@huo15/dingtalk-connector-pro 1.0.4 → 1.0.7

package/dist/src/gateway-methods.js

@@ -0,0 +1,360 @@
+/**
+ * Gateway Methods 注册
+ *
+ * 提供钉钉插件的 RPC 接口，允许外部系统、AI Agent 和其他插件调用钉钉功能
+ */
+import { resolveDingtalkAccount } from "./config/accounts.js";
+import { DingtalkDocsClient } from "./docs.js";
+import { sendProactive } from "./services/messaging.js";
+import { getUnionId } from "./utils/utils-legacy.js";
+/**
+ * 注册所有 Gateway Methods
+ */
+export function registerGatewayMethods(api) {
+    const log = api.logger;
+    // ============ 消息发送类 ============
+    /**
+     * 主动发送单聊消息
+     *
+     * @example
+     * ```typescript
+     * await gateway.call('dingtalk-connector.sendToUser', {
+     *   userId: 'user123',
+     *   content: '任务已完成！',
+     *   useAICard: true
+     * });
+     * ```
+     */
+    api.registerGatewayMethod('dingtalk-connector.sendToUser', async ({ context, params, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const { userId, userIds, content, msgType, title, useAICard, fallbackToNormal, accountId } = params || {};
+            const account = resolveDingtalkAccount({ cfg, accountId });
+            if (!account.config?.clientId) {
+                return respond(false, { error: 'DingTalk not configured' });
+            }
+            const targetUserIds = userIds || (userId ? [userId] : []);
+            if (targetUserIds.length === 0) {
+                return respond(false, { error: 'userId or userIds is required' });
+            }
+            if (!content) {
+                return respond(false, { error: 'content is required' });
+            }
+            // 构建目标
+            const target = targetUserIds.length === 1
+                ? { userId: targetUserIds[0] }
+                : { userIds: targetUserIds };
+            const result = await sendProactive(account.config, target, content, {
+                msgType,
+                title,
+                log,
+                useAICard: useAICard !== false,
+                fallbackToNormal: fallbackToNormal !== false,
+            });
+            respond(result.ok, result);
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][sendToUser] 错误: ${err.message}`);
+            respond(false, { error: err.message });
+        }
+    });
+    /**
+     * 主动发送群聊消息
+     *
+     * @example
+     * ```typescript
+     * await gateway.call('dingtalk-connector.sendToGroup', {
+     *   openConversationId: 'cid123',
+     *   content: '构建失败，请检查日志',
+     *   useAICard: true
+     * });
+     * ```
+     */
+    api.registerGatewayMethod('dingtalk-connector.sendToGroup', async ({ context, params, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const { openConversationId, content, msgType, title, useAICard, fallbackToNormal, accountId } = params || {};
+            const account = resolveDingtalkAccount({ cfg, accountId });
+            if (!account.config?.clientId) {
+                return respond(false, { error: 'DingTalk not configured' });
+            }
+            if (!openConversationId) {
+                return respond(false, { error: 'openConversationId is required' });
+            }
+            if (!content) {
+                return respond(false, { error: 'content is required' });
+            }
+            const result = await sendProactive(account.config, { openConversationId }, content, {
+                msgType,
+                title,
+                log,
+                useAICard: useAICard !== false,
+                fallbackToNormal: fallbackToNormal !== false,
+            });
+            respond(result.ok, result);
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][sendToGroup] 错误: ${err.message}`);
+            console.error(err);
+            respond(false, { error: err.message });
+        }
+    });
+    api.registerGatewayMethod('dingtalk-connector.send', async ({ context, params, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const { target, content, message, msgType, title, useAICard, fallbackToNormal, accountId } = params || {};
+            const actualContent = content || message;
+            const account = resolveDingtalkAccount({ cfg, accountId });
+            log?.info?.(`[Gateway][send] 收到请求: target=${target}, contentLen=${actualContent?.length}`);
+            if (!account.config?.clientId) {
+                return respond(false, { error: 'DingTalk not configured' });
+            }
+            if (!target) {
+                return respond(false, { error: 'target is required (format: user:<userId> or group:<openConversationId>)' });
+            }
+            if (!actualContent) {
+                return respond(false, { error: 'content is required' });
+            }
+            const targetStr = String(target);
+            let sendTarget;
+            if (targetStr.startsWith('user:')) {
+                sendTarget = { userId: targetStr.slice(5) };
+            }
+            else if (targetStr.startsWith('group:')) {
+                sendTarget = { openConversationId: targetStr.slice(6) };
+            }
+            else {
+                // 默认当作 userId
+                sendTarget = { userId: targetStr };
+            }
+            const result = await sendProactive(account.config, sendTarget, actualContent, {
+                msgType,
+                title,
+                log,
+                useAICard: useAICard !== false,
+                fallbackToNormal: fallbackToNormal !== false,
+            });
+            respond(result.ok, result);
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][send] 错误: ${err.message}`);
+            respond(false, { error: err.message });
+        }
+    });
+    // ============ 文档操作类 ============
+    api.registerGatewayMethod('dingtalk-connector.docs.read', async ({ context, params, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const { docId, operatorId: rawOperatorId, accountId } = params || {};
+            const account = resolveDingtalkAccount({ cfg, accountId });
+            if (!account.config?.clientId) {
+                return respond(false, { error: 'DingTalk not configured' });
+            }
+            if (!docId) {
+                return respond(false, { error: 'docId is required' });
+            }
+            if (!rawOperatorId) {
+                return respond(false, { error: 'operatorId (unionId or staffId) is required' });
+            }
+            // 如果 operatorId 不像 unionId，尝试转换
+            let operatorId = rawOperatorId;
+            if (!rawOperatorId.includes('$')) {
+                const resolved = await getUnionId(rawOperatorId, account.config, log);
+                if (resolved)
+                    operatorId = resolved;
+            }
+            const client = new DingtalkDocsClient(account.config, log);
+            const content = await client.readDoc(docId, operatorId);
+            if (content !== null) {
+                respond(true, { content });
+            }
+            else {
+                respond(false, { error: 'Failed to read document node' });
+            }
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][docs.read] 错误: ${err.message}`);
+            respond(false, { error: err.message });
+        }
+    });
+    /**
+     * 创建钉钉文档
+     *
+     * @example
+     * ```typescript
+     * const result = await gateway.call('dingtalk-connector.docs.create', {
+     *   spaceId: 'workspace123',
+     *   title: '会议纪要',
+     *   content: '今天讨论了...'
+     * });
+     * console.log('文档ID:', result.docId);
+     * ```
+     */
+    api.registerGatewayMethod('dingtalk-connector.docs.create', async ({ context, params, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const { spaceId, title, content, accountId } = params || {};
+            const account = resolveDingtalkAccount({ cfg, accountId });
+            if (!account.config?.clientId) {
+                return respond(false, { error: 'DingTalk not configured' });
+            }
+            if (!spaceId || !title) {
+                return respond(false, { error: 'spaceId and title are required' });
+            }
+            const client = new DingtalkDocsClient(account.config, log);
+            const doc = await client.createDoc(spaceId, title, content);
+            if (doc) {
+                respond(true, doc);
+            }
+            else {
+                respond(false, { error: 'Failed to create document' });
+            }
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][docs.create] 错误: ${err.message}`);
+            respond(false, { error: err.message });
+        }
+    });
+    /**
+     * 向钉钉文档追加内容
+     *
+     * @example
+     * ```typescript
+     * await gateway.call('dingtalk-connector.docs.append', {
+     *   docId: 'doc123',
+     *   content: '补充内容...'
+     * });
+     * ```
+     */
+    api.registerGatewayMethod('dingtalk-connector.docs.append', async ({ context, params, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const { docId, content, accountId } = params || {};
+            const account = resolveDingtalkAccount({ cfg, accountId });
+            if (!account.config?.clientId) {
+                return respond(false, { error: 'DingTalk not configured' });
+            }
+            if (!docId || !content) {
+                return respond(false, { error: 'docId and content are required' });
+            }
+            const client = new DingtalkDocsClient(account.config, log);
+            const ok = await client.appendToDoc(docId, content);
+            respond(ok, ok ? { success: true } : { error: 'Failed to append to document' });
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][docs.append] 错误: ${err.message}`);
+            respond(false, { error: err.message });
+        }
+    });
+    /**
+     * 搜索钉钉文档
+     *
+     * @example
+     * ```typescript
+     * const result = await gateway.call('dingtalk-connector.docs.search', {
+     *   keyword: '项目规范',
+     *   spaceId: 'workspace123'  // 可选
+     * });
+     * console.log('找到文档:', result.docs);
+     * ```
+     */
+    api.registerGatewayMethod('dingtalk-connector.docs.search', async ({ context, params, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const { keyword, spaceId, accountId } = params || {};
+            const account = resolveDingtalkAccount({ cfg, accountId });
+            if (!account.config?.clientId) {
+                return respond(false, { error: 'DingTalk not configured' });
+            }
+            if (!keyword) {
+                return respond(false, { error: 'keyword is required' });
+            }
+            const client = new DingtalkDocsClient(account.config, log);
+            const docs = await client.searchDocs(keyword, spaceId);
+            respond(true, { docs });
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][docs.search] 错误: ${err.message}`);
+            respond(false, { error: err.message });
+        }
+    });
+    /**
+     * 列出空间下的文档
+     *
+     * @example
+     * ```typescript
+     * const result = await gateway.call('dingtalk-connector.docs.list', {
+     *   spaceId: 'workspace123',
+     *   parentId: 'folder456'  // 可选，不传则列出根目录
+     * });
+     * console.log('文档列表:', result.docs);
+     * ```
+     */
+    api.registerGatewayMethod('dingtalk-connector.docs.list', async ({ context, params, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const { spaceId, parentId, accountId } = params || {};
+            const account = resolveDingtalkAccount({ cfg, accountId });
+            if (!account.config?.clientId) {
+                return respond(false, { error: 'DingTalk not configured' });
+            }
+            if (!spaceId) {
+                return respond(false, { error: 'spaceId is required' });
+            }
+            const client = new DingtalkDocsClient(account.config, log);
+            const docs = await client.listDocs(spaceId, parentId);
+            respond(true, { docs });
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][docs.list] 错误: ${err.message}`);
+            respond(false, { error: err.message });
+        }
+    });
+    // ============ 状态检查类 ============
+    api.registerGatewayMethod('dingtalk-connector.status', async ({ context, params, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const accountId = params?.accountId;
+            const account = resolveDingtalkAccount({ cfg, accountId });
+            const hasClientId = !!account.config?.clientId;
+            const hasClientSecret = !!account.config?.clientSecret;
+            respond(true, {
+                configured: hasClientId && hasClientSecret,
+                enabled: account.enabled,
+                accountId: account.accountId,
+                clientId: hasClientId ? String(account.config.clientId).substring(0, 8) + '...' : undefined,
+            });
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][status] 错误: ${err.message}`);
+            respond(false, { error: err.message });
+        }
+    });
+    api.registerGatewayMethod('dingtalk-connector.probe', async ({ context, respond }) => {
+        const { loadConfig } = await import('openclaw/plugin-sdk/config-runtime');
+        const cfg = loadConfig();
+        try {
+            const account = resolveDingtalkAccount({ cfg });
+            if (!account.config?.clientId || !account.config?.clientSecret) {
+                return respond(false, { error: 'Not configured' });
+            }
+            // 尝试获取 access token 来验证连接
+            const { getAccessToken } = await import('./utils/utils-legacy.js');
+            await getAccessToken(account.config);
+            respond(true, { ok: true, details: { clientId: account.config.clientId } });
+        }
+        catch (err) {
+            log?.error?.(`[Gateway][probe] 错误: ${err.message}`);
+            respond(false, { ok: false, error: err.message });
+        }
+    });
+}

package/dist/src/onboarding.js

@@ -0,0 +1,337 @@
+import { addWildcardAllowFrom, DEFAULT_ACCOUNT_ID, formatDocsLink, hasConfiguredSecretInput, } from "./sdk/helpers.js";
+import { promptSingleChannelSecretInput } from "openclaw/plugin-sdk/setup";
+import { resolveDingtalkAccount, resolveDingtalkCredentials } from "./config/accounts.js";
+import { probeDingtalk } from "./probe.js";
+const channel = "dingtalk-connector";
+function normalizeString(value) {
+    if (typeof value === "number") {
+        return String(value);
+    }
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed || undefined;
+}
+function setDingtalkDmPolicy(cfg, dmPolicy) {
+    const allowFrom = dmPolicy === "open"
+        ? addWildcardAllowFrom(cfg.channels?.["dingtalk-connector"]?.allowFrom)?.map((entry) => String(entry))
+        : undefined;
+    return {
+        ...cfg,
+        channels: {
+            ...cfg.channels,
+            "dingtalk-connector": {
+                ...cfg.channels?.["dingtalk-connector"],
+                dmPolicy,
+                ...(allowFrom ? { allowFrom } : {}),
+            },
+        },
+    };
+}
+function setDingtalkAllowFrom(cfg, allowFrom) {
+    return {
+        ...cfg,
+        channels: {
+            ...cfg.channels,
+            "dingtalk-connector": {
+                ...cfg.channels?.["dingtalk-connector"],
+                allowFrom,
+            },
+        },
+    };
+}
+function parseAllowFromInput(raw) {
+    return raw
+        .split(/[\n,;]+/g)
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+async function promptDingtalkAllowFrom(params) {
+    const existing = params.cfg.channels?.["dingtalk-connector"]?.allowFrom ?? [];
+    await params.prompter.note([
+        "Allowlist DingTalk DMs by user ID.",
+        "You can find user ID in DingTalk admin console or via API.",
+        "Examples:",
+        "- user123456",
+        "- user789012",
+    ].join("\n"), "DingTalk allowlist");
+    while (true) {
+        const entry = await params.prompter.text({
+            message: "DingTalk allowFrom (user IDs)",
+            placeholder: "user123456, user789012",
+            initialValue: existing[0] ? String(existing[0]) : undefined,
+            validate: (value) => (String(value ?? "").trim() ? undefined : "Required"),
+        });
+        const parts = parseAllowFromInput(String(entry));
+        if (parts.length === 0) {
+            await params.prompter.note("Enter at least one user.", "DingTalk allowlist");
+            continue;
+        }
+        const unique = [
+            ...new Set([
+                ...existing.map((v) => String(v).trim()).filter(Boolean),
+                ...parts,
+            ]),
+        ];
+        return setDingtalkAllowFrom(params.cfg, unique);
+    }
+}
+async function noteDingtalkCredentialHelp(prompter) {
+    await prompter.note([
+        "1) Go to DingTalk Open Platform (open-dev.dingtalk.com)",
+        "2) Create an enterprise internal app",
+        "3) Get Client ID and Client Secret from Credentials page",
+        "4) Enable required permissions: im:message, im:chat",
+        "5) Publish the app or add it to a test group",
+        "Tip: you can also set DINGTALK_CLIENT_ID / DINGTALK_CLIENT_SECRET env vars.",
+        `Docs: ${formatDocsLink("/channels/dingtalk-connector", "dingtalk-connector")}`,
+    ].join("\n"), "DingTalk credentials");
+}
+async function promptDingtalkClientId(params) {
+    const clientId = String(await params.prompter.text({
+        message: "Enter DingTalk Client ID",
+        initialValue: params.initialValue,
+        validate: (value) => (value?.trim() ? undefined : "Required"),
+    })).trim();
+    return clientId;
+}
+function setDingtalkGroupPolicy(cfg, groupPolicy) {
+    return {
+        ...cfg,
+        channels: {
+            ...cfg.channels,
+            "dingtalk-connector": {
+                ...cfg.channels?.["dingtalk-connector"],
+                enabled: true,
+                groupPolicy,
+            },
+        },
+    };
+}
+function setDingtalkGroupAllowFrom(cfg, groupAllowFrom) {
+    return {
+        ...cfg,
+        channels: {
+            ...cfg.channels,
+            "dingtalk-connector": {
+                ...cfg.channels?.["dingtalk-connector"],
+                groupAllowFrom,
+            },
+        },
+    };
+}
+const dmPolicy = {
+    label: "DingTalk",
+    channel,
+    policyKey: "channels.dingtalk-connector.dmPolicy",
+    allowFromKey: "channels.dingtalk-connector.allowFrom",
+    getCurrent: (cfg) => cfg.channels?.["dingtalk-connector"]?.dmPolicy ?? "open",
+    setPolicy: (cfg, policy) => setDingtalkDmPolicy(cfg, policy),
+    promptAllowFrom: promptDingtalkAllowFrom,
+};
+export const dingtalkOnboardingAdapter = {
+    channel,
+    getStatus: async ({ cfg }) => {
+        // Use resolveDingtalkAccount to correctly support pure multi-account configs
+        // where credentials are only under accounts.<id>, not at the top level.
+        const defaultAccount = resolveDingtalkAccount({ cfg });
+        const configured = defaultAccount.configured;
+        let probeResult = null;
+        if (configured && defaultAccount.clientId && defaultAccount.clientSecret) {
+            try {
+                probeResult = await probeDingtalk({
+                    clientId: defaultAccount.clientId,
+                    clientSecret: defaultAccount.clientSecret,
+                });
+            }
+            catch {
+                // Ignore probe errors
+            }
+        }
+        const statusLines = [];
+        if (!configured) {
+            statusLines.push("DingTalk: needs app credentials");
+        }
+        else if (probeResult?.ok) {
+            statusLines.push(`DingTalk: connected as ${probeResult.botName ?? "bot"}`);
+        }
+        else {
+            statusLines.push("DingTalk: configured (connection not verified)");
+        }
+        return {
+            channel,
+            configured,
+            statusLines,
+            selectionHint: configured ? "configured" : "needs app creds",
+            quickstartScore: configured ? 2 : 0,
+        };
+    },
+    configure: async ({ cfg, prompter }) => {
+        const dingtalkCfg = cfg.channels?.["dingtalk-connector"];
+        const resolved = resolveDingtalkCredentials(dingtalkCfg, {
+            allowUnresolvedSecretRef: true,
+        });
+        const hasConfigSecret = hasConfiguredSecretInput(dingtalkCfg?.clientSecret);
+        const hasConfigCreds = Boolean(typeof dingtalkCfg?.clientId === "string" && dingtalkCfg.clientId.trim() && hasConfigSecret);
+        let canUseEnv = Boolean(!hasConfigCreds && process.env.DINGTALK_CLIENT_ID?.trim() && process.env.DINGTALK_CLIENT_SECRET?.trim());
+        let next = cfg;
+        let clientId = null;
+        let clientSecret = null;
+        let clientSecretProbeValue = null;
+        if (!resolved) {
+            await noteDingtalkCredentialHelp(prompter);
+        }
+        // Check if we can use environment variables
+        if (canUseEnv) {
+            const useEnv = await prompter.confirm({
+                message: "DINGTALK_CLIENT_ID + DINGTALK_CLIENT_SECRET detected. Use env vars?",
+                initialValue: true,
+            });
+            if (useEnv) {
+                next = {
+                    ...next,
+                    channels: {
+                        ...next.channels,
+                        "dingtalk-connector": { ...next.channels?.["dingtalk-connector"], enabled: true },
+                    },
+                };
+                // Environment variables will be used, skip manual input
+            }
+            else {
+                // User chose not to use env vars, proceed to manual input
+                canUseEnv = false;
+            }
+        }
+        // If not using env vars, prompt for credentials
+        if (!canUseEnv) {
+            // Check if we should keep existing configuration
+            if (resolved && hasConfigSecret) {
+                const keepExisting = await prompter.confirm({
+                    message: "DingTalk credentials already configured. Keep them?",
+                    initialValue: true,
+                });
+                if (!keepExisting) {
+                    // User wants to reconfigure, proceed to input
+                    // Step 1: Prompt for Client ID first
+                    clientId = await promptDingtalkClientId({
+                        prompter,
+                        initialValue: normalizeString(dingtalkCfg?.clientId) ?? normalizeString(process.env.DINGTALK_CLIENT_ID),
+                    });
+                    // Step 2: Then prompt for Client Secret
+                    const clientSecretResult = await promptSingleChannelSecretInput({
+                        cfg: next,
+                        prompter,
+                        providerHint: "dingtalk",
+                        credentialLabel: "Client Secret",
+                        accountConfigured: false, // Force new input
+                        canUseEnv: false, // Already handled above
+                        hasConfigToken: false, // Force new input
+                        envPrompt: "", // Not used
+                        keepPrompt: "", // Not used
+                        inputPrompt: "Enter DingTalk Client Secret",
+                        preferredEnvVar: "DINGTALK_CLIENT_SECRET",
+                    });
+                    if (clientSecretResult.action === "set") {
+                        clientSecret = clientSecretResult.value;
+                        clientSecretProbeValue = clientSecretResult.resolvedValue;
+                    }
+                }
+                // If keepExisting is true, we don't modify anything
+            }
+            else {
+                // No existing config, prompt for new credentials
+                // Step 1: Prompt for Client ID first
+                clientId = await promptDingtalkClientId({
+                    prompter,
+                    initialValue: normalizeString(dingtalkCfg?.clientId) ?? normalizeString(process.env.DINGTALK_CLIENT_ID),
+                });
+                // Step 2: Then prompt for Client Secret
+                const clientSecretResult = await promptSingleChannelSecretInput({
+                    cfg: next,
+                    prompter,
+                    providerHint: "dingtalk",
+                    credentialLabel: "Client Secret",
+                    accountConfigured: false,
+                    canUseEnv: false,
+                    hasConfigToken: false,
+                    envPrompt: "",
+                    keepPrompt: "",
+                    inputPrompt: "Enter DingTalk Client Secret",
+                    preferredEnvVar: "DINGTALK_CLIENT_SECRET",
+                });
+                if (clientSecretResult.action === "set") {
+                    clientSecret = clientSecretResult.value;
+                    clientSecretProbeValue = clientSecretResult.resolvedValue;
+                }
+            }
+        }
+        if (clientId && clientSecret) {
+            next = {
+                ...next,
+                channels: {
+                    ...next.channels,
+                    "dingtalk-connector": {
+                        ...next.channels?.["dingtalk-connector"],
+                        enabled: true,
+                        clientId,
+                        clientSecret,
+                    },
+                },
+            };
+            // Test connection
+            try {
+                const probe = await probeDingtalk({
+                    clientId,
+                    clientSecret: clientSecretProbeValue ?? undefined,
+                });
+                if (probe.ok) {
+                    await prompter.note(`Connected as ${probe.botName ?? "bot"}`, "DingTalk connection test");
+                }
+                else {
+                    await prompter.note(`Connection failed: ${probe.error ?? "unknown error"}`, "DingTalk connection test");
+                }
+            }
+            catch (err) {
+                await prompter.note(`Connection test failed: ${String(err)}`, "DingTalk connection test");
+            }
+        }
+        // Group policy
+        const groupPolicy = await prompter.select({
+            message: "Group chat policy",
+            options: [
+                { value: "allowlist", label: "Allowlist - only respond in specific groups" },
+                { value: "open", label: "Open - respond in all groups (requires mention)" },
+                { value: "disabled", label: "Disabled - don't respond in groups" },
+            ],
+            initialValue: next.channels?.["dingtalk-connector"]?.groupPolicy ?? "open",
+        });
+        if (groupPolicy) {
+            next = setDingtalkGroupPolicy(next, groupPolicy);
+        }
+        // Group allowlist if needed
+        if (groupPolicy === "allowlist") {
+            const existing = next.channels?.["dingtalk-connector"]?.groupAllowFrom ?? [];
+            const entry = await prompter.text({
+                message: "Group chat allowlist (conversation IDs)",
+                placeholder: "cidxxxx, cidyyyy",
+                initialValue: existing.length > 0 ? existing.map(String).join(", ") : undefined,
+            });
+            if (entry) {
+                const parts = parseAllowFromInput(String(entry));
+                if (parts.length > 0) {
+                    next = setDingtalkGroupAllowFrom(next, parts);
+                }
+            }
+        }
+        return { cfg: next, accountId: DEFAULT_ACCOUNT_ID };
+    },
+    dmPolicy,
+    disable: (cfg) => ({
+        ...cfg,
+        channels: {
+            ...cfg.channels,
+            "dingtalk-connector": { ...cfg.channels?.["dingtalk-connector"], enabled: false },
+        },
+    }),
+};