@wecom/aibot-node-sdk - npm Package Compare versions

Comparing version 1.0.6 to 1.0.7-beta.0

dist/index.cjs.js

@@ -125,2 +125,14 @@ 'use strict';
 /**
+ * 解析代理 URL（从环境变量）
+ *
+ * 优先级：HTTPS_PROXY → https_proxy → HTTP_PROXY → http_proxy
+ */
+function resolveProxyUrl() {
+    return (process.env.HTTPS_PROXY ||
+        process.env.https_proxy ||
+        process.env.HTTP_PROXY ||
+        process.env.http_proxy ||
+        '');
+}
+/**
  * 企业微信 API 客户端
@@ -132,3 +144,3 @@ * 仅负责文件下载等 HTTP 辅助功能，消息收发均走 WebSocket 通道
         this.logger = logger;
-        this.httpClient = axios.create({
+        const config = {
             timeout,
@@ -138,3 +150,18 @@ headers: {
             },
-        });
+        };
+        // 自动检测代理环境变量，使用 CONNECT 隧道代理 HTTPS 请求
+        const proxyUrl = resolveProxyUrl();
+        if (proxyUrl) {
+            try {
+                const { HttpsProxyAgent } = require('https-proxy-agent');
+                config.httpsAgent = new HttpsProxyAgent(proxyUrl);
+                config.proxy = false; // 禁用 axios 内置代理解析，使用 agent
+                logger.info(`Using HTTPS proxy for API client: ${proxyUrl}`);
+            }
+            catch {
+                // https-proxy-agent 不可用时静默降级，不影响直连场景
+                logger.debug('https-proxy-agent not available, using direct connection');
+            }
+        }
+        this.httpClient = axios.create(config);
     }
@@ -141,0 +168,0 @@ /**

dist/index.esm.js

@@ -121,2 +121,14 @@ import { EventEmitter } from 'eventemitter3';
 /**
+ * 解析代理 URL（从环境变量）
+ *
+ * 优先级：HTTPS_PROXY → https_proxy → HTTP_PROXY → http_proxy
+ */
+function resolveProxyUrl() {
+    return (process.env.HTTPS_PROXY ||
+        process.env.https_proxy ||
+        process.env.HTTP_PROXY ||
+        process.env.http_proxy ||
+        '');
+}
+/**
  * 企业微信 API 客户端
@@ -128,3 +140,3 @@ * 仅负责文件下载等 HTTP 辅助功能，消息收发均走 WebSocket 通道
         this.logger = logger;
-        this.httpClient = axios.create({
+        const config = {
             timeout,
@@ -134,3 +146,18 @@ headers: {
             },
-        });
+        };
+        // 自动检测代理环境变量，使用 CONNECT 隧道代理 HTTPS 请求
+        const proxyUrl = resolveProxyUrl();
+        if (proxyUrl) {
+            try {
+                const { HttpsProxyAgent } = require('https-proxy-agent');
+                config.httpsAgent = new HttpsProxyAgent(proxyUrl);
+                config.proxy = false; // 禁用 axios 内置代理解析，使用 agent
+                logger.info(`Using HTTPS proxy for API client: ${proxyUrl}`);
+            }
+            catch {
+                // https-proxy-agent 不可用时静默降级，不影响直连场景
+                logger.debug('https-proxy-agent not available, using direct connection');
+            }
+        }
+        this.httpClient = axios.create(config);
     }
@@ -137,0 +164,0 @@ /**

package.json

 {
   "name": "@wecom/aibot-node-sdk",
-  "version": "1.0.6",
+  "version": "1.0.7-beta.0",
   "description": "企业微信智能机器人 Node.js SDK - WebSocket 长连接通道",
@@ -42,3 +42,6 @@ "main": "dist/index.cjs.js",
     "ws": "^8.16.0"
+  },
+  "optionalDependencies": {
+    "https-proxy-agent": "^7.0.0"
   }
 }

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

521525

1.04%

Lines of code

5773

0.94%

Worsened metrics

Dependency count

4

33.33%

Number of low quality alerts

1

Infinity%

Number of low supply chain risk alerts

9

800%

No dependency changes