@ai-wendao/ant 0.0.0-stage → 0.3.9

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: ant
+      name: '@ai-wendao/ant'

package/index.js

@@ -0,0 +1,678 @@
+export const name = 'ant'
+
+export const inject = []
+
+const MODEL_SYNC_PATH = '/api/ant-teams/models'
+const SERVICE_INFO_PATH = '/api/ant-teams/service-info'
+const BUNDLE_RELEASE_PATH = '/api/ant-teams/bundle-release'
+const DISCONNECT_PATH = '/api/ant-teams/disconnect'
+const REQUEST_CODE_PATH = '/api/ant-teams/request-code'
+const CONNECT_PATH = '/api/ant-teams/connect'
+const FEISHU_LINK_CODE_PATH = '/api/ant-teams/feishu/link-code'
+const FEISHU_MEMBER_APPS_PATH = '/api/ant-teams/feishu/apps'
+const FEISHU_CLAIM_PATH = '/api/ant-teams/feishu/tasks/claim'
+const FEISHU_HEARTBEAT_PATH = '/api/ant-teams/feishu/tasks/heartbeat'
+const FEISHU_COMPLETE_PATH = '/api/ant-teams/feishu/tasks/complete'
+const FEISHU_FINISH_PATH = '/api/ant-teams/feishu/tasks/finish'
+const ANT_NPM_PACKAGE_NAME = '@ai-wendao/ant'
+const MAX_MODEL_RESPONSE_BYTES = 1024 * 1024
+const MODEL_TOKEN_REF = 'ANT_MODEL_API_KEY'
+const SERVICE_RECORD_KEY = 'ant/team-service'
+const SESSION_HEARTBEAT_INTERVAL_MS = 30_000
+const FEISHU_POLL_INTERVAL_MS = 5_000
+const FEISHU_TASK_HEARTBEAT_INTERVAL_MS = 30_000
+const FEISHU_TASK_MAX_RUNTIME_MS = 30 * 60_000
+
+function jsonResponse(status, value) {
+  return new Response(JSON.stringify(value), {
+    status,
+    headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
+  })
+}
+
+function normalizeServiceUrl(value) {
+  let url
+  try { url = new URL(value) } catch { return null }
+  const localHttp = url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)
+  if ((url.protocol !== 'https:' && !localHttp) || url.username || url.password || url.search || url.hash || (url.pathname !== '/' && url.pathname !== '')) return null
+  return url.origin
+}
+
+function serviceUrlFromModelSettings(settings) {
+  const descriptor = settings.describe().find((entry) => entry.ns === 'llm-pi-ai')
+  const providers = descriptor?.value?.providers
+  if (!providers || typeof providers !== 'object') return null
+  const origins = new Set()
+  for (const provider of Object.values(providers)) {
+    if (provider?.apiKeyEnv !== MODEL_TOKEN_REF || typeof provider.baseURL !== 'string') continue
+    let url
+    try { url = new URL(provider.baseURL) } catch { return null }
+    const localHttp = url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)
+    if ((url.protocol !== 'https:' && !localHttp) || url.username || url.password || url.search || url.hash
+      || !['/model-gateway/openai/v1', '/model-gateway/anthropic'].includes(url.pathname)) return null
+    origins.add(url.origin)
+  }
+  return origins.size === 1 ? [...origins][0] : null
+}
+
+async function pinServiceUrl(credentials, serviceUrl) {
+  await credentials.modifyRecord(SERVICE_RECORD_KEY, async () => ({
+    kind: 'grant',
+    payload: { service_url: serviceUrl },
+  }))
+}
+
+async function readMemberConnection(credentials, settings) {
+  const credential = await credentials.resolve(MODEL_TOKEN_REF)
+  const token = typeof credential?.value === 'string' ? credential.value : null
+  if (!token) return null
+  const record = await credentials.readRecord(SERVICE_RECORD_KEY)
+  const pinnedUrl = record?.kind === 'grant' && typeof record.payload?.service_url === 'string'
+    ? normalizeServiceUrl(record.payload.service_url)
+    : null
+  const serviceUrl = pinnedUrl || serviceUrlFromModelSettings(settings)
+  return serviceUrl ? { serviceUrl, token } : null
+}
+
+async function updateModelSession(serviceUrl, token, action) {
+  return fetch(new URL(`/auth/dsh-session/${action}`, serviceUrl), {
+    method: 'POST',
+    headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+    redirect: 'manual',
+    signal: AbortSignal.timeout(10_000),
+  })
+}
+
+async function readLimitedBody(response) {
+  if (!response.body) return ''
+  const reader = response.body.getReader()
+  const chunks = []
+  let size = 0
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      size += value.byteLength
+      if (size > MAX_MODEL_RESPONSE_BYTES) {
+        await reader.cancel()
+        return null
+      }
+      chunks.push(value)
+    }
+  } finally {
+    reader.releaseLock()
+  }
+  const bytes = new Uint8Array(size)
+  let offset = 0
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return new TextDecoder().decode(bytes)
+}
+
+async function fetchMemberModels(request, credentials, settings) {
+  if (request.method !== 'POST') return jsonResponse(405, { message: '只支持 POST 请求' })
+  let token
+  let pinnedUrl
+  let serviceUrl
+  try {
+    token = await credentials.resolve(MODEL_TOKEN_REF)
+    const record = await credentials.readRecord(SERVICE_RECORD_KEY)
+    pinnedUrl = record?.kind === 'grant' && typeof record.payload?.service_url === 'string'
+      ? normalizeServiceUrl(record.payload.service_url)
+      : null
+    serviceUrl = pinnedUrl || serviceUrlFromModelSettings(settings)
+  } catch {
+    return jsonResponse(500, { message: 'DSH 无法读取 ANT 连接配置。' })
+  }
+  if (!token || !serviceUrl) return jsonResponse(401, { message: '当前 DSH 未连接 ANT，请验证工作邮箱。' })
+
+  try {
+    const session = await updateModelSession(serviceUrl, token.value, 'heartbeat')
+    if (session.status === 401 || session.status === 403) {
+      return jsonResponse(401, { message: 'ANT 成员凭证已失效，请重新验证工作邮箱。' })
+    }
+    if (!session.ok) return jsonResponse(502, { message: '无法激活 ANT 模型会话。' })
+    const upstream = await fetch(new URL('/api/me/models', serviceUrl), {
+      headers: { authorization: `Bearer ${token.value}`, accept: 'application/json' },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(10_000),
+    })
+    const text = await readLimitedBody(upstream)
+    if (text === null) return jsonResponse(502, { message: '团队模型目录响应过大' })
+    if (upstream.status === 401 || upstream.status === 403) {
+      return jsonResponse(401, { message: 'ANT 成员凭证已失效，请重新验证工作邮箱。' })
+    }
+    if (!upstream.ok) return jsonResponse(502, { message: 'ANT 暂时无法提供团队模型目录。' })
+    let result
+    try { result = JSON.parse(text) } catch { return jsonResponse(502, { message: 'ANT 团队模型目录格式无效。' }) }
+    if (!Array.isArray(result?.models) || normalizeServiceUrl(result.service_url) !== serviceUrl) {
+      return jsonResponse(502, { message: 'ANT 团队模型目录与已连接服务不匹配。' })
+    }
+    if (!pinnedUrl) {
+      try { await pinServiceUrl(credentials, serviceUrl) } catch {
+        return jsonResponse(500, { message: 'DSH 无法保存已连接的 ANT 服务地址' })
+      }
+    }
+    return jsonResponse(200, { service_url: serviceUrl, models: result.models })
+  } catch {
+    return jsonResponse(502, { message: '无法连接 ANT 团队服务' })
+  }
+}
+
+async function fetchServiceInfo(request, credentials, settings) {
+  if (request.method !== 'POST') return jsonResponse(405, { message: '只支持 POST 请求' })
+  let body
+  try {
+    const text = await request.text()
+    if (text.length > 4096) return jsonResponse(413, { message: '版本协商请求过大。' })
+    body = JSON.parse(text)
+  } catch {
+    return jsonResponse(400, { message: '版本协商请求格式无效。' })
+  }
+  const hasServiceUrl = typeof body?.service_url === 'string'
+  const suppliedServiceUrl = hasServiceUrl && body.service_url.trim()
+    ? normalizeServiceUrl(body.service_url)
+    : null
+  const bundleVersion = typeof body?.bundle_version === 'string'
+    && /^[0-9A-Za-z][0-9A-Za-z.+-]{0,63}$/u.test(body.bundle_version)
+    ? body.bundle_version
+    : null
+  const clientProtocols = Array.isArray(body?.api_protocol_versions)
+    && body.api_protocol_versions.length <= 16
+    && body.api_protocol_versions.every((version) => Number.isInteger(version) && version > 0 && version <= 65535)
+    ? [...new Set(body.api_protocol_versions)]
+    : null
+  if ((hasServiceUrl && body.service_url.trim() && !suppliedServiceUrl) || !bundleVersion || !clientProtocols?.length) {
+    return jsonResponse(400, { message: '团队服务地址或客户端版本信息无效。' })
+  }
+
+  let serviceUrl = suppliedServiceUrl
+  if (!serviceUrl) {
+    try {
+      serviceUrl = (await readMemberConnection(credentials, settings))?.serviceUrl || null
+    } catch {
+      return jsonResponse(500, { message: 'DSH 无法读取已保存的 ANT 服务地址。' })
+    }
+  }
+  if (!serviceUrl) return jsonResponse(400, { message: '请先填写 ANT 服务地址或连接团队。' })
+
+  try {
+    const upstream = await fetch(new URL('/.well-known/ant', serviceUrl), {
+      headers: {
+        accept: 'application/json',
+        'x-ant-bundle-version': bundleVersion,
+        'x-ant-api-protocol-versions': clientProtocols.join(','),
+      },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(10_000),
+    })
+    const text = await readLimitedBody(upstream)
+    if (text === null) return jsonResponse(502, { message: 'ANT 版本信息响应过大。' })
+    if (!upstream.ok) return jsonResponse(502, { message: `ANT 版本信息请求失败（${upstream.status}）。` })
+    let info
+    try { info = JSON.parse(text) } catch { return jsonResponse(502, { message: 'ANT 版本信息格式无效。' }) }
+    if (info?.service !== 'ant-server' || typeof info.version !== 'string' || info.version.length > 64) {
+      return jsonResponse(502, { message: '目标地址未返回有效的 ANT 服务信息。' })
+    }
+    const rawServerProtocols = info.api_protocol_versions
+    const validServerProtocols = Array.isArray(rawServerProtocols)
+      && rawServerProtocols.every((version) => Number.isInteger(version) && version > 0 && version <= 65535)
+    const serverProtocols = validServerProtocols ? [...new Set(rawServerProtocols)] : []
+    const sharedProtocols = serverProtocols.filter((version) => clientProtocols.includes(version))
+    const compatibility = validServerProtocols ? sharedProtocols.length > 0 : null
+    return jsonResponse(200, {
+      server_version: info.version,
+      bundle_version: bundleVersion,
+      server_api_protocol_versions: serverProtocols,
+      client_api_protocol_versions: clientProtocols,
+      shared_api_protocol_versions: sharedProtocols,
+      compatibility,
+    })
+  } catch {
+    return jsonResponse(502, { message: '无法连接 ANT 服务以检查版本兼容性。' })
+  }
+}
+
+async function fetchBundleRelease(request, credentials, settings) {
+  if (request.method !== 'GET') return jsonResponse(405, { message: '只支持 GET 请求' })
+  let connection
+  try { connection = await readMemberConnection(credentials, settings) } catch {
+    return jsonResponse(500, { message: 'DSH 无法读取 ANT 连接配置。' })
+  }
+  if (!connection) return jsonResponse(401, { message: '请先在 ANT 插件中连接团队。' })
+  try {
+    const session = await updateModelSession(connection.serviceUrl, connection.token, 'heartbeat')
+    if (session.status === 401 || session.status === 403) return jsonResponse(401, { message: 'ANT 成员凭证已失效。' })
+    if (!session.ok) return jsonResponse(502, { message: '无法激活 ANT 模型会话。' })
+    const headers = { authorization: `Bearer ${connection.token}`, accept: 'application/json' }
+    if (request.headers.get('x-ant-bundle-capabilities') === 'direct-package-install') {
+      headers['x-ant-bundle-capabilities'] = 'direct-package-install'
+    }
+    const upstream = await fetch(new URL('/api/me/bundle-release', connection.serviceUrl), {
+      headers,
+      redirect: 'manual',
+      signal: AbortSignal.timeout(10_000),
+    })
+    const text = await readLimitedBody(upstream)
+    if (text === null) return jsonResponse(502, { message: 'ANT 更新信息响应过大。' })
+    if (upstream.status === 401 || upstream.status === 403) return jsonResponse(401, { message: 'ANT 成员凭证已失效。' })
+    if (upstream.status === 426) {
+      return jsonResponse(426, { message: '当前 ANT 插件版本不能安全自动安装 scoped Bundle。请通过 DSH 官方插件管理器完成一次包名迁移。' })
+    }
+    if (!upstream.ok) return jsonResponse(502, { message: 'ANT 暂时无法提供插件更新信息。' })
+    let release
+    try { release = JSON.parse(text) } catch { return jsonResponse(502, { message: 'ANT 更新信息格式无效。' }) }
+    const validPackageName = release?.package_name === ANT_NPM_PACKAGE_NAME
+    const validVersion = typeof release?.version === 'string'
+      && (release.version === '' || /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.test(release.version))
+    const installSpec = release?.package_name === 'ant'
+      ? `ant@${release?.version}`
+      : `ant@npm:${release?.package_name}@${release?.version}`
+    const directInstallSpec = release?.package_name && release?.version
+      ? `${release.package_name}@${release.version}`
+      : ''
+    if (release?.bundle_name !== 'ant' || !validPackageName || !validVersion
+      || typeof release?.install_spec !== 'string' || typeof release?.release_notes !== 'string'
+      || (release.version && release.install_spec !== installSpec)
+      || (!release.version && release.install_spec !== '')
+      || (release.direct_install_spec !== undefined && release.direct_install_spec !== directInstallSpec)) {
+      return jsonResponse(502, { message: 'ANT 更新信息字段无效。' })
+    }
+    return jsonResponse(200, release)
+  } catch {
+    return jsonResponse(502, { message: '无法连接 ANT 更新服务。' })
+  }
+}
+
+async function disconnectMember(request, credentials, settings) {
+  if (request.method !== 'POST') return jsonResponse(405, { message: '只支持 POST 请求' })
+  let connection
+  try { connection = await readMemberConnection(credentials, settings) } catch {
+    return jsonResponse(500, { message: 'DSH 无法读取 ANT 连接配置。' })
+  }
+  if (!connection) return jsonResponse(200, { revoked: false })
+  try {
+    const response = await fetch(new URL('/auth/dsh-session/disconnect', connection.serviceUrl), {
+      method: 'POST',
+      headers: { authorization: `Bearer ${connection.token}`, accept: 'application/json' },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(10_000),
+    })
+    if (response.status === 204 || response.status === 401 || response.status === 403) {
+      return jsonResponse(200, { revoked: response.status === 204 })
+    }
+    return jsonResponse(200, { revoked: false })
+  } catch {
+    return jsonResponse(200, { revoked: false })
+  }
+}
+
+async function relayFeishuRequest(request, path, credentials, settings) {
+  if (request.method !== 'POST') return jsonResponse(405, { message: '只支持 POST 请求' })
+  let connection
+  try { connection = await readMemberConnection(credentials, settings) } catch {
+    return jsonResponse(500, { message: 'DSH 无法读取 ANT 连接配置。' })
+  }
+  if (!connection) return jsonResponse(401, { message: '请先在 ANT 插件中连接团队。' })
+  try {
+    const session = await updateModelSession(connection.serviceUrl, connection.token, 'heartbeat')
+    if (session.status === 401 || session.status === 403) return jsonResponse(401, { message: 'ANT 成员凭证已失效。' })
+    if (!session.ok) return jsonResponse(502, { message: '无法激活 ANT 模型会话。' })
+    const body = await request.text()
+    if (body.length > 64 * 1024) return jsonResponse(413, { message: '飞书任务请求过大。' })
+    const upstream = await fetch(new URL(path, connection.serviceUrl), {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${connection.token}`,
+        ...(body ? { 'content-type': 'application/json' } : {}),
+        accept: 'application/json',
+      },
+      ...(body ? { body } : {}),
+      redirect: 'manual',
+      signal: AbortSignal.timeout(15_000),
+    })
+    const text = await readLimitedBody(upstream)
+    if (text === null) return jsonResponse(502, { message: 'ANT 飞书任务响应过大。' })
+    return new Response(text, {
+      status: upstream.status,
+      headers: { 'content-type': upstream.headers.get('content-type') || 'application/json', 'cache-control': 'no-store' },
+    })
+  } catch {
+    return jsonResponse(502, { message: '无法连接 ANT 飞书任务服务。' })
+  }
+}
+
+async function requestFeishuJson(serviceUrl, token, path, body, timeout = 15_000) {
+  const response = await fetch(new URL(path, serviceUrl), {
+    method: 'POST',
+    headers: {
+      authorization: `Bearer ${token}`,
+      accept: 'application/json',
+      ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    redirect: 'manual',
+    signal: AbortSignal.timeout(timeout),
+  })
+  const text = await readLimitedBody(response)
+  if (text === null) throw new Error('ANT 飞书任务响应过大')
+  if (!response.ok) throw new Error(`ANT 飞书任务请求失败（${response.status}）`)
+  if (response.status === 204 || text === '') return null
+  try { return JSON.parse(text) } catch { throw new Error('ANT 飞书任务响应格式无效') }
+}
+
+async function syncModelsToHost(settings, serviceUrl, models) {
+  if (typeof settings?.mutate !== 'function') throw new Error('当前 DSH 版本未提供模型设置接口。')
+  const grouped = {
+    openai: models.filter((model) => model.protocol === 'openai'),
+    anthropic: models.filter((model) => model.protocol === 'anthropic'),
+  }
+  const ops = []
+  for (const protocol of ['openai', 'anthropic']) {
+    const route = protocol === 'openai' ? 'ant-team-openai' : 'ant-team-anthropic'
+    const protocolModels = grouped[protocol]
+    if (protocolModels.length === 0) {
+      ops.push({ op: 'unset', path: ['providers', route] })
+      continue
+    }
+    ops.push({ op: 'set', path: ['providers', route], value: {
+      displayName: protocol === 'openai' ? 'Lakala (OpenAI)' : 'Lakala (Anthropic)',
+      apiKeyEnv: 'ANT_MODEL_API_KEY',
+      api: protocol === 'openai' ? 'openai-completions' : 'anthropic-messages',
+      baseURL: protocol === 'openai'
+        ? new URL('/model-gateway/openai/v1', serviceUrl).toString()
+        : new URL('/model-gateway/anthropic', serviceUrl).toString(),
+      models: protocolModels.map((model) => ({ id: model.model_id, name: model.display_name })),
+    } })
+  }
+  const result = await settings.mutate('llm-pi-ai', ops, undefined)
+  if (!result.ok) throw new Error('DSH 无法更新 ANT 获准模型。')
+}
+
+function assistantMessageText(event) {
+  const content = event?.data?.message?.content
+  if (!Array.isArray(content)) return ''
+  return content.filter((part) => part?.type === 'text' && typeof part.text === 'string')
+    .map((part) => part.text).join('')
+}
+
+async function executeFeishuTask(task, connection, settings, sessionController, stoppedSignal) {
+  let sessionId
+  let promptAccepted = false
+  let followAbort
+  let taskHeartbeat
+  let runtimeTimeout
+  let timedOut = false
+  let stopSignalListener
+  try {
+    const catalogResponse = await fetch(new URL('/api/me/models', connection.serviceUrl), {
+      headers: { authorization: `Bearer ${connection.token}`, accept: 'application/json' },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(10_000),
+    })
+    const text = await readLimitedBody(catalogResponse)
+    if (!catalogResponse.ok || text === null) throw new Error('ANT 当前无法返回获准模型。')
+    const catalog = JSON.parse(text)
+    if (normalizeServiceUrl(catalog.service_url) !== connection.serviceUrl || !Array.isArray(catalog.models)) {
+      throw new Error('ANT 返回的模型目录无效。')
+    }
+    await syncModelsToHost(settings, connection.serviceUrl, catalog.models)
+    const model = task.models?.[0]
+    if (!model || !catalog.models.some((item) => item.protocol === model.protocol && item.model_id === model.model_id)) {
+      throw new Error('任务模型已不在成员授权目录中。')
+    }
+    if (typeof sessionController?.create !== 'function' || typeof sessionController?.follow !== 'function'
+      || typeof sessionController?.selectModel !== 'function' || typeof sessionController?.prompt !== 'function') {
+      throw new Error('当前 DSH 版本未提供 Session Controller 接口。')
+    }
+    sessionId = await sessionController.create(task.session_id ? { sessionId: task.session_id } : {})
+    const provider = model.protocol === 'openai' ? 'ant-team-openai' : 'ant-team-anthropic'
+    await sessionController.selectModel({ sessionId, provider, model: model.model_id })
+    followAbort = new AbortController()
+    stopSignalListener = () => followAbort.abort()
+    stoppedSignal.addEventListener('abort', stopSignalListener, { once: true })
+    const follow = sessionController.follow({ address: { kind: 'session', sessionId } }, followAbort.signal)
+    const iterator = follow[Symbol.asyncIterator]()
+    const opening = await iterator.next()
+    if (opening.done || opening.value?.type !== 'snapshot') throw new Error('DSH 会话无法开始跟随。')
+    if (stoppedSignal.aborted) throw new Error('DSH 客户端正在关闭。')
+
+    await sessionController.prompt({
+      requestId: globalThis.crypto.randomUUID(),
+      sessionId,
+      mode: 'queue',
+      content: [{ type: 'text', text: task.prompt }],
+    }, followAbort.signal)
+    promptAccepted = true
+    taskHeartbeat = setInterval(() => {
+      void updateModelSession(connection.serviceUrl, connection.token, 'heartbeat')
+        .then((response) => {
+          if (!response.ok) throw new Error('ANT model session expired')
+          return requestFeishuJson(connection.serviceUrl, connection.token, '/api/feishu/tasks/heartbeat', { task_id: task.id })
+        })
+        .catch(() => followAbort.abort())
+    }, FEISHU_TASK_HEARTBEAT_INTERVAL_MS)
+    taskHeartbeat.unref?.()
+    runtimeTimeout = setTimeout(() => { timedOut = true; followAbort.abort() }, FEISHU_TASK_MAX_RUNTIME_MS)
+    runtimeTimeout.unref?.()
+
+    let result = ''
+    while (!stoppedSignal.aborted) {
+      const next = await iterator.next()
+      if (next.done) throw new Error('DSH 会话结果流意外结束。')
+      const frame = next.value
+      if (frame?.type !== 'event') continue
+      const event = frame.event
+      if (event?.type === 'assistant/message') {
+        const message = assistantMessageText(event)
+        if (message) result = message
+      }
+      if (event?.type === 'turn/end') {
+        if (event.data?.reason?.kind !== 'completed' || !result.trim()) throw new Error('DSH 任务未能正常完成。')
+        await requestFeishuJson(connection.serviceUrl, connection.token, '/api/feishu/tasks/complete', {
+          task_id: task.id,
+          session_id: sessionId,
+          result,
+        })
+        return
+      }
+    }
+    if (stoppedSignal.aborted) throw new Error('DSH 客户端正在关闭。')
+  } catch {
+    const status = promptAccepted ? 'unknown' : 'failed'
+    try {
+      await requestFeishuJson(connection.serviceUrl, connection.token, '/api/feishu/tasks/finish', {
+        task_id: task.id,
+        status: timedOut && promptAccepted ? 'unknown' : status,
+      })
+    } catch {}
+  } finally {
+    clearInterval(taskHeartbeat)
+    clearTimeout(runtimeTimeout)
+    if (stopSignalListener) stoppedSignal.removeEventListener('abort', stopSignalListener)
+    followAbort?.abort()
+  }
+}
+
+function installFeishuTaskWorker(credentials, settings, sessionController) {
+  let stopped = false
+  let busy = false
+  let taskAbort
+  let work = Promise.resolve()
+  let pollWork = Promise.resolve()
+  const poll = async () => {
+    if (stopped || busy) return
+    busy = true
+    try {
+      const connection = await readMemberConnection(credentials, settings)
+      if (!connection) return
+      const session = await updateModelSession(connection.serviceUrl, connection.token, 'heartbeat')
+      if (!session.ok || stopped) return
+      const claim = await requestFeishuJson(connection.serviceUrl, connection.token, '/api/feishu/tasks/claim')
+      if (!claim?.task || stopped) return
+      taskAbort = new AbortController()
+      work = executeFeishuTask(claim.task, connection, settings, sessionController, taskAbort.signal)
+      await work
+    } catch {
+      // A transient polling error is retried on the next interval.
+    } finally {
+      busy = false
+    }
+  }
+  const schedulePoll = () => {
+    if (stopped || busy) return
+    pollWork = poll()
+  }
+  const timer = setInterval(schedulePoll, FEISHU_POLL_INTERVAL_MS)
+  timer.unref?.()
+  schedulePoll()
+  return async () => {
+    stopped = true
+    clearInterval(timer)
+    taskAbort?.abort()
+    await pollWork
+    await work
+  }
+}
+
+async function fetchAuthRequest(request, endpoint, credentials) {
+  if (request.method !== 'POST') return jsonResponse(405, { message: '只支持 POST 请求' })
+  let body
+  try { body = await request.json() } catch { return jsonResponse(400, { message: '请求格式无效' }) }
+  const serviceUrl = typeof body?.service_url === 'string' ? normalizeServiceUrl(body.service_url) : null
+  const payload = endpoint === 'request-code'
+    ? { email: body?.email }
+    : { email: body?.email, code: body?.code, device_id: body?.device_id }
+  if (!serviceUrl || typeof payload.email !== 'string' || payload.email.length > 320
+    || (endpoint !== 'request-code' && (typeof payload.code !== 'string' || payload.code.length !== 8
+      || typeof payload.device_id !== 'string' || payload.device_id.length > 64))) {
+    return jsonResponse(400, { message: '团队服务地址或邮箱验证信息无效' })
+  }
+
+  try {
+    const upstream = await fetch(new URL(`/auth/${endpoint}`, serviceUrl), {
+      method: 'POST',
+      headers: {
+        accept: 'application/json',
+        'content-type': 'application/json',
+        origin: serviceUrl,
+      },
+      body: JSON.stringify(payload),
+      redirect: 'manual',
+      signal: AbortSignal.timeout(10_000),
+    })
+    const text = await readLimitedBody(upstream)
+    if (text === null) return jsonResponse(502, { message: 'ANT 服务响应过大' })
+    if (endpoint === 'dsh-connect' && upstream.ok) {
+      let result
+      try { result = JSON.parse(text) } catch { return jsonResponse(502, { message: 'ANT 连接响应格式无效' }) }
+      if (typeof result?.token !== 'string' || !result.token.startsWith('antm_') || !Array.isArray(result.models)) {
+        return jsonResponse(502, { message: 'ANT 连接响应格式无效' })
+      }
+      try {
+        await pinServiceUrl(credentials, serviceUrl)
+      } catch {
+        return jsonResponse(500, { message: 'DSH 无法保存已连接的 ANT 服务地址' })
+      }
+      try {
+        const session = await updateModelSession(serviceUrl, result.token, 'heartbeat')
+        if (!session.ok) return jsonResponse(502, { message: '无法激活 ANT 模型会话。' })
+      } catch {
+        return jsonResponse(502, { message: '无法连接 ANT 模型会话服务。' })
+      }
+    }
+    return new Response(text, {
+      status: upstream.status,
+      headers: { 'content-type': upstream.headers.get('content-type') || 'application/json', 'cache-control': 'no-store' },
+    })
+  } catch {
+    return jsonResponse(502, { message: '无法连接 ANT 团队服务' })
+  }
+}
+
+export function apply(ctx) {
+  ctx.inject(['connection', 'credentials', 'settings', 'sessionController'], (connectionCtx) => {
+    connectionCtx.effect(() => connectionCtx.connection.fetch.register({
+      path: SERVICE_INFO_PATH,
+      methods: ['POST'],
+      requestBody: 'buffered',
+      fetch: (request) => fetchServiceInfo(request, connectionCtx.credentials, connectionCtx.settings),
+    }), 'ant-teams: ANT client-server version handshake')
+    connectionCtx.effect(() => connectionCtx.connection.fetch.register({
+      path: MODEL_SYNC_PATH,
+      methods: ['POST'],
+      requestBody: 'buffered',
+      fetch: (request) => fetchMemberModels(request, connectionCtx.credentials, connectionCtx.settings),
+    }), 'ant-teams: authenticated model catalog relay')
+    connectionCtx.effect(() => connectionCtx.connection.fetch.register({
+      path: BUNDLE_RELEASE_PATH,
+      methods: ['GET'],
+      fetch: (request) => fetchBundleRelease(request, connectionCtx.credentials, connectionCtx.settings),
+    }), 'ant-teams: authenticated Bundle release relay')
+    connectionCtx.effect(() => connectionCtx.connection.fetch.register({
+      path: DISCONNECT_PATH,
+      methods: ['POST'],
+      fetch: (request) => disconnectMember(request, connectionCtx.credentials, connectionCtx.settings),
+    }), 'ant-teams: revoke this device connection')
+    connectionCtx.effect(() => connectionCtx.connection.fetch.register({
+      path: REQUEST_CODE_PATH,
+      methods: ['POST'],
+      requestBody: 'buffered',
+      fetch: (request) => fetchAuthRequest(request, 'request-code', connectionCtx.credentials),
+    }), 'ant-teams: relay email verification code request')
+    connectionCtx.effect(() => connectionCtx.connection.fetch.register({
+      path: CONNECT_PATH,
+      methods: ['POST'],
+      requestBody: 'buffered',
+      fetch: (request) => fetchAuthRequest(request, 'dsh-connect', connectionCtx.credentials),
+    }), 'ant-teams: relay DSH account connection')
+    for (const [path, endpoint] of [
+      [FEISHU_MEMBER_APPS_PATH, '/api/feishu/member-apps'],
+      [FEISHU_LINK_CODE_PATH, '/api/feishu/link-code'],
+      [FEISHU_CLAIM_PATH, '/api/feishu/tasks/claim'],
+      [FEISHU_HEARTBEAT_PATH, '/api/feishu/tasks/heartbeat'],
+      [FEISHU_COMPLETE_PATH, '/api/feishu/tasks/complete'],
+      [FEISHU_FINISH_PATH, '/api/feishu/tasks/finish'],
+    ]) {
+      connectionCtx.effect(() => connectionCtx.connection.fetch.register({
+        path,
+        methods: ['POST'],
+        requestBody: 'buffered',
+        fetch: (request) => relayFeishuRequest(request, endpoint, connectionCtx.credentials, connectionCtx.settings),
+      }), `ant-teams: relay Feishu ${endpoint.split('/').at(-1)}`)
+    }
+    connectionCtx.effect(() => {
+      let stopped = false
+      let inFlight = Promise.resolve()
+      let refreshing = false
+      const heartbeat = () => {
+        if (stopped || refreshing) return
+        refreshing = true
+        inFlight = readMemberConnection(connectionCtx.credentials, connectionCtx.settings)
+          .then((connection) => connection
+            ? updateModelSession(connection.serviceUrl, connection.token, 'heartbeat')
+            : undefined)
+          .catch(() => undefined)
+          .finally(() => { refreshing = false })
+      }
+      heartbeat()
+      const timer = setInterval(heartbeat, SESSION_HEARTBEAT_INTERVAL_MS)
+      timer.unref?.()
+      return async () => {
+        stopped = true
+        clearInterval(timer)
+        await inFlight
+        try {
+          const connection = await readMemberConnection(connectionCtx.credentials, connectionCtx.settings)
+          if (connection) await updateModelSession(connection.serviceUrl, connection.token, 'revoke')
+        } catch {}
+      }
+    }, 'ant-teams: ANT model activity session')
+    connectionCtx.effect(
+      () => installFeishuTaskWorker(connectionCtx.credentials, connectionCtx.settings, connectionCtx.sessionController),
+      'ant-teams: DSH-owned Feishu task worker',
+    )
+  })
+}