@dsh-overdrive/gateway 0.1.3 → 0.1.5

package/dist/pending-buttons.js

@@ -0,0 +1,40 @@
+export const PENDING_BUTTONS_TTL_MS = 5 * 60_000;
+/**
+ * 编号回复兜底的按钮暂存（带 TTL）。
+ *
+ * 审批/危险操作按钮发出后，用户在聊天里回复数字（"1"/"2"…）选择；
+ * 若按钮长期不消费，后续的普通数字消息会被误判成按钮回复。
+ * 本类在 TTL（默认 5 分钟）后自动失效，杜绝"过期按钮吞消息"。
+ */
+export class PendingButtons {
+    ttlMs;
+    map = new Map();
+    constructor(ttlMs = PENDING_BUTTONS_TTL_MS) {
+        this.ttlMs = ttlMs;
+    }
+    set(chatId, buttons) {
+        this.map.set(chatId, { buttons, expiresAt: Date.now() + this.ttlMs });
+    }
+    /** 数字回复命中：返回匹配按钮并消费（删除）；无 pending / 已过期 / 非数字或越界返回 undefined。 */
+    match(chatId, text) {
+        const entry = this.map.get(chatId);
+        if (!entry)
+            return undefined;
+        if (entry.expiresAt < Date.now()) {
+            this.map.delete(chatId);
+            return undefined;
+        }
+        const n = Number(text.trim());
+        if (!Number.isInteger(n) || n < 1 || n > entry.buttons.length)
+            return undefined;
+        const button = entry.buttons[n - 1];
+        if (button)
+            this.map.delete(chatId);
+        return button;
+    }
+    /** 消费原生按钮点击（如 WhatsApp 原生交互按钮）：删除该 chat 的 pending。 */
+    consume(chatId) {
+        this.map.delete(chatId);
+    }
+}
+//# sourceMappingURL=pending-buttons.js.map

package/dist/pending-buttons.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-buttons.js","sourceRoot":"","sources":["../src/pending-buttons.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AAOjD;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IAGI;IAFZ,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE7D,YAA6B,QAAgB,sBAAsB;QAAtC,UAAK,GAAL,KAAK,CAAiC;IAAG,CAAC;IAEvE,GAAG,CAAC,MAAc,EAAE,OAAyB;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,MAAc,EAAE,IAAY;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sDAAsD;IACtD,OAAO,CAAC,MAAc;QACpB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/session.d.ts

@@ -2,9 +2,13 @@ export declare function buildSessionKey(adapterId: string, msg: {
     chatId: string;
     userId: string;
 }): string;
-/** 空列表 = 开发模式放行所有；生产环境必须显式配置。 */
+/**
+ * 白名单：默认 fail-closed —— 只有显式配置了条目才放行；
+ * 开发环境可用 ALLOW_ALL=1 显式放行所有（比空列表隐式放行安全得多）。
+ */
 export declare class Allowlist {
     private readonly entries;
-    constructor(entries: string[]);
+    private readonly allowAll;
+    constructor(entries: string[], allowAll?: boolean);
     allows(key: string): boolean;
 }

package/dist/session.js

@@ -2,14 +2,19 @@ import { sessionKey } from '@dsh-overdrive/sdk';
 export function buildSessionKey(adapterId, msg) {
     return sessionKey(adapterId, msg.chatId, msg.userId);
 }
-/** 空列表 = 开发模式放行所有；生产环境必须显式配置。 */
+/**
+ * 白名单：默认 fail-closed —— 只有显式配置了条目才放行；
+ * 开发环境可用 ALLOW_ALL=1 显式放行所有（比空列表隐式放行安全得多）。
+ */
 export class Allowlist {
     entries;
-    constructor(entries) {
+    allowAll;
+    constructor(entries, allowAll = false) {
         this.entries = entries;
+        this.allowAll = allowAll;
     }
     allows(key) {
-        return this.entries.length === 0 || this.entries.includes(key);
+        return this.allowAll || (this.entries.length > 0 && this.entries.includes(key));
     }
 }
 //# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,GAAuC;IAEvC,OAAO,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,iCAAiC;AACjC,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,OAAiB;QAAjB,YAAO,GAAP,OAAO,CAAU;IAAG,CAAC;IAElD,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;CACF"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,GAAuC;IAEvC,OAAO,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,SAAS;IAED;IACA;IAFnB,YACmB,OAAiB,EACjB,WAAW,KAAK;QADhB,YAAO,GAAP,OAAO,CAAU;QACjB,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
-{
+{
   "name": "@dsh-overdrive/gateway",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "scripts": {
     "build": "tsc"
@@ -10,7 +10,7 @@
     "dsh-overdrive-setup": "dist/setup.js"
   },
   "dependencies": {
-    "@dsh-overdrive/sdk": "0.1.1",
+    "@dsh-overdrive/sdk": "0.1.2",
     "@larksuiteoapi/node-sdk": "^1.50.0",
     "@slack/bolt": "^3.0.0",
     "@whiskeysockets/baileys": "^6.0.1",

package/src/adapter.ts

@@ -12,6 +12,12 @@ export interface OutboundPayload {
   buttons?: OutboundButton[];
 }
 
+/** 按钮回执的点击者身份（用于白名单校验）。chatId 在个别平台回调中可能缺失，缺失时按未授权处理（fail-closed）。 */
+export interface ReplySender {
+  chatId: string;
+  userId: string;
+}
+
 /** 平台适配器契约：M2/M3 的 WhatsApp/Telegram/… 都实现它。 */
 export interface Adapter {
   readonly id: string;
@@ -22,5 +28,6 @@ export interface Adapter {
   /** 可选：连接状态（供控制台）。 */
   status?(): { connected: boolean };
   onMessage(cb: (msg: NormalizedMessage) => void): void;
-  onReply(cb: (buttonId: string) => void): void;
+  /** 按钮点击回执：buttonId + 点击者身份。身份缺失即传空字符串，由上层按未授权处理。 */
+  onReply(cb: (buttonId: string, sender: ReplySender) => void): void;
 }

package/src/adapters/cli.ts

@@ -5,7 +5,7 @@ import type { Adapter, NormalizedMessage, OutboundPayload } from '../adapter.js'
 export class CliAdapter implements Adapter {
   readonly id = 'cli';
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
   private rl?: ReturnType<typeof createInterface>;
 
   async connect(): Promise<void> {
@@ -15,7 +15,7 @@ export class CliAdapter implements Adapter {
       if (!trimmed) return;
       const btn = trimmed.match(/^\/btn\s+(\S+)$/i);
       if (btn) {
-        this.replyCb?.(btn[1]);
+        this.replyCb?.(btn[1], { chatId: 'cli', userId: 'local' });
         return;
       }
       this.messageCb?.({ chatId: 'cli', userId: 'local', text: trimmed });
@@ -31,7 +31,7 @@ export class CliAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   /** CLI 是本地进程内适配器：恒为已连接。 */
   status(): { connected: boolean } { return { connected: true }; }
 }

package/src/adapters/dingtalk.ts

@@ -1,5 +1,6 @@
 import type { Adapter, NormalizedMessage, OutboundButton, OutboundPayload } from '../adapter.js';
-import { DWClient, TOPIC_ROBOT, type RobotMessage } from 'dingtalk-stream-sdk-nodejs';
+import { PendingButtons } from '../pending-buttons.js';
+import { DWClient, TOPIC_CARD, TOPIC_ROBOT, type RobotMessage } from 'dingtalk-stream-sdk-nodejs';
 
 // dingtalk-stream-sdk-nodejs@2.0.4 实测：exports 提供 DWClient + TOPIC_ROBOT
 // （/v1.0/im/bot/messages/get）；回调 registerCallbackListener(TOPIC_ROBOT, (msg) => …)，
@@ -41,6 +42,76 @@ export function matchNumberedButton(text: string, buttons: OutboundButton[]): Ou
   return buttons[n - 1];
 }
 
+/** 按钮 id（"approve:<reqId>" / "reject:<reqId>"）→ 卡片回调载荷 JSON 字符串。 */
+export function buttonCallbackData(button: OutboundButton): string {
+  const idx = button.id.indexOf(':');
+  return JSON.stringify({
+    action: idx >= 0 ? button.id.slice(0, idx) : button.id,
+    reqId: idx >= 0 ? button.id.slice(idx + 1) : '',
+  });
+}
+
+/** 钉钉 actionCard 消息体（Roadmap v0.2）。按钮回调经 TOPIC_CARD 走 Stream 返回。 */
+export function buildActionCard(text: string, buttons: OutboundButton[]): {
+  msgtype: 'actionCard';
+  actionCard: { title: string; text: string; btnOrientation: string; btns: Array<{ title: string; actionURL: string }> };
+} {
+  return {
+    msgtype: 'actionCard',
+    actionCard: {
+      title: '需要批准',
+      text,
+      btnOrientation: '1',
+      btns: buttons.map((b) => ({
+        title: b.label,
+        actionURL: `dingtalk://dingtalkclient/action/openapp?cardCallbackData=${encodeURIComponent(buttonCallbackData(b))}`,
+      })),
+    },
+  };
+}
+
+export interface CardCallbackResult {
+  buttonId: string;
+  chatId?: string;
+  userId?: string;
+}
+
+/**
+ * 钉钉卡片回调载荷 → { buttonId, chatId?, userId? }。
+ * Stream 模式下回调 JSON 的字段名（cardCallbackData / params / cardActionData，以及会话/用户字段）
+ * 在不同卡片版本有差异，这里做多路径深度兜底解析；真机验证后可按实际字段收敛。找不到返回 null。
+ */
+export function parseCardCallback(raw: unknown): CardCallbackResult | null {
+  let buttonId: string | null = null;
+  let chatId: string | undefined;
+  let userId: string | undefined;
+
+  const visit = (obj: unknown, depth: number): void => {
+    if (depth > 5 || !obj || typeof obj !== 'object') return;
+    for (const [key, value] of Object.entries(obj as Record<string, unknown>)) {
+      if (!buttonId && typeof value === 'string' && (key === 'cardCallbackData' || key === 'params' || key === 'cardActionData')) {
+        try {
+          const parsed = JSON.parse(value) as { action?: string; reqId?: string };
+          if ((parsed.action === 'approve' || parsed.action === 'reject') && typeof parsed.reqId === 'string' && parsed.reqId) {
+            buttonId = `${parsed.action}:${parsed.reqId}`;
+          }
+        } catch {
+          /* 该字段不是 JSON 载荷，继续往下找 */
+        }
+      }
+      if (!chatId && typeof value === 'string' && (key === 'conversationId' || key === 'conversation_id') && value) {
+        chatId = value;
+      }
+      if (!userId && typeof value === 'string' && (key === 'senderStaffId' || key === 'senderId' || key === 'userid' || key === 'userId') && value) {
+        userId = value;
+      }
+      if (typeof value === 'object') visit(value, depth + 1);
+    }
+  };
+  visit(raw, 0);
+  return buttonId ? { buttonId, chatId, userId } : null;
+}
+
 // ── 适配器 ────────────────────────────────────────────────────
 
 export interface DingTalkAdapterOptions {
@@ -53,8 +124,8 @@ export class DingTalkAdapter implements Adapter {
   private client?: DWClient;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
-  private readonly pendingButtons = new Map<string, OutboundButton[]>();
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
+  private readonly pendingButtons = new PendingButtons();
   /** conversationId → 最近的 sessionWebhook（回复通道，过期由钉钉侧管理） */
   private readonly webhooks = new Map<string, string>();
 
@@ -73,17 +144,29 @@ export class DingTalkAdapter implements Adapter {
       const parsed = parseBotMessage(data);
       if (!parsed) return;
       this.webhooks.set(parsed.chatId, parsed.sessionWebhook);
-      const pending = this.pendingButtons.get(parsed.chatId);
-      if (pending) {
-        const button = matchNumberedButton(parsed.text, pending);
-        if (button) {
-          this.pendingButtons.delete(parsed.chatId);
-          this.replyCb?.(button.id);
-          return;
-        }
+      const button = this.pendingButtons.match(parsed.chatId, parsed.text);
+      if (button) {
+        this.replyCb?.(button.id, { chatId: parsed.chatId, userId: parsed.userId });
+        return;
       }
       this.messageCb?.({ chatId: parsed.chatId, userId: parsed.userId, text: parsed.text });
     });
+    // 原生 actionCard 按钮回调（Stream 模式，Roadmap v0.2）
+    client.registerCallbackListener(TOPIC_CARD, (msg) => {
+      let data: unknown;
+      try {
+        data = JSON.parse(msg.data) as unknown;
+      } catch {
+        return;
+      }
+      const result = parseCardCallback(data);
+      if (result) {
+        this.replyCb?.(result.buttonId, {
+          chatId: result.chatId ?? result.userId ?? '',
+          userId: result.userId ?? '',
+        });
+      }
+    });
     await client.connect();
     this.connected = true;
     console.log('[dingtalk] 钉钉 Stream 已连接');
@@ -92,7 +175,19 @@ export class DingTalkAdapter implements Adapter {
   async send(chatId: string, payload: OutboundPayload): Promise<void> {
     const webhook = this.webhooks.get(chatId);
     if (!webhook) throw new Error(`钉钉会话 ${chatId} 无可用 sessionWebhook（先让用户发一条消息）`);
-    if (payload.buttons?.length) this.pendingButtons.set(chatId, payload.buttons);
+    if (payload.buttons?.length) {
+      this.pendingButtons.set(chatId, payload.buttons); // 卡片之外仍支持编号回复兜底
+      const res = await fetch(webhook, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(buildActionCard(payload.text, payload.buttons)),
+      });
+      if (!res.ok) {
+        const body = await res.text();
+        throw new Error(`钉钉回发失败 ${res.status}: ${body.slice(0, 200)}`);
+      }
+      return;
+    }
     const text = buildNumberedText(payload.text, payload.buttons ?? []);
     const res = await fetch(webhook, {
       method: 'POST',
@@ -106,6 +201,6 @@ export class DingTalkAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/discord.ts

@@ -64,7 +64,7 @@ export class DiscordAdapter implements Adapter {
   private readonly client: Client;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
 
   constructor(opts: DiscordAdapterOptions) {
     this.client = new Client({
@@ -89,7 +89,10 @@ export class DiscordAdapter implements Adapter {
       if (!interaction.isButton()) return;
       const button = interaction as ButtonInteraction;
       await button.deferUpdate().catch(() => undefined);
-      this.replyCb?.(button.customId);
+      this.replyCb?.(button.customId, {
+        chatId: button.channelId,
+        userId: button.user.id,
+      });
     });
   }
 
@@ -112,6 +115,6 @@ export class DiscordAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/feishu.ts

@@ -1,5 +1,6 @@
 import lark from '@larksuiteoapi/node-sdk';
 import type { Adapter, NormalizedMessage, OutboundButton, OutboundPayload } from '../adapter.js';
+import { PendingButtons } from '../pending-buttons.js';
 
 // @larksuiteoapi/node-sdk 是 CommonJS 包（main=lib/index.js，无 "type":"module"）：
 // Node 原生 ESM 下必须 default 导入后解构（同 M2b 的 @slack/bolt 处理）。
@@ -46,6 +47,42 @@ export function matchNumberedButton(text: string, buttons: OutboundButton[]): Ou
   return buttons[n - 1];
 }
 
+/** 按钮 id（"approve:<reqId>" / "reject:<reqId>"）→ 卡片按钮 value。 */
+export function buttonValue(button: OutboundButton): { action: string; reqId: string } {
+  const idx = button.id.indexOf(':');
+  return {
+    action: idx >= 0 ? button.id.slice(0, idx) : button.id,
+    reqId: idx >= 0 ? button.id.slice(idx + 1) : '',
+  };
+}
+
+/** 交互卡片 JSON（msg_type: interactive）。原生按钮点击走 card.action.trigger 回调。 */
+export function buildApprovalCard(text: string, buttons: OutboundButton[]): string {
+  const actions = buttons.map((b) => ({
+    tag: 'button',
+    text: { tag: 'plain_text', content: b.label },
+    type: b.id.startsWith('approve:') ? 'primary' : 'default',
+    value: buttonValue(b),
+  }));
+  const card = {
+    config: { wide_screen_mode: true },
+    header: { title: { tag: 'plain_text', content: text.slice(0, 60) }, template: 'blue' },
+    elements: [
+      { tag: 'div', text: { tag: 'lark_md', content: text } },
+      { tag: 'action', actions },
+    ],
+  };
+  return JSON.stringify(card);
+}
+
+/** 卡片回调 value → 按钮 id（"approve:<reqId>"）；缺字段返回 null。 */
+export function cardActionToButtonId(value: unknown): string | null {
+  if (!value || typeof value !== 'object') return null;
+  const { action, reqId } = value as { action?: unknown; reqId?: unknown };
+  if ((action !== 'approve' && action !== 'reject') || typeof reqId !== 'string' || !reqId) return null;
+  return `${action}:${reqId}`;
+}
+
 // ── 适配器 ────────────────────────────────────────────────────
 
 export interface FeishuAdapterOptions {
@@ -59,8 +96,8 @@ export class FeishuAdapter implements Adapter {
   private ws?: InstanceType<typeof WSClient>;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
-  private readonly pendingButtons = new Map<string, OutboundButton[]>();
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
+  private readonly pendingButtons = new PendingButtons();
   /** chatId → 最近一条入站消息的 message_id（send 优先 reply，缺失则 create 兜底） */
   private readonly lastMessageIds = new Map<string, string>();
 
@@ -78,17 +115,29 @@ export class FeishuAdapter implements Adapter {
         const normalized = parseFeishuTextMessage(data);
         if (!normalized) return;
         const chatId = normalized.chatId;
-        const pending = this.pendingButtons.get(chatId);
-        if (pending) {
-          const button = matchNumberedButton(normalized.text, pending);
-          if (button) {
-            this.pendingButtons.delete(chatId);
-            this.replyCb?.(button.id);
-            return;
-          }
+        const button = this.pendingButtons.match(chatId, normalized.text);
+        if (button) {
+          this.replyCb?.(button.id, { chatId, userId: normalized.userId });
+          return;
         }
         this.messageCb?.(normalized);
       },
+      // 原生交互卡片按钮回调 → 审批应答（Roadmap v0.2）
+      // 载荷字段（operator.open_id / context.open_chat_id）取自官方卡片回调事件；
+      // 个别版本字段名可能不同 —— 拿不到身份时上层按未授权处理（fail-closed），编号回复兜底不受影响。
+      'card.action.trigger': async (data: {
+        action?: { value?: unknown };
+        operator?: { open_id?: string };
+        context?: { open_chat_id?: string };
+      }) => {
+        const buttonId = cardActionToButtonId(data?.action?.value);
+        if (buttonId) {
+          this.replyCb?.(buttonId, {
+            chatId: data?.context?.open_chat_id ?? '',
+            userId: data?.operator?.open_id ?? '',
+          });
+        }
+      },
     });
     this.ws = new WSClient({
       appId: this.opts.appId,
@@ -101,7 +150,23 @@ export class FeishuAdapter implements Adapter {
   }
 
   async send(chatId: string, payload: OutboundPayload): Promise<void> {
-    if (payload.buttons?.length) this.pendingButtons.set(chatId, payload.buttons);
+    if (payload.buttons?.length) {
+      this.pendingButtons.set(chatId, payload.buttons); // 卡片之外仍支持编号回复兜底
+      const content = buildApprovalCard(payload.text, payload.buttons);
+      const messageId = this.lastMessageIds.get(chatId);
+      if (messageId) {
+        await this.client.im.message.reply({
+          path: { message_id: messageId },
+          data: { msg_type: 'interactive', content },
+        });
+      } else {
+        await this.client.im.message.create({
+          params: { receive_id_type: 'chat_id' },
+          data: { receive_id: chatId, msg_type: 'interactive', content },
+        });
+      }
+      return;
+    }
     const text = buildNumberedText(payload.text, payload.buttons ?? []);
     const content = JSON.stringify({ text });
     const messageId = this.lastMessageIds.get(chatId);
@@ -121,6 +186,6 @@ export class FeishuAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/slack.ts

@@ -69,7 +69,7 @@ export class SlackAdapter implements Adapter {
   private readonly app: InstanceType<typeof App>;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
 
   constructor(opts: SlackAdapterOptions) {
     this.app = new App({ token: opts.botToken, appToken: opts.appToken, socketMode: true });
@@ -82,8 +82,18 @@ export class SlackAdapter implements Adapter {
     });
     this.app.action(/^approve:|^reject:/, async ({ ack, body, respond }) => {
       await ack();
-      const action = (body as { actions?: Array<{ value?: string }> }).actions?.[0];
-      if (action?.value) this.replyCb?.(action.value);
+      const b = body as {
+        actions?: Array<{ value?: string }>;
+        user?: { id?: string };
+        channel?: { id?: string };
+      };
+      const action = b.actions?.[0];
+      if (action?.value) {
+        this.replyCb?.(action.value, {
+          chatId: b.channel?.id ?? '',
+          userId: b.user?.id ?? '',
+        });
+      }
       await respond({ text: '处理中…', replace_original: false }).catch(() => undefined);
     });
     await this.app.start(0); // Socket Mode 不需要端口；start(0) 仅建立连接
@@ -100,6 +110,6 @@ export class SlackAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/telegram.ts

@@ -10,8 +10,8 @@ export interface RawTelegramMessage {
     text?: string;
     caption?: string;
     photo?: Array<{ file_id?: string }>;
-    voice?: { file_id?: string };
-    audio?: { file_id?: string };
+    voice?: { file_id?: string; mime_type?: string };
+    audio?: { file_id?: string; mime_type?: string };
     video?: { file_id?: string };
     document?: { file_id?: string };
   };
@@ -22,6 +22,16 @@ export function telegramPhotoFileId(photo: Array<{ file_id?: string }>): string
   return photo[photo.length - 1]?.file_id;
 }
 
+/** 纯函数：语音消息的 file_id（voice 或 audio）；无返回 undefined。 */
+export function telegramVoiceFileId(raw: RawTelegramMessage): string | undefined {
+  return raw.message?.voice?.file_id ?? raw.message?.audio?.file_id;
+}
+
+/** 纯函数：语音消息的 MIME（voice 优先，audio 兜底）。 */
+export function telegramVoiceMime(raw: RawTelegramMessage): string | undefined {
+  return raw.message?.voice?.mime_type ?? raw.message?.audio?.mime_type;
+}
+
 /** 纯函数：Telegram 文件下载 URL 模板。file_path 需 getFile(file_id) 换取（真实调用在 adapter 薄层）。 */
 export function telegramImageUrl(token: string, filePath: string): string {
   return `https://api.telegram.org/file/bot${token}/${filePath}`;
@@ -34,7 +44,9 @@ export function normalizeTelegramMessage(raw: RawTelegramMessage): NormalizedMes
   const text = msg.text ?? msg.caption ?? '';
   let media: NormalizedMessage['media'];
   if (msg.photo?.length) media = { kind: 'image' }; // url 由 adapter getFile 薄层填充
-  else if (msg.voice || msg.audio) media = { kind: 'voice' };
+  else if (msg.voice || msg.audio) {
+    media = { kind: 'voice', mime: telegramVoiceMime(raw) }; // url 由 adapter getFile 薄层填充（ASR 用）
+  }
   else if (msg.video) media = { kind: 'video' };
   else if (msg.document) media = { kind: 'file' };
   if (!text && !media) return null;
@@ -57,7 +69,7 @@ export class TelegramAdapter implements Adapter {
   private readonly token: string;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
 
   constructor(opts: TelegramAdapterOptions) {
     this.token = opts.token;
@@ -74,17 +86,26 @@ export class TelegramAdapter implements Adapter {
     this.bot.on('callback_query:data', async (ctx) => {
       const data = ctx.callbackQuery.data;
       await ctx.answerCallbackQuery().catch(() => undefined);
-      this.replyCb?.(data);
+      const chat = ctx.callbackQuery.message?.chat as { id?: number | string } | undefined;
+      this.replyCb?.(data, {
+        chatId: String(chat?.id ?? ''),
+        userId: String(ctx.callbackQuery.from.id),
+      });
     });
     this.bot.catch((err) => console.error('[telegram]', err));
     void this.bot.start(); // 长轮询（自托管无需 webhook）
   }
 
-  /** 薄层：photo → getFile(file_id) 换 file_path → 下载 URL 填充 msg.media.url（纯函数只做模板）。 */
+  /** 薄层：photo/voice/audio → getFile(file_id) 换 file_path → 下载 URL 填充 msg.media.url（纯函数只做模板）。 */
   private async handleMessage(raw: RawTelegramMessage): Promise<void> {
     const msg = normalizeTelegramMessage(raw);
     if (!msg) return;
-    const fileId = msg.media?.kind === 'image' ? telegramPhotoFileId(raw.message?.photo ?? []) : undefined;
+    const fileId =
+      msg.media?.kind === 'image'
+        ? telegramPhotoFileId(raw.message?.photo ?? [])
+        : msg.media?.kind === 'voice'
+          ? telegramVoiceFileId(raw)
+          : undefined;
     if (fileId) {
       try {
         const file = await this.bot.api.getFile(fileId);
@@ -107,6 +128,6 @@ export class TelegramAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/wecom.ts

@@ -1,6 +1,7 @@
 import { createHash, createDecipheriv, createCipheriv, randomBytes } from 'node:crypto';
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
 import type { Adapter, NormalizedMessage, OutboundButton, OutboundPayload } from '../adapter.js';
+import { PendingButtons } from '../pending-buttons.js';
 
 // ── 纯函数：AES-256-CBC 加解密（企业微信协议）──────────────────
 
@@ -97,8 +98,10 @@ export class WeComAdapter implements Adapter {
   private server?: ReturnType<typeof createServer>;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
-  private readonly pendingButtons = new Map<string, OutboundButton[]>();
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
+  private readonly pendingButtons = new PendingButtons();
+  /** access_token 缓存：企业微信 token 有效期 7200s，且有获取频率限制，必须复用。 */
+  private tokenCache?: { token: string; expiresAt: number };
 
   constructor(private readonly opts: WeComAdapterOptions) {}
 
@@ -138,14 +141,10 @@ export class WeComAdapter implements Adapter {
       res.writeHead(200, { 'content-type': 'text/plain' });
       res.end('success'); // 先应答，避免企业微信重试
       if (!normalized) return;
-      const pending = this.pendingButtons.get(normalized.chatId);
-      if (pending) {
-        const button = matchNumberedButton(normalized.text, pending);
-        if (button) {
-          this.pendingButtons.delete(normalized.chatId);
-          this.replyCb?.(button.id);
-          return;
-        }
+      const button = this.pendingButtons.match(normalized.chatId, normalized.text);
+      if (button) {
+        this.replyCb?.(button.id, { chatId: normalized.chatId, userId: normalized.userId });
+        return;
       }
       this.messageCb?.(normalized);
     }
@@ -169,14 +168,17 @@ export class WeComAdapter implements Adapter {
   }
 
   private async fetchAccessToken(): Promise<string> {
+    if (this.tokenCache && this.tokenCache.expiresAt > Date.now()) return this.tokenCache.token;
     const url = `https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=${encodeURIComponent(this.opts.corpId)}&corpsecret=${encodeURIComponent(this.opts.secret)}`;
     const data = (await fetch(url).then((r) => r.json())) as { access_token?: string; errcode?: number };
     if (!data.access_token) throw new Error(`企业微信 token 获取失败: ${data.errcode}`);
+    // 官方有效期 7200s；留 200s 余量，避免临界过期
+    this.tokenCache = { token: data.access_token, expiresAt: Date.now() + 7_000_000 };
     return data.access_token;
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }