@mrrisega/dsh-remote 0.7.12-beta.5 → 0.7.12-beta.6

package/clients/dsh-remote/im-commands.mjs

@@ -0,0 +1,302 @@
+/**
+ * im-commands — 三家 IM 机器人（企微 / 钉钉 / 飞书）共用的**命令层**（2026-11-08）。
+ *
+ * 业主实测：在钉钉里发 `/ls` 期望列会话，但当时没有命令层 → `/ls` 被当成 prompt 转给了模型。
+ * 命令层把这类「控制类消息」在**进模型之前**拦下、自己执行并回复；解析器/文案/能力门禁三家共用，
+ * 各通道只负责把回复发出去（企微被动回复 / 钉钉 sessionWebhook / 飞书 im/v1/messages）。
+ *
+ * 命令表（能力门禁复用 `WECHAT_CAPABILITY_TABLE`，与会员升级文案同口径）：
+ *   | 命令        | 能力              | 免费 | 说明                                   |
+ *   | /help       | 无                | ✅   | 列出全部命令（含会员命令标注）         |
+ *   | /status     | 无                | ✅   | 连接状态 + 当前会话 + 本月剩余指令     |
+ *   | /stop       | 无                | ✅   | 急停当前任务（安全阀必须免费、立即生效）|
+ *   | /ls         | sessions          | ❌   | 最近 ≤10 个会话（标题/索引/当前标记）  |
+ *   | /use <N>    | sessions          | ❌   | 切换当前绑定会话（写配置 sessionId）   |
+ *   | /unbind     | 无                | ✅   | 解绑/退订本会话推送（合规：随时可退订）|
+ *
+ * 未命中的 `/xxx`：回帮助提示（含"未知命令"），**绝不转给模型**。
+ * 回复一律用纯文本列表（不用 Markdown 表格；各通道发送前还会走 im-format 兜底）。
+ */
+
+import path from "node:path";
+
+import { WECHAT_CAPABILITY_TABLE, grantsCap } from "./wechat-runtime.mjs";
+import { IM_BOTS_FILE, atomicWriteJson, readJsonFile } from "./wecom-bot.mjs";
+
+/** 命令表（顺序即 /help 展示顺序）。`free` 只是文档标记；真正门禁看 caps。 */
+export const IM_COMMANDS = Object.freeze([
+  Object.freeze({ name: "/help", caps: Object.freeze([]), free: true, usage: "/help", summary: "查看命令" }),
+  Object.freeze({ name: "/status", caps: Object.freeze([]), free: true, usage: "/status", summary: "连接状态 / 当前会话 / 本月额度" }),
+  Object.freeze({ name: "/stop", caps: Object.freeze([]), free: true, usage: "/stop", summary: "急停当前任务" }),
+  Object.freeze({ name: "/ls", caps: Object.freeze(["sessions"]), free: false, usage: "/ls", summary: "列出最近会话（会员）" }),
+  Object.freeze({ name: "/use", caps: Object.freeze(["sessions"]), free: false, usage: "/use <序号>", summary: "切换当前会话（会员）" }),
+  Object.freeze({ name: "/unbind", caps: Object.freeze([]), free: true, usage: "/unbind", summary: "解绑本会话推送（随时可退订）" })
+]);
+
+/** 会话标题截断（按码点，避免切坏 emoji/中文）。 */
+export function truncateTitle(title, max = 24) {
+  const s = String(title == null ? "" : title).replace(/\s+/g, " ").trim();
+  if (!s) return "";
+  const chars = Array.from(s);
+  return chars.length <= max ? s : `${chars.slice(0, Math.max(1, max - 1)).join("")}…`;
+}
+
+function pad2(n) { return String(n).padStart(2, "0"); }
+function fmtTime(at) {
+  const n = Number(at) || 0;
+  if (!n) return "";
+  try {
+    const d = new Date(n);
+    return `${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${pad2(d.getHours())}:${pad2(d.getMinutes())}`;
+  } catch { return ""; }
+}
+
+/**
+ * 解析一条消息是否为命令。
+ * @returns {{name:string, arg:string, unknown?:boolean, raw:string}|null} null = 普通文本（照旧转给模型）
+ */
+export function parseImCommand(text) {
+  const raw = String(text == null ? "" : text).trim();
+  if (!raw.startsWith("/")) return null;
+  const m = /^\/([a-zA-Z]*)(?:\s+([^\s]+))?(?:\s+([\s\S]*))?$/.exec(raw);
+  if (!m) return { name: "/", arg: "", unknown: true, raw };
+  const word = String(m[1] || "").toLowerCase();
+  return { name: word ? `/${word}` : "/", arg: String(m[2] || "").toLowerCase(), rest: m[3] || "", unknown: !word, raw };
+}
+
+/** 当前 caps 是否具备该命令要求（点号前缀规则，与会员表同源）。 */
+export function commandAllowed(command, caps) {
+  const list = Array.isArray(caps) ? caps : [];
+  return (command.caps || []).every((c) => grantsCap(list, c));
+}
+
+function appPromo(ctx) {
+  const base = String((ctx && ctx.appUrl) || "").trim().replace(/\/+$/, "");
+  if (!base) return "";
+  return `${base}/promo`;
+}
+
+/** /help：列出全部命令（免费/会员标注；免费档会提示哪些需要会员）。 */
+export function helpText(ctx = {}) {
+  const caps = Array.isArray(ctx.caps) ? ctx.caps : [];
+  const lines = ["📋 可用命令（命令不会发给模型，直接执行）", ""];
+  for (const cmd of IM_COMMANDS) {
+    const allowed = commandAllowed(cmd, caps);
+    const mark = cmd.free ? "" : allowed ? "（会员）" : "（会员·当前档不可用）";
+    lines.push(`${cmd.usage} — ${cmd.summary}${mark}`);
+  }
+  lines.push("", "免费档可用的命令：/help /status /stop /unbind（急停与退订永远免费）。");
+  if (caps.includes("sessions")) lines.push("你的档位已包含会话管理（/ls、/use）。");
+  return lines.join("\n");
+}
+
+/** 未知 /xxx：不转给模型，回"未知命令 + 帮助提示"。 */
+export function unknownCommandText(cmd, ctx = {}) {
+  const name = cmd && cmd.name && cmd.name !== "/" ? cmd.name : cmd && cmd.raw ? String(cmd.raw).split(/\s+/)[0] : "/?";
+  return `未知命令：${name}\n\n${helpText(ctx)}`;
+}
+
+/** 会员功能被拦：与现有升级文案同口径（能做什么/去哪升级），只是更简短。 */
+export function upgradeText(commandName, ctx = {}) {
+  const promo = appPromo(ctx);
+  const lines = [
+    `🔒 ${commandName} 是会员功能（列出/切换会话）`,
+    "",
+    "免费可用：/help /status /stop /unbind（急停、退订永远免费）",
+    "升级 Pro：指令不限量、可开新任务、可切换/多会话"
+  ];
+  if (promo) lines.push(`👉 ${promo}`);
+  return lines.join("\n");
+}
+
+/** /status：与状态文件同源的连接/会话/额度摘要。 */
+export async function statusText(ctx = {}) {
+  const snap = typeof ctx.statusSnapshot === "function" ? await ctx.statusSnapshot() : (ctx.status || {});
+  const s = snap && typeof snap === "object" ? snap : {};
+  const channel = String(s.channelLabel || ctx.channelLabel || "IM");
+  const connected = s.connected === true;
+  const authed = s.authenticated === true;
+  const state = String(s.state || (connected ? "connected" : "idle"));
+  const stateLine = connected
+    ? (authed ? "✅ 已连接（认证通过）" : "✅ 已连接（等待认证）")
+    : `⚠️ 未连接（${state}${s.lastError ? `：${truncateTitle(s.lastError, 40)}` : ""}）`;
+  const conv = truncateTitle(s.currentSessionTitle || s.boundSessionTitle || "", 24) || "未选择";
+  const convId = String(s.currentSessionId || s.boundSessionId || "");
+  const shortId = convId ? convId.replace(/^session-/, "").slice(0, 8) : "";
+  const limit = Number(s.messagesPerMonth) || 0;
+  const used = Number(s.usage && s.usage.messages) || 0;
+  const quotaLine = limit > 0
+    ? `本月指令：已用 ${used}/${limit}${s.tier ? `（${s.tier}）` : ""}`
+    : `本月指令：不限${s.tier ? `（${s.tier}）` : ""}`;
+  const lines = [
+    "📊 连接状态",
+    `· 通道：${channel}`,
+    `· 状态：${stateLine}`,
+    `· 当前会话：${conv}${shortId ? `（#${shortId}）` : ""}`,
+    `· ${quotaLine}`
+  ];
+  if (s.remainingMessages !== null && s.remainingMessages !== undefined && limit > 0) {
+    lines.push(`· 剩余：${Number(s.remainingMessages) || 0} 条`);
+  }
+  return lines.join("\n");
+}
+
+/** ctx 的 currentSessionId/currentSessionTitle 允许函数或字符串（各通道实现风格不一）。 */
+function resolveMaybeFn(value) {
+  try { return typeof value === "function" ? String(value() || "") : String(value || ""); } catch { return ""; }
+}
+
+/** 统一取最近会话列表（ctx.sessions 返回 [{sessionId,title,updatedAt,running}]）。 */
+export async function listSessions(ctx = {}) {
+  if (typeof ctx.sessions !== "function") return [];
+  const rows = await ctx.sessions();
+  if (!Array.isArray(rows)) return [];
+  return rows
+    .filter((r) => r && typeof r.sessionId === "string" && r.sessionId)
+    .slice(0, 10)
+    .map((r) => ({
+      sessionId: r.sessionId,
+      title: String(r.title || r.sessionTitle || "").trim() || r.sessionId,
+      updatedAt: Number(r.updatedAt) || 0,
+      running: r.running === true
+    }));
+}
+
+/** /ls：≤10 个会话，标题截断 24 + 索引 + 当前标记 + 更新时间。 */
+export async function lsText(ctx = {}) {
+  const rows = await listSessions(ctx);
+  const current = resolveMaybeFn(ctx.currentSessionId) || String(ctx.activeSessionId || "");
+  if (!rows.length) {
+    return "📂 最近没有可列出的会话。\n\n先在电脑的 DeepSeek Harness 里打开/运行一个会话，再发 /ls。";
+  }
+  const lines = ["📂 最近会话（最多 10 个）", ""];
+  rows.forEach((r, i) => {
+    const isCurrent = r.sessionId === current;
+    const time = fmtTime(r.updatedAt);
+    const marks = [isCurrent ? "（当前）" : "", r.running ? "· 运行中" : "", time ? `· ${time}` : ""].filter(Boolean).join(" ");
+    lines.push(`${i + 1}. ${truncateTitle(r.title, 24)}${marks ? ` ${marks}` : ""}`);
+  });
+  lines.push("", "回复 /use <序号> 切换会话（例如 /use 1）。");
+  return { text: lines.join("\n"), rows };
+}
+
+/** /use <N>：切换当前绑定会话（写配置 sessionId/sessionTitle）。 */
+export async function useText(ctx = {}, arg = "") {
+  const rows = await listSessions(ctx);
+  if (!rows.length) return "现在没有可切换的会话。先在电脑上打开一个会话，再发 /ls 看看。";
+  const raw = String(arg || "").trim();
+  if (!raw) return "用法：/use <序号>（先发 /ls 查看会话列表，例如 /use 1）";
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1 || n > rows.length) {
+    return `序号超出范围：当前列表是 1-${rows.length}。先发 /ls 查看列表，再用 /use <序号> 切换。`;
+  }
+  const pick = rows[n - 1];
+  if (typeof ctx.switchSession !== "function") return "当前通道还不支持切换会话（订阅器未就绪），请在电脑上切换。";
+  const r = await ctx.switchSession({ sessionId: pick.sessionId, title: pick.title });
+  if (!r || r.ok !== true) {
+    return `切换失败：${truncateTitle((r && (r.message || r.reason)) || "未知错误", 60)}。可以到电脑上切换，或稍后再试。`;
+  }
+  return `✅ 已切换到 #${n} ${truncateTitle(pick.title, 24) || pick.sessionId}`;
+}
+
+/** /stop：急停当前任务（免费、立即生效；回执明确）。 */
+export async function stopText(ctx = {}) {
+  const current = resolveMaybeFn(ctx.currentSessionId) || String(ctx.activeSessionId || "");
+  if (!current) return "当前没有正在运行的会话，无需急停。";
+  if (typeof ctx.cancelSession !== "function") return "急停失败：后台还没连上事件通道（订阅器未就绪）。请在电脑上停止任务。";
+  const title = truncateTitle(resolveMaybeFn(ctx.currentSessionTitle) || ctx.activeSessionTitle || current, 24);
+  let r;
+  try { r = await ctx.cancelSession({ sessionId: current }); } catch (e) {
+    r = { ok: false, message: e && e.message ? e.message : String(e) };
+  }
+  if (r && r.ok === true) return `⏹ 已急停：${title}（已发送中止，正在停止当前任务）`;
+  return `⏹ 急停请求已发出，但没收到确认：${truncateTitle((r && (r.message || r.reason)) || "未知错误", 60)}。请到电脑上确认任务是否已停。`;
+}
+
+/** /unbind：解绑本会话推送（免费；合规要求任何人可退订）。 */
+export async function unbindText(ctx = {}) {
+  if (typeof ctx.unbind !== "function") return "解绑失败：当前通道暂不支持解绑，请在电脑的「远程访问」里关闭该通道。";
+  let r;
+  try { r = await ctx.unbind(); } catch (e) { r = { ok: false, message: e && e.message ? e.message : String(e) }; }
+  if (r && r.ok === true) return "✅ 已解绑：这台电脑不再向本会话推送通知。想重新接收，发任意消息即可重新绑定。";
+  return `解绑失败：${truncateTitle((r && (r.message || r.reason)) || "未知错误", 60)}`;
+}
+
+/**
+ * 执行一条命令（**命中即返回 handled:true，调用方直接回复 text 并 return，绝不进模型**）。
+ *
+ * @param {{text:string, ctx:object}} args
+ *   ctx 契约（各通道按自己能力提供，缺的降级）：
+ *   · caps[]、tier、appUrl、channelLabel
+ *   · sessions(): Promise<[{sessionId,title,updatedAt,running}]>
+ *   · currentSessionId(): string、currentSessionTitle?: string、activeSessionId?
+ *   · cancelSession({sessionId})、switchSession({sessionId,title})、unbind()
+ *   · statusSnapshot(): Promise<{connected,authenticated,state,lastError,tier,usage,messagesPerMonth,remainingMessages,currentSessionTitle,currentSessionId}>
+ * @returns {Promise<{handled:boolean, ok?:boolean, gated?:boolean, command?:string, text?:string, rows?:Array}>}
+ */
+export async function executeImCommand({ text, ctx = {} } = {}) {
+  const cmd = parseImCommand(text);
+  if (!cmd) return { handled: false };
+  const caps = Array.isArray(ctx.caps) ? ctx.caps : [];
+  const known = IM_COMMANDS.find((c) => c.name === cmd.name);
+  if (!known) return { handled: true, ok: false, command: cmd.name, text: unknownCommandText(cmd, ctx) };
+  if (!commandAllowed(known, caps)) {
+    return { handled: true, ok: false, gated: true, command: known.name, text: upgradeText(known.name, ctx) };
+  }
+  try {
+    switch (known.name) {
+      case "/help":
+        return { handled: true, ok: true, command: known.name, text: helpText(ctx) };
+      case "/status":
+        return { handled: true, ok: true, command: known.name, text: await statusText(ctx) };
+      case "/stop":
+        return { handled: true, ok: true, command: known.name, text: await stopText(ctx) };
+      case "/unbind":
+        return { handled: true, ok: true, command: known.name, text: await unbindText(ctx) };
+      case "/ls": {
+        const r = await lsText(ctx);
+        return { handled: true, ok: true, command: known.name, text: typeof r === "string" ? r : r.text, rows: typeof r === "string" ? [] : r.rows };
+      }
+      case "/use":
+        return { handled: true, ok: true, command: known.name, text: await useText(ctx, cmd.arg) };
+      default:
+        return { handled: true, ok: false, command: known.name, text: unknownCommandText(cmd, ctx) };
+    }
+  } catch (e) {
+    return {
+      handled: true,
+      ok: false,
+      command: known.name,
+      text: `命令执行失败：${truncateTitle(e && e.message ? e.message : e, 60)}。可以到电脑上看一眼，或稍后再试。`
+    };
+  }
+}
+
+/** 能力表（导出方便各通道显示"会员功能"标记；单一真相源）。 */
+export const IM_COMMAND_CAPABILITY_TABLE = WECHAT_CAPABILITY_TABLE;
+
+/**
+ * 切换会话时写 `im-bots.json` 对应通道的 `sessionId/sessionTitle`（0600 原子写，保留其它段）。
+ * 各通道 controller 会热更新并在下一次入站用新会话。
+ */
+export function writeImBotsSession(relayDir, channel, { sessionId, sessionTitle } = {}) {
+  const dir = String(relayDir || "");
+  const ch = String(channel || "");
+  if (!dir || !ch) return { ok: false, reason: "no_target" };
+  const sid = String(sessionId || "").trim();
+  if (!sid) return { ok: false, reason: "no_session_id" };
+  try {
+    const file = path.join(dir, IM_BOTS_FILE);
+    const prev = readJsonFile(file);
+    const base = prev && typeof prev === "object" && !Array.isArray(prev) ? prev : {};
+    const cur = base[ch] && typeof base[ch] === "object" ? base[ch] : {};
+    atomicWriteJson(file, {
+      ...base,
+      version: 1,
+      [ch]: { ...cur, sessionId: sid, sessionTitle: truncateTitle(sessionTitle || "", 60) }
+    }, { onWarn: () => { /* 静默 */ } });
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, reason: e && e.message ? e.message : String(e) };
+  }
+}

package/clients/dsh-remote/test/dingtalk-bot.test.mjs

@@ -49,6 +49,11 @@ const FAKE_CLIENT = "ding-fake-client-id";
 
 function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
 
+/** 读 JSON 文件（不存在/坏 JSON → null）。 */
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return null; }
+}
+
 async function waitFor(fn, { label = "条件", timeout = 5000, interval = 20 } = {}) {
   const t0 = Date.now();
   for (;;) {
@@ -162,7 +167,7 @@ async function startWebhook(payload = { errcode: 0, errmsg: "ok" }, status = 200
 /** 最小 fake 订阅器（与 bridge 里 dsh-events 的对外接口同形）。 */
 function fakeSubscriber({ sessions = [{ sessionId: "session-live", running: true, title: "活跃会话" }], answer = "这是 agent 的最终回答" } = {}) {
   const emitter = new EventEmitter();
-  const calls = { prompt: [], listSessions: 0, lastAssistant: 0 };
+  const calls = { prompt: [], listSessions: 0, lastAssistant: 0, cancel: [] };
   return {
     on(evt, fn) { emitter.on(evt, fn); return this; },
     once(evt, fn) { emitter.once(evt, fn); return this; },
@@ -172,6 +177,7 @@ function fakeSubscriber({ sessions = [{ sessionId: "session-live", running: true
     sessions() { return sessions.map((s) => s.sessionId); },
     async listSessions() { calls.listSessions += 1; return { ok: true, sessions }; },
     async promptSession({ sessionId, text }) { calls.prompt.push({ sessionId, text }); return { ok: true }; },
+    async cancelSession({ sessionId } = {}) { calls.cancel.push({ sessionId }); return { ok: true }; },
     async lastAssistantText() { calls.lastAssistant += 1; return { ok: true, text: answer }; },
     calls
   };
@@ -553,6 +559,185 @@ test("controller：DSH_IM_BOTS=0 全关（env 优先）", async () => {
 
 // ─────────────────────────── 常量/默认值 ───────────────────────────
 
+// ─────────────────── 回复通道三层降级（2026-11-08 实测 bug：回答回传发不出） ───────────────────
+
+/** 包一层 fetch：把 openapi（accessToken / oToMessages / groupMessages）拦成本地假响应并记录。 */
+function makeOpenapiFetch() {
+  const calls = [];
+  const fetchImpl = (url, init) => {
+    const u = String(url);
+    if (u.includes("/oauth2/accessToken")) {
+      calls.push({ kind: "token", url: u, body: init && init.body });
+      return Promise.resolve({ ok: true, status: 200, json: async () => ({ accessToken: "tok-123", expireIn: 7200 }) });
+    }
+    if (u.includes("/robot/oToMessages/batchSend") || u.includes("/robot/groupMessages/send")) {
+      let body = null;
+      try { body = JSON.parse(init && init.body ? init.body : "{}"); } catch { body = null; }
+      calls.push({ kind: "send", url: u, body, headers: init && init.headers });
+      return Promise.resolve({ ok: true, status: 200, json: async () => ({ processQueryKey: "pq-1" }) });
+    }
+    return fetch(url, init);
+  };
+  return { fetchImpl, calls };
+}
+
+test("★ 回复通道①：入站缓存 sessionWebhook → 回答回传直接 POST 它（跨重启保持）", async () => {
+  const relayDir = tmpRelayDir();
+  const hook = await startWebhook();
+  const gateway = await startGateway();
+  const sub = fakeSubscriber({ answer: "重启后也要能回传答案" });
+  const botOptions = {
+    clientId: FAKE_CLIENT, clientSecret: FAKE_SECRET, robotCode: "ding-robot",
+    gatewayUrl: gateway.openUrl, relayDir, subscriber: sub,
+    logger: () => {}, reconnectBaseMs: 40, reconnectMaxMs: 160, tierDenyThrottleMs: 0
+  };
+  const bot1 = createDingtalkBot(botOptions);
+  try {
+    bot1.start();
+    await waitFor(() => bot1.status().connected, { label: "连接1" });
+    gateway.push({
+      type: "CALLBACK", headers: { messageId: "mid-c1", topic: TOPIC_ROBOT },
+      data: JSON.stringify({
+        conversationId: "cid-1", conversationType: "2", senderStaffId: "staff-9",
+        msgtype: "text", msgId: "m-c1", text: { content: "你好" },
+        sessionWebhook: hook.url, sessionWebhookExpiredTime: Date.now() + 5 * 60_000
+      })
+    });
+    await waitFor(() => hook.state.calls.length >= 1, { label: "被动回复" });
+    const st1 = bot1.status();
+    assert.equal(st1.replyChannel.kind, "sessionWebhook");
+    assert.equal(st1.replyChannel.hasWebhook, true);
+    await bot1.stop();
+  } finally {
+    await gateway.close();
+  }
+  // 重启（新进程语义）：只靠磁盘缓存也要能回传
+  const gateway2 = await startGateway();
+  const bot2 = createDingtalkBot({ ...botOptions, gatewayUrl: gateway2.openUrl });
+  try {
+    bot2.start();
+    await waitFor(() => bot2.status().connected, { label: "连接2" });
+    assert.equal(bot2.status().replyChannel.kind, "sessionWebhook", "★ 重启后回复通道来自持久化缓存");
+    const before = hook.state.calls.length;
+    const r = await bot2.sendMarkdown("重启后的回答回传");
+    assert.equal(r.ok, true);
+    assert.equal(r.kind, "sessionWebhook");
+    await waitFor(() => hook.state.calls.length > before, { label: "重启后回传到 webhook" });
+    assert.match(hook.last().body.markdown.text, /重启后的回答回传/);
+  } finally {
+    await bot2.stop();
+    await gateway2.close();
+    await hook.close();
+    fs.rmSync(relayDir, { recursive: true, force: true });
+  }
+});
+
+test("★ 回复通道②：sessionWebhook 过期 → 降级 openapi（userIds=[senderStaffId]）", async () => {
+  const relayDir = tmpRelayDir();
+  const gateway = await startGateway();
+  const hook = await startWebhook();
+  const api = makeOpenapiFetch();
+  const sub = fakeSubscriber({ answer: "x" });
+  const bot = createDingtalkBot({
+    clientId: FAKE_CLIENT, clientSecret: FAKE_SECRET, robotCode: "ding-robot",
+    gatewayUrl: gateway.openUrl, relayDir, subscriber: sub,
+    fetchImpl: api.fetchImpl, logger: () => {},
+    reconnectBaseMs: 40, reconnectMaxMs: 160, tierDenyThrottleMs: 0
+  });
+  try {
+    bot.start();
+    await waitFor(() => bot.status().connected, { label: "连接" });
+    gateway.push({
+      type: "CALLBACK", headers: { messageId: "mid-exp", topic: TOPIC_ROBOT },
+      data: JSON.stringify({
+        conversationId: "cid-exp", conversationType: "1", senderStaffId: "staff-exp",
+        msgtype: "text", msgId: "m-exp", text: { content: "hi" },
+        sessionWebhook: hook.url, sessionWebhookExpiredTime: Date.now() - 1000 // 已过期
+      })
+    });
+    await waitFor(() => bot.status().messages >= 1, { label: "入站" });
+    assert.equal(bot.status().replyChannel.kind, "openapi", "★ webhook 过期 → 显示 openapi 可用");
+    const hookCalls = hook.state.calls.length;
+    const r = await bot.sendMarkdown("降级 openapi 回答");
+    assert.equal(r.ok, true);
+    assert.equal(r.kind, "openapi");
+    const send = api.calls.filter((c) => c.kind === "send");
+    assert.equal(send.length, 1);
+    assert.deepEqual(send[0].body.userIds, ["staff-exp"], "★ 用缓存的 senderStaffId 发单聊");
+    assert.match(send[0].headers["x-acs-dingtalk-access-token"], /tok-123/);
+    assert.equal(hook.state.calls.length, hookCalls, "过期 webhook 不得再被调用");
+  } finally {
+    await bot.stop(); await gateway.close(); await hook.close();
+    fs.rmSync(relayDir, { recursive: true, force: true });
+  }
+});
+
+test("★ 回复通道③：webhook 与 openapi 都不可用 → 明确日志 no_reply_channel + 状态人话（不静默）", async () => {
+  const relayDir = tmpRelayDir();
+  const gateway = await startGateway();
+  const logs = [];
+  const bot = createDingtalkBot({
+    clientId: FAKE_CLIENT, clientSecret: FAKE_SECRET, robotCode: "", // 无 robotCode
+    gatewayUrl: gateway.openUrl, relayDir,
+    logger: (level, line) => logs.push(line),
+    reconnectBaseMs: 40, reconnectMaxMs: 160, tierDenyThrottleMs: 0
+  });
+  try {
+    bot.start();
+    await waitFor(() => bot.status().connected, { label: "连接" });
+    const r = await bot.sendMarkdown("发不出去的");
+    assert.equal(r.ok, false);
+    assert.match(String(r.reason), /no_reply_channel|no_robot_code|no_target_user|no_webhook/);
+    await waitFor(() => logs.join("\n").match(/no_reply_channel|no_robot_code/), { label: "明确日志" });
+    const st = bot.status();
+    assert.equal(st.replyChannel.kind, "none");
+    assert.ok(String(st.replyChannel.lastError || "").length > 0, "状态要有人话原因");
+    const stFile = readJson(path.join(relayDir, IM_BOT_STATUS_FILE));
+    assert.equal(stFile.dingtalk.replyChannel.kind, "none");
+    assert.match(String(stFile.dingtalk.replyChannel.lastError || ""), /回复通道|robotCode/, "面板可显示可操作原因（补 robotCode / 再发一条消息激活）");
+  } finally {
+    await bot.stop(); await gateway.close();
+    fs.rmSync(relayDir, { recursive: true, force: true });
+  }
+});
+
+test("★ 脱敏：日志/状态只出现 webhook host 与哈希，不含整条 webhook URL 或 secret", async () => {
+  const relayDir = tmpRelayDir();
+  const gateway = await startGateway();
+  const logs = [];
+  const sub = fakeSubscriber();
+  const bot = createDingtalkBot({
+    clientId: FAKE_CLIENT, clientSecret: FAKE_SECRET, robotCode: "ding-robot",
+    gatewayUrl: gateway.openUrl, relayDir, subscriber: sub,
+    logger: (level, line) => logs.push(line),
+    reconnectBaseMs: 40, reconnectMaxMs: 160, tierDenyThrottleMs: 0
+  });
+  try {
+    bot.start();
+    await waitFor(() => bot.status().connected, { label: "连接" });
+    const webhookUrl = "https://oapi.dingtalk.test/robot/sendBySession?session=TOKEN-SECRET-AAA";
+    gateway.push({
+      type: "CALLBACK", headers: { messageId: "mid-sec", topic: TOPIC_ROBOT },
+      data: JSON.stringify({
+        conversationId: "cid-sec", conversationType: "1", senderStaffId: "staff-sec",
+        msgtype: "text", msgId: "m-sec", text: { content: "hi" },
+        sessionWebhook: webhookUrl, sessionWebhookExpiredTime: Date.now() + 60_000
+      })
+    });
+    await waitFor(() => bot.status().messages >= 1, { label: "入站" });
+    await waitFor(() => logs.join("\n").includes("oapi.dingtalk.test"), { label: "host 日志" });
+    const joined = logs.join("\n");
+    assert.ok(!joined.includes("TOKEN-SECRET-AAA"), "★ 日志不得含 webhook 会话令牌");
+    assert.ok(!joined.includes(FAKE_SECRET), "★ 日志不得含 clientSecret");
+    const raw = fs.readFileSync(path.join(relayDir, IM_BOT_STATUS_FILE), "utf8");
+    assert.ok(!raw.includes("TOKEN-SECRET-AAA"), "★ 状态文件不得含 webhook 原值");
+    assert.ok(!raw.includes(FAKE_SECRET));
+  } finally {
+    await bot.stop(); await gateway.close();
+    fs.rmSync(relayDir, { recursive: true, force: true });
+  }
+});
+
 // ─────────────────── robotCode 可选（扫码一键创建机器人，2026-11-08） ───────────────────
 
 test("★ robotCode 可选：只给 clientId/clientSecret 也能启动、收/回消息；状态 capabilities 如实降级", async () => {
@@ -628,3 +813,35 @@ test("常量：默认 open 端点 / ticket 90s / 退避 1s→60s", () => {
   assert.equal(TICKET_TTL_MS, 90_000);
   assert.equal(TOPIC_ROBOT, "/v1.0/im/bot/messages/get");
 });
+
+// ─────────────────────── 命令层（2026-11-08：/ls 不再转给模型）───────────────────────
+
+test("★ 命令层：/help 回复、免费档 /ls 被拦（会员文案）、/stop 免费急停；命令不进 promptSession", async () => {
+  const rt = await setupBot();
+  try {
+    await rt.start();
+    const pushCmd = async (msgId, text) => {
+      rt.gateway.push({
+        type: "CALLBACK", headers: { messageId: `mid-${msgId}`, topic: TOPIC_ROBOT },
+        data: JSON.stringify({
+          conversationId: "cid-cmd", conversationType: "2", senderStaffId: "staff-cmd",
+          msgtype: "text", msgId: `m-${msgId}`, text: { content: text },
+          sessionWebhook: rt.hook.url, sessionWebhookExpiredTime: Date.now() + 60_000
+        })
+      });
+    };
+    pushCmd("help", "/help");
+    await waitFor(() => rt.hook.state.calls.find((c) => /可用命令/.test(c.body.markdown.text)), { label: "/help 回复" });
+    assert.equal(rt.sub.calls.prompt.length, 0, "★ 命令不得进模型");
+    pushCmd("ls", "/ls");
+    await waitFor(() => rt.hook.state.calls.find((c) => /会员功能/.test(c.body.markdown.text)), { label: "/ls 会员拦截" });
+    assert.equal(rt.sub.calls.prompt.length, 0);
+    pushCmd("stop", "/stop");
+    await waitFor(() => rt.hook.state.calls.find((c) => /已急停|没有正在运行/.test(c.body.markdown.text)), { label: "/stop 回复" });
+    assert.equal(rt.sub.calls.cancel.length, 1, "★ /stop 调 cancelSession");
+    assert.equal(rt.sub.calls.prompt.length, 0);
+    // 普通文本照旧转发
+    await rt.inbound({ text: "帮我看看日志", msgId: "m-normal-cmd" });
+    await waitFor(() => rt.sub.calls.prompt.length === 1, { label: "普通文本转发" });
+  } finally { await rt.close(); }
+});

package/clients/dsh-remote/test/feishu-bot.test.mjs

@@ -152,7 +152,7 @@ function makeFetch({ tokenCode = 0, sendCode = 0, sendMsg = "", patchCode = 0 }
 // ── 假事件订阅器 ──────────────────────────────────────────────────────────
 function makeSubscriber() {
   const emitter = new EventEmitter();
-  const calls = { sessions: [], prompts: [], started: 0, stopped: 0, listenSessions: 0 };
+  const calls = { sessions: [], prompts: [], cancels: [], started: 0, stopped: 0, listenSessions: 0 };
   return {
     calls,
     on: (evt, cb) => emitter.on(evt, cb),
@@ -161,7 +161,8 @@ function makeSubscriber() {
     stop() { calls.stopped += 1; },
     sessions() { return ["session-abc"]; },
     async listSessions() { calls.listenSessions += 1; return [{ sessionId: "session-abc", title: "t" }]; },
-    async promptSession(req) { calls.prompts.push(req); return { ok: true }; }
+    async promptSession(req) { calls.prompts.push(req); return { ok: true }; },
+    async cancelSession(req) { calls.cancels.push(req); return { ok: true }; }
   };
 }
 
@@ -1087,3 +1088,34 @@ test("向导：主路径只有两件事（填 App ID/Secret + 发一句话自动
   assert.match(FEISHU_SETUP_GUIDE.oneAppOnePc, /一台电脑/);
   assert.match(FEISHU_SETUP_GUIDE.docs.registerApp, /open\.feishu\.cn\/app/);
 });
+
+// ─────────────────────── 命令层（2026-11-08：/ls 不再转给模型）───────────────────────
+
+test("controller：命令层 — /help 直接回复、免费档 /ls 被拦、/stop 急停；命令绝不进模型", async () => {
+  const relayDir = mkRelayDir("ctl-cmd");
+  writeConfig(relayDir, { enabled: true, appId: APP_ID, appSecret: APP_SECRET, receiveId: "oc_chat_1", receiveIdType: "chat_id" });
+  const sub = makeSubscriber();
+  const { controller, fetchCalls } = startController(relayDir, { subscriber: sub, capsProvider: async () => "free" });
+  await controller.start();
+  const lastText = () => {
+    const rows = fetchCalls.filter((c) => c.url.includes("/im/v1/messages") && JSON.parse(c.body).msg_type === "text");
+    return rows.length ? JSON.parse(rows[rows.length - 1].body).content : "";
+  };
+  controller._bot()._dispatch("im.message.receive_v1", inboundText("/help"));
+  await waitFor(() => /可用命令/.test(lastText()));
+  assert.match(lastText(), /可用命令/);
+  assert.equal(sub.calls.prompts.length, 0, "★ 命令不得进模型");
+  controller._bot()._dispatch("im.message.receive_v1", inboundText("/ls"));
+  await waitFor(() => /会员功能/.test(lastText()));
+  assert.match(lastText(), /会员功能/, "免费档 /ls 必须被拦");
+  assert.equal(sub.calls.prompts.length, 0);
+  controller._bot()._dispatch("im.message.receive_v1", inboundText("/stop"));
+  await waitFor(() => /已急停|没有正在运行/.test(lastText()));
+  assert.equal(sub.calls.cancels.length, 1, "★ /stop 调 cancelSession");
+  assert.equal(sub.calls.prompts.length, 0, "★ 全部命令都不进模型");
+  // 普通文本照旧转发
+  controller._bot()._dispatch("im.message.receive_v1", inboundText("继续跑"));
+  await waitFor(() => sub.calls.prompts.length === 1);
+  assert.equal(sub.calls.prompts.length, 1);
+  await controller.stop();
+});

package/clients/dsh-remote/test/im-caps-fixture.mjs

@@ -0,0 +1,8 @@
+/** 测试共用的能力集夹具（与 wechat-runtime 的 WECHAT_CAPABILITY_TABLE 对齐，避免各测试各抄一份）。 */
+export function freeCaps() {
+  return ["notify", "approve", "status", "stop", "assign.continue"];
+}
+
+export function paidCaps() {
+  return ["notify", "approve", "status", "stop", "assign", "sessions", "summary", "steer", "attach", "multi"];
+}