@modesto_ma/dsh-channels 0.5.0-beta.5 → 0.5.0-beta.7

package/lib/index.js

@@ -37,10 +37,16 @@ function decideAccess(subject, config, snapshot) {
 		kind: "allow",
 		reason: "admin"
 	};
-	if (subject.chatType === "p2p") return {
-		kind: "deny",
-		reason: "dm-non-admin"
-	};
+	if (subject.chatType === "p2p") {
+		if (config.dmAllowWhitelist && snapshot.users.has(subject.senderId)) return {
+			kind: "allow",
+			reason: "authorized-user"
+		};
+		return {
+			kind: "deny",
+			reason: "dm-non-admin"
+		};
+	}
 	if (!snapshot.groups.has(subject.chatId)) return {
 		kind: "deny",
 		reason: "group-not-authorized",
@@ -60,6 +66,8 @@ function decideAccess(subject, config, snapshot) {
 //#region src/access/controller.ts
 /** Fixed private-chat notice for non-administrators (no model call). */
 const DM_DENY_TEXT = "非管理员禁用私聊功能哦～如需使用，请在管理员授权的群里 @ 我；或联系管理员把你的 user_id 加入白名单。";
+/** Fixed private-chat notice for non-whitelisted users while `dmAllowWhitelist` is on. */
+const DM_DENY_WHITELIST_TEXT = "你还不在白名单里，暂时不能私聊哦～发送 /userid 查看你的 user_id，请管理员加入白名单后即可使用。";
 /** Fixed private-chat notice while no administrator is configured. */
 const DM_UNCONFIGURED_TEXT = "机器人尚未配置管理员。发送 /userid 可查看你的 user_id，交给部署者配置后即可启用。";
 /** Per-sender cooldown for the repeated private-chat notice (10 s). */
@@ -122,8 +130,9 @@ var AccessController = class {
 	/**
 	* Slash-command admission. Runs before any command card/topic/Session side
 	* effect. `open` mode keeps the legacy behavior; otherwise private chats
-	* stay administrator-only (with `/userid` as the bootstrap exception) and
-	* group chats must pass the full admission matrix; the administrator is
+	* admit whoever the admission matrix admits (with `/userid` as the
+	* bootstrap exception) and group chats must pass the full admission
+	* matrix; the administrator is
 	* never constrained by the whitelists, so all of their commands pass even
 	* inside an unauthorized group (`/auth` is the in-conversation grant
 	* entry).
@@ -133,7 +142,7 @@ var AccessController = class {
 		try {
 			if (msg.chatType === "p2p") {
 				if (commandName === "userid") return true;
-				if (this.isAdmin(msg.senderId)) return true;
+				if (this.decide(msg).kind === "allow") return true;
 				await this.noticeDeniedDm(msg);
 				return false;
 			}
@@ -195,7 +204,8 @@ var AccessController = class {
 		const last = this.dmNoticeAt.get(msg.senderId);
 		if (last !== void 0 && now - last < DM_NOTICE_COOLDOWN_MS) return;
 		this.dmNoticeAt.set(msg.senderId, now);
-		const text = this.config().adminUserId === void 0 ? DM_UNCONFIGURED_TEXT : DM_DENY_TEXT;
+		const config = this.config();
+		const text = config.adminUserId === void 0 ? DM_UNCONFIGURED_TEXT : config.dmAllowWhitelist ? DM_DENY_WHITELIST_TEXT : DM_DENY_TEXT;
 		await this.sendText(msg.chatId, text, msg.messageId);
 	}
 	/** Best-effort fixed-text send; unavailable channel/failures only warn. */
@@ -400,7 +410,7 @@ function buildUserRequestCard(input) {
 	} else if (input.chatId !== void 0 && input.chatId !== "") elements.push(field("所在群", `\`${input.chatId}\``));
 	elements.push(field("申请时间", formatTime(input.now)));
 	elements.push(divider());
-	elements.push(note("授权后该用户可在所有已授权群里使用；私聊仍仅管理员可用。"));
+	elements.push(note(input.dmAllowWhitelist === true ? "授权后该用户可在所有已授权群里使用，也可以私聊机器人。" : "授权后该用户可在所有已授权群里使用；私聊仍仅管理员可用。"));
 	elements.push(decisionButtons(input.token, "授权用户", "忽略"));
 	return standaloneCard("**🙋 用户授权申请**", elements);
 }
@@ -733,6 +743,7 @@ var AccessRequests = class {
 				...groupName === void 0 ? {} : { groupName },
 				...msg.senderName === void 0 ? {} : { requesterName: msg.senderName },
 				token: record.token,
+				dmAllowWhitelist: this.config().dmAllowWhitelist,
 				now
 			}), record);
 			return true;
@@ -1235,8 +1246,8 @@ const accessGroupRecordSchema = z.object({
 });
 /**
 * One authorized user (`user_id`), global across every authorized group.
-* Private chats are administrator-only, so this grant only affects group
-* conversations.
+* Private chats are administrator-only unless `dmAllowWhitelist` is on, so
+* by default this grant only affects group conversations.
 */
 const accessUserRecordSchema = z.object({
 	/** Feishu `user_id` — also the table key. */
@@ -1337,6 +1348,31 @@ const analyzeRequestRecordSchema = z.object({
 	])
 });
 /**
+* Where one Feishu-routed Session came from, keyed by its DSH session id.
+* Written the first time a route record names the Session (new topic,
+* `/renew`, analyze API) and kept after the route retires, so the Web
+* client can still show the origin of an old Session. Names are resolved
+* live when read, never stored.
+*/
+const sessionOriginRecordSchema = z.object({
+	/** DSH session id (also the table key). */
+	key: z.string().min(1),
+	/** Route key the Session was bound under (thread_id or chat:<chatId>). */
+	routeKey: z.string().min(1),
+	/** Topic-scoped (`thread`) or chat-scoped (`chat`) route. */
+	kind: z.enum(["thread", "chat"]),
+	/** Feishu chat the Session was started from. */
+	chatId: z.string().min(1),
+	/** `p2p` or `group`. */
+	chatType: z.enum(["p2p", "group"]),
+	/** `user_id` of the user who started the Session (the requester for analyze topics). */
+	senderUserId: z.string().min(1),
+	/** Epoch ms when the Session was bound to the route. */
+	createdAt: z.number().int().nonnegative(),
+	/** Group-shared route (log-platform analysis topic). */
+	shared: z.literal(true).optional()
+});
+/**
 * Domain declaration for the host's storage facility. Plain data plus zod
 * schemas — deliberately not built with `defineDomain` so this module has no
 * runtime import of `@deepseek-ai/dsh-storage-domain`.
@@ -1364,7 +1400,8 @@ const feishuDomain = {
 		access_users: { valueSchema: accessUserRecordSchema },
 		access_requests: { valueSchema: accessRequestRecordSchema },
 		access_wiki_users: { valueSchema: accessUserRecordSchema },
-		analyze_requests: { valueSchema: analyzeRequestRecordSchema }
+		analyze_requests: { valueSchema: analyzeRequestRecordSchema },
+		session_origins: { valueSchema: sessionOriginRecordSchema }
 	}
 };
 /**
@@ -3367,6 +3404,7 @@ var RouteStore = class {
 			this.expired.set(key, record);
 			this.active.delete(key);
 		}
+		for (const record of this.active.values()) this.recordOrigins(record);
 	}
 	/** One active route by key (cache-first, normalized). */
 	get(key) {
@@ -3390,7 +3428,13 @@ var RouteStore = class {
 	/** Persist one active route and refresh the cache. */
 	async put(key, record) {
 		await this.deps.domain()?.routes.put(key, record);
-		this.active.set(key, normalizeRouteRecord(record));
+		const normalized = normalizeRouteRecord(record);
+		this.active.set(key, normalized);
+		await this.recordOrigins(normalized);
+	}
+	/** Feishu origin of one Session any route ever named, retired routes included. */
+	origin(sessionId) {
+		return this.deps.domain()?.sessionOrigins.get(sessionId);
 	}
 	/** Delete one active route from the medium and the cache. */
 	async remove(key) {
@@ -3418,6 +3462,33 @@ var RouteStore = class {
 		this.active.clear();
 		this.expired.clear();
 	}
+	/**
+	* Write an origin for every Session in the route's history that has none.
+	* Existing origins are never rewritten: the first route naming a Session
+	* is where it started. Failures are logged and never fail the route write.
+	*/
+	async recordOrigins(record) {
+		const table = this.deps.domain()?.sessionOrigins;
+		if (table === void 0) return;
+		for (const entry of normalizeSessionHistory(record)) {
+			if (table.get(entry.sessionId) !== void 0) continue;
+			const origin = {
+				key: entry.sessionId,
+				routeKey: record.key,
+				kind: record.kind,
+				chatId: record.chatId,
+				chatType: record.chatType,
+				senderUserId: record.senderUserId,
+				createdAt: entry.createdAt,
+				...record.shared === true ? { shared: true } : {}
+			};
+			try {
+				await table.put(entry.sessionId, origin);
+			} catch (error) {
+				this.deps.warn("dsh-channels: recording the origin of session %s failed: %s", entry.sessionId, String(error));
+			}
+		}
+	}
 	/** Whether one active route has crossed the configured inactivity deadline. */
 	hasExpired(record, now) {
 		const ttlMs = this.deps.ttlMs();
@@ -3504,7 +3575,12 @@ const BASE_REQUIREMENTS = [
 	{
 		anyOf: ["im:chat:readonly", "im:chat"],
 		level: "optional",
-		purpose: "机器人入群后读取群信息、发送群信息卡"
+		purpose: "机器人入群后读取群信息、发送群信息卡；Web 页面显示群名和群头像"
+	},
+	{
+		anyOf: ["contact:user.base:readonly"],
+		level: "optional",
+		purpose: "Web 页面显示用户真实姓名和头像"
 	}
 ];
 /** Panel sync needs, applicable while `slashCommandPanel` is on. */
@@ -4279,6 +4355,19 @@ function thrownErrorFields(error) {
 function assertFeishuOk(response) {
 	if (response.code !== void 0 && response.code !== 0) throw new FeishuApiError(`code=${response.code}${response.msg === void 0 ? "" : ` ${response.msg}`}`, response.code);
 }
+/** Member-list pages `memberName()` scans before giving up (100 members each). */
+const MEMBER_NAME_PAGES = 5;
+/** `user_ids` per `contact.v3.user.batch` call (the API maximum). */
+const USER_BATCH_SIZE = 50;
+/** Keep a non-blank name and an `https:` avatar URL from one Feishu response. */
+function feishuProfile(name, avatar) {
+	const trimmed = name?.trim();
+	const avatarUrl = avatar !== void 0 && /^https:\/\/[^\s"'<>]+$/u.test(avatar) ? avatar : void 0;
+	return {
+		...trimmed === void 0 || trimmed === "" ? {} : { name: trimmed },
+		...avatarUrl === void 0 ? {} : { avatarUrl }
+	};
+}
 /** Run one raw request, mapping thrown and non-zero-code failures to {@link FeishuApiError}. */
 async function feishuCall(call) {
 	let response;
@@ -4415,6 +4504,49 @@ var LarkChannelAdapter = class {
 	async getChatInfo(chatId) {
 		return this.channel.getChatInfo(chatId);
 	}
+	async userProfiles(userIds) {
+		const client = this.channel.rawClient;
+		const profiles = /* @__PURE__ */ new Map();
+		for (let offset = 0; offset < userIds.length; offset += USER_BATCH_SIZE) {
+			const response = await feishuCall(() => client.contact.v3.user.batch({ params: {
+				user_ids: userIds.slice(offset, offset + USER_BATCH_SIZE),
+				user_id_type: "user_id"
+			} }));
+			for (const item of response.data?.items ?? []) {
+				if (item.user_id === void 0) continue;
+				profiles.set(item.user_id, feishuProfile(item.name, item.avatar?.avatar_72));
+			}
+		}
+		return profiles;
+	}
+	async chatProfile(chatId) {
+		const client = this.channel.rawClient;
+		const response = await feishuCall(() => client.im.v1.chat.get({ path: { chat_id: chatId } }));
+		return feishuProfile(response.data?.name, response.data?.avatar);
+	}
+	async memberName(userId, chatId) {
+		const client = this.channel.rawClient;
+		let pageToken;
+		for (let page = 0; page < MEMBER_NAME_PAGES; page += 1) {
+			let response;
+			try {
+				response = await feishuCall(() => client.im.v1.chatMembers.get({
+					path: { chat_id: chatId },
+					params: {
+						member_id_type: "user_id",
+						page_size: 100,
+						...pageToken === void 0 ? {} : { page_token: pageToken }
+					}
+				}));
+			} catch (_membersUnavailable) {
+				return;
+			}
+			const hit = response.data?.items?.find((item) => item.member_id === userId)?.name?.trim();
+			if (hit !== void 0 && hit !== "") return hit;
+			pageToken = response.data?.page_token;
+			if (response.data?.has_more !== true || pageToken === void 0) return void 0;
+		}
+	}
 	botOpenId() {
 		return this.channel.botIdentity?.openId;
 	}
@@ -6727,7 +6859,7 @@ var InboundRouter = class {
 		} catch (error) {
 			this.ctx.logger?.warn?.("dsh-channels: recording processed message %s failed: %s", msg.messageId, String(error));
 		}
-		if (content.startsWith("/")) {
+		if (content.startsWith("/") && this.deps.commands.owns(content)) {
 			await this.deps.commands.handleSlash(msg, content);
 			return;
 		}
@@ -16148,14 +16280,21 @@ const configSchema = z.object({
 	* Admission policy for inbound Feishu traffic.
 	*
 	* - `guarded` (default): only the configured administrator can talk in
-	*   private chats, and a group conversation additionally requires the group
-	*   to be authorized and the sender to be the administrator or an explicitly
+	*   private chats (plus whitelisted users when `dmAllowWhitelist` is on),
+	*   and a group conversation additionally requires the group to be
+	*   authorized and the sender to be the administrator or an explicitly
 	*   authorized user.
 	* - `open`: legacy behavior — any user inside the app's availability scope
 	*   can start a conversation. Debug/compatibility only; unsafe.
 	*/
 	accessMode: z.enum(["open", "guarded"]).default("guarded"),
 	/**
+	* In `guarded` mode, also admit users on the global user whitelist
+	* (`/auth user`) in private chats. Off by default: private chats stay
+	* administrator-only. Each private-chat user already has an own workspace.
+	*/
+	dmAllowWhitelist: z.boolean().default(false),
+	/**
 	* The unique administrator's Feishu `user_id`. Set it in the Web
 	* settings panel (or the profile config). Get it by sending `/userid` to the
 	* bot in a private chat. When unset, the Feishu app owner (looked up via
@@ -16256,6 +16395,14 @@ const ACCESS_REQUESTS_ROUTE = "/dsh-channels/access/requests";
 * [`EditableFieldWire.browse`]，保留手写输入。
 */
 const PICK_DIRECTORY_ROUTE = "/dsh-channels/pick-directory";
+/** 会话的飞书来源（GET/HEAD，`?sessionId=`）：对话右侧栏「飞书来源」标签与会话头部入口使用。 */
+const SESSION_ORIGIN_ROUTE = "/dsh-channels/session-origin";
+/**
+* `GET PROFILES_ROUTE?users=<user_id,...>&chats=<chat_id,...>`: live Feishu
+* names and avatars for the users and chats the panel shows. At most
+* {@link PROFILES_MAX_IDS} ids per list.
+*/
+const PROFILES_ROUTE = "/dsh-channels/profiles";
 /**
 * 可由 Web 面板覆盖的配置项。顶层键对应 `src/config.ts` 的字段；`feishuTools.*`
 * 是嵌套字段（覆盖层里仍写成 `{ "feishuTools": { ... } }` 对象）。覆盖值写进
@@ -16307,6 +16454,7 @@ const EDITABLE_KEYS = [
 	"feishuTools.topicMessagesTimeoutMs",
 	"promptContextTimeoutMs",
 	"accessMode",
+	"dmAllowWhitelist",
 	"adminUserId",
 	"authRequestTtlDays",
 	"feishuTools.wikiRead",
@@ -16457,7 +16605,10 @@ const PANEL_COPY = {
 	cleared: "已恢复为 profile 配置",
 	debugModeWarning: "调试模式已打开：应用可用范围内的任何人都能和机器人对话。用完请在「访问授权」关闭。",
 	accessAdminMissingWarning: "没有可用的管理员，所有对话都会被拒绝。请在下方填写管理员 user_id（私聊机器人发送 /userid 获取）。",
-	accessAdminOwnerSummary: "未单独设置，正在使用应用所有者 {id}",
+	accessAdminCurrent: "当前管理员",
+	accessAdminSourceConfig: "已配置",
+	accessAdminSourceOwner: "应用所有者",
+	profilesWarning: "部分飞书名字和头像未能读取：{reason}",
 	accessNotLoaded: "飞书连接建立后加载授权列表",
 	accessRequestsTitle: "待处理申请",
 	accessGroupsTitle: "已授权群",
@@ -16766,6 +16917,18 @@ const APP_OWNER_LOOKUP_TIMEOUT_MS = 1e4;
 const SCOPE_CHECK_TIMEOUT_MS = 1e4;
 /** Upper bound on the whole post-connect slash-command panel sync (one list plus per-command writes). */
 const SLASH_COMMAND_SYNC_TIMEOUT_MS = 3e4;
+/**
+* How long one resolved user or chat profile is reused. Short enough that
+* every page entry shows current Feishu data; long enough that the session
+* header and its sidebar tab opening together cost one lookup.
+*/
+const PROFILE_TTL_MS = 30 * 1e3;
+/** The Feishu `code=<n> <msg>` of a failed API call, else the error text. */
+function feishuReason(error) {
+	return error instanceof FeishuApiError ? error.detail : messageOf$3(error);
+}
+/** Feishu `chat_id`s the profile lookup accepts. */
+const FEISHU_CHAT_ID_PATTERN = /^oc_[A-Za-z0-9_-]+$/u;
 /** Wrap the host's storage facility open behind a stable local type. */
 async function openFeishuDomain(ctx) {
 	const domain = await ctx.storageDomain.open(feishuDomain);
@@ -16778,6 +16941,7 @@ async function openFeishuDomain(ctx) {
 	const accessRequestsRaw = domain.table("access_requests");
 	const accessWikiUsersRaw = domain.table("access_wiki_users");
 	const analyzeRequestsRaw = domain.table("analyze_requests");
+	const sessionOriginsRaw = domain.table("session_origins");
 	return {
 		routes: {
 			get: (key) => table.get(key),
@@ -16832,6 +16996,10 @@ async function openFeishuDomain(ctx) {
 			put: (key, value) => analyzeRequestsRaw.put(key, value),
 			entries: () => analyzeRequestsRaw.entries()
 		},
+		sessionOrigins: {
+			get: (key) => sessionOriginsRaw.get(key),
+			put: (key, value) => sessionOriginsRaw.put(key, value)
+		},
 		getGlobal: () => domain.global.get() ?? {},
 		setGlobal: (value) => domain.global.set(value),
 		close: () => domain.close()
@@ -16978,6 +17146,8 @@ var FeishuService = class {
 	* is unset. Cleared on shutdown so a reconnect looks it up again.
 	*/
 	appOwner;
+	/** Live-resolved user and chat profiles, by `user:`/`chat:` key; misses are kept as `{}`. */
+	profileCache = /* @__PURE__ */ new Map();
 	/** Post-connect scope self-check; cleared on shutdown. */
 	scopeCheckState;
 	/** Post-connect slash-command panel sync; cleared on shutdown. */
@@ -17156,7 +17326,13 @@ var FeishuService = class {
 			streamer: () => this.streamer,
 			questionAnswerer: () => this.questionAnswerer,
 			approvalAnswerer: () => this.approvalAnswerer,
-			commands: { handleSlash: (msg, line) => this.handleSlashMessage(msg, line) }
+			commands: {
+				owns: (line) => {
+					const parsed = parseSlashCommand(line);
+					return parsed !== void 0 && commandSpec(parsed.name) !== void 0;
+				},
+				handleSlash: (msg, line) => this.handleSlashMessage(msg, line)
+			}
 		});
 		this.analyzeLauncher = new AnalyzeLauncher({
 			ctx: this.ctx,
@@ -17645,6 +17821,118 @@ var FeishuService = class {
 			};
 		}
 	}
+	/** Panel: Feishu origin of one Session, or null when Feishu never routed it. */
+	async sessionOrigin(sessionId) {
+		const origin = this.routes.origin(sessionId);
+		if (origin === void 0) return null;
+		const route = this.routes.findBySession(sessionId);
+		const bound = route !== void 0;
+		const group = origin.chatType === "group";
+		const profiles = await this.feishuProfiles([origin.senderUserId], group ? [origin.chatId] : []);
+		const chat = profiles.chats[origin.chatId] ?? {};
+		const sender = profiles.users[origin.senderUserId] ?? {};
+		const senderName = sender.name ?? (group ? await this.memberName(origin.senderUserId, origin.chatId) : void 0);
+		return {
+			sessionId,
+			chatType: origin.chatType,
+			kind: origin.kind,
+			chatId: origin.chatId,
+			...chat.name === void 0 ? {} : { chatName: chat.name },
+			...chat.avatarUrl === void 0 ? {} : { chatAvatarUrl: chat.avatarUrl },
+			senderUserId: origin.senderUserId,
+			...senderName === void 0 ? {} : { senderName },
+			...sender.avatarUrl === void 0 ? {} : { senderAvatarUrl: sender.avatarUrl },
+			shared: origin.shared === true,
+			createdAt: origin.createdAt,
+			bound,
+			...bound ? { lastActivityAt: route.lastActivityAt } : {},
+			chatLink: `https://applink.feishu.cn/client/chat/open?openChatId=${encodeURIComponent(origin.chatId)}`
+		};
+	}
+	/**
+	* Live Feishu names and avatars for the panel and the session-origin view,
+	* through a {@link PROFILE_TTL_MS} cache. Ids that are not Feishu
+	* `user_id`s / `chat_id`s are skipped; a disconnected channel and failed
+	* lookups leave ids absent, and failures are reported in `warning` and not
+	* cached.
+	* @param userIds - user `user_id`s to resolve.
+	* @param chatIds - chat `chat_id`s to resolve.
+	* @returns the resolved profiles by id.
+	*/
+	async feishuProfiles(userIds, chatIds) {
+		const result = {
+			users: {},
+			chats: {}
+		};
+		const warnings = [];
+		const now = Date.now();
+		for (const [key, cached] of this.profileCache) if (now - cached.at >= PROFILE_TTL_MS) this.profileCache.delete(key);
+		const fresh = (key) => this.profileCache.get(key)?.profile;
+		const keep = (target, id, profile) => {
+			if (profile.name !== void 0 || profile.avatarUrl !== void 0) target[id] = profile;
+		};
+		const users = [...new Set(userIds)].filter((id) => FEISHU_USER_ID_PATTERN.test(id));
+		const chats = [...new Set(chatIds)].filter((id) => FEISHU_CHAT_ID_PATTERN.test(id));
+		const missingUsers = [];
+		for (const id of users) {
+			const cached = fresh(`user:${id}`);
+			if (cached === void 0) missingUsers.push(id);
+			else keep(result.users, id, cached);
+		}
+		const missingChats = [];
+		for (const id of chats) {
+			const cached = fresh(`chat:${id}`);
+			if (cached === void 0) missingChats.push(id);
+			else keep(result.chats, id, cached);
+		}
+		const channel = this.channel;
+		if (channel === void 0) return result;
+		const lookups = [];
+		if (missingUsers.length > 0 && channel.userProfiles !== void 0) lookups.push(channel.userProfiles(missingUsers).then((found) => {
+			for (const id of missingUsers) {
+				const profile = found.get(id) ?? {};
+				this.profileCache.set(`user:${id}`, {
+					profile,
+					at: now
+				});
+				keep(result.users, id, profile);
+			}
+		}, (error) => {
+			warnings.push(`读取用户资料失败：${feishuReason(error)}`);
+		}));
+		const chatProfile = channel.chatProfile?.bind(channel);
+		if (chatProfile !== void 0) {
+			let chatError;
+			for (const id of missingChats) lookups.push(chatProfile(id).then((profile) => {
+				this.profileCache.set(`chat:${id}`, {
+					profile,
+					at: now
+				});
+				keep(result.chats, id, profile);
+			}, (error) => {
+				if (chatError !== void 0) return;
+				chatError = `读取群信息失败：${feishuReason(error)}`;
+				warnings.push(chatError);
+			}));
+		}
+		await Promise.all(lookups);
+		if (warnings.length > 0) {
+			result.warning = warnings.join("；");
+			this.ctx.logger?.debug?.("dsh-channels: Feishu profile lookup: %s", result.warning);
+		}
+		return result;
+	}
+	/** Chat-member-list name for a user the contact profile cannot name. */
+	async memberName(userId, chatId) {
+		const cached = this.profileCache.get(`member:${chatId}:${userId}`);
+		if (cached !== void 0 && Date.now() - cached.at < PROFILE_TTL_MS) return cached.profile.name;
+		const name = await this.channel?.memberName?.(userId, chatId);
+		this.profileCache.set(`member:${chatId}:${userId}`, {
+			profile: name === void 0 ? {} : { name },
+			at: Date.now()
+		});
+		return name;
+	}
 	/** Panel: decide one pending authorization request (same path as the card). */
 	async resolveAccessRequest(token, decision) {
 		const requests = this.accessRequests;
@@ -18234,6 +18522,7 @@ var FeishuService = class {
 				await this.delivery.standaloneReply(msg, standaloneInfoCard("**🔐 访问授权状态**", [
 					`**准入模式**：\`${this.config.accessMode}\``,
 					`**管理员**：${this.adminStatusLine()}`,
+					`**私聊**：${this.config.dmAllowWhitelist ? "管理员与白名单用户" : "仅管理员"}`,
 					...msg.chatType === "group" ? [`**本群**：${this.accessStore.hasGroup(msg.chatId) ? "已授权" : "未授权"}（\`${msg.chatId}\`）`] : [],
 					`**白名单**：群 ${groups.length} 个 · 用户 ${users.length} 个 · 知识库 ${this.accessStore.wikiUserRecords().length} 个 · 待处理申请 ${pending.length} 个`,
 					"群授权：`/auth allow` 或 `/auth revoke`（在目标群内发）；用户授权：`/auth user add @用户` 或 `/auth user add <user_id>`；知识库授权：`/auth wiki add @用户`。"
@@ -19364,6 +19653,11 @@ async function readJsonBody(req) {
 		throw new HttpError(400, "请求体不是合法 JSON");
 	}
 }
+/** Distinct non-empty entries of one comma-separated id query parameter. */
+function idList(raw) {
+	if (raw === null) return [];
+	return [...new Set(raw.split(",").map((id) => id.trim()).filter((id) => id !== ""))];
+}
 /**
 * Parse one JSON-object body for an access write. HttpErrors are answered
 * here (415/413/400); `undefined` means "already responded, stop".
@@ -19469,6 +19763,50 @@ function registerSettingsRoutes(server, gate, surface) {
 				sendJson(res, 200, await surface.catalogFor(url.searchParams.get("provider") ?? void 0, url.searchParams.get("model") ?? void 0));
 			})
 		}),
+		server.register({
+			kind: "exact",
+			path: SESSION_ORIGIN_ROUTE,
+			handler: guarded(async (req, res) => {
+				if (!allowOnly(req, res, ["GET", "HEAD"])) return;
+				if (methodOf(req) === "HEAD") {
+					res.writeHead(200, { "cache-control": "no-store" });
+					res.end();
+					return;
+				}
+				const sessionId = new URL(req.url ?? "/", "http://dsh.local").searchParams.get("sessionId")?.trim();
+				if (sessionId === void 0 || sessionId === "") {
+					sendJson(res, 400, {
+						ok: false,
+						error: "缺少 sessionId 参数"
+					});
+					return;
+				}
+				sendJson(res, 200, await surface.sessionOrigin(sessionId));
+			})
+		}),
+		server.register({
+			kind: "exact",
+			path: PROFILES_ROUTE,
+			handler: guarded(async (req, res) => {
+				if (!allowOnly(req, res, ["GET", "HEAD"])) return;
+				if (methodOf(req) === "HEAD") {
+					res.writeHead(200, { "cache-control": "no-store" });
+					res.end();
+					return;
+				}
+				const params = new URL(req.url ?? "/", "http://dsh.local").searchParams;
+				const userIds = idList(params.get("users"));
+				const chatIds = idList(params.get("chats"));
+				if (userIds.length > 200 || chatIds.length > 200) {
+					sendJson(res, 400, {
+						ok: false,
+						error: `每次最多查询 200 个用户和 200 个群`
+					});
+					return;
+				}
+				sendJson(res, 200, await surface.feishuProfiles(userIds, chatIds));
+			})
+		}),
 		server.register({
 			kind: "exact",
 			path: CONFIG_ROUTE,
@@ -19742,6 +20080,7 @@ const BOOLEAN_KEYS = /* @__PURE__ */ new Set([
 	"welcomeOnboarding",
 	"slashCommandPanel",
 	"allowPermissionSwitch",
+	"dmAllowWhitelist",
 	"acceptAttachments",
 	"prefetchImages",
 	"feishuTools.attachmentFetch",
@@ -20145,7 +20484,13 @@ const FIELD_META = {
 		label: "调试模式",
 		group: "access",
 		summary: "打开后所有人都能聊，不安全，只在调试时用",
-		help: "关闭时（默认）：管理员随时可用；非管理员私聊会被拒绝；群聊要同时满足群已授权、发言人在用户白名单里。授权入口有三个：群里 /auth 命令、授权卡、本页。撤销立即生效。"
+		help: "关闭时（默认）：管理员随时可用；非管理员私聊会被拒绝（打开「白名单用户可私聊」后白名单用户也可以）；群聊要同时满足群已授权、发言人在用户白名单里。授权入口有三个：群里 /auth 命令、授权卡、本页。撤销立即生效。"
+	},
+	dmAllowWhitelist: {
+		label: "白名单用户可私聊",
+		group: "access",
+		summary: "关闭时私聊仅管理员可用",
+		help: "打开后「已授权用户」里的人也可以私聊机器人，各自使用独立的私聊工作区，能力与群聊相同；不在白名单的人仍收到固定提示。撤销用户立即生效。"
 	},
 	adminUserId: {
 		label: "管理员 user_id",
@@ -20494,6 +20839,19 @@ var SettingsSurface = class {
 	* the draft provider/model changes). A broken lookup degrades to the
 	* free-text form instead of failing the panel.
 	*/
+	/** Feishu origin of one Session for the conversation sidebar. */
+	async sessionOrigin(sessionId) {
+		return { origin: await this.target.sessionOrigin(sessionId) };
+	}
+	/**
+	* Live Feishu names and avatars for the panel's users and chats.
+	* @param userIds - user `user_id`s.
+	* @param chatIds - chat `chat_id`s.
+	* @returns the profiles Feishu resolved.
+	*/
+	async feishuProfiles(userIds, chatIds) {
+		return this.target.feishuProfiles(userIds, chatIds);
+	}
 	async catalogFor(provider, model) {
 		if (this.catalog === void 0) return emptyCatalog();
 		try {
@@ -21286,6 +21644,6 @@ function apply(ctx, config) {
 	}, "dsh-channels");
 }
 //#endregion
-export { AUTH_USER_TARGET_ERRORS, AccessController, AccessRequests, AccessStore, ApprovalAnswerer, CARD_MAX_BYTES, CARD_TARGET_BYTES, CATALOG_ROUTE, CHANNEL_COMMAND_NAMES, CONFIG_ROUTE, CREDENTIALS_ROUTE, Config, DM_DENY_TEXT, DM_UNCONFIGURED_TEXT, DSH_CHANNELS_VERSION, EDITABLE_KEYS, EMPTY_TOTALS, FIELD_DESCRIPTORS, FeishuService, HEALTH_DEPENDENCY_NAMES, INTERRUPTION_NOTICE, LOGICAL_EXPORT_FORMAT, LOGICAL_EXPORT_FORMAT_VERSION, MAX_QUESTION_OPTIONS, MAX_TABLES_PER_CARD, OverlayStore, PANEL_CHEVRON_TOKEN, PANEL_COPY, PANEL_ROUTE, PANEL_TITLES, PICK_DIRECTORY_ROUTE, QuestionAnswerer, REASONING_MAX_BYTES, RECONNECT_ROUTE, RESTART_KEYS, RouteOperationQueue, SESSION_HISTORY_DISPLAY_LIMIT, STATUS_ROUTE, SUPPORTED_COMMAND_NAMES, SettingsSurface, TRUNCATION_SUFFIX, TurnStreamer, accessGroupRecordSchema, accessRequestRecordSchema, accessUserRecordSchema, addUsage, appendSessionHistory, apply, applyCatalog, applyProjectionViews, armModelCommand, averageDecodeTokensPerSecond, averageTtftMs, buildApprovalCard, buildApprovalSettledCard, buildCard, buildCommandResultCard, buildCompactComparisonCard, buildGroupInfoCard, buildHealthCard, buildInterruptionCard, buildQuestionCard, buildQuestionSettledCard, buildRenewCard, buildRequestSettledCard, buildSessionHistoryCard, buildSessionStatusCard, buildUserRequestCard, buildWorkDirCard, cacheHitPct, cardJsonBytes, chatRouteKey, commandResultCardKind, compactFailureContext, countFiberStates, createHostCatalog, createLogicalSessionExport, createSettingsDirectoryPicker, decideAccess, defaultOverlayPath, emptyCatalog, ensureWorkspace, expiredRouteRecordSchema, feishuDomain, foldAll, foldEvent, foldHealthSnapshot, foldSessionStats, inflightSnapshotSchema, inject, isAdminUserId, isSameOriginRequest, isSupportedCommand, maskOpenIdTail, measureSessionContext, mergeOverlay, mountSettingsRoutes, name, normalizeCredentialValue, normalizeOverlay, normalizeRouteRecord, normalizeSessionHistory, parseOverlay, parseSlashCommand, pickEditable, processedRecordSchema, querySessionHistory, readProjectionViews, registerChannelCommands, registerModelCommand, registerSettingsRoutes, resolveAuthUserTarget, resolveDshHome, resolveWorkDir, routeRecordSchema, segmentCardContent, serializeLogicalSession, sessionDirOf, sessionHistoryEntrySchema, splitBodyForCard, stagingPathFor, stagingRoot, stripTables, supportedCommandHelp, supportedCommandList, tableBlocks, topicDirFor, topicTokenFor, usageFromBuckets, withDirectoryBrowse, workspacePathFor, workspaceTitleFor, worktreeBranchFor };
+export { AUTH_USER_TARGET_ERRORS, AccessController, AccessRequests, AccessStore, ApprovalAnswerer, CARD_MAX_BYTES, CARD_TARGET_BYTES, CATALOG_ROUTE, CHANNEL_COMMAND_NAMES, CONFIG_ROUTE, CREDENTIALS_ROUTE, Config, DM_DENY_TEXT, DM_DENY_WHITELIST_TEXT, DM_UNCONFIGURED_TEXT, DSH_CHANNELS_VERSION, EDITABLE_KEYS, EMPTY_TOTALS, FIELD_DESCRIPTORS, FeishuService, HEALTH_DEPENDENCY_NAMES, INTERRUPTION_NOTICE, LOGICAL_EXPORT_FORMAT, LOGICAL_EXPORT_FORMAT_VERSION, MAX_QUESTION_OPTIONS, MAX_TABLES_PER_CARD, OverlayStore, PANEL_CHEVRON_TOKEN, PANEL_COPY, PANEL_ROUTE, PANEL_TITLES, PICK_DIRECTORY_ROUTE, QuestionAnswerer, REASONING_MAX_BYTES, RECONNECT_ROUTE, RESTART_KEYS, RouteOperationQueue, SESSION_HISTORY_DISPLAY_LIMIT, STATUS_ROUTE, SUPPORTED_COMMAND_NAMES, SettingsSurface, TRUNCATION_SUFFIX, TurnStreamer, accessGroupRecordSchema, accessRequestRecordSchema, accessUserRecordSchema, addUsage, appendSessionHistory, apply, applyCatalog, applyProjectionViews, armModelCommand, averageDecodeTokensPerSecond, averageTtftMs, buildApprovalCard, buildApprovalSettledCard, buildCard, buildCommandResultCard, buildCompactComparisonCard, buildGroupInfoCard, buildHealthCard, buildInterruptionCard, buildQuestionCard, buildQuestionSettledCard, buildRenewCard, buildRequestSettledCard, buildSessionHistoryCard, buildSessionStatusCard, buildUserRequestCard, buildWorkDirCard, cacheHitPct, cardJsonBytes, chatRouteKey, commandResultCardKind, compactFailureContext, countFiberStates, createHostCatalog, createLogicalSessionExport, createSettingsDirectoryPicker, decideAccess, defaultOverlayPath, emptyCatalog, ensureWorkspace, expiredRouteRecordSchema, feishuDomain, foldAll, foldEvent, foldHealthSnapshot, foldSessionStats, inflightSnapshotSchema, inject, isAdminUserId, isSameOriginRequest, isSupportedCommand, maskOpenIdTail, measureSessionContext, mergeOverlay, mountSettingsRoutes, name, normalizeCredentialValue, normalizeOverlay, normalizeRouteRecord, normalizeSessionHistory, parseOverlay, parseSlashCommand, pickEditable, processedRecordSchema, querySessionHistory, readProjectionViews, registerChannelCommands, registerModelCommand, registerSettingsRoutes, resolveAuthUserTarget, resolveDshHome, resolveWorkDir, routeRecordSchema, segmentCardContent, serializeLogicalSession, sessionDirOf, sessionHistoryEntrySchema, splitBodyForCard, stagingPathFor, stagingRoot, stripTables, supportedCommandHelp, supportedCommandList, tableBlocks, topicDirFor, topicTokenFor, usageFromBuckets, withDirectoryBrowse, workspacePathFor, workspaceTitleFor, worktreeBranchFor };
 
 //# sourceMappingURL=index.js.map