woodenfish-bot 4.4.4 → 4.4.6

package/es/index.js

@@ -1,10 +1,11 @@
+import _asyncToGenerator from '@babel/runtime/helpers/asyncToGenerator';
 import _classCallCheck from '@babel/runtime/helpers/classCallCheck';
 import _createClass from '@babel/runtime/helpers/createClass';
 import _defineProperty from '@babel/runtime/helpers/defineProperty';
+import _regeneratorRuntime from '@babel/runtime/regenerator';
 import resty from 'resty-client';
-import _asyncToGenerator from '@babel/runtime/helpers/asyncToGenerator';
 import _typeof from '@babel/runtime/helpers/typeof';
-import _regeneratorRuntime from '@babel/runtime/regenerator';
+import _slicedToArray from '@babel/runtime/helpers/slicedToArray';
 import fs from 'fs';
 import https from 'https';
 import _possibleConstructorReturn from '@babel/runtime/helpers/possibleConstructorReturn';
@@ -297,7 +298,7 @@ var Guild = /*#__PURE__*/function () {
   }]);
 }();
 
-var version = "4.4.4";
+var version = "4.4.6";
 
 function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
@@ -677,6 +678,45 @@ log.setLevel('info');
 log.setLevel('trace');
 var BotLogger = log;
 
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: true } : { done: false, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = true, u = false; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = true, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+
+// 全局token刷新锁，避免并发刷新
+var tokenRefreshPromises = new Map();
+
+// 定期清理可能遗留的Promise（防止内存泄漏）
+setInterval(function () {
+  var now = Date.now();
+  var keysToDelete = [];
+  var _iterator = _createForOfIteratorHelper(tokenRefreshPromises.entries()),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var _step$value = _slicedToArray(_step.value, 2),
+        key = _step$value[0],
+        _step$value$ = _step$value[1],
+        promise = _step$value$.promise,
+        timestamp = _step$value$.timestamp;
+      // 如果Promise已经存在超过5分钟，可能出现了问题，清理掉
+      if (now - timestamp > 5 * 60 * 1000) {
+        keysToDelete.push(key);
+        console.warn("\u6E05\u7406\u8D85\u65F6\u7684token\u5237\u65B0Promise (key: ".concat(key, ", \u5B58\u5728\u65F6\u95F4: ").concat((now - timestamp) / 1000, "s)"));
+      }
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  keysToDelete.forEach(function (key) {
+    return tokenRefreshPromises["delete"](key);
+  });
+  if (keysToDelete.length > 0) {
+    console.log("\u6E05\u7406\u4E86 ".concat(keysToDelete.length, " \u4E2A\u8D85\u65F6\u7684token\u5237\u65B0Promise"));
+  }
+}, 60000); // 每分钟清理一次
+
 // 转为对象
 var toObject = function toObject(data) {
   if (Buffer.isBuffer(data)) return JSON.parse(data.toString());
@@ -755,17 +795,40 @@ function getAccessToken(access_token_file, url, data, appID) {
   });
 }
 
-// 添加 User-Agent
-var addAuthorization = /*#__PURE__*/function () {
-  var _ref = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(header, appID, token, clientSecret, apiVersion) {
-    var now_time, url, data, access_token_file, default_token_json, access_token, expires_in, access_token_json;
+// 等待Promise完成，带超时机制
+var waitForPromiseWithTimeout = /*#__PURE__*/function () {
+  var _ref = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(promise) {
+    var timeoutMs,
+      timeoutPromise,
+      _args = arguments;
     return _regeneratorRuntime.wrap(function (_context) {
       while (1) switch (_context.prev = _context.next) {
         case 0:
-          if (!(apiVersion == 'v2')) {
-            _context.next = 3;
-            break;
-          }
+          timeoutMs = _args.length > 1 && _args[1] !== undefined ? _args[1] : 10000;
+          timeoutPromise = new Promise(function (_, reject) {
+            setTimeout(function () {
+              return reject(new Error("Token refresh timeout after ".concat(timeoutMs, "ms")));
+            }, timeoutMs);
+          });
+          return _context.abrupt("return", Promise.race([promise, timeoutPromise]));
+        case 1:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee);
+  }));
+  return function waitForPromiseWithTimeout(_x) {
+    return _ref.apply(this, arguments);
+  };
+}();
+
+// 获取或刷新token（带并发控制和超时保护）
+var getOrRefreshToken = /*#__PURE__*/function () {
+  var _ref2 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(appID, clientSecret) {
+    var now_time, url, data, access_token_file, access_token, expires_in, needsRefresh, access_token_json, expiresStr, parsed, default_token_json, key, existingEntry, refreshPromise, _t2;
+    return _regeneratorRuntime.wrap(function (_context3) {
+      while (1) switch (_context3.prev = _context3.next) {
+        case 0:
           now_time = getTimeStampNumber();
           url = 'https://bots.qq.com/app/getAppAccessToken';
           data = {
@@ -773,55 +836,149 @@ var addAuthorization = /*#__PURE__*/function () {
             clientSecret: clientSecret
           };
           access_token_file = './access_token.json';
-          default_token_json = {
-            bot: _defineProperty({}, appID, {
-              access_token: "",
-              expires_in: ""
-            })
-          };
           access_token = '';
           expires_in = 0;
+          needsRefresh = false; // 首先读取当前token状态
           try {
-            // 判断文件是否存在
             if (fs.existsSync(access_token_file)) {
-              // 执行文件存在时的处理逻辑
-              access_token_json = JSON.parse(fs.readFileSync(access_token_file).toString()); // 判断是否存在appID
+              access_token_json = JSON.parse(fs.readFileSync(access_token_file).toString());
               if (access_token_json.hasOwnProperty('bot') && access_token_json['bot'].hasOwnProperty(appID)) {
                 access_token = access_token_json['bot'][appID]['access_token'];
-                expires_in = parseInt(access_token_json['bot'][appID]['expires_in']);
+                expiresStr = access_token_json['bot'][appID]['expires_in'];
+                if (expiresStr && typeof expiresStr === 'string') {
+                  parsed = parseInt(expiresStr);
+                  if (!isNaN(parsed) && parsed > 0) {
+                    expires_in = parsed;
+                  } else {
+                    console.log('expires_in解析失败，重置为0:', expiresStr);
+                    expires_in = 0;
+                  }
+                } else {
+                  expires_in = 0;
+                }
               }
             } else {
-              // 执行文件不存在时的处理逻辑
+              default_token_json = {
+                bot: _defineProperty({}, appID, {
+                  access_token: "",
+                  expires_in: ""
+                })
+              };
               fs.writeFileSync(access_token_file, JSON.stringify(default_token_json, null, 2), 'utf-8');
+              needsRefresh = true;
             }
           } catch (err) {
             console.error('读取文件时发生错误:', err);
+            expires_in = 0;
+            needsRefresh = true;
           }
-          // 判断access_token是否存在，不存在或者已经过期就重新获取
-          if (!(access_token === '' || now_time > expires_in - 50)) {
-            _context.next = 2;
+
+          // 如果token有效且不需要刷新，直接返回
+          if (!(access_token !== '' && now_time <= expires_in - 50 && !needsRefresh)) {
+            _context3.next = 1;
             break;
           }
-          console.log('access_token', access_token, 'expire_time', expires_in);
-          _context.next = 1;
-          return getAccessToken(access_token_file, url, data, appID);
+          return _context3.abrupt("return", access_token);
         case 1:
-          access_token = _context.sent;
-        case 2:
+          // 需要刷新token，进入并发控制逻辑
+          key = "".concat(appID, ":").concat(clientSecret);
+          existingEntry = tokenRefreshPromises.get(key);
+          if (!existingEntry) {
+            _context3.next = 5;
+            break;
+          }
+          _context3.prev = 2;
+          // 等待已有的刷新完成，但设置超时防止无限等待
+          console.log("\u7B49\u5F85\u5DF2\u6709\u7684token\u5237\u65B0\u5B8C\u6210 (appID: ".concat(appID, ")"));
+          _context3.next = 3;
+          return waitForPromiseWithTimeout(existingEntry.promise, 10000);
+        case 3:
+          return _context3.abrupt("return", _context3.sent);
+        case 4:
+          _context3.prev = 4;
+          _t2 = _context3["catch"](2);
+          console.warn("\u7B49\u5F85token\u5237\u65B0\u8D85\u65F6\u6216\u5931\u8D25\uFF0C\u91CD\u65B0\u53D1\u8D77\u5237\u65B0 (appID: ".concat(appID, "):"), _t2);
+          // 移除失败的Promise，让新的请求可以重新发起刷新
+          tokenRefreshPromises["delete"](key);
+        case 5:
+          // 创建新的刷新Promise
+          refreshPromise = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2() {
+            var new_token, _t;
+            return _regeneratorRuntime.wrap(function (_context2) {
+              while (1) switch (_context2.prev = _context2.next) {
+                case 0:
+                  _context2.prev = 0;
+                  console.log('开始刷新access_token - 当前token:', access_token, '过期时间:', expires_in, '当前时间:', now_time);
+                  _context2.next = 1;
+                  return getAccessToken(access_token_file, url, data, appID);
+                case 1:
+                  new_token = _context2.sent;
+                  console.log('access_token刷新成功，新token:', new_token);
+                  return _context2.abrupt("return", new_token);
+                case 2:
+                  _context2.prev = 2;
+                  _t = _context2["catch"](0);
+                  console.error("Token\u5237\u65B0\u5931\u8D25 (appID: ".concat(appID, "):"), _t);
+                  throw _t;
+                case 3:
+                  _context2.prev = 3;
+                  // 刷新完成后移除Promise
+                  tokenRefreshPromises["delete"](key);
+                  return _context2.finish(3);
+                case 4:
+                case "end":
+                  return _context2.stop();
+              }
+            }, _callee2, null, [[0, 2, 3, 4]]);
+          }))(); // 存储Promise和时间戳以便其他并发请求使用和超时清理
+          tokenRefreshPromises.set(key, {
+            promise: refreshPromise,
+            timestamp: Date.now()
+          });
+          _context3.next = 6;
+          return refreshPromise;
+        case 6:
+          return _context3.abrupt("return", _context3.sent);
+        case 7:
+        case "end":
+          return _context3.stop();
+      }
+    }, _callee3, null, [[2, 4]]);
+  }));
+  return function getOrRefreshToken(_x2, _x3) {
+    return _ref2.apply(this, arguments);
+  };
+}();
+
+// 添加 User-Agent
+var addAuthorization = /*#__PURE__*/function () {
+  var _ref4 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4(header, appID, token, clientSecret, apiVersion) {
+    var access_token;
+    return _regeneratorRuntime.wrap(function (_context4) {
+      while (1) switch (_context4.prev = _context4.next) {
+        case 0:
+          if (!(apiVersion == 'v2')) {
+            _context4.next = 2;
+            break;
+          }
+          _context4.next = 1;
+          return getOrRefreshToken(appID, clientSecret);
+        case 1:
+          access_token = _context4.sent;
           // 更新header['Authorization']
           header['Authorization'] = "QQBot ".concat(access_token);
-          _context.next = 4;
+          _context4.next = 3;
           break;
-        case 3:
+        case 2:
           header['Authorization'] = "Bot ".concat(appID, ".").concat(token);
-        case 4:
+        case 3:
         case "end":
-          return _context.stop();
+          return _context4.stop();
       }
-    }, _callee);
+    }, _callee4);
   }));
-  return function addAuthorization(_x, _x2, _x3, _x4, _x5) {
-    return _ref.apply(this, arguments);
+  return function addAuthorization(_x4, _x5, _x6, _x7, _x8) {
+    return _ref4.apply(this, arguments);
   };
 }();
 // 组装完整Url
@@ -1966,41 +2123,78 @@ var OpenAPI = /*#__PURE__*/function () {
     // 基础rest请求
   }, {
     key: "request",
-    value: function request(options) {
-      var _this$config = this.config,
-        appID = _this$config.appID,
-        token = _this$config.token,
-        clientSecret = _this$config.clientSecret;
-      options.headers = _objectSpread({}, options.headers);
-      var apiVersion = options.apiVersion || 'v2';
-      // 添加 UA
-      addUserAgent(options.headers, appID, apiVersion);
-      // 添加鉴权信息
-      addAuthorization(options.headers, appID, token, clientSecret, apiVersion);
-      // 组装完整Url
-      var botUrl = buildUrl(options.url, this.config.sandbox);
-
-      // 简化错误信息，后续可考虑通过中间件形式暴露给用户自行处理
-      resty.useRes(function (result) {
-        return result;
-      }, function (error) {
-        var _error$response, _error$response2;
-        var traceid = error === null || error === void 0 || (_error$response = error.response) === null || _error$response === void 0 || (_error$response = _error$response.headers) === null || _error$response === void 0 ? void 0 : _error$response['x-tps-trace-id'];
-        if (error !== null && error !== void 0 && (_error$response2 = error.response) !== null && _error$response2 !== void 0 && _error$response2.data) {
-          return Promise.reject(_objectSpread(_objectSpread({}, error.response.data), {}, {
-            traceid: traceid
-          }));
-        }
-        if (error !== null && error !== void 0 && error.response) {
-          return Promise.reject(_objectSpread(_objectSpread({}, error.response), {}, {
-            traceid: traceid
-          }));
-        }
-        return Promise.reject(error);
-      });
-      var client = resty.create(options);
-      return client.request(botUrl, options);
-    }
+    value: function () {
+      var _request = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(options) {
+        var _this$config, appID, token, clientSecret, apiVersion, botUrl, client, retryClient, _t, _t2;
+        return _regeneratorRuntime.wrap(function (_context) {
+          while (1) switch (_context.prev = _context.next) {
+            case 0:
+              _this$config = this.config, appID = _this$config.appID, token = _this$config.token, clientSecret = _this$config.clientSecret;
+              options.headers = _objectSpread({}, options.headers);
+              apiVersion = options.apiVersion || 'v2'; // 添加 UA
+              addUserAgent(options.headers, appID, apiVersion);
+              // 添加鉴权信息
+              _context.next = 1;
+              return addAuthorization(options.headers, appID, token, clientSecret, apiVersion);
+            case 1:
+              // 组装完整Url
+              botUrl = buildUrl(options.url, this.config.sandbox); // 简化错误信息，后续可考虑通过中间件形式暴露给用户自行处理
+              resty.useRes(function (result) {
+                return result;
+              }, function (error) {
+                var _error$response, _error$response2;
+                var traceid = error === null || error === void 0 || (_error$response = error.response) === null || _error$response === void 0 || (_error$response = _error$response.headers) === null || _error$response === void 0 ? void 0 : _error$response['x-tps-trace-id'];
+                if (error !== null && error !== void 0 && (_error$response2 = error.response) !== null && _error$response2 !== void 0 && _error$response2.data) {
+                  return Promise.reject(_objectSpread(_objectSpread({}, error.response.data), {}, {
+                    traceid: traceid
+                  }));
+                }
+                if (error !== null && error !== void 0 && error.response) {
+                  return Promise.reject(_objectSpread(_objectSpread({}, error.response), {}, {
+                    traceid: traceid
+                  }));
+                }
+                return Promise.reject(error);
+              });
+              client = resty.create(options);
+              _context.prev = 2;
+              _context.next = 3;
+              return client.request(botUrl, options);
+            case 3:
+              return _context.abrupt("return", _context.sent);
+            case 4:
+              _context.prev = 4;
+              _t = _context["catch"](2);
+              if (!((_t === null || _t === void 0 ? void 0 : _t.code) === 11201 || (_t === null || _t === void 0 ? void 0 : _t.err_code) === 40012001)) {
+                _context.next = 8;
+                break;
+              }
+              console.log('检测到认证失败，尝试重试请求...');
+              _context.prev = 5;
+              // 由于addAuthorization现在是并发安全的，重试时会自动获取最新token
+              retryClient = resty.create(options);
+              _context.next = 6;
+              return retryClient.request(botUrl, options);
+            case 6:
+              return _context.abrupt("return", _context.sent);
+            case 7:
+              _context.prev = 7;
+              _t2 = _context["catch"](5);
+              console.log('重试请求仍然失败:', _t2);
+              throw _t2;
+            case 8:
+              throw _t;
+            case 9:
+            case "end":
+              return _context.stop();
+          }
+        }, _callee, this, [[2, 4], [5, 7]]);
+      }));
+      function request(_x) {
+        return _request.apply(this, arguments);
+      }
+      return request;
+    }()
   }], [{
     key: "newClient",
     value: function newClient(config) {

package/lib/index.js

@@ -1,12 +1,13 @@
 'use strict';
 
+var _asyncToGenerator = require('@babel/runtime/helpers/asyncToGenerator');
 var _classCallCheck = require('@babel/runtime/helpers/classCallCheck');
 var _createClass = require('@babel/runtime/helpers/createClass');
 var _defineProperty = require('@babel/runtime/helpers/defineProperty');
+var _regeneratorRuntime = require('@babel/runtime/regenerator');
 var resty = require('resty-client');
-var _asyncToGenerator = require('@babel/runtime/helpers/asyncToGenerator');
 var _typeof = require('@babel/runtime/helpers/typeof');
-var _regeneratorRuntime = require('@babel/runtime/regenerator');
+var _slicedToArray = require('@babel/runtime/helpers/slicedToArray');
 var fs = require('fs');
 var https = require('https');
 var _possibleConstructorReturn = require('@babel/runtime/helpers/possibleConstructorReturn');
@@ -299,7 +300,7 @@ var Guild = /*#__PURE__*/function () {
   }]);
 }();
 
-var version = "4.4.4";
+var version = "4.4.6";
 
 function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
@@ -679,6 +680,45 @@ log.setLevel('info');
 log.setLevel('trace');
 var BotLogger = log;
 
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: true } : { done: false, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = true, u = false; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = true, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+
+// 全局token刷新锁，避免并发刷新
+var tokenRefreshPromises = new Map();
+
+// 定期清理可能遗留的Promise（防止内存泄漏）
+setInterval(function () {
+  var now = Date.now();
+  var keysToDelete = [];
+  var _iterator = _createForOfIteratorHelper(tokenRefreshPromises.entries()),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var _step$value = _slicedToArray(_step.value, 2),
+        key = _step$value[0],
+        _step$value$ = _step$value[1],
+        promise = _step$value$.promise,
+        timestamp = _step$value$.timestamp;
+      // 如果Promise已经存在超过5分钟，可能出现了问题，清理掉
+      if (now - timestamp > 5 * 60 * 1000) {
+        keysToDelete.push(key);
+        console.warn("\u6E05\u7406\u8D85\u65F6\u7684token\u5237\u65B0Promise (key: ".concat(key, ", \u5B58\u5728\u65F6\u95F4: ").concat((now - timestamp) / 1000, "s)"));
+      }
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  keysToDelete.forEach(function (key) {
+    return tokenRefreshPromises["delete"](key);
+  });
+  if (keysToDelete.length > 0) {
+    console.log("\u6E05\u7406\u4E86 ".concat(keysToDelete.length, " \u4E2A\u8D85\u65F6\u7684token\u5237\u65B0Promise"));
+  }
+}, 60000); // 每分钟清理一次
+
 // 转为对象
 var toObject = function toObject(data) {
   if (Buffer.isBuffer(data)) return JSON.parse(data.toString());
@@ -757,17 +797,40 @@ function getAccessToken(access_token_file, url, data, appID) {
   });
 }
 
-// 添加 User-Agent
-var addAuthorization = /*#__PURE__*/function () {
-  var _ref = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(header, appID, token, clientSecret, apiVersion) {
-    var now_time, url, data, access_token_file, default_token_json, access_token, expires_in, access_token_json;
+// 等待Promise完成，带超时机制
+var waitForPromiseWithTimeout = /*#__PURE__*/function () {
+  var _ref = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(promise) {
+    var timeoutMs,
+      timeoutPromise,
+      _args = arguments;
     return _regeneratorRuntime.wrap(function (_context) {
       while (1) switch (_context.prev = _context.next) {
         case 0:
-          if (!(apiVersion == 'v2')) {
-            _context.next = 3;
-            break;
-          }
+          timeoutMs = _args.length > 1 && _args[1] !== undefined ? _args[1] : 10000;
+          timeoutPromise = new Promise(function (_, reject) {
+            setTimeout(function () {
+              return reject(new Error("Token refresh timeout after ".concat(timeoutMs, "ms")));
+            }, timeoutMs);
+          });
+          return _context.abrupt("return", Promise.race([promise, timeoutPromise]));
+        case 1:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee);
+  }));
+  return function waitForPromiseWithTimeout(_x) {
+    return _ref.apply(this, arguments);
+  };
+}();
+
+// 获取或刷新token（带并发控制和超时保护）
+var getOrRefreshToken = /*#__PURE__*/function () {
+  var _ref2 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(appID, clientSecret) {
+    var now_time, url, data, access_token_file, access_token, expires_in, needsRefresh, access_token_json, expiresStr, parsed, default_token_json, key, existingEntry, refreshPromise, _t2;
+    return _regeneratorRuntime.wrap(function (_context3) {
+      while (1) switch (_context3.prev = _context3.next) {
+        case 0:
           now_time = getTimeStampNumber();
           url = 'https://bots.qq.com/app/getAppAccessToken';
           data = {
@@ -775,55 +838,149 @@ var addAuthorization = /*#__PURE__*/function () {
             clientSecret: clientSecret
           };
           access_token_file = './access_token.json';
-          default_token_json = {
-            bot: _defineProperty({}, appID, {
-              access_token: "",
-              expires_in: ""
-            })
-          };
           access_token = '';
           expires_in = 0;
+          needsRefresh = false; // 首先读取当前token状态
           try {
-            // 判断文件是否存在
             if (fs.existsSync(access_token_file)) {
-              // 执行文件存在时的处理逻辑
-              access_token_json = JSON.parse(fs.readFileSync(access_token_file).toString()); // 判断是否存在appID
+              access_token_json = JSON.parse(fs.readFileSync(access_token_file).toString());
               if (access_token_json.hasOwnProperty('bot') && access_token_json['bot'].hasOwnProperty(appID)) {
                 access_token = access_token_json['bot'][appID]['access_token'];
-                expires_in = parseInt(access_token_json['bot'][appID]['expires_in']);
+                expiresStr = access_token_json['bot'][appID]['expires_in'];
+                if (expiresStr && typeof expiresStr === 'string') {
+                  parsed = parseInt(expiresStr);
+                  if (!isNaN(parsed) && parsed > 0) {
+                    expires_in = parsed;
+                  } else {
+                    console.log('expires_in解析失败，重置为0:', expiresStr);
+                    expires_in = 0;
+                  }
+                } else {
+                  expires_in = 0;
+                }
               }
             } else {
-              // 执行文件不存在时的处理逻辑
+              default_token_json = {
+                bot: _defineProperty({}, appID, {
+                  access_token: "",
+                  expires_in: ""
+                })
+              };
               fs.writeFileSync(access_token_file, JSON.stringify(default_token_json, null, 2), 'utf-8');
+              needsRefresh = true;
             }
           } catch (err) {
             console.error('读取文件时发生错误:', err);
+            expires_in = 0;
+            needsRefresh = true;
           }
-          // 判断access_token是否存在，不存在或者已经过期就重新获取
-          if (!(access_token === '' || now_time > expires_in - 50)) {
-            _context.next = 2;
+
+          // 如果token有效且不需要刷新，直接返回
+          if (!(access_token !== '' && now_time <= expires_in - 50 && !needsRefresh)) {
+            _context3.next = 1;
             break;
           }
-          console.log('access_token', access_token, 'expire_time', expires_in);
-          _context.next = 1;
-          return getAccessToken(access_token_file, url, data, appID);
+          return _context3.abrupt("return", access_token);
         case 1:
-          access_token = _context.sent;
-        case 2:
+          // 需要刷新token，进入并发控制逻辑
+          key = "".concat(appID, ":").concat(clientSecret);
+          existingEntry = tokenRefreshPromises.get(key);
+          if (!existingEntry) {
+            _context3.next = 5;
+            break;
+          }
+          _context3.prev = 2;
+          // 等待已有的刷新完成，但设置超时防止无限等待
+          console.log("\u7B49\u5F85\u5DF2\u6709\u7684token\u5237\u65B0\u5B8C\u6210 (appID: ".concat(appID, ")"));
+          _context3.next = 3;
+          return waitForPromiseWithTimeout(existingEntry.promise, 10000);
+        case 3:
+          return _context3.abrupt("return", _context3.sent);
+        case 4:
+          _context3.prev = 4;
+          _t2 = _context3["catch"](2);
+          console.warn("\u7B49\u5F85token\u5237\u65B0\u8D85\u65F6\u6216\u5931\u8D25\uFF0C\u91CD\u65B0\u53D1\u8D77\u5237\u65B0 (appID: ".concat(appID, "):"), _t2);
+          // 移除失败的Promise，让新的请求可以重新发起刷新
+          tokenRefreshPromises["delete"](key);
+        case 5:
+          // 创建新的刷新Promise
+          refreshPromise = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2() {
+            var new_token, _t;
+            return _regeneratorRuntime.wrap(function (_context2) {
+              while (1) switch (_context2.prev = _context2.next) {
+                case 0:
+                  _context2.prev = 0;
+                  console.log('开始刷新access_token - 当前token:', access_token, '过期时间:', expires_in, '当前时间:', now_time);
+                  _context2.next = 1;
+                  return getAccessToken(access_token_file, url, data, appID);
+                case 1:
+                  new_token = _context2.sent;
+                  console.log('access_token刷新成功，新token:', new_token);
+                  return _context2.abrupt("return", new_token);
+                case 2:
+                  _context2.prev = 2;
+                  _t = _context2["catch"](0);
+                  console.error("Token\u5237\u65B0\u5931\u8D25 (appID: ".concat(appID, "):"), _t);
+                  throw _t;
+                case 3:
+                  _context2.prev = 3;
+                  // 刷新完成后移除Promise
+                  tokenRefreshPromises["delete"](key);
+                  return _context2.finish(3);
+                case 4:
+                case "end":
+                  return _context2.stop();
+              }
+            }, _callee2, null, [[0, 2, 3, 4]]);
+          }))(); // 存储Promise和时间戳以便其他并发请求使用和超时清理
+          tokenRefreshPromises.set(key, {
+            promise: refreshPromise,
+            timestamp: Date.now()
+          });
+          _context3.next = 6;
+          return refreshPromise;
+        case 6:
+          return _context3.abrupt("return", _context3.sent);
+        case 7:
+        case "end":
+          return _context3.stop();
+      }
+    }, _callee3, null, [[2, 4]]);
+  }));
+  return function getOrRefreshToken(_x2, _x3) {
+    return _ref2.apply(this, arguments);
+  };
+}();
+
+// 添加 User-Agent
+var addAuthorization = /*#__PURE__*/function () {
+  var _ref4 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4(header, appID, token, clientSecret, apiVersion) {
+    var access_token;
+    return _regeneratorRuntime.wrap(function (_context4) {
+      while (1) switch (_context4.prev = _context4.next) {
+        case 0:
+          if (!(apiVersion == 'v2')) {
+            _context4.next = 2;
+            break;
+          }
+          _context4.next = 1;
+          return getOrRefreshToken(appID, clientSecret);
+        case 1:
+          access_token = _context4.sent;
           // 更新header['Authorization']
           header['Authorization'] = "QQBot ".concat(access_token);
-          _context.next = 4;
+          _context4.next = 3;
           break;
-        case 3:
+        case 2:
           header['Authorization'] = "Bot ".concat(appID, ".").concat(token);
-        case 4:
+        case 3:
         case "end":
-          return _context.stop();
+          return _context4.stop();
       }
-    }, _callee);
+    }, _callee4);
   }));
-  return function addAuthorization(_x, _x2, _x3, _x4, _x5) {
-    return _ref.apply(this, arguments);
+  return function addAuthorization(_x4, _x5, _x6, _x7, _x8) {
+    return _ref4.apply(this, arguments);
   };
 }();
 // 组装完整Url
@@ -1968,41 +2125,78 @@ var OpenAPI = /*#__PURE__*/function () {
     // 基础rest请求
   }, {
     key: "request",
-    value: function request(options) {
-      var _this$config = this.config,
-        appID = _this$config.appID,
-        token = _this$config.token,
-        clientSecret = _this$config.clientSecret;
-      options.headers = _objectSpread({}, options.headers);
-      var apiVersion = options.apiVersion || 'v2';
-      // 添加 UA
-      addUserAgent(options.headers, appID, apiVersion);
-      // 添加鉴权信息
-      addAuthorization(options.headers, appID, token, clientSecret, apiVersion);
-      // 组装完整Url
-      var botUrl = buildUrl(options.url, this.config.sandbox);
-
-      // 简化错误信息，后续可考虑通过中间件形式暴露给用户自行处理
-      resty.useRes(function (result) {
-        return result;
-      }, function (error) {
-        var _error$response, _error$response2;
-        var traceid = error === null || error === void 0 || (_error$response = error.response) === null || _error$response === void 0 || (_error$response = _error$response.headers) === null || _error$response === void 0 ? void 0 : _error$response['x-tps-trace-id'];
-        if (error !== null && error !== void 0 && (_error$response2 = error.response) !== null && _error$response2 !== void 0 && _error$response2.data) {
-          return Promise.reject(_objectSpread(_objectSpread({}, error.response.data), {}, {
-            traceid: traceid
-          }));
-        }
-        if (error !== null && error !== void 0 && error.response) {
-          return Promise.reject(_objectSpread(_objectSpread({}, error.response), {}, {
-            traceid: traceid
-          }));
-        }
-        return Promise.reject(error);
-      });
-      var client = resty.create(options);
-      return client.request(botUrl, options);
-    }
+    value: function () {
+      var _request = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(options) {
+        var _this$config, appID, token, clientSecret, apiVersion, botUrl, client, retryClient, _t, _t2;
+        return _regeneratorRuntime.wrap(function (_context) {
+          while (1) switch (_context.prev = _context.next) {
+            case 0:
+              _this$config = this.config, appID = _this$config.appID, token = _this$config.token, clientSecret = _this$config.clientSecret;
+              options.headers = _objectSpread({}, options.headers);
+              apiVersion = options.apiVersion || 'v2'; // 添加 UA
+              addUserAgent(options.headers, appID, apiVersion);
+              // 添加鉴权信息
+              _context.next = 1;
+              return addAuthorization(options.headers, appID, token, clientSecret, apiVersion);
+            case 1:
+              // 组装完整Url
+              botUrl = buildUrl(options.url, this.config.sandbox); // 简化错误信息，后续可考虑通过中间件形式暴露给用户自行处理
+              resty.useRes(function (result) {
+                return result;
+              }, function (error) {
+                var _error$response, _error$response2;
+                var traceid = error === null || error === void 0 || (_error$response = error.response) === null || _error$response === void 0 || (_error$response = _error$response.headers) === null || _error$response === void 0 ? void 0 : _error$response['x-tps-trace-id'];
+                if (error !== null && error !== void 0 && (_error$response2 = error.response) !== null && _error$response2 !== void 0 && _error$response2.data) {
+                  return Promise.reject(_objectSpread(_objectSpread({}, error.response.data), {}, {
+                    traceid: traceid
+                  }));
+                }
+                if (error !== null && error !== void 0 && error.response) {
+                  return Promise.reject(_objectSpread(_objectSpread({}, error.response), {}, {
+                    traceid: traceid
+                  }));
+                }
+                return Promise.reject(error);
+              });
+              client = resty.create(options);
+              _context.prev = 2;
+              _context.next = 3;
+              return client.request(botUrl, options);
+            case 3:
+              return _context.abrupt("return", _context.sent);
+            case 4:
+              _context.prev = 4;
+              _t = _context["catch"](2);
+              if (!((_t === null || _t === void 0 ? void 0 : _t.code) === 11201 || (_t === null || _t === void 0 ? void 0 : _t.err_code) === 40012001)) {
+                _context.next = 8;
+                break;
+              }
+              console.log('检测到认证失败，尝试重试请求...');
+              _context.prev = 5;
+              // 由于addAuthorization现在是并发安全的，重试时会自动获取最新token
+              retryClient = resty.create(options);
+              _context.next = 6;
+              return retryClient.request(botUrl, options);
+            case 6:
+              return _context.abrupt("return", _context.sent);
+            case 7:
+              _context.prev = 7;
+              _t2 = _context["catch"](5);
+              console.log('重试请求仍然失败:', _t2);
+              throw _t2;
+            case 8:
+              throw _t;
+            case 9:
+            case "end":
+              return _context.stop();
+          }
+        }, _callee, this, [[2, 4], [5, 7]]);
+      }));
+      function request(_x) {
+        return _request.apply(this, arguments);
+      }
+      return request;
+    }()
   }], [{
     key: "newClient",
     value: function newClient(config) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "woodenfish-bot",
-    "version": "4.4.4",
+    "version": "4.4.6",
     "description": "woodenfish-bot",
     "publishConfig": {
         "registry": "https://registry.npmjs.org/"