@dsh-overdrive/gateway 0.1.3 → 0.1.5

package/src/adapters/whatsapp.ts

@@ -8,6 +8,7 @@ import makeWASocket, {
 import * as qrcode from 'qrcode-terminal';
 import pino from 'pino';
 import type { Adapter, NormalizedMessage, OutboundButton, OutboundPayload } from '../adapter.js';
+import { PendingButtons } from '../pending-buttons.js';
 
 // ── 纯函数（可单测）────────────────────────────────────────────
 
@@ -128,9 +129,9 @@ export class WhatsAppAdapter implements Adapter {
   private sock?: WASocket;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
-  /** chatId → 当前 pending 按钮（编号回复 → 按钮 id） */
-  private readonly pendingButtons = new Map<string, OutboundButton[]>();
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
+  /** chatId → 当前 pending 按钮（编号回复 → 按钮 id，带 TTL 防过期误吞） */
+  private readonly pendingButtons = new PendingButtons();
 
   constructor(private readonly opts: WhatsAppAdapterOptions) {}
 
@@ -173,21 +174,23 @@ export class WhatsAppAdapter implements Adapter {
         const buttonId = parseNativeButtonResponse(waRaw);
         if (buttonId) {
           const chatId = waRaw.key?.remoteJid;
-          if (chatId) this.pendingButtons.delete(chatId);
-          this.replyCb?.(buttonId);
+          if (chatId) this.pendingButtons.consume(chatId);
+          this.replyCb?.(buttonId, {
+            chatId: chatId ?? '',
+            userId: waRaw.key?.participant ?? chatId ?? '',
+          });
           continue;
         }
         const normalized = normalizeWhatsAppMessage(waRaw);
         if (!normalized) continue;
-        // 编号回复兜底：若该 chat 有 pending 按钮且消息是数字，转成按钮点击
-        const pending = this.pendingButtons.get(normalized.msg.chatId);
-        if (pending) {
-          const button = matchNumberedReply(normalized.msg.text, pending);
-          if (button) {
-            this.pendingButtons.delete(normalized.msg.chatId);
-            this.replyCb?.(button.id);
-            continue;
-          }
+        // 编号回复兜底：若该 chat 有 pending 按钮且消息是数字（TTL 内），转成按钮点击
+        const button = this.pendingButtons.match(normalized.msg.chatId, normalized.msg.text);
+        if (button) {
+          this.replyCb?.(button.id, {
+            chatId: normalized.msg.chatId,
+            userId: normalized.msg.userId,
+          });
+          continue;
         }
         this.messageCb?.(normalized.msg);
       }
@@ -226,6 +229,6 @@ export class WhatsAppAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/asr.ts

@@ -0,0 +1,83 @@
+// ASR 语音转写（Roadmap v0.2）。
+// 通过 OpenAI 兼容的 /audio/transcriptions 端点（OpenAI / SiliconFlow / Groq 等）把
+// 语音消息转成文本。未配置 API key 时完全禁用（保持原有"不支持转写"降级路径）。
+
+export interface AsrConfig {
+  apiKey?: string;
+  /** OpenAI 兼容 API 根地址，默认 https://api.openai.com/v1 */
+  baseUrl?: string;
+  /** 转写模型，默认 whisper-1 */
+  model?: string;
+}
+
+export interface AsrVoiceInput {
+  url?: string;
+  mime?: string;
+}
+
+export interface AsrTranscriber {
+  readonly enabled: boolean;
+  /** 转写语音消息 → 文本；未启用 / 下载或转写失败 → null（调用方走原降级路径）。 */
+  transcribe(voice: AsrVoiceInput): Promise<string | null>;
+}
+
+const DEFAULT_BASE_URL = 'https://api.openai.com/v1';
+const DEFAULT_MODEL = 'whisper-1';
+
+/** MIME → 文件扩展名（OpenAI 转写接口要求带正确扩展名的文件名）。 */
+export function extensionForMime(mime?: string): string {
+  if (!mime) return 'oga';
+  const map: Record<string, string> = {
+    'audio/ogg': 'ogg',
+    'audio/oga': 'oga',
+    'audio/opus': 'opus',
+    'audio/mpeg': 'mp3',
+    'audio/mp3': 'mp3',
+    'audio/mp4': 'm4a',
+    'audio/m4a': 'm4a',
+    'audio/wav': 'wav',
+    'audio/webm': 'webm',
+    'audio/aac': 'aac',
+    'audio/amr': 'amr',
+  };
+  const key = mime.split(';')[0].trim().toLowerCase();
+  return map[key] ?? 'oga';
+}
+
+export function createTranscriber(config: AsrConfig = {}): AsrTranscriber {
+  const enabled = Boolean(config.apiKey);
+  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, '');
+  const model = config.model ?? DEFAULT_MODEL;
+
+  async function transcribe(voice: AsrVoiceInput): Promise<string | null> {
+    if (!enabled || !voice.url) return null;
+    try {
+      const audioRes = await fetch(voice.url);
+      if (!audioRes.ok) {
+        console.warn(`[asr] 下载音频失败: ${audioRes.status}`);
+        return null;
+      }
+      const audioBlob = await audioRes.blob();
+      const form = new FormData();
+      form.append('file', audioBlob, `voice.${extensionForMime(voice.mime)}`);
+      form.append('model', model);
+      const res = await fetch(`${baseUrl}/audio/transcriptions`, {
+        method: 'POST',
+        headers: { authorization: `Bearer ${config.apiKey}` },
+        body: form,
+      });
+      if (!res.ok) {
+        console.warn(`[asr] 转写失败 ${res.status}: ${(await res.text()).slice(0, 200)}`);
+        return null;
+      }
+      const data = (await res.json()) as { text?: string };
+      const text = data.text?.trim();
+      return text ? text : null;
+    } catch (error) {
+      console.warn(`[asr] 转写异常: ${error instanceof Error ? error.message : String(error)}`);
+      return null;
+    }
+  }
+
+  return { enabled, transcribe };
+}

package/src/commands.ts

@@ -4,7 +4,9 @@ export type ParsedCommand =
   | { kind: 'agents' }
   | { kind: 'help' }
   | { kind: 'task'; prompt: string }
-  | { kind: 'cron'; schedule: string; prompt: string };
+  | { kind: 'cron'; schedule: string; prompt: string }
+  | { kind: 'crons' }
+  | { kind: 'cronrm'; taskId: string };
 
 // cron 语法：/cron <分 时 日 月 周> <需求>（schedule 为 5 个空白分隔字段）
 const CRON_RE = /^\/cron\s+(\S+\s+\S+\s+\S+\s+\S+\s+\S+)\s+(.+)$/;
@@ -15,10 +17,13 @@ export function parseCommand(text: string): ParsedCommand | null {
   if (trimmed === '/new') return { kind: 'new' };
   if (trimmed === '/agents') return { kind: 'agents' };
   if (trimmed === '/help') return { kind: 'help' };
+  if (trimmed === '/crons') return { kind: 'crons' };
   const task = trimmed.match(/^\/task\s+(.+)$/);
   if (task) return { kind: 'task', prompt: task[1] };
   const cron = trimmed.match(CRON_RE);
   if (cron) return { kind: 'cron', schedule: cron[1], prompt: cron[2] };
+  const cronrm = trimmed.match(/^\/cronrm\s+(\S+)$/);
+  if (cronrm) return { kind: 'cronrm', taskId: cronrm[1] };
   return null;
 }
 
@@ -27,6 +32,8 @@ export const HELP_TEXT = [
   '/trace — 查看最近一轮轨迹',
   '/task <需求> — 派子任务',
   '/cron <分 时 日 月 周> <需求> — 定时任务',
+  '/crons — 查看定时任务列表',
+  '/cronrm <任务id> — 删除定时任务',
   '/agents — 查看子任务状态',
   '/new — 重置会话',
 ].join('\n');

package/src/config.ts

@@ -25,6 +25,9 @@ export interface AdapterEnv {
   wecomToken?: string;
   wecomEncodingAESKey?: string;
   wecomCallbackPort?: string;
+  asrApiKey?: string;
+  asrBaseUrl?: string;
+  asrModel?: string;
 }
 
 export function parseAdapterIds(raw: string): string[] {
@@ -86,5 +89,8 @@ export function adapterEnvFromProcess(env: NodeJS.ProcessEnv = process.env): Ada
     wecomToken: env.WECOM_TOKEN,
     wecomEncodingAESKey: env.WECOM_ENCODING_AES_KEY,
     wecomCallbackPort: env.WECOM_CALLBACK_PORT,
+    asrApiKey: env.ASR_API_KEY,
+    asrBaseUrl: env.ASR_BASE_URL,
+    asrModel: env.ASR_MODEL,
   };
 }

package/src/index.ts

@@ -6,6 +6,7 @@ import { CliAdapter } from './adapters/cli.js';
 import { parseCommand, HELP_TEXT, type ParsedCommand } from './commands.js';
 import { TrajectoryAggregator, formatTrajectorySummary } from './trajectory.js';
 import { createStatusServer } from './status.js';
+import { createTranscriber, type AsrTranscriber } from './asr.js';
 
 /**
  * message.delta → 打字指示去重：同一 turn 内首个 delta 触发一次 typing，
@@ -64,6 +65,10 @@ export function planOutbound(ev: ServerEvent): { payload: OutboundPayload } | nu
 
 export interface WireOptions {
   allowlist: string[];
+  /** 开发逃生口：ALLOW_ALL=1 跳过白名单（生产勿开）。 */
+  allowAll?: boolean;
+  /** ASR 转写器；配置了 API key 时启用，语音消息转成文本再发给 agent。 */
+  asr?: AsrTranscriber;
 }
 
 /** 命令面分发：/trace /new /task /cron /agents /help（M4）。 */
@@ -96,6 +101,21 @@ async function handleCommand(
       await adapter.send(chatId, { text: '⏰ 定时任务已注册' });
       return;
     }
+    case 'crons': {
+      const res = await client.listTasks();
+      const text = res.tasks.length
+        ? res.tasks.map((task) => `- \`${task.id}\` ${task.schedule} — ${task.prompt}`).join('\n')
+        : '暂无定时任务。';
+      await adapter.send(chatId, { text: `⏰ 定时任务（${res.tasks.length}）:\n${text}` });
+      return;
+    }
+    case 'cronrm': {
+      const res = await client.removeTask(command.taskId);
+      await adapter.send(chatId, {
+        text: res.ok ? `🗑️ 已删除定时任务 \`${command.taskId}\`` : `未找到定时任务 \`${command.taskId}\``,
+      });
+      return;
+    }
     case 'agents': {
       await adapter.send(chatId, { text: '（M4 简化）子任务状态由 agent 汇报，/task 派发' });
       return;
@@ -113,7 +133,7 @@ export async function wireAdapter(
   client: GatewayClient,
   opts: WireOptions,
 ): Promise<void> {
-  const allow = new Allowlist(opts.allowlist);
+  const allow = new Allowlist(opts.allowlist, opts.allowAll);
   const chatIds = new Map<string, string>();
   const aggregator = new TrajectoryAggregator();
   const deltas = new DeltaTracker();
@@ -135,6 +155,16 @@ export async function wireAdapter(
         return;
       }
 
+      // ASR 语音转写：配置了 API key 时把语音消息转成文本；失败/未配置走原降级路径
+      if (msg.media?.kind === 'voice' && opts.asr?.enabled) {
+        const transcript = await opts.asr.transcribe(msg.media);
+        if (transcript) {
+          msg.text = msg.text ? `${msg.text}\n[语音转写] ${transcript}` : `[语音转写] ${transcript}`;
+          msg.media = undefined;
+          console.log(`[gateway][${adapter.id}] 语音转写: ${transcript.slice(0, 60)}`);
+        }
+      }
+
       await client.upsertSession({ platform: adapter.id, channel: msg.chatId, user: msg.userId });
       console.log(`[gateway][${adapter.id}] upsertSession OK -> ${key}`);
       await client.sendMessage(key, { text: msg.text, media: msg.media });
@@ -146,13 +176,22 @@ export async function wireAdapter(
     }
   });
 
-  adapter.onReply(async (buttonId) => {
+  adapter.onReply(async (buttonId, sender) => {
     try {
       const idx = buttonId.indexOf(':');
       if (idx < 0) return;
       const action = buttonId.slice(0, idx) as 'approve' | 'reject';
       const reqId = buttonId.slice(idx + 1);
       if ((action === 'approve' || action === 'reject') && reqId) {
+        // 安全边界：审批按钮必须校验点击者（维护者评审指出：未授权用户可代授权）
+        const senderKey = buildSessionKey(adapter.id, { chatId: sender.chatId, userId: sender.userId });
+        if (!allow.allows(senderKey)) {
+          console.warn(`[gateway][${adapter.id}] 按钮点击者不在白名单，拒绝批准: ${senderKey}`);
+          if (sender.chatId) {
+            await adapter.send(sender.chatId, { text: '⛔ 你不在白名单里，不能批准该操作。' }).catch(() => undefined);
+          }
+          return;
+        }
         await client.resolveApproval(reqId, action);
       }
     } catch (error) {
@@ -193,8 +232,15 @@ async function main(): Promise<void> {
   const dshToken = process.env.DSH_TOKEN ?? 'dev-token';
   const allowlist = (process.env.ALLOWLIST ?? '')
     .split(',').map((s) => s.trim()).filter(Boolean);
+  const allowAll = process.env.ALLOW_ALL === '1';
   const adapterIds = parseAdapterIds(process.env.GATEWAY_ADAPTERS ?? 'cli');
   const env = adapterEnvFromProcess();
+  const asr = createTranscriber({
+    apiKey: env.asrApiKey,
+    baseUrl: env.asrBaseUrl,
+    model: env.asrModel,
+  });
+  if (asr.enabled) console.log('[gateway] ASR 语音转写已启用');
 
   const client = new GatewayClient(dshBaseUrl, dshToken);
   await client.health(); // 确认 DSH 侧（或 mock）活着
@@ -202,7 +248,7 @@ async function main(): Promise<void> {
   const adapters: Adapter[] = adapterIds.map((id) => createAdapter(id, env));
   for (const adapter of adapters) {
     await adapter.connect();
-    await wireAdapter(adapter, client, { allowlist });
+    await wireAdapter(adapter, client, { allowlist, allowAll, asr });
     console.log(`[gateway] ${adapter.id} 适配器已就绪`);
   }
 

package/src/pending-buttons.ts

@@ -0,0 +1,45 @@
+import type { OutboundButton } from './adapter.js';
+
+export const PENDING_BUTTONS_TTL_MS = 5 * 60_000;
+
+interface PendingButtonEntry {
+  buttons: OutboundButton[];
+  expiresAt: number;
+}
+
+/**
+ * 编号回复兜底的按钮暂存（带 TTL）。
+ *
+ * 审批/危险操作按钮发出后，用户在聊天里回复数字（"1"/"2"…）选择；
+ * 若按钮长期不消费，后续的普通数字消息会被误判成按钮回复。
+ * 本类在 TTL（默认 5 分钟）后自动失效，杜绝"过期按钮吞消息"。
+ */
+export class PendingButtons {
+  private readonly map = new Map<string, PendingButtonEntry>();
+
+  constructor(private readonly ttlMs: number = PENDING_BUTTONS_TTL_MS) {}
+
+  set(chatId: string, buttons: OutboundButton[]): void {
+    this.map.set(chatId, { buttons, expiresAt: Date.now() + this.ttlMs });
+  }
+
+  /** 数字回复命中：返回匹配按钮并消费（删除）；无 pending / 已过期 / 非数字或越界返回 undefined。 */
+  match(chatId: string, text: string): OutboundButton | undefined {
+    const entry = this.map.get(chatId);
+    if (!entry) return undefined;
+    if (entry.expiresAt < Date.now()) {
+      this.map.delete(chatId);
+      return undefined;
+    }
+    const n = Number(text.trim());
+    if (!Number.isInteger(n) || n < 1 || n > entry.buttons.length) return undefined;
+    const button = entry.buttons[n - 1];
+    if (button) this.map.delete(chatId);
+    return button;
+  }
+
+  /** 消费原生按钮点击（如 WhatsApp 原生交互按钮）：删除该 chat 的 pending。 */
+  consume(chatId: string): void {
+    this.map.delete(chatId);
+  }
+}

package/src/session.ts

@@ -7,11 +7,17 @@ export function buildSessionKey(
   return sessionKey(adapterId, msg.chatId, msg.userId);
 }
 
-/** 空列表 = 开发模式放行所有；生产环境必须显式配置。 */
+/**
+ * 白名单：默认 fail-closed —— 只有显式配置了条目才放行；
+ * 开发环境可用 ALLOW_ALL=1 显式放行所有（比空列表隐式放行安全得多）。
+ */
 export class Allowlist {
-  constructor(private readonly entries: string[]) {}
+  constructor(
+    private readonly entries: string[],
+    private readonly allowAll = false,
+  ) {}
 
   allows(key: string): boolean {
-    return this.entries.length === 0 || this.entries.includes(key);
+    return this.allowAll || (this.entries.length > 0 && this.entries.includes(key));
   }
 }

package/test/adapters.dingtalk.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { buildReplyBody, parseBotMessage } from '../src/adapters/dingtalk.js';
+import { buildActionCard, buildReplyBody, buttonCallbackData, parseBotMessage, parseCardCallback } from '../src/adapters/dingtalk.js';
 
 describe('parseBotMessage（RobotMessage → NormalizedMessage）', () => {
   it('文本消息', () => {
@@ -23,3 +23,42 @@ describe('buildReplyBody（sessionWebhook 回发载荷）', () => {
     expect(buildReplyBody('hi')).toEqual({ msgtype: 'text', text: { content: 'hi' } });
   });
 });
+
+describe('buildActionCard（钉钉 actionCard）', () => {
+  it('生成带 cardCallbackData 的按钮', () => {
+    const card = buildActionCard('需要批准', [
+      { id: 'approve:r1', label: '✅ 同意' },
+      { id: 'reject:r1', label: '🚫 拒绝' },
+    ]);
+    expect(card.msgtype).toBe('actionCard');
+    expect(card.actionCard.btns).toHaveLength(2);
+    expect(card.actionCard.btns[0].actionURL).toContain('cardCallbackData=');
+    expect(decodeURIComponent(card.actionCard.btns[0].actionURL.split('cardCallbackData=')[1])).toBe('{"action":"approve","reqId":"r1"}');
+  });
+});
+
+describe('parseCardCallback（TOPIC_CARD 回调载荷 → 按钮 id + 身份）', () => {
+  it('识别 cardCallbackData 字段', () => {
+    expect(parseCardCallback({ cardPrivateData: { cardCallbackData: '{"action":"approve","reqId":"r1"}' } })).toMatchObject({ buttonId: 'approve:r1' });
+  });
+  it('识别 params / cardActionData 字段与嵌套结构', () => {
+    expect(parseCardCallback({ cardPrivateData: { params: '{"action":"reject","reqId":"r9"}' } })).toMatchObject({ buttonId: 'reject:r9' });
+    expect(parseCardCallback({ a: { b: { cardActionData: '{"action":"approve","reqId":"x"}' } } })).toMatchObject({ buttonId: 'approve:x' });
+  });
+  it('带回会话与用户身份（用于白名单校验）', () => {
+    expect(parseCardCallback({
+      cardPrivateData: { cardCallbackData: '{"action":"approve","reqId":"r1"}', userId: 'u1' },
+      conversationId: 'cid1',
+    })).toEqual({ buttonId: 'approve:r1', chatId: 'cid1', userId: 'u1' });
+  });
+  it('非法载荷返回 null', () => {
+    expect(parseCardCallback(null)).toBeNull();
+    expect(parseCardCallback({ cardPrivateData: { cardCallbackData: 'not-json' } })).toBeNull();
+    expect(parseCardCallback({ cardPrivateData: { cardCallbackData: '{"action":"other","reqId":"r1"}' } })).toBeNull();
+    expect(parseCardCallback({ cardPrivateData: { cardCallbackData: '{"action":"approve"}' } })).toBeNull();
+  });
+  it('buttonCallbackData 与 parseCardCallback 往返一致', () => {
+    const data = buttonCallbackData({ id: 'reject:r7', label: 'x' });
+    expect(parseCardCallback({ cardPrivateData: { cardCallbackData: data } })).toMatchObject({ buttonId: 'reject:r7' });
+  });
+});

package/test/adapters.feishu.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, it } from 'vitest';
-import { buildNumberedText, parseFeishuTextMessage } from '../src/adapters/feishu.js';
+import {
+  buildApprovalCard, buildNumberedText, cardActionToButtonId, parseFeishuTextMessage,
+} from '../src/adapters/feishu.js';
 
 describe('parseFeishuTextMessage（im.message.receive_v1 载荷 → NormalizedMessage）', () => {
   it('文本私聊消息', () => {
@@ -28,3 +30,37 @@ describe('buildNumberedText（审批编号回复）', () => {
     expect(text).toContain('2) 🚫 拒绝');
   });
 });
+
+describe('buildApprovalCard（飞书原生交互卡片）', () => {
+  it('生成 interactive 卡片 JSON：header + 文本 + action 按钮', () => {
+    const content = buildApprovalCard('需要批准：执行危险操作', [
+      { id: 'approve:r1', label: '✅ 同意' },
+      { id: 'reject:r1', label: '🚫 拒绝' },
+    ]);
+    const card = JSON.parse(content);
+    expect(card.config.wide_screen_mode).toBe(true);
+    expect(card.header.title.content).toContain('需要批准');
+    const actions = card.elements.find((e: { tag: string }) => e.tag === 'action').actions;
+    expect(actions).toHaveLength(2);
+    expect(actions[0]).toMatchObject({
+      tag: 'button',
+      type: 'primary', // approve 主按钮
+      value: { action: 'approve', reqId: 'r1' },
+    });
+    expect(actions[1].value).toEqual({ action: 'reject', reqId: 'r1' });
+  });
+});
+
+describe('cardActionToButtonId（卡片回调 → 按钮 id）', () => {
+  it('approve/reject 值还原为按钮 id', () => {
+    expect(cardActionToButtonId({ action: 'approve', reqId: 'r1' })).toBe('approve:r1');
+    expect(cardActionToButtonId({ action: 'reject', reqId: 'r9' })).toBe('reject:r9');
+  });
+  it('非法值返回 null', () => {
+    expect(cardActionToButtonId(null)).toBeNull();
+    expect(cardActionToButtonId({})).toBeNull();
+    expect(cardActionToButtonId({ action: 'other', reqId: 'r1' })).toBeNull();
+    expect(cardActionToButtonId({ action: 'approve' })).toBeNull();
+    expect(cardActionToButtonId('str')).toBeNull();
+  });
+});

package/test/asr.test.ts

@@ -0,0 +1,77 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createTranscriber, extensionForMime } from '../src/asr.js';
+
+describe('extensionForMime', () => {
+  it('maps known audio mimes', () => {
+    expect(extensionForMime('audio/ogg')).toBe('ogg');
+    expect(extensionForMime('audio/mpeg')).toBe('mp3');
+    expect(extensionForMime('audio/mp4')).toBe('m4a');
+    expect(extensionForMime('audio/wav')).toBe('wav');
+    expect(extensionForMime('audio/webm')).toBe('webm');
+  });
+  it('ignores parameters and case', () => {
+    expect(extensionForMime('audio/OGG; codecs=opus')).toBe('ogg');
+  });
+  it('falls back for unknown or missing mime', () => {
+    expect(extensionForMime('application/x-foo')).toBe('oga');
+    expect(extensionForMime(undefined)).toBe('oga');
+    expect(extensionForMime('')).toBe('oga');
+  });
+});
+
+describe('createTranscriber.transcribe', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('未配置 API key 时禁用且不发起请求', async () => {
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+    const asr = createTranscriber({})
+    expect(asr.enabled).toBe(false)
+    expect(await asr.transcribe({ url: 'https://x/v.ogg' })).toBeNull()
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('下载音频并调用 OpenAI 兼容转写端点，返回文本', async () => {
+    const fetchMock = vi.fn()
+      .mockResolvedValueOnce({ ok: true, blob: async () => new Blob(['fake-audio']) })
+      .mockResolvedValueOnce({ ok: true, json: async () => ({ text: '  你好世界  ' }) })
+    vi.stubGlobal('fetch', fetchMock)
+    const asr = createTranscriber({ apiKey: 'sk-test', baseUrl: 'https://api.siliconflow.cn/v1', model: 'whisper-1' })
+    expect(asr.enabled).toBe(true)
+    const text = await asr.transcribe({ url: 'https://x/v.ogg', mime: 'audio/ogg' })
+    expect(text).toBe('你好世界')
+
+    // 第一次 fetch：下载音频；第二次：转写端点
+    expect(fetchMock.mock.calls[0][0]).toBe('https://x/v.ogg')
+    const [url, init] = fetchMock.mock.calls[1]
+    expect(String(url)).toBe('https://api.siliconflow.cn/v1/audio/transcriptions')
+    expect(init.method).toBe('POST')
+    expect(init.headers.authorization).toBe('Bearer sk-test')
+    expect(init.body).toBeInstanceOf(FormData)
+    const filename = (init.body as FormData).get('file') as File
+    expect(filename.name).toBe('voice.ogg')
+  })
+
+  it('下载失败返回 null（不抛错）', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValueOnce({ ok: false, status: 403 }))
+    const asr = createTranscriber({ apiKey: 'sk-test' })
+    expect(await asr.transcribe({ url: 'https://x/v.ogg' })).toBeNull()
+  })
+
+  it('转写端点失败返回 null', async () => {
+    const fetchMock = vi.fn()
+      .mockResolvedValueOnce({ ok: true, blob: async () => new Blob(['x']) })
+      .mockResolvedValueOnce({ ok: false, status: 500, text: async () => 'server error' })
+    vi.stubGlobal('fetch', fetchMock)
+    const asr = createTranscriber({ apiKey: 'sk-test' })
+    expect(await asr.transcribe({ url: 'https://x/v.ogg' })).toBeNull()
+  })
+
+  it('无 url 返回 null', async () => {
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+    const asr = createTranscriber({ apiKey: 'sk-test' })
+    expect(await asr.transcribe({ mime: 'audio/ogg' })).toBeNull()
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+})

package/test/commands.test.ts

@@ -10,9 +10,15 @@ describe('parseCommand', () => {
     expect(parseCommand('/task 调研竞品')).toEqual({ kind: 'task', prompt: '调研竞品' });
     expect(parseCommand('/cron 0 8 * * * 每日汇报')).toEqual({ kind: 'cron', schedule: '0 8 * * *', prompt: '每日汇报' });
   });
+  it('识别 /crons 与 /cronrm', () => {
+    expect(parseCommand('/crons')).toEqual({ kind: 'crons' });
+    expect(parseCommand('/cronrm cron-1')).toEqual({ kind: 'cronrm', taskId: 'cron-1' });
+    expect(parseCommand('/cronrm cron-123-abc')).toEqual({ kind: 'cronrm', taskId: 'cron-123-abc' });
+  });
   it('非命令返回 null', () => {
     expect(parseCommand('hello')).toBeNull();
     expect(parseCommand('/unknown')).toBeNull();
     expect(parseCommand('/task')).toBeNull(); // 缺参数
+    expect(parseCommand('/cronrm')).toBeNull(); // 缺任务 id
   });
 });

package/test/multi.test.ts

@@ -1,22 +1,24 @@
 import { describe, expect, it } from 'vitest';
 import { wireAdapter } from '../src/index.js';
 import { GatewayClient } from '@dsh-overdrive/sdk';
-import type { Adapter, NormalizedMessage, OutboundPayload } from '../src/adapter.js';
+import type { Adapter, NormalizedMessage, OutboundPayload, ReplySender } from '../src/adapter.js';
 
 /** 可编程 FakeAdapter：验证 wiring 逻辑（白名单/会话键/错误兜底）。 */
 class FakeAdapter implements Adapter {
   readonly id: string;
   readonly sent: Array<{ chatId: string; payload: OutboundPayload }> = [];
   private messageCb?: (msg: NormalizedMessage) => Promise<void> | void;
-  private replyCb?: (buttonId: string) => Promise<void> | void;
+  private replyCb?: (buttonId: string, sender: ReplySender) => Promise<void> | void;
   constructor(id: string) { this.id = id; }
   async connect(): Promise<void> {}
   async send(chatId: string, payload: OutboundPayload): Promise<void> { this.sent.push({ chatId, payload }); }
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: ReplySender) => void): void { this.replyCb = cb; }
   /** 测试助手：返回处理器 Promise，测试 await 以确保 async 接线（upsert→sendMessage / catch 兜底）跑完 */
   emit(msg: NormalizedMessage): Promise<void> | void { return this.messageCb?.(msg); }
-  click(buttonId: string): Promise<void> | void { return this.replyCb?.(buttonId); }
+  click(buttonId: string, sender: ReplySender = { chatId: 'C1', userId: 'U1' }): Promise<void> | void {
+    return this.replyCb?.(buttonId, sender);
+  }
 }
 
 /** 假 DSH：记录调用。 */
@@ -63,22 +65,41 @@ describe('wireAdapter（多适配器装配核心）', () => {
     expect(messages).toEqual([{ sessionId: 'telegram:111:222', text: 'hello' }]);
   });
 
-  it('按钮点击 → resolveApproval', async () => {
+  it('按钮点击（白名单内）→ resolveApproval', async () => {
     const adapter = new FakeAdapter('discord');
     const { client, approvals } = fakeClient();
-    await wireAdapter(adapter, client, { allowlist: [] });
+    await wireAdapter(adapter, client, { allowlist: ['discord:C1:U1'] });
 
-    await adapter.click('approve:r1');
+    await adapter.click('approve:r1', { chatId: 'C1', userId: 'U1' });
     expect(approvals).toEqual([{ reqId: 'r1', decision: 'approve' }]);
   });
 
+  it('按钮点击（白名单外）→ 拒绝批准并回错误文本', async () => {
+    const adapter = new FakeAdapter('discord');
+    const { client, approvals } = fakeClient();
+    await wireAdapter(adapter, client, { allowlist: ['discord:C1:U1'] });
+
+    await adapter.click('approve:r1', { chatId: 'C1', userId: 'EVIL' });
+    expect(approvals).toEqual([]); // 未授权用户不能批准
+    expect(adapter.sent[0].payload.text).toContain('⛔');
+  });
+
+  it('空白名单 fail-closed：点击一律拒绝', async () => {
+    const adapter = new FakeAdapter('telegram');
+    const { client, approvals } = fakeClient();
+    await wireAdapter(adapter, client, { allowlist: [] });
+
+    await adapter.click('reject:r1', { chatId: 'C1', userId: 'U1' });
+    expect(approvals).toEqual([]);
+  });
+
   it('DSH 调用失败 → 回错误文本（不崩溃）', async () => {
     const adapter = new FakeAdapter('slack');
     const client = {
       upsertSession: async () => { throw new Error('dsh down'); },
       connect: async () => () => undefined,
     } as unknown as GatewayClient;
-    await wireAdapter(adapter, client, { allowlist: [] });
+    await wireAdapter(adapter, client, { allowlist: [], allowAll: true });
 
     await adapter.emit({ chatId: 'C1', userId: 'U1', text: 'hi' });
     expect(adapter.sent[0].payload.text).toContain('❌');