd, 'resources', 'key', 'win32', archDir, 'wx_key.dll'))
-    candidates.push(join(cwd, 'resources', 'key', 'win32', 'x64', 'wx_key.dll'))
-    candidates.push(join(cwd, 'resources', 'key', 'win32', 'wx_key.dll'))
     candidates.push(join(cwd, 'resources', 'wx_key.dll'))
 
     for (const path of candidates) {
@@ -139,7 +156,7 @@ export class KeyService {
         const parts = line.split('","').map((p) => p.replace(/^"|"$/g, ''))
         if (parts[0]?.toLowerCase() === imageName.toLowerCase()) {
           const pid = Number(parts[1])
-          if (!Number.isNaN(pid)) return pid
+          if (!Number.isNaN(pid) && await this.isProcessRunning(pid)) return pid
         }
       }
       return null
@@ -148,6 +165,20 @@ export class KeyService {
     }
   }
 
+  private async isProcessRunning(pid: number): Promise<boolean> {
+    if (this.exitedPids.has(pid)) return false
+    try {
+      const command = `$process = Get-Process -Id ${pid} -ErrorAction SilentlyContinue; if ($process -and -not $process.HasExited) { 'running' }`
+      const { stdout } = await execFileAsync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', command])
+      const running = stdout.trim() === 'running'
+      if (!running) this.exitedPids.add(pid)
+      return running
+    } catch {
+      this.exitedPids.add(pid)
+      return false
+    }
+  }
+
   async findWeChatPid(): Promise<number | null> {
     const names = ['Weixin.exe', 'WeChat.exe']
     for (const name of names) {
@@ -159,7 +190,7 @@ export class KeyService {
 
   private async getProcessExecutablePath(pid: number): Promise<string | null> {
     if (!this.ensureKernel32()) return null
-    const hProcess = this.OpenProcess(0x1000, false, pid)
+    const hProcess = this.OpenProcess(this.PROCESS_QUERY_LIMITED_INFORMATION, false, pid)
     if (!hProcess) return null
 
     try {
@@ -215,7 +246,7 @@ export class KeyService {
       return { success: false, error: '等待超时，未检测到微信进程' }
     }
 
-    onStatus?.(`检测到微信进程 (PID: ${pid})，立即 hook...`)
+    onStatus?.('检测到微信进程，正在准备初始化...')
     return this.extractKeyFromPid(pid, logs, onStatus)
   }
 
@@ -244,8 +275,8 @@ export class KeyService {
       return { success: false, error: '未找到微信进程，请先启动微信并登录' }
     }
 
-    onStatus?.(`检测到微信进程 (PID: ${pid})，正在提取 key...`)
-    return this.extractKeyFromPid(pid, logs, onStatus)
+    onStatus?.('检测到微信进程，正在准备初始化...')
+    return this.extractKeyFromPid(pid, logs, onStatus, timeoutMs)
   }
 
   private async extractKeyFromPid(
@@ -254,7 +285,7 @@ export class KeyService {
     onStatus?: (message: string) => void,
     timeoutMs = 90_000
   ): Promise<DbKeyResult> {
-
+    onStatus?.('正在安装本地访问组件...')
     const ok = this.initHook(pid)
     if (!ok) {
       const error = this.getLastErrorMsg ? this.decodeCString(this.getLastErrorMsg()) : ''
@@ -262,11 +293,13 @@ export class KeyService {
         if (error.includes('0xC0000022') || error.includes('ACCESS_DENIED')) {
           return { success: false, error: '权限不足，请以管理员身份运行 CLI' }
         }
-        return { success: false, error }
+        return { success: false, error: '本地访问组件初始化失败' }
       }
       return { success: false, error: '初始化 Hook 失败' }
     }
 
+    onStatus?.('本地访问组件已就绪，等待数据库初始化事件...')
+
     const keyBuffer = Buffer.alloc(128)
     const start = Date.now()
     let pollCount = 0
@@ -277,27 +310,19 @@ export class KeyService {
         const pollResult = this.pollKeyData(keyBuffer, keyBuffer.length)
         if (pollResult) {
           const key = this.decodeUtf8(keyBuffer)
-          onStatus?.(`[调试] pollKeyData=true, key长度=${key.length}, 内容=${key.slice(0, 20)}...`)
           if (key.length === 64) {
             onStatus?.('密钥获取成功!')
             return { success: true, key, logs }
           }
-        } else if (pollCount <= 5 || pollCount % 20 === 0) {
-          // 前5次和每20次输出一次调试信息
-          const hexSample = keyBuffer.slice(0, 16).toString('hex')
-          onStatus?.(`[调试] poll #${pollCount}: pollResult=${pollResult}, buffer=${hexSample}`)
+        } else if (pollCount % 100 === 0) {
+          onStatus?.('仍在等待数据库初始化事件...')
         }
 
-        // 读取状态消息
+        // Drain native status messages without forwarding process details to the terminal.
         for (let i = 0; i < 5; i++) {
           const statusBuffer = Buffer.alloc(256)
           const levelOut = [0]
           if (!this.getStatusMessage(statusBuffer, statusBuffer.length, levelOut)) break
-          const msg = this.decodeUtf8(statusBuffer)
-          if (msg) {
-            logs.push(msg)
-            onStatus?.(msg)
-          }
         }
 
         await new Promise(resolve => setTimeout(resolve, 120))
@@ -306,7 +331,94 @@ export class KeyService {
       try { this.cleanupHook() } catch { }
     }
 
-    return { success: false, error: '获取密钥超时，请确保微信已登录', logs }
+    return { success: false, error: '等待超时，未观察到数据库初始化事件', logs }
+  }
+
+  /**
+   * 捕获 sns.db 解密密钥。通过 Hook 微信数据库打开操作，
+   * 捕获 sns.db 被访问时的密钥并测试匹配。
+   */
+  async captureSnsKey(
+    timeoutMs = 30000,
+    snsDbPath: string,
+    onStatus?: (message: string) => void
+  ): Promise<DbKeyResult> {
+    if (process.platform !== 'win32') {
+      return { success: false, error: '朋友圈密钥捕获仅支持 Windows（依赖进程 Hook）' }
+    }
+    if (!this.ensureLoaded()) {
+      return { success: false, error: 'wx_key.dll 未加载，请确保 resources/key/ 目录存在' }
+    }
+
+    const pid = await this.findWeChatPid()
+    if (!pid) {
+      return { success: false, error: '未找到微信进程 (Weixin.exe)，请确保微信已登录' }
+    }
+
+    const ok = this.initHook(pid)
+    if (!ok) {
+      const error = this.getLastErrorMsg ? this.decodeCString(this.getLastErrorMsg()) : ''
+      if (error) return { success: false, error }
+      return { success: false, error: '初始化 Hook 失败，请以管理员身份运行' }
+    }
+
+    onStatus?.('本地访问组件已就绪，等待数据库访问...')
+
+    const keyBuffer = Buffer.alloc(128)
+    const capturedKeys = new Set<string>()
+    const start = Date.now()
+
+    try {
+      while (Date.now() - start < timeoutMs) {
+        const pollResult = this.pollKeyData(keyBuffer, keyBuffer.length)
+        if (pollResult) {
+          const key = this.decodeUtf8(keyBuffer)
+          if (key.length === 64 && !capturedKeys.has(key)) {
+            capturedKeys.add(key)
+            onStatus?.('捕获到密钥，正在测试 sns.db...')
+
+            // Test against sns.db using Python
+            const snsSalt = configService.get('snsSalt')
+            try {
+              const scriptPath = resolveScriptPath('nt_decrypt.py')
+              const { stdout } = await execFileAsync(getPythonCommand(), [
+                scriptPath, 'sns-stats',
+              ], {
+                timeout: 15000, encoding: 'utf8',
+                env: createPythonProcessEnv({
+                  WEFLOW_DB_PATH: snsDbPath,
+                  WEFLOW_NT_KEY: key,
+                  WEFLOW_NT_SALT: snsSalt || '00000000000000000000000000000000',
+                }),
+              })
+
+              const lines = stdout.trim().split('\n')
+              const result = JSON.parse(lines[lines.length - 1] || '{}')
+              if (result.success) {
+                return { success: true, key }
+              }
+            } catch {
+              // Test fails for this key, continue polling
+            }
+          }
+        }
+
+        // Read status
+        for (let i = 0; i < 2; i++) {
+          const statusBuffer = Buffer.alloc(256)
+          const levelOut = [0]
+          if (!this.getStatusMessage(statusBuffer, statusBuffer.length, levelOut)) break
+          const msg = this.decodeUtf8(statusBuffer)
+          if (msg) onStatus?.(msg)
+        }
+
+        await new Promise(resolve => setTimeout(resolve, 200))
+      }
+    } finally {
+      try { this.cleanupHook() } catch { }
+    }
+
+    return { success: false, error: `超时 (${timeoutMs / 1000}s)，未捕获到 sns.db 的密钥。请确保在微信中打开了朋友圈` }
   }
 
   /**
@@ -339,16 +451,16 @@ export class KeyService {
       return { success: false, error: '未找到 WeChat 3.x (WeChat.exe) 进程，请先启动 3.x 微信并登录' }
     }
 
-    onStatus?.(`找到 3.x 进程 (PID: ${pid})，正在通过内存搜索提取密钥...`)
+    onStatus?.('检测到 3.x 微信进程，正在准备初始化...')
 
     try {
-      const scriptPath = join(process.cwd(), 'scripts', 'extract_3x_key.py')
+      const scriptPath = resolveScriptPath('extract_3x_key.py')
 
       if (!existsSync(scriptPath)) {
         return { success: false, error: `Python 脚本不存在: ${scriptPath}` }
       }
 
-      const { stdout } = await execFileAsync('python', [scriptPath], {
+      const { stdout } = await execFileAsync(getPythonCommand(), [scriptPath], {
         timeout: 120_000,
         maxBuffer: 1024 * 1024
       })