@modesto_ma/dsh-channels 0.3.0 → 0.5.0-beta.1

package/src/session/manager.ts

@@ -29,6 +29,7 @@ import { appendSessionHistory, sessionDirOf } from '../domain.ts'
 import type { RouteRecord } from '../domain.ts'
 import { mountChannelGuidance } from '../feishu/agent-context.ts'
 import { attachmentsDir } from '../feishu/inbound-attachments.ts'
+import { effectiveAttachmentMode, resolveAttachmentService } from '../feishu/native-attachments.ts'
 import { installRequestPolicy } from './request-policy.ts'
 import type { RequestPolicyController } from './request-policy.ts'
 import { placementServices, restoreTopicDir } from './isolation.ts'
@@ -65,6 +66,14 @@ export interface SessionManagerDeps {
   started(): boolean
   /** Drop streamer state for a session whose owner handle is being released. */
   detachStream(sessionId: string): void
+  /**
+   * Register this channel's model tools inside one Agent scope. Called from
+   * the agent-preset `setup` after the preset is mounted (tools live inside
+   * presets in web-profile deployments), and once more for a BORROWED live
+   * agent as a best-effort race guard (D7). Optional: unit tests that do not
+   * compose model tools omit it.
+   */
+  mountTools?(agentCtx: AgentContext, sessionId: string): Promise<void> | void
   warn(message: string, ...args: unknown[]): void
 }
 
@@ -82,6 +91,8 @@ export class SessionManager {
   private readonly live = new Map<string, LiveAgent>()
   private readonly pendingResume = new Map<string, Promise<LiveAgent>>()
   private readonly policies = new WeakMap<AgentContext, RequestPolicyController>()
+  /** Agent scopes this plugin already attempted to mount model tools into. */
+  private readonly toolMounts = new WeakSet<AgentContext>()
 
   constructor(private readonly deps: SessionManagerDeps) {}
 
@@ -116,7 +127,7 @@ export class SessionManager {
     cwd: string,
     agentOptions: Record<string, unknown> = this.agentOptions(),
   ): Promise<AgentHandle> {
-    const composition = await this.presetComposition(undefined, true)
+    const composition = await this.presetComposition(undefined, true, sessionId)
     const handle = await this.deps.ctx.agents.create({
       sessionId,
       meta: {
@@ -132,15 +143,31 @@ export class SessionManager {
   }
 
   /**
-   * Register the attachment-directory guidance for one Session. Called after
-   * the effective working directory is known (a worktree checkout path is
-   * only returned once the worktree exists), so the prompt section can name
-   * the absolute directory. Best-effort: a missing system-prompt service
-   * (headless) is a no-op and a late registration never blocks the turn.
+   * Register the attachment guidance for one Session. Called after the
+   * effective working directory is known (a worktree checkout path is only
+   * returned once the worktree exists), so the archive guidance can name the
+   * absolute directory. The guidance flavor follows the *effective* attachment
+   * backend: an explicitly configured archive deployment, or a native
+   * deployment whose host does not mount `ctx.attachments`, keeps the legacy
+   * workspace-directory instructions. Best-effort: a missing system-prompt
+   * service (headless) is a no-op and a late registration never blocks the turn.
    */
   async mountGuidance(agent: Agent, directory: string): Promise<void> {
+    // With inbound attachments disabled the Agent has no attachment workflow to
+    // discover (and the legacy guidance would wrongly claim files are archived).
+    if (!this.deps.config.acceptAttachments) return
+    const mode = effectiveAttachmentMode(
+      this.deps.config.attachmentStore,
+      resolveAttachmentService(this.deps.ctx),
+      this.deps.config.feishuTools.attachmentFetch,
+      this.deps.config.acceptAttachments,
+    )
     try {
-      await mountChannelGuidance(agent.ctx, attachmentsDir(directory))
+      await mountChannelGuidance(
+        agent.ctx,
+        mode,
+        mode === 'archive' ? attachmentsDir(directory) : undefined,
+      )
     } catch (error) {
       this.deps.warn(
         'dsh-channels: mounting attachment guidance for session %s failed: %s',
@@ -166,7 +193,7 @@ export class SessionManager {
     if (own !== undefined) return own
 
     const foreign = this.deps.ctx.agents.get(sessionId as SessionId)
-    if (foreign !== undefined) return this.borrow(sessionId, foreign)
+    if (foreign !== undefined) return await this.borrow(sessionId, foreign)
 
     let pending = this.pendingResume.get(sessionId)
     if (pending === undefined) {
@@ -179,9 +206,14 @@ export class SessionManager {
   }
 
   /** Borrow one foreign live agent and mount this channel's scoped policy. */
-  private borrow(sessionId: string, agent: Agent): LiveAgent {
+  private async borrow(sessionId: string, agent: Agent): Promise<LiveAgent> {
     const borrowed = borrowLiveAgent(agent, this.mountRequestPolicy(agent.ctx, agent.session))
     this.live.set(sessionId, borrowed)
+    // Best-effort tool backfill (D7): the foreign owner may have composed the
+    // session without this plugin's setup (web UI resolver, previous plugin
+    // instance). mountToolsFor swallows failures, so the borrow itself never
+    // fails; awaiting it makes the tool available before the first turn.
+    await this.mountToolsFor(agent.ctx, sessionId)
     return borrowed
   }
 
@@ -193,7 +225,7 @@ export class SessionManager {
       // (config override or roster default). A session persisted before the
       // preset fix has no preset recorded on its header; re-resolving here is
       // what repairs it on the first resume after a restart.
-      const composition = await this.presetComposition(undefined, true)
+      const composition = await this.presetComposition(undefined, true, sessionId)
       const handle = await this.deps.ctx.agents.resume({
         resumeSessionId: sessionId,
         agentOptions: this.agentOptions(),
@@ -215,7 +247,7 @@ export class SessionManager {
       // Lost a cold-resume race: another owner published the session while our
       // resume was in flight. Borrow the winner instead of failing the turn.
       const winner = this.deps.ctx.agents.get(sessionId)
-      if (winner !== undefined) return this.borrow(sessionId, winner)
+      if (winner !== undefined) return await this.borrow(sessionId, winner)
       throw error
     }
   }
@@ -255,13 +287,13 @@ export class SessionManager {
   async renew(record: RouteRecord, oldLive: LiveAgent): Promise<RenewCommit> {
     const sessionId = randomUUID() as SessionId
     const preset = this.effectivePreset(oldLive.agent.session)
-    const composition = await this.presetComposition(preset, false)
+    const composition = await this.presetComposition(preset, false, sessionId)
     const services: PlacementServices = placementServices(this.deps.ctx)
     const switchable = services.workingDirectory !== undefined
     const workspacePath = record.workspacePath
     const workspace = await this.deps.ctx.workspaceRegistry.create(
       workspacePath,
-      workspaceTitleFor(record.chatType, record.chatId, record.senderOpenId),
+      workspaceTitleFor(record.chatType, record.chatId, record.senderUserId),
     )
 
     let newHandle: AgentHandle | undefined
@@ -358,6 +390,7 @@ export class SessionManager {
   private async presetComposition(
     requestedPreset: string | undefined = this.deps.config.agentPreset,
     useRosterDefault = true,
+    sessionId?: string,
   ): Promise<PresetComposition> {
     // Read through ctx.get (safe lookup): only the web profile ships a roster,
     // and direct property access on a cordis context throws for services the
@@ -369,6 +402,7 @@ export class SessionManager {
       // cannot guarantee that the explicit channel value wins.
       this.mountRequestPolicy(agentCtx)
       await mountChannelCommands(agentCtx)
+      if (sessionId !== undefined) await this.mountToolsFor(agentCtx, sessionId)
     }
     if (presets === undefined || (requestedPreset === undefined && !useRosterDefault)) {
       return { setup: channelCommandsOnly }
@@ -380,10 +414,30 @@ export class SessionManager {
         this.mountRequestPolicy(agentCtx)
         await presets.mount(agentCtx, resolved.id)
         await mountChannelCommands(agentCtx)
+        if (sessionId !== undefined) await this.mountToolsFor(agentCtx, sessionId)
       },
     }
   }
 
+  /**
+   * Mount the channel model tools into one Agent scope, at most once per
+   * scope. A failure is logged and swallowed: missing tools never fail a
+   * session (attachment fetch degrades to its structured failures).
+   */
+  private async mountToolsFor(agentCtx: AgentContext, sessionId: string): Promise<void> {
+    if (this.deps.mountTools === undefined) return
+    if (this.toolMounts.has(agentCtx)) return
+    try {
+      await this.deps.mountTools(agentCtx, sessionId)
+      this.toolMounts.add(agentCtx)
+    } catch (error) {
+      this.deps.warn(
+        'dsh-channels: mounting channel tools for session %s failed: %s',
+        sessionId, String(error),
+      )
+    }
+  }
+
   /** Effective preset after folding any durable runtime preset switch. */
   private effectivePreset(session: Session): string | undefined {
     let selected = session.header.agentPreset

package/src/session/routes.ts

@@ -135,8 +135,7 @@ export class RouteStore {
 
   /**
    * Retire one active thread route into a persistent tombstone regardless of
-   * the configured TTL. Used by the workspace-retention cleanup, which may
-   * close topics earlier than the route TTL.
+   * the configured TTL.
    */
   async retire(key: string, now = Date.now()): Promise<ExpiredRouteRecord | undefined> {
     const record = this.get(key)
@@ -145,7 +144,7 @@ export class RouteStore {
       key,
       chatId: record.chatId,
       chatType: record.chatType,
-      senderOpenId: record.senderOpenId,
+      senderUserId: record.senderUserId,
       expiredAt: now,
       workspacePath: record.workspacePath,
       ...(record.sessionDir === undefined ? {} : { sessionDir: record.sessionDir }),

package/src/settings/contract.ts

@@ -20,13 +20,11 @@ export const CREDENTIALS_ROUTE = '/dsh-channels/credentials'
 export const RECONNECT_ROUTE = '/dsh-channels/reconnect'
 /** 模型/推理档位/预设选择器的宿主目录（provider → model → effort 级联刷新）。 */
 export const CATALOG_ROUTE = '/dsh-channels/catalog'
-/** 手动执行一次过期目录清理（POST，无请求体）。 */
-export const CLEANUP_ROUTE = '/dsh-channels/cleanup'
 /** 访问与授权只读快照（GET/HEAD）：准入模式、管理员、群/用户白名单、待处理申请。 */
 export const ACCESS_ROUTE = '/dsh-channels/access'
 /** 群白名单增删（POST/DELETE，body `{ chatId, name? }` / `{ chatId }`）。 */
 export const ACCESS_GROUPS_ROUTE = '/dsh-channels/access/groups'
-/** 用户白名单增删（POST/DELETE，body `{ openId, name? }` / `{ openId }`）。 */
+/** 用户白名单增删（POST/DELETE，body `{ userId, name? }` / `{ userId }`）。 */
 export const ACCESS_USERS_ROUTE = '/dsh-channels/access/users'
 /** 结算一条待处理授权申请（POST，body `{ token, decision }`）。 */
 export const ACCESS_REQUESTS_ROUTE = '/dsh-channels/access/requests'
@@ -40,9 +38,10 @@ export const ACCESS_REQUESTS_ROUTE = '/dsh-channels/access/requests'
 export const PICK_DIRECTORY_ROUTE = '/dsh-channels/pick-directory'
 
 /**
- * 可由 Web 面板覆盖的配置项。全部是 `src/config.ts` 里已存在的字段；
- * 覆盖值写进 `$DSH_HOME/dsh-channels/settings.json`，优先级高于 profile
- * 的 `cordis.patch.yml`（见 README「Web 设置面板」）。
+ * 可由 Web 面板覆盖的配置项。顶层键对应 `src/config.ts` 的字段；`feishuTools.*`
+ * 是嵌套字段（覆盖层里仍写成 `{ "feishuTools": { ... } }` 对象）。覆盖值写进
+ * `$DSH_HOME/dsh-channels/settings.json`，优先级高于 profile 的
+ * `cordis.patch.yml`（见 README「Web 设置面板」）。
  *
  * 刻意不包含 `appId` / `appSecret`：它们是**凭据引用名**，面板改为直接
  * 编辑引用背后的值（`PUT /dsh-channels/credentials`，经 DSH 凭据服务写入），
@@ -55,20 +54,34 @@ export const PICK_DIRECTORY_ROUTE = '/dsh-channels/pick-directory'
 export const EDITABLE_KEYS = [
   // 工作区
   'baseDir',
-  'workspaceRetention',
-  'workspaceRetentionAuto',
   // 行为
   'dmMode',
   'requireMention',
   'threadFallback',
   'welcomeOnboarding',
+  'slashCommandPanel',
   'allowPermissionSwitch',
   // 准入与授权（管理员/准入模式/申请有效期；白名单由「访问与授权」卡片管理）
-  'adminOpenId',
+  'adminUserId',
   'accessMode',
   'authRequestTtlDays',
-  // 内容
+  // 内容与附件（v2 管线；`feishuTools.*` 是嵌套配置，覆盖层仍写成嵌套对象）
   'acceptAttachments',
+  'attachmentStore',
+  'prefetchImages',
+  'prefetchTimeoutMs',
+  'prefetchImageMaxBytes',
+  'prefetchTotalMaxBytes',
+  'historyBootstrapLimit',
+  // 模型工具（feishuTools 子项）
+  'feishuTools.attachmentFetch',
+  'feishuTools.attachmentFetchMaxResources',
+  'feishuTools.attachmentFetchMaxBytes',
+  'feishuTools.attachmentFetchTimeoutMs',
+  'feishuTools.topicMessages',
+  'feishuTools.topicMessagesTimeoutMs',
+  'feishuTools.sendFile',
+  'promptContextTimeoutMs',
   // 模型
   'provider',
   'model',
@@ -89,6 +102,7 @@ export type EditableKey = (typeof EDITABLE_KEYS)[number]
 export const RESTART_KEYS = [
   'dmMode',
   'requireMention',
+  'slashCommandPanel',
   'refreshMs',
   'statusRefreshMs',
   'loggerLevel',
@@ -104,7 +118,7 @@ export type FieldKind = 'boolean' | 'number' | 'text' | 'select'
  * panel tab (see {@link TAB_FIELD_GROUPS}); the Host is the source of truth for
  * which key belongs to which group.
  */
-export type FieldGroup = 'workspace' | 'behavior' | 'content' | 'model' | 'streaming' | 'access'
+export type FieldGroup = 'workspace' | 'behavior' | 'content' | 'tools' | 'model' | 'streaming' | 'access'
 
 /** One selectable value rendered by the generic form. */
 export interface FieldOptionWire {
@@ -249,8 +263,40 @@ export interface ChannelStatusWire {
   overlayPath: string
   /** 正在连接或重连时为 true，此时面板的写操作按钮禁用。 */
   busy: boolean
+  /** 连接后的权限自检结果；未连接或自检尚未完成时缺省。 */
+  scopeCheck?: ScopeCheckWire
+  /** 连接后飞书原生斜杠指令面板的同步结果；未连接或同步尚未完成时缺省。 */
+  slashCommandSync?: SlashCommandSyncWire
 }
 
+/** One plugin need whose scopes are all missing. */
+export interface MissingScopeWire {
+  /** Scope names, preferred first; granting any one satisfies the need. */
+  scopes: string[]
+  /** `required` breaks a core path; `optional` only degrades a feature. */
+  level: 'required' | 'optional'
+  /** What the plugin loses without it. */
+  purpose: string
+  /** Developer-console permission page filtered to the preferred scope. */
+  consoleUrl: string
+}
+
+/** Post-connect scope self-check outcome. */
+export type ScopeCheckWire =
+  /** Every applicable need is granted. */
+  | { state: 'ok'; checkedAt: number }
+  /** Some needs are missing; `consoleUrl` opens the console filtered to all of them. */
+  | { state: 'missing'; checkedAt: number; missing: MissingScopeWire[]; consoleUrl: string }
+  /** The grant list could not be read; `error` carries the Feishu reason. */
+  | { state: 'error'; checkedAt: number; error: string }
+
+/** Post-connect native slash-command panel sync outcome. */
+export type SlashCommandSyncWire =
+  /** The panel lists exactly the registry commands; counts are this sync's writes. */
+  | { state: 'ok'; checkedAt: number; created: number; updated: number; removed: number; total: number }
+  /** A Feishu call failed; `error` carries the Feishu reason. */
+  | { state: 'error'; checkedAt: number; error: string }
+
 /** The whole editable configuration surface, with provenance. */
 export interface PanelConfigWire {
   /** profile `cordis.patch.yml` 提供的值（覆盖层之下）。 */
@@ -281,9 +327,9 @@ export interface AccessGroupWire {
   addedAt: number
 }
 
-/** One authorized user `open_id` (global across every authorized group). */
+/** One authorized user `user_id` (global across every authorized group). */
 export interface AccessUserWire {
-  openId: string
+  userId: string
   /** Display name captured at authorization time. */
   name?: string
   /** Which authorization entry produced the grant. */
@@ -297,7 +343,7 @@ export interface AccessRequestWire {
   /** Opaque token; never derived from the target id. */
   token: string
   kind: 'group' | 'user'
-  /** `chat_id` for a group request, `open_id` for a user request. */
+  /** `chat_id` for a group request, `user_id` for a user request. */
   targetId: string
   /** Display name of the requested target (group name / user name), when known. */
   name?: string
@@ -320,9 +366,14 @@ export interface AccessRequestWire {
 export interface AccessWire {
   mode: 'open' | 'guarded'
   admin: {
-    openId?: string
+    /** The effective administrator: configured `adminUserId`, else the app owner. */
+    userId?: string
+    /** Where `userId` came from: explicit config or the app-owner fallback. */
+    source?: 'config' | 'owner'
     /** false while guarded mode would refuse every conversation (fail closed). */
     configured: boolean
+    /** Why the app-owner fallback is unavailable, when its lookup failed. */
+    ownerLookupError?: string
   }
   /**
    * Whether the persisted whitelists were loaded. While the channel holds no
@@ -344,51 +395,10 @@ export type AccessMutationResponse =
 export interface PanelWire {
   status: ChannelStatusWire
   config: PanelConfigWire
-  cleanup: CleanupPreviewWire
   /** 访问与授权卡片的数据（准入模式、管理员、白名单、待处理申请）。 */
   access: AccessWire
 }
 
-/**
- * What the workspace-retention cleanup would delete right now. Counts are
- * zero and `error` is set when the Host cannot compute the preview (for
- * example the cleanup seam is unavailable); the panel stays usable.
- */
-export interface CleanupPreviewWire {
-  /** Effective `workspaceRetention` value (`off` / `7d` / `30d` / `90d` / `180d`). */
-  retention: string
-  /** Retention threshold in milliseconds; absent when `retention` is `off`. */
-  thresholdMs?: number
-  /** Periodic cleanup runs at startup and once per day. */
-  auto: boolean
-  /** Plugin-created workspaces under the current baseDir (user projects). */
-  workspaces: number
-  /** Directories older than the threshold (legacy topic workspaces + per-topic dirs). */
-  candidates: number
-  /** Total bytes currently occupied by the candidates. */
-  candidateBytes: number
-  /** Why the preview could not be computed (counts are zero then). */
-  error?: string
-}
-
-/** Outcome of one manual cleanup run (partial failures do not abort the run). */
-export interface CleanupRunWire {
-  ok: boolean
-  deletedWorkspaces: number
-  /** Per-topic working directories removed (current layout). */
-  deletedSessionDirs: number
-  retiredRoutes: number
-  freedBytes: number
-  /** One `path: message` line per directory that could not be deleted. */
-  failures: string[]
-  error?: string
-}
-
-/** `POST /dsh-channels/cleanup` response. */
-export type CleanupResponse =
-  | { ok: true; panel: PanelWire; result: CleanupRunWire }
-  | { ok: false; error: string }
-
 /**
  * `POST /dsh-channels/pick-directory` response. `canceled` is a normal
  * outcome (the operator dismissed the OS dialog), not an error; `path` is an
@@ -486,7 +496,7 @@ export type PanelTabId = (typeof PANEL_TABS)[number]['id']
 /** Which editable field groups each tab renders (the tabs own one or two). */
 export const TAB_FIELD_GROUPS: Readonly<Record<PanelTabId, readonly FieldGroup[]>> = {
   connection: [],
-  sessions: ['behavior', 'content'],
+  sessions: ['behavior', 'content', 'tools'],
   model: ['model'],
   workspace: ['workspace'],
   access: ['access'],
@@ -498,6 +508,7 @@ export const FIELD_GROUP_LABELS: Readonly<Record<FieldGroup, string>> = {
   workspace: '工作区与文件',
   behavior: '行为',
   content: '内容与附件',
+  tools: '模型工具',
   model: '模型与推理',
   streaming: '流式卡片与日志',
   access: '准入与授权',
@@ -522,6 +533,21 @@ export const PANEL_COPY = {
   statusSummaryConnecting: '正在连接飞书长连接…',
   statusSummaryError: '最近一次连接飞书失败，请检查凭据与网络后重试。',
   lastError: '最近一次连接失败',
+  scopeCheckTitle: '权限自检',
+  scopeCheckOk: '已开通插件需要的全部飞书权限。',
+  scopeCheckMissing: '以下飞书权限未开通，开通后需在开发者后台发布新版本：',
+  scopeCheckOpenAll: '在开发者后台开通全部缺失权限',
+  scopeCheckOpenOne: '去开通',
+  scopeCheckOptional: '可选',
+  scopeCheckRequired: '必需',
+  scopeCheckError: '无法读取应用的权限授予状态：',
+  slashCommandSyncTitle: '斜杠指令面板',
+  slashCommandSyncOk: '插件命令已同步到飞书原生斜杠指令面板，在聊天框输入 / 即可选择（飞书客户端约 5 分钟后刷新）。',
+  slashCommandSyncTotal: '命令数',
+  slashCommandSyncCreated: '本次新增',
+  slashCommandSyncUpdated: '本次更新',
+  slashCommandSyncRemoved: '本次删除',
+  slashCommandSyncError: '同步飞书原生斜杠指令面板失败（不影响直接输入命令）：',
   missingConfig: '缺少配置',
   statusHintUnconfigured: '配置完成后插件会自动连接；也可以稍后在本页手动连接。',
   connectionInfo: '连接信息',
@@ -570,9 +596,9 @@ export const PANEL_COPY = {
   credentialsPendingHint: '填写后点「保存凭据」；两项齐全时插件会自动连接飞书。',
   // ---- tabs / forms -------------------------------------------------------
   connectionTabHelp: '连接状态与飞书应用凭据。凭据不完整时不会连接飞书。',
-  sessionsTabHelp: '私聊、群聊触发方式与入站内容；「需重连」项在下次连接时读取。',
+  sessionsTabHelp: '私聊、群聊触发方式与入站内容：附件存储/预取、模型工具开关与读取预算；「需重连」项在下次连接时读取。',
   modelTabHelp: '飞书会话使用的模型服务商、模型、推理档位与 Agent 预设；下拉选项来自宿主机实时目录，保存后对新会话生效。',
-  workspaceTabHelp: '每个用户一个工作区（模型/工具产生文件的落点），每个话题在其中拥有独立工作目录；只影响之后新建的话题。',
+  workspaceTabHelp: '每个用户一个工作区（模型/工具产生文件的落点），每个话题在其中拥有独立工作目录；只影响之后新建的话题。入站附件默认存于 DSH 原生附件库，不占用话题目录。插件不会自动删除工作区或话题目录；过期目录可手动删除，话题下次对话时会重建空目录。',
   accessTabHelp: '准入采用 fail-closed：管理员不受白名单限制，非管理员私聊会被拒绝，群聊需要「群已授权 + 用户在白名单」两层同时命中。',
   advancedTabHelp: '流式刷新等低层参数、Web 覆盖文件与只读信息。',
   save: '保存更改',
@@ -619,37 +645,12 @@ export const PANEL_COPY = {
   advancedHelp: '这些值来自 profile 配置，不能在面板里编辑。',
   readOnlyCard: '部署级参数',
   // ---- model --------------------------------------------------------------
-  // ---- cleanup ------------------------------------------------------------
-  cleanupCard: '目录清理',
-  cleanupCardHelp: '删除超过保留期且不再活跃的飞书话题目录（以及旧版本按话题建立的工作区目录）；用户工作区本身、DSH 会话日志都不会删除。删除不可恢复：相关旧话题会失效并提示已过期。',
-  cleanupRetention: '保留期',
-  cleanupAutoLabel: '自动清理',
-  cleanupCandidates: '可清理目录',
-  cleanupWorkspaces: '插件工作区',
-  cleanupCandidateBytes: '预计释放空间',
-  cleanupRetentionOff: '关闭（不删除）',
-  cleanupAutoOn: '已开启（启动时 + 每天一次）',
-  cleanupAutoOff: '已关闭（仅手动执行）',
-  cleanupAutoInactive: '未执行（保留期为关闭）',
-  cleanupNow: '立即清理',
-  cleanupRunning: '清理中…',
-  cleanupConfirm: '确定清理过期目录吗？该操作不可恢复，会删除这些目录内的全部文件（包括 attachments/ 附件）。',
-  cleanupConfirmHint: '删除前会再次确认；保留期为「关闭」或没有过期目录时按钮不可用。',
-  cleanupDisabledOff: '保留策略为「关闭」：请先在上方「过期目录保留期」中选择保留天数。',
-  cleanupDisabledEmpty: '没有超过保留期的过期目录。',
-  cleanupPreviewFailed: '无法读取清理预览',
-  cleanupDone: '清理完成',
-  cleanupFailed: '清理失败',
-  cleanupDeleted: '已删除工作区',
-  cleanupDeletedDirs: '话题目录',
-  cleanupRetired: '已清理话题路由',
-  cleanupFreed: '释放空间',
-  cleanupFailures: '以下目录未能删除：',
   // ---- access -------------------------------------------------------------
   accessCard: '访问与授权',
-  accessCardHelp: '准入采用 fail-closed：管理员不受白名单限制（私聊、任意群聊都可直接对话）；非管理员私聊会被拒绝，群聊需要「群已授权 + 用户在白名单」两层同时命中。管理员与准入模式在上方「准入与授权」中编辑；私聊机器人发送 /userid 获取自己的 open_id。',
+  accessCardHelp: '准入采用 fail-closed：管理员不受白名单限制（私聊、任意群聊都可直接对话）；非管理员私聊会被拒绝，群聊需要「群已授权 + 用户在白名单」两层同时命中。管理员与准入模式在上方「准入与授权」中编辑；私聊机器人发送 /userid 获取自己的 user_id。',
   accessModeOpenWarning: '当前准入模式为开放（open）：应用可用范围内的任何人都能开启对话。该模式不安全，仅建议调试时使用。',
-  accessAdminMissingWarning: '当前准入=guarded 但未配置管理员，所有对话都会被拒绝。请在上方「准入与授权」填写管理员 open_id。',
+  accessAdminMissingWarning: '当前准入=guarded 但未配置管理员，也无法自动使用应用所有者，所有对话都会被拒绝。请在上方「准入与授权」填写管理员 user_id（私聊机器人发送 /userid 获取；私聊模式关闭时 /userid 不可用，可在飞书管理后台的成员详情里查看用户 ID）。',
+  accessAdminOwnerNotice: '未配置管理员，已自动使用应用所有者作为管理员：',
   accessGroupsTitle: '已授权群',
   accessGroupsEmpty: '尚未授权任何群。机器人被拉进群后，管理员会收到带 chat_id 的群信息卡；也可在群内发送 /groupid 获取。',
   accessUsersTitle: '已授权用户',
@@ -658,7 +659,7 @@ export const PANEL_COPY = {
   accessRequestsEmpty: '没有待处理的授权申请。',
   accessGroupChatIdPlaceholder: '群 chat_id（oc_…）',
   accessGroupNamePlaceholder: '群名（可选）',
-  accessUserOpenIdPlaceholder: '用户 open_id（ou_…）',
+  accessUserIdPlaceholder: '用户 user_id',
   accessUserNamePlaceholder: '昵称（可选）',
   accessAddGroup: '添加群',
   accessAddUser: '添加用户',
@@ -680,5 +681,5 @@ export const PANEL_COPY = {
   accessRequestAllowed: '已授权',
   accessRequestDenied: '已忽略',
   accessHints: '三种授权入口：群内 /auth 命令、入群与用户授权卡、本面板。撤销立即生效；白名单只约束非管理员（管理员在任何私聊/群聊都直接放行），非管理员需要群和用户两层同时命中。',
-  accessChatIdHint: 'chat_id 可从入群群信息卡或群内 /groupid 获取；open_id 可私聊机器人发送 /userid 获取。',
+  accessChatIdHint: 'chat_id 可从入群群信息卡或群内 /groupid 获取；user_id 可私聊机器人发送 /userid 获取。',
 } as const