@mrrisega/dsh-remote 0.7.12-beta.3 → 0.7.12-beta.5

package/packages/dsh-remote-web/test/im-bots.test.mjs

@@ -632,143 +632,100 @@ test("POST /im-deps/feishu：安装失败 → phase=failed + 人话原因（netw
   });
 });
 
-// ─────────────────── 钉钉「扫码一键创建机器人」device-flow（2026-11-08） ───────────────────
-
-/** 假钉钉接口（注入 imAuthFetch；测试绝不真的打 oapi.dingtalk.com）。 */
-function makeAuthFetch(plan = {}) {
-  const calls = [];
-  const resp = (body, ok = true, status = 200) => ({ ok, status, json: async () => body });
-  const fn = async (url, opts) => {
-    const body = opts && opts.body ? JSON.parse(opts.body) : {};
-    calls.push({ url: String(url), body });
-    const u = String(url);
-    if (u.endsWith("/init")) {
-      if (plan.initThrows) throw new Error("ECONNRESET");
-      return resp(plan.init || { nonce: "nonce-1" });
-    }
-    if (u.endsWith("/begin")) {
-      if (plan.beginRejected) return resp({ errmsg: "rejected" }, false, 400);
-      return resp(plan.begin || { device_code: "dc-secret", verification_uri_complete: "https://oapi.dingtalk.com/auth?x=1", interval: 2, expires_in: 120 });
-    }
-    if (u.endsWith("/poll")) {
-      if (plan.pollThrows) throw new Error("ETIMEDOUT");
-      return resp(plan.polls && plan.polls.length ? plan.polls.shift() : { status: "WAITING" });
-    }
-    throw new Error("unexpected url " + u);
-  };
-  fn.calls = calls;
-  return fn;
-}
+// ─────────────────── 钉钉扫码授权：**委托桥侧持久化**（2026-11-08 架构修正） ───────────────────
+//
+// 契约（与桥约定）：
+//   · 插件只写命令文件 <relayDir>/im-dingtalk-auth-cmd.json {action:"begin"|"cancel", at}
+//   · 桥持久化 device_code/断点续轮询，把进度写进 im-bot-status.json 的 dingtalk.auth
+//   · 插件 GET status 直接读状态文件；**自身不存内存会话、不调 oapi.dingtalk.com**
+
+const readCmd = async (relayDir) => {
+  const raw = await readFile(path.join(relayDir, "im-dingtalk-auth-cmd.json"), "utf8");
+  return { data: JSON.parse(raw), mode: (await stat(path.join(relayDir, "im-dingtalk-auth-cmd.json"))).mode & 0o777 };
+};
+const writeAuthStatus = (relayDir, auth) => writeFile(path.join(relayDir, "im-bot-status.json"),
+  JSON.stringify({ updatedAt: Date.now(), dingtalk: { enabled: true, connected: false, auth } }));
 
-test("POST /im-dingtalk-auth/begin：返回 authId/url/interval/expiresIn；device_code 绝不落浏览器", async () => {
+test("POST begin：只写命令文件 {action:'begin', at}（0600），**不返回 URL**（URL 在桥状态里）", async () => {
   const relayDir = await tmpRelay();
-  const imAuthFetch = makeAuthFetch();
-  await withHost(relayDir, { imAuthFetch }, async (base) => {
+  await withHost(relayDir, {}, async (base) => {
+    const before = Date.now();
     const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
     assert.equal(r.status, 200);
     assert.equal(r.body.ok, true);
-    assert.ok(r.body.authId, "必须给浏览器一个 authId 句柄");
-    assert.equal(r.body.url, "https://oapi.dingtalk.com/auth?x=1");
-    assert.equal(r.body.interval, 2);
-    assert.equal(r.body.expiresIn, 120);
-    const raw = JSON.stringify(r.body);
-    assert.ok(!raw.includes("dc-secret"), "★ device_code 不能下发给浏览器");
-  });
-});
-
-test("POST begin 限流：同一时间只允许一个授权，旧 authId 查询回 cancelled", async () => {
-  const relayDir = await tmpRelay();
-  const imAuthFetch = makeAuthFetch();
-  await withHost(relayDir, { imAuthFetch }, async (base) => {
-    const a = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    const b = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    assert.ok(a.body.authId && b.body.authId && a.body.authId !== b.body.authId);
-    const old = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=${encodeURIComponent(a.body.authId)}`);
-    assert.equal(old.body.status, "failed");
-    assert.equal(old.body.code, "cancelled", "旧授权必须被作废（而不是继续有效）");
-    const cur = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=${encodeURIComponent(b.body.authId)}`);
-    assert.equal(cur.body.status, "waiting");
-  });
-});
-
-test("GET status：waiting → success 时把凭据写入 im-bots.json（0600、credentialSource=scan），响应不回 secret", async () => {
-  const relayDir = await tmpRelay();
-  const imAuthFetch = makeAuthFetch({
-    polls: [
-      { status: "WAITING" },
-      { status: "SUCCESS", client_id: "ding-client-8899", client_secret: "DING-SCAN-SECRET" },
-    ],
-  });
-  await withHost(relayDir, { imAuthFetch }, async (base) => {
-    const begin = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    const id = encodeURIComponent(begin.body.authId);
-    let st = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=${id}`);
-    assert.equal(st.body.status, "waiting", "用户还没确认 → waiting");
-    st = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=${id}`);
-    assert.equal(st.body.status, "success");
-    assert.equal(st.body.credentialSource, "scan");
-    assert.equal(st.body.hasSecret, true);
-    assert.equal(st.body.clientIdTail, "8899");
-    assert.ok(!JSON.stringify(st.body).includes("DING-SCAN-SECRET"), "★ 扫码拿到的 secret 绝不能回给浏览器");
-
-    const cfg = JSON.parse(await readFile(path.join(relayDir, "im-bots.json"), "utf8"));
-    assert.equal(cfg.dingtalk.clientId, "ding-client-8899");
-    assert.equal(cfg.dingtalk.clientSecret, "DING-SCAN-SECRET", "凭据要写入配置文件（桥读）");
-    assert.equal(cfg.dingtalk.credentialSource, "scan");
-    assert.equal(cfg.dingtalk.enabled, true, "扫码成功即可用");
-    const mode = (await stat(path.join(relayDir, "im-bots.json"))).mode & 0o777;
-    assert.equal(mode, 0o600, "配置文件必须 0600");
-
-    // 面板 GET 里也只见 hasSecret，不见 secret
-    const view = await json(`${base}/dsh-remote/im-bots`);
-    assert.equal(view.body.dingtalk.hasSecret, true);
-    assert.equal(view.body.dingtalk.credentialSource, "scan");
-    assert.ok(!JSON.stringify(view.body).includes("DING-SCAN-SECRET"));
+    assert.equal(r.body.url, undefined, "★ begin 不得返回 URL（授权链接要等桥跑完写状态）");
+    assert.equal(r.body.authId, undefined, "★ 不再有插件内存会话 authId");
+    const { data, mode } = await readCmd(relayDir);
+    assert.equal(data.action, "begin");
+    assert.equal(typeof data.at, "number");
+    assert.ok(data.at >= before, "at 应是本次点击时间戳（桥据此判断是否新命令）");
+    assert.equal(mode, 0o600, "命令文件必须 0600");
   });
 });
 
-test("GET status：未知/过期 authId → expired；钉钉拒绝 → failed(dingtalk_api_rejected)；网络不通 → failed(network_error)", async () => {
+test("POST cancel：写 {action:'cancel'} 命令（桥停轮询 + 删持久化会话）", async () => {
   const relayDir = await tmpRelay();
-  await withHost(relayDir, { imAuthFetch: makeAuthFetch() }, async (base) => {
-    const none = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=nope`);
-    assert.equal(none.body.status, "expired");
-    assert.equal(none.body.code, "expired");
+  await withHost(relayDir, {}, async (base) => {
+    const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/cancel`);
+    assert.equal(r.body.ok, true);
+    const { data, mode } = await readCmd(relayDir);
+    assert.equal(data.action, "cancel");
+    assert.equal(mode, 0o600);
+  });
+});
 
-    // 钉钉拒绝 poll
-    const rejDir = await tmpRelay();
-    const rejFetch = makeAuthFetch({ polls: [{ status: "DENIED", message: "用户取消了创建" }] });
-    await withHost(rejDir, { imAuthFetch: rejFetch }, async (base2) => {
-      const b = await post(base2, `${base2}/dsh-remote/im-dingtalk-auth/begin`);
-      const st = await json(`${base2}/dsh-remote/im-dingtalk-auth/status?id=${encodeURIComponent(b.body.authId)}`);
-      assert.equal(st.body.status, "failed");
-      assert.equal(st.body.code, "dingtalk_api_rejected");
-      assert.ok(st.body.message.includes("用户取消"), "钉钉原文原因要带给用户");
+test("GET status：直接读 im-bot-status.json 的 dingtalk.auth（白名单 + 只透 https 链接 + 人话兜底）", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    // 1) idle（无 auth 段）
+    let st = await json(`${base}/dsh-remote/im-dingtalk-auth/status`);
+    assert.equal(st.body.state, "idle");
+    assert.equal(st.body.url, "");
+    assert.equal(st.body.message, "", "idle 不该有错误文案");
+
+    // 2) waiting（带链接/剩余时间/未知字段）
+    await writeAuthStatus(relayDir, {
+      state: "waiting", url: "https://oapi.dingtalk.com/x?nonce=1", expiresAt: 123, remainingSec: 300,
+      deviceCode: "LEAK-DEVICE", clientSecret: "LEAK-SECRET",
     });
+    st = await json(`${base}/dsh-remote/im-dingtalk-auth/status`);
+    assert.equal(st.body.state, "waiting");
+    assert.equal(st.body.url, "https://oapi.dingtalk.com/x?nonce=1");
+    assert.equal(st.body.remainingSec, 300);
+    assert.equal(st.body.expiresAt, 123);
+    assert.ok(!JSON.stringify(st.body).includes("LEAK"), "★ 状态文件里的 device_code/secret 不能透出");
 
-    // 网络错误（poll 抛错）
-    const netDir = await tmpRelay();
-    const netFetch = makeAuthFetch({ pollThrows: true });
-    await withHost(netDir, { imAuthFetch: netFetch }, async (base3) => {
-      const b = await post(base3, `${base3}/dsh-remote/im-dingtalk-auth/begin`);
-      const st = await json(`${base3}/dsh-remote/im-dingtalk-auth/status?id=${encodeURIComponent(b.body.authId)}`);
-      assert.equal(st.body.status, "failed");
-      assert.equal(st.body.code, "network_error");
-    });
+    // 3) 非 https 链接必须过滤（防状态文件被塞 javascript:/data:）
+    await writeAuthStatus(relayDir, { state: "waiting", url: "javascript:alert(1)" });
+    st = await json(`${base}/dsh-remote/im-dingtalk-auth/status`);
+    assert.equal(st.body.url, "", "只允许 https 链接");
+
+    // 4) failed：桥给裸 code/ok 时也要翻成中文人话
+    await writeAuthStatus(relayDir, { state: "failed", message: "ok" });
+    st = await json(`${base}/dsh-remote/im-dingtalk-auth/status`);
+    assert.equal(st.body.state, "failed");
+    assert.match(st.body.message, /[\u4e00-\u9fa5]/, "message 必须中文人话");
+    assert.notEqual(st.body.message, "ok", "★ 绝不裸渲染 ok");
   });
 });
 
-test("POST begin：钉钉接口不可用 → network_error / dingtalk_api_rejected（人话）", async () => {
-  const dir1 = await tmpRelay();
-  await withHost(dir1, { imAuthFetch: makeAuthFetch({ initThrows: true }) }, async (base) => {
-    const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    assert.equal(r.status, 502);
-    assert.equal(r.body.ok, false);
-    assert.equal(r.body.code, "network_error");
-    assert.match(r.body.message, /网络不通/);
-  });
-  const dir2 = await tmpRelay();
-  await withHost(dir2, { imAuthFetch: makeAuthFetch({ beginRejected: true }) }, async (base) => {
-    const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    assert.equal(r.body.code, "dingtalk_api_rejected");
+test("GET /im-bots：status.dingtalk.auth 也按同一白名单透出（面板打开时恢复等待态）", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    await writeAuthStatus(relayDir, { state: "waiting", url: "https://oapi.dingtalk.com/y", remainingSec: 120, clientIdTail: "8899" });
+    const r = await json(`${base}/dsh-remote/im-bots`);
+    const auth = r.body.status.dingtalk.auth;
+    assert.equal(auth.state, "waiting");
+    assert.equal(auth.url, "https://oapi.dingtalk.com/y");
+    assert.equal(auth.remainingSec, 120);
+    assert.ok(!JSON.stringify(r.body).includes("LEAK"));
   });
 });
+
+test("源码约束：插件侧**不再有内存授权会话、不再直连 oapi.dingtalk.com**（只委托桥）", async () => {
+  const src = await readFile(new URL("../lib/index.js", import.meta.url), "utf8");
+  assert.ok(src.includes("im-dingtalk-auth-cmd.json"), "必须有命令文件契约");
+  assert.ok(!src.includes("oapi.dingtalk.com"), "★ 插件不得再自己调钉钉 registration 接口（由桥负责）");
+  assert.ok(!src.includes("dingtalkAuthSessions"), "★ 不得再有插件内存授权会话 Map（进程重启就丢）");
+  assert.ok(!/setInterval\([^)]*dingtalkAuthPollOnce/.test(src), "★ 不得再有插件侧后台轮询 loop");
+});

package/packages/dsh-remote-web/test/panel-ia.test.mjs

@@ -196,8 +196,8 @@ function loadPlugin(opts = {}) {
   let imBotsPutReply = { status: 200, body: { ok: true, wecom: { enabled: true, botId: "aibdemo1234", hasSecret: true, url: "", targetChatId: "" }, status: { connected: false, authenticated: false, lastError: "" }, updatedAt: 0 } };
   let imBotsTestReply = { status: 200, body: { ok: true, connected: true, authenticated: true, lastError: "" } };
   let imDepsReply = { installed: false, phase: "idle", version: "", lastError: "" };
-  let dingAuthBeginReply = { status: 200, body: { ok: true, authId: "auth-1", url: "https://oapi.dingtalk.com/x?nonce=1", interval: 2, expiresIn: 120 } };
-  let dingAuthStatusReplies = [];
+  let dingAuthBeginReply = { status: 200, body: { ok: true } };
+  let dingAuthStatusReply = { ok: true, state: "idle", url: "", remainingSec: 0, message: "" };
   const nextPoll = () => (pollReplies.length > 1 ? pollReplies.shift() : pollReplies[0]);
 
   const makeEl = () => ({
@@ -265,10 +265,13 @@ function loadPlugin(opts = {}) {
         dingAuthCalls.push({ kind: "begin", method: options.method || "POST" });
         return response(dingAuthBeginReply.status, dingAuthBeginReply.body);
       }
+      if (path === "/dsh-remote/im-dingtalk-auth/cancel") {
+        dingAuthCalls.push({ kind: "cancel", method: options.method || "POST" });
+        return response(200, { ok: true });
+      }
       if (path.startsWith("/dsh-remote/im-dingtalk-auth/status")) {
         dingAuthCalls.push({ kind: "status", path });
-        const next = dingAuthStatusReplies.length ? dingAuthStatusReplies.shift() : { status: "waiting" };
-        return response(200, next);
+        return response(200, dingAuthStatusReply);
       }
       if (path === "/dsh-remote/im-deps") {
         depsCalls.push(Date.now());
@@ -347,7 +350,7 @@ function loadPlugin(opts = {}) {
     setImBotsTest(body, status = 200) { imBotsTestReply = { status, body }; },
     setImDeps(body) { imDepsReply = body; },
     setDingAuthBegin(body, status = 200) { dingAuthBeginReply = { status, body }; },
-    setDingAuthStatus(list) { dingAuthStatusReplies = (list || []).slice(); },
+    setDingAuthStatus(body) { dingAuthStatusReply = body || { ok: true, state: "idle" }; },
     dingAuthCalls() { return dingAuthCalls.slice(); },
     depsCalls() { return depsCalls.slice(); },
     depsInstalls() { return depsInstalls.slice(); },
@@ -713,7 +716,7 @@ test("平台列表：企业微信 / 钉钉 / 飞书 / Webhook 都是真入口（
   assert.ok(!texts.some((t) => t.includes("飞书机器人") && t.includes("即将支持")), "飞书不再是即将支持");
 });
 
-test("钉钉主路径：扫码一键创建（begin→等待→轮询→自动成功）+ 顶部「不用去后台」说明；手动配置折叠", async () => {
+test("钉钉主路径：点扫码→begin→轮询桥状态：先生成链接、再等待确认、成功自动切已连接", async () => {
   const plugin = loadPlugin();
   plugin.setImBotsGet({
     ok: true,
@@ -721,7 +724,8 @@ test("钉钉主路径：扫码一键创建（begin→等待→轮询→自动成
     dingtalk: { enabled: false, clientId: "", hasSecret: false, robotCode: "", credentialSource: "" },
     status: { dingtalk: { connected: false }, feishu: {}, deps: { feishu: { installed: false, phase: "idle" } } },
   });
-  plugin.setDingAuthStatus([{ status: "waiting" }, { status: "success", clientIdTail: "8899", credentialSource: "scan", hasSecret: true }]);
+  // 桥还没跑完 begin：状态是 idle → 面板显示"正在生成授权链接…"
+  plugin.setDingAuthStatus({ ok: true, state: "idle", url: "", remainingSec: 0 });
   let tree = await plugin.settle();
   openEntry(tree, "channel");
   tree = await plugin.settle();
@@ -729,41 +733,43 @@ test("钉钉主路径：扫码一键创建（begin→等待→轮询→自动成
   tree = await plugin.settle();
   let dlg = find(tree, (n) => String(n.props?.className || "").split(/\s+/).includes("dru-ia-dialog"));
   assert.ok(dlg, "钉钉配置页应打开");
-  // 主路径：一句说明 + 扫码按钮
-  assert.ok(textOf(dlg).includes("不用去开发者后台创建应用") || textOf(dlg).includes("不需要去开发者后台创建应用"),
-    "顶部要说明不需要去开发者后台创建应用");
+  assert.ok(textOf(dlg).includes("不用去开发者后台创建应用"), "顶部要说明不需要去开发者后台创建应用");
   const scanBtn = btnWith(dlg, "用钉钉扫码，一键创建机器人");
   assert.ok(scanBtn, "主路径必须是一个「扫码一键创建」按钮");
-  // 手动配置默认折叠（不占主路径）
-  assert.equal(find(dlg, (n) => n.props?.id === "dru-ding-client"), undefined, "手动字段默认不应出现（折叠在高级里）");
+  assert.equal(find(dlg, (n) => n.props?.id === "dru-ding-client"), undefined, "手动字段默认折叠");
 
-  // 点扫码 → begin
+  // 点扫码 → begin；此时还没有 URL（桥正在创建）
   scanBtn.props.onClick();
   await flush(); await flush();
   tree = await plugin.settle(3);
-  assert.ok(plugin.dingAuthCalls().some((c) => c.kind === "begin"), "★ 点扫码必须 POST begin");
+  assert.ok(plugin.dingAuthCalls().some((c) => c.kind === "begin"), "★ 点扫码必须 POST begin（写命令文件）");
+  dlg = find(tree, (n) => String(n.props?.className || "").split(/\s+/).includes("dru-ia-dialog"));
+  assert.ok(textOf(dlg).includes("正在生成授权链接"), "URL 未就绪时如实显示正在生成（不瞎编链接）");
+
+  // 桥写回 waiting + url/remainingSec → 面板轮询拿到并展示
+  plugin.setDingAuthStatus({ ok: true, state: "waiting", url: "https://oapi.dingtalk.com/x?nonce=1", remainingSec: 300, expiresAt: Date.now() + 300000 });
+  await plugin.advance(2100);
+  await flush(); await flush();
+  tree = await plugin.settle(3);
   dlg = find(tree, (n) => String(n.props?.className || "").split(/\s+/).includes("dru-ia-dialog"));
-  assert.ok(textOf(dlg).includes("等待你在钉钉里确认"), "要显示等待确认中");
-  assert.ok(textOf(dlg).includes("用手机钉钉扫"), "没有二维码库时要提示用手机钉钉扫链接");
+  assert.ok(textOf(dlg).includes("等待你在钉钉里确认"), "有 URL 后显示等待确认");
+  assert.ok(textOf(dlg).includes("剩余约 5 分钟"), "要显示剩余分钟（remainingSec/60）");
   const link = find(dlg, (n) => n.type === "a" && String(n.props?.href || "").includes("oapi.dingtalk.com"));
   assert.ok(link, "要给出可点击的授权链接");
   assert.equal(link.props.target, "_blank");
   assert.equal(link.props.rel, "noopener");
   assert.ok(btnWith(dlg, "复制授权链接"), "要有复制授权链接按钮");
+  assert.ok(btnWith(dlg, "我已完成授权，检查一下"), "要有手动检查按钮");
+  assert.ok(btnWith(dlg, "取消授权"), "要有取消授权（写 cancel 命令）");
 
-  // 轮询：waiting → success（fake timers 推进 2 轮）
-  await plugin.advance(2100);
-  await flush(); await flush();
-  tree = await plugin.settle(3);
+  // 桥把进度推进到 success → 面板下一次轮询自动切已连接并收起授权块
+  plugin.setDingAuthStatus({ ok: true, state: "success", clientIdTail: "8899", message: "" });
   await plugin.advance(2100);
   await flush(); await flush();
   tree = await plugin.settle(4);
-  assert.ok(plugin.dingAuthCalls().filter((c) => c.kind === "status").length >= 1, "要轮询授权状态");
-  assert.ok(textOf(tree).includes("已创建机器人并建立连接"), "成功后要自动切到已连接状态");
+  assert.ok(textOf(tree).includes("来源：扫码创建"), "成功后自动切到已连接状态（显示来源）");
   assert.ok(textOf(tree).includes("8899"), "成功提示要带 Client ID 尾号");
-  dlg = find(tree, (n) => String(n.props?.className || "").split(/\s+/).includes("dru-ia-dialog"));
-  assert.ok(dlg, "成功后弹层仍开着（用户能直接看到结果/去钉钉试）");
-  assert.ok(!textOf(dlg).includes("等待你在钉钉里确认"), "成功后不再显示等待态");
+  assert.equal(btnWith(tree, "我已完成授权，检查一下"), undefined, "成功后授权块自动收起");
 });
 
 test("钉钉手动模式：折叠展开后 7 步 + 三个坑 + 三字段；官方链接全部 target=_blank rel=noopener 且提交体字段锁死", async () => {
@@ -1288,3 +1294,115 @@ test("飞书依赖下载：点下载 → POST 安装 → 轮询 /im-deps，装
   assert.ok(textOf(tree).includes("1.40.0"), "装好后面板直接显示版本（用户不需要重开弹层）");
   assert.ok(find(tree, (n) => n.props?.id === "dru-fs-appid"), "装好后应出现飞书配置表单");
 });
+
+// ─────────── ⑫ 钉钉授权修正（2026-11-08 生产踩坑：TTL/人话/未配置措辞） ───────────
+
+test("钉钉等待中：「我已完成授权，检查一下」再读一次桥状态；成功即切已连接（关面板也不丢）", async () => {
+  const plugin = loadPlugin();
+  plugin.setImBotsGet({
+    ok: true, wecom: {}, feishu: {}, dingtalk: {},
+    status: { dingtalk: { connected: false }, feishu: {}, deps: { feishu: { installed: false } } },
+  });
+  plugin.setDingAuthStatus({ ok: true, state: "idle", url: "", remainingSec: 0 });
+  let tree = await plugin.settle();
+  openEntry(tree, "channel");
+  tree = await plugin.settle();
+  clickChannelRow(tree, "钉钉机器人");
+  tree = await plugin.settle();
+  btnWith(tree, "用钉钉扫码，一键创建机器人").props.onClick();
+  plugin.setDingAuthStatus({ ok: true, state: "waiting", url: "https://oapi.dingtalk.com/z", remainingSec: 120 });
+  await flush(); await flush();
+  tree = await plugin.settle(3);
+  await plugin.advance(2100);   // 让轮询读到 waiting（url 到位）
+  await flush(); await flush();
+  tree = await plugin.settle(3);
+  const checkBtn = btnWith(tree, "我已完成授权，检查一下");
+  assert.ok(checkBtn, "等待中要有「我已完成授权，检查一下」按钮");
+  const before = plugin.dingAuthCalls().filter((c) => c.kind === "status").length;
+  // 用户已在手机钉钉确认 → 桥把状态写成 success；手动检查只再读一次状态
+  plugin.setDingAuthStatus({ ok: true, state: "success", clientIdTail: "0001", message: "" });
+  checkBtn.props.onClick();
+  await flush(); await flush();
+  tree = await plugin.settle(3);
+  const after = plugin.dingAuthCalls().filter((c) => c.kind === "status").length;
+  assert.ok(after > before, "手动检查必须再读一次 status（桥持久化，不需要面板传 check 参数）");
+  assert.ok(textOf(tree).includes("来源：扫码创建"), "手动检查成功后自动切已连接并收起授权块");
+  assert.equal(btnWith(tree, "我已完成授权，检查一下"), undefined, "成功后授权块自动收起");
+});
+
+test("钉钉授权失败/过期：显示「授权失败：<中文人话>」+ 重试按钮（绝不裸渲染）", async () => {
+  const plugin = loadPlugin();
+  plugin.setImBotsGet({
+    ok: true, wecom: {}, feishu: {}, dingtalk: {},
+    status: { dingtalk: { connected: false, auth: { state: "failed", message: "ok" } }, feishu: {}, deps: { feishu: { installed: false } } },
+  });
+  let tree = await plugin.settle();
+  openEntry(tree, "channel");
+  tree = await plugin.settle();
+  clickChannelRow(tree, "钉钉机器人");
+  tree = await plugin.settle();
+  const t = textOf(tree);
+  assert.ok(t.includes("授权失败"), "桥报 failed 要显示授权失败");
+  assert.ok(t.includes("操作失败，请稍后重试"), "裸 ok 要兜底成中文人话");
+  assert.ok(!/授权失败：\s*ok\s*/m.test(t), "绝不裸渲染 ok");
+});
+
+test("钉钉未配置措辞：enabled=false 显示「未配置」，不是「连接失败」", async () => {
+  const plugin = loadPlugin();
+  plugin.setImBotsGet({
+    ok: true, wecom: {}, feishu: {},
+    dingtalk: { enabled: false, clientId: "", hasSecret: false, robotCode: "", credentialSource: "" },
+    status: { dingtalk: { connected: false, enabled: false, state: "idle", lastError: "未启用（配置里 dingtalk.enabled=false）" }, feishu: {}, deps: { feishu: { installed: false } } },
+  });
+  let tree = await plugin.settle();
+  openEntry(tree, "channel");
+  tree = await plugin.settle();
+  clickChannelRow(tree, "钉钉机器人");
+  tree = await plugin.settle();
+  const t = textOf(tree);
+  assert.ok(t.includes("未配置"), "没有任何凭据时显示「未配置」");
+  assert.ok(!t.includes("连接失败"), "未配置 ≠ 连接失败（业主明确要求）");
+  assert.ok(!t.includes("未启用（配置里 dingtalk.enabled=false）"), "不得把底层 enabled=false 原文透给用户");
+});
+
+test("钉钉连接失败：只有 state=failed 才显示「连接失败：<中文人话>」，绝不裸渲染 code/ok", async () => {
+  const plugin = loadPlugin();
+  plugin.setImBotsGet({
+    ok: true, wecom: {}, feishu: {},
+    dingtalk: { enabled: true, clientId: "ding-x", hasSecret: true, robotCode: "rc", credentialSource: "scan" },
+    status: { dingtalk: { connected: false, enabled: true, state: "failed", lastError: "ok" }, feishu: {}, deps: { feishu: { installed: false } } },
+  });
+  let tree = await plugin.settle();
+  openEntry(tree, "channel");
+  tree = await plugin.settle();
+  clickChannelRow(tree, "钉钉机器人");
+  tree = await plugin.settle();
+  const t = textOf(tree);
+  assert.ok(t.includes("连接失败"), "state=failed 时才显示连接失败");
+  assert.ok(t.includes("操作失败，请稍后重试"), "后端给了裸 ok 时要兜底成中文人话");
+  assert.ok(!/连接失败：\s*ok\s*$/m.test(t), "绝不把裸 ok 渲染出来");
+});
+
+test("钉钉等待中：点「取消授权」写 cancel 命令并收起授权块", async () => {
+  const plugin = loadPlugin();
+  plugin.setImBotsGet({
+    ok: true, wecom: {}, feishu: {}, dingtalk: {},
+    status: { dingtalk: { connected: false }, feishu: {}, deps: { feishu: { installed: false } } },
+  });
+  plugin.setDingAuthStatus({ ok: true, state: "idle", url: "", remainingSec: 0 });
+  let tree = await plugin.settle();
+  openEntry(tree, "channel");
+  tree = await plugin.settle();
+  clickChannelRow(tree, "钉钉机器人");
+  tree = await plugin.settle();
+  btnWith(tree, "用钉钉扫码，一键创建机器人").props.onClick();
+  await flush(); await flush();
+  tree = await plugin.settle(3);
+  const cancel = btnWith(tree, "取消授权");
+  assert.ok(cancel, "等待中要有「取消授权」");
+  cancel.props.onClick();
+  await flush(); await flush();
+  tree = await plugin.settle(3);
+  assert.ok(plugin.dingAuthCalls().some((c) => c.kind === "cancel"), "取消授权必须写 cancel 命令（桥停轮询）");
+  assert.equal(btnWith(tree, "取消授权"), undefined, "取消后授权块收起");
+});