npm - @quecue/dev-notify - Versions diffs - 0.2.0 → 0.2.2 - Mend

@quecue/dev-notify 0.2.0 → 0.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (14) hide show

package/CHANGELOG.en.md CHANGED Viewed

@@ -2,6 +2,26 @@
 English | [简体中文](CHANGELOG.md)
+## 0.2.2 — 2026-11-07
+Communication dependency extraction, Windows file-replacement fixes, and documentation updates. Actual version availability is authoritative on the npm registry; the changes below are not included in `0.2.1`.
+- Extract Telegram/Feishu communication into the standard npm runtime dependency `@quecue/notify-core@0.1.0`, with source at [QueCue/notify-core](https://github.com/QueCue/notify-core). Do not embed the library or link sibling source; npm users do not install this dependency manually. The CLI entry point, languages, and reply button protocol remain compatible. The library's `0.1.0` has been published through GitHub Actions, and this application's lockfile now pins the official registry source and matching SHA512.
+- When a Windows state file is temporarily busy, retry only the same atomic replacement without repeating message or input operations.
+- Update Chinese and English installation, dependency, credential cleanup, and security boundary documentation to distinguish published packages from unreleased source.
+- Share package-file verification between local maintainer checks and CI, covering application runtime, the standard communication dependency declaration and public documentation; remove the obsolete alpha default from the manual publishing form.
+- Regression results for this source revision: 219 tests, 218 passed, 0 failed, and 1 opt-in native credential test skipped. These results do not establish real-machine acceptance on each platform.
+## 0.2.1 — 2026-11-04
+### Fixed
+- Fixed mixed Chinese and English Telegram messages after switching the interface language: the reply bridge is a long-running process and previously read the language only once at startup; it now follows the configured language on every polling cycle, so subsequent messages immediately use the new language after `dev-notify language`. An already running bridge must be restarted once (`reply stop` / `reply start`) to load the fix.
+### Verification
+- Automated regression totals 204 items: 203 passed, 0 failed, and 1 native credential test requiring explicit enablement was skipped.
 ## 0.2.0 — 2026-11-04
 ### Added

package/CHANGELOG.md CHANGED Viewed

@@ -2,6 +2,26 @@
 简体中文 | [English](CHANGELOG.en.md)
+## 0.2.2 — 2026-11-07
+通讯层依赖提取、Windows 文件替换修复与文档更新。实际版本可用性以 npm registry 为准；以下变更不包含在 `0.2.1` 中。
+- 将 Telegram／飞书通讯层提取为标准 npm 运行时依赖 `@quecue/notify-core@0.1.0`，源码见 [QueCue/notify-core](https://github.com/QueCue/notify-core)。不嵌入通讯库、不链接兄弟仓库源码，npm 用户无需手动安装该依赖。CLI 入口、语言及回复按钮协议保持兼容。通讯库 `0.1.0` 已通过 GitHub Actions 正式发布，本应用锁文件已切换为正式 registry 来源及对应 SHA512。
+- Windows 状态文件被暂态占用时只重试同一次原子替换，不重做消息或输入操作。
+- 更新中英文安装、依赖、凭据清理及安全边界说明，区分已发布安装包和未发布源码。
+- 统一维护者本地与 CI 的发布文件清单校验，覆盖应用运行时、标准通讯依赖声明及公开文档；移除手动发布表单中过时的 alpha 默认标签。
+- 当前源码回归 219 项：218 通过、0 失败、1 项显式原生凭据测试跳过。此结果不代表各平台的实机验收。
+## 0.2.1 — 2026-11-04
+### 修复
+- 修复切换界面语言后 Telegram 消息中英混用的问题：回复桥接是长驻进程，之前只在启动时读取一次语言；现在桥接每轮跟随配置语言，`dev-notify language` 切换后后续消息立即使用新语言。已在运行的桥接需重启一次（`reply stop` / `reply start`）以加载修复。
+### 验证
+- 自动化回归共 204 项：203 通过、0 失败、1 项需要显式启用的原生凭据测试跳过。
 ## 0.2.0 — 2026-11-04
 ### 新增

package/README.en.md CHANGED Viewed

@@ -2,9 +2,15 @@
 English | [简体中文](README.md)
-Cross-platform developer task notification tool written in **TypeScript / Node.js** and distributed via npm, with no standalone executable or other script runtime required. General notifications do not depend on Claude Code, Unity, or a project directory.
+Cross-platform developer task notification tool written in **TypeScript / Node.js** and distributed via npm, with no standalone executable or other script runtime required. General notifications do not depend on Claude Code or a project directory.
-**The npm package name is `@quecue/dev-notify`. `0.1.3` provides Claude Code reply notifications plus native PC and Telegram two-sided question answering and result feedback.** For version changes and upgrade notes, see [CHANGELOG.en.md](CHANGELOG.en.md); the published version is authoritative on the npm registry.
+**The npm package name is `@quecue/dev-notify`, with general notifications, Claude Code remote replies, and local/Telegram two-sided question answering and result feedback.** Source repository: [QueCue/dev-notify](https://github.com/QueCue/dev-notify). For changes and upgrade notes, see [CHANGELOG.en.md](CHANGELOG.en.md); published versions and distribution tags are authoritative on the npm registry, and source changes do not constitute a release.
+### Communication dependency in 0.2.2 source
+The current 0.2.2 source extracts Telegram/Feishu communication into the standard npm runtime dependency `@quecue/notify-core`, pinned to exactly `0.1.0`. Source: [QueCue/notify-core](https://github.com/QueCue/notify-core). This structure does not describe the published `0.2.1` package.
+npm installs the dependency; builds compile only this application without copying the communication library or linking sibling source. npm users do not install the library manually. `@quecue/notify-core@0.1.0` has been published through GitHub Actions. The lockfile pins its registry source and integrity; use `npm ci --ignore-scripts` for source development.
 ## Installation and usage
@@ -13,6 +19,7 @@ Requires Node.js 22 or later; initial targets are Windows and macOS. Runtime dep
 Install from npm:
 ```sh
+npm view @quecue/dev-notify dist-tags
 npm install -g @quecue/dev-notify
 dev-notify --version
 dev-notify setup
@@ -20,27 +27,22 @@ dev-notify setup
 You can also override credentials and recipients with environment variables: `TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID` / `TELEGRAM_CHAT_IDS`, `FEISHU_WEBHOOK`, `FEISHU_SECRET`; and path variables `DEV_NOTIFY_HOME`, `CLAUDE_CONFIG_DIR`. Explicitly present variables take precedence, and empty values also override; see "Paths, templates, and environment variables" below for complete rules and custom variable names.
-`0.1.0-alpha.1` does not include Claude Code hooks; the reply interactions below require `0.1.0-alpha.3` or later. After upgrading, re-run `dev-notify integration claude-code install` to update the complete hooks, and stop and restart any existing reply bridge; existing valid authorizations and notification credentials do not need to be reconfigured. If you use a custom configuration, keep passing the original `--config` path. For source development, build in the project directory and run:
+The default installation uses npm's `latest` tag; `alpha` is a prerelease tag and does not imply a newer version than the stable release. Use the `npm view` command above to check tags and `dev-notify --version` to check the installed version. See the changelog for upgrade notes; after upgrading, update the complete hooks and restart any existing reply bridge. Valid authorizations and notification credentials do not need to be reconfigured; keep passing the original `--config` path for custom configurations.
-```sh
-npm ci --ignore-scripts
-npm run build
-node dist/cli.js setup
-node dist/cli.js doctor
-```
+The main instructions below use the npm-installed `dev-notify` command; see "Development and verification" for source builds and `node dist/cli.js` usage.
 After configuration is complete, send:
 ```sh
-node dist/cli.js send --title "Build complete" --content "Installer generated"
-node dist/cli.js send --title "Test results" --content-file result.txt
-node dist/cli.js send --title "Task output" --stdin
-node dist/cli.js send --title "Segment preview" --content-file result.txt --dry-run
+dev-notify send --title "Build complete" --content "Installer generated"
+dev-notify send --title "Test results" --content-file result.txt
+dev-notify send --title "Task output" --stdin
+dev-notify send --title "Segment preview" --content-file result.txt --dry-run
 ```
 To install locally as the `dev-notify` command, run `npm install --global .` after building, then use `dev-notify setup`, `dev-notify send ...`, and so on. This is a local source install, not an install from the public registry; this project does not automatically install globally or publish.
-npm handles installation, upgrades, and uninstallation of the official package. **Clearing credentials before uninstalling is recommended**: npm uninstall does not automatically delete user credentials. First run `dev-notify credentials clear` interactively, then uninstall. That command deletes only the Node credential referenced by the current configuration and does not touch other accounts, other configurations, or old-prototype credentials.
+npm handles installation, upgrades, and uninstallation of the official package. **Clearing credentials before uninstalling is recommended**: npm uninstall does not automatically delete user credentials. First run `dev-notify credentials clear` interactively, then uninstall. That command deletes only the Node credential referenced by the current configuration; it does not scan other configurations, delete unrelated entries, or handle old-prototype credentials. However, configuration copies sharing the same credential reference will also lose access to that credential.
 Installed versions can be upgraded with `update`; it only checks the version and invokes npm, and does not download or replace files itself:
@@ -73,7 +75,7 @@ Actual integrity verification, registry configuration, permission handling, and
 ## Configuration wizard
 ```sh
-node dist/cli.js setup
+dev-notify setup
 ```
 1. Choose Telegram, Feishu, or both; when editing an existing configuration, the current selection is shown and pressing Enter keeps it.
@@ -84,12 +86,12 @@ node dist/cli.js setup
 6. After confirmation, Claude Code notification hooks are merged and installed by default (`--no-hooks` skips it). Existing integrations are left as-is and are not added again.
 7. Remote reply authorization is not requested in setup; when Telegram is available, it prompts you to run `reply setup` separately to choose specific trusted private-chat users and confirm separately.
-Editing an existing configuration no longer asks a second time whether to continue; leaving a secret blank preserves the stored value, and entering `-` for an optional signature clears it. Channels that are not selected are disabled, and new entries retain credentials only for the selected channels. Environment variables still take precedence (`TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID` / `TELEGRAM_CHAT_IDS`, `FEISHU_WEBHOOK`, `FEISHU_SECRET`); the wizard indicates which variables are overriding configuration, and tests and the final save both use the effective values. See the complete list in "Paths, templates, and environment variables".
+Editing an existing configuration no longer asks a second time whether to continue; leaving a secret blank preserves the stored value, and entering `-` for an optional signature clears it. Channels that are not selected are disabled, and new entries retain credentials only for the selected channels. Environment variables still take precedence (`TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID` / `TELEGRAM_CHAT_IDS`, `FEISHU_WEBHOOK`, `FEISHU_SECRET`); the wizard indicates which variables are overriding configuration. Tests and subsequent runtime operations use the effective values after environment overrides, but persistence saves the wizard-entered credentials and selected recipients; environment overrides are not automatically written back to configuration or system credentials. See the complete list in "Paths, templates, and environment variables".
 For automation, use the secret-free template and CI secrets:
 ```sh
-node dist/cli.js setup --template --yes
+dev-notify setup --template --yes
 ```
 To save configuration only without sending a test or installing hooks, use `setup --no-test` / `setup --no-hooks` (they can be combined). The template does not overwrite existing configuration. `--yes` can only be used with `--template`; interactive confirmation is still required before saving secrets.
@@ -187,7 +189,7 @@ The Node version uses **Windows Credential Manager / macOS Keychain**, passing s
 - When native component loading fails, storage is locked, or access is denied, it reports an explicit error and does not fall back to a plaintext file. macOS may request system authorization; system prompts may still appear in offline environments.
 - By default it does not enumerate system entries and accesses only the current reference or a random entry created in this run.
-The old prototype used `backend: "system"`, which on Windows is a DPAPI file and not the same store as Node Credential Manager. Node does not read or delete it. For old configurations, run `setup` to re-enter and generate a Node reference; the original credentials remain unchanged. Early prototype source, tests, and documentation have been removed from the main branch but remain available in Git history.
+The old prototype used `backend: "system"`, which on Windows is a DPAPI file and not the same store as Node Credential Manager. Node does not read or delete it. For old configurations, run `setup` to re-enter and generate a Node reference; the original credentials remain unchanged. This compatibility restriction does not affect configurations already using `keyring` references.
 ## Paths, templates, and environment variables
@@ -269,7 +271,7 @@ Save flow: write a new random system entry → verify readability → atomically
 Configuration writes use an exclusive `.setup.lock`, and the original file is checked before writing and before switching. Avoid concurrently editing configuration with an editor while the wizard is saving; editors do not honor this lock. Power loss or force-kill may leave locks or orphaned entries, and storage and JSON are not cross-system atomic transactions. Only after confirming that no wizard is running should residual locks be handled; the program does not proactively scan or delete unknown entries.
 ```sh
-node dist/cli.js credentials clear
+dev-notify credentials clear
 ```
 Cleanup requires interactive confirmation; it first removes the current JSON reference, then attempts to delete its Node entry; environment variables remain unchanged. Configuration copies sharing the same old reference are also affected, and this is communicated before the operation. Deletion failure is clearly warned and is not shown as cleaned.
@@ -292,20 +294,32 @@ If one recipient fails midway, its subsequent segments stop, while Telegram cont
 | 2 | Argument, configuration, file, or credential operation error |
 | 130 | Canceled by the user |
-If the test notification fails after the wizard saves successfully, the command still ends as a successful save and clearly shows the test failure; the two are clearly distinguished. Canceling hook configuration after saving still returns 0 and keeps channels; a hook configuration error returns 1 and clearly states that channels were saved. Integration `status` returns 1 when entries are missing, duplicated, or hooks are disabled in the current user-level file. Internal hook handling commands always exit without blocking, with failures reported via stderr.
+If the test notification fails after the wizard saves successfully, the command still ends as a successful save and clearly shows the test failure; the two are clearly distinguished. Canceling hook configuration after saving still returns 0 and keeps channels; a hook configuration error returns 1 and clearly states that channels were saved. Integration `status` returns 1 when entries are missing, duplicated, or hooks are disabled in the current user-level file. Internal hook failures are reported via stderr with a non-blocking exit status for the host. This does not mean asynchronous or immediate completion: synchronous hooks awaiting remote answers still wait within their documented timeout.
 ## Development and verification
+Clone the [GitHub source repository](https://github.com/QueCue/dev-notify) and run these commands from its directory. npm restores pinned dependencies from the lockfile; no communication-library checkout is required:
 ```sh
 npm ci --ignore-scripts
+npm run build
+node dist/cli.js setup
+node dist/cli.js doctor
+node dist/cli.js send --title "Build complete" --content "Installer generated"
 npm test
 npm pack --dry-run
 ```
+For other CLI examples, replace `dev-notify` with `node dist/cli.js`; no global installation is required.
 `node-src/` is TypeScript source, `dist/` is compiled output, and `test-js/` is tests. Default tests use only fake credentials and mock backends/network; the local native fake-entry round-trip test requires explicitly setting `DEV_NOTIFY_NATIVE_TEST=1`, is enabled only on Windows, uses random IDs, and cleans up afterward.
-The npm publish whitelist contains only `dist/*.js`, README, SECURITY, CHANGELOG, LICENSE, and the required package.json; tests, configuration, and ciphertext are not included. There is no postinstall, auto-start, or self-written download script; prebuilt native dependencies are resolved by npm's platform optional packages, **do not use `--omit=optional`**. macOS x64/arm64 and Windows x64/arm64 prebuilt packages are provided by dependencies; providing packages does not mean this project has completed real-machine acceptance.
+For the current 0.2.2 source, the package whitelist includes only this application's compiled CLI JavaScript, README, SECURITY, CHANGELOG, LICENSE and package.json. Library copies, tests, real configuration, ciphertext and dependency tarballs are excluded. npm resolves runtime dependencies separately. Published package contents depend on the corresponding version. There is no postinstall, auto-start, or self-written download script; prebuilt native dependencies are resolved by npm's platform optional packages, **do not use `--omit=optional`**. macOS x64/arm64 and Windows x64/arm64 prebuilt packages are provided by dependencies; providing packages does not mean this project has completed real-machine acceptance.
+See [CHANGELOG.en.md](CHANGELOG.en.md) for verification results of published versions. The regression record for this 0.2.2 source on Windows x64 with Node 24 is 219 tests: 218 passed, 0 failed, and 1 opt-in native credential test skipped. This record does not describe verification of the published npm package.
+Automated coverage includes temporary hooks, reply/authorization/expiry/anti-replay, single-select/multi-select/custom input, one-time permission JSON, two-sided races, feedback exceptions, and per-recipient duplicate reminder suppression. The actual CLI subprocess completes the loop of background start → PreToolUse registration → PermissionRequest → fake bot button → JSON answer → simulated PostToolUse → final feedback → notification deduplication/subsequent tool reminder → stop; this loop uses mock network and process metadata and cannot replace real-machine input verification. Automated tests for the Windows native input helper class only verify compilation/layout and do not perform a real Send.
-The local verification environment is Windows x64 with Node 24. Automated regression has 203 items: 202 passed, 0 failed, and 1 native credential test requiring explicit enablement was skipped. Coverage includes temporary hooks, reply/authorization/expiry/anti-replay, single-select/multi-select/custom, one-time permission JSON, two-sided races, feedback exceptions, and per-recipient duplicate reminder suppression. The actual CLI subprocess completes the loop of background start → PreToolUse registration → PermissionRequest → fake bot button → JSON answer → simulated PostToolUse → final feedback → notification deduplication/subsequent tool reminder → stop; this loop uses mock network and process metadata and cannot replace real-machine input verification. Separately, the user completed real-machine acceptance on Windows native Claude Code 2.1.316 with real Telegram for local-first, remote-first, multi-select, custom input, competing different answers, and delayed general reminder deduplication. Isolated compilation and tests do not cover the `dist` referenced by real hooks; automated tests for the Windows native input helper class only verify compilation/layout and do not perform a real Send. macOS's two terminal adapters have only simulation verification; macOS real-machine testing, the minimum Node version, version manager switching, tool permission answering on a real machine, and a full public release audit have not yet been accepted.
+Real-machine acceptance is separate from automated results: question-answering acceptance on Windows native Claude Code 2.1.316 with real Telegram covers local-first, remote-first, multi-select, custom input, competing different answers, and delayed general reminder deduplication. Those question-answering tests do not verify terminal input injection for ordinary replies. Both macOS terminal adapters have only simulation verification; macOS real-machine testing, the minimum Node version, version manager switching, and tool permission answering on a real machine have not yet been accepted. This project has not completed a security audit.
-Licensed under MIT, see [LICENSE](LICENSE). Security boundaries are in [SECURITY.en.md](SECURITY.en.md). Version updates must be published separately to npm; pushing to GitHub does not automatically update the npm package.
+Licensed under MIT, see [LICENSE](LICENSE). Security boundaries are in [SECURITY.en.md](SECURITY.en.md). Source changes reach installed users only after a new npm release. Ordinary branch pushes do not publish; matching `v*` version tags trigger the repository's publishing workflow. Maintainers should see the [npm publishing guide](https://github.com/QueCue/dev-notify/blob/main/.github/NPM_PUBLISH.en.md).

package/README.md CHANGED Viewed

@@ -2,9 +2,15 @@
 简体中文 | [English](README.en.md)
-跨平台开发任务通知工具，使用 **TypeScript / Node.js**，通过 npm 分发，不需要独立可执行文件或其他脚本运行时。通用通知不依赖 Claude Code、Unity 或项目目录。
+跨平台开发任务通知工具，使用 **TypeScript / Node.js**，通过 npm 分发，不需要独立可执行文件或其他脚本运行时。通用通知不依赖 Claude Code 或项目目录。
-**npm 包名为 `@quecue/dev-notify`。`0.1.3` 提供 Claude Code 回复、原生 PC 与 Telegram 双端答题及结果反馈。** 版本变更与升级说明见 [CHANGELOG.md](CHANGELOG.md)；公开版本以 npm registry 为准。
+**npm 包名为 `@quecue/dev-notify`，支持通用通知、Claude Code 远程回复，以及本机与 Telegram 双端答题和结果反馈。** 源码仓库：[QueCue/dev-notify](https://github.com/QueCue/dev-notify)。版本变更与升级说明见 [CHANGELOG.md](CHANGELOG.md)；公开版本和发布标签以 npm registry 为准，源码更新不等同于已发布。
+### 0.2.2 源码的通讯层依赖
+当前 0.2.2 源码将 Telegram／飞书通讯层提取为标准 npm 运行时依赖 `@quecue/notify-core`，精确版本为 `0.1.0`，源码见 [QueCue/notify-core](https://github.com/QueCue/notify-core)。此结构不代表已发布的 `0.2.1` 包。
+依赖由 npm 安装，构建只编译本应用，不复制通讯库或链接兄弟仓库源码。npm 用户无需手动安装通讯库。`@quecue/notify-core@0.1.0` 已通过 GitHub Actions 发布，锁文件固定其 registry 来源和 integrity；源码开发使用 `npm ci --ignore-scripts` 还原依赖。
 ## 安装与使用
@@ -13,6 +19,7 @@
 从 npm 安装：
 ```sh
+npm view @quecue/dev-notify dist-tags
 npm install -g @quecue/dev-notify
 dev-notify --version
 dev-notify setup
@@ -20,27 +27,22 @@ dev-notify setup
 也可用环境变量覆盖凭据和接收人：`TELEGRAM_BOT_TOKEN`、`TELEGRAM_CHAT_ID` / `TELEGRAM_CHAT_IDS`、`FEISHU_WEBHOOK`、`FEISHU_SECRET`；路径变量 `DEV_NOTIFY_HOME`、`CLAUDE_CONFIG_DIR`。显式存在的变量优先，空值也会覆盖；完整规则和自定义变量名见下文「路径、模板和环境变量」。
-`0.1.0-alpha.1` 不含 Claude Code hooks；以下回复交互要求 `0.1.0-alpha.3` 或以上。升级后须重新运行 `dev-notify integration claude-code install` 更新完整 hooks，并停止、重新启动已有回复桥接；已有有效授权和通知凭据无需重新配置。使用自定义配置时，继续传入原来的 `--config` 路径。源码开发可在工程目录构建后执行：
+默认安装使用 npm 的 `latest` 标签；`alpha` 是预发行标签，不代表比稳定版更新。可用上面的 `npm view` 命令核对标签，使用 `dev-notify --version` 核对已安装版本。升级说明见 changelog；升级后应更新完整 hooks 并重启已有回复桥接。有效授权和通知凭据无需重新配置，自定义配置继续传入原来的 `--config` 路径。
-```sh
-npm ci --ignore-scripts
-npm run build
-node dist/cli.js setup
-node dist/cli.js doctor
-```
+以下主流程使用 npm 安装的 `dev-notify` 命令；源码构建与 `node dist/cli.js` 用法见「开发与验证」。
 配置完成后发送：
 ```sh
-node dist/cli.js send --title "构建完成" --content "安装包已生成"
-node dist/cli.js send --title "测试结果" --content-file result.txt
-node dist/cli.js send --title "任务输出" --stdin
-node dist/cli.js send --title "分段预览" --content-file result.txt --dry-run
+dev-notify send --title "构建完成" --content "安装包已生成"
+dev-notify send --title "测试结果" --content-file result.txt
+dev-notify send --title "任务输出" --stdin
+dev-notify send --title "分段预览" --content-file result.txt --dry-run
 ```
 若需要本地安装为 `dev-notify` 命令，在构建后运行 `npm install --global .`，之后可执行 `dev-notify setup`、`dev-notify send ...`。这是本地源码安装，不是从公开 registry 安装；本工程不会自动进行全局安装或发布。
-正式包的安装、升级和卸载由 npm 负责。**卸载前建议先清理凭据**：npm 卸载不会自动删除用户凭据。请先交互执行 `dev-notify credentials clear`，再卸载。该命令只删除当前配置引用的 Node 凭据，不会动其他账号、其他配置或旧版原型凭据。
+正式包的安装、升级和卸载由 npm 负责。**卸载前建议先清理凭据**：npm 卸载不会自动删除用户凭据。请先交互执行 `dev-notify credentials clear`，再卸载。该命令只删除当前配置引用的 Node 凭据，不扫描其他配置或删除无关条目，也不处理旧版原型凭据；但共享同一凭据引用的配置副本也会失去该凭据。
 已安装的版本可以用 `update` 升级；它只负责检查版本并调用 npm，不会自己下载或替换文件：
@@ -73,7 +75,7 @@ dev-notify update --no-post # 只更新包，不执行 hooks/桥接维护
 ## 配置向导
 ```sh
-node dist/cli.js setup
+dev-notify setup
 ```
 1. 选择 Telegram、飞书或两者；编辑已有配置时显示当前选择，直接回车保留。
@@ -84,12 +86,12 @@ node dist/cli.js setup
 6. 确认后默认合并安装 Claude Code 通知 hooks（`--no-hooks` 跳过）。已有集成保持原样，不重复添加。
 7. 远程回复授权不在 setup 中询问；Telegram 可用时提示另行运行 `reply setup`，选择具体可信私聊用户并单独确认。
-编辑已有配置不再二次询问是否继续；密钥留空保留已存值，可选签名输入 `-` 清除。没有选中的渠道会被禁用，新条目只保留所选渠道的凭据。环境变量仍然优先（`TELEGRAM_BOT_TOKEN`、`TELEGRAM_CHAT_ID` / `TELEGRAM_CHAT_IDS`、`FEISHU_WEBHOOK`、`FEISHU_SECRET`）；向导会提示哪些变量正在覆盖配置，测试和最终保存也都使用生效后的值。完整列表见「路径、模板和环境变量」。
+编辑已有配置不再二次询问是否继续；密钥留空保留已存值，可选签名输入 `-` 清除。没有选中的渠道会被禁用，新条目只保留所选渠道的凭据。环境变量仍然优先（`TELEGRAM_BOT_TOKEN`、`TELEGRAM_CHAT_ID` / `TELEGRAM_CHAT_IDS`、`FEISHU_WEBHOOK`、`FEISHU_SECRET`）；向导会提示哪些变量正在覆盖配置；测试和后续运行使用环境覆盖后的有效值，但持久保存的是向导输入的凭据与选择的接收人，不会把环境覆盖值自动写回配置或系统凭据。完整列表见「路径、模板和环境变量」。
 自动化使用无密钥模板和 CI secrets：
 ```sh
-node dist/cli.js setup --template --yes
+dev-notify setup --template --yes
 ```
 需要只保存配置、不发送测试或不安装 hooks 时，使用 `setup --no-test` / `setup --no-hooks`（可组合）。模板不会覆盖已有配置。`--yes` 只能配合 `--template` 使用；保存密钥前仍然需要交互确认。
@@ -187,7 +189,7 @@ Node 版使用 **Windows Credential Manager / macOS Keychain**，通过原生 No
 - 原生组件加载失败、存储锁定或拒绝访问时会明确报错，不会降级为明文文件。macOS 可能要求系统授权；离线环境仍可能出现系统提示。
 - 默认不枚举系统条目，只访问当前引用或本次新建的随机条目。
-旧版原型使用 `backend: "system"`，Windows 上是 DPAPI 文件，与 Node Credential Manager 不是同一存储。Node 不会读取或删除它。遇到旧配置时，可以运行 `setup` 重新输入并生成 Node 引用，原凭据保持不变。早期原型的源码、测试和文档已从主分支移除，仍可在 Git 历史中查阅。
+旧版原型使用 `backend: "system"`，Windows 上是 DPAPI 文件，与 Node Credential Manager 不是同一存储。Node 不会读取或删除它。遇到旧配置时，可以运行 `setup` 重新输入并生成 Node 引用，原凭据保持不变。此兼容性限制不影响已使用 `keyring` 引用的配置。
 ## 路径、模板和环境变量
@@ -269,7 +271,7 @@ Node 版使用 **Windows Credential Manager / macOS Keychain**，通过原生 No
 配置写入使用排他 `.setup.lock`，写入前及切换前都会核对原文件。请在向导保存期间避免用编辑器并发修改配置；编辑器不遵守这个锁。断电或强杀可能留下锁或孤立条目，存储和 JSON 也不是跨系统原子事务。确认没有向导运行后，才能处理残留锁；程序不会主动扫描或删除未知条目。
 ```sh
-node dist/cli.js credentials clear
+dev-notify credentials clear
 ```
 清理必须交互确认，先去除当前 JSON 引用，再尝试删除其 Node 条目；环境变量保持不变。共享同一旧引用的配置副本也会受影响，操作前会告知。删除失败会明确警告，不会显示为已清理。
@@ -292,20 +294,32 @@ node dist/cli.js credentials clear
 | 2 | 参数、配置、文件或凭据操作错误 |
 | 130 | 用户取消 |
-向导保存成功后测试通知失败，命令仍以保存成功结束，并明确显示测试失败，两者会清楚区分。保存后取消 hook 配置仍返回 0 并保留渠道；hook 配置出错返回 1，明确提示渠道已保存。集成 `status` 在条目缺失、重复或当前用户级文件禁用 hooks 时返回 1。内部 hook 处理命令始终非阻塞退出，失败通过 stderr 报告。
+向导保存成功后测试通知失败，命令仍以保存成功结束，并明确显示测试失败，两者会清楚区分。保存后取消 hook 配置仍返回 0 并保留渠道；hook 配置出错返回 1，明确提示渠道已保存。集成 `status` 在条目缺失、重复或当前用户级文件禁用 hooks 时返回 1。内部 hook 处理失败通过 stderr 报告，并采用不阻止宿主的退出码；这不代表异步或立即返回，等待远程答案的同步 hook 仍会在约定超时内等待。
 ## 开发与验证
+从 [GitHub 源码仓库](https://github.com/QueCue/dev-notify)克隆后，在仓库目录执行，npm 将按锁文件安装固定版本依赖，无需检出通讯库仓库：
 ```sh
 npm ci --ignore-scripts
+npm run build
+node dist/cli.js setup
+node dist/cli.js doctor
+node dist/cli.js send --title "构建完成" --content "安装包已生成"
 npm test
 npm pack --dry-run
 ```
+其他 CLI 示例中的 `dev-notify` 也可替换为 `node dist/cli.js`，无须全局安装。
 `node-src/` 是 TypeScript 源码，`dist/` 是编译输出，`test-js/` 是测试。默认测试只用假凭据和模拟后端/网络；本机原生假条目往返测试需显式设置 `DEV_NOTIFY_NATIVE_TEST=1`，且只在 Windows 启用，使用随机 ID，结束后清理。
-npm 发布白名单只有 `dist/*.js`、README、SECURITY、CHANGELOG、LICENSE 和必需的 package.json；不包含测试、配置或密文。没有 postinstall、自动启动或自写下载脚本；预编译原生依赖由 npm 的平台 optional 包解析，**请勿使用 `--omit=optional`**。macOS x64/arm64 和 Windows x64/arm64 预编译包由依赖提供，提供包并不等同于本项目已完成实机验收。
+当前 0.2.2 源码的 npm 白名单仅包含本应用 CLI 编译 JS、README、SECURITY、CHANGELOG、LICENSE 和 package.json；不包含通讯库副本、测试、真实配置、密文或依赖 tarball。运行时依赖由 npm 单独解析。已发布版本的包内容以对应版本为准。没有 postinstall、自动启动或自写下载脚本；预编译原生依赖由 npm 的平台 optional 包解析，**请勿使用 `--omit=optional`**。macOS x64/arm64 和 Windows x64/arm64 预编译包由依赖提供，提供包并不等同于本项目已完成实机验收。
+各已发布版本的验证结果见 [CHANGELOG.md](CHANGELOG.md)。当前 0.2.2 源码在 Windows x64、Node 24 下的回归记录为 219 项：218 通过、0 失败、1 项需显式启用的原生凭据测试跳过；该记录不代表已发布 npm 包的验证结果。
+自动化覆盖临时 hooks、回复/授权/过期/防重放、单选/多选/自定义、单次权限 JSON、双端竞争、反馈异常及按接收人的重复提醒去重。实际 CLI 子进程完成后台 start → PreToolUse 登记 → PermissionRequest → 假 Bot 按钮 → JSON 答案 → 模拟 PostToolUse → 最终反馈 → 通知去重/后续工具提醒 → stop；该闭环使用模拟网络和进程元数据，不能替代实机输入验证。Windows 原生输入帮助类的自动化测试只做编译/布局验证，不会执行真实 Send。
-本机验证环境为 Windows x64、Node 24。自动化回归 203 项：202 通过、0 失败、1 项需显式启用的原生凭据测试跳过。覆盖临时 hooks、回复/授权/过期/防重放、单选/多选/自定义、单次权限 JSON、双端竞争、反馈异常及按接收人的重复提醒去重。实际 CLI 子进程完成后台 start → PreToolUse 登记 → PermissionRequest → 假 Bot 按钮 → JSON 答案 → 模拟 PostToolUse → 最终反馈 → 通知去重/后续工具提醒 → stop；该闭环使用模拟网络和进程元数据，不能替代实机输入验证。另由用户在 Windows 原生 Claude Code 2.1.316 与真实 Telegram 完成本机优先、远端优先、多选、自定义、不同答案竞争，以及延迟通用提醒去重的实机验收。隔离编译和测试不会覆盖真实 hooks 引用的 dist；Windows 原生输入帮助类的自动化测试只做编译/布局验证，不会执行真实 Send。macOS 两条终端适配器只有模拟验证；macOS 实机、Node 最低版本、版本管理器切换、工具权限应答实机及完整公开发布审计尚未完成验收。
+实机验收与自动化结果分别记录：Windows 原生 Claude Code 2.1.316 与真实 Telegram 的问答验收覆盖本机优先、远端优先、多选、自定义、不同答案竞争及延迟通用提醒去重；这些问答测试不验证普通回复的终端输入注入。macOS 两条终端适配器只有模拟验证；macOS 实机、Node 最低版本、版本管理器切换及工具权限应答实机尚未完成验收，本项目也尚未完成安全审计。
-采用 MIT，见 [LICENSE](LICENSE)。安全边界见 [SECURITY.md](SECURITY.md)。版本更新需单独发布到 npm，GitHub 推送不会自动更新 npm 安装包。
+采用 MIT，见 [LICENSE](LICENSE)。安全边界见 [SECURITY.md](SECURITY.md)。源码变更只有发布新 npm 版本后才提供给安装用户；普通分支推送不发布，符合版本规则的 `v*` 标签会触发仓库的发布工作流。维护者流程见 [npm 发布说明](https://github.com/QueCue/dev-notify/blob/main/.github/NPM_PUBLISH.md)。

package/SECURITY.en.md CHANGED Viewed

@@ -2,7 +2,13 @@
 English | [简体中文](SECURITY.md)
-The current source is `0.1.3` and the npm package name is `@quecue/dev-notify`; the published version is authoritative on the npm registry, and source updates are not equivalent to a release. This project has not completed a security audit or real-machine acceptance on both platforms.
+The npm package name is `@quecue/dev-notify`, with public source at [QueCue/dev-notify](https://github.com/QueCue/dev-notify). Published versions are authoritative on the npm registry; this document describes the 0.2.2 source, and a source version alone does not establish that an installation package has been published. This project has not completed a security audit or real-machine acceptance on both platforms.
+## Communication dependency in 0.2.2 source
+The current 0.2.2 source uses the standard npm runtime dependency `@quecue/notify-core`, pinned to exactly `0.1.0`, with source at [QueCue/notify-core](https://github.com/QueCue/notify-core). Builds do not embed the library or link sibling source; npm installs it automatically. This does not describe the published `0.2.1` package. The library's `0.1.0` release was published through its own GitHub Actions OIDC identity; the lockfile pins the official registry source and SHA512. Neither provenance nor integrity verification constitutes a security audit.
+Reusing a dependency does not automatically share credentials or authorization, and a bot's `getUpdates` must still have only one consumer. Upgrade dependencies only from trusted sources; tarball integrity checks in the lockfile do not establish source authenticity or constitute a security audit.
 ## Credentials and permissions
@@ -66,13 +72,15 @@ The current source is `0.1.3` and the npm package name is `@quecue/dev-notify`;
 ## npm and testing
 - Runtime has a native credential dependency, with the version and platform optional packages pinned in `package-lock.json`. Keep optional dependencies. There is no postinstall, self-written binary download, or background startup script.
-- The npm whitelist contains only compiled JS, README, SECURITY, CHANGELOG, LICENSE, and package.json. Tests, configuration, logs, and ciphertext do not enter this package.
-- Third-party native packages carry their own licenses and Rust dependency declarations; dependency supply chain and licenses still need review before public release; pinned versions are not equivalent to a completed audit.
+- For the current 0.2.2 source, the npm whitelist includes only this application's compiled CLI JS, README, SECURITY, CHANGELOG, LICENSE and package.json. Library copies, tests, real configuration, logs, ciphertext and dependency tarballs are excluded. Published versions are governed by their actual package contents.
+- Third-party native packages carry their own licenses and Rust dependency declarations. Check the supply chain and licenses for releases and dependency upgrades; pinned versions are not equivalent to a completed audit.
 - Default tests use fake credentials, temporary directories, and mock system backends/network. `DEV_NOTIFY_NATIVE_TEST=1` explicitly enables Windows native tests, creates only fake entries with random IDs for this run, cleans up afterward, and does not read the user's existing entries.
 - npm uninstall does not automatically delete user configuration or credentials. To clean up, first run the interactive cleanup command; uninstall lifecycle scripts will not secretly manipulate the user's system storage.
-## Public release
+## Release security and vulnerability reporting
+The project is public; see [CHANGELOG.en.md](CHANGELOG.en.md) for release history and the npm registry for published versions. Releases and dependency upgrades still require checking the package name, source ownership, and dependency licenses, and checking source, actual npm packages, and Git history for secrets. Once a key leaks, revoke and rotate it; deleting files cannot undo a leak. This project has not completed a security audit.
-Verify the package name, source ownership, and dependency licenses; scan the full directory, the actual npm package, and Git history. Once a key leaks, it must be revoked and rotated; deleting files cannot undo a leak that has already occurred. A private vulnerability reporting channel should be set up before a public release; there is currently no public security contact address.
+There is currently no public security contact email. If GitHub private vulnerability reporting is enabled for the repository, submit privately through its [Security page](https://github.com/QueCue/dev-notify/security). Otherwise, use [Issues](https://github.com/QueCue/dev-notify/issues) only to ask for a private contact method, without publishing vulnerability details, credentials, or sensitive logs.
-Windows x64 / Node 24 has had isolated tests and a real CLI fake-network loop; the Windows native input helper class in automation only does compilation/layout verification and does not inject into real Claude sessions. The user separately completed real-machine acceptance on Claude Code 2.1.316 with real Telegram for PC/remote priority, single-select/multi-select/custom, competing different answers, and duplicate reminder deduplication; that question-answering path does not involve terminal input injection. Tool permission answering on a real machine, macOS terminal input and the system permission flow, other architectures, and the minimum Node version have not been verified, so comprehensive compatibility is not claimed.
+Windows x64 / Node 24 has had isolated tests and a real CLI fake-network loop; the Windows native input helper class in automation only verifies compilation/layout and does not inject into real Claude sessions. Question-answering acceptance on Claude Code 2.1.316 with real Telegram covers local/remote priority, single-select/multi-select/custom input, competing different answers, and duplicate reminder deduplication; that path does not involve terminal input injection. Tool permission answering on a real machine, macOS terminal input and the system permission flow, other architectures, and the minimum Node version have not been verified, so comprehensive compatibility is not claimed.

package/SECURITY.md CHANGED Viewed

@@ -2,7 +2,13 @@
 简体中文 | [English](SECURITY.en.md)
-当前源码为 `0.1.3`，npm 包名为 `@quecue/dev-notify`；发布版本以 npm registry 为准，源码更新不等同于已发布。本项目尚未完成安全审计或双平台实机验收。
+npm 包名为 `@quecue/dev-notify`，公开源码见 [QueCue/dev-notify](https://github.com/QueCue/dev-notify)。发布版本以 npm registry 为准，本文描述 0.2.2 源码，不能仅依据源码版本认定安装包已发布。本项目尚未完成安全审计或双平台实机验收。
+## 0.2.2 源码的通讯层依赖
+当前 0.2.2 源码使用标准 npm 运行时依赖 `@quecue/notify-core`，精确版本 `0.1.0`，源码见 [QueCue/notify-core](https://github.com/QueCue/notify-core)。构建不嵌入通讯库、不链接兄弟仓库源码，npm 自动安装该依赖；这不是已发布 `0.2.1` 的结构说明。通讯库 `0.1.0` 已通过独立 GitHub Actions OIDC 发行，锁文件固定正式 registry 来源和 SHA512；包的 provenance 或完整性校验均不等于安全审计。
+依赖复用不会自动共享凭据或授权，同一个 Bot 的 `getUpdates` 仍只能由一个消费者使用。依赖只从可信来源升级；锁文件的 tarball integrity 校验不等于来源认证或安全审计。
 ## 凭据与权限
@@ -66,13 +72,15 @@
 ## npm 与测试
 - 运行时有原生凭据依赖，版本和平台 optional 包锁定于 `package-lock.json`。请保留 optional 依赖。项目没有 postinstall、自写二进制下载或后台启动脚本。
-- npm 白名单仅包含编译后的 JS、README、SECURITY、CHANGELOG、LICENSE 和 package.json。测试、配置、日志、密文不会进入本包。
-- 第三方原生包带有其许可证与 Rust 依赖声明，公开前仍需审查依赖供应链和许可；固定版本并不等同于完成审计。
+- 当前 0.2.2 源码的 npm 白名单仅包含本应用 CLI 编译 JS、README、SECURITY、CHANGELOG、LICENSE 和 package.json。通讯库副本、测试、真实配置、日志、密文及依赖 tarball 不进入发布包；已发布版本以实际包内容为准。
+- 第三方原生包带有其许可证与 Rust 依赖声明。发布及依赖升级时应核对供应链和许可；固定版本并不等同于完成审计。
 - 默认测试使用假凭据、临时目录和模拟系统后端、网络。`DEV_NOTIFY_NATIVE_TEST=1` 会显式开启 Windows 原生测试，只创建本次随机 ID 的假条目，结束后清理，不读取用户现有条目。
 - npm 卸载不会自动删除用户配置或凭据。需要清理时，请先运行交互清理命令；卸载生命周期脚本不会偷偷操作用户的系统存储。
-## 公开发布
+## 发布安全与漏洞报告
+项目已公开，发布记录见 [CHANGELOG.md](CHANGELOG.md)，公开版本以 npm registry 为准。发布及依赖升级仍需核对包名、源码权属和依赖许可，检查源码、实际 npm 包与 Git 历史是否包含秘密。密钥一旦泄漏，必须撤销并轮换；删除文件无法撤销已经发生的泄漏。本项目尚未完成安全审计。
-核对包名、源码权属、依赖许可；扫描完整目录、实际 npm 包和 Git 历史。密钥一旦泄漏，必须撤销并轮换；删除文件无法撤销已经发生的泄漏。正式公开前应设置私密漏洞报告渠道；当前还没有公开安全联络地址。
+目前没有公开安全联络邮箱。如仓库已启用 GitHub 私密漏洞报告，请通过 [Security 页面](https://github.com/QueCue/dev-notify/security)私密提交；否则可先在 [Issues](https://github.com/QueCue/dev-notify/issues) 中仅询问私密联系方式，不要公开漏洞细节、凭据或敏感日志。
-Windows x64 / Node 24 已做隔离测试及真实 CLI 假网络闭环；自动化中的 Windows 原生输入帮助类只做编译/布局验证，不会向真实 Claude 会话注入。用户另在 Claude Code 2.1.316 与真实 Telegram 完成了 PC/远端优先、单选/多选/自定义、不同答案竞争及重复提醒去重的实机验收；该问答路径不涉及终端输入注入。工具权限应答实机、macOS 终端输入与系统权限流程、其他架构及 Node 最低版本尚未验证，因此不宣称全面兼容。
+Windows x64 / Node 24 已做隔离测试及真实 CLI 假网络闭环；自动化中的 Windows 原生输入帮助类只做编译/布局验证，不会向真实 Claude 会话注入。Claude Code 2.1.316 与真实 Telegram 的问答实机验收覆盖本机/远端优先、单选/多选/自定义、不同答案竞争及重复提醒去重；该问答路径不涉及终端输入注入。工具权限应答实机、macOS 终端输入与系统权限流程、其他架构及 Node 最低版本尚未验证，因此不宣称全面兼容。

package/dist/channels.js CHANGED Viewed

@@ -1,160 +1,13 @@
-import { createHmac } from 'node:crypto';
-import { setTimeout as delay } from 'node:timers/promises';
-import { ConfigError } from './config.js';
+// 兼容原 CLI 的导出与语言设置，通讯实现由公共包唯一维护。
+import { createChannels } from '@quecue/notify-core';
 import { t } from './i18n.js';
-import { escapeHtml, feishuParts, parseMarkdown, partTitle, telegramParts } from './formatting.js';
-export class TransportError extends ConfigError {
-}
-const icons = { info: 'ℹ️', success: '✅', warn: '⚠️', error: '❌' };
-const colors = { info: 'blue', success: 'green', warn: 'yellow', error: 'red' };
-const bytes = (data) => Buffer.byteLength(JSON.stringify(data), 'utf8');
-export async function requestJson(url, payload, fetcher = fetch) {
-    try {
-        const response = await fetcher(url, { method: 'POST', body: JSON.stringify(payload),
-            headers: { 'Content-Type': 'application/json' }, redirect: 'error', signal: AbortSignal.timeout(10000) });
-        if (!response.body)
-            throw new TransportError(t('channels.noResponse'));
-        const reader = response.body.getReader();
-        const chunks = [];
-        let size = 0;
-        try {
-            while (true) {
-                const { done, value } = await reader.read();
-                if (done)
-                    break;
-                size += value.byteLength;
-                if (size > 1024 * 1024) {
-                    await reader.cancel();
-                    throw new TransportError(t('channels.responseTooLarge'));
-                }
-                chunks.push(value);
-            }
-        }
-        finally {
-            reader.releaseLock();
-        }
-        const result = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
-        if (!result || typeof result !== 'object' || Array.isArray(result))
-            throw new TransportError(t('channels.notJsonObject'));
-        return result;
-    }
-    catch (error) {
-        if (error instanceof TransportError)
-            throw error;
-        throw new TransportError(t('channels.network'));
-    }
-}
-function text(title, content, footer, icon, html) {
-    const sections = [`${icon} ${html ? `<b>${escapeHtml(title)}</b>` : title}`];
-    if (content)
-        sections.push(content);
-    if (footer)
-        sections.push('────────\n' + (html ? `<i>${escapeHtml(footer)}</i>` : footer));
-    return sections.join('\n\n');
-}
-function card(message, title, content) {
-    const elements = [];
-    if (content)
-        elements.push({ tag: 'markdown', content });
-    if (message.footer)
-        elements.push({ tag: 'hr' }, { tag: 'note', elements: [{ tag: 'plain_text', content: message.footer }] });
-    if (message.reply?.url)
-        elements.push({ tag: 'action', actions: [{ tag: 'button', text: { tag: 'plain_text', content: t('channels.feishuReplyButton') }, url: message.reply.url, type: 'primary' }] });
-    return { msg_type: 'interactive', card: { config: { wide_screen_mode: true },
-            header: { template: colors[message.level], title: { tag: 'plain_text', content: title } }, elements } };
-}
+export { TransportError } from '@quecue/notify-core';
+const channels = createChannels(key => t(key));
+export const requestJson = channels.requestJson;
+export const deliver = channels.deliver;
 export function makePlan(channel, message, config) {
-    if (!message.title.trim())
-        throw new Error(t('channels.emptyTitle'));
-    const blocks = parseMarkdown(message.content);
-    if (channel === 'telegram') {
-        const icon = icons[message.level];
-        const reserve = String(Math.max(1, message.content.length)).length * 2 + 16;
-        const budget = 3900 - text(message.title, '', message.footer, icon, false).length - reserve;
-        const chunks = telegramParts(blocks, budget);
-        const items = [];
-        for (const chatId of config.telegram.chatIds)
-            chunks.forEach((chunk, index) => {
-                const title = partTitle(message.title, index, chunks.length);
-                const plain = text(title, chunk.plain, message.footer, icon, false);
-                if (plain.length > 4096)
-                    throw new Error(t('channels.telegramTooLong'));
-                items.push({ recipient: chatId, plain, payload: { chat_id: chatId,
-                        text: text(title, chunk.html, message.footer, icon, true), parse_mode: 'HTML', disable_web_page_preview: true,
-                        ...(message.reply?.users.includes(chatId) ? { reply_markup: { inline_keyboard: [[{ text: t('channels.telegramReplyButton'), callback_data: 'dn:r:' + message.reply.token }]] } } : {}) } });
-            });
-        return { channel, items, recipients: config.telegram.chatIds.length };
-    }
-    const budget = Math.min(10000, Math.floor((28000 - bytes(card(message, message.title, '')) - 512) / 6));
-    const chunks = feishuParts(blocks, budget);
-    const items = chunks.map((chunk, index) => {
-        const payload = card(message, partTitle(message.title, index, chunks.length), chunk);
-        if (bytes(payload) + 128 > 28000)
-            throw new Error(t('channels.feishuTooLong'));
-        return { recipient: 'feishu', payload };
-    });
-    return { channel, items, recipients: 1 };
-}
-export async function deliver(plan, config, request = requestJson, sleep = delay) {
-    let sent = 0, error;
-    const failed = new Set();
-    const telegram = plan.channel === 'telegram';
-    const url = telegram ? `https://api.telegram.org/bot${config.telegram.token}/sendMessage` : config.feishu.webhook;
-    const post = async (payload) => {
-        if (!telegram && config.feishu.secret) {
-            const timestamp = String(Math.floor(Date.now() / 1000));
-            payload.timestamp = timestamp;
-            payload.sign = createHmac('sha256', `${timestamp}\n${config.feishu.secret}`).update('').digest('base64');
-        }
-        let response = await request(url, payload);
-        if (telegram && response.error_code === 429) {
-            const wait = response.parameters?.retry_after;
-            if (typeof wait === 'number' && Number.isFinite(wait) && wait > 0 && wait <= 60) {
-                await sleep(wait * 1000);
-                response = await request(url, payload);
-            }
-        }
-        return response;
-    };
-    for (let index = 0; index < plan.items.length; index++) {
-        const item = plan.items[index];
-        if (failed.has(item.recipient))
-            continue;
-        const payload = structuredClone(item.payload);
-        try {
-            let response = await post(payload);
-            if (telegram && response.ok !== true && /parse|entit/i.test(String(response.description ?? ''))) {
-                delete payload.parse_mode;
-                payload.text = item.plain;
-                response = await post(payload);
-            }
-            else if (!telegram && response.code !== 0) {
-                let changed = false;
-                payload.card.elements = payload.card.elements.map((element) => {
-                    if (element.tag !== 'markdown')
-                        return element;
-                    changed = true;
-                    return { tag: 'div', text: { tag: 'lark_md', content: element.content } };
-                });
-                if (changed)
-                    response = await post(payload);
-            }
-            if (telegram ? response.ok === true : response.code === 0) {
-                sent++;
-                if (plan.onSent)
-                    await plan.onSent(item, response);
-            }
-            else {
-                failed.add(item.recipient);
-                error = t('channels.rejected');
-            }
-        }
-        catch (cause) {
-            failed.add(item.recipient);
-            error = cause instanceof TransportError ? cause.message : t('channels.sendFailed');
-        }
-        if (!telegram && !failed.has(item.recipient) && index + 1 < plan.items.length)
-            await sleep(250);
-    }
-    return { channel: plan.channel, sent, planned: plan.items.length, ok: sent > 0 && sent === plan.items.length && !error, error };
+    // 开发会话的按钮前缀属于业务协议，不写死在通用通讯包中。
+    return channels.makePlan(channel, message.reply ? {
+        ...message, reply: { ...message.reply, callbackData: message.reply.callbackData ?? 'dn:r:' + message.reply.token }
+    } : message, config);
 }

package/dist/cli.js CHANGED Viewed

@@ -16,7 +16,7 @@ import { startBridge, stopBridge, bridgeStatus, runBridge } from './reply-bridge
 import { updatePackage } from './update.js';
 import { postUpdate } from './maintenance.js';
 import { localeName, parseLocale, resolveLocale, setLocale, t } from './i18n.js';
-export const VERSION = '0.2.0';
+export const VERSION = '0.2.2';
 const helpText = () => t('cli.help', { version: VERSION });
 function rawLang(argv) {
     for (let i = 0; i < argv.length; i++) {
@@ -191,7 +191,7 @@ export async function main(argv = process.argv.slice(2), overrides = {}) {
                 return access && status.ready ? 0 : 1;
             }
             if (action === 'run') {
-                await runBridge(file, { env: context.env, log: context.err });
+                await runBridge(file, { env: context.env, lang: values.lang, log: context.err });
                 return 0;
             }
             const ready = await startBridge(file, context.env);

package/dist/config.js CHANGED Viewed

@@ -3,8 +3,8 @@ import { homedir } from 'node:os';
 import path from 'node:path';
 import { resolveReference } from './credentials.js';
 import { getLocale, t } from './i18n.js';
-export class ConfigError extends Error {
-}
+import { NotifyError as ConfigError } from '@quecue/notify-core';
+export { ConfigError };
 export const example = {
     version: 1,
     language: 'zh',

package/dist/formatting.js CHANGED Viewed

@@ -1,212 +1,5 @@
-// 先解析为独立文本块，再在渲染后的可见文本上分段，不切断 HTML 实体或标签。
+// 保留原有导出入口；格式化与分段算法由 notify-core 维护。
+import { createFormatting } from '@quecue/notify-core';
 import { t } from './i18n.js';
-export const escapeHtml = (text) => text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
-export const partTitle = (title, index, total) => total > 1 ? `${title} (${index + 1}/${total})` : title;
-function inline(text, tags = [], depth = 0) {
-    if (depth > 8)
-        return [{ text, tags }];
-    // 不在生成的 HTML 上执行 Markdown 正则，避免修改链接属性。
-    const expression = /`([^`\n]+)`|\[([^\]\n]+)\]\((https?:\/\/[^\s)]+)\)|\*\*(\S(?:.*?\S)?)\*\*|__(\S(?:.*?\S)?)__|~~(\S(?:.*?\S)?)~~|(?<![\w*])\*([^*\n]+)\*(?![\w*])|(?<![\w_])_([^_\n]+)_(?![\w_])/g;
-    const spans = [];
-    let cursor = 0;
-    for (const match of text.matchAll(expression)) {
-        if (match.index > cursor)
-            spans.push({ text: text.slice(cursor, match.index), tags });
-        if (match[1] !== undefined)
-            spans.push({ text: match[1], tags: [...tags, 'code'] });
-        else if (match[2] !== undefined) {
-            // 链接地址同样保留在可见文本中；任何纯文本回退都不会丢失地址。
-            spans.push(...inline(match[2], tags, depth + 1), { text: ` (${match[3]})`, tags });
-        }
-        else {
-            const content = match[4] ?? match[5] ?? match[6] ?? match[7] ?? match[8];
-            const tag = match[4] !== undefined || match[5] !== undefined ? 'b' : match[6] !== undefined ? 's' : 'i';
-            spans.push(...inline(content, [...tags, tag], depth + 1));
-        }
-        cursor = match.index + match[0].length;
-    }
-    if (cursor < text.length)
-        spans.push({ text: text.slice(cursor), tags });
-    return spans.length ? spans : [{ text: '', tags }];
-}
-function cells(line) {
-    return line.trim().replace(/^\|/, '').replace(/\|$/, '').split('|').map(cell => inline(cell.trim()).map(s => s.text).join(''));
-}
-function separator(line) {
-    return line.includes('|') && line.trim().replace(/^\|/, '').replace(/\|$/, '').split('|').every(cell => /^:?-{3,}:?$/.test(cell.trim()));
-}
-function width(text) {
-    let size = 0;
-    for (const ch of text) {
-        const code = ch.codePointAt(0);
-        size += code >= 0x1100 && (code <= 0x115f || code >= 0x2e80 && code <= 0xa4cf || code >= 0xac00 && code <= 0xd7af || code >= 0xff01 && code <= 0xff60 || code >= 0x1f300) ? 2 : 1;
-    }
-    return size;
-}
-function table(lines) {
-    const rows = lines.filter((_, index) => index !== 1).map(cells);
-    const count = Math.max(...rows.map(row => row.length));
-    const widths = Array.from({ length: count }, (_, col) => Math.max(3, ...rows.map(row => width(row[col] ?? ''))));
-    const output = [];
-    rows.forEach((row, index) => {
-        output.push(widths.map((size, col) => (row[col] ?? '') + ' '.repeat(size - width(row[col] ?? ''))).join(' | '));
-        if (!index)
-            output.push(widths.map(size => '-'.repeat(size)).join('-+-'));
-    });
-    return output.join('\n');
-}
-export function parseMarkdown(content) {
-    const lines = content.replace(/\r\n?/g, '\n').replace(/\0/g, '').split('\n');
-    const blocks = [];
-    let index = 0;
-    while (index < lines.length) {
-        const line = lines[index];
-        const fence = /^\s*(`{3,}|~{3,})(.*)$/.exec(line);
-        if (fence) {
-            const marker = fence[1][0];
-            const closing = new RegExp(`^\\s*${marker === '`' ? '`' : '~'}{${fence[1].length},}\\s*$`);
-            const body = [];
-            index++;
-            while (index < lines.length && !closing.test(lines[index]))
-                body.push(lines[index++]);
-            if (index < lines.length)
-                index++;
-            blocks.push({ spans: [{ text: body.join('\n'), tags: [] }], code: true });
-            continue;
-        }
-        if (index + 1 < lines.length && line.includes('|') && separator(lines[index + 1])) {
-            const rows = [line, lines[index + 1]];
-            index += 2;
-            while (index < lines.length && lines[index].trim() && lines[index].includes('|'))
-                rows.push(lines[index++]);
-            blocks.push({ spans: [{ text: table(rows), tags: [] }], code: true });
-            continue;
-        }
-        const heading = /^\s{0,3}#{1,6}\s+(.*)$/.exec(line);
-        const quote = /^\s*>\s?(.*)$/.exec(line);
-        const list = /^(\s*)[-*+]\s+(.*)$/.exec(line);
-        let spans;
-        if (heading)
-            spans = inline(heading[1], ['b']);
-        else if (/^\s*([-*_])(?:\s*\1){2,}\s*$/.test(line))
-            spans = [{ text: '────────', tags: [] }];
-        else if (quote)
-            spans = inline(quote[1], ['blockquote']);
-        else if (list)
-            spans = inline(`${list[1]}• ${list[2].replace(/^\[ \] /, '☐ ').replace(/^\[x\] /i, '☑ ')}`);
-        else
-            spans = inline(line);
-        blocks.push({ spans, code: false });
-        index++;
-    }
-    return blocks;
-}
-export function visibleText(blocks) {
-    return blocks.map(block => block.spans.map(span => span.text).join('')).join('\n');
-}
-function cut(text, budget, measure) {
-    if (budget < 1)
-        throw new Error(t('format.noSpace'));
-    let used = 0, end = 0;
-    for (const ch of text) {
-        const size = measure(ch);
-        if (used + size > budget)
-            break;
-        used += size;
-        end += ch.length;
-    }
-    if (!end && text)
-        throw new Error(t('format.oneChar'));
-    if (end < text.length) {
-        for (const boundary of ['\n\n', '\n', ' ']) {
-            const offset = text.slice(0, end).lastIndexOf(boundary);
-            if (offset >= end / 2) {
-                end = offset + boundary.length;
-                break;
-            }
-        }
-    }
-    return [text.slice(0, end), text.slice(end)];
-}
-export function telegramParts(blocks, budget) {
-    if (budget < 2)
-        throw new Error(t('format.telegramHeader'));
-    const output = [];
-    let html = '', plain = '';
-    const flush = () => { if (plain)
-        output.push({ html, plain }); html = ''; plain = ''; };
-    blocks.forEach((block, index) => {
-        const spans = index ? [{ text: '\n', tags: [] }, ...block.spans] : block.spans;
-        for (const span of spans) {
-            let rest = span.text;
-            while (rest) {
-                if (budget - plain.length < [...rest][0].length)
-                    flush();
-                const [piece, remaining] = cut(rest, budget - plain.length, text => text.length);
-                // 块间换行不包裹为代码，其余内容每片均使用完整标签。
-                const actualTags = block.code && !(index && span === spans[0]) ? ['pre'] : span.tags;
-                html += actualTags.map(tag => `<${tag}>`).join('') + escapeHtml(piece) + [...actualTags].reverse().map(tag => `</${tag}>`).join('');
-                plain += piece;
-                rest = remaining;
-                if (rest)
-                    flush();
-            }
-        }
-    });
-    flush();
-    return output.length ? output : [{ html: '', plain: '' }];
-}
-export function feishuParts(blocks, budget) {
-    if (budget < 128)
-        throw new Error(t('format.feishuHeader'));
-    const output = [];
-    let current = '';
-    const size = (text) => Buffer.byteLength(text, 'utf8');
-    const flush = () => { if (current)
-        output.push(current); current = ''; };
-    blocks.forEach((block, index) => {
-        if (index) {
-            if (size(current) + 1 > budget)
-                flush();
-            current += '\n';
-        }
-        for (const span of block.spans) {
-            let rest = span.text;
-            let prefix = '', suffix = '';
-            if (block.code) {
-                const runs = rest.match(/`+/g) ?? [];
-                const marker = '`'.repeat(Math.max(3, ...runs.map(run => run.length + 1)));
-                prefix = marker + 'text\n';
-                suffix = '\n' + marker;
-                // 极端围栏长度下保留字面正文，不无限增大包装。
-                if (size(prefix + suffix) > budget / 2) {
-                    prefix = '';
-                    suffix = '';
-                }
-            }
-            else {
-                for (const tag of span.tags) {
-                    const wrapper = tag === 'b' ? '**' : tag === 'i' ? '*' : tag === 's' ? '~~' : tag === 'code' ? '`' : '';
-                    if (tag === 'blockquote')
-                        prefix += '▎ ';
-                    else {
-                        prefix += wrapper;
-                        suffix = wrapper + suffix;
-                    }
-                }
-            }
-            while (rest) {
-                const overhead = size(prefix + suffix);
-                if (size(current) + overhead + size([...rest][0]) > budget)
-                    flush();
-                const [piece, remaining] = cut(rest, budget - size(current) - overhead, size);
-                current += prefix + piece + suffix;
-                rest = remaining;
-                if (rest)
-                    flush();
-            }
-        }
-    });
-    flush();
-    return output.length ? output : [''];
-}
+export { escapeHtml, partTitle } from '@quecue/notify-core';
+export const { parseMarkdown, visibleText, telegramParts, feishuParts } = createFormatting(key => t(key));

package/dist/reply-bridge.js CHANGED Viewed

@@ -4,8 +4,8 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { setTimeout as delay } from 'node:timers/promises';
-import { appPaths, ConfigError } from './config.js';
-import { t } from './i18n.js';
+import { appPaths, ConfigError, readConfigLanguage } from './config.js';
+import { resolveLocale, setLocale, t } from './i18n.js';
 import { accessReplies, atomicJson, readJson, replyDirectory, stateTransaction } from './reply-state.js';
 import { telegramApi } from './reply-telegram.js';
 import { drainReplies, processUpdate } from './reply-engine.js';
@@ -118,6 +118,8 @@ export async function runBridge(file, options = {}) {
         await atomicJson(leasePath(file), lease);
         let iteration = 0, failures = 0;
         while (!await isStopped() && iteration++ < (options.maxIterations ?? Infinity)) {
+            // 桥接是长驻进程，语言切换后要跟着配置文件走；否则后续消息会和 hook 进程的语言不一致。
+            setLocale(resolveLocale(options.lang, env, await readConfigLanguage(file)));
             const current = await fresh();
             if (!current)
                 break;

package/dist/reply-state.js CHANGED Viewed

@@ -24,6 +24,21 @@ export async function readJson(file) {
         throw new ConfigError(t('reply.readFailed'));
     }
 }
+// Windows 防病毒/索引程序可能短暂占用目标文件；只重试原子替换，不重做状态事务或业务操作。
+export async function replaceStateFile(source, target, replace = rename, sleep = delay) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            await replace(source, target);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (!['EPERM', 'EACCES', 'EBUSY'].includes(code ?? '') || attempt >= 5)
+                throw error;
+            await sleep(10 * 2 ** attempt);
+        }
+    }
+}
 export async function atomicJson(file, value) {
     await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
     const temporary = path.join(path.dirname(file), `.reply-${randomBytes(12).toString('hex')}.tmp`);
@@ -36,7 +51,7 @@ export async function atomicJson(file, value) {
         finally {
             await handle.close();
         }
-        await rename(temporary, file);
+        await replaceStateFile(temporary, file);
     }
     finally {
         await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')

package/dist/reply-telegram.js CHANGED Viewed

@@ -1,17 +1,23 @@
+import { createTelegramApi, TelegramApiError } from '@quecue/notify-core';
 import { requestJson } from './channels.js';
 import { ConfigError } from './config.js';
 import { t } from './i18n.js';
 export function telegramApi(token, request = requestJson) {
+    const call = createTelegramApi(token, { request });
     return async (method, payload) => {
         if (!['sendMessage', 'editMessageReplyMarkup', 'answerCallbackQuery', 'getMe', 'getUpdates', 'getWebhookInfo'].includes(method))
             throw new ConfigError(t('reply.telegramMethod'));
-        const response = await request(`https://api.telegram.org/bot${token}/${method}`, payload);
-        if (response.ok !== true) {
-            if (response.error_code === 409)
-                throw new ConfigError(t('reply.telegramConflict'));
-            throw new ConfigError(t('reply.telegramRequestFailed'));
+        try {
+            return await call(method, payload);
+        }
+        catch (error) {
+            if (error instanceof TelegramApiError) {
+                if (error.code === 409)
+                    throw new ConfigError(t('reply.telegramConflict'));
+                throw new ConfigError(t('reply.telegramRequestFailed'));
+            }
+            throw error;
         }
-        return response.result;
     };
 }
 export async function replyHint(api, chat, title, content, replyTo, markup) {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@quecue/dev-notify",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "跨平台开发任务通知工具，支持 Telegram 与飞书",
   "license": "MIT",
   "repository": {
@@ -29,7 +29,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "node scripts/build.mjs",
     "test": "npm run build && node --test test-js/*.test.mjs",
     "start": "node dist/cli.js",
     "prepack": "npm run build"
@@ -39,7 +39,8 @@
     "typescript": "^5.9.0"
   },
   "dependencies": {
-    "@napi-rs/keyring": "2.1.2"
+    "@napi-rs/keyring": "2.1.2",
+    "@quecue/notify-core": "0.1.0"
   },
   "publishConfig": {
     "access": "public",