@mrrisega/dsh-remote 0.7.12-beta.4 → 0.7.12-beta.6

package/packages/dsh-remote-web/runtime/clients/dsh-remote/dsh-bridge.mjs

@@ -124,6 +124,15 @@ import { createAgentRuntime } from "./agent/index.mjs";
 import { createWecomBotController } from "./wecom-bot.mjs";
 // 钉钉 Stream 模式长连接（2026-11-08）：与企微同构、零新增依赖；默认关闭，配置在 im-bots.json 的 dingtalk 段。
 import { createDingtalkBotController } from "./dingtalk-bot.mjs";
+// 钉钉「扫码一键创建机器人」授权会话：**持久化 + 断点续轮询**（2026-11-08）。
+// 根因：device_code 只存在插件进程内存 → 面板关/宿主重启就丢，而凭据只在 poll SUCCESS 那次返回。
+// 现在授权会话落盘在 <relayDir>/im-dingtalk-auth.json，bridge 启动即续轮询，桥在跑就能接住。
+import {
+  resumeDingtalkAuth,
+  startDingtalkAuthCommandWatcher,
+  stopDingtalkAuthCommandWatcher,
+  stopDingtalkAuthPolling
+} from "./dingtalk-auth.mjs";
 // 飞书通道：官方 SDK 按需下载（41MB，不随包分发）、懒加载；未启用时零副作用
 import { createFeishuBotController } from "./feishu-bot.mjs";
 
@@ -3358,6 +3367,29 @@ function imBotLog(level, message) {
 }
 
 function startImBots() {
+  // ⓪ 钉钉扫码授权断点续轮询（fire-and-forget，绝不阻塞隧道/连接主链路）：
+  //    上次没等到用户确认就重启/关面板也没关系 —— 会话在磁盘上，桥一跑就继续 poll，
+  //    成功后自动写 im-bots.json（credentialSource:"scan"）→ controller 热更新把机器人连上。
+  try {
+    void resumeDingtalkAuth({
+      relayDir: RELAY_DIR,
+      logger: imBotLog,
+      onWarn: (m) => imBotLog("warn", m),
+      onSuccess: () => { try { startImBots(); } catch { /* 忽略 */ } }
+    }).catch((e) => {
+      console.warn(`[bridge] 钉钉扫码授权续轮询失败(不影响远程访问): ${redactText(e)}`);
+    });
+    // 控制命令文件：插件写 <relayDir>/im-dingtalk-auth-cmd.json（begin/cancel），桥读并执行。
+    // 插件不需要 device_code，也不需要 HTTP 端点 —— 只表达意图；桥在跑就能接住。
+    startDingtalkAuthCommandWatcher({
+      relayDir: RELAY_DIR,
+      logger: imBotLog,
+      onWarn: (m) => imBotLog("warn", m),
+      onSuccess: () => { try { startImBots(); } catch { /* 忽略 */ } }
+    });
+  } catch (e) {
+    console.warn(`[bridge] 钉钉扫码授权续轮询初始化失败(忽略): ${redactText(e)}`);
+  }
   // ① 企业微信（现有）
   try {
     if (!imBots) {
@@ -3437,6 +3469,9 @@ function startImBots() {
 
 /** 优雅退出 IM 机器人通道（企微 + 钉钉，互不影响）。失败只记日志。 */
 async function stopImBots() {
+  // 先停扫码授权轮询/命令监听（**保留** auth 文件：下次启动能续轮询；用户显式取消才删文件）
+  try { stopDingtalkAuthCommandWatcher(); } catch { /* 忽略 */ }
+  try { stopDingtalkAuthPolling(); } catch { /* 忽略 */ }
   const wecom = imBots;
   const dingtalk = imBotsDingtalk;
   const feishu = imBotsFeishu;

package/packages/dsh-remote-web/runtime/dsh-setup.mjs

@@ -149,7 +149,7 @@ function findDepWs(startDir) {
  * 漏同步就会出现「入口脚本在、依赖不在」的半装运行时（插件半据此判定「运行环境已就绪」，
  * 却永远起不来 bridge —— 2026-09-23 用户反馈的现场）。`src/channel-ref.mjs` 同理（本安装器也 import）。
  */
-const RUNTIME_CLIENT_FILES = ["mobile-adapter.mjs", "dsh-bridge.mjs", "e2ee-shim.mjs", "e2ee-client.mjs", "e2ee-shim-script.js", "mobile-adapter.test.mjs", "wechat-channel.mjs", "dsh-events.mjs", "wechat-runtime.mjs", "wecom-bot.mjs", "im-format.mjs", "dingtalk-bot.mjs", "feishu-bot.mjs", "src/lifecycle.mjs", "src/channel-ref.mjs"];
+const RUNTIME_CLIENT_FILES = ["mobile-adapter.mjs", "dsh-bridge.mjs", "e2ee-shim.mjs", "e2ee-client.mjs", "e2ee-shim-script.js", "mobile-adapter.test.mjs", "wechat-channel.mjs", "dsh-events.mjs", "wechat-runtime.mjs", "wecom-bot.mjs", "im-format.mjs", "dingtalk-bot.mjs", "dingtalk-auth.mjs", "feishu-bot.mjs", "src/lifecycle.mjs", "src/channel-ref.mjs"];
 
 /**
  * 把"客户端脚本"补齐到配置目录。

package/packages/dsh-remote-web/test/im-bots.test.mjs

@@ -632,190 +632,100 @@ test("POST /im-deps/feishu：安装失败 → phase=failed + 人话原因（netw
   });
 });
 
-// ─────────────────── 钉钉「扫码一键创建机器人」device-flow（2026-11-08） ───────────────────
-
-/** 假钉钉接口（注入 imAuthFetch；测试绝不真的打 oapi.dingtalk.com）。 */
-function makeAuthFetch(plan = {}) {
-  const calls = [];
-  const resp = (body, ok = true, status = 200) => ({ ok, status, json: async () => body });
-  const fn = async (url, opts) => {
-    const body = opts && opts.body ? JSON.parse(opts.body) : {};
-    calls.push({ url: String(url), body });
-    const u = String(url);
-    if (u.endsWith("/init")) {
-      if (plan.initThrows) throw new Error("ECONNRESET");
-      return resp(plan.init || { nonce: "nonce-1" });
-    }
-    if (u.endsWith("/begin")) {
-      if (plan.beginRejected) return resp({ errmsg: "rejected" }, false, 400);
-      return resp(plan.begin || { device_code: "dc-secret", verification_uri_complete: "https://oapi.dingtalk.com/auth?x=1", interval: 2, expires_in: 7200 });
-    }
-    if (u.endsWith("/poll")) {
-      if (plan.pollThrows) throw new Error("ETIMEDOUT");
-      return resp(plan.polls && plan.polls.length ? plan.polls.shift() : { status: "WAITING" });
-    }
-    throw new Error("unexpected url " + u);
-  };
-  fn.calls = calls;
-  return fn;
-}
+// ─────────────────── 钉钉扫码授权：**委托桥侧持久化**（2026-11-08 架构修正） ───────────────────
+//
+// 契约（与桥约定）：
+//   · 插件只写命令文件 <relayDir>/im-dingtalk-auth-cmd.json {action:"begin"|"cancel", at}
+//   · 桥持久化 device_code/断点续轮询，把进度写进 im-bot-status.json 的 dingtalk.auth
+//   · 插件 GET status 直接读状态文件；**自身不存内存会话、不调 oapi.dingtalk.com**
+
+const readCmd = async (relayDir) => {
+  const raw = await readFile(path.join(relayDir, "im-dingtalk-auth-cmd.json"), "utf8");
+  return { data: JSON.parse(raw), mode: (await stat(path.join(relayDir, "im-dingtalk-auth-cmd.json"))).mode & 0o777 };
+};
+const writeAuthStatus = (relayDir, auth) => writeFile(path.join(relayDir, "im-bot-status.json"),
+  JSON.stringify({ updatedAt: Date.now(), dingtalk: { enabled: true, connected: false, auth } }));
 
-test("POST /im-dingtalk-auth/begin：返回 authId/url/interval/expiresIn；device_code 绝不落浏览器", async () => {
+test("POST begin：只写命令文件 {action:'begin', at}（0600），**不返回 URL**（URL 在桥状态里）", async () => {
   const relayDir = await tmpRelay();
-  const imAuthFetch = makeAuthFetch();
-  await withHost(relayDir, { imAuthFetch }, async (base) => {
+  await withHost(relayDir, {}, async (base) => {
+    const before = Date.now();
     const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
     assert.equal(r.status, 200);
     assert.equal(r.body.ok, true);
-    assert.ok(r.body.authId, "必须给浏览器一个 authId 句柄");
-    assert.equal(r.body.url, "https://oapi.dingtalk.com/auth?x=1");
-    assert.equal(r.body.interval, 2);
-    assert.equal(r.body.expiresIn, 7200, "★ TTL 必须按钉钉 expires_in（7200s），不能再是写死的 2 分钟");
-    const raw = JSON.stringify(r.body);
-    assert.ok(!raw.includes("dc-secret"), "★ device_code 不能下发给浏览器");
-  });
-});
-
-test("POST begin 限流：同一时间只允许一个授权，旧 authId 查询回 cancelled", async () => {
-  const relayDir = await tmpRelay();
-  const imAuthFetch = makeAuthFetch();
-  await withHost(relayDir, { imAuthFetch, imAuthPollMs: 60000 }, async (base) => {
-    const a = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    const b = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    assert.ok(a.body.authId && b.body.authId && a.body.authId !== b.body.authId);
-    const old = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=${encodeURIComponent(a.body.authId)}`);
-    assert.equal(old.body.status, "failed");
-    assert.equal(old.body.code, "cancelled", "旧授权必须被作废（而不是继续有效）");
-    const cur = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=${encodeURIComponent(b.body.authId)}`);
-    assert.equal(cur.body.status, "waiting");
-  });
-});
-
-test("GET status：waiting → success 时把凭据写入 im-bots.json（0600、credentialSource=scan），响应不回 secret", async () => {
-  const relayDir = await tmpRelay();
-  const imAuthFetch = makeAuthFetch({
-    polls: [
-      { status: "WAITING" },
-      { status: "SUCCESS", client_id: "ding-client-8899", client_secret: "DING-SCAN-SECRET" },
-    ],
-  });
-  await withHost(relayDir, { imAuthFetch, imAuthPollMs: 60000 }, async (base) => {
-    const begin = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    const id = encodeURIComponent(begin.body.authId);
-    let st = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=${id}&check=1`);
-    assert.equal(st.body.status, "waiting", "用户还没确认 → waiting");
-    st = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=${id}&check=1`);
-    assert.equal(st.body.status, "success");
-    assert.equal(st.body.credentialSource, "scan");
-    assert.equal(st.body.hasSecret, true);
-    assert.equal(st.body.clientIdTail, "8899");
-    assert.ok(!JSON.stringify(st.body).includes("DING-SCAN-SECRET"), "★ 扫码拿到的 secret 绝不能回给浏览器");
-
-    const cfg = JSON.parse(await readFile(path.join(relayDir, "im-bots.json"), "utf8"));
-    assert.equal(cfg.dingtalk.clientId, "ding-client-8899");
-    assert.equal(cfg.dingtalk.clientSecret, "DING-SCAN-SECRET", "凭据要写入配置文件（桥读）");
-    assert.equal(cfg.dingtalk.credentialSource, "scan");
-    assert.equal(cfg.dingtalk.enabled, true, "扫码成功即可用");
-    const mode = (await stat(path.join(relayDir, "im-bots.json"))).mode & 0o777;
-    assert.equal(mode, 0o600, "配置文件必须 0600");
-
-    // 面板 GET 里也只见 hasSecret，不见 secret
-    const view = await json(`${base}/dsh-remote/im-bots`);
-    assert.equal(view.body.dingtalk.hasSecret, true);
-    assert.equal(view.body.dingtalk.credentialSource, "scan");
-    assert.ok(!JSON.stringify(view.body).includes("DING-SCAN-SECRET"));
+    assert.equal(r.body.url, undefined, "★ begin 不得返回 URL（授权链接要等桥跑完写状态）");
+    assert.equal(r.body.authId, undefined, "★ 不再有插件内存会话 authId");
+    const { data, mode } = await readCmd(relayDir);
+    assert.equal(data.action, "begin");
+    assert.equal(typeof data.at, "number");
+    assert.ok(data.at >= before, "at 应是本次点击时间戳（桥据此判断是否新命令）");
+    assert.equal(mode, 0o600, "命令文件必须 0600");
   });
 });
 
-test("GET status：未知/过期 authId → expired；钉钉拒绝 → failed(dingtalk_api_rejected)；网络不通 → failed(network_error)", async () => {
+test("POST cancel：写 {action:'cancel'} 命令（桥停轮询 + 删持久化会话）", async () => {
   const relayDir = await tmpRelay();
-  await withHost(relayDir, { imAuthFetch: makeAuthFetch() }, async (base) => {
-    const none = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=nope`);
-    assert.equal(none.body.status, "expired");
-    assert.equal(none.body.code, "expired");
+  await withHost(relayDir, {}, async (base) => {
+    const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/cancel`);
+    assert.equal(r.body.ok, true);
+    const { data, mode } = await readCmd(relayDir);
+    assert.equal(data.action, "cancel");
+    assert.equal(mode, 0o600);
+  });
+});
 
-    // 钉钉拒绝 poll
-    const rejDir = await tmpRelay();
-    const rejFetch = makeAuthFetch({ polls: [{ status: "DENIED", message: "用户取消了创建" }] });
-    await withHost(rejDir, { imAuthFetch: rejFetch, imAuthPollMs: 60000 }, async (base2) => {
-      const b = await post(base2, `${base2}/dsh-remote/im-dingtalk-auth/begin`);
-      const st = await json(`${base2}/dsh-remote/im-dingtalk-auth/status?id=${encodeURIComponent(b.body.authId)}&check=1`);
-      assert.equal(st.body.status, "failed");
-      assert.equal(st.body.code, "dingtalk_api_rejected");
-      assert.ok(st.body.message.includes("用户取消"), "钉钉原文原因要带给用户");
+test("GET status：直接读 im-bot-status.json 的 dingtalk.auth（白名单 + 只透 https 链接 + 人话兜底）", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    // 1) idle（无 auth 段）
+    let st = await json(`${base}/dsh-remote/im-dingtalk-auth/status`);
+    assert.equal(st.body.state, "idle");
+    assert.equal(st.body.url, "");
+    assert.equal(st.body.message, "", "idle 不该有错误文案");
+
+    // 2) waiting（带链接/剩余时间/未知字段）
+    await writeAuthStatus(relayDir, {
+      state: "waiting", url: "https://oapi.dingtalk.com/x?nonce=1", expiresAt: 123, remainingSec: 300,
+      deviceCode: "LEAK-DEVICE", clientSecret: "LEAK-SECRET",
     });
+    st = await json(`${base}/dsh-remote/im-dingtalk-auth/status`);
+    assert.equal(st.body.state, "waiting");
+    assert.equal(st.body.url, "https://oapi.dingtalk.com/x?nonce=1");
+    assert.equal(st.body.remainingSec, 300);
+    assert.equal(st.body.expiresAt, 123);
+    assert.ok(!JSON.stringify(st.body).includes("LEAK"), "★ 状态文件里的 device_code/secret 不能透出");
 
-    // 网络抖动的 poll：**不放失败**（后台继续重试直到 expires_in），状态仍 waiting
-    const netDir = await tmpRelay();
-    const netFetch = makeAuthFetch({ pollThrows: true });
-    await withHost(netDir, { imAuthFetch: netFetch, imAuthPollMs: 60000 }, async (base3) => {
-      const b = await post(base3, `${base3}/dsh-remote/im-dingtalk-auth/begin`);
-      const st = await json(`${base3}/dsh-remote/im-dingtalk-auth/status?id=${encodeURIComponent(b.body.authId)}&check=1`);
-      assert.equal(st.body.status, "waiting", "网络抖动不该判死授权（用户还在扫码）");
-    });
-  });
-});
+    // 3) 非 https 链接必须过滤（防状态文件被塞 javascript:/data:）
+    await writeAuthStatus(relayDir, { state: "waiting", url: "javascript:alert(1)" });
+    st = await json(`${base}/dsh-remote/im-dingtalk-auth/status`);
+    assert.equal(st.body.url, "", "只允许 https 链接");
 
-test("POST begin：钉钉接口不可用 → network_error / dingtalk_api_rejected（人话）", async () => {
-  const dir1 = await tmpRelay();
-  await withHost(dir1, { imAuthFetch: makeAuthFetch({ initThrows: true }) }, async (base) => {
-    const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    assert.equal(r.status, 502);
-    assert.equal(r.body.ok, false);
-    assert.equal(r.body.code, "network_error");
-    assert.match(r.body.message, /连不上钉钉接口/, "错误 message 必须是中文人话");
-  });
-  const dir2 = await tmpRelay();
-  await withHost(dir2, { imAuthFetch: makeAuthFetch({ beginRejected: true }) }, async (base) => {
-    const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    assert.equal(r.body.code, "dingtalk_api_rejected");
+    // 4) failed：桥给裸 code/ok 时也要翻成中文人话
+    await writeAuthStatus(relayDir, { state: "failed", message: "ok" });
+    st = await json(`${base}/dsh-remote/im-dingtalk-auth/status`);
+    assert.equal(st.body.state, "failed");
+    assert.match(st.body.message, /[\u4e00-\u9fa5]/, "message 必须中文人话");
+    assert.notEqual(st.body.message, "ok", "★ 绝不裸渲染 ok");
   });
 });
 
-test("钉钉授权：后台轮询在**无人查询**时也继续前进（关面板/刷新不影响），TTL 按 expires_in=7200s", async () => {
+test("GET /im-bots：status.dingtalk.auth 也按同一白名单透出（面板打开时恢复等待态）", async () => {
   const relayDir = await tmpRelay();
-  const imAuthFetch = makeAuthFetch({
-    polls: [{ status: "WAITING" }, { status: "SUCCESS", client_id: "ding-bg-1", client_secret: "BG-SECRET" }],
-  });
-  // 后台轮询间隔压到 20ms（生产 3s），验证"不靠面板/HTTP 查询也会成功"
-  await withHost(relayDir, { imAuthFetch, imAuthPollMs: 20 }, async (base) => {
-    const begin = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    assert.equal(begin.body.expiresIn, 7200, "★ TTL 必须是钉钉的 expires_in（7200s），不是 2 分钟");
-    // 不调用任何 status 接口，等后台轮询把 SUCCESS 落盘
-    let cfg = null;
-    for (let i = 0; i < 100; i++) {
-      try { cfg = JSON.parse(await readFile(path.join(relayDir, "im-bots.json"), "utf8")); } catch { cfg = null; }
-      if (cfg && cfg.dingtalk && cfg.dingtalk.clientId === "ding-bg-1") break;
-      await new Promise((r) => setTimeout(r, 25));
-    }
-    assert.ok(cfg && cfg.dingtalk.clientId === "ding-bg-1", "★ 后台轮询必须在没有面板查询时也把凭据写盘");
-    assert.equal(cfg.dingtalk.credentialSource, "scan");
-    assert.equal(cfg.dingtalk.enabled, true, "扫码成功自动 enabled");
-    // 之后查询直接拿到 success（脱敏）
-    const st = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=${encodeURIComponent(begin.body.authId)}`);
-    assert.equal(st.body.status, "success");
-    assert.ok(!JSON.stringify(st.body).includes("BG-SECRET"));
+  await withHost(relayDir, {}, async (base) => {
+    await writeAuthStatus(relayDir, { state: "waiting", url: "https://oapi.dingtalk.com/y", remainingSec: 120, clientIdTail: "8899" });
+    const r = await json(`${base}/dsh-remote/im-bots`);
+    const auth = r.body.status.dingtalk.auth;
+    assert.equal(auth.state, "waiting");
+    assert.equal(auth.url, "https://oapi.dingtalk.com/y");
+    assert.equal(auth.remainingSec, 120);
+    assert.ok(!JSON.stringify(r.body).includes("LEAK"));
   });
 });
 
-test("钉钉授权错误：message 永远是中文人话（绝不裸 code / ok）", async () => {
-  const dir1 = await tmpRelay();
-  await withHost(dir1, { imAuthFetch: makeAuthFetch({ initThrows: true }) }, async (base) => {
-    const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    assert.equal(r.body.code, "network_error");
-    assert.notEqual(r.body.message, r.body.code, "message 不能等于裸 code");
-    assert.match(r.body.message, /[\u4e00-\u9fa5]/, "message 必须含中文");
-  });
-  const dir2 = await tmpRelay();
-  await withHost(dir2, { imAuthFetch: makeAuthFetch({ beginRejected: true }) }, async (base) => {
-    const r = await post(base, `${base}/dsh-remote/im-dingtalk-auth/begin`);
-    assert.match(r.body.message, /[\u4e00-\u9fa5]/);
-    assert.ok(!/^\s*(ok|error|https?:)/i.test(r.body.message), "不得裸渲染 ok/errcode/URL");
-  });
-  const dir3 = await tmpRelay();
-  await withHost(dir3, { imAuthFetch: makeAuthFetch() }, async (base) => {
-    const st = await json(`${base}/dsh-remote/im-dingtalk-auth/status?id=nope`);
-    assert.equal(st.body.code, "expired");
-    assert.match(st.body.message, /授权已过期/, "过期也要中文人话");
-  });
+test("源码约束：插件侧**不再有内存授权会话、不再直连 oapi.dingtalk.com**（只委托桥）", async () => {
+  const src = await readFile(new URL("../lib/index.js", import.meta.url), "utf8");
+  assert.ok(src.includes("im-dingtalk-auth-cmd.json"), "必须有命令文件契约");
+  assert.ok(!src.includes("oapi.dingtalk.com"), "★ 插件不得再自己调钉钉 registration 接口（由桥负责）");
+  assert.ok(!src.includes("dingtalkAuthSessions"), "★ 不得再有插件内存授权会话 Map（进程重启就丢）");
+  assert.ok(!/setInterval\([^)]*dingtalkAuthPollOnce/.test(src), "★ 不得再有插件侧后台轮询 loop");
 });

package/packages/dsh-remote-web/test/panel-ia.test.mjs

@@ -196,8 +196,8 @@ function loadPlugin(opts = {}) {
   let imBotsPutReply = { status: 200, body: { ok: true, wecom: { enabled: true, botId: "aibdemo1234", hasSecret: true, url: "", targetChatId: "" }, status: { connected: false, authenticated: false, lastError: "" }, updatedAt: 0 } };
   let imBotsTestReply = { status: 200, body: { ok: true, connected: true, authenticated: true, lastError: "" } };
   let imDepsReply = { installed: false, phase: "idle", version: "", lastError: "" };
-  let dingAuthBeginReply = { status: 200, body: { ok: true, authId: "auth-1", url: "https://oapi.dingtalk.com/x?nonce=1", interval: 2, expiresIn: 120 } };
-  let dingAuthStatusReplies = [];
+  let dingAuthBeginReply = { status: 200, body: { ok: true } };
+  let dingAuthStatusReply = { ok: true, state: "idle", url: "", remainingSec: 0, message: "" };
   const nextPoll = () => (pollReplies.length > 1 ? pollReplies.shift() : pollReplies[0]);
 
   const makeEl = () => ({
@@ -265,10 +265,13 @@ function loadPlugin(opts = {}) {
         dingAuthCalls.push({ kind: "begin", method: options.method || "POST" });
         return response(dingAuthBeginReply.status, dingAuthBeginReply.body);
       }
+      if (path === "/dsh-remote/im-dingtalk-auth/cancel") {
+        dingAuthCalls.push({ kind: "cancel", method: options.method || "POST" });
+        return response(200, { ok: true });
+      }
       if (path.startsWith("/dsh-remote/im-dingtalk-auth/status")) {
         dingAuthCalls.push({ kind: "status", path });
-        const next = dingAuthStatusReplies.length ? dingAuthStatusReplies.shift() : { status: "waiting" };
-        return response(200, next);
+        return response(200, dingAuthStatusReply);
       }
       if (path === "/dsh-remote/im-deps") {
         depsCalls.push(Date.now());
@@ -347,7 +350,7 @@ function loadPlugin(opts = {}) {
     setImBotsTest(body, status = 200) { imBotsTestReply = { status, body }; },
     setImDeps(body) { imDepsReply = body; },
     setDingAuthBegin(body, status = 200) { dingAuthBeginReply = { status, body }; },
-    setDingAuthStatus(list) { dingAuthStatusReplies = (list || []).slice(); },
+    setDingAuthStatus(body) { dingAuthStatusReply = body || { ok: true, state: "idle" }; },
     dingAuthCalls() { return dingAuthCalls.slice(); },
     depsCalls() { return depsCalls.slice(); },
     depsInstalls() { return depsInstalls.slice(); },
@@ -713,7 +716,7 @@ test("平台列表：企业微信 / 钉钉 / 飞书 / Webhook 都是真入口（
   assert.ok(!texts.some((t) => t.includes("飞书机器人") && t.includes("即将支持")), "飞书不再是即将支持");
 });
 
-test("钉钉主路径：扫码一键创建（begin→等待→轮询→自动成功）+ 顶部「不用去后台」说明；手动配置折叠", async () => {
+test("钉钉主路径：点扫码→begin→轮询桥状态：先生成链接、再等待确认、成功自动切已连接", async () => {
   const plugin = loadPlugin();
   plugin.setImBotsGet({
     ok: true,
@@ -721,7 +724,8 @@ test("钉钉主路径：扫码一键创建（begin→等待→轮询→自动成
     dingtalk: { enabled: false, clientId: "", hasSecret: false, robotCode: "", credentialSource: "" },
     status: { dingtalk: { connected: false }, feishu: {}, deps: { feishu: { installed: false, phase: "idle" } } },
   });
-  plugin.setDingAuthStatus([{ status: "waiting" }, { status: "success", clientIdTail: "8899", credentialSource: "scan", hasSecret: true }]);
+  // 桥还没跑完 begin：状态是 idle → 面板显示"正在生成授权链接…"
+  plugin.setDingAuthStatus({ ok: true, state: "idle", url: "", remainingSec: 0 });
   let tree = await plugin.settle();
   openEntry(tree, "channel");
   tree = await plugin.settle();
@@ -729,41 +733,43 @@ test("钉钉主路径：扫码一键创建（begin→等待→轮询→自动成
   tree = await plugin.settle();
   let dlg = find(tree, (n) => String(n.props?.className || "").split(/\s+/).includes("dru-ia-dialog"));
   assert.ok(dlg, "钉钉配置页应打开");
-  // 主路径：一句说明 + 扫码按钮
-  assert.ok(textOf(dlg).includes("不用去开发者后台创建应用") || textOf(dlg).includes("不需要去开发者后台创建应用"),
-    "顶部要说明不需要去开发者后台创建应用");
+  assert.ok(textOf(dlg).includes("不用去开发者后台创建应用"), "顶部要说明不需要去开发者后台创建应用");
   const scanBtn = btnWith(dlg, "用钉钉扫码，一键创建机器人");
   assert.ok(scanBtn, "主路径必须是一个「扫码一键创建」按钮");
-  // 手动配置默认折叠（不占主路径）
-  assert.equal(find(dlg, (n) => n.props?.id === "dru-ding-client"), undefined, "手动字段默认不应出现（折叠在高级里）");
+  assert.equal(find(dlg, (n) => n.props?.id === "dru-ding-client"), undefined, "手动字段默认折叠");
 
-  // 点扫码 → begin
+  // 点扫码 → begin；此时还没有 URL（桥正在创建）
   scanBtn.props.onClick();
   await flush(); await flush();
   tree = await plugin.settle(3);
-  assert.ok(plugin.dingAuthCalls().some((c) => c.kind === "begin"), "★ 点扫码必须 POST begin");
+  assert.ok(plugin.dingAuthCalls().some((c) => c.kind === "begin"), "★ 点扫码必须 POST begin（写命令文件）");
+  dlg = find(tree, (n) => String(n.props?.className || "").split(/\s+/).includes("dru-ia-dialog"));
+  assert.ok(textOf(dlg).includes("正在生成授权链接"), "URL 未就绪时如实显示正在生成（不瞎编链接）");
+
+  // 桥写回 waiting + url/remainingSec → 面板轮询拿到并展示
+  plugin.setDingAuthStatus({ ok: true, state: "waiting", url: "https://oapi.dingtalk.com/x?nonce=1", remainingSec: 300, expiresAt: Date.now() + 300000 });
+  await plugin.advance(2100);
+  await flush(); await flush();
+  tree = await plugin.settle(3);
   dlg = find(tree, (n) => String(n.props?.className || "").split(/\s+/).includes("dru-ia-dialog"));
-  assert.ok(textOf(dlg).includes("等待你在钉钉里确认"), "要显示等待确认中");
-  assert.ok(textOf(dlg).includes("用手机钉钉扫"), "没有二维码库时要提示用手机钉钉扫链接");
+  assert.ok(textOf(dlg).includes("等待你在钉钉里确认"), "有 URL 后显示等待确认");
+  assert.ok(textOf(dlg).includes("剩余约 5 分钟"), "要显示剩余分钟（remainingSec/60）");
   const link = find(dlg, (n) => n.type === "a" && String(n.props?.href || "").includes("oapi.dingtalk.com"));
   assert.ok(link, "要给出可点击的授权链接");
   assert.equal(link.props.target, "_blank");
   assert.equal(link.props.rel, "noopener");
   assert.ok(btnWith(dlg, "复制授权链接"), "要有复制授权链接按钮");
+  assert.ok(btnWith(dlg, "我已完成授权，检查一下"), "要有手动检查按钮");
+  assert.ok(btnWith(dlg, "取消授权"), "要有取消授权（写 cancel 命令）");
 
-  // 轮询：waiting → success（fake timers 推进 2 轮）
-  await plugin.advance(2100);
-  await flush(); await flush();
-  tree = await plugin.settle(3);
+  // 桥把进度推进到 success → 面板下一次轮询自动切已连接并收起授权块
+  plugin.setDingAuthStatus({ ok: true, state: "success", clientIdTail: "8899", message: "" });
   await plugin.advance(2100);
   await flush(); await flush();
   tree = await plugin.settle(4);
-  assert.ok(plugin.dingAuthCalls().filter((c) => c.kind === "status").length >= 1, "要轮询授权状态");
   assert.ok(textOf(tree).includes("来源：扫码创建"), "成功后自动切到已连接状态（显示来源）");
   assert.ok(textOf(tree).includes("8899"), "成功提示要带 Client ID 尾号");
-  dlg = find(tree, (n) => String(n.props?.className || "").split(/\s+/).includes("dru-ia-dialog"));
-  assert.ok(dlg, "成功后弹层仍开着（用户能直接看到结果/去钉钉试）");
-  assert.ok(!textOf(dlg).includes("等待你在钉钉里确认"), "成功后不再显示等待态");
+  assert.equal(btnWith(tree, "我已完成授权，检查一下"), undefined, "成功后授权块自动收起");
 });
 
 test("钉钉手动模式：折叠展开后 7 步 + 三个坑 + 三字段；官方链接全部 target=_blank rel=noopener 且提交体字段锁死", async () => {
@@ -1291,33 +1297,56 @@ test("飞书依赖下载：点下载 → POST 安装 → 轮询 /im-deps，装
 
 // ─────────── ⑫ 钉钉授权修正（2026-11-08 生产踩坑：TTL/人话/未配置措辞） ───────────
 
-test("钉钉等待中：「我已完成授权，检查一下」手动触发 status?check=1（不再 2 分钟判死）", async () => {
+test("钉钉等待中：「我已完成授权，检查一下」再读一次桥状态；成功即切已连接（关面板也不丢）", async () => {
   const plugin = loadPlugin();
   plugin.setImBotsGet({
     ok: true, wecom: {}, feishu: {}, dingtalk: {},
     status: { dingtalk: { connected: false }, feishu: {}, deps: { feishu: { installed: false } } },
   });
-  // 用户点「检查」时服务端后台已经推进到 success（手动检查只是立刻取一次结论）
-  plugin.setDingAuthStatus([{ status: "success", clientIdTail: "0001", credentialSource: "scan", hasSecret: true }]);
+  plugin.setDingAuthStatus({ ok: true, state: "idle", url: "", remainingSec: 0 });
   let tree = await plugin.settle();
   openEntry(tree, "channel");
   tree = await plugin.settle();
   clickChannelRow(tree, "钉钉机器人");
   tree = await plugin.settle();
   btnWith(tree, "用钉钉扫码，一键创建机器人").props.onClick();
+  plugin.setDingAuthStatus({ ok: true, state: "waiting", url: "https://oapi.dingtalk.com/z", remainingSec: 120 });
+  await flush(); await flush();
+  tree = await plugin.settle(3);
+  await plugin.advance(2100);   // 让轮询读到 waiting（url 到位）
   await flush(); await flush();
   tree = await plugin.settle(3);
   const checkBtn = btnWith(tree, "我已完成授权，检查一下");
   assert.ok(checkBtn, "等待中要有「我已完成授权，检查一下」按钮");
+  const before = plugin.dingAuthCalls().filter((c) => c.kind === "status").length;
+  // 用户已在手机钉钉确认 → 桥把状态写成 success；手动检查只再读一次状态
+  plugin.setDingAuthStatus({ ok: true, state: "success", clientIdTail: "0001", message: "" });
   checkBtn.props.onClick();
   await flush(); await flush();
   tree = await plugin.settle(3);
-  const calls = plugin.dingAuthCalls().filter((c) => c.kind === "status");
-  assert.ok(calls.some((c) => String(c.path).includes("check=1")), "★ 手动检查必须触发一次 status?check=1（让服务端立刻补轮）");
+  const after = plugin.dingAuthCalls().filter((c) => c.kind === "status").length;
+  assert.ok(after > before, "手动检查必须再读一次 status（桥持久化，不需要面板传 check 参数）");
   assert.ok(textOf(tree).includes("来源：扫码创建"), "手动检查成功后自动切已连接并收起授权块");
   assert.equal(btnWith(tree, "我已完成授权，检查一下"), undefined, "成功后授权块自动收起");
 });
 
+test("钉钉授权失败/过期：显示「授权失败：<中文人话>」+ 重试按钮（绝不裸渲染）", async () => {
+  const plugin = loadPlugin();
+  plugin.setImBotsGet({
+    ok: true, wecom: {}, feishu: {}, dingtalk: {},
+    status: { dingtalk: { connected: false, auth: { state: "failed", message: "ok" } }, feishu: {}, deps: { feishu: { installed: false } } },
+  });
+  let tree = await plugin.settle();
+  openEntry(tree, "channel");
+  tree = await plugin.settle();
+  clickChannelRow(tree, "钉钉机器人");
+  tree = await plugin.settle();
+  const t = textOf(tree);
+  assert.ok(t.includes("授权失败"), "桥报 failed 要显示授权失败");
+  assert.ok(t.includes("操作失败，请稍后重试"), "裸 ok 要兜底成中文人话");
+  assert.ok(!/授权失败：\s*ok\s*/m.test(t), "绝不裸渲染 ok");
+});
+
 test("钉钉未配置措辞：enabled=false 显示「未配置」，不是「连接失败」", async () => {
   const plugin = loadPlugin();
   plugin.setImBotsGet({
@@ -1353,3 +1382,27 @@ test("钉钉连接失败：只有 state=failed 才显示「连接失败：<中
   assert.ok(t.includes("操作失败，请稍后重试"), "后端给了裸 ok 时要兜底成中文人话");
   assert.ok(!/连接失败：\s*ok\s*$/m.test(t), "绝不把裸 ok 渲染出来");
 });
+
+test("钉钉等待中：点「取消授权」写 cancel 命令并收起授权块", async () => {
+  const plugin = loadPlugin();
+  plugin.setImBotsGet({
+    ok: true, wecom: {}, feishu: {}, dingtalk: {},
+    status: { dingtalk: { connected: false }, feishu: {}, deps: { feishu: { installed: false } } },
+  });
+  plugin.setDingAuthStatus({ ok: true, state: "idle", url: "", remainingSec: 0 });
+  let tree = await plugin.settle();
+  openEntry(tree, "channel");
+  tree = await plugin.settle();
+  clickChannelRow(tree, "钉钉机器人");
+  tree = await plugin.settle();
+  btnWith(tree, "用钉钉扫码，一键创建机器人").props.onClick();
+  await flush(); await flush();
+  tree = await plugin.settle(3);
+  const cancel = btnWith(tree, "取消授权");
+  assert.ok(cancel, "等待中要有「取消授权」");
+  cancel.props.onClick();
+  await flush(); await flush();
+  tree = await plugin.settle(3);
+  assert.ok(plugin.dingAuthCalls().some((c) => c.kind === "cancel"), "取消授权必须写 cancel 命令（桥停轮询）");
+  assert.equal(btnWith(tree, "取消授权"), undefined, "取消后授权块收起");
+});