weflow-cli 1.5.0 → 1.6.0

package/src/core/ntCore.ts

@@ -7,15 +7,19 @@
  */
 import { execFile } from 'child_process'
 import { promisify } from 'util'
-import { existsSync } from 'fs'
-import { join, dirname } from 'path'
-import { fileURLToPath } from 'url'
+import { existsSync, openSync, readSync, closeSync } from 'fs'
+import { join } from 'path'
+import crypto from 'crypto'
 import { configService } from '../services/configService.js'
+import { getPythonCommand } from '../utils/python.js'
+import { createPythonProcessEnv, safeSubprocessError } from '../utils/pythonProcessEnv.js'
+import { resolvePackageRoot } from '../utils/packageRoot.js'
 import type { ChatSession, Message, Contact } from '../types.js'
 
 const execFileAsync = promisify(execFile)
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = dirname(__filename)
+function getPackageRoot(): string {
+  return resolvePackageRoot(import.meta.url)
+}
 
 export interface NtResult {
   success: boolean
@@ -42,6 +46,19 @@ export interface NtScanResult {
   matched?: Array<{ path: string; name: string; salt: string; size: number; wxid: string; key: string }>
 }
 
+interface NtPythonSecrets {
+  dbPath?: string
+  key?: string
+  salt?: string
+  contactDbPath?: string | null
+  contactKey?: string | null
+  contactSalt?: string | null
+  talker?: string
+  ownWxid?: string
+  keyword?: string
+  usernames?: string
+}
+
 export class NtCore {
   private dbPath: string
   private keyHex: string
@@ -81,37 +98,58 @@ export class NtCore {
   }
 
   private get scriptPath(): string {
-    // __dirname = dist/src/core, so ../../.. = package root
-    const pkgRoot = join(__dirname, '..', '..', '..')
-    return join(pkgRoot, 'scripts', 'nt_decrypt.py')
+    return join(getPackageRoot(), 'scripts', 'nt_decrypt.py')
   }
 
-  private async callPython(args: string[]): Promise<any> {
+  private async callPython(args: string[], secrets: NtPythonSecrets = {}): Promise<any> {
+    const values: NtPythonSecrets = {
+      dbPath: this.dbPath,
+      key: this.keyHex,
+      salt: this.saltHex,
+      contactDbPath: this.contactDbPath,
+      contactKey: this.contactKey,
+      contactSalt: this.contactSalt,
+      ...secrets,
+    }
     try {
-      const { stdout } = await execFileAsync('python', [this.scriptPath, ...args], {
+      const { stdout } = await execFileAsync(getPythonCommand(), [this.scriptPath, ...args], {
         timeout: 120_000,
         maxBuffer: 50 * 1024 * 1024,
-        env: { ...process.env, PYTHONIOENCODING: 'utf-8' },
+        env: createPythonProcessEnv({
+          WEFLOW_DB_PATH: values.dbPath,
+          WEFLOW_NT_KEY: values.key,
+          WEFLOW_NT_SALT: values.salt,
+          WEFLOW_CONTACT_DB: values.contactDbPath || undefined,
+          WEFLOW_CONTACT_KEY: values.contactKey || undefined,
+          WEFLOW_CONTACT_SALT: values.contactSalt || undefined,
+          WEFLOW_TALKER: values.talker,
+          WEFLOW_OWN_WXID: values.ownWxid,
+          WEFLOW_QUERY_KEYWORD: values.keyword,
+          WEFLOW_QUERY_USERNAMES: values.usernames,
+        }),
         encoding: 'utf-8',
       })
 
       const lines = stdout.split('\n').filter((l: string) => l.trim())
       for (let i = lines.length - 1; i >= 0; i--) {
         const trimmed = lines[i].trim()
-        if (trimmed.startsWith('{')) {
-          return JSON.parse(trimmed)
+        if (trimmed.startsWith('{"')) {
+          try {
+            return JSON.parse(trimmed)
+          } catch {
+            // Try next line
+          }
         }
       }
       return { error: 'No valid JSON output from Python script' }
     } catch (e: any) {
-      const msg = e?.message || String(e)
-      if (msg.includes('ENOENT') || msg.includes('python')) {
+      if (e?.code === 'ENOENT') {
         return { error: 'Python not found. Install Python and sqlcipher3: pip install sqlcipher3' }
       }
-      if (msg.includes('ETIMEDOUT') || msg.includes('killed')) {
+      if (e?.code === 'ETIMEDOUT' || e?.killed || e?.signal) {
         return { error: 'NT database query timed out' }
       }
-      return { error: `NT database query failed: ${msg}` }
+      return { error: safeSubprocessError(e, 'NT database query failed') }
     }
   }
 
@@ -119,22 +157,23 @@ export class NtCore {
    * Scan memory for NT keys and match to databases.
    * Requires WeChat to be running.
    */
-  static async scan(): Promise<NtScanResult> {
+  static async scan(root?: string): Promise<NtScanResult> {
     try {
-      const pkgRoot = join(__dirname, '..', '..', '..')
-      const scriptPath = join(pkgRoot, 'scripts', 'nt_decrypt.py')
-      const { stdout } = await execFileAsync('python', [scriptPath, 'scan', '--json'], {
+      const scriptPath = join(getPackageRoot(), 'scripts', 'nt_decrypt.py')
+      const scanArgs = ['scan', '--json']
+      const { stdout } = await execFileAsync(getPythonCommand(), [scriptPath, ...scanArgs], {
         timeout: 300_000,
         maxBuffer: 10 * 1024 * 1024,
-        env: { ...process.env, PYTHONIOENCODING: 'utf-8' },
+        env: createPythonProcessEnv(root ? { WEFLOW_SCAN_ROOT: root } : {}),
         encoding: 'utf-8',
       })
 
       const lines = stdout.split('\n').filter((l: string) => l.trim())
       for (let i = lines.length - 1; i >= 0; i--) {
         const trimmed = lines[i].trim()
-        if (trimmed.startsWith('{')) {
-          const result = JSON.parse(trimmed)
+        if (trimmed.startsWith('{"')) {
+          let result: any
+          try { result = JSON.parse(trimmed) } catch { continue }
           if (result.error) {
             return { success: false, error: result.error }
           }
@@ -148,28 +187,64 @@ export class NtCore {
       }
       return { success: false, error: 'Scan produced no valid output' }
     } catch (e: any) {
-      const msg = e?.message || String(e)
-      if (msg.includes('ENOENT') || msg.includes('python')) {
+      if (e?.code === 'ENOENT') {
         return { success: false, error: 'Python not found. Install Python and add to PATH.' }
       }
-      return { success: false, error: `NT scan failed: ${msg}` }
+      return { success: false, error: safeSubprocessError(e, 'NT scan failed') }
     }
   }
 
-  async getSessions(keyword?: string): Promise<NtSessionsResult> {
-    const args: string[] = [
-      'sessions',
-      '--db', this.dbPath,
-      '--key', this.keyHex,
-      '--salt', this.saltHex,
-    ]
-    if (keyword) args.push('--keyword', keyword)
-    if (this.contactDbPath && this.contactKey && this.contactSalt) {
-      args.push('--contact-db', this.contactDbPath)
-      args.push('--contact-key', this.contactKey)
-      args.push('--contact-salt', this.contactSalt)
+  /**
+   * 验证 key+salt 能否真实打开数据库 (读取 sqlite_master 触发解密)。
+   * cannotVerify=true 表示环境问题 (Python/sqlcipher3 缺失) 而非密钥错误。
+   */
+  static async verifyDbKey(dbPath: string, keyHex: string, saltHex: string): Promise<{
+    success: boolean
+    error?: string
+    tables?: number
+    cannotVerify?: boolean
+  }> {
+    const scriptPath = join(getPackageRoot(), 'scripts', 'nt_decrypt.py')
+    let stdout = ''
+    try {
+      const r = await execFileAsync(getPythonCommand(), [scriptPath, 'verify'], {
+        timeout: 60_000,
+        maxBuffer: 1024 * 1024,
+        env: createPythonProcessEnv({
+          WEFLOW_DB_PATH: dbPath,
+          WEFLOW_NT_KEY: keyHex,
+          WEFLOW_NT_SALT: saltHex,
+        }),
+        encoding: 'utf-8',
+      })
+      stdout = r.stdout
+    } catch (e: any) {
+      // 缺 sqlcipher3 等场景: 脚本打印 JSON 后 exit 1
+      stdout = e?.stdout || ''
+      if (!stdout.trim()) {
+        return { success: false, cannotVerify: true, error: safeSubprocessError(e, 'Python 调用失败') }
+      }
+    }
+    const lines = stdout.split('\n').filter((l: string) => l.trim())
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const trimmed = lines[i].trim()
+      if (trimmed.startsWith('{"')) {
+        try {
+          const r = JSON.parse(trimmed)
+          if (r.success === undefined) {
+            // 只有 error 字段 = 环境问题 (如 "需要 sqlcipher3")
+            return { success: false, cannotVerify: true, error: r.error }
+          }
+          return { success: !!r.success, tables: r.tables, error: r.error }
+        } catch { /* try next line */ }
+      }
     }
-    const result = await this.callPython(args)
+    return { success: false, cannotVerify: true, error: 'verify 无有效输出' }
+  }
+
+  async getSessions(keyword?: string): Promise<NtSessionsResult> {
+    const args: string[] = ['sessions']
+    const result = await this.callPython(args, { keyword })
     if (result.error) {
       return { success: false, error: result.error }
     }
@@ -179,22 +254,12 @@ export class NtCore {
   async getMessages(talker: string, limit = 100, offset = 0): Promise<NtMessagesResult> {
     const args: string[] = [
       'messages',
-      '--db', this.dbPath,
-      '--key', this.keyHex,
-      '--salt', this.saltHex,
-      '--talker', talker,
       '--limit', String(limit),
       '--offset', String(offset),
     ]
-    if (this.contactDbPath && this.contactKey && this.contactSalt) {
-      args.push('--contact-db', this.contactDbPath)
-      args.push('--contact-key', this.contactKey)
-      args.push('--contact-salt', this.contactSalt)
-    }
     // Pass own wxid from config for self-message detection
     const ownWxid = configService.get('wxid')
-    if (ownWxid) args.push('--own-wxid', ownWxid)
-    const result = await this.callPython(args)
+    const result = await this.callPython(args, { talker, ownWxid })
     if (result.error) {
       return { success: false, error: result.error }
     }
@@ -204,21 +269,97 @@ export class NtCore {
   async getContacts(keyword?: string, limit = 200): Promise<NtContactsResult> {
     const args: string[] = [
       'contacts',
-      '--db', this.dbPath,
-      '--key', this.keyHex,
-      '--salt', this.saltHex,
       '--limit', String(limit),
     ]
-    if (keyword) args.push('--keyword', keyword)
-    if (this.contactDbPath && this.contactKey && this.contactSalt) {
-      args.push('--contact-db', this.contactDbPath)
-      args.push('--contact-key', this.contactKey)
-      args.push('--contact-salt', this.contactSalt)
-    }
-    const result = await this.callPython(args)
+    const result = await this.callPython(args, { keyword })
     if (result.error) {
       return { success: false, error: result.error }
     }
     return { success: true, contacts: result.contacts || [] }
   }
+
+  // ====== SNS (朋友圈) ======
+
+  /** 查询 SNS 朋友圈时间线 */
+  async getSnsTimeline(snsDbPath: string, snsKey: string, snsSalt: string, opts: {
+    limit?: number; offset?: number; usernames?: string[];
+    keyword?: string; startTime?: number; endTime?: number;
+  } = {}): Promise<{ success: boolean; timeline?: any[]; error?: string }> {
+    const args: string[] = [
+      'sns-timeline',
+      '--limit', String(opts.limit ?? 20),
+      '--offset', String(opts.offset ?? 0),
+    ]
+    if (opts.startTime) args.push('--start-time', String(opts.startTime))
+    if (opts.endTime) args.push('--end-time', String(opts.endTime))
+    const result = await this.callPython(args, {
+      dbPath: snsDbPath,
+      key: snsKey,
+      salt: snsSalt,
+      keyword: opts.keyword,
+      usernames: opts.usernames?.length ? JSON.stringify(opts.usernames) : undefined,
+    })
+    if (result.error) return { success: false, error: result.error }
+    return { success: true, timeline: result.timeline || [] }
+  }
+
+  /** 获取朋友圈中有动态的用户列表 */
+  async getSnsUsernames(snsDbPath: string, snsKey: string, snsSalt: string): Promise<{ success: boolean; usernames?: string[]; error?: string }> {
+    const result = await this.callPython(['sns-usernames'], { dbPath: snsDbPath, key: snsKey, salt: snsSalt })
+    if (result.error) return { success: false, error: result.error }
+    return { success: true, usernames: result.usernames || [] }
+  }
+
+  /** 获取朋友圈统计信息 */
+  async getSnsExportStats(snsDbPath: string, snsKey: string, snsSalt: string, myWxid?: string): Promise<{ success: boolean; data?: { totalPosts: number; totalFriends: number; myPosts: number | null }; error?: string }> {
+    const result = await this.callPython(['sns-stats'], { dbPath: snsDbPath, key: snsKey, salt: snsSalt, ownWxid: myWxid })
+    if (result.error) return { success: false, error: result.error }
+    return { success: true, data: result.data }
+  }
+
+  // ====== 收藏 (favorite.db) ======
+
+  /**
+   * 从全库共用 passphrase 派生某库的 raw key。
+   * 微信 4.x 各库密钥 = PBKDF2-HMAC-SHA512(passphrase, 库salt, 256000轮, 32字节)
+   */
+  static deriveRawKey(passphraseHex: string, saltHex: string): string {
+    const passphrase = Buffer.from(passphraseHex, 'hex')
+    const salt = Buffer.from(saltHex, 'hex')
+    return crypto.pbkdf2Sync(passphrase, salt, 256000, 32, 'sha512').toString('hex')
+  }
+
+  /** 读取数据库文件前 16 字节盐值 */
+  static readDbSalt(dbPath: string): string | null {
+    let fd: number
+    try {
+      fd = openSync(dbPath, 'r')
+    } catch {
+      return null
+    }
+    try {
+      const buf = Buffer.alloc(16)
+      const n = readSync(fd, buf, 0, 16, 0)
+      return n === 16 ? buf.toString('hex') : null
+    } catch {
+      return null
+    } finally {
+      closeSync(fd)
+    }
+  }
+
+  /** 查询收藏列表 (keyHex 为派生后的 raw key) */
+  async getFavorites(favDbPath: string, keyHex: string, opts: {
+    limit?: number; offset?: number; keyword?: string; favType?: number;
+  } = {}): Promise<{ success: boolean; favorites?: any[]; total?: number; error?: string }> {
+    const args: string[] = [
+      'fav-list',
+      '--limit', String(opts.limit ?? 100),
+      '--offset', String(opts.offset ?? 0),
+    ]
+    if (opts.favType != null) args.push('--type', String(opts.favType))
+    const result = await this.callPython(args, { dbPath: favDbPath, key: keyHex, salt: undefined, keyword: opts.keyword })
+    if (result.error) return { success: false, error: result.error }
+    return { success: true, favorites: result.favorites || [], total: result.total ?? 0 }
+  }
 }

package/src/core/sqlcipherCore.ts

@@ -17,9 +17,23 @@ import { existsSync, readFileSync, readdirSync, unlinkSync, mkdirSync, writeFile
 import { join, basename, dirname } from 'path'
 import os from 'os'
 import { DatabaseSync } from 'node:sqlite'
-import lz4 from 'lz4'
+import { createRequire } from 'module'
 import type { ChatSession, Message, Contact } from '../types.js'
 
+const require = createRequire(import.meta.url)
+
+// lz4 是原生模块（仅 3.x WCDB 解压用），懒加载避免非 Windows 平台启动即崩溃
+let lz4Lazy: any = null
+function getLz4(): any {
+  if (lz4Lazy !== null) return lz4Lazy
+  try {
+    lz4Lazy = require('lz4')
+  } catch (e) {
+    lz4Lazy = undefined
+  }
+  return lz4Lazy
+}
+
 const PAGE_SIZE = 4096
 const KEY_SIZE = 32
 const DEFAULT_ITER = 64000
@@ -549,6 +563,8 @@ export class SqlcipherCore {
     if (!buf) return null
 
     try {
+      const lz4 = getLz4()
+      if (!lz4) return null
       const maxSize = buf.length * 256
       const outBuf = Buffer.alloc(maxSize)
       const actualSize = lz4.decodeBlock(buf, outBuf)

package/src/core/wcdbCore.ts

@@ -3586,19 +3586,15 @@ export class WcdbCore {
     if (!this.ensureReady()) {
       return { success: false, error: 'WCDB 未连接' }
     }
+    if (params && params.length > 0) {
+      return { success: false, error: 'PARAMETER_BINDING_UNSUPPORTED' }
+    }
     const startedAt = Date.now()
     try {
       if (!this.wcdbExecQuery) return { success: false, error: '接口未就绪' }
       const fallbackFlag = /fallback|diag|diagnostic/i.test(String(sql || ''))
       this.writeLog(`[audit:execQuery] kind=${kind} path=${path || ''} sql_len=${String(sql || '').length} fallback=${fallbackFlag ? 1 : 0}`)
 
-      // 如果提供了参数，使用参数化查询（需要 C++ 层支持）
-      // 注意：当前 wcdbExecQuery 可能不支持参数化，这是一个占位符实现
-      // TODO: 需要更新 C++ 层的 wcdb_exec_query 以支持参数绑定
-      if (params && params.length > 0) {
-        console.warn('[wcdbCore] execQuery: 参数化查询暂未在 C++ 层实现，将使用原始 SQL（可能存在注入风险）')
-      }
-
       const normalizedKind = String(kind || '').toLowerCase()
       const isContactQuery = normalizedKind === 'contact' || /\bfrom\s+contact\b/i.test(String(sql))
       let effectivePath = path || ''

package/src/services/assistantDaemon.ts

@@ -0,0 +1,111 @@
+/**
+ * 助手守护进程管理 — start(后台常驻) / stop / status / run(前台)
+ * pid 文件: ~/.weflow-cli/assistant.pid, 日志: ~/.weflow-cli/assistant.log
+ */
+import { join } from 'path'
+import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, appendFileSync, statSync } from 'fs'
+import os from 'os'
+import { spawn, type ChildProcess } from 'child_process'
+import { resolvePackageRoot } from '../utils/packageRoot.js'
+import { createPythonProcessEnv } from '../utils/pythonProcessEnv.js'
+
+const DIR = join(os.homedir(), '.weflow-cli')
+const PID_FILE = join(DIR, 'assistant.pid')
+const LOG_FILE = join(DIR, 'assistant.log')
+const MARKER = 'WEFLOW_ASSISTANT_DAEMON=1'
+
+export function isDaemonAlive(): { alive: boolean; pid: number | null } {
+  if (!existsSync(PID_FILE)) return { alive: false, pid: null }
+  try {
+    const pid = parseInt(readFileSync(PID_FILE, 'utf8').trim())
+    // Windows: process.kill(pid, 0) 对不存在进程抛错; 对存在进程返回 undefined
+    process.kill(pid, 0)
+    return { alive: true, pid }
+  } catch {
+    rmSync(PID_FILE, { force: true })
+    return { alive: false, pid: null }
+  }
+}
+
+export function appendLog(line: string): void {
+  try {
+    if (!existsSync(DIR)) mkdirSync(DIR, { recursive: true })
+    appendFileSync(LOG_FILE, line + '\n', 'utf8')
+  } catch { /* 日志失败不阻断 */ }
+}
+
+/** 日志轮转: 超过 1MB 保留尾部 256KB, 防止常驻进程日志无限增长 */
+export function rotateLogIfNeeded(): void {
+  try {
+    if (!existsSync(LOG_FILE)) return
+    if (statSync(LOG_FILE).size < 1024 * 1024) return
+    const buf = readFileSync(LOG_FILE)
+    const tail = buf.subarray(Math.max(0, buf.length - 256 * 1024))
+    const cut = tail.indexOf('\n') // 对齐到行首
+    writeFileSync(LOG_FILE, `--- rotated at ${new Date().toLocaleString('zh-CN')} ---\n` + tail.subarray(cut + 1))
+    appendLog(`[轮转] 日志已截断 (原 ${statSync(LOG_FILE).size} 字节)`)
+  } catch { /* 轮转失败不阻断 */ }
+}
+
+export function tailLog(n = 20): string {
+  try {
+    const lines = readFileSync(LOG_FILE, 'utf8').trim().split('\n')
+    return lines.slice(-n).join('\n')
+  } catch {
+    return '(暂无日志)'
+  }
+}
+
+/** 后台启动守护进程 (detached, 脱离终端生命周期) */
+export function startDaemon(): { started: boolean; pid?: number; error?: string } {
+  const { alive, pid } = isDaemonAlive()
+  if (alive) return { started: false, pid: pid!, error: `已在运行 (pid ${pid})` }
+
+  const packageRoot = resolvePackageRoot(import.meta.url)
+  const compiledEntry = join(packageRoot, 'dist', 'bin', 'weflow-cli.js')
+  const sourceEntry = join(packageRoot, 'bin', 'weflow-cli.ts')
+  const entry = existsSync(compiledEntry) ? compiledEntry : sourceEntry
+
+  if (!existsSync(entry)) return { started: false, error: `入口不存在: ${entry}` }
+
+  try {
+    appendLog(`--- ${new Date().toLocaleString('zh-CN')} daemon starting ---`)
+    const entryArgs = entry === sourceEntry ? ['--import', 'tsx', entry] : [entry]
+    const child: ChildProcess = spawn(process.execPath, [...entryArgs, 'assistant', 'run'], {
+      detached: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: createPythonProcessEnv({ [MARKER]: '1' }),
+      windowsHide: true,
+    })
+
+    // 收集子进程输出写入日志
+    child.stdout?.on('data', (d: Buffer) => appendLog(d.toString().trim()))
+    child.stderr?.on('data', (d: Buffer) => appendLog('[stderr] ' + d.toString().trim()))
+    child.on('exit', (code) => {
+      appendLog(`--- daemon exited (code ${code}) ---`)
+      try { if (existsSync(PID_FILE)) rmSync(PID_FILE, { force: true }) } catch {}
+    })
+
+    if (child.pid) {
+      writeFileSync(PID_FILE, String(child.pid), 'utf8')
+      return { started: true, pid: child.pid }
+    }
+    return { started: false, error: '无法获取子进程 pid' }
+  } catch (e: any) {
+    return { started: false, error: e.message }
+  }
+}
+
+export function stopDaemon(): { stopped: boolean; message: string } {
+  const { alive, pid } = isDaemonAlive()
+  if (!alive) return { stopped: false, message: '守护进程未在运行' }
+  try {
+    // Windows 下 SIGTERM/SIGKILL 等价 terminate
+    process.kill(pid!, 'SIGTERM')
+    rmSync(PID_FILE, { force: true })
+    appendLog(`--- ${new Date().toLocaleString('zh-CN')} daemon stopped manually ---`)
+    return { stopped: true, message: `已停止 (pid ${pid})` }
+  } catch (e: any) {
+    return { stopped: false, message: `停止失败: ${e.message}` }
+  }
+}