@ai-wendao/ant 0.4.0 → 0.4.4

package/client.js

@@ -160,6 +160,7 @@ window.__ModuleLoader__.load({
     const inject = ['slots', 'layout', 'pluginNavigation', 'remote', 'remote.credentials', 'remote.settings', 'remote.pluginManager']
 
     async function readLocalJsonResponse(response) {
+      if (response.status === 204) return null
       const contentType = response.headers?.get?.('content-type') || ''
       const isJson = /^(?:application|text)\/(?:[a-z0-9!#$&^_.+-]+\+)?json(?:\s*;|$)/iu.test(contentType.trim())
       if (contentType && !isJson) {
@@ -239,6 +240,7 @@ window.__ModuleLoader__.load({
       const bindingRevision = useRef(0)
       const [message, setMessage] = useState('')
       const [pluginAlerts, setPluginAlerts] = useState([])
+      const [delegationRevision, setDelegationRevision] = useState(0)
       useEffect(() => {
         let disposed = false
         const revision = bindingRevision.current
@@ -313,6 +315,7 @@ window.__ModuleLoader__.load({
       const onConnectionChange = (url) => {
         bindingRevision.current += 1
         setBinding({ state: 'ready', url: url || null })
+        setDelegationRevision((value) => value + 1)
         if (url) {
           setServiceUrl(url)
           setDraft(url)
@@ -353,272 +356,594 @@ window.__ModuleLoader__.load({
             onClick: () => openInstalledPlugin(plugin.package_name), style: secondaryButtonStyle }, `在 DSH 中查看 ${plugin.title}`))) : null,
         h(ModelSyncFooter, { remote, serviceUrl, bindingReady: binding.state === 'ready',
           onServiceUrlChange: setServiceUrl, onConnectionChange }),
-        h(DelegationSettings, { remote }))
+        h(DelegationCards, { remote, revision: delegationRevision,
+          openImSettings: () => openInstalledPlugin('@xmanrui/dsh-im') }))
     }
 
-    function DelegationSettings({ remote }) {
+    function DelegationCards({ remote, revision, openImSettings }) {
       const [bots, setBots] = useState([])
-      const [enrolledBots, setEnrolledBots] = useState([])
+      const [enrolled, setEnrolled] = useState([])
       const [groups, setGroups] = useState([])
-      const [grants, setGrants] = useState([])
+      const [cards, setCards] = useState([])
       const [tasks, setTasks] = useState([])
-      const [teamReady, setTeamReady] = useState(false)
+      const [executors, setExecutors] = useState([])
+      const [defaults, setDefaults] = useState(null)
+      const [localConcurrency, setLocalConcurrency] = useState(null)
+      const [repositoryCacheLimitGib, setRepositoryCacheLimitGib] = useState(10)
       const [botId, setBotId] = useState('')
+      const [trustedOrigin, setTrustedOrigin] = useState('')
+      const [bindingCode, setBindingCode] = useState('')
       const [conversationKind, setConversationKind] = useState('dm')
       const [groupId, setGroupId] = useState('')
-      const [bindingCode, setBindingCode] = useState('')
-      const [groupReady, setGroupReady] = useState(false)
-      const [origin, setOrigin] = useState('')
-      const [repository, setRepository] = useState('')
-      const [prNumber, setPrNumber] = useState('')
+      const [chatGroupId, setChatGroupId] = useState('')
+      const [title, setTitle] = useState('')
+      const [intent, setIntent] = useState('')
+      const [examples, setExamples] = useState('')
+      const [taskPrompt, setTaskPrompt] = useState('')
+      const [runner, setRunner] = useState('dsh')
+      const [parameters, setParameters] = useState([])
+      const [giteaToken, setGiteaToken] = useState('')
+      const [tokenConfigured, setTokenConfigured] = useState(false)
       const [senderScope, setSenderScope] = useState('any')
       const [senderIds, setSenderIds] = useState('')
       const [days, setDays] = useState(7)
-      const [token, setToken] = useState('')
-      const [tokenReady, setTokenReady] = useState(false)
       const [busy, setBusy] = useState(false)
+      const [loading, setLoading] = useState(true)
+      const [botLoadError, setBotLoadError] = useState(false)
+      const [loadFailures, setLoadFailures] = useState([])
+      const [createOpen, setCreateOpen] = useState(false)
       const [message, setMessage] = useState('')
-      const refresh = async () => {
-        const [botResponse, grantResponse, credential, statusResponse, enrolledResponse, groupResponse] = await Promise.all([
-          fetch('/api/ant-teams/delegation/bots', { cache: 'no-store' }),
-          fetch('/api/ant-teams/delegation/grants', { cache: 'no-store' }),
-          remote?.credentials?.describe?.(['ANT_GITEA_API_TOKEN']),
-          fetch('/api/ant-teams/delegation/status', { cache: 'no-store' }),
-          fetch('/api/ant-teams/delegation/enrolled-bots', { cache: 'no-store' }),
-          fetch('/api/ant-teams/delegation/groups', { cache: 'no-store' }),
-        ])
-        const botData = await readLocalJsonResponse(botResponse)
-        const grantData = await readLocalJsonResponse(grantResponse)
-        const statusData = await readLocalJsonResponse(statusResponse)
-        const enrolledData = await readLocalJsonResponse(enrolledResponse)
-        const groupData = await readLocalJsonResponse(groupResponse)
-        if (!grantResponse.ok) { setTeamReady(false); throw new Error(grantData.message || '请先连接 ANT 团队。') }
-        setTeamReady(true)
-        setBots(botResponse.ok && Array.isArray(botData.bots) ? botData.bots : [])
-        setGroupReady(enrolledResponse.ok && groupResponse.ok)
-        setEnrolledBots(enrolledResponse.ok && Array.isArray(enrolledData) ? enrolledData : [])
-        setGroups(groupResponse.ok && Array.isArray(groupData) ? groupData : [])
-        setGrants(Array.isArray(grantData) ? grantData : [])
-        setTasks(statusResponse.ok && Array.isArray(statusData.items) ? statusData.items : [])
-        setTokenReady(Boolean(credential?.ok && credential.value?.ANT_GITEA_API_TOKEN?.configured))
-        if (!botResponse.ok) setMessage(botData.message || '请先配置 DSH-IM 飞书机器人。')
-        else if (!statusResponse.ok) setMessage(statusData.message || '本机任务记录暂时无法读取。')
+      const load = async () => {
+        setLoading(true)
+        setMessage('')
+        try {
+          const paths = ['bots', 'enrolled-bots', 'groups', 'cards', 'settings', 'executors', 'local-settings', 'status']
+          const responses = await Promise.all(paths.map((path) =>
+            fetch(`/api/ant-teams/delegation/${path}`, { cache: 'no-store',
+              ...(path === 'enrolled-bots' ? { headers: { 'x-ant-include-unbound': 'true' } } : {}) })
+              .catch(() => null)))
+          const data = await Promise.all(responses.map((response) => response
+            ? readLocalJsonResponse(response).catch(() => null) : null))
+          const valid = [
+            (value) => Array.isArray(value?.bots),
+            Array.isArray, Array.isArray, Array.isArray,
+            (value) => value && typeof value === 'object' && !Array.isArray(value),
+            Array.isArray,
+            (value) => value && typeof value === 'object' && !Array.isArray(value),
+            (value) => Array.isArray(value?.items),
+          ]
+          const readable = responses.map((response, index) => Boolean(response?.ok && valid[index](data[index])))
+          setLoadFailures(paths.filter((path, index) => !readable[index]))
+          setBots(readable[0] ? data[0].bots : [])
+          setBotLoadError(!readable[0])
+          setEnrolled(readable[1] ? data[1] : [])
+          setGroups(readable[2] ? data[2] : [])
+          setCards(readable[3] ? data[3] : [])
+          setDefaults(readable[4] ? data[4] : null)
+          setExecutors(readable[5] ? data[5] : [])
+          setLocalConcurrency(readable[6] ? data[6].max_concurrency : null)
+          setRepositoryCacheLimitGib(readable[6] ? data[6].repository_cache_limit_gib ?? 10 : 10)
+          setTasks(readable[7] ? data[7].items : [])
+          let credential = null
+          try { credential = await remote?.credentials?.describe?.(['ANT_GITEA_API_TOKEN']) } catch {}
+          setTokenConfigured(Boolean(credential?.ok && credential.value?.ANT_GITEA_API_TOKEN?.configured))
+        } finally { setLoading(false) }
       }
-      useEffect(() => { void refresh().catch((error) => { setTeamReady(false); setMessage(error.message) }) }, [remote])
-      const saveToken = async (event) => {
-        event.preventDefault()
-        if (!token.trim()) return
+      useEffect(() => { void load().catch((error) => setMessage(error.message)) }, [remote, revision])
+      const selectedBot = bots.find((bot) => bot.bot_id === botId)
+      const botConnected = Boolean(selectedBot?.available && selectedBot?.connected)
+      const selectedEnrollment = enrolled.find((bot) => bot.bot_fingerprint === selectedBot?.fingerprint)
+      const selectedEnrollmentBound = selectedEnrollment?.device_bound_to_current === true
+      const availableGroups = groups.filter((group) => group.bot_fingerprint === selectedBot?.fingerprint)
+      const selectedChatGroup = availableGroups.find((group) => group.group_id === chatGroupId)
+      const activeCards = cards.filter((card) => !card.revoked_at && card.expires_at * 1000 > Date.now())
+      const selectedGroupHasTasks = Boolean(selectedBot && chatGroupId && (
+        activeCards.some((card) => card.bot_fingerprint === selectedBot.fingerprint
+          && card.conversation_kind === 'group' && card.conversation_id === chatGroupId)))
+      const connectedBots = bots.filter((bot) => bot.available && bot.connected)
+      const authorizationLoadError = loadFailures.includes('cards')
+      const enrollmentLoadError = loadFailures.includes('enrolled-bots')
+      const enrolledCount = enrolled.filter((item) => item.device_bound_to_current
+        && connectedBots.some((bot) => bot.fingerprint === item.bot_fingerprint)).length
+      const selectedTaskCount = activeCards.filter((card) => card.bot_fingerprint === selectedBot?.fingerprint).length
+      const selectedRunnerNeedsPr = ['codex', 'claude-code'].includes(runner)
+      const codexAvailable = executors.some((item) => item.id === 'codex-readonly' && item.available)
+      const claudeCodeAvailable = executors.some((item) => item.id === 'claude-code' && item.available)
+      const nativePrUnavailableReason = executors.find((item) => item.reason)?.reason || null
+      const requesterSummary = senderScope === 'allowlist'
+        ? `仅指定成员：${senderIds.trim() || '尚未填写成员 ID'}`
+        : conversationKind === 'group' ? `群 ${groupId || '尚未选择'} 的所有成员` : '任何能私聊此机器人的人'
+      const resultRouteSummary = conversationKind === 'group' ? '回复到原群（群内可见）' : '回复到发起任务的私聊'
+      const cardBlockReason = enrollmentLoadError ? '暂时无法核对机器人是否已启用协作，请刷新状态后再试。'
+        : !botConnected || !selectedEnrollmentBound ? '先在上方把机器人绑定到这台 DSH。'
+        : conversationKind === 'group' && loadFailures.includes('groups') ? '暂时无法核对目标群，请刷新状态后再试。'
+        : conversationKind === 'group' && !groupId ? '请在“参数与授权范围”中选择目标群；若列表为空，让群成员先 @机器人，再刷新群列表。'
+          : senderScope === 'allowlist' && !senderIds.trim() ? '请在“参数与授权范围”中填写可请求成员的 IM ID。'
+            : parameters.some((rule) => rule.kind === 'gitea_pr') && !tokenConfigured ? '请先在“参数与授权范围”中保存本机 Gitea 只读令牌。'
+              : parameters.some((rule) => rule.kind === 'gitea_pr') && !selectedEnrollment?.gitea_origin
+                ? '请先登记这个机器人的可信 Gitea 地址。'
+              : parameters.some((rule) => rule.kind === 'gitea_pr')
+                && normalizeServiceUrl(trustedOrigin) !== selectedEnrollment?.gitea_origin
+                ? '请先保存机器人级可信 Gitea 地址；PR 参数将自动使用这个地址。'
+              : selectedRunnerNeedsPr && (parameters.length !== 1 || parameters[0].kind !== 'gitea_pr')
+                ? 'Codex 和 Claude Code 目前只支持单个 Gitea PR 审查任务。'
+                : selectedRunnerNeedsPr && !parameters[0].required
+                  ? '本机代码审查的 Gitea PR 编号必须设为必填。'
+                : runner === 'codex' && !codexAvailable
+                  ? '这台 DSH 尚未找到可用的 Codex CLI，请先安装或检查 DSH 的 PATH。'
+                : runner === 'claude-code' && !claudeCodeAvailable
+                  ? '这台 DSH 尚未注册 Claude Code 子代理，请先在 DSH 中安装并启用它。'
+              : ''
+      const loadNames = { bots: '机器人', 'enrolled-bots': '协作启用状态', groups: '群聊列表',
+        cards: '任务授权', settings: '团队默认值', executors: '本机执行器',
+        'local-settings': '本机设置', status: '最近任务' }
+      const updateParameter = (index, patch) => setParameters((current) => current.map((rule, i) => i === index ? { ...rule, ...patch } : rule))
+      const preparePrExample = () => {
+        setTitle('审查 Gitea PR 差异')
+        setIntent('同事希望查看指定 Gitea PR 的代码差异并获得审查意见。')
+        setExamples('请帮我审查 123 号 PR\n看看刚才提到的 PR 有什么风险')
+        setTaskPrompt('结合已核验 PR 的完整代码快照和差异，给出可定位的问题；没有足够上下文时说明局限，不修改代码。')
+        setParameters([{ name: 'pr_number', kind: 'gitea_pr', required: true,
+          description: '要审查的 PR 编号', min: '1', max: '', choices: '',
+          gitea_origin: selectedEnrollment?.gitea_origin || trustedOrigin || '', repository: '' }])
+        setRunner(codexAvailable ? 'codex' : claudeCodeAvailable ? 'claude-code' : 'dsh')
+        setCreateOpen(true)
+        window.document?.getElementById('ant-new-task')?.scrollIntoView({ behavior: 'smooth', block: 'start' })
+      }
+      const saveGiteaToken = async () => {
+        if (!giteaToken.trim()) return
         setBusy(true)
         try {
-          const result = await remote.credentials.set('ANT_GITEA_API_TOKEN', token.trim())
-          if (!result?.ok) throw new Error('DSH 无法安全保存 Gitea 访问令牌。')
-          setToken('')
-          setTokenReady(true)
-          setMessage('Gitea 访问令牌已保存在这台 DSH。')
+          const result = await remote.credentials.set('ANT_GITEA_API_TOKEN', giteaToken.trim())
+          if (!result?.ok) throw new Error('DSH 无法安全保存 Gitea 令牌。')
+          setGiteaToken(''); setTokenConfigured(true)
+          setMessage('Gitea 令牌已保存在这台 DSH，不会提交给 ANT 服务端。')
         } catch (error) { setMessage(error.message) }
         finally { setBusy(false) }
       }
-      const create = async (event) => {
-        event.preventDefault()
-        const bot = bots.find((item) => item.bot_id === botId && item.available && item.connected)
-        if (!teamReady || !bot || !tokenReady) { setMessage('请先连接 ANT 团队，选择可用的专用飞书机器人，并保存 Gitea 访问令牌。'); return }
-        if (!groupReady || !selectedEnrolled) {
-          setMessage('请先为这个专用机器人启用协作收件，并固定可信 Gitea 地址。')
-          return
-        }
-        if (conversationKind === 'group' && !groups.some((item) => item.bot_fingerprint === bot.fingerprint && item.group_id === groupId)) {
-          setMessage('请先让群成员在目标群 @ 机器人一次，然后选择待启用群。')
-          return
-        }
-        if (normalizeServiceUrl(origin) !== selectedEnrollment.gitea_origin) {
-          setMessage('当前地址与机器人已登记的可信 Gitea 地址不同。请先点击“更新可信地址”，或恢复原地址。')
+      const enrollBot = async () => {
+        if (!selectedBot) return
+        const requestedOrigin = trustedOrigin
+        const origin = requestedOrigin?.trim() ? normalizeServiceUrl(requestedOrigin) : ''
+        if (requestedOrigin?.trim() && !origin) {
+          setMessage('请填写有效的 HTTPS Gitea 地址后再启用协作。')
           return
         }
-        const trustedOrigin = selectedEnrollment.gitea_origin
-        if (!window.confirm(conversationKind === 'group'
-          ? `确认允许所选群的成员请求 ${trustedOrigin} 上 ${repository} PR #${prNumber} 的只读审查？结果将公开回复原群／原话题，直到你撤销或授权到期。目前没有每日请求次数上限。`
-          : `开启后，此飞书机器人将由 ANT 接收消息，只处理你授权的 PR 审查；它不再运行 DSH-IM 的普通聊天。Gitea 令牌会发送到 ${origin}，请核对地址。目前没有每日请求次数上限。请确认这是专用协作机器人。`)) return
         setBusy(true)
         try {
-          const response = await fetch('/api/ant-teams/delegation/grants', {
+          const response = await fetch('/api/ant-teams/delegation/enrolled-bots', {
             method: 'POST', headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ bot_id: bot.bot_id, bot_fingerprint: bot.fingerprint,
-              gitea_origin: trustedOrigin, repository, pr_number: Number(prNumber), sender_scope: senderScope,
-              sender_ids: senderScope === 'allowlist' ? senderIds.split(/[\s,，]+/u).filter(Boolean) : [],
-              conversation_kind: conversationKind,
-              ...(conversationKind === 'group' ? { conversation_id: groupId } : {}),
-              expires_at: Math.floor(Date.now() / 1000) + Number(days) * 86400 }),
+            body: JSON.stringify({ bot_id: selectedBot.bot_id, bot_fingerprint: selectedBot.fingerprint,
+              gitea_origin: origin }),
           })
           const result = await readLocalJsonResponse(response)
-          if (!response.ok) throw new Error(result.message || '委托授权未能创建。')
-          setPrNumber('')
-          setMessage(conversationKind === 'group'
-            ? '本群已启用。在群里 @机器人发送“审查 PR 编号”可试一次；结果会公开回复原群／原话题。'
-            : '委托已保存；机器人连接后可私聊发送“审查 PR 编号”试一次，以核对 Gitea 令牌和实际回复。')
-          await refresh()
+          if (!response.ok) throw new Error(result.message || '协作机器人启用失败。')
+          await load()
+          if (origin) setTrustedOrigin(origin)
+          setMessage('协作机器人已启用。你可以开放能力；私聊时也能正常聊天。')
         } catch (error) { setMessage(error.message) }
         finally { setBusy(false) }
       }
-      const enrollBot = async () => {
-        const bot = bots.find((item) => item.bot_id === botId && item.available && item.connected)
-        if (!bot || !groupReady) { setMessage('请先选择可用机器人，并确认团队服务端已支持群聊委托。'); return }
-        const trustedOrigin = normalizeServiceUrl(origin)
-        if (!trustedOrigin) { setMessage('请先填写有效的 Gitea 服务地址（HTTPS，或本机测试地址）。'); return }
-        if (!window.confirm('此机器人会切换为 ANT 独占收件模式，停止 DSH-IM 原有普通聊天。更换机器人账号或可信 Gitea 地址时，不匹配的旧授权会撤销。请确认这是专用协作机器人。')) return
+      const saveTrustedOrigin = async () => {
+        if (!selectedBot || !selectedEnrollmentBound) return
+        const origin = normalizeServiceUrl(trustedOrigin)
+        if (!origin) { setMessage('请填写有效的 HTTPS Gitea 地址。'); return }
+        if (!window.confirm(`将这个机器人的可信 Gitea 地址设为 ${origin}？已开放能力中的 PR 参数需要重新核对。`)) return
         setBusy(true)
         try {
           const response = await fetch('/api/ant-teams/delegation/enrolled-bots', {
             method: 'POST', headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ bot_id: bot.bot_id, bot_fingerprint: bot.fingerprint,
-              gitea_origin: trustedOrigin }),
+            body: JSON.stringify({ bot_id: selectedBot.bot_id, bot_fingerprint: selectedBot.fingerprint,
+              gitea_origin: origin }),
+          })
+          const result = await readLocalJsonResponse(response)
+          if (!response.ok) throw new Error(result.message || '可信地址保存失败。')
+          await load(); setTrustedOrigin(origin); setMessage('可信 Gitea 地址已保存。')
+        } catch (error) { setMessage(error.message) }
+        finally { setBusy(false) }
+      }
+      const issueBindingCode = async () => {
+        if (!selectedBot || !selectedEnrollmentBound) return
+        setBusy(true)
+        try {
+          const response = await fetch('/api/ant-teams/delegation/owner-challenge', {
+            method: 'POST', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ bot_id: selectedBot.bot_id, bot_fingerprint: selectedBot.fingerprint }),
+          })
+          const result = await readLocalJsonResponse(response)
+          if (!response.ok) throw new Error(result.message || '无法获取身份绑定码。')
+          setBindingCode(result.code)
+          setMessage('绑定码 5 分钟有效。请你本人私聊这个机器人完成绑定。')
+        } catch (error) { setMessage(error.message) }
+        finally { setBusy(false) }
+      }
+      const saveGroupChat = async () => {
+        if (!selectedBot || !selectedEnrollmentBound || !chatGroupId.trim()) return
+        const enabled = !selectedChatGroup?.chat_enabled
+        if (!enabled && selectedGroupHasTasks) {
+          setMessage('这个群还有开放能力。请先停止这些能力，再关闭群聊。')
+          return
+        }
+        if (!window.confirm(enabled
+          ? selectedGroupHasTasks
+            ? '这个群当前因任务授权可以聊天。要在任务到期后仍允许普通聊天吗？聊天会使用团队模型额度。'
+            : '允许这个群与机器人自然聊天？群成员仍不能执行未开放的能力，聊天会使用团队模型额度。'
+          : '关闭这个群的普通聊天？已有能力不会自动撤销。')) return
+        setBusy(true)
+        try {
+          const response = await fetch('/api/ant-teams/delegation/groups', {
+            method: 'PUT', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ bot_id: selectedBot.bot_id,
+              bot_fingerprint: selectedBot.fingerprint, group_id: chatGroupId.trim(), enabled }),
           })
           if (!response.ok) {
             const result = await readLocalJsonResponse(response)
-            throw new Error(result.message || '无法启用机器人。')
+            throw new Error(result.message || '群聊设置保存失败。')
           }
-          setOrigin(trustedOrigin)
-          setMessage('专用机器人已启用，可创建私聊授权。若要开放群聊，请让目标群成员先 @它一次。')
-          await refresh()
+          await load()
+          setMessage(enabled ? '这个群现在可以与机器人聊天；可执行能力仍需逐项开放。' : '已关闭这个群的普通聊天。')
         } catch (error) { setMessage(error.message) }
         finally { setBusy(false) }
       }
-      const stopBot = async () => {
-        const bot = enrolledBots.find((item) => item.bot_id === botId)
-        if (!bot || !window.confirm('停止此机器人的 ANT 群聊接收，并撤销它的全部委托授权？若需恢复普通聊天，还要在 DSH-IM 中切回普通模式。')) return
+      const saveLocalProcessingSettings = async (event) => {
+        event.preventDefault()
         setBusy(true)
         try {
-          const response = await fetch('/api/ant-teams/delegation/enrolled-bots', {
-            method: 'DELETE', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ bot_id: bot.bot_id }),
+          const response = await fetch('/api/ant-teams/delegation/local-settings', {
+            method: 'PUT', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+              max_concurrency: localConcurrency === '' ? null : Number(localConcurrency),
+              repository_cache_limit_gib: Number(repositoryCacheLimitGib),
+            }),
           })
-          if (!response.ok) throw new Error('停止机器人失败，请重试。')
-          setMessage('已撤销此机器人的委托授权。若需普通聊天，请在 DSH-IM 中切回普通模式。')
-          setBindingCode('')
-          await refresh()
+          const result = await readLocalJsonResponse(response)
+          if (!response.ok) throw new Error(result.message || '本机处理设置保存失败。')
+          setLocalConcurrency(result.max_concurrency)
+          setRepositoryCacheLimitGib(result.repository_cache_limit_gib)
+          setMessage('本机并发与仓库缓存设置已保存。')
         } catch (error) { setMessage(error.message) }
         finally { setBusy(false) }
       }
-      const issueBindingCode = async () => {
-        const bot = bots.find((item) => item.bot_id === botId && item.available && item.connected)
-        if (!bot || !enrolledBots.some((item) => item.bot_fingerprint === bot.fingerprint)) return
+      const createCard = async (event) => {
+        event.preventDefault()
+        if (!selectedBot || !botConnected || !selectedEnrollmentBound) { setMessage('请先在这台 DSH 绑定选中的协作机器人。'); return }
+        if (!title.trim() || !intent.trim() || !taskPrompt.trim()) {
+          setMessage('请填写能力名称、适用请求说明和处理要求。'); return
+        }
+        const bytes = (value) => new TextEncoder().encode(value).length
+        if (bytes(title.trim()) > 100 || bytes(intent.trim()) > 1000 || bytes(taskPrompt.trim()) > 4000) {
+          setMessage('能力名称、请求说明或处理要求过长，请缩短后再提交。'); return
+        }
+        const exampleLines = examples.split('\n').map((item) => item.trim()).filter(Boolean)
+        if (exampleLines.length > 8 || exampleLines.some((item) => bytes(item) > 500)) {
+          setMessage('同事示例最多写 8 句，每句请保持简短。'); return
+        }
+        const normalized = parameters.map((rule) => ({ name: rule.name.trim(), kind: rule.kind,
+          description: rule.description.trim() || null,
+          required: rule.required, min: rule.min === '' ? null : Number(rule.min),
+          max: rule.max === '' ? null : Number(rule.max),
+          choices: rule.kind === 'choice' ? rule.choices.split(/[，,\n]/u).map((item) => item.trim()).filter(Boolean) : null,
+          gitea_origin: rule.kind === 'gitea_pr' ? selectedEnrollment?.gitea_origin || null : null,
+          repository: rule.kind === 'gitea_pr' ? rule.repository.trim().toLowerCase() : null }))
+        if (normalized.some((rule) => !/^[A-Za-z][A-Za-z0-9_]{0,31}$/u.test(rule.name))) {
+          setMessage('参数键请用英文字母开头，只能包含英文字母、数字和下划线；给同事看的中文问题可填在“参数说明”。'); return
+        }
+        if (new Set(normalized.map((rule) => rule.name)).size !== normalized.length) {
+          setMessage('参数键不能重复，请为每项参数填写不同的英文键。'); return
+        }
+        if (normalized.some((rule) => rule.description && bytes(rule.description) > 100)) {
+          setMessage('参数说明过长，请缩短给同事看的问题。'); return
+        }
+        if (normalized.some((rule) => rule.kind === 'choice' && (!rule.choices?.length || rule.choices.length > 32
+          || rule.choices.some((choice) => bytes(choice) > 100)
+          || new Set(rule.choices).size !== rule.choices.length))) {
+          setMessage('选项参数请填写 1–32 个不重复的可选值，每项保持简短。'); return
+        }
+        if (normalized.some((rule) => (rule.min != null && !Number.isInteger(rule.min))
+          || (rule.max != null && !Number.isInteger(rule.max))
+          || (rule.min != null && rule.max != null && rule.min > rule.max)
+          || (rule.kind === 'text' && rule.max != null && (rule.max < 1 || rule.max > 4096))
+          || (rule.kind === 'gitea_pr' && ((rule.min != null && rule.min < 1)
+            || (rule.max != null && rule.max > 1_000_000_000))))) {
+          setMessage('参数范围无效：最小值不能大于最大值；文本最长 4096 字节，PR 编号须为正整数。'); return
+        }
+        if (normalized.some((rule) => rule.kind === 'gitea_pr' && (!rule.gitea_origin || !rule.repository))) {
+          setMessage('PR 参数还需要填写可信 Gitea 地址和仓库。'); return
+        }
+        const validRepository = (value) => {
+          const parts = value.split('/')
+          return parts.length === 2 && parts.every((part) => part !== '.' && part !== '..'
+            && /^[A-Za-z0-9_.-]{1,100}$/u.test(part))
+        }
+        if (normalized.some((rule) => rule.kind === 'gitea_pr' && !validRepository(rule.repository))) {
+          setMessage('Gitea 仓库请填写“团队名/仓库名”，不要包含空格或多余路径。'); return
+        }
+        if (['codex', 'claude-code'].includes(runner) && (normalized.length !== 1
+          || normalized[0].kind !== 'gitea_pr' || !normalized[0].required)) {
+          setMessage('Codex 和 Claude Code 目前需要一个必填的 Gitea PR 编号参数。'); return
+        }
+        if (runner === 'codex' && !codexAvailable) {
+          setMessage('这台 DSH 尚未找到可用的 Codex CLI。'); return
+        }
+        if (runner === 'claude-code' && !claudeCodeAvailable) {
+          setMessage('这台 DSH 尚未注册 Claude Code 子代理。'); return
+        }
+        const scope = conversationKind === 'group' ? `群 ${groupId}` : '私聊'
+        const resultDestination = conversationKind === 'group' ? '原群（群内可见）' : '发起任务的私聊'
+        const executionInfo = runner === 'codex'
+          ? 'ANT 会使用这台电脑已登录的 Codex，在已核验 PR Head 的临时完整代码快照中固定只读权限；会传入所有者要求、请求人原话和 PR 差异，不传 Gitea 令牌。'
+          : runner === 'claude-code'
+            ? 'ANT 会调用这台 DSH 已注册的 Claude Code 子代理，在已核验 PR Head 的临时完整代码快照中审查；会传入所有者要求、请求人原话和 PR 差异，不传 Gitea 令牌。它沿用 DSH 中 Claude Code 的本机权限设置；请确认该设置适合由获准成员请求审查。'
+            : '这项任务仅由受限 DSH 处理已提供的文字。'
+        if (!window.confirm(`开放“${title}”后，${requesterSummary}可在${scope}请求，有效期 ${days} 天；结果${resultDestination}。${executionInfo}请确认。`)) return
         setBusy(true)
         try {
-          const response = await fetch('/api/ant-teams/delegation/owner-challenge', {
+          const response = await fetch('/api/ant-teams/delegation/cards', {
             method: 'POST', headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ bot_id: bot.bot_id, bot_fingerprint: bot.fingerprint }),
+            body: JSON.stringify({ bot_id: selectedBot.bot_id, bot_fingerprint: selectedBot.fingerprint,
+              title, intent, examples: exampleLines,
+              parameters: normalized, task_prompt: taskPrompt, runner, workspace: null,
+              sender_scope: senderScope, sender_ids: senderScope === 'allowlist'
+                ? senderIds.split(/[\s,，]+/u).filter(Boolean) : [], conversation_kind: conversationKind,
+              ...(conversationKind === 'group' ? { conversation_id: groupId } : {}),
+              expires_at: Math.floor(Date.now() / 1000) + Number(days) * 86400 }),
           })
           const result = await readLocalJsonResponse(response)
-          if (!response.ok) throw new Error(result.message || '无法生成绑定码。')
-          setBindingCode(result.code)
-          setMessage('绑定码 5 分钟有效。私聊发送后，点击下方“刷新状态”查看绑定结果。')
+          if (!response.ok && runner === 'claude-code' && result.code === 'INVALID_REQUEST') {
+            throw new Error('当前团队服务端可能尚不支持 Claude Code 执行方。请管理员升级服务端后刷新重试。')
+          }
+          if (!response.ok) throw new Error(result.message || '能力保存失败。')
+          setTitle(''); setIntent(''); setExamples(''); setTaskPrompt(''); setParameters([]); setRunner('dsh')
+          await load()
+          setCreateOpen(false)
+          setMessage('能力已开放。同事可自然地提出这类请求；参数不完整时机器人会追问。')
         } catch (error) { setMessage(error.message) }
         finally { setBusy(false) }
       }
-      const revoke = async (grant) => {
-        if (!window.confirm(`停止授权 ${grant.repository} 的 PR #${grant.pr_number}？`)) return
+      const revokeCard = async (card) => {
+        if (!window.confirm(`停止开放“${card.title}”？正在处理的任务无法撤销已经发生的读取。`)) return
         setBusy(true)
         try {
-          const response = await fetch('/api/ant-teams/delegation/grants', {
-            method: 'DELETE', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ id: grant.id }),
+          const response = await fetch('/api/ant-teams/delegation/cards', {
+            method: 'DELETE', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ id: card.id }),
           })
-          if (!response.ok) throw new Error('停止授权失败，请重试。')
-          setMessage('已停止新的委托请求。专用机器人若需恢复普通聊天，请在 DSH-IM 中切回普通模式。')
-          await refresh()
+          if (!response.ok) throw new Error('停止能力失败，请重试。')
+          await load(); setMessage('能力已停止开放。')
         } catch (error) { setMessage(error.message) }
         finally { setBusy(false) }
       }
-      const active = grants.filter((grant) => !grant.revoked_at && grant.expires_at * 1000 > Date.now())
-      const selectedBot = bots.find((bot) => bot.bot_id === botId)
-      const selectedEnrollment = enrolledBots.find((item) => item.bot_fingerprint === selectedBot?.fingerprint)
-      const selectedEnrolled = Boolean(selectedEnrollment)
-      const botGroups = groups.filter((item) => item.bot_fingerprint === selectedBot?.fingerprint)
-      return h('section', { style: panelStyle, 'aria-label': '委托同事请求 DSH 审查' },
-        h('h3', { style: { margin: 0, fontSize: 16 } }, '委托同事请求 DSH 审查'),
-        h('p', { style: mutedTextStyle }, '支持飞书私聊和你逐个启用的群聊，只处理指定 Gitea PR 的只读审查。群里的结果默认公开回复原群／原话题。'),
-        h('p', { style: mutedTextStyle }, '审查时，PR 标题和差异会交给当前获准的团队模型处理；Gitea 令牌只保存在本机，不发送给 ANT 服务端。'),
-        h('form', { onSubmit: saveToken, style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
-          h('label', { style: { width: '100%', fontSize: 13 } }, `Gitea 访问令牌（仅保存在本机 DSH）${tokenReady ? ' · 已配置' : ''}`),
-          h('input', { type: 'password', autoComplete: 'off', value: token, onChange: (event) => setToken(event.target.value),
-            placeholder: '只读访问令牌', style: { ...inputStyle, flex: '1 1 260px' } }),
-          h('button', { type: 'submit', disabled: busy || !token.trim(), style: secondaryButtonStyle }, '保存令牌')),
-        h('form', { onSubmit: create, style: { display: 'grid', gap: 9, maxWidth: 640 } },
-          h('label', { htmlFor: 'ant-delegation-bot' }, '专用飞书机器人'),
-          h('select', { id: 'ant-delegation-bot', required: true, value: botId,
-            onChange: (event) => { setBotId(event.target.value); setGroupId(''); setBindingCode('');
-              setOrigin(enrolledBots.find((item) => item.bot_id === event.target.value)?.gitea_origin || '') }, style: inputStyle },
-            h('option', { value: '' }, '选择已连接的机器人'),
-            ...bots.filter((bot) => bot.available && bot.connected).map((bot) => h('option', { key: bot.bot_id, value: bot.bot_id }, bot.name))),
-          h('label', { htmlFor: 'ant-delegation-origin' }, '可信 Gitea 服务地址'),
-          h('input', { id: 'ant-delegation-origin', type: 'url', required: true, value: origin,
-            onChange: (event) => setOrigin(event.target.value), placeholder: 'https://git.example.com', style: inputStyle }),
-          groupReady ? h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8, alignItems: 'center' } },
-            h('span', { style: mutedTextStyle }, selectedEnrolled
-              ? `${selectedEnrollment.owner_bound ? '飞书身份已绑定，可在群内批准' : '协作收件已启用，群内批准需先绑定身份'} · 可信 Gitea：${selectedEnrollment.gitea_origin}`
-              : '协作机器人尚未启用'),
-            !selectedEnrolled ? h('button', { type: 'button', disabled: busy || !botId,
-              onClick: () => void enrollBot(), style: secondaryButtonStyle }, '启用协作机器人') : null,
-            selectedEnrolled ? h('button', { type: 'button', disabled: busy,
-              onClick: () => void enrollBot(), style: secondaryButtonStyle }, '更新可信地址') : null,
-            selectedEnrolled ? h('button', { type: 'button', disabled: busy,
-              onClick: () => void issueBindingCode(), style: secondaryButtonStyle },
-            selectedEnrollment.owner_bound ? '重新绑定飞书身份' : '绑定我的飞书身份') : null,
-            selectedEnrolled ? h('button', { type: 'button', disabled: busy,
-              onClick: () => void stopBot(), style: secondaryButtonStyle }, '停止接收并撤销授权') : null) :
-            h('p', { style: mutedTextStyle }, '当前团队服务端尚未提供新版委托设置，请联系管理员升级。'),
-          bindingCode && selectedEnrolled ? h('p', { role: 'status', style: mutedTextStyle },
-            `请你本人私聊这个机器人发送“绑定身份 ${bindingCode}”；5 分钟内有效，不要把码发在群里。绑定后可在群里 @它发送“在本群启用 <完整 PR 链接> 审查”，再按提示确认。`) : null,
-          h('label', { htmlFor: 'ant-delegation-kind' }, '授权给谁使用'),
-          h('select', { id: 'ant-delegation-kind', value: conversationKind,
+      const cancelTask = async (task) => {
+        if (!window.confirm(`取消任务 ${task.task_id}？已经发生的读取不能撤回。`)) return
+        setBusy(true)
+        try {
+          const response = await fetch('/api/ant-teams/delegation/cancel', { method: 'POST',
+            headers: { 'content-type': 'application/json' }, body: JSON.stringify({ task_id: task.task_id }) })
+          const result = await readLocalJsonResponse(response)
+          if (!response.ok || !result.canceled) throw new Error(result.message || '任务已结束或无法取消，请刷新状态。')
+          await load(); setMessage('已请求取消任务。')
+        } catch (error) { setMessage(error.message) }
+        finally { setBusy(false) }
+      }
+      return h('section', { style: panelStyle, 'aria-label': '协作机器人与开放能力' },
+        h('h3', { style: { margin: 0, fontSize: 16 } }, '协作机器人'),
+        h('p', { style: mutedTextStyle }, '同事可以像平常一样和机器人聊天。DSH 负责理解与回答；只有准备执行你开放的能力时，ANT 才核对请求人、群、参数和权限。群里的任务结果会回复原群。'),
+        h('p', { role: 'status', style: mutedTextStyle }, '每项能力都单独设定执行方和请求范围。普通对话不会自动获得读取电脑、调用工具或访问其他群的权限。'),
+        loadFailures.length ? h('p', { role: 'status', style: mutedTextStyle },
+          `部分协作信息暂时无法读取：${loadFailures.map((path) => loadNames[path]).join('、')}。已读取的信息仍显示，请稍后刷新状态。`) : null,
+        h('div', { style: { border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 8, padding: 12,
+          display: 'grid', gap: 8 } },
+          h('strong', null, '机器人和聊天范围'),
+          h('span', { role: 'status', style: mutedTextStyle }, loading ? '正在读取机器人与任务状态…'
+            : botLoadError ? '暂时无法读取机器人状态。请刷新后再试。'
+              : connectedBots.length === 0 ? '尚未发现已连接的机器人。请先在 DSH-IM 中连接飞书机器人。'
+                : selectedBot && !botConnected ? `“${selectedBot.name}”当前离线；请先在 DSH-IM 恢复连接。`
+                  : enrollmentLoadError ? selectedBot
+                    ? `“${selectedBot.name}”已连接；暂时无法确认协作是否已启用，请刷新状态。`
+                    : '机器人已连接；协作启用状态暂未读取，请刷新状态。'
+                  : selectedBot && !selectedEnrollmentBound ? selectedEnrollment
+                    ? `“${selectedBot.name}”已连接；原协作配置尚未绑定到这台 DSH，请在本机重新启用。若原设备令牌曾被撤销，旧任务权限已关闭，绑定后需重新开放。`
+                    : `“${selectedBot.name}”已连接；请先启用本机协作。启用后，它仍能正常聊天。`
+                  : enrolledCount === 0 ? '机器人已连接；请选择并启用协作。启用后，它仍能正常聊天。'
+                      : !selectedBot ? '已有协作机器人；请选择一台，查看已开放的能力并私聊自测。'
+                      : authorizationLoadError ? `“${selectedBot.name}”已启用协作；已开放任务暂未读取，请刷新状态。普通聊天仍可自测。`
+                      : selectedTaskCount === 0 ? `“${selectedBot.name}”已启用协作；下一步开放一项能力。你也可以先私聊自测普通聊天。`
+                        : `“${selectedBot.name}”已启用协作 · ${selectedTaskCount} 项能力已开放。可以私聊自测。`),
+          bots.length ? h('label', null, '我的机器人', h('select', { value: botId,
+            onChange: (event) => { setBotId(event.target.value); setGroupId(''); setChatGroupId(''); setBindingCode('');
+              setTrustedOrigin(enrolled.find((bot) => bot.bot_id === event.target.value)?.gitea_origin || '') }, style: inputStyle },
+            h('option', { value: '' }, '请选择机器人'),
+            ...bots.map((bot) => h('option', { key: bot.bot_id, value: bot.bot_id,
+              disabled: !bot.available || !bot.connected }, `${bot.name}${bot.available && bot.connected ? '' : '（未连接）'}`)))) : null,
+          connectedBots.length === 0 && !loading && !botLoadError ? h('button', { type: 'button',
+            onClick: openImSettings, style: secondaryButtonStyle }, '打开 DSH-IM 设置') : null,
+          connectedBots.length === 0 && !loading && !botLoadError ? h('span', { style: mutedTextStyle },
+            '若尚未安装 DSH-IM，请先到 DSH 的插件列表安装并连接机器人。') : null,
+          selectedBot && !botConnected && connectedBots.length ? h('button', { type: 'button', onClick: openImSettings,
+            style: secondaryButtonStyle }, '检查 DSH-IM 连接') : null,
+          selectedBot && !selectedEnrollmentBound ? h('button', { type: 'button', disabled: busy || !botConnected || enrollmentLoadError,
+            onClick: () => void enrollBot(), style: secondaryButtonStyle },
+            selectedEnrollment ? '绑定原协作配置到这台 DSH' : '启用并绑定到这台 DSH') : null,
+          selectedEnrollmentBound && botConnected ? h('p', { style: mutedTextStyle },
+            `自测：私聊“${selectedBot.name}”发送“你能做什么”；发起任务后可问“刚才的任务怎么样了”。群聊请先在目标群 @机器人，再开放能力时选择该群。`) : null,
+          selectedEnrollmentBound && botConnected ? h('div', { style: { display: 'grid', gap: 8 } },
+            h('strong', null, '允许聊天的群'),
+            h('span', { style: mutedTextStyle }, '群成员可以正常聊天；是否能让机器人办事，由每项能力单独决定。若机器人尚未发现群，可以直接填群 ID。'),
+            h('select', { 'aria-label': '已记录的群', value: availableGroups.some((group) => group.group_id === chatGroupId) ? chatGroupId : '',
+              onChange: (event) => setChatGroupId(event.target.value), style: inputStyle },
+              h('option', { value: '' }, '从已记录的群中选择'),
+              ...availableGroups.map((group) => h('option', { key: group.group_id, value: group.group_id },
+                `${group.group_code} · ${group.chat_enabled ? '已允许聊天' : '未允许聊天'}`))),
+            h('input', { 'aria-label': '群 ID', value: chatGroupId, maxLength: 256,
+              onChange: (event) => setChatGroupId(event.target.value.trim()),
+              placeholder: '也可以手动填写群 ID', style: inputStyle }),
+            h('button', { type: 'button', disabled: busy || !chatGroupId.trim()
+              || (selectedChatGroup?.chat_enabled && selectedGroupHasTasks),
+              onClick: () => void saveGroupChat(), style: secondaryButtonStyle },
+              selectedChatGroup?.chat_enabled ? '关闭此群聊天'
+                : selectedGroupHasTasks ? '能力到期后仍允许聊天' : '允许此群聊天'),
+            selectedChatGroup?.chat_enabled && selectedGroupHasTasks ? h('span', { style: mutedTextStyle },
+              '本群还有开放能力；关闭聊天前请先停止这些能力。') : null) : null,
+          h('div', { style: { display: 'flex', gap: 8, flexWrap: 'wrap' } },
+            h('button', { type: 'button', onClick: () => { setCreateOpen(true)
+              window.document?.getElementById('ant-new-task')?.scrollIntoView({ behavior: 'smooth', block: 'start' }) },
+              style: primaryButtonStyle }, '开放新能力'),
+            h('button', { type: 'button', onClick: preparePrExample, style: secondaryButtonStyle }, '使用 PR 差异审查示例'),
+            h('button', { type: 'button', onClick: () => void load().catch((error) => setMessage(error.message)),
+              style: secondaryButtonStyle }, '刷新状态'))),
+        h('h4', { style: { marginBottom: 0 } }, `我开放的能力 · ${authorizationLoadError ? '暂未读取' : activeCards.length}`),
+        ...activeCards.map((card) => h('div', { key: card.id, style: { display: 'flex', gap: 12,
+          alignItems: 'center', justifyContent: 'space-between', flexWrap: 'wrap', borderTop: '1px solid var(--dsw-alias-border-l2)', paddingTop: 8 } },
+          h('span', { style: { flex: '1 1 280px', minWidth: 0, overflowWrap: 'anywhere' } }, `${card.title} · ${bots.find((bot) => bot.fingerprint === card.bot_fingerprint)?.name || '机器人'} · ${card.conversation_kind === 'group' ? `群 ${groups.find((group) => group.group_id === card.conversation_id)?.group_code || card.conversation_id}` : '私聊'} · ${card.sender_scope === 'allowlist' ? '仅指定成员可请求' : card.conversation_kind === 'group' ? '群成员可请求' : '可私聊者可请求'} · 结果回复原${card.conversation_kind === 'group' ? '群' : '私聊'} · ${card.runner === 'codex' ? 'Codex 只读 PR 完整快照审查' : card.runner === 'claude-code' ? 'Claude Code PR 完整快照审查试用' : 'DSH 文字处理'} · ${new Date(card.expires_at * 1000).toLocaleString('zh-CN')} 到期`),
+          h('button', { type: 'button', disabled: busy, onClick: () => void revokeCard(card), style: secondaryButtonStyle }, '停止'))),
+        activeCards.length === 0 ? h('p', { style: mutedTextStyle },
+          authorizationLoadError ? '暂时无法确认已开放的能力，请刷新状态后再试。'
+            : '还没有开放能力。先选机器人，再开放一项能力；PR 审查只是可选示例。') : null,
+        h('h4', { style: { marginBottom: 0 } }, '最近任务'),
+        ...(tasks.filter((task) => task.task_id).length ? tasks.filter((task) => task.task_id)
+          .map((task) => h('div', { key: task.task_id, style: { display: 'flex', gap: 12, alignItems: 'center',
+            justifyContent: 'space-between', flexWrap: 'wrap', borderTop: '1px solid var(--dsw-alias-border-l2)', paddingTop: 8 } },
+            h('span', { style: { flex: '1 1 280px', minWidth: 0, overflowWrap: 'anywhere' } }, `${task.task_id} · ${task.title || (task.pr_number ? `PR #${task.pr_number} 差异审查` : '任务')} · ${task.outcome === 'canceled' ? '已取消' : task.outcome === 'failed' ? '未完成' : ({
+              pending: '排队中', running: '处理中', reply_pending: '结果待发送', reply_attempted: '回复状态待核对', done: '已回复',
+            }[task.status] || task.status)}`),
+            ['card_task', 'legacy_pr_task'].includes(task.kind) && ['pending', 'running'].includes(task.status) ? h('button', { type: 'button', disabled: busy,
+              onClick: () => void cancelTask(task), style: secondaryButtonStyle }, '取消任务') : null))
+          : [h('p', { key: 'none', style: mutedTextStyle }, loadFailures.includes('status')
+            ? '任务记录暂时无法读取，请刷新状态。' : '暂无任务。')]),
+        h('details', { id: 'ant-new-task', open: createOpen,
+          onToggle: (event) => setCreateOpen(event.currentTarget.open),
+          style: { border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 8, padding: 12 } },
+          h('summary', { style: { cursor: 'pointer', fontWeight: 600 } }, '开放一项能力'),
+        h('form', { onSubmit: createCard, style: { display: 'grid', gap: 9, maxWidth: 760 } },
+          h('p', { style: mutedTextStyle }, selectedBot
+            ? `当前机器人：${selectedBot.name}${selectedEnrollmentBound ? ' · 已绑定此设备' : ' · 请先绑定到此设备'}`
+            : '请先在上方选择机器人并启用协作。'),
+          selectedEnrollmentBound ? h('p', { style: mutedTextStyle },
+            '机器人及其任务能力只在这台 DSH 设备接收和执行；同一账号的其他设备不会继承本机授权。') : null,
+          selectedEnrollment && !selectedEnrollmentBound ? h('p', { style: mutedTextStyle },
+            '这是尚未绑定到设备的机器人。请在要继续使用它的电脑重新启用；Gitea 地址和配置记录会保留。若旧设备访问曾被撤销，原任务权限不会恢复，需要重新开放。') : null,
+          selectedBot && conversationKind === 'group' && !selectedBot.history_available ? h('p', { role: 'status', style: mutedTextStyle },
+            '这个机器人当前不能读取平台群历史；群聊只能参考实际送达的消息和本机近期记录。请检查 DSH-IM 权限。') : null,
+          h('label', null, '能力名称', h('input', { required: true, maxLength: 100, value: title,
+            onChange: (event) => setTitle(event.target.value), placeholder: '例如：总结项目进度', style: inputStyle })),
+          h('label', null, '什么请求属于这项能力', h('textarea', { required: true, maxLength: 1000, rows: 2, value: intent,
+            onChange: (event) => setIntent(event.target.value), placeholder: '例如：把群里讨论的本周进展整理成摘要', style: inputStyle })),
+          h('label', null, '同事可能怎么说（每行一句，可选）', h('textarea', { rows: 2, value: examples,
+            onChange: (event) => setExamples(event.target.value), placeholder: '帮我总结一下刚才的讨论', style: inputStyle })),
+          h('label', null, '处理要求', h('textarea', { required: true, maxLength: 4000, rows: 3, value: taskPrompt,
+            onChange: (event) => setTaskPrompt(event.target.value), placeholder: '只使用当前会话可见的内容，列出结论和待办', style: inputStyle })),
+          h('label', null, '执行方', h('select', { value: runner,
+            onChange: (event) => setRunner(event.target.value), style: inputStyle },
+            h('option', { value: 'dsh' }, 'DSH · 已提供文字'),
+            h('option', { value: 'codex',
+              disabled: !codexAvailable }, 'Codex · 单个 Gitea PR 完整快照，只读'),
+            h('option', { value: 'claude-code', disabled: !claudeCodeAvailable },
+              'Claude Code · 单个 Gitea PR 完整快照试用'))),
+          nativePrUnavailableReason ? h('p', { role: 'status', style: mutedTextStyle },
+            `${nativePrUnavailableReason}，已禁用 Codex/Claude Code 完整快照选项；可选择 DSH 差异审查。`) : null,
+          runner === 'codex' ? h('p', { role: 'status', style: mutedTextStyle },
+            'Codex 使用这台电脑的登录账号及其用量；ANT 为每项能力维护仓库缓存，每次审查创建固定到 PR Head 的临时代码快照。Codex 只能只读查看该快照；不会收到 Gitea 令牌。Git LFS 实际文件不会下载。') : null,
+          runner === 'claude-code' ? h('p', { role: 'status', style: mutedTextStyle },
+            'Claude Code 通过 DSH 已注册的子代理运行，可查看本次 PR 的临时代码快照。ANT 不会传 Gitea 令牌；Claude Code 沿用 DSH 提供方的本机权限，不具备 Codex 路径相同的固定只读隔离。Git LFS 实际文件不会下载。') : null,
+          selectedRunnerNeedsPr ? h('p', { role: 'status', style: mutedTextStyle },
+            '本机 PR 执行方需要 Gitea granular token 的只读权限 read:repository 和 read:user；read:user 仅用于这台 DSH 获取 Git HTTPS 登录名。') : null,
+          h('p', { role: 'status', style: mutedTextStyle },
+            `开放后：${requesterSummary}可请求 · 有效期 ${days} 天 · ${resultRouteSummary}`),
+          h('details', { style: { border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 8, padding: 10 } },
+            h('summary', { style: { cursor: 'pointer' } }, '参数与授权范围'),
+          h('div', null, h('strong', null, '需要从请求中确认的参数'),
+            h('p', { style: mutedTextStyle }, '可不添加参数。参数键使用英文，给同事看的中文问题填在参数说明；需要指定 PR 时选“Gitea PR 编号”，系统会核对它是否存在。自由文本留在本机，服务端只核对长度和摘要。')),
+          ...parameters.map((rule, index) => h('div', { key: index, style: { display: 'flex', flexWrap: 'wrap', gap: 8,
+            padding: 8, border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 8 } },
+            h('input', { 'aria-label': '参数键（英文）', value: rule.name, maxLength: 32, placeholder: '英文键，例如 pr_number',
+              onChange: (event) => updateParameter(index, { name: event.target.value }), style: { ...inputStyle, flex: '1 1 150px' } }),
+            h('input', { 'aria-label': '参数说明', value: rule.description, maxLength: 100,
+              onChange: (event) => updateParameter(index, { description: event.target.value }),
+              placeholder: '给同事看的问题，例如要审查哪个 PR', style: { ...inputStyle, flex: '1 1 230px' } }),
+            h('select', { 'aria-label': '参数类型', value: rule.kind,
+              onChange: (event) => updateParameter(index, { kind: event.target.value }), style: { ...inputStyle, flex: '1 1 150px' } },
+              h('option', { value: 'text' }, '文本'), h('option', { value: 'integer' }, '整数'),
+              h('option', { value: 'choice' }, '选项'), h('option', { value: 'gitea_pr' }, 'Gitea PR 编号')),
+            h('label', null, h('input', { type: 'checkbox', checked: rule.required,
+              onChange: (event) => updateParameter(index, { required: event.target.checked }) }), ' 必填'),
+            ['integer', 'gitea_pr'].includes(rule.kind) ? h('input', { 'aria-label': '最小值', type: 'number', value: rule.min,
+              onChange: (event) => updateParameter(index, { min: event.target.value }), placeholder: '最小值', style: { ...inputStyle, width: 120 } }) : null,
+            ['text', 'integer', 'gitea_pr'].includes(rule.kind) ? h('input', { 'aria-label': '最大值', type: 'number', value: rule.max,
+              onChange: (event) => updateParameter(index, { max: event.target.value }), placeholder: '最大值', style: { ...inputStyle, width: 120 } }) : null,
+            rule.kind === 'choice' ? h('input', { 'aria-label': '可选值', value: rule.choices,
+              onChange: (event) => updateParameter(index, { choices: event.target.value }), placeholder: '用逗号分隔选项', style: { ...inputStyle, flex: '1 1 250px' } }) : null,
+            rule.kind === 'gitea_pr' ? h('span', { style: mutedTextStyle },
+              `使用机器人的可信 Gitea 地址：${selectedEnrollment?.gitea_origin || trustedOrigin || '请在下方登记一次'}`) : null,
+            rule.kind === 'gitea_pr' ? h('input', { 'aria-label': 'Gitea 仓库', value: rule.repository,
+              onChange: (event) => updateParameter(index, { repository: event.target.value }), placeholder: '团队/仓库', style: { ...inputStyle, flex: '1 1 180px' } }) : null,
+            h('button', { type: 'button', style: secondaryButtonStyle,
+              onClick: () => setParameters((current) => current.filter((_, i) => i !== index)) }, '移除参数'))),
+          h('button', { type: 'button', disabled: parameters.length >= 12, style: secondaryButtonStyle,
+            onClick: () => setParameters((current) => [...current, { name: '', kind: 'text', required: true,
+              description: '', min: '', max: '', choices: '', gitea_origin: '', repository: '' }]) }, '添加参数'),
+          parameters.some((rule) => rule.kind === 'gitea_pr') ? h('div', { style: { display: 'flex', gap: 8, flexWrap: 'wrap' } },
+            h('input', { 'aria-label': '这个机器人的可信 Gitea 地址', type: 'url', value: trustedOrigin,
+              onChange: (event) => setTrustedOrigin(event.target.value), placeholder: '可信 Gitea 地址',
+              style: { ...inputStyle, flex: '1 1 260px' } }),
+            h('button', { type: 'button', disabled: busy || !trustedOrigin.trim() || !selectedBot,
+              onClick: () => void (selectedEnrollmentBound ? saveTrustedOrigin() : enrollBot()), style: secondaryButtonStyle },
+              selectedEnrollmentBound ? '保存可信地址' : '绑定到这台 DSH 并保存地址')) : null,
+          parameters.some((rule) => rule.kind === 'gitea_pr') ? h('div', { style: { display: 'flex', gap: 8, flexWrap: 'wrap' } },
+            h('input', { 'aria-label': '只读 Gitea 访问令牌', type: 'password', autoComplete: 'off', value: giteaToken,
+              onChange: (event) => setGiteaToken(event.target.value), placeholder: tokenConfigured ? '本机已保存 Gitea 令牌' : '先保存只读 Gitea 令牌',
+              style: { ...inputStyle, flex: '1 1 260px' } }),
+            h('button', { type: 'button', disabled: busy || !giteaToken.trim(),
+              onClick: () => void saveGiteaToken(), style: secondaryButtonStyle }, '保存令牌')) : null,
+          parameters.some((rule) => rule.kind === 'gitea_pr') ? h('p', { style: mutedTextStyle },
+            '令牌只保存在这台 DSH，用于读取 PR，不会提交到 ANT 服务端或交给执行方。') : null,
+          h('label', null, '使用场景', h('select', { value: conversationKind,
             onChange: (event) => { setConversationKind(event.target.value); setGroupId('') }, style: inputStyle },
-            h('option', { value: 'dm' }, '私聊这个机器人'),
-            groupReady ? h('option', { value: 'group' }, '仅所选飞书群') : null),
-          conversationKind === 'group' ? h('p', { style: mutedTextStyle },
-            '让群成员先在目标群 @机器人一次，然后刷新列表。向群成员核对机器人回复的识别码；启用后，该群成员都能看到审查结果。') : null,
-          conversationKind === 'group' ? h('div', { style: { display: 'flex', gap: 8 } },
-            h('select', { 'aria-label': '待启用群', required: true, value: groupId,
-              onChange: (event) => setGroupId(event.target.value), style: { ...inputStyle, flex: 1 } },
-              h('option', { value: '' }, '选择待启用群'),
-              ...botGroups.map((group) => h('option', { key: group.group_id, value: group.group_id },
-                `识别码 ${group.group_code} · ${new Date(group.last_seen_at * 1000).toLocaleString('zh-CN')} · ${group.group_id}${group.active_grants ? ' · 已有授权' : ' · 待启用'}`))),
-            h('button', { type: 'button', disabled: busy, onClick: () => void refresh().catch((error) => setMessage(error.message)),
-              style: secondaryButtonStyle }, '刷新群列表')) : null,
-          h('label', { htmlFor: 'ant-delegation-repository' }, '仓库'),
-          h('input', { id: 'ant-delegation-repository', required: true, value: repository,
-            onChange: (event) => setRepository(event.target.value), placeholder: '团队名/仓库名', style: inputStyle }),
-          h('label', { htmlFor: 'ant-delegation-pr' }, '允许审查的 PR 编号'),
-          h('input', { id: 'ant-delegation-pr', type: 'number', min: 1, required: true, value: prNumber,
-            onChange: (event) => setPrNumber(event.target.value), style: inputStyle }),
-          h('label', { htmlFor: 'ant-delegation-audience' }, '谁可以请求'),
-          h('select', { id: 'ant-delegation-audience', value: senderScope,
+            h('option', { value: 'dm' }, '私聊'), h('option', { value: 'group' }, '指定群聊'))),
+          conversationKind === 'group' ? h('label', null, '群聊', h('select', { required: true, value: groupId,
+            onChange: (event) => setGroupId(event.target.value), style: inputStyle },
+            h('option', { value: '' }, '让群成员先 @ 机器人，再刷新列表'),
+            ...availableGroups.map((group) => h('option', { key: group.group_id, value: group.group_id },
+              `识别码 ${group.group_code} · ${group.group_id}`)))) : null,
+          conversationKind === 'group' ? h('button', { type: 'button', disabled: busy,
+            onClick: () => void load().catch((error) => setMessage(error.message)), style: secondaryButtonStyle }, '刷新群列表') : null,
+          conversationKind === 'group' && selectedEnrollmentBound ? h('div', { style: { display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' } },
+            h('span', { style: mutedTextStyle }, selectedEnrollment.owner_bound ? '已绑定你的飞书身份，可在群内批准任务' : '群内批准前需绑定你的飞书身份'),
+            h('button', { type: 'button', disabled: busy, onClick: () => void issueBindingCode(), style: secondaryButtonStyle },
+              selectedEnrollment.owner_bound ? '重新获取绑定码' : '获取身份绑定码')) : null,
+          conversationKind === 'group' && bindingCode ? h('p', { role: 'status', style: mutedTextStyle },
+            `请你本人私聊机器人发送“绑定身份 ${bindingCode}”。完成后在群里 @机器人发送“在本群启用任务 任务名称”，并按提示确认；结果会公开回复该群。`) : null,
+          h('label', null, '谁可以请求', h('select', { value: senderScope,
             onChange: (event) => setSenderScope(event.target.value), style: inputStyle },
-            h('option', { value: 'any' }, conversationKind === 'group' ? '所选群的所有成员' : '任何能私聊这个专用机器人的人'),
-            h('option', { value: 'allowlist' }, '仅指定飞书用户 ID')),
-          senderScope === 'allowlist' ? h('input', { 'aria-label': '飞书用户 ID', required: true, value: senderIds,
+            h('option', { value: 'any' }, conversationKind === 'group' ? '此群任何成员' : '任何能私聊此机器人者'),
+            h('option', { value: 'allowlist' }, '指定 IM 用户 ID'))),
+          senderScope === 'allowlist' ? h('input', { 'aria-label': '可请求的 IM 用户 ID', required: true, value: senderIds,
             onChange: (event) => setSenderIds(event.target.value), placeholder: '多个 ID 用逗号分隔', style: inputStyle }) : null,
-          h('label', { htmlFor: 'ant-delegation-days' }, '有效期'),
-          h('select', { id: 'ant-delegation-days', value: days, onChange: (event) => setDays(Number(event.target.value)), style: inputStyle },
-            h('option', { value: 1 }, '1 天'), h('option', { value: 7 }, '7 天'), h('option', { value: 30 }, '30 天')),
-          conversationKind === 'group' ? h('p', { style: mutedTextStyle },
-            '请确认该 PR 的标题、差异和审查结果可以向整个群公开；“指定发送者”只限制谁能发起，不会把结果改成私聊。目前没有每日请求次数上限。')
-            : senderScope === 'any' ? h('p', { style: mutedTextStyle },
-              'PR 审查结果会回复给发信人；请确认该 PR 可以向这些人披露。') : null,
-          h('button', { type: 'submit', disabled: busy || !teamReady || !tokenReady || !selectedEnrolled ||
-            (conversationKind === 'group' && !groupId), style: primaryButtonStyle }, '开启这项委托')),
-        h('h4', { style: { marginBottom: 0 } }, `当前有效授权 · ${active.length}`),
-        ...active.map((grant) => h('div', { key: grant.id, style: { display: 'flex', justifyContent: 'space-between', gap: 12,
-          alignItems: 'center', borderTop: '1px solid var(--dsw-alias-border-l2)', paddingTop: 10 } },
-        h('span', null, `${grant.repository} · PR #${grant.pr_number} · ${grant.conversation_kind === 'group'
-          ? `群 ${grant.conversation_id}（${grant.sender_scope === 'any' ? '全群' : '指定发送者'}）`
-          : (grant.sender_scope === 'any' ? '任何私聊者' : '指定发送者')} · ${new Date(grant.expires_at * 1000).toLocaleString('zh-CN')} 到期`),
-        h('button', { type: 'button', disabled: busy, onClick: () => void revoke(grant), style: secondaryButtonStyle }, '停止授权'))),
-        h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', gap: 8 } },
-          h('h4', { style: { margin: 0 } }, '最近任务'),
-          h('button', { type: 'button', disabled: busy, onClick: () => void refresh().catch((error) => { setTeamReady(false); setMessage(error.message) }),
-            style: secondaryButtonStyle }, '刷新状态')),
-        ...(tasks.length ? tasks.map((task, index) => h('p', { key: `${task.created_at}-${index}`, style: mutedTextStyle },
-          `${task.created_at ? new Date(task.created_at).toLocaleString('zh-CN') + ' · ' : ''}${task.repository || '请求'}${task.pr_number ? ` · PR #${task.pr_number}` : ''} · ${{
-            pending: '待审查', reply_pending: '待回复', reply_attempted: '回复状态待核对，请查看飞书原会话',
-            done: '已回复',
-          }[task.status] || task.status}`)) : [h('p', { style: mutedTextStyle }, '暂无任务记录。')]),
+          h('label', null, '有效期', h('select', { value: days, onChange: (event) => setDays(Number(event.target.value)), style: inputStyle },
+            h('option', { value: 1 }, '1 天'), h('option', { value: 7 }, '7 天'), h('option', { value: 30 }, '30 天')))),
+          cardBlockReason ? h('p', { role: 'status', style: mutedTextStyle }, cardBlockReason) : null,
+          h('button', { disabled: busy || Boolean(cardBlockReason),
+            style: primaryButtonStyle }, '保存并开放能力'))),
+        h('details', { style: { border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 8, padding: 12 } },
+          h('summary', { style: { cursor: 'pointer', fontWeight: 600 } }, '本机处理设置'),
+          h('p', { style: mutedTextStyle }, '本机并发上限只影响这台电脑接收的新任务；PR 仓库缓存上限按这台 DSH 的长期仓库缓存总量计算，不包括任务临时工作目录。'),
+        h('div', { style: { display: 'flex', gap: 8, flexWrap: 'wrap', alignItems: 'center' } },
+          h('span', { style: mutedTextStyle }, loadFailures.includes('settings') ? '团队默认值暂未读取。'
+            : `团队默认：先看 ${defaults?.context_messages ?? 10} 条前文、最多翻阅 ${defaults?.history_max_records ?? 100} 条平台记录、同时处理 ${defaults?.max_concurrency ?? 3} 项任务。`),
+          h('button', { type: 'button', onClick: () => void load().catch((error) => setMessage(error.message)), style: secondaryButtonStyle }, '刷新')),
+        loadFailures.includes('local-settings') ? h('p', { role: 'status', style: mutedTextStyle },
+          '本机处理设置暂未读取；请刷新后重试。')
+          : h('form', { onSubmit: saveLocalProcessingSettings, style: { display: 'flex', gap: 8, flexWrap: 'wrap', alignItems: 'end' } },
+          h('label', null, '这台电脑最多同时处理',
+            h('select', { value: localConcurrency == null ? '' : String(localConcurrency),
+              onChange: (event) => setLocalConcurrency(event.target.value), style: inputStyle },
+            h('option', { value: '' }, '跟随团队默认'),
+            ...Array.from({ length: 8 }, (_, index) => h('option', { key: index + 1, value: index + 1 }, `${index + 1} 项任务`)))),
+          h('label', null, '这台电脑 PR 仓库缓存上限（GiB）',
+            h('input', { type: 'number', min: 1, max: 100, step: 1, required: true,
+              value: repositoryCacheLimitGib,
+              onChange: (event) => setRepositoryCacheLimitGib(event.target.value), style: inputStyle }),
+            h('span', { style: mutedTextStyle }, '默认 10 GiB，范围 1–100 GiB，按长期仓库文件逻辑大小计算（不含临时工作区和文件系统分配开销）。日常不会淘汰仍启用能力的缓存；停用或到期能力会在刷新时回收。单次拉取若实际越界，为恢复预算会清理这项能力的仓库缓存（旧 PR 可重新下载）。')),
+          h('button', { disabled: busy, style: secondaryButtonStyle }, '保存本机处理设置')),
+        h('p', { style: mutedTextStyle }, `本机可用执行方：${executors.map((item) => `${item.title}${item.available ? '（可用）' : `（${item.reason || '未启用或未找到'}）`}`).join('、') || '暂未读取到'}。可用选项会出现在对应能力的执行方设置中。`)),
         message ? h('p', { role: 'status', style: mutedTextStyle }, message) : null)
     }