@mhfire/dsh-im-bridge 0.3.0 → 0.4.2

package/README.en.md

@@ -14,7 +14,7 @@ One DSH session maps to one WeCom chat window, not “every window of the same u
 
 - **1:1**: `single:<userid>` — one Agent for that user
 - **Group**: `group:<chatid>` — all members share one Agent and one serial queue (two people speaking at once still cannot concurrent-`followup`)
-- `allowFrom` still filters by **sender** userid; rejected senders are not enqueued
+- `allowFrom` filters **who may chat** by sender userid; empty = enqueue everyone. Office commands use `wecomCli.allowFrom` separately
 - Leading `@nickname` mentions are stripped on arrival, so both the model input and the title read `测试一下` instead of `@MediaAgent 测试一下`. Mentions later in the text stay, and a message that is nothing but mentions goes to the model unchanged
 - Process restart continues the same durable session via a stable `wecom-` + short hash of the key: adopt a live Agent if the process already has one (for example the browser already opened that row), `resume` from persistence otherwise, and `create` only when neither exists. Resume cwd / preset follow the archive, not the current config; a cwd mismatch logs a warning and is not rewritten.
 - The GUI title is `企微·私聊` / `企微·群` plus the first user prompt (the same automatic title as other sessions), not a userid / chatid; two windows of the same kind with similar first lines stay two sidebar rows
@@ -23,7 +23,7 @@ One DSH session maps to one WeCom chat window, not “every window of the same u
 
 ## Compatible DeepSeek Harness versions
 
-DeepSeek Harness is still a developer preview and makes **no semver compatibility promise** to out-of-tree plugins. Package 0.3.0 is aligned to published tags by the APIs it actually calls:
+DeepSeek Harness is still a developer preview and makes **no semver compatibility promise** to out-of-tree plugins. Package 0.4.2 is aligned to published tags by the APIs it actually calls:
 
 | DSH | This package |
 |---|---|
@@ -40,7 +40,7 @@ Pin `dsh` to `0.1.0-rc.8` or later, for example `npx @deepseek-ai/dsh@0.1.1-rc.2
 ```powershell
 dsh plugin --profile web add @mhfire/dsh-im-bridge
 # Or pin a version:
-# dsh plugin --profile web add @mhfire/dsh-im-bridge@0.3.0
+# dsh plugin --profile web add @mhfire/dsh-im-bridge@0.4.2
 ```
 
 In `$DSH_HOME/profiles/web/cordis.patch.yml` (or your profile), supply credentials only (other fields ship as bundle defaults and can be overridden):
@@ -81,7 +81,7 @@ Fields, top to bottom:
 | Welcome message | `welcomeMessage` | Applies on the next message |
 | WeCom-only provider / model | `provider` / `model` | Applies only to **later new** WeCom-window sessions; both must be set to override, otherwise the GUI default model is used |
 
-`workspace`, `agentPreset`, `persona` / `personaFile`, `thinking`, `maxReplyBytes`, and `reasoningEffort` are not on the card; set them in the profile patch or the table below. This release does not hot-reconnect credentials.
+`workspace`, `agentPreset`, `persona` / `personaFile`, `thinking`, `maxReplyBytes`, `reasoningEffort`, and `wecomCli` are not on the card; set them in the profile patch or the table below. This release does not hot-reconnect credentials; changing `wecomCli` also requires a process restart.
 
 ## Configuration
 
@@ -91,7 +91,7 @@ The bundle `cordis.patch.yml` supplies defaults for every field except `botId` /
 |---|---|
 | `botId` / `secret` | WeCom AI Bot credentials (`role('secret')`, redacted in UI); when empty, WeCom side is skipped and the host keeps running |
 | `workspace` | Agent working directory (session cwd) |
-| `allowFrom` | Allowed sender userids; empty = allow everyone |
+| `allowFrom` | Chat allow-list; empty = everyone may ask. Does not gate wecom-cli |
 | `agentTimeoutSec` | Max seconds per task; also drives progress / ETA |
 | `startHint` | Placeholder text when processing starts |
 | `agentPreset` | Agent preset to mount (default `standard`) |
@@ -101,6 +101,7 @@ The bundle `cordis.patch.yml` supplies defaults for every field except `botId` /
 | `maxReplyBytes` | Reply size cap in bytes (default 20000) |
 | `deniedMessage` | Reply when the sender is not on `allowFrom` (editable in Settings) |
 | `welcomeMessage` | Welcome text on `enter_chat` (editable in Settings) |
+| `wecomCli` | Optional WeCom office skills (off by default). See the next section |
 | `thinking` | Streaming animation. Precedence: tool activity (`toolLabels`) > model stream phase (`reasoningStatus` / `outputStatus` from `assistant/chunk`) > timed `phases` fallback; also `spin` / `reasoningSpin` / `outputSpin` / `eggs` |
 
 To give WeCom a different model from the GUI, set both in the profile `cordis.patch.yml`:
@@ -130,6 +131,41 @@ thinking:
     pwsh: PowerShell
 ```
 
+## WeCom office skills (wecom-cli)
+
+The plugin depends on the official [`@wecom/cli`](https://www.npmjs.com/package/@wecom/cli) binary. Install `wecomcli-*` under **`$DSH_HOME/wecom-cli-skills`** (not workspace `.dsh/skills` / `.agents/skills`, and not `$DSH_HOME/skills`). Only the **office userid’s 1:1** agent gets the office layer: `skills.register()` for the catalog and `tools.register()` for the gated `wecom_cli` tool. Both go through that agent’s own ctx, so group chats and the GUI never see them. Other workspace skills stay on `skill-filesystem`.
+
+Office commands run **only through the `wecom_cli` tool**: the model passes `argv` (the arguments after `wecom-cli`), the plugin spawns the official binary directly, and any `auth init` is refused. The `wecom-cli` on PATH is a shim that prints a refusal and exits 1, so group chats, the GUI, and any `pwsh wecom-cli` fail; the shim’s message points back at `wecom_cli`. The credential directory is never exported to the process environment — it is injected per spawn.
+
+`wecomCli.enabled` is off by default. Turning it on requires a non-empty **`wecomCli.allowFrom`** (office userids). Root `allowFrom` only gates who may chat; empty means everyone may ask. An empty office list logs a warning and skips the shim / auth.
+
+One-time setup:
+
+1. Leave root `allowFrom` empty (everyone may ask) and put **office** userids in `wecomCli.allowFrom` (do not leave that empty)
+2. In **Settings → Plugins → WeCom Bridge**, click **Install official skills** (the Host downloads the official repo zip into `$DSH_HOME/wecom-cli-skills`). **Do not** use `npx skills add -g` (it leaks into the GUI). The skills CLI has **no `--dir`**, so that flag does not write into the plugin directory. If `wecomcli-*` folders already sit in the workspace, move them here and delete the workspace copies. You can also copy official `skills/wecomcli-*` into `$DSH_HOME/wecom-cli-skills` by hand.
+
+3. Enable it in the profile `cordis.patch.yml` (the plugin then writes wecom-cli credentials from the existing `botId` / `secret` via hidden `auth init --bot-id/--secret`; no QR scan and no `npm install -g @wecom/cli`):
+
+```yaml
+- id: im-bridge
+  config:
+    allowFrom: []
+    wecomCli:
+      enabled: true
+      allowFrom: ["<office userid>"]
+      # skillsDir: ''   # empty = $DSH_HOME/wecom-cli-skills
+      # configDir: ''   # empty = <workspace>/.dsh/wecom-cli; gitignore this directory
+```
+
+| Field | Description |
+|---|---|
+| `wecomCli.enabled` | Install the PATH deny shim, run the auth check, and wire the prompt plus the `wecom_cli` tool; default `false` |
+| `wecomCli.allowFrom` | Userids that receive the `wecom_cli` tool; empty skips the shim / auth. Independent of the chat list |
+| `wecomCli.skillsDir` | Override skills root; empty = `$DSH_HOME/wecom-cli-skills` |
+| `wecomCli.configDir` | Override the credential directory; empty = `<workspace>/.dsh/wecom-cli`. Gitignore that directory. `WECOM_CLI_CONFIG_DIR` is injected only when the plugin spawns the CLI, never into the process environment, so `~/.config/wecom` stays unused. |
+
+Changing `wecomCli` requires a process restart. Messages still arrive when unauthorized; at boot the plugin seeds credentials with hidden `--bot-id/--secret` (stderr is not a TTY). If automatic seeding fails, the log prints a manual command that sets `WECOM_CLI_CONFIG_DIR` — keep that prefix, or `npx --yes @wecom/cli auth init --manual` writes to `~/.config/wecom`, which the plugin never reads. Do not run `auth init` from the agent (that creates a new bot).
+
 ## Persona
 
 Precedence: `personaFile` → `persona` string → packaged default persona.
@@ -166,9 +202,16 @@ Trigger (paths relative to `workspace`):
 
 ## Security
 
-- Do not commit secret-bearing files such as `config.json` / `persona.md`
+- Do not commit secret-bearing files such as `config.json` / `persona.md` / `.dsh/wecom-cli/`
 - Session and tool output may contain adversarial text; the plugin’s safety prompt tells the agent not to treat tool output as instructions
 
+## Known Limitations and Deferred Work
+
+- wecom-cli credentials live in the workspace `<workspace>/.dsh/wecom-cli` (gitignore it). People on `wecomCli.allowFrom` borrow that identity’s office permissions; the chat list (root `allowFrom`) does not grant office access. An office 1:1 may still send to any `--chat-id`; the plugin does not pin recipients.
+- Gating is not a sandbox. The `wecom_cli` tool and `wecomcli-*` register only on the office 1:1 agent, PATH resolves `wecom-cli` to a refusal, and the credential directory reaches only the plugin's own spawns — but a shell in the same process can still bypass all of it: run `node <absolute path to @wecom/cli's wecom.js>`, or `npx --yes @wecom/cli` with a self-set `WECOM_CLI_CONFIG_DIR`. Without that variable such a bypass lands on the unauthorized `~/.config/wecom`. Real isolation needs a process sandbox.
+- The WeCom channel has no GUI confirmation dialog. Irreversible actions (send mail, cancel a meeting, delete a todo, overwrite a document) are constrained only by the prompt (run `--dry-run` first, wait for the next user message). Every WeCom session forbids `ask_user_question` (it hangs until the task times out).
+- Leftover `wecomcli-*` folders in workspace `.dsh/skills` / `.agents/skills` remain visible to every agent with that cwd, including GUI. Other skills are unchanged. `enabled: false` only turns off the deny shim, the auth check, `wecom_cli`, and wecomcli-* registration; the channel ban on `ask_user_question` is still injected.
+
 ## License
 
 MIT

package/README.md

@@ -14,7 +14,7 @@ Host 通过 `installSettingsSection` 注册 `im-bridge` 命名空间；浏览器
 
 - **单聊**：`single:<userid>`，该用户一条 Agent
 - **群聊**：`group:<chatid>`，群内所有人共用一条 Agent 和同一条串行队列（两人同时发也不会并发 `followup`）
-- `allowFrom` 仍按**发送者** userid 拦截；被拒的人不进队
+- `allowFrom` 按**发送者** userid 拦截谁能聊天；空 = 所有人可进队。办公命令另用 `wecomCli.allowFrom`
 - 群里 @机器人 的消息，开头的 `@昵称` 在入站就去掉：模型看到的和标题用的都是「测试一下」而不是「@MediaAgent 测试一下」；正文中间的 @某人 保留，整条只有 @ 时按原文交给模型
 - 进程重启后用稳定 id `wecom-` + key 的短 hash 续上同一条会话：进程里已有活 Agent 就直接采用（例如浏览器已打开该行），存档里有就 `resume`，都没有才 `create`。resume 的 cwd / preset 跟存档，不跟当前配置；cwd 不一致时打警告，不改写。
 - GUI 标题为「企微·私聊/群」+ 第一句用户话（与其它会话一样由 DSH 生成），不再露出 userid / chatid；同类型窗口若第一句话相近，侧栏仍是两行
@@ -23,7 +23,7 @@ Host 通过 `installSettingsSection` 注册 `im-bridge` 命名空间；浏览器
 
 ## 兼容的 DeepSeek Harness 版本
 
-DeepSeek Harness 仍是 developer preview，对外置插件**没有 semver 兼容承诺**。本包 0.3.0 按实际调用的 API 对齐已发布 tag：
+DeepSeek Harness 仍是 developer preview，对外置插件**没有 semver 兼容承诺**。本包 0.4.2 按实际调用的 API 对齐已发布 tag：
 
 | DSH | 本包 |
 |---|---|
@@ -40,7 +40,7 @@ DeepSeek Harness 仍是 developer preview，对外置插件**没有 semver 兼
 ```powershell
 dsh plugin --profile web add @mhfire/dsh-im-bridge
 # 或钉版本：
-# dsh plugin --profile web add @mhfire/dsh-im-bridge@0.3.0
+# dsh plugin --profile web add @mhfire/dsh-im-bridge@0.4.2
 ```
 
 在 `$DSH_HOME/profiles/web/cordis.patch.yml`（或对应 profile）中补密钥即可（其余项已有 bundle 默认，可按需覆盖）：
@@ -81,7 +81,7 @@ dsh plugin --profile web add <本包路径>
 | 进入会话欢迎语 | `welcomeMessage` | 下一轮消息生效 |
 | 企微专用 provider / model | `provider` / `model` | 只影响之后**新建**的企微窗口会话；须两项都填才覆盖，否则跟随 GUI 默认模型 |
 
-`workspace`、`agentPreset`、`persona` / `personaFile`、`thinking`、`maxReplyBytes`、`reasoningEffort` 不在卡片上，仍在 profile patch 或下表中配置。本版本不做凭证热重连。
+`workspace`、`agentPreset`、`persona` / `personaFile`、`thinking`、`maxReplyBytes`、`reasoningEffort`、`wecomCli` 不在卡片上，仍在 profile patch 或下表中配置。本版本不做凭证热重连；改 `wecomCli` 也须重启进程。
 
 ## 配置项
 
@@ -91,7 +91,7 @@ bundle 的 `cordis.patch.yml` 已为除 `botId` / `secret` 外的字段提供默
 |---|---|
 | `botId` / `secret` | 企业微信智能机器人凭证（`role('secret')`，UI 自动脱敏）；缺省时跳过企微侧，不阻塞主进程 |
 | `workspace` | Agent 工作目录（会话 cwd） |
-| `allowFrom` | 允许的发送者 userid 白名单；空 = 允许所有人 |
+| `allowFrom` | 聊天白名单；空 = 允许所有人问诊断。不控制 wecom-cli |
 | `agentTimeoutSec` | 单任务最长执行时间（秒），动画进度条/剩余估算的基准 |
 | `startHint` | 开始处理时的占位提示语 |
 | `agentPreset` | Agent 加入的 preset（默认 `standard`） |
@@ -101,6 +101,7 @@ bundle 的 `cordis.patch.yml` 已为除 `botId` / `secret` 外的字段提供默
 | `maxReplyBytes` | 回复上限（字节，默认 20000） |
 | `deniedMessage` | 非白名单用户的拒绝文案（Settings 可编） |
 | `welcomeMessage` | 进入会话欢迎语（Settings 可编） |
+| `wecomCli` | 可选的企业微信办公能力（默认关闭）。见下一节 |
 | `thinking` | 流式动画。优先级：工具活动（`toolLabels`）> 模型流式阶段（`reasoningStatus` / `outputStatus`，来自 `assistant/chunk`）> 时间轴 `phases` 兜底；另有 `spin` / `reasoningSpin` / `outputSpin` / `eggs` 等 |
 
 企微与 GUI 使用不同模型时，在 profile `cordis.patch.yml` 同时填写：
@@ -130,6 +131,41 @@ thinking:
     pwsh: PowerShell
 ```
 
+## 企业微信办公能力（wecom-cli）
+
+插件依赖官方 [`@wecom/cli`](https://www.npmjs.com/package/@wecom/cli) 二进制。`wecomcli-*` 装在 **`$DSH_HOME/wecom-cli-skills`**（不要装进工作区 `.dsh/skills` / `.agents/skills`，也不要装进 `$DSH_HOME/skills`）。插件只在**办公 userid 的单聊** Agent 上注入：`skills.register()` 装 catalog，`tools.register()` 装门控工具 `wecom_cli`。两者都走该 Agent 自己的 ctx，群聊与 GUI 看不到。工作区里其它 skill 仍由 `skill-filesystem` 发现，不受影响。
+
+办公命令**只经 `wecom_cli` 工具执行**：模型传 `argv`（`wecom-cli` 之后的参数数组），插件直接 spawn 官方二进制，并拒绝任何 `auth init`。PATH 上的 `wecom-cli` 是一个只打印拒绝信息并 `exit 1` 的 shim，所以群聊、GUI 以及任何 `pwsh wecom-cli` 都跑不通；shim 的文案会指回 `wecom_cli`。凭证目录不进程级导出，只在插件自己 spawn 时注入。
+
+`wecomCli.enabled` 默认关闭。开启须同时配置非空 **`wecomCli.allowFrom`**（办公 userid）；根级 `allowFrom` 只管谁能聊天，空名单表示所有人可问诊断。办公名单为空时插件会告警并跳过 shim / 授权 / `wecom_cli`。
+
+一次性准备：
+
+1. 根级 `allowFrom` 留空（所有人可问诊断），把 **办公** userid 写进 `wecomCli.allowFrom`（不要留空）
+2. 在 **Settings → 插件配置 → 企业微信桥接** 点「安装官方 skills」（Host 下载官方仓库 zip，解到 `$DSH_HOME/wecom-cli-skills`）。**不要用** `npx skills add -g`（会泄漏给 GUI）；skills CLI **没有 `--dir`**，加了也不会写到程序目录。若工作区里已有 `wecomcli-*`，先挪到该目录再删工作区副本。也可手动把官方仓库 `skills/wecomcli-*` 拷进 `$DSH_HOME/wecom-cli-skills`。
+
+3. 在 profile `cordis.patch.yml` 打开（启用后插件会用已有 `botId` / `secret` 走 `auth init --bot-id/--secret` 写入 wecom-cli 凭据，不必扫码、不必 `npm install -g @wecom/cli`）：
+
+```yaml
+- id: im-bridge
+  config:
+    allowFrom: []
+    wecomCli:
+      enabled: true
+      allowFrom: ["<办公 userid>"]
+      # skillsDir: ''   # 空 = $DSH_HOME/wecom-cli-skills
+      # configDir: ''   # 空 = <workspace>/.dsh/wecom-cli；请 gitignore
+```
+
+| 字段 | 说明 |
+|---|---|
+| `wecomCli.enabled` | 装 PATH 拒绝 shim、跑授权检查、给企微 Agent 接上 prompt 与 `wecom_cli` 工具；默认 `false` |
+| `wecomCli.allowFrom` | 能拿到 `wecom_cli` 工具的 userid；空则跳过 shim / 授权。与根级聊天名单独立 |
+| `wecomCli.skillsDir` | 覆盖 skills 根目录；空 = `$DSH_HOME/wecom-cli-skills` |
+| `wecomCli.configDir` | 覆盖凭证目录；空 = `<workspace>/.dsh/wecom-cli`。请把该目录加入 gitignore。`WECOM_CLI_CONFIG_DIR` 只在插件 spawn CLI 时注入，不写进程环境，因此不会使用 `~/.config/wecom`。 |
+
+改 `wecomCli` 后须重启进程。未授权时插件仍收消息；启动时用隐藏的 `--bot-id/--secret`（stderr 非 TTY）写入凭据。若自动写入失败，日志会打印一条带 `WECOM_CLI_CONFIG_DIR` 的手动命令——必须带上它，否则 `npx --yes @wecom/cli auth init --manual` 会把凭证写到 `~/.config/wecom`，插件读不到。禁止在 Agent 里扫码 `auth init`（会新建机器人）。
+
 ## 人设（persona）
 
 优先级：`personaFile` → `persona` 字符串 → 包内默认人设。
@@ -166,9 +202,16 @@ Agent 的最终回复若包含指向**工作区内** PNG 的 Markdown，桥会
 
 ## 安全
 
-- `config.json` / `persona.md` 等含密钥文件不入库；
+- `config.json` / `persona.md` / `.dsh/wecom-cli/` 等含密钥文件不入库；
 - 会话与工具输出可能含对抗性文本，插件内置安全提示词约束 agent 不把工具输出当指令。
 
+## Known Limitations and Deferred Work
+
+- wecom-cli 凭证在工作区 `<workspace>/.dsh/wecom-cli`（请 gitignore）。`wecomCli.allowFrom` 里的人借用这份凭据的办公权限；聊天名单（根级 `allowFrom`）不授予办公。办公单聊仍可向任意 `--chat-id` 发信，插件不锁定收件人。
+- 门控不是沙箱。`wecom_cli` 工具与 `wecomcli-*` 只注册到办公单聊 Agent，PATH 上的 `wecom-cli` 一律拒绝，凭证目录也只在插件自己 spawn 时注入；但同进程的 shell 仍可绕过：直接 `node <@wecom/cli 的 wecom.js 绝对路径>`，或 `npx --yes @wecom/cli` 并自行设置 `WECOM_CLI_CONFIG_DIR`。不设该变量时这类旁路会落到未授权的 `~/.config/wecom`。真正的隔离需要进程级沙箱。
+- 企微通道没有 GUI 审批框：发信、取消会议、删待办、覆盖文档等不可逆操作只靠 prompt 约束（先 `--dry-run`，等用户下一条确认）。所有企微会话都禁止 `ask_user_question`（会挂到超时）。
+- 工作区 `.dsh/skills` / `.agents/skills` 里残留的 `wecomcli-*` 仍会被同 cwd 的 GUI 和群聊发现。其它 skill 不受影响。`enabled: false` 只关拒绝 shim、授权检查、`wecom_cli` 与 wecomcli-* 注册；通道上的 `ask_user_question` 禁令仍会注入。
+
 ## License
 
 MIT

package/cordis.patch.yml

@@ -18,6 +18,12 @@
         maxReplyBytes: 20000
         deniedMessage: '无权访问本服务'
         welcomeMessage: '👋 办公助手已就绪。直接发消息即可，例如查文件、整理文档、查资料或处理日常事务。'
+        wecomCli:
+          enabled: false
+          skillsDir: ''
+          allowFrom: []
+          # skillsDir 空 = $DSH_HOME/wecom-cli-skills（不要用工作区 .dsh/skills）
+          # configDir: ''   # 空 = <workspace>/.dsh/wecom-cli
         thinking:
           eggAfterSec: 240
           intervalMs: 1500

package/lib/client.js

@@ -115,7 +115,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region \0dsh-css:C:\Users\user\Desktop\dsh-im-bridge\plugin\src\client\fields.module.css.mjs
-		const css = ".OMD7cq_field{flex-direction:column;gap:6px;padding:12px 0;display:flex}.OMD7cq_field+.OMD7cq_field{border-top:1px solid var(--dsw-alias-border-l2)}.OMD7cq_head{align-items:center;gap:8px;display:flex}.OMD7cq_label{min-width:0;color:var(--dsw-alias-label-primary);flex:1;font-size:13px;font-weight:500;line-height:1.5}.OMD7cq_badges{align-items:center;gap:8px;display:inline-flex}.OMD7cq_badge{white-space:nowrap;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-secondary);border-radius:999px;padding:1px 8px;font-size:11px;font-weight:500;line-height:17px}.OMD7cq_badgeMuted{white-space:nowrap;color:var(--dsw-alias-label-tertiary);border-radius:999px;padding:1px 8px;font-size:11px;line-height:17px}.OMD7cq_reset{font:inherit;color:var(--dsw-alias-label-secondary);cursor:pointer;background:0 0;border:none;padding:0;font-size:12px;line-height:1.5}.OMD7cq_reset:hover:not(:disabled){color:var(--dsw-alias-label-primary)}.OMD7cq_reset:disabled{cursor:default}.OMD7cq_input{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);height:34px;font:inherit;color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 12px;font-size:13px;line-height:1.5}.OMD7cq_input:focus-visible{border-color:var(--dsw-alias-brand-primary);outline:none}.OMD7cq_input:disabled{color:var(--dsw-alias-label-tertiary);cursor:default}.OMD7cq_inputInvalid{border:1px solid var(--dsw-alias-label-error);background:var(--dsw-alias-bg-layer-3);height:34px;font:inherit;color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 12px;font-size:13px;line-height:1.5}.OMD7cq_inputInvalid:focus-visible{outline:none}.OMD7cq_invalid{color:var(--dsw-alias-label-error);margin:0;font-size:12px;line-height:1.5}.OMD7cq_hint{color:var(--dsw-alias-label-tertiary);margin:0;font-size:12px;line-height:1.5}";
+		const css = ".OMD7cq_field{flex-direction:column;gap:6px;padding:12px 0;display:flex}.OMD7cq_field+.OMD7cq_field{border-top:1px solid var(--dsw-alias-border-l2)}.OMD7cq_head{align-items:center;gap:8px;display:flex}.OMD7cq_label{min-width:0;color:var(--dsw-alias-label-primary);flex:1;font-size:13px;font-weight:500;line-height:1.5}.OMD7cq_badges{align-items:center;gap:8px;display:inline-flex}.OMD7cq_badge{white-space:nowrap;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-secondary);border-radius:999px;padding:1px 8px;font-size:11px;font-weight:500;line-height:17px}.OMD7cq_badgeMuted{white-space:nowrap;color:var(--dsw-alias-label-tertiary);border-radius:999px;padding:1px 8px;font-size:11px;line-height:17px}.OMD7cq_reset{font:inherit;color:var(--dsw-alias-label-secondary);cursor:pointer;background:0 0;border:none;padding:0;font-size:12px;line-height:1.5}.OMD7cq_reset:hover:not(:disabled){color:var(--dsw-alias-label-primary)}.OMD7cq_reset:disabled{cursor:default}.OMD7cq_input{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);height:34px;font:inherit;color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 12px;font-size:13px;line-height:1.5}.OMD7cq_input:focus-visible{border-color:var(--dsw-alias-brand-primary);outline:none}.OMD7cq_input:disabled{color:var(--dsw-alias-label-tertiary);cursor:default}.OMD7cq_input::placeholder{color:var(--dsw-alias-label-tertiary)}.OMD7cq_inputInvalid{border:1px solid var(--dsw-alias-label-error);background:var(--dsw-alias-bg-layer-3);height:34px;font:inherit;color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 12px;font-size:13px;line-height:1.5}.OMD7cq_inputInvalid:focus-visible{outline:none}.OMD7cq_invalid{color:var(--dsw-alias-label-error);margin:0;font-size:12px;line-height:1.5}.OMD7cq_hint{color:var(--dsw-alias-label-tertiary);margin:0;font-size:12px;line-height:1.5}.OMD7cq_install{appearance:none;font:inherit;cursor:pointer;background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);border:1px solid #0000;border-radius:8px;align-self:flex-start;padding:5px 14px;font-size:13px;line-height:1.5}.OMD7cq_install:hover:not(:disabled){opacity:.92}.OMD7cq_install:disabled{opacity:.4;cursor:default}.OMD7cq_install:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:1px}";
 		const tagId = "@mhfire/dsh-im-bridge/fields.module.css";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
 			const tag = document.createElement("style");
@@ -133,6 +133,7 @@ window.__ModuleLoader__.load({
 			"hint": "OMD7cq_hint",
 			"input": "OMD7cq_input",
 			"inputInvalid": "OMD7cq_inputInvalid",
+			"install": "OMD7cq_install",
 			"invalid": "OMD7cq_invalid",
 			"label": "OMD7cq_label",
 			"reset": "OMD7cq_reset"
@@ -189,7 +190,8 @@ window.__ModuleLoader__.load({
 		}
 		/**
 		* Write-only credential control. The literal never rides a response, so the
-		* control starts blank and reports only whether one is configured.
+		* control starts blank and reports only whether one is configured. A configured
+		* empty draft shows a dots placeholder so the box does not look unset.
 		* @param props - the field's copy, staged text, and configured state.
 		* @returns the labelled control.
 		*/
@@ -217,6 +219,7 @@ window.__ModuleLoader__.load({
 						type: "password",
 						autoComplete: "off",
 						value: props.text,
+						placeholder: props.configured && props.text === "" ? "••••••••" : void 0,
 						disabled: props.disabled,
 						onChange: (event) => {
 							props.onEdit(event.target.value);
@@ -278,6 +281,16 @@ window.__ModuleLoader__.load({
 							props.edit("secret", text);
 						}
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SkillsInstall, {
+						t,
+						disabled,
+						available: state.skillsInstallAvailable,
+						status: state.skillsInstallStatus,
+						dest: state.skillsDest,
+						count: state.skillsCount,
+						error: state.skillsError,
+						onInstall: props.installSkills
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ValueField, {
 						id: "im-bridge-allowFrom",
 						label: t("allowFrom"),
@@ -373,6 +386,44 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		function skillsStatusText(t, status, dest, count, error, available) {
+			if (!available) return t("skillsUnavailable");
+			if (status === "ok") return t("skillsInstalled").replace("{count}", String(count)).replace("{dest}", dest);
+			if (status === "error") return error === "" ? t("skillsFailed") : `${t("skillsFailed")} ${error}`;
+			return t("skillsHint");
+		}
+		/**
+		* Host-side install of official wecomcli-* (browser never chooses the path).
+		* @param props - copy, status, and the install action.
+		* @returns the labelled control.
+		*/
+		function SkillsInstall(props) {
+			const installing = props.status === "installing";
+			const status = skillsStatusText(props.t, props.status, props.dest, props.count, props.error, props.available);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: fields_module_css_default.field,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: fields_module_css_default.head,
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: fields_module_css_default.label,
+							children: props.t("skillsTitle")
+						})
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: fields_module_css_default.install,
+						disabled: props.disabled || !props.available || installing,
+						onClick: props.onInstall,
+						children: props.t(installing ? "skillsInstalling" : "skillsInstall")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: props.status === "error" || !props.available ? fields_module_css_default.invalid : fields_module_css_default.hint,
+						children: status
+					})
+				]
+			});
+		}
 		//#endregion
 		//#region src/client/card-form.ts
 		/**
@@ -577,6 +628,10 @@ window.__ModuleLoader__.load({
 				this.failed = false;
 				this.publish();
 			}
+			/** Rebuild bound projections for card-owned state outside the settings draft. */
+			notify() {
+				this.publish();
+			}
 			spec(field) {
 				const spec = this.specs.get(field);
 				if (spec === void 0) throw new Error(`im-bridge card has no field ${field}`);
@@ -610,15 +665,22 @@ window.__ModuleLoader__.load({
 		var WecomCardController = class {
 			scope;
 			describe;
+			rpc;
 			form;
 			store;
+			skillsInstallStatus = "idle";
+			skillsDest = "";
+			skillsCount = 0;
+			skillsError = "";
 			/**
 			* @param scope - bound settings scope for the `im-bridge` namespace.
 			* @param describe - Host describe face; secret literals never ride it.
+			* @param rpc - optional Connection RPC for the skills install button.
 			*/
-			constructor(scope, describe) {
+			constructor(scope, describe, rpc) {
 				this.scope = scope;
 				this.describe = describe;
+				this.rpc = rpc;
 				this.form = new CardForm(scope, [
 					csvField("allowFrom"),
 					numberField("agentTimeoutSec"),
@@ -649,7 +711,12 @@ window.__ModuleLoader__.load({
 					deniedMessage: this.form.field("deniedMessage"),
 					welcomeMessage: this.form.field("welcomeMessage"),
 					provider: this.form.field("provider"),
-					model: this.form.field("model")
+					model: this.form.field("model"),
+					skillsInstallAvailable: this.rpc !== void 0,
+					skillsInstallStatus: this.skillsInstallStatus,
+					skillsDest: this.skillsDest,
+					skillsCount: this.skillsCount,
+					skillsError: this.skillsError
 				};
 			}
 			/**
@@ -670,11 +737,45 @@ window.__ModuleLoader__.load({
 				await this.scope.set(field, text);
 				return this.secretConfigured(field);
 			}
+			/**
+			* Download official wecomcli-* into the Host-resolved directory.
+			* The browser does not choose the path.
+			*/
+			installSkills() {
+				this.runInstall();
+			}
+			async runInstall() {
+				if (this.rpc === void 0 || this.skillsInstallStatus === "installing") return;
+				this.skillsInstallStatus = "installing";
+				this.skillsError = "";
+				this.form.notify();
+				try {
+					const result = await this.rpc.call("/im-bridge", "wecomcli.installSkills", {});
+					if (!result.ok) {
+						this.skillsInstallStatus = "error";
+						this.skillsError = result.error.message;
+						this.form.notify();
+						return;
+					}
+					const value = result.value;
+					this.skillsInstallStatus = "ok";
+					this.skillsDest = typeof value.dest === "string" ? value.dest : "";
+					this.skillsCount = typeof value.count === "number" ? value.count : 0;
+					this.skillsError = "";
+				} catch (error) {
+					this.skillsInstallStatus = "error";
+					this.skillsError = error instanceof Error ? error.message : String(error);
+				}
+				this.form.notify();
+			}
 			/** Face the slot registration injects. */
 			inject() {
 				return {
 					hooks: { wecomCard: this.store },
-					...this.form.actions()
+					...this.form.actions(),
+					installSkills: () => {
+						this.installSkills();
+					}
 				};
 			}
 		};
@@ -697,7 +798,7 @@ window.__ModuleLoader__.load({
 			invalidNumber: "Enter a finite number.",
 			botId: "Bot ID",
 			secret: "Secret",
-			secretHint: "Leave blank to keep the stored value. Save, then restart the process to open the WebSocket.",
+			secretHint: "The box stays empty on purpose (the stored value never rides the wire). A Configured badge means it is saved; type a new value to replace it. Save, then restart the process to open the WebSocket.",
 			secretConfigured: "Configured",
 			secretUnset: "Not configured",
 			allowFrom: "Allowed sender userids",
@@ -713,7 +814,14 @@ window.__ModuleLoader__.load({
 			provider: "WeCom-only provider",
 			providerHint: "Empty follows the GUI default model. Both provider and model must be set to override.",
 			model: "WeCom-only model",
-			modelHint: "Takes effect only together with provider."
+			modelHint: "Takes effect only together with provider.",
+			skillsTitle: "WeCom office skills",
+			skillsHint: "Installs wecomcli-* into the plugin directory ($DSH_HOME/wecom-cli-skills). Do not use npx skills add -g; that CLI has no --dir. An empty Bot ID / Secret box is normal.",
+			skillsInstall: "Install official skills",
+			skillsInstalling: "Installing…",
+			skillsInstalled: "Installed {count} skills into {dest}",
+			skillsFailed: "Install failed.",
+			skillsUnavailable: "Install needs the Web host Connection."
 		};
 		/** Chinese copy for the im-bridge card. */
 		const zh = {
@@ -732,7 +840,7 @@ window.__ModuleLoader__.load({
 			invalidNumber: "请输入有效数字。",
 			botId: "Bot ID",
 			secret: "Secret",
-			secretHint: "留空保留已存值。保存后需重启进程才会连 WebSocket。",
+			secretHint: "框空是正常的（已存值不会传到浏览器）。徽章「已配置」即已保存；重新输入可覆盖。保存后需重启进程才会连 WebSocket。",
 			secretConfigured: "已配置",
 			secretUnset: "未配置",
 			allowFrom: "允许的发送者 userid",
@@ -748,7 +856,14 @@ window.__ModuleLoader__.load({
 			provider: "企微专用 provider",
 			providerHint: "空 = 跟随 GUI 默认模型。须与 model 同时填写才覆盖。",
 			model: "企微专用 model",
-			modelHint: "仅在同时填写 provider 时生效。"
+			modelHint: "仅在同时填写 provider 时生效。",
+			skillsTitle: "企微办公 skills",
+			skillsHint: "装到程序目录 $DSH_HOME/wecom-cli-skills。不要用 npx skills add -g；CLI 没有 --dir。Bot ID / Secret 框空是正常的。",
+			skillsInstall: "安装官方 skills",
+			skillsInstalling: "正在安装…",
+			skillsInstalled: "已装 {count} 个到 {dest}",
+			skillsFailed: "安装失败。",
+			skillsUnavailable: "安装需要 Web Host 的 Connection。"
 		};
 		//#endregion
 		//#region src/client/index.ts
@@ -767,7 +882,8 @@ window.__ModuleLoader__.load({
 		* @param ctx - browser plugin context.
 		*/
 		function apply(ctx) {
-			const card = new WecomCardController(ctx.settingsScope.bind({ namespace: NS }), ctx.settingsScope.describe());
+			const connection = ctx.get("connection");
+			const card = new WecomCardController(ctx.settingsScope.bind({ namespace: NS }), ctx.settingsScope.describe(), connection?.rpc);
 			ctx.effect(() => ctx.locale.register(NS, {
 				zh,
 				en