@lijian-ui/dsh-im-gateway 0.1.0

package/lib/index.js

@@ -0,0 +1,3623 @@
+import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
+import { Service } from "@deepseek-ai/cordis";
+import Schema from "@deepseek-ai/schemastery";
+import { SessionId } from "@deepseek-ai/dsh-session";
+import { createUserMessage } from "@deepseek-ai/dsh-llm";
+import { installModelSelection } from "@deepseek-ai/dsh-agent";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import os from "node:os";
+import crypto, { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+import QRCode from "qrcode";
+//#region src/gateway/im-gateway.ts
+const Config = Schema.object({
+	cwd: Schema.string().default(process.cwd()),
+	streamThrottleMs: Schema.number().default(800),
+	slashCommands: Schema.boolean().default(true),
+	channels: Schema.array(Schema.object({
+		id: Schema.string().required(),
+		type: Schema.union([
+			"dingtalk",
+			"qq",
+			"weixin"
+		]),
+		name: Schema.string().default(""),
+		enabled: Schema.boolean().default(false),
+		config: Schema.object({
+			clientId: Schema.string().default(""),
+			clientSecret: Schema.string().role("secret").default(""),
+			callbackBaseUrl: Schema.string().default(""),
+			appId: Schema.string().default(""),
+			botAppId: Schema.string().default(""),
+			baseUrl: Schema.string().default(""),
+			token: Schema.string().role("secret").default(""),
+			botId: Schema.string().default(""),
+			cdnBaseUrl: Schema.string().default(""),
+			pollIntervalMs: Schema.number().default(3e3)
+		}).default({})
+	})).default([])
+});
+/**
+* Core IM gateway service.
+*
+* Responsibilities (ported from pi-desk-top/src/main/im/im-gateway.ts):
+*  - channel registry (`registerChannel`)
+*  - conversation → host session mapping
+*  - per-conversation serial queue (one agent turn at a time)
+*  - slash-command handling (/help, /reset, /clear)
+*  - agent-event → channel reply routing (streaming, tool notifications, flush)
+*
+* ─────────────────────────────────────────────────────────────────────────
+* HOST API CONTRACT (verified against deepseek-harness source):
+*  - Sessions:  `ctx.sessions` is the `SessionStore` (from @deepseek-ai/dsh-session).
+*               `create(id, { meta: { cwd } })` builds an event-sourced Session.
+*               The Session object has NO `.prompt()` / `.on()` — it is a log.
+*  - Agents:    `ctx.agents` is the `AgentRegistry` (from @deepseek-ai/dsh-agent).
+*               `get(sessionId)` → Agent | undefined; `createAgent(ownerCtx, opts)`
+*               starts the agent loop on a session. Drive a turn with
+*               `agent.followup(userMessage)` (see host/apiproxy/src/api-proxy.ts:2461).
+*  - Events:    subscribe at the CONTEXT level: `ctx.on('session/event', (session, event) => …)`.
+*               Typed events (packages/core/session/src/types.ts):
+*                 'turn/start'        { turn }
+*                 'assistant/chunk'   { turn, step, chunk: StreamChunk }  // chunk.type==='text-delta' → text
+*                 'assistant/message' { turn, step, message: AssistantMessage }
+*                 'tool/call'         { turn, step, callId, name, arguments }
+*                 'turn/end'          { turn, reason }
+* ─────────────────────────────────────────────────────────────────────────
+*/
+var ImGatewayService = class extends Service {
+	config;
+	static inject = ["agents"];
+	channels = /* @__PURE__ */ new Map();
+	convToSession = /* @__PURE__ */ new Map();
+	sessionToConv = /* @__PURE__ */ new Map();
+	/** Deduplicate concurrent ensureSession calls for the same conversation. */
+	sessionCreations = /* @__PURE__ */ new Map();
+	serialQueues = /* @__PURE__ */ new Map();
+	pendingStream = /* @__PURE__ */ new Map();
+	finalText = /* @__PURE__ */ new Map();
+	/** Whether beginStream was already called for this conversation's reply cycle. */
+	streamStarted = /* @__PURE__ */ new Map();
+	agentHandles = /* @__PURE__ */ new Map();
+	/** Per-session model-selection ref (so /model can switch without re-injecting). */
+	modelRefs = /* @__PURE__ */ new Map();
+	/** Per-session model override captured from /model (absent → fall back to globalModelOverride). */
+	modelOverrides = /* @__PURE__ */ new Map();
+	/**
+	* Default model when there is no session override AND no /cwd-provided default.
+	* Set by /model <name> issued BEFORE the first message of a conversation
+	* (i.e. session not yet created). Survives across conversations until cleared.
+	*/
+	globalModelOverride;
+	/** Live channel runtime status, surfaced to the settings UI via getChannelStatuses. */
+	channelStatuses = /* @__PURE__ */ new Map();
+	unsubSessionEvent;
+	active = false;
+	constructor(ctx, config) {
+		super(ctx, "imGateway");
+		this.config = config;
+	}
+	registerChannel(adapter) {
+		if (this.channels.has(adapter.id)) this.ctx.logger.warn(`[im-gateway] channel "${adapter.id}" re-registered; replacing.`);
+		this.channels.set(adapter.id, adapter);
+		adapter.statusListener = (status) => this.setChannelStatus(adapter.id, status);
+		if (this.active) Promise.resolve(adapter.start()).catch((err) => this.ctx.logger.error(`[im-gateway] channel "${adapter.id}" start failed`, err));
+	}
+	getChannel(id) {
+		return this.channels.get(id);
+	}
+	listChannels() {
+		return [...this.channels.keys()];
+	}
+	/**
+	* Stop every channel and clear the registry. Used by config reload
+	* (mirrors the reference project's applyConfig → stopAll): after a save
+	* the caller re-creates adapters from the new settings and re-registers.
+	*/
+	async stopAll() {
+		const adapters = [...this.channels.values()];
+		this.channels.clear();
+		this.channelStatuses.clear();
+		for (const adapter of adapters) try {
+			await adapter.stop();
+		} catch (err) {
+			this.ctx.logger.error(`[im-gateway] stop channel "${adapter.id}" failed`, err);
+		}
+	}
+	/** Snapshot of every channel's runtime status for the settings UI. */
+	getChannelStatuses() {
+		const out = {};
+		for (const [id, status] of this.channelStatuses) out[id] = status;
+		return out;
+	}
+	/** Record a channel's runtime status and log meaningful transitions. */
+	setChannelStatus(id, status) {
+		const prev = this.channelStatuses.get(id)?.status;
+		this.channelStatuses.set(id, {
+			...status,
+			lastChange: Date.now()
+		});
+		if (prev !== status.status) {
+			if (status.status === "error") this.ctx.logger.warn(`[im-gateway] channel "${id}" → error: ${status.error ?? "unknown"}`);
+			else this.ctx.logger.info(`[im-gateway] channel "${id}" → ${status.status}`);
+		}
+	}
+	async *[Service.init]() {
+		yield async () => {
+			this.active = false;
+			this.unsubSessionEvent?.();
+			this.unsubSessionEvent = void 0;
+			for (const adapter of this.channels.values()) try {
+				await adapter.stop();
+			} catch (err) {
+				this.ctx.logger.error(`[im-gateway] stop channel "${adapter.id}" failed`, err);
+			}
+			for (const [, handle] of this.agentHandles) await handle.dispose().catch((err) => this.ctx.logger.warn("[im-gateway] agent dispose failed", err));
+			this.agentHandles.clear();
+			this.convToSession.clear();
+			this.sessionToConv.clear();
+		};
+		this.active = true;
+		this.unsubSessionEvent = this.ctx.root.on("session/event", (session, event) => this.onSessionEvent(session, event));
+		for (const adapter of this.channels.values()) try {
+			await adapter.start();
+		} catch (err) {
+			this.ctx.logger.error(`[im-gateway] start channel "${adapter.id}" failed`, err);
+		}
+		this.ctx.logger.info(`[im-gateway] active; channels: ${this.listChannels().join(", ") || "(none)"}`);
+	}
+	async handleInbound(message) {
+		const channel = this.channels.get(message.channelId);
+		if (!channel) {
+			this.ctx.logger.warn(`[im-gateway] inbound from unknown channel "${message.channelId}"`);
+			return;
+		}
+		if (channel.onInbound) {
+			if (await channel.onInbound(message)) return;
+		}
+		if (this.config.slashCommands && message.text.trimStart().startsWith("/")) try {
+			if (await this.handleSlash(channel, message)) return;
+		} catch (err) {
+			const convId = convOf(`${message.channelId}:${message.conversationId}`);
+			const detail = err instanceof Error ? err.message : String(err);
+			this.ctx.logger.error(`[im-gateway] slash command failed: ${detail}`, err);
+			await channel.sendText(convId, `⚠️ 命令执行失败：${detail}`).catch(() => void 0);
+			return;
+		}
+		const convKey = `${message.channelId}:${message.conversationId}`;
+		const sessionId = await this.ensureSession(convKey);
+		const parts = toContentBlocks(message);
+		const next = (this.serialQueues.get(convKey) ?? Promise.resolve()).then(() => this.runTurn(sessionId, convKey, channel, parts));
+		this.serialQueues.set(convKey, next.catch(() => void 0));
+	}
+	async ensureSession(convKey) {
+		const existing = this.convToSession.get(convKey);
+		if (existing) return existing;
+		let creation = this.sessionCreations.get(convKey);
+		if (creation === void 0) {
+			creation = this.ensureSessionInner(convKey);
+			this.sessionCreations.set(convKey, creation);
+			creation.finally(() => this.sessionCreations.delete(convKey)).catch(() => void 0);
+		}
+		return creation;
+	}
+	/**
+	* Resolve an IM conversation to a live agent session, following the OFFICIAL
+	* dsh pattern (dsh-host-apiproxy/src/api-proxy.ts `ensureSession`):
+	*
+	*   1. A live agent with this id already exists → reuse it.
+	*   2. A persisted log exists on disk (from a previous run) → `agents.resume`
+	*      the SAME id. This is the crux: IM conversations are long-lived (the
+	*      DingTalk conversationId is stable across restarts), so the session id
+	*      MUST be stable too. `agents.create` on a stored id would reject with
+	*      "id collision" because the fresh seed does not reproduce the stored
+	*      log; `agents.resume` replays the stored log AS the seed and keeps the
+	*      conversation history. A random per-boot suffix would dodge the
+	*      collision but silently throw history away — do NOT do that.
+	*   3. Neither → genuinely new conversation: `agents.create`.
+	*/
+	async ensureSessionInner(convKey) {
+		const sessionId = SessionId(`im:${convKey}`);
+		if (this.ctx.agents.get(sessionId)) {
+			this.convToSession.set(convKey, sessionId);
+			this.sessionToConv.set(sessionId, convKey);
+			await this.attachToWorkspace(sessionId);
+			return sessionId;
+		}
+		const persistence = this.ctx.get("sessionPersistence");
+		if (persistence) {
+			if ((await persistence.list()).find((header) => header.id === sessionId)) {
+				const handle = await this.ctx.agents.resume({ resumeSessionId: sessionId });
+				this.installModelSelection(handle.agent, sessionId);
+				this.agentHandles.set(sessionId, handle);
+				this.convToSession.set(convKey, sessionId);
+				this.sessionToConv.set(sessionId, convKey);
+				this.ctx.logger.info(`[im-gateway] resumed session ${sessionId} (history kept)`);
+				await this.attachToWorkspace(sessionId);
+				return sessionId;
+			}
+		}
+		let handle;
+		try {
+			handle = await this.ctx.agents.create({
+				sessionId,
+				meta: { cwd: this.config.cwd }
+			});
+		} catch (err) {
+			if (isIdCollision(err)) handle = await this.ctx.agents.resume({ resumeSessionId: sessionId });
+			else throw err;
+		}
+		this.installModelSelection(handle.agent, sessionId);
+		this.agentHandles.set(sessionId, handle);
+		this.convToSession.set(convKey, sessionId);
+		this.sessionToConv.set(sessionId, convKey);
+		await this.attachToWorkspace(sessionId);
+		return sessionId;
+	}
+	/**
+	* Associate an IM session with the workspace whose canonical path matches its
+	* cwd, so the session shows up under the correct project group in the web
+	* sidebar instead of the "Ungrouped" bucket.
+	*
+	* dsh groups the sidebar by Host Workspace: sessions created through the UI
+	* attach to a workspace via `session.create(workspaceId)`. Our bare
+	* `agents.create({ meta: { cwd } })` only stamps the header cwd — it does NOT
+	* enter any workspace's `sessionIds` account, so the session is "stray" and
+	* lands in the Ungrouped group (workspace auto-bootstrap only runs once on
+	* first init, before our IM sessions exist). Explicitly resolving the cwd's
+	* workspace (creating it if the user never opened it) and attaching is the
+	* official path (workspaceRegistry.attachSession).
+	*
+	* Best-effort: workspace grouping must never block or fail an IM turn.
+	*/
+	async attachToWorkspace(sessionId) {
+		try {
+			const workspaceRegistry = this.ctx.get("workspaceRegistry");
+			if (!workspaceRegistry) return;
+			const cwd = this.config.cwd;
+			if (!cwd) return;
+			let workspace = await workspaceRegistry.resolveByPath(cwd);
+			if (!workspace) workspace = await workspaceRegistry.create(cwd);
+			await workspace.attachSession(sessionId);
+			this.ctx.logger.info(`[im-gateway] attached session ${sessionId} to workspace "${cwd}"`);
+		} catch (err) {
+			this.ctx.logger.warn(`[im-gateway] workspace attach failed for ${sessionId}`, err);
+		}
+	}
+	/**
+	* Wire the agent-default-model selection into one agent's prompt assembly
+	* (mirrors dsh-host-apiproxy selectionFor). Listeners live on the agent's
+	* scoped ctx and are torn down with it.
+	*
+	* The `current` getter returns this session's /model override when set,
+	* otherwise the deployment default (`agentDefaultModel`). The setter records
+	* an override — that is exactly how the official `session.selectModel`
+	* switches the model for one conversation. We keep the ref alive in
+	* `modelRefs` so `/model` can mutate `current` on the same object the prompt
+	* assembly reads.
+	*/
+	installModelSelection(agent, sessionId) {
+		const gateway = this;
+		const defaults = this.ctx.get("agentDefaultModel");
+		const ref = {
+			get current() {
+				const override = gateway.modelOverrides.get(sessionId) ?? gateway.globalModelOverride;
+				const base = defaults?.currentSelection();
+				return override ?? base ?? void 0;
+			},
+			set current(next) {
+				if (next) gateway.modelOverrides.set(sessionId, {
+					provider: next.provider,
+					model: next.model,
+					...next.reasoningEffort === void 0 ? {} : { reasoningEffort: String(next.reasoningEffort) }
+				});
+				else gateway.modelOverrides.delete(sessionId);
+			},
+			assembled: void 0
+		};
+		installModelSelection(agent.ctx, ref);
+		this.modelRefs.set(sessionId, ref);
+	}
+	async runTurn(sessionId, convKey, channel, parts) {
+		const convId = convOf(convKey);
+		const agent = this.ctx.agents.get(sessionId);
+		if (!agent) {
+			this.ctx.logger.warn(`[im-gateway] no agent for session ${sessionId}`);
+			await channel.sendText(convId, "⚠️ 会话未就绪，请稍后重试。");
+			return;
+		}
+		const userMessage = createUserMessage({
+			content: parts,
+			source: { kind: "user" }
+		});
+		try {
+			agent.followup(userMessage);
+		} catch (err) {
+			this.ctx.logger.error(`[im-gateway] followup failed for ${convKey}`, err);
+			await channel.sendText(convId, "⚠️ 处理失败，请稍后重试。");
+		}
+	}
+	onSessionEvent(session, event) {
+		const convKey = this.sessionToConv.get(String(session.id));
+		if (!convKey) return;
+		const channel = this.channelForConv(convKey);
+		if (!channel) return;
+		const convId = convOf(convKey);
+		switch (event.type) {
+			case "turn/start":
+				this.finalText.set(convId, "");
+				this.streamStarted.delete(convId);
+				break;
+			case "assistant/chunk": {
+				const chunk = event.data.chunk;
+				if (chunk.type === "text-delta") {
+					if (channel.beginStream && !this.streamStarted.get(convId)) {
+						this.streamStarted.set(convId, true);
+						channel.beginStream(convId).catch((err) => {
+							this.ctx.logger.warn(`[im-gateway] beginStream failed: ${err instanceof Error ? err.message : String(err)}`);
+						});
+					}
+					this.finalText.set(convId, (this.finalText.get(convId) ?? "") + chunk.text);
+					this.streamToChannel(channel, convId, chunk.text);
+				}
+				break;
+			}
+			case "tool/call": {
+				const name = event.data.name ?? "未知工具";
+				if (channel.streamText) channel.streamText(convId, `🔧 正在调用工具：${name} …`).catch(() => void 0);
+				else channel.sendText(convId, `🔧 ${name} …`);
+				break;
+			}
+			case "assistant/message":
+				this.finalText.set(convId, extractText(event.data.message.content));
+				break;
+			case "turn/end": {
+				this.flushStream(channel, convId);
+				const full = this.finalText.get(convId) ?? "";
+				if (channel.endStream) channel.endStream(convId, full || "✅ 已完成（无文本输出）").catch((err) => {
+					this.ctx.logger.warn(`[im-gateway] endStream failed: ${err instanceof Error ? err.message : String(err)}`);
+					if (full) channel.sendText(convId, full).catch(() => void 0);
+				});
+				else if (!channel.updateCard) {
+					if (full) channel.sendText(convId, full);
+					else {
+						const reason = event.data?.reason;
+						if (reason?.kind === "error") {
+							const detail = typeof reason.error?.message === "string" ? reason.error.message : "未知错误";
+							channel.sendText(convId, `⚠️ 处理失败：${detail.slice(0, 200)}`);
+						}
+					}
+				}
+				break;
+			}
+		}
+	}
+	streamToChannel(channel, convId, delta) {
+		if (!channel.streamText && !channel.updateCard) return;
+		const entry = this.pendingStream.get(convId) ?? { text: "" };
+		entry.text += delta;
+		if (!entry.timer) entry.timer = setTimeout(() => this.flushStream(channel, convId), this.config.streamThrottleMs);
+		this.pendingStream.set(convId, entry);
+	}
+	flushStream(channel, convId) {
+		const entry = this.pendingStream.get(convId);
+		if (!entry) return;
+		const text = entry.text;
+		entry.text = "";
+		entry.timer = void 0;
+		this.pendingStream.set(convId, entry);
+		if (!text) return;
+		if (channel.streamText) channel.streamText(convId, text);
+		else channel.updateCard?.(convId, text);
+	}
+	async handleSlash(channel, message) {
+		const parts = message.text.slice(1).split(/\s+/);
+		const cmd = parts[0];
+		const arg = parts.slice(1).join(" ").trim();
+		const convKey = `${message.channelId}:${message.conversationId}`;
+		const convId = convOf(convKey);
+		switch (cmd) {
+			case "help":
+				await channel.sendText(convId, [
+					"**可用指令**",
+					"",
+					"- `/help` — 显示本帮助",
+					"- `/reset` · `/clear` · `/new` — 重置当前会话（开启新一轮）",
+					"- `/model` — 列出可用模型；`/model <编号|模型名|provider/model>` 切换",
+					"- `/status` — 查看当前渠道、工作目录与模型",
+					"- `/stop` — 中止当前正在生成的回答"
+				].join("\n"));
+				return true;
+			case "reset":
+			case "clear":
+			case "new": {
+				const sessionId = this.convToSession.get(convKey);
+				if (sessionId) {
+					await this.agentHandles.get(sessionId)?.dispose().catch(() => void 0);
+					this.agentHandles.delete(sessionId);
+					this.modelRefs.delete(sessionId);
+					this.modelOverrides.delete(sessionId);
+					this.sessionToConv.delete(sessionId);
+					this.convToSession.delete(convKey);
+				}
+				this.finalText.delete(convId);
+				await channel.sendText(convId, "✅ 会话已重置，下一句将开启新一轮。");
+				return true;
+			}
+			case "model":
+				await this.handleModelCommand(channel, convKey, convId, arg);
+				return true;
+			case "status":
+				await this.handleStatusCommand(channel, convKey, convId, message);
+				return true;
+			case "stop":
+				await this.handleStopCommand(channel, convKey, convId);
+				return true;
+			default: return false;
+		}
+	}
+	async handleModelCommand(channel, convKey, convId, arg) {
+		const sessionId = this.convToSession.get(convKey);
+		const models = await this.listAvailableModels();
+		if (models.length === 0) {
+			await channel.sendText(convId, "⚠️ 暂无可用的模型（未配置 provider）。");
+			return;
+		}
+		if (!arg) {
+			const current = (sessionId ? this.modelOverrides.get(sessionId) : void 0) ?? this.globalModelOverride ?? this.ctx.get("agentDefaultModel")?.currentSelection();
+			const NUM_EMOJI = [
+				"1️⃣",
+				"2️⃣",
+				"3️⃣",
+				"4️⃣",
+				"5️⃣",
+				"6️⃣",
+				"7️⃣",
+				"8️⃣",
+				"9️⃣",
+				"🔟"
+			];
+			const lines = models.map((m, i) => {
+				const isCur = current && current.provider === m.provider && current.model === m.model;
+				const label = m.name && m.name !== m.model ? `${m.model}（${m.name}）` : m.model;
+				return `- ${NUM_EMOJI[i] ?? `${i + 1}.`} ${label} \`[${m.provider}]\`${isCur ? " ← 当前" : ""}`;
+			});
+			await channel.sendText(convId, [
+				"**可用模型**（输入 `/model <emoji|模型名|provider/model>` 切换——emoji 即列表左侧的 1️⃣2️⃣ 等；无会话时切换将设为默认模型，下次建立会话生效）",
+				"",
+				...lines
+			].join("\n"));
+			return;
+		}
+		const target = this.resolveModelArg(arg, models);
+		if (!target) {
+			await channel.sendText(convId, `⚠️ 未找到模型「${arg}」。输入 /model 查看可用列表。`);
+			return;
+		}
+		if (!sessionId) {
+			this.globalModelOverride = {
+				provider: target.provider,
+				model: target.model
+			};
+			await channel.sendText(convId, `✅ 已设置默认模型：\`${target.model}\` [\`${target.provider}\`]（下次建立会话时生效，下一次发送消息后立即应用）`);
+			return;
+		}
+		this.modelOverrides.set(sessionId, {
+			provider: target.provider,
+			model: target.model
+		});
+		const ref = this.modelRefs.get(sessionId);
+		if (ref) ref.current = {
+			provider: target.provider,
+			model: target.model
+		};
+		await channel.sendText(convId, `✅ 已切换模型：\`${target.model}\` [\`${target.provider}\`]（下一句生效）`);
+	}
+	/** Build the provider/model catalog from the host llm registry. */
+	async listAvailableModels() {
+		const llm = this.ctx.get("llm");
+		if (!llm?.listProviders) return [];
+		const out = [];
+		let providers = [];
+		try {
+			providers = llm.listProviders() ?? [];
+		} catch (err) {
+			this.ctx.logger.warn(`[im-gateway] listProviders failed: ${err instanceof Error ? err.message : String(err)}`);
+			return [];
+		}
+		for (const p of providers) {
+			let models = [];
+			try {
+				models = await llm.listModels(p.id);
+			} catch (err) {
+				this.ctx.logger.warn(`[im-gateway] listModels("${p.id}") failed: ${err instanceof Error ? err.message : String(err)}`);
+				continue;
+			}
+			for (const m of models) out.push({
+				provider: p.id,
+				model: m.id,
+				name: m.name ?? m.id
+			});
+		}
+		return out;
+	}
+	/** Resolve a /model argument (index | model id | partial | provider/model) to a catalog entry. */
+	resolveModelArg(arg, models) {
+		const byIndex = arg.match(/^(\d+)$/);
+		if (byIndex) return models[Number(byIndex[1]) - 1];
+		if (arg.includes("/")) {
+			const [provider, ...rest] = arg.split("/");
+			const model = rest.join("/");
+			return models.find((m) => m.provider === provider && m.model === model);
+		}
+		return models.find((m) => m.model === arg) ?? models.find((m) => m.model.toLowerCase() === arg.toLowerCase()) ?? models.find((m) => m.model.toLowerCase().includes(arg.toLowerCase()));
+	}
+	async handleStatusCommand(channel, convKey, convId, message) {
+		const sessionId = this.convToSession.get(convKey);
+		const sessionOverride = sessionId ? this.modelOverrides.get(sessionId) : void 0;
+		const sel = sessionOverride ?? this.globalModelOverride ?? this.ctx.get("agentDefaultModel")?.currentSelection();
+		const handle = sessionId ? this.agentHandles.get(sessionId) : void 0;
+		const lines = ["**当前状态**", ""];
+		lines.push(`- 📡 渠道：\`${message.channelId}\``, `- 📁 工作目录：\`${this.config.cwd}\``, `- 🤖 当前模型：${sel ? `\`${sel.provider} / ${sel.model}\`` : "未知"}`, `- 💬 会话：${sessionId ? "已建立" : "未建立"}`);
+		if (this.globalModelOverride && !sessionOverride) lines.push(`- 🌐 全局默认模型（预选）：\`${this.globalModelOverride.provider} / ${this.globalModelOverride.model}\``);
+		if (handle) lines.push(`- ⚙️ 运行状态：\`${handle.agent.status}\``);
+		await channel.sendText(convId, lines.join("\n"));
+	}
+	async handleStopCommand(channel, convKey, convId) {
+		const sessionId = this.convToSession.get(convKey);
+		const handle = sessionId ? this.agentHandles.get(sessionId) : void 0;
+		if (!handle) {
+			await channel.sendText(convId, "⚠️ 当前没有进行中的会话。");
+			return;
+		}
+		try {
+			handle.agent.cancel({ kind: "user" }, { keepInbox: true });
+			await channel.sendText(convId, "🛑 已中止当前轮次。");
+		} catch (err) {
+			this.ctx.logger.error(`[im-gateway] /stop failed for ${convKey}`, err);
+			await channel.sendText(convId, "⚠️ 中止失败，请稍后重试。");
+		}
+	}
+	channelForConv(convKey) {
+		const channelId = convKey.slice(0, convKey.indexOf(":"));
+		return this.channels.get(channelId);
+	}
+};
+/** convKey = `channelId:conversationId` → conversationId (supports ':' inside it). */
+function convOf(convKey) {
+	return convKey.slice(convKey.indexOf(":") + 1);
+}
+/**
+* Build dsh ContentBlock[] from a normalized inbound message.
+*
+* PoC is TEXT-ONLY. Real multimodal requires registering raw bytes with the
+* `@deepseek-ai/dsh-attachment` service to obtain an `ImageAttachmentRef`
+* (the actual `ImageBlock` shape is `{ type: 'image'; attachment }`, NOT inline
+* base64). That is a tracked seam: inbound images currently arrive as the
+* "[图片]" text note the channel adapter emits. Wire `ctx.attachments` before
+* enabling vision.
+*/
+function toContentBlocks(message) {
+	const blocks = [];
+	if (message.text) {
+		const text = message.isGroup && message.senderNick ? `[@${message.senderNick}] ${message.text}` : message.text;
+		blocks.push({
+			type: "text",
+			text
+		});
+	}
+	return blocks;
+}
+/** Extract plain text from an assistant message's content blocks. */
+function extractText(content) {
+	return content.filter((b) => b.type === "text").map((b) => b.text).join("");
+}
+/**
+* Whether an error is a session-persistence id collision. The persistence
+* coordinator throws several distinct collision messages; match on the
+* stable substring instead of the error class (which can be duplicated when a
+* dependency is inlined into the bundle).
+*/
+function isIdCollision(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	return message.includes("id collision") || message.includes("already has a persisted log");
+}
+//#endregion
+//#region src/channels/dingtalk-connection.ts
+/**
+* DingTalk stream connection (ported from pi-desk-top/src/main/im/dingtalk/
+* dingtalk-connection.ts — MIT, protocol code only; OpenClaw framework parts
+* dropped, EventEmitter removed in favour of plain callback options).
+*
+* What this gives us:
+*  - DWClient WebSocket long connection (no public callback URL needed)
+*  - application-layer heartbeat: 10s ping / 20s timeout (SDK keepAlive off)
+*  - exponential-backoff reconnect with jitter, guarded against concurrency
+*  - message dedup with 5-minute TTL (stream-account scoped)
+*
+* The DingTalk "stream" bot pushes messages over an OUTBOUND WebSocket. We
+* register a CALLBACK listener for TOPIC_ROBOT BEFORE connect() so the connect
+* handshake carries the subscription — otherwise the server never delivers bot
+* messages to our callback (this is the gotcha the reference calls out).
+*/
+const HEARTBEAT_INTERVAL = 1e4;
+const BASE_BACKOFF_DELAY$2 = 2e3;
+const MAX_BACKOFF_DELAY$2 = 3e4;
+const DEDUP_TTL_MS = 3e5;
+let DWClientCtor = null;
+let TOPIC_ROBOT = "";
+async function loadDingtalkStream() {
+	if (DWClientCtor) return;
+	const mod = await import("dingtalk-stream");
+	DWClientCtor = mod.DWClient ?? mod.default?.DWClient;
+	TOPIC_ROBOT = mod.TOPIC_ROBOT ?? "/v1.0/im/bot/messages/get";
+	if (!DWClientCtor) throw new Error("dingtalk-stream: DWClient not found");
+}
+/**
+* Thin wrapper around the official DWClient streaming socket. NOT an EventEmitter
+* in this port — callers subscribe via the constructor callbacks.
+*/
+var DingtalkConnection = class {
+	opts;
+	client = null;
+	stopped = false;
+	isReconnecting = false;
+	reconnectAttempts = 0;
+	keepAliveTimer = null;
+	dedup = /* @__PURE__ */ new Map();
+	connected = false;
+	constructor(opts) {
+		this.opts = opts;
+	}
+	get isConnected() {
+		return this.connected;
+	}
+	/** Mark a message id as processed (returns true if it was already seen). */
+	checkAndMark(accountId, msgId) {
+		const now = Date.now();
+		for (const [k, ts] of this.dedup) if (now - ts > DEDUP_TTL_MS) this.dedup.delete(k);
+		const key = `${accountId}:${msgId}`;
+		if (this.dedup.has(key)) return true;
+		this.dedup.set(key, now);
+		return false;
+	}
+	setupSocketListeners() {
+		const socket = this.client?.socket;
+		if (!socket) return;
+		socket.on("pong", () => {
+			this.reconnectAttempts = 0;
+			this.connected = true;
+		});
+		socket.on("message", () => {
+			this.reconnectAttempts = 0;
+			this.connected = true;
+		});
+		socket.on("close", () => {
+			this.connected = false;
+			if (!this.stopped && !this.isReconnecting) this.doReconnect(true);
+		});
+	}
+	startKeepAlive() {
+		this.stopKeepAlive();
+		this.keepAliveTimer = setInterval(() => {
+			if (!this.client?.socket) return;
+			if (this.client.socket.readyState === 1) {
+				this.client.socket.ping();
+				this.connected = true;
+			} else if (!this.isReconnecting) this.doReconnect(false);
+		}, HEARTBEAT_INTERVAL);
+	}
+	stopKeepAlive() {
+		if (this.keepAliveTimer) {
+			clearInterval(this.keepAliveTimer);
+			this.keepAliveTimer = null;
+		}
+	}
+	backoffDelay() {
+		const exponential = BASE_BACKOFF_DELAY$2 * 2 ** this.reconnectAttempts;
+		const jitter = Math.random() * 1e3;
+		return Math.min(exponential + jitter, MAX_BACKOFF_DELAY$2);
+	}
+	async doReconnect(immediate) {
+		if (this.isReconnecting || this.stopped) return;
+		this.isReconnecting = true;
+		try {
+			if (!immediate) await new Promise((r) => setTimeout(r, this.backoffDelay()));
+			this.reconnectAttempts++;
+			this.client?.disconnect();
+			this.registerMessageListener();
+			await this.client.connect();
+			this.setupSocketListeners();
+			if (await this.waitForSocketOpen()) {
+				this.connected = true;
+				this.reconnectAttempts = 0;
+				this.opts.onStatusChange?.(true);
+			}
+		} catch {} finally {
+			this.isReconnecting = false;
+		}
+	}
+	waitForSocketOpen() {
+		return new Promise((resolve) => {
+			const t = setTimeout(() => resolve(false), 1e4);
+			const check = () => {
+				if (this.client?.socket?.readyState === 1) {
+					clearTimeout(t);
+					resolve(true);
+				} else setTimeout(check, 200);
+			};
+			check();
+		});
+	}
+	registerMessageListener() {
+		this.client.registerCallbackListener(TOPIC_ROBOT, async (res) => {
+			const headers = res?.headers ?? {};
+			const messageId = headers.messageId;
+			const rawData = res?.data ?? "";
+			if (messageId) this.client.socketCallBackResponse?.(messageId, { success: true });
+			if (messageId && this.checkAndMark("stream", messageId)) return { status: "SUCCESS" };
+			this.opts.onMessage(rawData, headers);
+			return { status: "SUCCESS" };
+		});
+	}
+	async connect() {
+		await loadDingtalkStream();
+		if (this.stopped) return;
+		this.client = new DWClientCtor({
+			clientId: this.opts.clientId,
+			clientSecret: this.opts.clientSecret,
+			autoReconnect: false,
+			keepAlive: false
+		});
+		this.client.on("error", (err) => {
+			this.connected = false;
+			this.opts.onStatusChange?.(false);
+			console.error("[im:dingtalk] connection error:", err?.message);
+		});
+		this.registerMessageListener();
+		await this.client.connect();
+		this.setupSocketListeners();
+		this.startKeepAlive();
+		this.connected = true;
+		this.opts.onStatusChange?.(true);
+	}
+	async stop() {
+		this.stopped = true;
+		this.stopKeepAlive();
+		this.client?.disconnect();
+		this.client = null;
+		this.connected = false;
+	}
+};
+//#endregion
+//#region src/channels/dingtalk-card.ts
+/**
+* DingTalk AI Card streaming protocol (ported from
+* pi-desk-top/src/main/im/dingtalk/dingtalk-card.ts, itself ported from
+* dingtalk-openclaw-connector, MIT — protocol code only).
+*
+* Lifecycle:
+*   createDingtalkCard() → POST /v1.0/card/instances + /deliver (card instance)
+*   streamDingtalkCard() → PUT /v1.0/card/streaming (incremental content updates)
+*   finishDingtalkCard() → final streaming frame + PUT /v1.0/card/instances (FINISHED)
+*
+* The whole path is rate-limited by a global token bucket (DingTalk caps at
+* ~40 req/s; we stay at 20) with a 2s backoff + one retry on QPS errors.
+*
+* HTTP uses the global fetch (Node >=18); no axios dependency.
+*
+* CRITICAL: every request goes through `cardFetch` which enforces a 10s
+* timeout (AbortController) and checks DingTalk's business error code
+* (HTTP 200 but errcode != 0). WITHOUT the timeout, a hung PUT would leave
+* the gateway's endStream() pending forever — no card finalize AND no plain
+* text fallback, i.e. the agent "replies" but the user sees nothing.
+*/
+const DINGTALK_API = "https://api.dingtalk.com";
+/** Official DingTalk AI Card template (same as the reference project). */
+const AI_CARD_TEMPLATE_ID = "02fcf2f4-5e02-4a85-b672-46d1f715543e.schema";
+const CARD_API_MAX_QPS = 20;
+const QPS_BACKOFF_DURATION_MS = 2e3;
+const TOKEN_EXPIRE_MS = 72e5;
+/** Hard cap per card API request — a hang must become a rejection. */
+const CARD_REQUEST_TIMEOUT_MS = 1e4;
+/** Card flow status codes (DingTalk AI Card protocol). */
+const AICardStatus = {
+	PROCESSING: "1",
+	INPUTING: "2",
+	FINISHED: "3",
+	EXECUTING: "4",
+	FAILED: "5"
+};
+const tokenCache = /* @__PURE__ */ new Map();
+async function getAccessToken(cfg) {
+	const key = cfg.clientId;
+	const cached = tokenCache.get(key);
+	if (cached && cached.expiryMs > Date.now() + 6e4) return cached.token;
+	const data = await cardFetch(`${DINGTALK_API}/v1.0/oauth2/accessToken`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			appKey: cfg.clientId,
+			appSecret: cfg.clientSecret
+		})
+	});
+	const token = data?.accessToken;
+	if (!token) throw new Error(`dingtalk card accessToken missing: ${JSON.stringify(data).slice(0, 200)}`);
+	const expireInSec = Number(data?.expireIn ?? 0) || 7200;
+	tokenCache.set(key, {
+		token,
+		expiryMs: Date.now() + expireInSec * 1e3
+	});
+	return token;
+}
+var TokenBucket = class {
+	tokens = CARD_API_MAX_QPS;
+	lastRefill = Date.now();
+	backoffUntil = 0;
+	async waitForToken() {
+		for (;;) {
+			const now = Date.now();
+			if (now < this.backoffUntil) {
+				await sleep(this.backoffUntil - now);
+				continue;
+			}
+			const elapsed = (now - this.lastRefill) / 1e3;
+			this.tokens = Math.min(CARD_API_MAX_QPS, this.tokens + elapsed * CARD_API_MAX_QPS);
+			this.lastRefill = now;
+			if (this.tokens >= 1) {
+				this.tokens -= 1;
+				return;
+			}
+			await sleep(Math.ceil((1 - this.tokens) / CARD_API_MAX_QPS * 1e3));
+		}
+	}
+	triggerBackoff() {
+		this.backoffUntil = Date.now() + QPS_BACKOFF_DURATION_MS;
+		this.tokens = 0;
+	}
+};
+const cardRateLimiter = new TokenBucket();
+function sleep(ms) {
+	return new Promise((r) => setTimeout(r, ms));
+}
+function isQpsLimitError(err) {
+	const msg = `${err?.message ?? ""} ${err?.errmsg ?? ""} ${err?.code ?? ""}`.toLowerCase();
+	return msg.includes("qps") || msg.includes("rate limit") || msg.includes("too many");
+}
+/**
+* fetch wrapper for every card API call. Guarantees:
+*  1. 10s hard timeout — a hung request rejects instead of hanging forever
+*     (the caller's catch then triggers the plain-text fallback).
+*  2. Business error detection — DingTalk often returns HTTP 200 with
+*     `errcode`/`errorCode` != 0; a bare `res.ok` check would treat a failed
+*     FINISHED as success and leave the card spinning forever.
+* Returns the parsed JSON body.
+*/
+async function cardFetch(url, init) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), CARD_REQUEST_TIMEOUT_MS);
+	let res;
+	try {
+		res = await fetch(url, {
+			...init,
+			signal: controller.signal
+		});
+	} catch (err) {
+		clearTimeout(timer);
+		if (err?.name === "AbortError") {
+			const e = /* @__PURE__ */ new Error(`card api timeout after ${CARD_REQUEST_TIMEOUT_MS}ms: ${url}`);
+			e.timeout = true;
+			throw e;
+		}
+		throw err;
+	}
+	clearTimeout(timer);
+	let data = null;
+	try {
+		data = await res.json();
+	} catch {}
+	const errcode = data?.errcode ?? data?.errorCode;
+	if (!res.ok || errcode !== void 0 && errcode !== null && Number(errcode) !== 0) {
+		const err = new Error(`card api HTTP ${res.status} errcode ${errcode}: ${data?.errmsg ?? data?.message ?? ""}`.slice(0, 300));
+		err.status = res.status;
+		err.code = String(errcode);
+		err.errmsg = data?.errmsg ?? data?.message;
+		throw err;
+	}
+	return data;
+}
+function buildDeliverBody(cardInstanceId, target, robotCode) {
+	const base = {
+		outTrackId: cardInstanceId,
+		userIdType: 1
+	};
+	if (target.type === "group") return {
+		...base,
+		openSpaceId: `dtv1.card//IM_GROUP.${target.targetId}`,
+		imGroupOpenDeliverModel: { robotCode }
+	};
+	return {
+		...base,
+		openSpaceId: `dtv1.card//IM_ROBOT.${target.targetId}`,
+		imRobotOpenDeliverModel: {
+			spaceType: "IM_ROBOT",
+			robotCode,
+			extension: { dynamicSummary: "true" }
+		}
+	};
+}
+/** Create a card instance and deliver it to the target. */
+async function createDingtalkCard(cfg, target) {
+	try {
+		const token = await getAccessToken(cfg);
+		const cardInstanceId = `card_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+		const createBody = {
+			cardTemplateId: AI_CARD_TEMPLATE_ID,
+			outTrackId: cardInstanceId,
+			cardData: { cardParamMap: { config: JSON.stringify({ autoLayout: true }) } },
+			callbackType: "STREAM",
+			imGroupOpenSpaceModel: { supportForward: true },
+			imRobotOpenSpaceModel: { supportForward: true }
+		};
+		await cardFetch(`${DINGTALK_API}/v1.0/card/instances`, {
+			method: "POST",
+			headers: {
+				"x-acs-dingtalk-access-token": token,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(createBody)
+		});
+		const deliverBody = buildDeliverBody(cardInstanceId, target, String(cfg.clientId ?? ""));
+		await cardFetch(`${DINGTALK_API}/v1.0/card/instances/deliver`, {
+			method: "POST",
+			headers: {
+				"x-acs-dingtalk-access-token": token,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(deliverBody)
+		});
+		return {
+			cardInstanceId,
+			accessToken: token,
+			tokenExpireTime: Date.now() + TOKEN_EXPIRE_MS,
+			inputingStarted: false
+		};
+	} catch (err) {
+		console.error(`[im:dingtalk] AI Card create failed:`, err?.message ?? err);
+		return null;
+	}
+}
+async function ensureValidToken(card, cfg) {
+	if (Date.now() > card.tokenExpireTime - 3e5) {
+		card.accessToken = await getAccessToken(cfg);
+		card.tokenExpireTime = Date.now() + TOKEN_EXPIRE_MS;
+	}
+	return card.accessToken;
+}
+async function putWithRetry(url, body, token) {
+	await cardRateLimiter.waitForToken();
+	try {
+		await cardFetch(url, {
+			method: "PUT",
+			headers: {
+				"x-acs-dingtalk-access-token": token,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(body)
+		});
+	} catch (err) {
+		if (isQpsLimitError(err)) {
+			cardRateLimiter.triggerBackoff();
+			await cardRateLimiter.waitForToken();
+			await cardFetch(url, {
+				method: "PUT",
+				headers: {
+					"x-acs-dingtalk-access-token": token,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify(body)
+			});
+		} else throw err;
+	}
+}
+/** Incrementally update the card content (finished=true finalizes the text). */
+async function streamDingtalkCard(card, content, finished = false, cfg) {
+	if (!card) return;
+	if (cfg) await ensureValidToken(card, cfg);
+	if (!card.inputingStarted) {
+		await cardRateLimiter.waitForToken();
+		const statusBody = {
+			outTrackId: card.cardInstanceId,
+			cardData: { cardParamMap: {
+				flowStatus: AICardStatus.INPUTING,
+				msgContent: content,
+				staticMsgContent: "",
+				sys_full_json_obj: JSON.stringify({ order: ["msgContent"] }),
+				config: JSON.stringify({ autoLayout: true })
+			} }
+		};
+		try {
+			await cardFetch(`${DINGTALK_API}/v1.0/card/instances`, {
+				method: "PUT",
+				headers: {
+					"x-acs-dingtalk-access-token": card.accessToken,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify(statusBody)
+			});
+		} catch (err) {
+			if (isQpsLimitError(err)) {
+				cardRateLimiter.triggerBackoff();
+				await cardRateLimiter.waitForToken();
+				await cardFetch(`${DINGTALK_API}/v1.0/card/instances`, {
+					method: "PUT",
+					headers: {
+						"x-acs-dingtalk-access-token": card.accessToken,
+						"Content-Type": "application/json"
+					},
+					body: JSON.stringify(statusBody)
+				});
+			} else throw err;
+		}
+		card.inputingStarted = true;
+	}
+	const fixedContent = content;
+	const streamContent = finished ? fixedContent : fixedContent.replace(/\n+$/, "");
+	const body = {
+		outTrackId: card.cardInstanceId,
+		guid: `${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+		key: "msgContent",
+		content: streamContent,
+		isFull: true,
+		isFinalize: finished,
+		isError: false
+	};
+	await putWithRetry(`${DINGTALK_API}/v1.0/card/streaming`, body, card.accessToken);
+}
+/** Finalize the card (FINISHED status — removes the loading animation). */
+async function finishDingtalkCard(card, content, cfg, skipStreamFinalize = false) {
+	if (!card) return;
+	if (cfg) await ensureValidToken(card, cfg);
+	const fixedContent = content;
+	if (!skipStreamFinalize) await streamDingtalkCard(card, fixedContent, true, cfg);
+	const body = {
+		outTrackId: card.cardInstanceId,
+		cardData: { cardParamMap: {
+			flowStatus: AICardStatus.FINISHED,
+			msgContent: fixedContent,
+			staticMsgContent: "",
+			sys_full_json_obj: JSON.stringify({ order: ["msgContent"] }),
+			config: JSON.stringify({ autoLayout: true })
+		} },
+		cardUpdateOptions: { updateCardDataByKey: true }
+	};
+	await putWithRetry(`${DINGTALK_API}/v1.0/card/instances`, body, card.accessToken);
+}
+//#endregion
+//#region src/channels/dingtalk.ts
+function parseJsonish(raw) {
+	if (raw == null) return null;
+	if (typeof raw === "object") return raw;
+	if (typeof raw === "string") try {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object") return parsed;
+	} catch {}
+	return null;
+}
+/** DingTalk stream messages carry the payload in `content` (a JSON STRING). */
+function resolveDingtalkContent(data) {
+	return parseJsonish(data?.content);
+}
+/**
+* Remove a leading `@name ` mention that DingTalk injects onto group messages.
+* Matches either "@Name " (no whitespace inside the handle) or the bracket form
+* "@[Name] " some clients emit. Returns the text unchanged if no mention lead.
+*/
+function stripLeadingMention(text) {
+	return text.replace(/^@\[?([^\]\s]+)\]?\s*/, "");
+}
+function extractQuotedText(container) {
+	const content = parseJsonish(container?.repliedMsg?.content);
+	switch (container?.repliedMsg?.msgType) {
+		case "text": return content?.text ?? "";
+		case "picture": return "[图片]";
+		case "audio": return content?.recognition ?? "[语音消息]";
+		case "file": return `[文件: ${content?.fileName ?? "?"}]`;
+		case "richText": return (content?.richText ?? []).map((i) => i?.text ?? "").join("");
+		default: return "";
+	}
+}
+function extractQuotedMedia(container) {
+	const content = parseJsonish(container?.repliedMsg?.content);
+	if (container?.repliedMsg?.msgType === "picture") return content?.downloadCode ? [content.downloadCode] : [];
+	if (container?.repliedMsg?.msgType === "richText") return (content?.richText ?? []).map((i) => i?.downloadCode ?? "").filter(Boolean);
+	return [];
+}
+var DingtalkAdapter = class {
+	ctx;
+	config;
+	id;
+	label;
+	conn = null;
+	active = false;
+	token = null;
+	/**
+	* peer → reply context. The userId (senderStaffId) drives group replies: we
+	* @ the last user who talked to the bot in that conversation. encryptedId
+	* (senderId) is the encrypted form some @ channels need. The webhook is the
+	* group/single reply channel that actually honors `at`.
+	*/
+	peerInfo = /* @__PURE__ */ new Map();
+	/** Runtime-status sink, assigned by the gateway on registration (ChannelStatus broadcast). */
+	statusListener;
+	/** Active AI card per conversation — one streaming card at a time per peer. */
+	cards = /* @__PURE__ */ new Map();
+	constructor(ctx, config, id, label) {
+		this.ctx = ctx;
+		this.config = config;
+		this.id = id;
+		this.label = label;
+	}
+	isActive() {
+		return this.active;
+	}
+	async start() {
+		if (!this.config.clientId || !this.config.clientSecret) {
+			this.ctx.logger.warn(`[im-channel-dingtalk:${this.id}] clientId/clientSecret missing; not connecting`);
+			this.statusListener?.({
+				status: "offline",
+				lastChange: Date.now()
+			});
+			return;
+		}
+		this.conn = new DingtalkConnection({
+			clientId: this.config.clientId,
+			clientSecret: this.config.clientSecret,
+			onMessage: (rawData, headers) => void this.handleRaw(rawData, headers),
+			onStatusChange: (connected) => {
+				this.active = connected;
+				this.statusListener?.({
+					status: connected ? "online" : "offline",
+					lastChange: Date.now()
+				});
+				this.ctx.logger.info(`[im-channel-dingtalk] ${connected ? "connected" : "disconnected"}`);
+			}
+		});
+		try {
+			await this.conn.connect();
+			this.active = true;
+		} catch (err) {
+			this.active = false;
+			this.statusListener?.({
+				status: "error",
+				error: String(err),
+				lastChange: Date.now()
+			});
+			this.ctx.logger.error("[im-channel-dingtalk] connect failed", err);
+			throw err;
+		}
+	}
+	async stop() {
+		await this.conn?.stop();
+		this.conn = null;
+		this.active = false;
+	}
+	async handleRaw(rawData, _headers) {
+		let data;
+		try {
+			data = JSON.parse(rawData);
+		} catch {
+			return;
+		}
+		const msgtype = data.msgtype;
+		if (!(msgtype === "text" || msgtype === "picture" || msgtype === "richText" || msgtype === "audio" || msgtype === "file")) return;
+		if (data.conversationType !== "1" && data.conversationType !== "2") return;
+		const isGroup = data.conversationType === "2";
+		const peer = isGroup ? data.conversationId ?? "" : data.senderStaffId ?? data.senderId ?? "";
+		const userId = data.senderStaffId ?? data.senderId ?? "";
+		if (!peer) return;
+		if (isGroup && !data.isInAtList) return;
+		this.peerInfo.set(peer, {
+			isGroup,
+			userId,
+			encryptedId: data.senderId,
+			webhook: data.sessionWebhook,
+			senderNick: data.senderNick
+		});
+		const content = resolveDingtalkContent(data);
+		const downloadCodes = [];
+		let text = "";
+		if (msgtype === "text") {
+			text = data.text?.content ?? "";
+			const quoted = extractQuotedText(data.text);
+			if (quoted) text = `[引用] ${quoted}\n\n${text}`;
+			downloadCodes.push(...extractQuotedMedia(data.text));
+		} else if (msgtype === "picture") {
+			text = "[图片]";
+			const code = content?.downloadCode ?? data.picture?.downloadCode ?? "";
+			if (code) downloadCodes.push(code);
+		} else if (msgtype === "richText") {
+			const richList = content?.richText ?? data?.richText?.richTextList ?? [];
+			const parts = [];
+			for (const item of richList) {
+				if (typeof item?.text === "string") parts.push(item.text);
+				if (item?.downloadCode) downloadCodes.push(item.downloadCode);
+			}
+			const quoted = extractQuotedText(content);
+			if (quoted) parts.unshift(`[引用] ${quoted}`);
+			downloadCodes.push(...extractQuotedMedia(content));
+			text = parts.join("\n");
+			if (!text) text = downloadCodes.length ? "[图片]" : "[富文本消息]";
+		} else if (msgtype === "audio") text = content?.recognition || "[语音消息]";
+		else if (msgtype === "file") {
+			const fileName = content?.fileName || "文件";
+			text = content?.downloadCode ?? "" ? `[文件: ${fileName}]` : `[文件: ${fileName}]`;
+		}
+		if (!text && downloadCodes.length === 0) return;
+		text = stripLeadingMention(text);
+		const message = {
+			channelId: this.id,
+			conversationId: peer,
+			userId,
+			text,
+			senderNick: data.senderNick,
+			isGroup
+		};
+		this.ctx.imGateway.handleInbound(message).catch((err) => this.ctx.logger.error("[im-channel-dingtalk] handleInbound failed", err));
+	}
+	async sendText(conversationId, text) {
+		const info = this.peerInfo.get(conversationId) ?? {
+			isGroup: true,
+			userId: ""
+		};
+		if (!info.webhook) {
+			this.ctx.logger.warn(`[im-channel-dingtalk] no sessionWebhook for peer ${conversationId}; cannot reply (single-chat fallback not implemented in PoC)`);
+			return;
+		}
+		const body = {
+			msgtype: "markdown",
+			markdown: {
+				title: this.label || "AI 助手",
+				text: info.senderNick ? `@${info.senderNick} ${text}` : text
+			}
+		};
+		if (info.isGroup) {
+			body.at = {};
+			if (info.userId) body.at.atUserIds = [info.userId];
+			if (info.encryptedId) body.at.atDingtalkIds = [info.encryptedId];
+		}
+		try {
+			const res = await fetch(info.webhook, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(body)
+			});
+			if (!res.ok) this.ctx.logger.warn(`[im-channel-dingtalk] webhook reply failed: HTTP ${res.status}`);
+		} catch (err) {
+			this.ctx.logger.error("[im-channel-dingtalk] webhook reply error", err);
+		}
+	}
+	async sendImage(conversationId, image) {
+		const info = this.peerInfo.get(conversationId);
+		if (!info?.webhook) {
+			this.ctx.logger.warn(`[im-channel-dingtalk] no sessionWebhook for peer ${conversationId}; skipping image`);
+			return;
+		}
+		try {
+			const token = await this.getToken();
+			const buf = Buffer.from(image.data, "base64");
+			const form = new FormData();
+			form.append("media", new Blob([buf], { type: image.mediaType }), "image");
+			const upJson = await (await fetch(`https://oapi.dingtalk.com/media/upload?access_token=${token}&type=image`, {
+				method: "POST",
+				body: form
+			})).json();
+			if (upJson.errcode) {
+				this.ctx.logger.warn(`[im-channel-dingtalk] media upload failed: ${upJson.errcode} ${upJson.errmsg}`);
+				return;
+			}
+			await fetch(info.webhook, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					msgtype: "image",
+					image: { media_id: upJson.media_id }
+				})
+			});
+		} catch (err) {
+			this.ctx.logger.error("[im-channel-dingtalk] sendImage error", err);
+		}
+	}
+	cardTarget(conversationId) {
+		return this.peerInfo.get(conversationId)?.isGroup ?? true ? {
+			type: "group",
+			targetId: conversationId
+		} : {
+			type: "user",
+			targetId: conversationId
+		};
+	}
+	async beginStream(conversationId) {
+		if (this.cards.has(conversationId)) this.cards.delete(conversationId);
+		const card = await createDingtalkCard(this.config, this.cardTarget(conversationId));
+		this.cards.set(conversationId, card ?? null);
+		if (!card) {
+			this.ctx.logger.warn(`[im-channel-dingtalk:${this.id}] beginStream: card create FAILED for ${conversationId}; falling back to text`);
+			await this.sendText(conversationId, "⏳ 正在思考…").catch(() => {});
+		} else this.ctx.logger.info(`[im-channel-dingtalk:${this.id}] beginStream: card ${card.cardInstanceId} created for ${conversationId}`);
+	}
+	async streamText(conversationId, text, finished = false) {
+		const card = this.cards.get(conversationId);
+		if (!card) return;
+		try {
+			await streamDingtalkCard(card, text, finished, this.config);
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-dingtalk:${this.id}] streamText failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.cards.delete(conversationId);
+		}
+	}
+	async endStream(conversationId, text) {
+		const card = this.cards.get(conversationId);
+		this.cards.delete(conversationId);
+		if (!card) {
+			this.ctx.logger.warn(`[im-channel-dingtalk:${this.id}] endStream: no card for ${conversationId}; plain-text fallback`);
+			await this.sendText(conversationId, text);
+			return;
+		}
+		const info = this.peerInfo.get(conversationId);
+		const final = (info?.isGroup ?? true) && info?.senderNick ? `@${info.senderNick} ${text}` : text;
+		try {
+			const long = final.length > CARD_STREAM_FRAME_LIMIT;
+			await finishDingtalkCard(card, final, this.config, long);
+			this.ctx.logger.info(`[im-channel-dingtalk:${this.id}] endStream: card ${card.cardInstanceId} FINISHED for ${conversationId} (${final.length} chars)`);
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-dingtalk:${this.id}] endStream finalize failed: ${err instanceof Error ? err.message : String(err)}; fallback to text`);
+			await this.sendText(conversationId, text).catch(() => {});
+		}
+	}
+	async getToken() {
+		if (this.token && this.token.expiresAt > Date.now() + 6e4) return this.token.value;
+		const url = `https://oapi.dingtalk.com/gettoken?appkey=${encodeURIComponent(this.config.clientId)}&appsecret=${encodeURIComponent(this.config.clientSecret)}`;
+		const json = await (await fetch(url)).json();
+		if (json.errcode) throw new Error(`dingtalk gettoken: ${json.errcode} ${json.errmsg}`);
+		this.token = {
+			value: json.access_token,
+			expiresAt: Date.now() + (json.expires_in ?? 7200) * 1e3
+		};
+		return this.token.value;
+	}
+};
+/** DingTalk card streaming API caps a single content frame at ~1K. */
+const CARD_STREAM_FRAME_LIMIT = 1e3;
+//#endregion
+//#region src/channels/qq.ts
+const BASE_BACKOFF_DELAY$1 = 2e3;
+const MAX_BACKOFF_DELAY$1 = 3e4;
+/** True when a path points at a local file (drive letter, /, ~, file://). */
+function isLocalPath$1(raw) {
+	return raw.startsWith("file://") || /^[A-Za-z]:[\\/]/.test(raw) || raw.startsWith("/") || raw.startsWith("~");
+}
+/** True when the path exists AND is a regular file (directories are skipped
+*  so a `pwd`-style output never gets uploaded as media). */
+function isRegularFile(p) {
+	try {
+		return statSync(p).isFile();
+	} catch {
+		return false;
+	}
+}
+/** Strip file:// / URL-encoding to get the on-disk absolute path. */
+function toLocalPath$1(raw) {
+	let p = raw.startsWith("file://") ? raw.slice(7) : raw;
+	try {
+		p = decodeURIComponent(p);
+	} catch {}
+	return p;
+}
+/** Guess a MIME type from a download URL (QQ attachments expose content_type). */
+function mimeFromContentType(ct) {
+	if (!ct) return "image/jpeg";
+	const base = ct.split(";")[0].trim().toLowerCase();
+	if (base.startsWith("image/")) return base;
+	return "image/jpeg";
+}
+var QQAdapter = class {
+	ctx;
+	id;
+	label;
+	appId;
+	appSecret;
+	bot = null;
+	stopped = true;
+	active = false;
+	reconnectAttempts = 0;
+	reconnectTimer = null;
+	/** Per-peer (target string) last inbound msgId — anchors stream replies. */
+	lastMsgIds = /* @__PURE__ */ new Map();
+	/** Active StreamSession per peer (C2C only). */
+	streamSessions = /* @__PURE__ */ new Map();
+	/** Runtime-status sink, assigned by the gateway on registration. */
+	statusListener;
+	constructor(ctx, config, id, label) {
+		this.ctx = ctx;
+		this.id = id;
+		this.label = label;
+		this.appId = config.appId ?? "";
+		this.appSecret = config.clientSecret ?? "";
+	}
+	isActive() {
+		return this.active;
+	}
+	setStatus(s, error) {
+		this.statusListener?.({
+			status: s,
+			error,
+			lastChange: Date.now()
+		});
+	}
+	async start() {
+		if (!this.appId || !this.appSecret) {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] credentials missing — bind via QR scan first`);
+			this.setStatus("error", "credentials missing — bind via QR scan first");
+			return;
+		}
+		this.stopped = false;
+		this.setStatus("offline");
+		const { QQBot } = await import("@tencent-connect/qqbot-nodejs");
+		const bot = new QQBot({
+			appId: this.appId,
+			appSecret: this.appSecret,
+			accountId: this.id,
+			markdownSupport: true,
+			tokenPrefetch: "async"
+		});
+		this.bot = bot;
+		bot.on("ready", () => {
+			this.reconnectAttempts = 0;
+			this.active = true;
+			this.setStatus("online");
+		});
+		bot.on("resumed", () => {
+			this.active = true;
+			this.setStatus("online");
+		});
+		bot.on("error", (err) => {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] gateway error: ${err.message}`);
+			if (!this.stopped && this.active) {
+				this.setStatus("offline");
+				this.scheduleReconnect();
+			}
+		});
+		bot.on("message", (_ctx, msg) => {
+			try {
+				this.handleMessage(msg);
+			} catch (err) {
+				this.ctx.logger.warn(`[im-channel-qq:${this.id}] handleMessage failed: ${String(err)}`);
+			}
+		});
+		bot.on("interaction", (_ctx, event) => {
+			const btnId = event.data?.resolved?.button_data ?? event.data?.resolved?.button_id;
+			if (!btnId) return;
+			bot.acknowledgeInteraction(event.id).catch(() => void 0);
+			const userId = event.data?.resolved?.user_id;
+			if (userId) {
+				const msg = {
+					channelId: this.id,
+					conversationId: `c2c:${userId}`,
+					userId,
+					text: `[按钮点击] ${btnId}`
+				};
+				this.ctx.imGateway.handleInbound(msg).catch(() => void 0);
+			}
+		});
+		let startResolved = false;
+		await Promise.race([bot.start().then(() => {
+			startResolved = true;
+		}).catch((err) => {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] bot.start rejected: ${String(err?.message)}`);
+			this.setStatus("error", `bot.start rejected: ${String(err?.message)}`);
+		}), new Promise((resolve) => setTimeout(() => {
+			if (!startResolved) this.ctx.logger.warn(`[im-channel-qq:${this.id}] bot.start did not resolve within 5s — continuing in background`);
+			resolve();
+		}, 5e3))]);
+	}
+	async stop() {
+		this.stopped = true;
+		if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+		this.reconnectTimer = null;
+		const bot = this.bot;
+		this.bot = null;
+		if (bot) try {
+			bot.stop();
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] stop failed: ${String(err)}`);
+		}
+		this.active = false;
+		this.setStatus("offline");
+	}
+	scheduleReconnect() {
+		if (this.stopped || this.reconnectTimer) return;
+		const attempt = this.reconnectAttempts;
+		this.reconnectAttempts += 1;
+		const backoff = Math.min(MAX_BACKOFF_DELAY$1, BASE_BACKOFF_DELAY$1 * 2 ** Math.min(attempt, 5));
+		this.reconnectTimer = setTimeout(() => {
+			this.reconnectTimer = null;
+			if (this.stopped) return;
+			this.setStatus("offline");
+			this.start().catch((err) => {
+				this.ctx.logger.warn(`[im-channel-qq:${this.id}] reconnect failed (${attempt}): ${String(err?.message)}`);
+				this.scheduleReconnect();
+			});
+		}, backoff);
+	}
+	async handleMessage(msg) {
+		const kind = msg.kind;
+		if (kind !== "c2c" && kind !== "group") return;
+		if (msg.senderIsBot) return;
+		let text = (msg.content ?? "").trim();
+		if (msg.refMsgIdx && Array.isArray(msg.msgElements) && msg.msgElements.length > 0) {
+			const quoted = msg.msgElements[0].content?.trim();
+			if (quoted) text = `[用户正在回复以下消息: ${quoted}]\n${text}`;
+		}
+		const voiceText = (msg.attachments ?? []).map((a) => a.asr_refer_text).find((t) => Boolean(t));
+		if (voiceText) text = text ? `${text}\n[语音转文字: ${voiceText}]` : `[语音转文字: ${voiceText}]`;
+		const images = [];
+		for (const att of msg.attachments ?? []) {
+			if (!att.url) continue;
+			if (!att.content_type?.startsWith("image/")) continue;
+			try {
+				const res = await fetch(att.url);
+				if (!res.ok) continue;
+				const buf = Buffer.from(await res.arrayBuffer());
+				images.push({
+					mediaType: mimeFromContentType(att.content_type),
+					data: buf.toString("base64")
+				});
+			} catch (err) {
+				this.ctx.logger.warn(`[im-channel-qq:${this.id}] image download failed: ${String(err)}`);
+			}
+		}
+		if (!text && images.length === 0) return;
+		const base = {
+			channelId: this.id,
+			text,
+			images: images.length ? images : void 0
+		};
+		if (kind === "c2c") {
+			this.lastMsgIds.set(`c2c:${msg.senderId}`, msg.messageId);
+			const message = {
+				...base,
+				conversationId: `c2c:${msg.senderId}`,
+				userId: msg.senderId,
+				senderNick: msg.senderName,
+				isGroup: false
+			};
+			this.ctx.imGateway.handleInbound(message).catch((err) => this.ctx.logger.error(`[im-channel-qq:${this.id}] handleInbound failed`, err));
+			return;
+		}
+		const groupOpenid = msg.groupOpenid ?? msg.channelId ?? "";
+		if (!groupOpenid) return;
+		if (!(msg.mentions ?? []).some((m) => m?.is_you === true)) return;
+		const message = {
+			...base,
+			conversationId: `group:${groupOpenid}`,
+			userId: msg.senderId,
+			senderNick: msg.senderName,
+			isGroup: true
+		};
+		this.ctx.imGateway.handleInbound(message).catch((err) => this.ctx.logger.error(`[im-channel-qq:${this.id}] handleInbound failed`, err));
+	}
+	parseTarget(target) {
+		const sep = target.indexOf(":");
+		const scope = target.slice(0, sep);
+		const targetId = target.slice(sep + 1);
+		if (scope !== "c2c" && scope !== "group" || !targetId) return null;
+		return {
+			scope,
+			targetId
+		};
+	}
+	async sendText(conversationId, text) {
+		const bot = this.bot;
+		if (!bot) throw new Error("QQ bot not connected");
+		const rt = this.parseTarget(conversationId);
+		if (!rt) {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] invalid send target: ${conversationId}`);
+			return;
+		}
+		const enriched = await this.sendMediaForText(rt, text);
+		await bot.sendText(rt, enriched);
+	}
+	async sendImage(conversationId, image) {
+		const bot = this.bot;
+		const rt = this.parseTarget(conversationId);
+		if (!bot || !rt) return;
+		try {
+			await bot.sendImage(rt, {
+				base64: image.data,
+				type: "image/jpeg"
+			});
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] sendImage failed: ${String(err)}`);
+		}
+	}
+	/**
+	* Detect local image/file paths in a reply, upload each and send it as a
+	* standalone media message (sendImage / sendMedia). Returns the text with
+	* the references replaced by short notes.
+	*/
+	async sendMediaForText(rt, text) {
+		if (!this.bot) return text;
+		let result = text;
+		for (const m of text.matchAll(/!\[([^\]]*)\]\(([^)]+)\)/g)) {
+			const [full, alt, p] = m;
+			if (!isLocalPath$1(p)) continue;
+			const filePath = toLocalPath$1(p);
+			if (!isRegularFile(filePath)) continue;
+			await this.sendLocalMedia(rt, filePath);
+			result = result.replace(full, alt ? `[${alt}]` : "[图片]");
+		}
+		for (const m of result.matchAll(/(?:file:\/\/)?[A-Za-z]:[\\/][^\s"'()<>]+|(?:\/(?:Users|home|tmp|var|private|root)\/[^\s"'()<>]+)/g)) {
+			const filePath = toLocalPath$1(m[0]);
+			if (!isRegularFile(filePath)) continue;
+			if (await this.sendLocalMedia(rt, filePath)) {
+				const isImg = /\.(png|jpe?g|gif|bmp|webp)$/i.test(filePath);
+				result = result.replace(m[0], isImg ? "[图片]" : `[文件已发送：${basename(filePath)}]`);
+			}
+		}
+		return result;
+	}
+	/** Upload one local file and send it as an IMAGE / FILE media message. */
+	async sendLocalMedia(rt, filePath) {
+		const bot = this.bot;
+		if (!bot) return false;
+		try {
+			if (/\.(png|jpe?g|gif|bmp|webp)$/i.test(filePath)) await bot.sendImage(rt, { localPath: filePath });
+			else {
+				const { MediaFileType: MFT } = await import("@tencent-connect/qqbot-nodejs");
+				await bot.sendMedia({
+					target: rt,
+					fileType: MFT.FILE,
+					localPath: filePath,
+					fileName: basename(filePath)
+				});
+			}
+			return true;
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] media send failed (${filePath}): ${String(err)}`);
+			return false;
+		}
+	}
+	async beginStream(conversationId) {
+		const rt = this.parseTarget(conversationId);
+		const bot = this.bot;
+		if (!rt || !bot) return;
+		if (rt.scope !== "c2c") {
+			this.streamSessions.set(conversationId, {
+				session: null,
+				enabled: false
+			});
+			return;
+		}
+		const msgId = this.lastMsgIds.get(conversationId);
+		if (!msgId) {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] beginStream: no inbound msgId for ${conversationId}`);
+			this.streamSessions.set(conversationId, {
+				session: null,
+				enabled: false
+			});
+			return;
+		}
+		try {
+			const { StreamSession: StreamSessionCtor } = await import("@tencent-connect/qqbot-nodejs");
+			const session = new StreamSessionCtor(bot.messageApi, {
+				openid: rt.targetId,
+				msgId,
+				creds: {
+					appId: this.appId,
+					clientSecret: this.appSecret
+				}
+			});
+			this.streamSessions.set(conversationId, {
+				session,
+				enabled: true
+			});
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] beginStream failed: ${String(err)}`);
+			this.streamSessions.set(conversationId, {
+				session: null,
+				enabled: false
+			});
+		}
+	}
+	async streamText(conversationId, text, _finished = false) {
+		const s = this.streamSessions.get(conversationId);
+		if (!s?.enabled || !s.session) return;
+		try {
+			await s.session.update(text);
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-qq:${this.id}] streamText failed — disabling stream: ${String(err)}`);
+			s.enabled = false;
+		}
+	}
+	async endStream(conversationId, text) {
+		const s = this.streamSessions.get(conversationId);
+		this.streamSessions.delete(conversationId);
+		if (!s) {
+			await this.sendText(conversationId, text);
+			return;
+		}
+		if (s.session) {
+			if (s.enabled) try {
+				await s.session.update(text);
+				await s.session.complete();
+				return;
+			} catch (err) {
+				this.ctx.logger.warn(`[im-channel-qq:${this.id}] endStream failed, falling back to sendText: ${String(err)}`);
+				try {
+					s.session.cancel();
+				} catch {}
+			}
+			else try {
+				s.session.cancel();
+			} catch (err) {
+				this.ctx.logger.warn(`[im-channel-qq:${this.id}] endStream cancel failed: ${String(err)}`);
+			}
+		}
+		await this.sendText(conversationId, text);
+	}
+};
+//#endregion
+//#region src/channels/weixin-api.ts
+/**
+* Weixin iLink CGI API — all calls are plain `fetch`, zero HTTP deps.
+* Ported from pi-desk-top/src/main/im/weixin/weixin-api.ts (itself ported
+* from the official tencent-weixin connector):
+*  - iLink-App-Id is the fixed upstream value "bot"
+*  - bot_agent is a fixed self-identity string
+*  - logging goes through console (no redaction framework needed)
+*/
+/** iLink-App-Id — fixed upstream value used by the official connector. */
+const ILINK_APP_ID = "bot";
+/** iLink-App-ClientVersion: uint32 encoded as 0x00MMNNPP. */
+const ILINK_APP_CLIENT_VERSION = 131075;
+/** Self-identity reported in base_info.bot_agent. */
+const BOT_AGENT = "dsh-desktop";
+/** Default timeout for long-poll getUpdates requests. */
+const DEFAULT_LONG_POLL_TIMEOUT_MS = 35e3;
+/** Default timeout for regular API requests. */
+const DEFAULT_API_TIMEOUT_MS = 15e3;
+/** Default timeout for lightweight API requests. */
+const DEFAULT_CONFIG_TIMEOUT_MS = 1e4;
+function ensureTrailingSlash(url) {
+	return url.endsWith("/") ? url : `${url}/`;
+}
+/** X-WECHAT-UIN header: random uint32 -> decimal string -> base64. */
+function randomWechatUin() {
+	const bytes = crypto.randomBytes(4).readUInt32BE(0);
+	return Buffer.from(String(bytes), "utf-8").toString("base64");
+}
+/** Build the `base_info` payload included in every API request. */
+function buildBaseInfo() {
+	return {
+		channel_version: "2.4.3",
+		bot_agent: BOT_AGENT
+	};
+}
+function buildHeaders(opts) {
+	const headers = {
+		"Content-Type": "application/json",
+		AuthorizationType: "ilink_bot_token",
+		"X-WECHAT-UIN": randomWechatUin(),
+		"iLink-App-Id": ILINK_APP_ID,
+		"iLink-App-ClientVersion": String(ILINK_APP_CLIENT_VERSION)
+	};
+	if (opts.token?.trim()) headers.Authorization = `Bearer ${opts.token.trim()}`;
+	return headers;
+}
+function buildCommonHeaders() {
+	return {
+		"iLink-App-Id": ILINK_APP_ID,
+		"iLink-App-ClientVersion": String(ILINK_APP_CLIENT_VERSION)
+	};
+}
+/** GET fetch wrapper. Returns raw response text; throws on HTTP error/timeout. */
+async function apiGetFetch(params) {
+	const base = ensureTrailingSlash(params.baseUrl);
+	const url = new URL(params.endpoint, base);
+	const controller = params.timeoutMs != null && params.timeoutMs > 0 ? new AbortController() : void 0;
+	const t = controller != null ? setTimeout(() => controller.abort(), params.timeoutMs) : void 0;
+	try {
+		const res = await fetch(url.toString(), {
+			method: "GET",
+			headers: buildCommonHeaders(),
+			...controller ? { signal: controller.signal } : {}
+		});
+		if (t !== void 0) clearTimeout(t);
+		const rawText = await res.text();
+		if (!res.ok) throw new Error(`${params.label} ${res.status}: ${rawText.slice(0, 300)}`);
+		return rawText;
+	} catch (err) {
+		if (t !== void 0) clearTimeout(t);
+		throw err;
+	}
+}
+/** POST JSON fetch wrapper. Returns raw response text; throws on error/timeout. */
+async function apiPostFetch(params) {
+	const base = ensureTrailingSlash(params.baseUrl);
+	const url = new URL(params.endpoint, base);
+	const controller = params.timeoutMs !== void 0 ? new AbortController() : void 0;
+	const t = controller != null ? setTimeout(() => controller.abort(), params.timeoutMs) : void 0;
+	try {
+		const res = await fetch(url.toString(), {
+			method: "POST",
+			headers: buildHeaders({ token: params.token }),
+			body: params.body,
+			...controller ? { signal: controller.signal } : {}
+		});
+		if (t !== void 0) clearTimeout(t);
+		const rawText = await res.text();
+		if (!res.ok) throw new Error(`${params.label} ${res.status}: ${rawText.slice(0, 300)}`);
+		return rawText;
+	} catch (err) {
+		if (t !== void 0) clearTimeout(t);
+		throw err;
+	}
+}
+/**
+* Long-poll getUpdates. Server holds the request until new messages or
+* timeout. Client-side timeout returns an empty response so the caller can
+* simply retry — this is normal for long-poll.
+*/
+async function getUpdates(params) {
+	const timeout = params.timeoutMs ?? DEFAULT_LONG_POLL_TIMEOUT_MS;
+	try {
+		const rawText = await apiPostFetch({
+			baseUrl: params.baseUrl,
+			endpoint: "ilink/bot/getupdates",
+			body: JSON.stringify({
+				get_updates_buf: params.get_updates_buf ?? "",
+				base_info: buildBaseInfo()
+			}),
+			token: params.token,
+			timeoutMs: timeout,
+			label: "getUpdates"
+		});
+		return JSON.parse(rawText);
+	} catch (err) {
+		if (err instanceof Error && err.name === "AbortError") return {
+			ret: 0,
+			msgs: [],
+			get_updates_buf: params.get_updates_buf
+		};
+		throw err;
+	}
+}
+/** Send a single message downstream. */
+async function sendMessage(params) {
+	await apiPostFetch({
+		baseUrl: params.baseUrl,
+		endpoint: "ilink/bot/sendmessage",
+		body: JSON.stringify({
+			...params.body,
+			base_info: buildBaseInfo()
+		}),
+		token: params.token,
+		timeoutMs: params.timeoutMs ?? DEFAULT_API_TIMEOUT_MS,
+		label: "sendMessage"
+	});
+}
+/** Fetch bot config (includes typing_ticket) for a given user. */
+async function getConfig(params) {
+	const rawText = await apiPostFetch({
+		baseUrl: params.baseUrl,
+		endpoint: "ilink/bot/getconfig",
+		body: JSON.stringify({
+			ilink_user_id: params.ilinkUserId,
+			context_token: params.contextToken,
+			base_info: buildBaseInfo()
+		}),
+		token: params.token,
+		timeoutMs: params.timeoutMs ?? DEFAULT_CONFIG_TIMEOUT_MS,
+		label: "getConfig"
+	});
+	return JSON.parse(rawText);
+}
+/** Send a typing indicator to a user. */
+async function sendTyping(params) {
+	await apiPostFetch({
+		baseUrl: params.baseUrl,
+		endpoint: "ilink/bot/sendtyping",
+		body: JSON.stringify({
+			...params.body,
+			base_info: buildBaseInfo()
+		}),
+		token: params.token,
+		timeoutMs: params.timeoutMs ?? DEFAULT_CONFIG_TIMEOUT_MS,
+		label: "sendTyping"
+	});
+}
+/** Notify Weixin that the channel client is stopping. */
+async function notifyStop(params) {
+	const rawText = await apiPostFetch({
+		baseUrl: params.baseUrl,
+		endpoint: "ilink/bot/msg/notifystop",
+		body: JSON.stringify({ base_info: buildBaseInfo() }),
+		token: params.token,
+		timeoutMs: params.timeoutMs ?? DEFAULT_CONFIG_TIMEOUT_MS,
+		label: "notifyStop"
+	});
+	return JSON.parse(rawText);
+}
+/** Notify Weixin that the channel client is starting. */
+async function notifyStart(params) {
+	const rawText = await apiPostFetch({
+		baseUrl: params.baseUrl,
+		endpoint: "ilink/bot/msg/notifystart",
+		body: JSON.stringify({ base_info: buildBaseInfo() }),
+		token: params.token,
+		timeoutMs: params.timeoutMs ?? DEFAULT_CONFIG_TIMEOUT_MS,
+		label: "notifyStart"
+	});
+	return JSON.parse(rawText);
+}
+//#endregion
+//#region src/channels/weixin-types.ts
+const MessageItemType = {
+	NONE: 0,
+	TEXT: 1,
+	IMAGE: 2,
+	VOICE: 3,
+	FILE: 4,
+	VIDEO: 5
+};
+const MessageType = {
+	NONE: 0,
+	USER: 1,
+	BOT: 2
+};
+const MessageState = {
+	NEW: 0,
+	GENERATING: 1,
+	FINISH: 2
+};
+const TypingStatus = {
+	TYPING: 1,
+	CANCEL: 2
+};
+//#endregion
+//#region src/channels/markdown-filter.ts
+/**
+* Streaming markdown filter — character-level state machine that strips
+* unsupported markdown syntax on-the-fly. Ported VERBATIM from the official
+* tencent-weixin connector (src/messaging/markdown-filter.ts) — WeChat does
+* not render markdown, so agent replies must pass through this before send.
+*
+* Outputs as much filtered text as possible on each `feed()` call, only
+* holding back the minimum characters needed for pattern disambiguation.
+*
+* Constructs passed through (not filtered):
+* - Code fences (```), inline code (`), tables (|...|), horizontal rules
+* - Bold (**), italic/bold-italic wrapping non-CJK content
+*
+* Constructs filtered (markers stripped, content kept):
+* - Italic/bold-italic wrapping CJK content, headings H5/H6, images (removed)
+*/
+var StreamingMarkdownFilter = class StreamingMarkdownFilter {
+	buf = "";
+	fence = false;
+	sol = true;
+	inl = null;
+	feed(delta) {
+		this.buf += delta;
+		return this.pump(false);
+	}
+	flush() {
+		return this.pump(true);
+	}
+	pump(eof) {
+		let out = "";
+		while (this.buf) {
+			const sLen = this.buf.length;
+			const sSol = this.sol;
+			const sFence = this.fence;
+			const sInl = this.inl;
+			if (this.fence) out += this.pumpFence(eof);
+			else if (this.inl) out += this.pumpInline(eof);
+			else if (this.sol) out += this.pumpSOL(eof);
+			else out += this.pumpBody(eof);
+			if (this.buf.length === sLen && this.sol === sSol && this.fence === sFence && this.inl === sInl) break;
+		}
+		if (eof && this.inl) {
+			out += ({
+				image: "![",
+				bold3: "***",
+				italic: "*",
+				ubold3: "___",
+				uitalic: "_"
+			}[this.inl.type] ?? "") + this.inl.acc;
+			this.inl = null;
+		}
+		return out;
+	}
+	/** Inside a code fence: pass content and markers through verbatim. */
+	pumpFence(eof) {
+		if (this.sol) {
+			if (this.buf.length < 3 && !eof) return "";
+			if (this.buf.startsWith("```")) {
+				const nl = this.buf.indexOf("\n", 3);
+				if (nl !== -1) {
+					this.fence = false;
+					const line = this.buf.slice(0, nl + 1);
+					this.buf = this.buf.slice(nl + 1);
+					this.sol = true;
+					return line;
+				}
+				if (eof) {
+					this.fence = false;
+					const line = this.buf;
+					this.buf = "";
+					return line;
+				}
+				return "";
+			}
+			this.sol = false;
+		}
+		const nl = this.buf.indexOf("\n");
+		if (nl !== -1) {
+			const chunk = this.buf.slice(0, nl + 1);
+			this.buf = this.buf.slice(nl + 1);
+			this.sol = true;
+			return chunk;
+		}
+		const chunk = this.buf;
+		this.buf = "";
+		return chunk;
+	}
+	/** At start of line: detect and consume line-start patterns. */
+	pumpSOL(eof) {
+		const b = this.buf;
+		if (b[0] === "\n") {
+			this.buf = b.slice(1);
+			return "\n";
+		}
+		if (b[0] === "`") {
+			if (b.length < 3 && !eof) return "";
+			if (b.startsWith("```")) {
+				const nl = b.indexOf("\n", 3);
+				if (nl !== -1) {
+					this.fence = true;
+					const line = b.slice(0, nl + 1);
+					this.buf = b.slice(nl + 1);
+					this.sol = true;
+					return line;
+				}
+				if (eof) {
+					this.buf = "";
+					return b;
+				}
+				return "";
+			}
+			this.sol = false;
+			return "";
+		}
+		if (b[0] === ">") {
+			this.sol = false;
+			return "";
+		}
+		if (b[0] === "#") {
+			let n = 0;
+			while (n < b.length && b[n] === "#") n++;
+			if (n === b.length && !eof) return "";
+			if (n >= 5 && n <= 6 && n < b.length && b[n] === " ") {
+				this.buf = b.slice(n + 1);
+				this.sol = false;
+				return "";
+			}
+			this.sol = false;
+			return "";
+		}
+		if (b[0] === " " || b[0] === "	") {
+			if (b.search(/[^ \t]/) === -1 && !eof) return "";
+			this.sol = false;
+			return "";
+		}
+		if (b[0] === "-" || b[0] === "*" || b[0] === "_") {
+			const ch = b[0];
+			let j = 0;
+			while (j < b.length && (b[j] === ch || b[j] === " ")) j++;
+			if (j === b.length && !eof) return "";
+			if (j === b.length || b[j] === "\n") {
+				let count = 0;
+				for (let k = 0; k < j; k++) if (b[k] === ch) count++;
+				if (count >= 3) {
+					if (j < b.length) {
+						this.buf = b.slice(j + 1);
+						this.sol = true;
+						return b.slice(0, j + 1);
+					}
+					this.buf = "";
+					return b;
+				}
+			}
+			this.sol = false;
+			return "";
+		}
+		this.sol = false;
+		return "";
+	}
+	/** Scan line body for inline pattern triggers; output safe chars eagerly. */
+	pumpBody(eof) {
+		let out = "";
+		let i = 0;
+		while (i < this.buf.length) {
+			const c = this.buf[i];
+			if (c === "\n") {
+				out += this.buf.slice(0, i + 1);
+				this.buf = this.buf.slice(i + 1);
+				this.sol = true;
+				return out;
+			}
+			if (c === "!" && i + 1 < this.buf.length && this.buf[i + 1] === "[") {
+				out += this.buf.slice(0, i);
+				this.buf = this.buf.slice(i + 2);
+				this.inl = {
+					type: "image",
+					acc: ""
+				};
+				return out;
+			}
+			if (c === "~") {
+				i++;
+				continue;
+			}
+			if (c === "*") {
+				if (i + 2 < this.buf.length && this.buf[i + 1] === "*" && this.buf[i + 2] === "*") {
+					out += this.buf.slice(0, i);
+					this.buf = this.buf.slice(i + 3);
+					this.inl = {
+						type: "bold3",
+						acc: ""
+					};
+					return out;
+				}
+				if (i + 1 < this.buf.length && this.buf[i + 1] === "*") {
+					i += 2;
+					continue;
+				}
+				if (i + 1 < this.buf.length && this.buf[i + 1] !== " " && this.buf[i + 1] !== "\n") {
+					out += this.buf.slice(0, i);
+					this.buf = this.buf.slice(i + 1);
+					this.inl = {
+						type: "italic",
+						acc: ""
+					};
+					return out;
+				}
+				i++;
+				continue;
+			}
+			if (c === "_") {
+				if (i + 2 < this.buf.length && this.buf[i + 1] === "_" && this.buf[i + 2] === "_") {
+					out += this.buf.slice(0, i);
+					this.buf = this.buf.slice(i + 3);
+					this.inl = {
+						type: "ubold3",
+						acc: ""
+					};
+					return out;
+				}
+				if (i + 1 < this.buf.length && this.buf[i + 1] === "_") {
+					i += 2;
+					continue;
+				}
+				if (i + 1 < this.buf.length && this.buf[i + 1] !== " " && this.buf[i + 1] !== "\n") {
+					out += this.buf.slice(0, i);
+					this.buf = this.buf.slice(i + 1);
+					this.inl = {
+						type: "uitalic",
+						acc: ""
+					};
+					return out;
+				}
+				i++;
+				continue;
+			}
+			i++;
+		}
+		let hold = 0;
+		if (!eof) {
+			if (this.buf.endsWith("**")) hold = 2;
+			else if (this.buf.endsWith("__")) hold = 2;
+			else if (this.buf.endsWith("*")) hold = 1;
+			else if (this.buf.endsWith("_")) hold = 1;
+			else if (this.buf.endsWith("!")) hold = 1;
+		}
+		out += this.buf.slice(0, this.buf.length - hold);
+		this.buf = hold > 0 ? this.buf.slice(-hold) : "";
+		return out;
+	}
+	/** Accumulate inline content until closing marker is found. */
+	pumpInline(_eof) {
+		if (!this.inl) return "";
+		this.inl.acc += this.buf;
+		this.buf = "";
+		switch (this.inl.type) {
+			case "bold3": {
+				const idx = this.inl.acc.indexOf("***");
+				if (idx !== -1) {
+					const content = this.inl.acc.slice(0, idx);
+					this.buf = this.inl.acc.slice(idx + 3);
+					this.inl = null;
+					if (StreamingMarkdownFilter.containsCJK(content)) return content;
+					return `***${content}***`;
+				}
+				return "";
+			}
+			case "ubold3": {
+				const idx = this.inl.acc.indexOf("___");
+				if (idx !== -1) {
+					const content = this.inl.acc.slice(0, idx);
+					this.buf = this.inl.acc.slice(idx + 3);
+					this.inl = null;
+					if (StreamingMarkdownFilter.containsCJK(content)) return content;
+					return `___${content}___`;
+				}
+				return "";
+			}
+			case "italic":
+				for (let j = 0; j < this.inl.acc.length; j++) {
+					if (this.inl.acc[j] === "\n") {
+						const r = "*" + this.inl.acc.slice(0, j + 1);
+						this.buf = this.inl.acc.slice(j + 1);
+						this.inl = null;
+						this.sol = true;
+						return r;
+					}
+					if (this.inl.acc[j] === "*") {
+						if (j + 1 < this.inl.acc.length && this.inl.acc[j + 1] === "*") {
+							j++;
+							continue;
+						}
+						const content = this.inl.acc.slice(0, j);
+						this.buf = this.inl.acc.slice(j + 1);
+						this.inl = null;
+						if (StreamingMarkdownFilter.containsCJK(content)) return content;
+						return `*${content}*`;
+					}
+				}
+				return "";
+			case "uitalic":
+				for (let j = 0; j < this.inl.acc.length; j++) {
+					if (this.inl.acc[j] === "\n") {
+						const r = "_" + this.inl.acc.slice(0, j + 1);
+						this.buf = this.inl.acc.slice(j + 1);
+						this.inl = null;
+						this.sol = true;
+						return r;
+					}
+					if (this.inl.acc[j] === "_") {
+						if (j + 1 < this.inl.acc.length && this.inl.acc[j + 1] === "_") {
+							j++;
+							continue;
+						}
+						const content = this.inl.acc.slice(0, j);
+						this.buf = this.inl.acc.slice(j + 1);
+						this.inl = null;
+						if (StreamingMarkdownFilter.containsCJK(content)) return content;
+						return `_${content}_`;
+					}
+				}
+				return "";
+			case "image": {
+				const cb = this.inl.acc.indexOf("]");
+				if (cb === -1) return "";
+				if (cb + 1 >= this.inl.acc.length) return "";
+				if (this.inl.acc[cb + 1] !== "(") {
+					const r = "![" + this.inl.acc.slice(0, cb + 1);
+					this.buf = this.inl.acc.slice(cb + 1);
+					this.inl = null;
+					return r;
+				}
+				const cp = this.inl.acc.indexOf(")", cb + 2);
+				if (cp !== -1) {
+					this.buf = this.inl.acc.slice(cp + 1);
+					this.inl = null;
+					return "";
+				}
+				return "";
+			}
+		}
+		return "";
+	}
+	static containsCJK(text) {
+		return /[\u2E80-\u9FFF\uAC00-\uD7AF\uF900-\uFAFF]/.test(text);
+	}
+};
+function encryptAesEcb(plaintext, key) {
+	const cipher = crypto.createCipheriv("aes-128-ecb", key, null);
+	return Buffer.concat([cipher.update(plaintext), cipher.final()]);
+}
+function decryptAesEcb(ciphertext, key) {
+	const decipher = crypto.createDecipheriv("aes-128-ecb", key, null);
+	return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+/** AES-128-ECB ciphertext size (PKCS7 padding to 16-byte boundary). */
+function aesEcbPaddedSize(plaintextSize) {
+	return Math.ceil((plaintextSize + 1) / 16) * 16;
+}
+function buildCdnDownloadUrl(encryptedQueryParam, cdnBaseUrl) {
+	return `${cdnBaseUrl}/download?encrypted_query_param=${encodeURIComponent(encryptedQueryParam)}`;
+}
+function buildCdnUploadUrl(params) {
+	return `${params.cdnBaseUrl}/upload?encrypted_query_param=${encodeURIComponent(params.uploadParam)}&filekey=${encodeURIComponent(params.filekey)}`;
+}
+/**
+* Parse a base64 aes_key into the raw 16-byte AES key. Two encodings exist:
+* base64(raw 16 bytes) for images; base64(hex string of 16 bytes) for
+* file/voice/video.
+*/
+function parseAesKey(aesKeyBase64, label) {
+	const decoded = Buffer.from(aesKeyBase64, "base64");
+	if (decoded.length === 16) return decoded;
+	if (decoded.length === 32 && /^[0-9a-fA-F]{32}$/.test(decoded.toString("ascii"))) return Buffer.from(decoded.toString("ascii"), "hex");
+	throw new Error(`${label}: aes_key must decode to 16 raw bytes or 32-char hex string, got ${decoded.length} bytes`);
+}
+async function fetchCdnBytes(url, label) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`${label}: CDN download ${res.status} ${res.statusText}`);
+	return Buffer.from(await res.arrayBuffer());
+}
+/** Download + AES-128-ECB decrypt a CDN media file. Returns plaintext Buffer. */
+async function downloadAndDecryptBuffer(params) {
+	const { encryptedQueryParam, aesKeyBase64, cdnBaseUrl, label, fullUrl } = params;
+	const key = parseAesKey(aesKeyBase64, label);
+	return decryptAesEcb(await fetchCdnBytes(fullUrl ?? buildCdnDownloadUrl(encryptedQueryParam, cdnBaseUrl), label), key);
+}
+const UPLOAD_MAX_RETRIES = 3;
+/** Upload a ciphertext buffer to the CDN; returns the download param. */
+async function uploadBufferToCdn(params) {
+	const { buf, uploadFullUrl, uploadParam, filekey, cdnBaseUrl, label, aeskey } = params;
+	const ciphertext = encryptAesEcb(buf, aeskey);
+	const cdnUrl = uploadFullUrl?.trim() || (uploadParam ? buildCdnUploadUrl({
+		cdnBaseUrl,
+		uploadParam,
+		filekey
+	}) : void 0);
+	if (!cdnUrl) throw new Error(`${label}: CDN upload URL missing`);
+	let downloadParam;
+	let lastError;
+	for (let attempt = 1; attempt <= UPLOAD_MAX_RETRIES; attempt++) try {
+		const res = await fetch(cdnUrl, {
+			method: "POST",
+			headers: { "Content-Type": "application/octet-stream" },
+			body: new Uint8Array(ciphertext)
+		});
+		if (res.status >= 400 && res.status < 500) {
+			const errMsg = res.headers.get("x-error-message") ?? await res.text();
+			throw new Error(`CDN upload client error ${res.status}: ${errMsg}`);
+		}
+		if (res.status !== 200) throw new Error(`CDN upload server error: ${res.headers.get("x-error-message") ?? `status ${res.status}`}`);
+		downloadParam = res.headers.get("x-encrypted-param") ?? void 0;
+		if (!downloadParam) throw new Error("CDN upload response missing x-encrypted-param header");
+		break;
+	} catch (err) {
+		lastError = err;
+		if (err instanceof Error && err.message.includes("client error")) throw err;
+		if (attempt < UPLOAD_MAX_RETRIES) continue;
+	}
+	if (!downloadParam) throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error(`CDN upload failed after ${UPLOAD_MAX_RETRIES} attempts`);
+	return { downloadParam };
+}
+/**
+* Upload a local file to the Weixin CDN with AES-128-ECB encryption.
+* Shared by image / video / file attachment paths.
+*/
+async function uploadLocalFileToWeixin(params) {
+	const { filePath, toUserId, mediaType, baseUrl, token, cdnBaseUrl } = params;
+	const plaintext = await readFile(filePath);
+	const rawsize = plaintext.length;
+	const rawfilemd5 = crypto.createHash("md5").update(plaintext).digest("hex");
+	const filesize = aesEcbPaddedSize(rawsize);
+	const filekey = crypto.randomBytes(16).toString("hex");
+	const aeskey = crypto.randomBytes(16);
+	const rawText = await postJson(baseUrl, "ilink/bot/getuploadurl", token, {
+		filekey,
+		media_type: mediaType,
+		to_user_id: toUserId,
+		rawsize,
+		rawfilemd5,
+		filesize,
+		no_need_thumb: true,
+		aeskey: aeskey.toString("hex"),
+		base_info: {
+			channel_version: "2.4.3",
+			bot_agent: "dsh-desktop"
+		}
+	});
+	const resp = JSON.parse(rawText);
+	if (!resp.upload_full_url?.trim() && !resp.upload_param) throw new Error("getuploadurl returned no upload URL");
+	const { downloadParam } = await uploadBufferToCdn({
+		buf: plaintext,
+		uploadFullUrl: resp.upload_full_url,
+		uploadParam: resp.upload_param,
+		filekey,
+		cdnBaseUrl: cdnBaseUrl ?? "https://novac2c.cdn.weixin.qq.com/c2c",
+		aeskey,
+		label: "uploadLocalFileToWeixin"
+	});
+	return {
+		filekey,
+		downloadEncryptedQueryParam: downloadParam,
+		aeskey: aeskey.toString("hex"),
+		fileSize: rawsize,
+		fileSizeCiphertext: filesize
+	};
+}
+/** Shared POST helper with the iLink headers (kept local to media module). */
+async function postJson(baseUrl, endpoint, token, body) {
+	const res = await fetch(`${baseUrl.replace(/\/$/, "")}/${endpoint}`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			AuthorizationType: "ilink_bot_token",
+			"X-WECHAT-UIN": Buffer.from(String(Math.floor(Math.random() * 4e9)), "utf-8").toString("base64"),
+			"iLink-App-Id": "bot",
+			"iLink-App-ClientVersion": "132099",
+			Authorization: `Bearer ${token}`
+		},
+		body: JSON.stringify(body)
+	});
+	const raw = await res.text();
+	if (!res.ok) throw new Error(`${endpoint} ${res.status}: ${raw.slice(0, 300)}`);
+	return raw;
+}
+//#endregion
+//#region src/channels/weixin.ts
+const LONG_POLL_TIMEOUT_MS = 35e3;
+const BASE_BACKOFF_DELAY = 2e3;
+const MAX_BACKOFF_DELAY = 3e4;
+const TYPING_INTERVAL_MS = 5e3;
+/** getupdates returns this errcode when the bot token / session expired. */
+const SESSION_EXPIRED_ERRCODE = -14;
+/** How long to pause polling after a session-expired error. */
+const SESSION_PAUSE_MS = 3e5;
+function isMediaItem(item) {
+	return item.type === MessageItemType.IMAGE || item.type === MessageItemType.VIDEO || item.type === MessageItemType.FILE || item.type === MessageItemType.VOICE;
+}
+/** Guess the MIME type from a decrypted image's magic bytes. */
+function sniffImageMime(buf) {
+	if (buf.length >= 8 && buf.subarray(0, 8).equals(Buffer.from("89504e470d0a1a0a", "hex"))) return "image/png";
+	if (buf.length >= 3 && buf.subarray(0, 3).equals(Buffer.from("ffd8ff", "hex"))) return "image/jpeg";
+	if (buf.length >= 6 && buf.subarray(0, 6).toString("ascii") === "GIF87a") return "image/gif";
+	if (buf.length >= 6 && buf.subarray(0, 6).toString("ascii") === "GIF89a") return "image/gif";
+	if (buf.length >= 4 && buf.subarray(0, 4).toString("ascii") === "RIFF") return "image/webp";
+	return "image/jpeg";
+}
+/** True when a path points at a local file (drive letter, /, ~, file://). */
+function isLocalPath(raw) {
+	return raw.startsWith("file://") || /^[A-Za-z]:[\\/]/.test(raw) || raw.startsWith("/") || raw.startsWith("~");
+}
+/** Strip file:// / URL-encoding to get the on-disk absolute path. */
+function toLocalPath(raw) {
+	let p = raw.startsWith("file://") ? raw.slice(7) : raw;
+	try {
+		p = decodeURIComponent(p);
+	} catch {}
+	return p;
+}
+/** Extract the plain-text body from an item list (quotes + voice-to-text). */
+function bodyFromItemList(itemList) {
+	if (!itemList?.length) return "";
+	for (const item of itemList) {
+		if (item.type === MessageItemType.TEXT && item.text_item?.text != null) {
+			const text = String(item.text_item.text);
+			const ref = item.ref_msg;
+			if (!ref) return text;
+			if (ref.message_item && isMediaItem(ref.message_item)) return text;
+			const parts = [];
+			if (ref.title) parts.push(ref.title);
+			if (ref.message_item) {
+				const refBody = bodyFromItemList([ref.message_item]);
+				if (refBody) parts.push(refBody);
+			}
+			if (!parts.length) return text;
+			return `[引用: ${parts.join(" | ")}]\n${text}`;
+		}
+		if (item.type === MessageItemType.VOICE && item.voice_item?.text) return item.voice_item.text;
+	}
+	return "";
+}
+/** client_id for outbound messages — random per message. */
+function generateClientId() {
+	return `pi-weixin-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+}
+/** Per-bot state directory: ~/.dsh/im-gateway (survives restarts). */
+function stateDir() {
+	return join(os.homedir(), ".dsh", "im-gateway");
+}
+var WeixinAdapter = class {
+	ctx;
+	id;
+	label;
+	token;
+	botId;
+	baseUrl;
+	cdnBaseUrl;
+	stopped = true;
+	active = false;
+	pollTimer = null;
+	reconnectAttempts = 0;
+	typingTimer = null;
+	typingTarget = null;
+	/** get_updates_buf cursor — persisted for restart continuity. */
+	updatesBuf = "";
+	/** Per-conversation context tokens (persisted). */
+	contextTokens = /* @__PURE__ */ new Map();
+	/** Per-user typing_ticket from getconfig (needed for sendTyping). */
+	typingTickets = /* @__PURE__ */ new Map();
+	/** Runtime-status sink, assigned by the gateway on registration. */
+	statusListener;
+	constructor(ctx, config, id, label) {
+		this.ctx = ctx;
+		this.id = id;
+		this.label = label;
+		this.token = config.token ?? "";
+		this.botId = config.botId ?? "";
+		this.baseUrl = config.baseUrl?.trim() || "https://ilinkai.weixin.qq.com";
+		this.cdnBaseUrl = config.cdnBaseUrl?.trim() || "https://novac2c.cdn.weixin.qq.com/c2c";
+	}
+	isActive() {
+		return this.active;
+	}
+	setStatus(s, error) {
+		this.statusListener?.({
+			status: s,
+			error,
+			lastChange: Date.now()
+		});
+	}
+	stateFilePath(name) {
+		return join(stateDir(), `weixin-${name}-${this.botId || "unbound"}.json`);
+	}
+	restoreState() {
+		try {
+			const bufPath = this.stateFilePath("syncbuf");
+			if (existsSync(bufPath)) {
+				const parsed = JSON.parse(readFileSync(bufPath, "utf-8"));
+				if (typeof parsed.buf === "string") this.updatesBuf = parsed.buf;
+			}
+		} catch {}
+		try {
+			const tokPath = this.stateFilePath("context-tokens");
+			if (existsSync(tokPath)) {
+				const parsed = JSON.parse(readFileSync(tokPath, "utf-8"));
+				for (const [k, v] of Object.entries(parsed)) if (typeof v === "string" && v) this.contextTokens.set(k, v);
+			}
+		} catch {}
+	}
+	persistBuf() {
+		try {
+			mkdirSync(stateDir(), { recursive: true });
+			writeFileSync(this.stateFilePath("syncbuf"), JSON.stringify({ buf: this.updatesBuf }), "utf-8");
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-weixin:${this.id}] persist syncbuf failed: ${String(err)}`);
+		}
+	}
+	persistContextTokens() {
+		try {
+			mkdirSync(stateDir(), { recursive: true });
+			writeFileSync(this.stateFilePath("context-tokens"), JSON.stringify(Object.fromEntries(this.contextTokens)), "utf-8");
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-weixin:${this.id}] persist context tokens failed: ${String(err)}`);
+		}
+	}
+	contextTokenKey(userId) {
+		return `${this.botId}:${userId}`;
+	}
+	async start() {
+		if (!this.token) {
+			this.ctx.logger.warn(`[im-channel-weixin:${this.id}] token missing — scan the QR code first`);
+			this.setStatus("error", "token missing — scan the QR code first");
+			return;
+		}
+		this.stopped = false;
+		this.restoreState();
+		try {
+			await notifyStart({
+				baseUrl: this.baseUrl,
+				token: this.token,
+				timeoutMs: 1e4
+			}).catch(() => void 0);
+		} catch {}
+		this.active = true;
+		this.setStatus("online");
+		this.schedulePoll(0);
+	}
+	async stop() {
+		this.stopped = true;
+		if (this.pollTimer) clearTimeout(this.pollTimer);
+		this.pollTimer = null;
+		this.stopTyping();
+		try {
+			await notifyStop({
+				baseUrl: this.baseUrl,
+				token: this.token,
+				timeoutMs: 1e4
+			}).catch(() => void 0);
+		} catch {}
+		this.active = false;
+		this.setStatus("offline");
+	}
+	schedulePoll(delayMs) {
+		if (this.stopped) return;
+		this.pollTimer = setTimeout(() => void this.pollOnce(), delayMs);
+	}
+	async pollOnce() {
+		if (this.stopped) return;
+		try {
+			const resp = await getUpdates({
+				baseUrl: this.baseUrl,
+				token: this.token,
+				get_updates_buf: this.updatesBuf,
+				timeoutMs: LONG_POLL_TIMEOUT_MS
+			});
+			this.reconnectAttempts = 0;
+			if (!this.active) {
+				this.active = true;
+				this.setStatus("online");
+			}
+			if (resp.ret !== void 0 && resp.ret !== 0 || resp.errcode !== void 0 && resp.errcode !== 0) {
+				const expired = resp.errcode === SESSION_EXPIRED_ERRCODE || resp.ret === SESSION_EXPIRED_ERRCODE;
+				this.ctx.logger.warn(`[im-channel-weixin:${this.id}] getUpdates ret=${resp.ret} errcode=${resp.errcode} errmsg=${resp.errmsg}` + (expired ? " — session expired, pausing" : ""));
+				if (expired) this.setStatus("error", "session expired — re-scan the QR code");
+				this.schedulePoll(expired ? SESSION_PAUSE_MS : 2e3);
+				return;
+			}
+			if (resp.get_updates_buf && resp.get_updates_buf !== this.updatesBuf) {
+				this.updatesBuf = resp.get_updates_buf;
+				this.persistBuf();
+			}
+			for (const msg of resp.msgs ?? []) try {
+				await this.handleMessage(msg);
+			} catch (err) {
+				this.ctx.logger.warn(`[im-channel-weixin:${this.id}] handleMessage failed: ${String(err)}`);
+			}
+			this.schedulePoll(resp.msgs?.length ? 100 : 300);
+		} catch (err) {
+			const attempt = this.reconnectAttempts;
+			this.reconnectAttempts += 1;
+			const backoff = Math.min(MAX_BACKOFF_DELAY, BASE_BACKOFF_DELAY * 2 ** Math.min(attempt, 5));
+			this.active = false;
+			this.setStatus("error", `poll error: ${String(err)}`);
+			this.ctx.logger.warn(`[im-channel-weixin:${this.id}] poll error (${attempt}), retry in ${backoff}ms: ${String(err)}`);
+			this.schedulePoll(backoff);
+		}
+	}
+	async handleMessage(msg) {
+		const fromUserId = msg.from_user_id ?? "";
+		if (!fromUserId) return;
+		if (msg.message_type === MessageType.BOT) return;
+		const text = bodyFromItemList(msg.item_list);
+		if (msg.context_token) {
+			this.contextTokens.set(this.contextTokenKey(fromUserId), msg.context_token);
+			this.persistContextTokens();
+		}
+		const images = [];
+		for (const item of msg.item_list ?? []) {
+			if (item.type !== MessageItemType.IMAGE || !item.image_item) continue;
+			const img = item.image_item;
+			if (!img.media) continue;
+			try {
+				const aesKeyBase64 = img.aeskey ? Buffer.from(img.aeskey, "hex").toString("base64") : img.media.aes_key;
+				if (!aesKeyBase64) continue;
+				const buf = await downloadAndDecryptBuffer({
+					encryptedQueryParam: img.media.encrypt_query_param ?? "",
+					aesKeyBase64,
+					cdnBaseUrl: this.cdnBaseUrl,
+					label: "weixin image",
+					fullUrl: img.media.full_url
+				});
+				images.push({
+					mediaType: sniffImageMime(buf),
+					data: buf.toString("base64")
+				});
+			} catch (err) {
+				this.ctx.logger.warn(`[im-channel-weixin:${this.id}] image download/decrypt failed: ${String(err)}`);
+			}
+		}
+		if (!text && images.length === 0) return;
+		const message = {
+			channelId: this.id,
+			conversationId: fromUserId,
+			userId: fromUserId,
+			text,
+			images: images.length ? images : void 0
+		};
+		this.ctx.imGateway.handleInbound(message).catch((err) => this.ctx.logger.error(`[im-channel-weixin:${this.id}] handleInbound failed`, err));
+	}
+	async sendText(conversationId, text) {
+		const contextToken = this.contextTokens.get(this.contextTokenKey(conversationId));
+		const enriched = await this.sendMediaForText(conversationId, text, contextToken);
+		const filter = new StreamingMarkdownFilter();
+		const filtered = filter.feed(enriched) + filter.flush();
+		if (!filtered.trim()) return;
+		const req = { msg: {
+			from_user_id: "",
+			to_user_id: conversationId,
+			client_id: generateClientId(),
+			message_type: MessageType.BOT,
+			message_state: MessageState.FINISH,
+			item_list: [{
+				type: MessageItemType.TEXT,
+				text_item: { text: filtered }
+			}],
+			context_token: contextToken ?? void 0
+		} };
+		await sendMessage({
+			baseUrl: this.baseUrl,
+			token: this.token,
+			timeoutMs: 15e3,
+			body: req
+		});
+		this.stopTyping();
+	}
+	async sendImage(conversationId, image) {
+		const tmpPath = join(os.tmpdir(), `weixin-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.img`);
+		try {
+			writeFileSync(tmpPath, Buffer.from(image.data, "base64"));
+			const contextToken = this.contextTokens.get(this.contextTokenKey(conversationId));
+			await this.sendLocalMedia(conversationId, tmpPath, contextToken);
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-weixin:${this.id}] sendImage failed: ${String(err)}`);
+		}
+	}
+	/**
+	* Detect local image/file paths in a reply, upload each to the CDN and
+	* send it as a standalone media message (IMAGE / FILE). Returns the text
+	* with the references replaced by short notes.
+	*/
+	async sendMediaForText(conversationId, text, contextToken) {
+		let result = text;
+		for (const m of text.matchAll(/!\[([^\]]*)\]\(([^)]+)\)/g)) {
+			const [full, alt, p] = m;
+			if (!isLocalPath(p)) continue;
+			const filePath = toLocalPath(p);
+			if (!existsSync(filePath)) continue;
+			await this.sendLocalMedia(conversationId, filePath, contextToken);
+			result = result.replace(full, alt ? `[${alt}]` : "[图片]");
+		}
+		for (const m of result.matchAll(/(?:file:\/\/)?[A-Za-z]:[\\/][^\s"'()<>]+|(?:\/(?:Users|home|tmp|var|private|root)\/[^\s"'()<>]+)/g)) {
+			const filePath = toLocalPath(m[0]);
+			if (!existsSync(filePath)) continue;
+			if (await this.sendLocalMedia(conversationId, filePath, contextToken)) {
+				const isImg = /\.(png|jpe?g|gif|bmp|webp)$/i.test(filePath);
+				result = result.replace(m[0], isImg ? "[图片]" : `[文件已发送：${basename(filePath)}]`);
+			}
+		}
+		return result;
+	}
+	/** Upload one local file and send it as an IMAGE/FILE media message. */
+	async sendLocalMedia(conversationId, filePath, contextToken) {
+		try {
+			const isImage = /\.(png|jpe?g|gif|bmp|webp)$/i.test(filePath);
+			const uploaded = await uploadLocalFileToWeixin({
+				filePath,
+				toUserId: conversationId,
+				mediaType: isImage ? 1 : 3,
+				baseUrl: this.baseUrl,
+				token: this.token,
+				cdnBaseUrl: this.cdnBaseUrl
+			});
+			const media = isImage ? {
+				type: MessageItemType.IMAGE,
+				image_item: {
+					media: {
+						encrypt_query_param: uploaded.downloadEncryptedQueryParam,
+						aes_key: Buffer.from(uploaded.aeskey, "hex").toString("base64"),
+						encrypt_type: 1
+					},
+					mid_size: uploaded.fileSizeCiphertext
+				}
+			} : {
+				type: MessageItemType.FILE,
+				file_item: {
+					media: {
+						encrypt_query_param: uploaded.downloadEncryptedQueryParam,
+						aes_key: Buffer.from(uploaded.aeskey, "hex").toString("base64"),
+						encrypt_type: 1
+					},
+					file_name: basename(filePath),
+					len: String(uploaded.fileSize)
+				}
+			};
+			await sendMessage({
+				baseUrl: this.baseUrl,
+				token: this.token,
+				timeoutMs: 15e3,
+				body: { msg: {
+					from_user_id: "",
+					to_user_id: conversationId,
+					client_id: generateClientId(),
+					message_type: MessageType.BOT,
+					message_state: MessageState.FINISH,
+					item_list: [media],
+					context_token: contextToken ?? void 0
+				} }
+			});
+			return true;
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-weixin:${this.id}] media send failed (${filePath}): ${String(err)}`);
+			return false;
+		}
+	}
+	/**
+	* Fetch (and cache) the per-user typing_ticket from getconfig — required
+	* by sendtyping. Mirrors the official connector's per-user config cache.
+	*/
+	async ensureTypingTicket(userId) {
+		const cached = this.typingTickets.get(userId);
+		if (cached) return cached;
+		try {
+			const ctxToken = this.contextTokens.get(this.contextTokenKey(userId));
+			const resp = await getConfig({
+				baseUrl: this.baseUrl,
+				token: this.token,
+				ilinkUserId: userId,
+				contextToken: ctxToken
+			});
+			if (resp.typing_ticket) {
+				this.typingTickets.set(userId, resp.typing_ticket);
+				return resp.typing_ticket;
+			}
+		} catch (err) {
+			this.ctx.logger.warn(`[im-channel-weixin:${this.id}] getConfig (typing ticket) failed: ${String(err)}`);
+		}
+	}
+	async sendTyping(conversationId) {
+		this.typingTarget = conversationId;
+		if (this.typingTimer) return;
+		const ticket = await this.ensureTypingTicket(conversationId);
+		if (!ticket) return;
+		const fire = () => {
+			if (!this.typingTarget) return;
+			sendTyping({
+				baseUrl: this.baseUrl,
+				token: this.token,
+				timeoutMs: 1e4,
+				body: {
+					ilink_user_id: this.typingTarget,
+					typing_ticket: ticket,
+					status: TypingStatus.TYPING
+				}
+			}).catch(() => void 0);
+			this.typingTimer = setTimeout(fire, TYPING_INTERVAL_MS);
+		};
+		fire();
+	}
+	/** Stop the keepalive and send the cancel typing status (status=2). */
+	stopTyping() {
+		const target = this.typingTarget;
+		if (this.typingTimer) clearTimeout(this.typingTimer);
+		this.typingTimer = null;
+		this.typingTarget = null;
+		const ticket = target ? this.typingTickets.get(target) : void 0;
+		if (target && ticket) sendTyping({
+			baseUrl: this.baseUrl,
+			token: this.token,
+			timeoutMs: 1e4,
+			body: {
+				ilink_user_id: target,
+				typing_ticket: ticket,
+				status: TypingStatus.CANCEL
+			}
+		}).catch(() => void 0);
+	}
+};
+//#endregion
+//#region src/sync.ts
+const NS$2 = "im-gateway";
+/** Channels that should actually run = settings merged value (user layer wins). */
+function readEffectiveConfig(ctx, fallback) {
+	try {
+		const channels = ctx.get("settings").describe({ redactSecrets: false }).find((n) => n.ns === String(NS$2))?.value?.channels;
+		if (Array.isArray(channels) && channels.length > 0) return channels;
+	} catch (err) {
+		ctx.logger.warn("[im-gateway] settings read failed; falling back to boot config", err);
+	}
+	return fallback.channels ?? [];
+}
+/** Instantiate the right adapter class for a channel instance. */
+function createAdapter(ctx, inst) {
+	const label = inst.name || typeLabel(inst.type);
+	switch (inst.type) {
+		case "dingtalk": return new DingtalkAdapter(ctx, inst.config, inst.id, label);
+		case "qq": return new QQAdapter(ctx, inst.config, inst.id, label);
+		case "weixin": return new WeixinAdapter(ctx, inst.config, inst.id, label);
+		default:
+			ctx.logger.warn(`[im-gateway] unknown channel type "${String(inst.type)}" for "${inst.id}"`);
+			return null;
+	}
+}
+function typeLabel(type) {
+	switch (type) {
+		case "dingtalk": return "钉钉";
+		case "qq": return "QQ";
+		case "weixin": return "个人微信";
+	}
+}
+/**
+* Stop every channel and re-create them from the CURRENT settings merged
+* config. Called at boot and after every config save (mirrors the reference
+* project's applyConfig → stopAll → recreate → start). Without this, a
+* QR-scan binding saved from the settings UI would never take effect in the
+* running process — adapters created at boot with empty credentials stay
+* dead forever.
+*
+* @param imGateway - the gateway service instance. Passed explicitly instead
+*   of resolving `ctx.imGateway` because callers live in different fibers
+*   (boot inject vs Typert remote) whose `inject` lists differ — property
+*   access would throw `cannot get property "imGateway" without inject`.
+*/
+async function syncChannels(imGateway, ctx, fallback) {
+	await imGateway.stopAll();
+	const effective = readEffectiveConfig(ctx, fallback);
+	for (const inst of effective) {
+		if (!inst.enabled) continue;
+		const adapter = createAdapter(ctx, inst);
+		if (!adapter) continue;
+		ctx.logger.info(`[im-gateway] starting channel "${inst.id}" (${inst.type})`);
+		imGateway.registerChannel(adapter);
+	}
+}
+//#endregion
+//#region src/channels/qq-login.ts
+/**
+* QQ Bot QR scan binding — ported from
+* pi-desk-top/src/main/im/qq/qq-login.ts. Wraps
+* `@tencent-connect/qqbot-connector`'s callback-style `startQrConnect` into
+* the same snapshot model used by WeChat: startLogin kicks off a background
+* flow (the connector polls internally and calls back), the UI polls
+* getStatus() for snapshots.
+*
+* On success the connector hands back the robot credentials directly
+* (appId + appSecret) — no need to create the bot on the QQ open platform
+* manually.
+*/
+const logins$1 = /* @__PURE__ */ new Map();
+function snapshot$1(l) {
+	const s = {
+		loginId: l.loginId,
+		status: l.status,
+		qrcodeUrl: l.qrcodeUrl,
+		qrcode: l.qrcode,
+		message: l.message
+	};
+	if (l.status === "confirmed" && l.appId && l.appSecret) s.credentials = {
+		appId: l.appId,
+		appSecret: l.appSecret
+	};
+	return s;
+}
+/** Purge stale logins so the map never grows unbounded. */
+function purgeStale$1() {
+	const now = Date.now();
+	for (const [id, l] of logins$1) if (l.status !== "running" && now - l.startedAt > 3e5) logins$1.delete(id);
+}
+/**
+* Kick off a QQ QR binding. Returns immediately with a login id; the
+* connector polls in the background and the UI polls getStatus().
+*/
+async function startLogin$1() {
+	purgeStale$1();
+	const { startQrConnect } = await import("@tencent-connect/qqbot-connector");
+	const loginId = randomUUID();
+	const login = {
+		loginId,
+		status: "running",
+		qrcodeUrl: "",
+		qrcode: "",
+		message: "正在获取二维码…",
+		startedAt: Date.now()
+	};
+	logins$1.set(loginId, login);
+	login.stop = startQrConnect({
+		onQrDisplayed: (url) => {
+			login.qrcode = url;
+			QRCode.toDataURL(url, {
+				width: 240,
+				margin: 1
+			}).then((dataUrl) => {
+				login.qrcodeUrl = dataUrl;
+				login.message = "请用手机 QQ 扫描二维码绑定机器人。";
+			}).catch(() => {
+				login.message = "二维码渲染失败，可用下方链接扫码。";
+			});
+		},
+		onQrExpired: () => {
+			login.message = "二维码已过期，正在刷新…";
+		},
+		onSuccess: (creds) => {
+			const first = creds[0];
+			if (!first) {
+				login.status = "error";
+				login.message = "绑定失败：未获取到机器人凭据。";
+				return;
+			}
+			login.appId = first.appId;
+			login.appSecret = first.appSecret;
+			login.status = "confirmed";
+			login.message = `绑定成功！AppID: ${first.appId}`;
+		},
+		onFailure: (err) => {
+			login.status = "error";
+			login.message = `绑定失败：${err.message}`;
+		}
+	}, {
+		displayQrCodeToConsole: false,
+		source: "dsh-desktop"
+	});
+	return snapshot$1(login);
+}
+/** Read the current login snapshot (null if the login is gone). */
+function getLoginStatus$1(loginId) {
+	const l = logins$1.get(loginId);
+	if (!l) return null;
+	return snapshot$1(l);
+}
+/** Cancel an in-flight login. */
+function cancelLogin$1(loginId) {
+	const l = logins$1.get(loginId);
+	if (!l) return;
+	l.stop?.();
+	l.status = "canceled";
+	l.message = "绑定已取消。";
+}
+//#endregion
+//#region src/channels/weixin-login.ts
+/**
+* Weixin QR scan login — ported from
+* pi-desk-top/src/main/im/weixin/weixin-login.ts (itself adapted from the
+* official connector's login-qr.ts). The login loop runs IN-PROCESS
+* (started by startLogin, never awaited); the UI polls getStatus() for a
+* snapshot and submits the pairing code via submitVerifyCode when the server
+* asks for one.
+*
+* On "confirmed" the loop resolves with the bot credentials; the caller
+* stores them into the channel instance config.
+*/
+/** Default `bot_type` for ilink get_bot_qrcode / get_qrcode_status. */
+const DEFAULT_ILINK_BOT_TYPE = "3";
+/** Fixed API base URL for all QR code requests. */
+const FIXED_BASE_URL = "https://ilinkai.weixin.qq.com";
+/** Client-side timeout for the long-poll get_qrcode_status request. */
+const QR_LONG_POLL_TIMEOUT_MS = 35e3;
+/** A QR code that was never scanned expires after this long. */
+const LOGIN_TTL_MS = 3e5;
+/** Max QR refresh attempts before giving up. */
+const MAX_QR_REFRESH_COUNT = 3;
+const logins = /* @__PURE__ */ new Map();
+/** Remove stale logins so the map never grows unbounded. */
+function purgeStale() {
+	const now = Date.now();
+	for (const [id, l] of logins) if (!l.running && now - l.startedAt > LOGIN_TTL_MS) logins.delete(id);
+}
+function snapshot(l) {
+	const s = {
+		loginId: l.loginId,
+		status: l.status,
+		qrcodeUrl: l.qrcodeUrl,
+		qrcode: l.qrContent,
+		message: l.message
+	};
+	if (l.status === "need_verifycode") s.verifyCodeNeeded = true;
+	if (l.status === "confirmed" && l.botToken && l.botId) s.credentials = {
+		token: l.botToken,
+		botId: l.botId,
+		baseUrl: l.baseUrl ?? FIXED_BASE_URL,
+		userId: l.userId
+	};
+	return s;
+}
+async function fetchQRCode(apiBaseUrl, botType) {
+	const rawText = await apiPostFetch({
+		baseUrl: apiBaseUrl,
+		endpoint: `ilink/bot/get_bot_qrcode?bot_type=${encodeURIComponent(botType)}`,
+		body: JSON.stringify({ local_token_list: [] }),
+		timeoutMs: 15e3,
+		label: "fetchQRCode"
+	});
+	return JSON.parse(rawText);
+}
+async function pollQRStatus(apiBaseUrl, qrcode, verifyCode) {
+	try {
+		let endpoint = `ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(qrcode)}`;
+		if (verifyCode) endpoint += `&verify_code=${encodeURIComponent(verifyCode)}`;
+		const rawText = await apiGetFetch({
+			baseUrl: apiBaseUrl,
+			endpoint,
+			timeoutMs: QR_LONG_POLL_TIMEOUT_MS,
+			label: "pollQRStatus"
+		});
+		return JSON.parse(rawText);
+	} catch (err) {
+		return { status: "wait" };
+	}
+}
+async function refreshQR(l) {
+	try {
+		const qr = await fetchQRCode(FIXED_BASE_URL, DEFAULT_ILINK_BOT_TYPE);
+		l.qrcode = qr.qrcode;
+		l.qrContent = qr.qrcode_img_content;
+		l.qrcodeUrl = await QRCode.toDataURL(qr.qrcode_img_content, {
+			width: 240,
+			margin: 1
+		});
+		l.startedAt = Date.now();
+		l.qrRefreshCount += 1;
+		l.message = "二维码已更新，请重新扫描。";
+		return true;
+	} catch (err) {
+		l.message = `刷新二维码失败: ${String(err)}`;
+		return false;
+	}
+}
+/**
+* Kick off a QR login. Returns the login id + QR material immediately; the
+* polling loop runs in the background and updates the snapshot.
+*/
+async function startLogin() {
+	purgeStale();
+	const loginId = randomUUID();
+	const login = {
+		loginId,
+		qrcode: "",
+		qrcodeUrl: "",
+		qrContent: "",
+		startedAt: Date.now(),
+		status: "running",
+		message: "正在获取二维码…",
+		currentApiBaseUrl: FIXED_BASE_URL,
+		qrRefreshCount: 0,
+		running: true
+	};
+	logins.set(loginId, login);
+	(async () => {
+		try {
+			const qr = await fetchQRCode(FIXED_BASE_URL, DEFAULT_ILINK_BOT_TYPE);
+			login.qrcode = qr.qrcode;
+			login.qrContent = qr.qrcode_img_content;
+			login.qrcodeUrl = await QRCode.toDataURL(qr.qrcode_img_content, {
+				width: 240,
+				margin: 1
+			});
+			login.message = "请用手机微信扫描二维码。";
+			await runLoop(login);
+		} catch (err) {
+			login.status = "error";
+			login.message = `获取二维码失败: ${String(err)}`;
+			login.running = false;
+		}
+	})();
+	return snapshot(login);
+}
+async function runLoop(l) {
+	while (l.running && Date.now() - l.startedAt < LOGIN_TTL_MS) {
+		const resp = await pollQRStatus(l.currentApiBaseUrl, l.qrcode, l.pendingVerifyCode);
+		switch (resp.status) {
+			case "wait": break;
+			case "scaned":
+				if (l.pendingVerifyCode) l.pendingVerifyCode = void 0;
+				if (l.status !== "scaned") {
+					l.status = "scaned";
+					l.message = "已扫码，正在确认…";
+				}
+				break;
+			case "need_verifycode":
+				l.status = "need_verifycode";
+				l.message = l.pendingVerifyCode ? "❌ 数字不匹配，请重新输入。" : "请在手机微信上查看数字，并在此输入。";
+				await new Promise((resolve) => {
+					const iv = setInterval(() => {
+						if (!l.running || l.pendingVerifyCode !== void 0) {
+							clearInterval(iv);
+							resolve();
+						}
+					}, 500);
+				});
+				if (!l.running) return;
+				break;
+			case "expired":
+				if (!await refreshQR(l) || l.qrRefreshCount > MAX_QR_REFRESH_COUNT) {
+					l.status = "error";
+					l.message = "二维码多次失效，连接流程已停止。请稍后再试。";
+					l.running = false;
+					return;
+				}
+				l.status = "wait";
+				break;
+			case "verify_code_blocked":
+				l.pendingVerifyCode = void 0;
+				l.message = "多次输入错误，请稍后再试。";
+				await new Promise((r) => setTimeout(r, 3e3));
+				break;
+			case "binded_redirect":
+				l.status = "confirmed";
+				l.message = "该微信已绑定过此实例，无需重复连接。";
+				l.running = false;
+				return;
+			case "scaned_but_redirect":
+				if (resp.redirect_host) l.currentApiBaseUrl = `https://${resp.redirect_host}`;
+				break;
+			case "confirmed":
+				if (!resp.ilink_bot_id) {
+					l.status = "error";
+					l.message = "登录失败：服务器未返回 ilink_bot_id。";
+					l.running = false;
+					return;
+				}
+				l.status = "confirmed";
+				l.botToken = resp.bot_token;
+				l.botId = resp.ilink_bot_id;
+				l.baseUrl = resp.baseurl;
+				l.userId = resp.ilink_user_id;
+				l.message = "已连接到微信。";
+				l.running = false;
+				return;
+		}
+		await new Promise((r) => setTimeout(r, 800));
+	}
+	if (l.running) {
+		l.status = "error";
+		l.message = "登录超时，请重试。";
+		l.running = false;
+	}
+}
+/** Read the current login snapshot (null if the login is gone). */
+function getLoginStatus(loginId) {
+	const l = logins.get(loginId);
+	if (!l) return null;
+	return snapshot(l);
+}
+/** Submit the pairing code shown on the phone. */
+function submitVerifyCode(loginId, code) {
+	const l = logins.get(loginId);
+	if (!l || !l.running) return false;
+	l.pendingVerifyCode = code.trim();
+	if (l.status === "need_verifycode") l.status = "wait";
+	return true;
+}
+/** Cancel an in-flight login. */
+function cancelLogin(loginId) {
+	const l = logins.get(loginId);
+	if (!l) return;
+	l.running = false;
+	l.status = "canceled";
+	l.message = "登录已取消。";
+}
+//#endregion
+//#region src/remote.ts
+const NS$1 = "im-gateway";
+const SERVICE = "imGatewayRemote";
+const PACKAGE = "@lijian-ui/dsh-im-gateway";
+/** Secret-typed credential keys (mirrors the host Config schema roles). */
+const SECRET_KEYS = /* @__PURE__ */ new Set(["clientSecret", "token"]);
+/** Minimal boundary schema: channels must be an array. */
+const channelsSchema = { parse(value) {
+	if (!Array.isArray(value)) throw new Error("channels must be an array");
+	return value;
+} };
+/** Minimal boundary schema: revision is an optional number. */
+const revisionSchema = { parse(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value !== "number") throw new Error("expectedRevision must be a number");
+	return value;
+} };
+const codec = (typeSymbol, schema) => ({
+	mode: "strict",
+	typeSymbol,
+	schema
+});
+/**
+* The typed wire contribution registered with `ctx.typert`. HOST face:
+* the registry expects `face: 'host'` + `invocations` (the client-side
+* `$mount` contribution instead carries `descriptors`).
+*/
+const CONTRIBUTION = {
+	package: PACKAGE,
+	face: "host",
+	schemas: [],
+	invocations: [
+		{
+			id: `${PACKAGE}#${SERVICE}/getConfig`,
+			service: SERVICE,
+			namespace: SERVICE,
+			method: "getConfig",
+			invocation: { kind: "direct" },
+			parameters: [],
+			result: codec(`${PACKAGE}#ImGatewayConfigView`, { parse: (v) => v })
+		},
+		{
+			id: `${PACKAGE}#${SERVICE}/saveConfig`,
+			service: SERVICE,
+			namespace: SERVICE,
+			method: "saveConfig",
+			invocation: { kind: "direct" },
+			parameters: [{
+				name: "channels",
+				wire: "channels",
+				source: "json",
+				codec: codec(`${PACKAGE}#ChannelsArray`, channelsSchema)
+			}, {
+				name: "expectedRevision",
+				wire: "expectedRevision",
+				source: "json",
+				acceptsUndefined: true,
+				codec: codec(`${PACKAGE}#Revision`, revisionSchema)
+			}],
+			result: codec(`${PACKAGE}#ImGatewayConfigView`, { parse: (v) => v })
+		},
+		{
+			id: `${PACKAGE}#${SERVICE}/getChannelStatuses`,
+			service: SERVICE,
+			namespace: SERVICE,
+			method: "getChannelStatuses",
+			invocation: { kind: "direct" },
+			parameters: [],
+			result: codec(`${PACKAGE}#ChannelStatuses`, { parse: (v) => v })
+		},
+		{
+			id: `${PACKAGE}#${SERVICE}/startQrLogin`,
+			service: SERVICE,
+			namespace: SERVICE,
+			method: "startQrLogin",
+			invocation: { kind: "direct" },
+			parameters: [{
+				name: "channelType",
+				wire: "channelType",
+				source: "json",
+				codec: codec(`${PACKAGE}#ChannelType`, { parse: (v) => v })
+			}],
+			result: codec(`${PACKAGE}#QrLoginStatus`, { parse: (v) => v })
+		},
+		{
+			id: `${PACKAGE}#${SERVICE}/getQrLoginStatus`,
+			service: SERVICE,
+			namespace: SERVICE,
+			method: "getQrLoginStatus",
+			invocation: { kind: "direct" },
+			parameters: [{
+				name: "loginId",
+				wire: "loginId",
+				source: "json",
+				codec: codec(`${PACKAGE}#LoginId`, { parse: (v) => v })
+			}],
+			result: codec(`${PACKAGE}#QrLoginStatus`, { parse: (v) => v })
+		},
+		{
+			id: `${PACKAGE}#${SERVICE}/submitQrVerifyCode`,
+			service: SERVICE,
+			namespace: SERVICE,
+			method: "submitQrVerifyCode",
+			invocation: { kind: "direct" },
+			parameters: [{
+				name: "loginId",
+				wire: "loginId",
+				source: "json",
+				codec: codec(`${PACKAGE}#LoginId`, { parse: (v) => v })
+			}, {
+				name: "code",
+				wire: "code",
+				source: "json",
+				codec: codec(`${PACKAGE}#VerifyCode`, { parse: (v) => v })
+			}],
+			result: codec(`${PACKAGE}#Bool`, { parse: (v) => v })
+		},
+		{
+			id: `${PACKAGE}#${SERVICE}/cancelQrLogin`,
+			service: SERVICE,
+			namespace: SERVICE,
+			method: "cancelQrLogin",
+			invocation: { kind: "direct" },
+			parameters: [{
+				name: "loginId",
+				wire: "loginId",
+				source: "json",
+				codec: codec(`${PACKAGE}#LoginId`, { parse: (v) => v })
+			}],
+			result: codec(`${PACKAGE}#Bool`, { parse: (v) => v })
+		}
+	],
+	model: {
+		services: [],
+		events: [],
+		objects: []
+	}
+};
+/** Read the namespace view (channels + revision). Secrets redacted on the wire. */
+function readView(settings) {
+	const view = settings.describe({ redactSecrets: true }).find((n) => n.ns === NS$1);
+	const channels = view?.value?.channels;
+	return {
+		channels: Array.isArray(channels) ? channels : [],
+		revision: view?.revision ?? 0
+	};
+}
+/** Pull the current channels array (plaintext secrets) from the settings service. */
+function currentChannels(settings) {
+	const channels = settings.describe({ redactSecrets: false }).find((n) => n.ns === NS$1)?.value?.channels;
+	return Array.isArray(channels) ? channels : [];
+}
+/**
+* Merge blank secrets back from storage. `channels` is a wholesale-replace
+* array; without this, a save would wipe every secret the user did not
+* retype (they see a blank password field because describe redacts).
+*/
+function mergeStoredSecrets(current, incoming) {
+	return incoming.map((inst) => {
+		const stored = current.find((c) => c.id === inst.id);
+		if (!stored) return inst;
+		const config = { ...inst.config };
+		for (const key of SECRET_KEYS) {
+			const value = config[key];
+			if (value === "" || value === void 0) {
+				const old = stored.config?.[key];
+				if (old !== void 0 && old !== "") config[key] = old;
+			}
+		}
+		return {
+			...inst,
+			config
+		};
+	});
+}
+/**
+* The Remote service. Constructing it registers the `imGatewayRemote` cordis
+* service; the contribution above lets the API gateway dispatch the two
+* methods. Plain methods are fine — the descriptors carry the wire contract.
+*/
+var ImGatewayApi = class extends TypertRemoteService {
+	settings;
+	constructor(ctx) {
+		super(ctx, SERVICE);
+		this.settings = ctx.get("settings");
+	}
+	/** Current channels + revision (secrets redacted). */
+	getConfig() {
+		return readView(this.settings);
+	}
+	/** Wholesale-replace the channels array. Blank secrets are kept from storage. */
+	async saveConfig(channels, expectedRevision) {
+		if (!Array.isArray(channels)) throw new Error("channels must be an array");
+		const merged = mergeStoredSecrets(currentChannels(this.settings), channels);
+		await this.settings.update(NS$1, { channels: merged }, expectedRevision);
+		try {
+			const gateway = this.ctx.get("imGateway");
+			if (gateway) await syncChannels(gateway, this.ctx, {
+				cwd: process.cwd(),
+				streamThrottleMs: 800,
+				slashCommands: true,
+				channels: []
+			});
+		} catch (err) {
+			this.ctx.logger.error("[im-gateway] channel reload after save failed", err);
+		}
+		return readView(this.settings);
+	}
+	/** Live channel runtime statuses (online/offline/error) for the settings UI. */
+	getChannelStatuses() {
+		return this.ctx.get("imGateway").getChannelStatuses();
+	}
+	/**
+	* Kick off a QR-scan login for a channel type ('qq' | 'weixin'). Returns
+	* `{ status: snapshot }` (the client's generic `call()` spreads the value
+	* to the top level, so the snapshot MUST be wrapped in a `status` key —
+	* otherwise `res.status` would be the snapshot's `status` string, not the
+	* snapshot object, and the polling effect would never start).
+	*/
+	async startQrLogin(channelType) {
+		try {
+			if (channelType === "qq") return { status: await startLogin$1() };
+			if (channelType === "weixin") return { status: await startLogin() };
+			throw new Error(`unsupported channel type for QR login: ${channelType}`);
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			console.error(`[im-gateway] startQrLogin(${channelType}) failed:`, message);
+			return { status: {
+				loginId: "",
+				status: "error",
+				qrcodeUrl: "",
+				qrcode: "",
+				message: `二维码获取失败：${message}`
+			} };
+		}
+	}
+	/** Read the current login snapshot (null → the login is gone/expired). */
+	getQrLoginStatus(loginId) {
+		const qq = getLoginStatus$1(loginId);
+		if (qq) return { status: qq };
+		const wx = getLoginStatus(loginId);
+		if (wx) return { status: wx };
+		return { status: null };
+	}
+	/** Submit the phone pairing code (WeChat only; QQ returns false). */
+	submitQrVerifyCode(loginId, code) {
+		return submitVerifyCode(loginId, code);
+	}
+	/** Cancel an in-flight QR login. */
+	cancelQrLogin(loginId) {
+		cancelLogin$1(loginId);
+		cancelLogin(loginId);
+		return true;
+	}
+};
+/**
+* Register the Remote config service. Called from the bundle apply AFTER the
+* entry's plugin-level `inject: ['typert', 'settings']` guarantee, so both
+* services are live here (synchronous registration, mirroring the official
+* dsh-skill-viewer host: `export const inject = ["typert", ...]`).
+*/
+function registerRemoteApi(ctx) {
+	new ImGatewayApi(ctx);
+	ctx.effect(() => ctx.get("typert").register(CONTRIBUTION), `im-gateway: typert contribution ${PACKAGE}`);
+}
+//#endregion
+//#region src/index.ts
+/**
+* Plugin-level dependency declaration: the bundle waits for these host
+* services before apply runs (mirrors the official dsh-skill-viewer host:
+* `export const inject = ["typert", ...]`). `imGateway` (our own core
+* service) is created inside apply and waited on via ctx.inject below.
+*/
+const inject = ["typert", "settings"];
+/** Settings namespace for the whole IM bundle (web UI renders `channels[]`). */
+const NS = settingsNamespace("im-gateway");
+/**
+* Single-entry IM gateway bundle. One plugin (`@lijian-ui/dsh-im-gateway`) provides the
+* core gateway service AND every channel (DingTalk / QQ / 个人微信) as
+* INSTANCES: `config.channels` is an array, and the same channel type may
+* appear multiple times (multi-bot support, mirroring pi-desk-top). Only
+* `enabled` instances connect out.
+*/
+function apply(ctx, config) {
+	installConsoleLoggerExporter(ctx);
+	installSettingsSection(ctx, NS, Config, config, {
+		setSource: () => {},
+		onChange: () => {}
+	});
+	ctx.plugin(ImGatewayService, config);
+	registerRemoteApi(ctx);
+	ctx.inject(["imGateway"], (sctx) => {
+		syncChannels(sctx.imGateway, sctx, config);
+	});
+}
+/**
+* Route every cordis logger message to the native console so IM gateway logs
+* actually reach the terminal. Without this, `ctx.logger.*` only lands in
+* cordis's in-memory buffer (its default exporter) and is invisible while
+* debugging. Message shape: { name, type, level, args, ... }.
+*/
+function installConsoleLoggerExporter(ctx) {
+	try {
+		ctx.root.logger?.exporter?.({
+			colors: 0,
+			export: (message) => {
+				const { name = "im-gateway", type = "log", args = [] } = message;
+				const line = `[${name}] ${args.map((arg) => arg instanceof Error ? arg.stack ?? arg.message : typeof arg === "string" ? arg : (() => {
+					try {
+						return JSON.stringify(arg);
+					} catch {
+						return String(arg);
+					}
+				})()).join(" ")}`;
+				if (type === "error") console.error(line);
+				else if (type === "warn") console.warn(line);
+				else if (type === "debug") console.debug(line);
+				else console.info(line);
+			}
+		});
+	} catch {}
+}
+//#endregion
+export { Config, apply, inject };