@modesto_ma/dsh-channels 0.5.0-beta.3 → 0.5.0-beta.4

package/src/settings/contract.ts

@@ -20,12 +20,14 @@ export const CREDENTIALS_ROUTE = '/dsh-channels/credentials'
 export const RECONNECT_ROUTE = '/dsh-channels/reconnect'
 /** 模型/推理档位/预设选择器的宿主目录（provider → model → effort 级联刷新）。 */
 export const CATALOG_ROUTE = '/dsh-channels/catalog'
-/** 访问与授权只读快照（GET/HEAD）：准入模式、管理员、群/用户白名单、待处理申请。 */
+/** 访问与授权只读快照（GET/HEAD）：准入模式、管理员、群/用户/知识库白名单、待处理申请。 */
 export const ACCESS_ROUTE = '/dsh-channels/access'
 /** 群白名单增删（POST/DELETE，body `{ chatId, name? }` / `{ chatId }`）。 */
 export const ACCESS_GROUPS_ROUTE = '/dsh-channels/access/groups'
 /** 用户白名单增删（POST/DELETE，body `{ userId, name? }` / `{ userId }`）。 */
 export const ACCESS_USERS_ROUTE = '/dsh-channels/access/users'
+/** 知识库白名单增删（POST/DELETE，body `{ userId, name? }` / `{ userId }`）。 */
+export const ACCESS_WIKI_USERS_ROUTE = '/dsh-channels/access/wiki-users'
 /** 结算一条待处理授权申请（POST，body `{ token, decision }`）。 */
 export const ACCESS_REQUESTS_ROUTE = '/dsh-channels/access/requests'
 /**
@@ -61,6 +63,8 @@ export const EDITABLE_KEYS = [
   'welcomeOnboarding',
   'slashCommandPanel',
   'allowPermissionSwitch',
+  // 日志平台分析接口（访问令牌是凭据引用 analyzeToken，值写在 DSH 凭据里）
+  'analyzeListen',
   // 准入与授权（管理员/准入模式/申请有效期；白名单由「访问与授权」卡片管理）
   'adminUserId',
   'accessMode',
@@ -107,6 +111,7 @@ export const RESTART_KEYS = [
   'dmMode',
   'requireMention',
   'slashCommandPanel',
+  'analyzeListen',
   'refreshMs',
   'statusRefreshMs',
   'loggerLevel',
@@ -135,7 +140,7 @@ export type StringListItemFormat = 'wiki-root-link'
  * panel tab (see {@link TAB_FIELD_GROUPS}); the Host is the source of truth for
  * which key belongs to which group.
  */
-export type FieldGroup = 'workspace' | 'behavior' | 'content' | 'tools' | 'model' | 'streaming' | 'access'
+export type FieldGroup = 'workspace' | 'behavior' | 'content' | 'tools' | 'model' | 'streaming' | 'access' | 'wiki'
 
 /** One selectable value rendered by the generic form. */
 export interface FieldOptionWire {
@@ -231,8 +236,11 @@ export interface CredentialRefWire {
   source?: string
 }
 
-/** The two credential slots the panel may write. */
-export type CredentialField = 'appId' | 'appSecret'
+/**
+ * The credential slots the panel may write: the Feishu application pair
+ * (resolved on connect) and the analyze API token (resolved per request).
+ */
+export type CredentialField = 'appId' | 'appSecret' | 'analyzeToken'
 
 /** Official-SDK WebSocket lifecycle snapshot (structural copy, no SDK import on the wire). */
 export interface ConnectionWire {
@@ -340,6 +348,7 @@ export interface PanelConfigWire {
   credentials: {
     appId: CredentialRefWire
     appSecret: CredentialRefWire
+    analyzeToken: CredentialRefWire
   }
 }
 
@@ -388,7 +397,8 @@ export interface AccessRequestWire {
 
 /**
  * `GET /dsh-channels/access` payload: admission mode, the administrator
- * reference, both whitelists, and the still-pending authorization requests.
+ * reference, the group, user, and wiki whitelists, and the still-pending
+ * authorization requests.
  */
 export interface AccessWire {
   mode: 'open' | 'guarded'
@@ -410,6 +420,8 @@ export interface AccessWire {
   loaded: boolean
   groups: AccessGroupWire[]
   users: AccessUserWire[]
+  /** Wiki whitelist (`/auth wiki add`): topic owners allowed to use the wiki tools. */
+  wikiUsers: AccessUserWire[]
   requests: AccessRequestWire[]
 }
 
@@ -472,6 +484,7 @@ export type ClearConfigResponse =
 export interface SaveCredentialsRequest {
   appId?: string
   appSecret?: string
+  analyzeToken?: string
 }
 
 /** `DELETE /dsh-channels/credentials` body. */
@@ -484,7 +497,8 @@ export interface ClearCredentialRequest {
  *
  * - `auto`: the channel was stopped and connected immediately after the save.
  * - `pending`: the channel is running; reconnect for the value to take effect.
- * - `not-needed`: removed while stopped, nothing to reconnect.
+ * - `not-needed`: removed while stopped, or only the analyze API token
+ *   changed (it applies to the next request), nothing to reconnect.
  * - `unconfigured`: saved, but the other credential of the pair is still
  *   missing — the plugin keeps waiting (no connection attempt) until it is
  *   configured.
@@ -520,6 +534,7 @@ export const PANEL_TABS = [
   { id: 'model', label: '模型' },
   { id: 'workspace', label: '工作区' },
   { id: 'access', label: '访问授权' },
+  { id: 'wiki', label: '知识库' },
   { id: 'advanced', label: '高级' },
 ] as const
 
@@ -532,6 +547,7 @@ export const TAB_FIELD_GROUPS: Readonly<Record<PanelTabId, readonly FieldGroup[]
   model: ['model'],
   workspace: ['workspace'],
   access: ['access'],
+  wiki: ['wiki'],
   advanced: ['streaming'],
 }
 
@@ -544,6 +560,7 @@ export const FIELD_GROUP_LABELS: Readonly<Record<FieldGroup, string>> = {
   model: '模型与推理',
   streaming: '流式卡片与日志',
   access: '准入与授权',
+  wiki: '知识库工具',
 }
 
 /** Display labels for the panel header/cards (kept on the wire so the client owns no copy). */
@@ -632,6 +649,7 @@ export const PANEL_COPY = {
   modelTabHelp: '飞书会话使用的模型服务商、模型、推理档位与 Agent 预设；下拉选项来自宿主机实时目录，保存后对新会话生效。',
   workspaceTabHelp: '每个用户一个工作区（模型/工具产生文件的落点），每个话题在其中拥有独立工作目录；只影响之后新建的话题。入站附件默认存于 DSH 原生附件库，不占用话题目录。插件不会自动删除工作区或话题目录；过期目录可手动删除，话题下次对话时会重建空目录。',
   accessTabHelp: '准入采用 fail-closed：管理员不受白名单限制，非管理员私聊会被拒绝，群聊需要「群已授权 + 用户在白名单」两层同时命中。',
+  wikiTabHelp: '知识库工具以应用身份访问「知识库范围」内的文档、电子表格和多维表格。只有管理员或知识库白名单里的用户发起的话题能用；每次打开、新建、修改仍需话题发起人在授权卡上确认。',
   advancedTabHelp: '流式刷新等低层参数、Web 覆盖文件与只读信息。',
   save: '保存更改',
   saving: '保存中…',
@@ -670,6 +688,13 @@ export const PANEL_COPY = {
   enabled: '已启用',
   disabled: '已关闭',
   credentialRemoveConfirm: '确定移除已存储的凭据值？移除后不会回显，需要时须重新填写。',
+  analyzeTokenCard: '日志分析接口令牌',
+  analyzeTokenCardHelp: '日志平台调用分析接口时 Authorization: Bearer 后面的值。经 DSH 凭据服务写入本机凭据库，面板永不回显；保存或移除后下一次请求即生效，无需重连。未配置时接口对所有请求返回 503。',
+  analyzeTokenLabel: '访问令牌',
+  analyzeTokenPlaceholder: '填写新令牌（建议 32 位以上随机串）',
+  saveAnalyzeToken: '保存令牌',
+  analyzeTokenSaved: '令牌已保存，下一次请求生效',
+  analyzeTokenRemoved: '令牌已移除，接口将拒绝所有请求',
   accessNotLoaded: '飞书连接建立后加载授权列表',
   loading: '加载中…',
   loadFailed: '设置面板加载失败',
@@ -719,5 +744,11 @@ export const PANEL_COPY = {
   accessRequestAllowed: '已授权',
   accessRequestDenied: '已忽略',
   accessHints: '三种授权入口：群内 /auth 命令、入群与用户授权卡、本面板。撤销立即生效；白名单只约束非管理员（管理员在任何私聊/群聊都直接放行），非管理员需要群和用户两层同时命中。',
+  // ---- wiki ---------------------------------------------------------------
+  wikiUsersCard: '知识库白名单',
+  wikiUsersHelp: '与「访问授权」里的用户白名单相互独立：这里的用户（以及管理员）发起的话题可以使用知识库工具。也可以在飞书里发送 /auth wiki add @用户 或 /auth wiki remove @用户；移除立即生效。',
+  wikiUsersEmpty: '知识库白名单为空：目前只有管理员发起的话题能使用知识库工具。',
+  wikiUserAdded: '已加入知识库白名单',
+  wikiUserRemoved: '已移出知识库白名单',
   accessChatIdHint: 'chat_id 可从入群群信息卡或群内 /groupid 获取；user_id 可私聊机器人发送 /userid 获取。',
 } as const

package/src/settings/routes.ts

@@ -3,8 +3,10 @@
  * credentials(PUT,DELETE) / reconnect / access。
  *
  * 路由注册进宿主可选的 `webServer` 服务（headless profile 没有它时面板自然
- * 不存在，飞书通道不受影响）。写操作额外做同源校验 —— 本机非回环绑定下
- * 防止跨站页面改写插件配置或授权白名单；读取不敏感，保持只读 GET。凭据值
+ * 不存在，飞书通道不受影响）。每个路由（读写都算）先交给宿主 `connection`
+ * 服务的 `requestRejection`：与 DSH 自己的 `/api` 同一套 Host/Origin 校验和
+ * 浏览器登录 cookie 鉴权，未通过返回 403 / 401，请求体不会被读取。没有
+ * `connection` 服务的组合不挂载这些路由。写操作另保留同源校验。凭据值
  * 只走写路径，响应永远不包含它们。`catalog` 只读宿主 LLM / preset roster 的
  * 枚举结果，用于面板的 provider → model → 推理档位级联选择。`access` 提供
  * 准入快照与白名单/授权申请的写入口（与飞书卡片共用同一结算函数）。
@@ -19,6 +21,7 @@ import {
   ACCESS_REQUESTS_ROUTE,
   ACCESS_ROUTE,
   ACCESS_USERS_ROUTE,
+  ACCESS_WIKI_USERS_ROUTE,
   CATALOG_ROUTE,
   CONFIG_ROUTE,
   CREDENTIALS_ROUTE,
@@ -44,6 +47,18 @@ export interface HostWebServer {
   }): () => void
 }
 
+/**
+ * The narrow `ctx.connection` surface this module consumes: DSH's own
+ * Host/Origin fence plus browser (login cookie) or API authentication.
+ */
+export interface HostRequestGate {
+  /**
+   * @param request - incoming request headers.
+   * @returns 403 (untrusted Host/Origin), 401 (unauthenticated), or undefined when allowed.
+   */
+  requestRejection(request: { readonly headers: IncomingMessage['headers'] }): 401 | 403 | undefined
+}
+
 type WebHandler = (req: IncomingMessage, res: ServerResponse) => void | Promise<void>
 
 /** Request body cap: the panel payload is a handful of primitives. */
@@ -151,9 +166,20 @@ async function readAccessBody(
   return body as Record<string, unknown>
 }
 
-/** Wrap a handler so thrown errors become JSON instead of a dropped socket. */
-function guarded(handler: WebHandler): WebHandler {
+/**
+ * Wrap a handler so the host gate runs before anything else and thrown
+ * errors become JSON instead of a dropped socket.
+ */
+function guardedBy(gate: HostRequestGate, handler: WebHandler): WebHandler {
   return async (req, res) => {
+    const rejection = gate.requestRejection(req)
+    if (rejection !== undefined) {
+      sendJson(res, rejection, {
+        ok: false,
+        error: rejection === 401 ? '未登录 DSH，请从 DSH 启动链接打开页面' : '请求来源不受信任',
+      })
+      return
+    }
     try {
       await handler(req, res)
     } catch (error) {
@@ -175,7 +201,12 @@ function forbiddenWrite(res: ServerResponse): void {
 }
 
 /** Register the panel routes; the returned disposer removes all of them. */
-export function registerSettingsRoutes(server: HostWebServer, surface: SettingsSurface): () => void {
+export function registerSettingsRoutes(
+  server: HostWebServer,
+  gate: HostRequestGate,
+  surface: SettingsSurface,
+): () => void {
+  const guarded = (handler: WebHandler): WebHandler => guardedBy(gate, handler)
   const disposers = [
     server.register({
       kind: 'exact',
@@ -272,15 +303,15 @@ export function registerSettingsRoutes(server: HostWebServer, surface: SettingsS
           }
           throw error
         }
-        const payload = body as { appId?: unknown; appSecret?: unknown; field?: unknown } | null
+        const payload = body as { appId?: unknown; appSecret?: unknown; analyzeToken?: unknown; field?: unknown } | null
         if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
           sendJson(res, 400, { ok: false, error: '请求体必须是 JSON 对象' })
           return
         }
         if (methodOf(req) === 'DELETE') {
           const field = payload.field
-          if (field !== 'appId' && field !== 'appSecret') {
-            sendJson(res, 400, { ok: false, error: 'field 必须是 appId 或 appSecret' })
+          if (field !== 'appId' && field !== 'appSecret' && field !== 'analyzeToken') {
+            sendJson(res, 400, { ok: false, error: 'field 必须是 appId、appSecret 或 analyzeToken' })
             return
           }
           const result = await surface.clearCredential(field as CredentialField)
@@ -290,6 +321,7 @@ export function registerSettingsRoutes(server: HostWebServer, surface: SettingsS
         const values: SaveCredentialsRequest = {}
         if (payload.appId !== undefined) values.appId = payload.appId as string
         if (payload.appSecret !== undefined) values.appSecret = payload.appSecret as string
+        if (payload.analyzeToken !== undefined) values.analyzeToken = payload.analyzeToken as string
         const result = await surface.saveCredentials(values)
         sendJson(res, result.ok ? 200 : 400, result)
       }),
@@ -395,6 +427,23 @@ export function registerSettingsRoutes(server: HostWebServer, surface: SettingsS
         sendJson(res, result.ok ? 200 : 400, result)
       }),
     }),
+    server.register({
+      kind: 'exact',
+      path: ACCESS_WIKI_USERS_ROUTE,
+      handler: guarded(async (req, res) => {
+        if (!allowOnly(req, res, ['POST', 'DELETE'])) return
+        if (!isSameOriginRequest(req)) {
+          forbiddenWrite(res)
+          return
+        }
+        const payload = await readAccessBody(req, res)
+        if (payload === undefined) return
+        const result = methodOf(req) === 'DELETE'
+          ? await surface.removeWikiUser(payload.userId)
+          : await surface.saveWikiUser(payload.userId, payload.name)
+        sendJson(res, result.ok ? 200 : 400, result)
+      }),
+    }),
     server.register({
       kind: 'exact',
       path: ACCESS_REQUESTS_ROUTE,
@@ -417,17 +466,20 @@ export function registerSettingsRoutes(server: HostWebServer, surface: SettingsS
 }
 
 /**
- * Mount the routes once the host carries a Web server. The optional
- * `ctx.inject` keeps headless profiles from waiting on a service they will
+ * Mount the routes once the host carries both a Web server and the
+ * `connection` service that authenticates its browser requests. The optional
+ * `ctx.inject` keeps headless profiles from waiting on services they will
  * never have; embedded/test hosts that resolve services synchronously fall
- * back to the direct attach path.
+ * back to the direct attach path. Without `connection` nothing is mounted, so
+ * the panel never serves unauthenticated requests.
  */
 export function mountSettingsRoutes(ctx: HostContext, surface: SettingsSurface): void {
   const attach = (webCtx: HostContext): void => {
     const server = webCtx.get?.('webServer') as HostWebServer | undefined
-    if (server === undefined) return
+    const gate = webCtx.get?.('connection') as HostRequestGate | undefined
+    if (server === undefined || gate === undefined) return
     webCtx.effect(
-      () => registerSettingsRoutes(server, surface),
+      () => registerSettingsRoutes(server, gate, surface),
       'dsh-channels: settings panel routes',
     )
   }
@@ -435,7 +487,7 @@ export function mountSettingsRoutes(ctx: HostContext, surface: SettingsSurface):
     inject?: (dependencies: string[], callback: (child: HostContext) => void) => unknown
   }).inject
   if (typeof inject === 'function') {
-    inject.call(ctx, ['webServer'], attach)
+    inject.call(ctx, ['webServer', 'connection'], attach)
     return
   }
   attach(ctx)

package/src/settings/surface.ts

@@ -95,7 +95,7 @@ export interface SettingsTarget {
   runningConfigSnapshot(): FeishuConfig | undefined
   applyOverlay(overlay: OverlayPatch): void
   restart(): Promise<void>
-  credentialStates(): Promise<{ appId: CredentialInfo; appSecret: CredentialInfo }>
+  credentialStates(): Promise<Record<CredentialField, CredentialInfo>>
   setCredential(field: CredentialField, value: string): Promise<void>
   clearCredential(field: CredentialField): Promise<void>
   /** Current admission snapshot: mode, administrator, whitelists, pending requests. */
@@ -108,6 +108,10 @@ export interface SettingsTarget {
   addAccessUser(userId: string, name?: string): Promise<AccessMutationResponse>
   /** Revoke one user authorization (takes effect on the next message). */
   removeAccessUser(userId: string): Promise<AccessMutationResponse>
+  /** Add one user `user_id` to the wiki whitelist. */
+  addWikiUser(userId: string, name?: string): Promise<AccessMutationResponse>
+  /** Remove one user from the wiki whitelist (takes effect on the next wiki tool call). */
+  removeWikiUser(userId: string): Promise<AccessMutationResponse>
   /** Settle one pending request (panel shares this path with the Feishu DM card). */
   resolveAccessRequest(token: string, decision: 'allow' | 'deny'): Promise<AccessMutationResponse>
 }
@@ -121,6 +125,9 @@ export interface CredentialInfo {
 
 const RESTART_SET = new Set<string>(RESTART_KEYS)
 
+/** Every credential slot the panel writes, in form order. */
+const CREDENTIAL_FIELDS: readonly CredentialField[] = ['appId', 'appSecret', 'analyzeToken']
+
 /** Optional text fields: an empty string in the panel clears the override. */
 const OPTIONAL_TEXT_KEYS = new Set<EditableKey>([
   'provider',
@@ -128,6 +135,7 @@ const OPTIONAL_TEXT_KEYS = new Set<EditableKey>([
   'reasoningEffort',
   'agentPreset',
   'adminUserId',
+  'analyzeListen',
 ])
 
 const BOOLEAN_KEYS = new Set<EditableKey>([
@@ -250,6 +258,11 @@ const FIELD_META: Record<EditableKey, { label: string; help: string; min?: numbe
   welcomeOnboarding: { label: '首次私聊引导卡', help: '每个私聊会话第一次触达时发送一张命令与用法引导卡，只发一次。' },
   slashCommandPanel: { label: '同步飞书原生斜杠指令面板', help: '连接时把插件命令同步到飞书输入 / 时弹出的面板；需开通 application:app_slash_command:read 与 write 权限，部分企业不允许应用添加斜杠指令。关闭时不读写面板，直接输入命令不受影响。' },
   allowPermissionSwitch: { label: '允许飞书侧切换权限预设', help: '安全敏感：开启后话题所有者可用 /permissions 切换沙箱与审批预设。' },
+  analyzeListen: {
+    label: '日志分析接口监听地址',
+    help: '日志平台调用 POST /dsh-channels/analyze 的独立端口，格式 host:port（如 0.0.0.0:3090）；留空 = 关闭接口；需重连生效。请求需带 Authorization: Bearer <令牌>，令牌在本页下方「日志分析接口令牌」卡片填写。',
+    placeholder: '留空 = 关闭',
+  },
   adminUserId: {
     label: '管理员 user_id',
     help: '唯一管理员。私聊机器人发送 /userid 获取（不是 ou_ 开头的 open_id，也不是邮箱）；留空 = 清除 Web 覆盖。未配置时自动使用飞书应用所有者（需可选的「获取应用信息」权限，开不了就在这里手动填写）；两者都没有时 guarded 模式会拒绝所有对话。',
@@ -354,11 +367,11 @@ const FIELD_META: Record<EditableKey, { label: string; help: string; min?: numbe
   },
   'feishuTools.wikiRead': {
     label: '启用知识库读取工具',
-    help: '让模型浏览「知识库范围」内的知识库节点，并读取 docx 文档、电子表格和多维表格（feishu_wiki_list / feishu_wiki_read / feishu_wiki_sheet_read / feishu_wiki_base_read），以应用身份访问。需开通 wiki:wiki、docx:document、sheets:spreadsheet、bitable:app 权限（或对应的只读权限）。只有话题所有者是管理员或在知识库白名单（/auth wiki add @成员）中才能使用；打开文档前会在授权卡上征得话题所有者同意，每个话题一次。知识库范围为空时不挂载。对新会话生效。',
+    help: '让模型浏览「知识库范围」内的知识库节点，并读取 docx 文档、电子表格和多维表格（feishu_wiki_list / feishu_wiki_read / feishu_wiki_sheet_read / feishu_wiki_base_read），以应用身份访问。需开通 wiki:wiki、docx:document（或对应的只读权限），电子表格需 sheets:spreadsheet:read，多维表格需 base:table:read、base:field:read、base:record:read（旧版 sheets:spreadsheet、bitable:app 不生效）。只有话题所有者是管理员或在知识库白名单（/auth wiki add @成员）中才能使用；打开文档前会在授权卡上征得话题所有者同意，每个话题一次。知识库范围为空时不挂载。对新会话生效。',
   },
   'feishuTools.wikiWrite': {
     label: '启用知识库写入工具',
-    help: '让模型在「知识库范围」内新建 docx 文档、电子表格和多维表格，编辑本应用拥有的文档和电子表格，增改删本应用拥有的多维表格记录、向其他多维表格新增记录（feishu_wiki_create / feishu_wiki_edit / feishu_wiki_sheet_edit / feishu_wiki_base_edit），以应用身份访问；每次新建或编辑都需话题所有者在审批卡上同意。需开通 wiki:wiki、docx:document、sheets:spreadsheet、bitable:app 权限；使用条件同读取工具（管理员或知识库白名单）。知识库范围为空时不挂载。对新会话生效。',
+    help: '让模型在「知识库范围」内新建 docx 文档、电子表格和多维表格，编辑本应用拥有的文档和电子表格，增改删本应用拥有的多维表格记录、向其他多维表格新增记录（feishu_wiki_create / feishu_wiki_edit / feishu_wiki_sheet_edit / feishu_wiki_base_edit），以应用身份访问；每次新建或编辑都需话题所有者在审批卡上同意。需开通 wiki:wiki、docx:document、sheets:spreadsheet:write_only、base:record:create、base:record:update、base:record:delete 权限，以及读取工具的权限；使用条件同读取工具（管理员或知识库白名单）。知识库范围为空时不挂载。对新会话生效。',
   },
   wikiRoots: {
     label: '知识库范围（wikiRoots）',
@@ -383,6 +396,7 @@ const GROUP_OF: Record<EditableKey, EditableFieldWire['group']> = {
   welcomeOnboarding: 'behavior',
   slashCommandPanel: 'behavior',
   allowPermissionSwitch: 'behavior',
+  analyzeListen: 'behavior',
   adminUserId: 'access',
   accessMode: 'access',
   authRequestTtlDays: 'access',
@@ -401,9 +415,9 @@ const GROUP_OF: Record<EditableKey, EditableFieldWire['group']> = {
   'feishuTools.topicMessages': 'tools',
   'feishuTools.topicMessagesTimeoutMs': 'tools',
   'feishuTools.sendFile': 'tools',
-  'feishuTools.wikiRead': 'tools',
-  'feishuTools.wikiWrite': 'tools',
-  wikiRoots: 'tools',
+  'feishuTools.wikiRead': 'wiki',
+  'feishuTools.wikiWrite': 'wiki',
+  wikiRoots: 'wiki',
   provider: 'model',
   model: 'model',
   reasoningEffort: 'model',
@@ -561,6 +575,9 @@ export function normalizeCredentialValue(raw: unknown): { ok: true; value: strin
 const MAX_ACCESS_VALUE_LENGTH = 128
 
 
+/** Format reason for a rejected user `user_id` (shared by the user and wiki whitelists). */
+const USER_ID_FORMAT = '用户 user_id 只能包含字母、数字、_ 和 -（不是 ou_ 开头的 open_id，也不是邮箱）'
+
 /** Trim one whitelist identifier, rejecting empty, oversized, or hostile input. */
 export function normalizeAccessId(
   raw: unknown,
@@ -754,9 +771,10 @@ export class SettingsSurface {
       this.directoryPicker?.available === true,
     )
 
-    let credentialStates: { appId: CredentialInfo; appSecret: CredentialInfo } = {
+    let credentialStates: Record<CredentialField, CredentialInfo> = {
       appId: { configured: false, writable: false },
       appSecret: { configured: false, writable: false },
+      analyzeToken: { configured: false, writable: false },
     }
     try {
       credentialStates = await this.target.credentialStates()
@@ -772,6 +790,7 @@ export class SettingsSurface {
     const credentials: PanelConfigWire['credentials'] = {
       appId: toWire(effective.appId, credentialStates.appId),
       appSecret: toWire(effective.appSecret, credentialStates.appSecret),
+      analyzeToken: toWire(effective.analyzeToken, credentialStates.analyzeToken),
     }
 
     // The access snapshot comes from in-memory maps, but a broken seam must
@@ -788,6 +807,7 @@ export class SettingsSurface {
         loaded: false,
         groups: [],
         users: [],
+        wikiUsers: [],
         requests: [],
       }
     }
@@ -915,7 +935,7 @@ export class SettingsSurface {
     if (busy !== undefined) return busy
     const writes: Array<{ field: CredentialField; value: string }> = []
     const issues: FieldIssueWire[] = []
-    for (const field of ['appId', 'appSecret'] as const) {
+    for (const field of CREDENTIAL_FIELDS) {
       const raw = values[field]
       if (raw === undefined) continue
       const normalized = normalizeCredentialValue(raw)
@@ -926,13 +946,16 @@ export class SettingsSurface {
       writes.push({ field, value: normalized.value })
     }
     if (issues.length > 0) return { ok: false, error: '凭据校验失败', issues }
-    if (writes.length === 0) return { ok: false, error: '请至少填写一项凭据（App ID 或 App Secret）' }
+    if (writes.length === 0) return { ok: false, error: '请至少填写一项凭据' }
 
     try {
       for (const write of writes) await this.target.setCredential(write.field, write.value)
     } catch (error) {
       return { ok: false, error: messageOf(error) }
     }
+    if (writes.every(write => write.field === 'analyzeToken')) {
+      return { ok: true, panel: await this.panel(), reconnect: 'not-needed' }
+    }
     return this.finishCredentialChange('save')
   }
 
@@ -940,7 +963,7 @@ export class SettingsSurface {
   async clearCredential(field: CredentialField): Promise<ClearCredentialResponse> {
     const busy = this.writeBusy()
     if (busy !== undefined) return busy
-    if (field !== 'appId' && field !== 'appSecret') {
+    if (!CREDENTIAL_FIELDS.includes(field)) {
       return { ok: false, error: '未知的凭据字段' }
     }
     try {
@@ -948,6 +971,7 @@ export class SettingsSurface {
     } catch (error) {
       return { ok: false, error: messageOf(error) }
     }
+    if (field === 'analyzeToken') return { ok: true, panel: await this.panel(), reconnect: 'not-needed' }
     return this.finishCredentialChange('clear')
   }
 
@@ -1040,18 +1064,43 @@ export class SettingsSurface {
 
   /** Authorize one user `user_id` (not an open_id or email). */
   async saveAccessUser(userId: unknown, name?: unknown): Promise<AccessMutationResponse> {
-    const id = normalizeAccessId(userId, '用户 user_id', '用户 user_id 只能包含字母、数字、_ 和 -（不是 ou_ 开头的 open_id，也不是邮箱）')
+    return this.saveUser(userId, name, (id, label) => this.target.addAccessUser(id, label))
+  }
+
+  /** Revoke one user authorization (immediate: the next message re-evaluates). */
+  async removeAccessUser(userId: unknown): Promise<AccessMutationResponse> {
+    return this.removeUser(userId, id => this.target.removeAccessUser(id))
+  }
+
+  /** Add one user `user_id` to the wiki whitelist. */
+  async saveWikiUser(userId: unknown, name?: unknown): Promise<AccessMutationResponse> {
+    return this.saveUser(userId, name, (id, label) => this.target.addWikiUser(id, label))
+  }
+
+  /** Remove one user from the wiki whitelist (immediate: the next wiki tool call re-evaluates). */
+  async removeWikiUser(userId: unknown): Promise<AccessMutationResponse> {
+    return this.removeUser(userId, id => this.target.removeWikiUser(id))
+  }
+
+  private async saveUser(
+    userId: unknown,
+    name: unknown,
+    add: (id: string, label: string | undefined) => Promise<AccessMutationResponse>,
+  ): Promise<AccessMutationResponse> {
+    const id = normalizeAccessId(userId, '用户 user_id', USER_ID_FORMAT)
     if (!id.ok) return { ok: false, error: id.message }
     const label = normalizeAccessName(name)
     if (!label.ok) return { ok: false, error: label.message }
-    return this.mutateAccess(() => this.target.addAccessUser(id.value, label.value))
+    return this.mutateAccess(() => add(id.value, label.value))
   }
 
-  /** Revoke one user authorization (immediate: the next message re-evaluates). */
-  async removeAccessUser(userId: unknown): Promise<AccessMutationResponse> {
-    const id = normalizeAccessId(userId, '用户 user_id', '用户 user_id 只能包含字母、数字、_ 和 -（不是 ou_ 开头的 open_id，也不是邮箱）')
+  private async removeUser(
+    userId: unknown,
+    remove: (id: string) => Promise<AccessMutationResponse>,
+  ): Promise<AccessMutationResponse> {
+    const id = normalizeAccessId(userId, '用户 user_id', USER_ID_FORMAT)
     if (!id.ok) return { ok: false, error: id.message }
-    return this.mutateAccess(() => this.target.removeAccessUser(id.value))
+    return this.mutateAccess(() => remove(id.value))
   }
 
   /**