@rezti/dsh-rez-suite 0.1.45 → 0.1.46

package/src/changelog.ts

@@ -0,0 +1,85 @@
+/**
+ * User-facing suite notes. Keep in sync with CHANGELOG.md (npm / git).
+ * The settings tab renders this; do not put release copy only in markdown.
+ */
+
+export interface ChangelogCopy {
+  zh: string
+  en: string
+}
+
+export interface ChangelogSection {
+  title: ChangelogCopy
+  items: ChangelogCopy[]
+}
+
+export interface ChangelogRelease {
+  version: string
+  date: string
+  sections: ChangelogSection[]
+}
+
+export const SUITE_CHANGELOG: readonly ChangelogRelease[] = [
+  {
+    version: '0.1.46',
+    date: '2026-08-19',
+    sections: [
+      {
+        title: { zh: '员工会碰到的', en: 'What you will see' },
+        items: [
+          {
+            zh: '回形针上传 PDF：说明书 / 规格书走输入栏回形针，先入 Marketing/Inbox，对应 TAPD 改成测试中并转凯文；凯文说审批了哪份，再进 Marketing/Publish。不要用微信发 PDF。',
+            en: 'Paperclip PDF uploads: manuals go to Marketing/Inbox first. TAPD moves to 测试中 and Kelvin; after he names the file, it lands in Marketing/Publish. Do not send PDFs over WeChat.',
+          },
+          {
+            zh: '运营多了「设计」房间：拍摄原片 Comfy 只修一次，shot / clean 先入 Inbox；凯文终审后同时写入 Marketing/RAW。',
+            en: 'Operations gets a Design room. Retouch shots once in Comfy; shot/clean stay in Inbox until Kelvin dual-saves them to Marketing/RAW.',
+          },
+          {
+            zh: '品牌 / VI 走 Marketing/Inbox/Brand/，终审后写入 Marketing/RAW/Brand/，不要写进某个 SKU。',
+            en: 'Brand / VI files go Marketing/Inbox/Brand/, then Marketing/RAW/Brand/ after approval — not into a SKU folder.',
+          },
+          {
+            zh: '工程师多了「实验室」：对话里给 YAML，立刻拿到下载链接。还在编是说明文件；成功是 firmware.bin；失败是带日志的 README。不要在对话里等 bin，不要默认 OTA。',
+            en: 'Engineers get a Lab room. Submit YAML and get a download link immediately. Compiling shows a README; success is firmware.bin; failure includes the log. Do not wait for the bin in chat. Do not OTA by default.',
+          },
+          {
+            zh: '人事助理可引导新人领本机安装包、自己申请 API Key。',
+            en: 'HR assistant can walk new staff through the desktop installer and API key request.',
+          },
+          {
+            zh: '设置页暂时不显示企业微信配置栏（已填过的 webhook 不会被擦掉）。',
+            en: 'WeCom settings are hidden for now. An existing webhook is left as-is.',
+          },
+          {
+            zh: '运营仍可改 TAPD 状态、写评论、往 Inbox 传文件；不能删 TAPD / Nextcloud。',
+            en: 'Operations can still update TAPD and write Inbox files, but cannot delete TAPD or Nextcloud items.',
+          },
+        ],
+      },
+      {
+        title: { zh: '安装与审批机', en: 'Installers and approver machines' },
+        items: [
+          {
+            zh: '员工 Mac zip / Windows exe、审批人 Docker：每次启动拉钉死的 0.1.46，不要 latest。',
+            en: 'Staff Mac zip / Windows exe and approver Docker pin suite 0.1.46. Do not use latest.',
+          },
+          {
+            zh: '安装包只是启动壳，第一次会从外网拉 Node 和 dsh。',
+            en: 'The zip/exe is a launcher. The first run downloads Node and dsh.',
+          },
+          {
+            zh: '回形针依赖还在 GitHub。装 suite 要能访问 GitHub；公司机禁外网会失败。',
+            en: 'The paperclip plugin still comes from GitHub. Installing suite needs GitHub access.',
+          },
+        ],
+      },
+    ],
+  },
+]
+
+export function latestSuiteChangelog(): ChangelogRelease {
+  const latest = SUITE_CHANGELOG[0]
+  if (latest === undefined) throw new Error('SUITE_CHANGELOG is empty')
+  return latest
+}

package/src/client/locales.ts

@@ -6,15 +6,16 @@ export const zh = {
   'entry.label': 'Rez',
   'entry.tooltip': 'Rez Suite 配置与审计面板',
   'settings.title': 'ReZ-TI',
-  'settings.description': '公司 MCP（Odoo / Nextcloud / 企微 / HA / TAPD / GSC）与个人微信扫码通道。',
+  'settings.description': '公司 MCP（Odoo / Nextcloud / HA / TAPD / GSC）。企业微信栏暂隐。个人微信在「微信」页签扫码。',
   'panel.title': 'Rez Suite',
   'tab.config': '配置',
   'tab.weixin': '微信',
   'tab.status': '状态',
   'tab.audit': '用量',
+  'tab.changelog': '更新日志',
   // config
   'config.role': '角色',
-  'config.roleHint': '选身份后左侧自动出现工作区。人事/财务/法务助理全员可见；搞钱/产品/运营仅「老板」。',
+  'config.roleHint': '选身份后左侧自动出现工作区。人事/财务/法务助理全员可见；设计房间仅「运营」；实验室仅「工程师」；搞钱/产品/运营仅「老板」。',
   'role.all': '全部',
   'role.boss': '老板',
   'role.engineer': '工程师',
@@ -58,6 +59,9 @@ export const zh = {
   'config.tianyancha': '天眼查（法务助理 · 仅老板）',
   'config.tianyancha.url': '天眼查 MCP URL',
   'config.tianyancha.token': 'OpenAPI Token',
+  'config.esphome': 'ESPHome 实验室',
+  'config.esphome.url': 'MCP URL',
+  'config.esphome.token': '实验室 Token',
   'config.fs': '本地文件 (fs-mcp-server)',
   'config.fs.root': '根目录',
   'config.sqlite': 'SQLite (sqlite-mcp-server)',
@@ -102,6 +106,8 @@ export const zh = {
   'audit.reset': '清空账本',
   'audit.resetConfirm': '确定清空全部用量记录吗？',
   'audit.empty': '暂无记录',
+  'changelog.current': '当前 {version}',
+  'changelog.upgrade': '升级：',
   // common
   'common.close': '关闭',
   'common.loading': '加载中…',
@@ -136,14 +142,15 @@ export const en: Record<RezKey, string> = {
   'entry.label': 'Rez',
   'entry.tooltip': 'Rez Suite configuration and audit panel',
   'settings.title': 'ReZ-TI',
-  'settings.description': 'Company MCP (Odoo / Nextcloud / WeCom / HA / TAPD / GSC) and personal WeChat scan-and-chat.',
+  'settings.description': 'Company MCP (Odoo / Nextcloud / HA / TAPD / GSC). WeCom settings are hidden for now. Personal WeChat is the WeChat tab.',
   'panel.title': 'Rez Suite',
   'tab.config': 'Config',
   'tab.weixin': 'WeChat',
   'tab.status': 'Status',
   'tab.audit': 'Usage',
+  'tab.changelog': 'Changelog',
   'config.role': 'Role',
-  'config.roleHint': 'Identity registers workspaces in the sidebar. Staff assistants for every role; 搞钱 / 产品 / 运营 for Boss only.',
+  'config.roleHint': 'Identity registers workspaces in the sidebar. Staff assistants for every role; 设计 for Operations only; 实验室 for Engineer only; 搞钱 / 产品 / 运营 for Boss only.',
   'role.all': 'All',
   'role.boss': 'Boss',
   'role.engineer': 'Engineer',
@@ -187,6 +194,9 @@ export const en: Record<RezKey, string> = {
   'config.tianyancha': 'Tianyancha (Legal assistant, boss only)',
   'config.tianyancha.url': 'Tianyancha MCP URL',
   'config.tianyancha.token': 'OpenAPI token',
+  'config.esphome': 'ESPHome lab',
+  'config.esphome.url': 'MCP URL',
+  'config.esphome.token': 'Lab token',
   'config.fs': 'Local files (fs-mcp-server)',
   'config.fs.root': 'Root directory',
   'config.sqlite': 'SQLite (sqlite-mcp-server)',
@@ -229,6 +239,8 @@ export const en: Record<RezKey, string> = {
   'audit.reset': 'Clear ledger',
   'audit.resetConfirm': 'Clear all usage records?',
   'audit.empty': 'No records',
+  'changelog.current': 'Now {version}',
+  'changelog.upgrade': 'Upgrade:',
   'common.close': 'Close',
   'common.loading': 'Loading…',
   'common.error': 'Error: {error}',

package/src/client/panel/ChangelogTab.tsx

@@ -0,0 +1,57 @@
+/**
+ * Settings tab: what this suite version changed. Copy lives in src/changelog.ts.
+ */
+
+import { useEffect, useState } from 'react'
+import type { RezApi } from '../api.ts'
+import { SUITE_CHANGELOG, latestSuiteChangelog } from '../../changelog.ts'
+import { zh } from '../locales.ts'
+import { useT } from './helpers.ts'
+import css from './panel.module.css'
+
+export function ChangelogTab({ api }: { api: RezApi }) {
+  const t = useT()
+  const lang = t('tab.config') === zh['tab.config'] ? 'zh' : 'en'
+  const latest = latestSuiteChangelog()
+  const [installed, setInstalled] = useState('')
+
+  useEffect(() => {
+    let cancelled = false
+    void api.updateStatus().then((status) => {
+      if (!cancelled) setInstalled(status.installed)
+    }).catch(() => {
+      if (!cancelled) setInstalled(latest.version)
+    })
+    return () => { cancelled = true }
+  }, [api, latest.version])
+
+  return (
+    <div className={css.tabBody}>
+      <p className={css.message}>
+        {t('changelog.current', { version: installed || latest.version })}
+        {' · '}
+        {t('changelog.upgrade')}
+        {' '}
+        <code className={css.changelogCode}>dsh plugin --profile web add @rezti/dsh-rez-suite@{latest.version}</code>
+      </p>
+      {SUITE_CHANGELOG.map((release) => (
+        <section key={release.version} className={css.section}>
+          <h3 className={css.sectionTitle}>
+            {release.version}
+            <span className={css.changelogDate}>{release.date}</span>
+          </h3>
+          {release.sections.map((section) => (
+            <div key={section.title[lang]} className={css.changelogBlock}>
+              <div className={css.changelogHeading}>{section.title[lang]}</div>
+              <ul className={css.changelogList}>
+                {section.items.map((item) => (
+                  <li key={item[lang]}>{item[lang]}</li>
+                ))}
+              </ul>
+            </div>
+          ))}
+        </section>
+      ))}
+    </div>
+  )
+}

package/src/client/panel/ConfigTab.tsx

@@ -26,9 +26,10 @@ type SecretDrafts = {
   gsc: string
   qcc: string
   tianyancha: string
+  esphome: string
 }
 
-const EMPTY_SECRETS: SecretDrafts = { odoo: '', nextcloud: '', wechat: '', homeassistant: '', tapd: '', gsc: '', qcc: '', tianyancha: '' }
+const EMPTY_SECRETS: SecretDrafts = { odoo: '', nextcloud: '', wechat: '', homeassistant: '', tapd: '', gsc: '', qcc: '', tianyancha: '', esphome: '' }
 
 function Field({ label, children }: { label: string; children: ReactNode }) {
   return (
@@ -177,6 +178,7 @@ export function ConfigTab({ api }: { api: RezApi }) {
           gsc: { ...config.connections.gsc, secret: secrets.gsc || undefined },
           qcc: { ...config.connections.qcc, secret: secrets.qcc || undefined },
           tianyancha: { ...config.connections.tianyancha, secret: secrets.tianyancha || undefined },
+          esphome: { ...config.connections.esphome, secret: secrets.esphome || undefined },
         },
       }
       const saved = await api.saveConfig(payload)
@@ -249,14 +251,7 @@ export function ConfigTab({ api }: { api: RezApi }) {
         usernameLabel={t('config.nextcloud.username')}
         secretLabel={t('config.nextcloud.appPassword')}
       />
-      <McpSection
-        title={t('config.wecom')}
-        row={config.connections.wechat}
-        secret={secrets.wechat}
-        onEnabled={enabled => { patchConnection('wechat', { enabled }) }}
-        onSecret={value => { setSecrets(prev => ({ ...prev, wechat: value })) }}
-        secretLabel={t('config.wecom.webhook')}
-      />
+      {/* WeCom (企业微信) 设置栏暂隐：安装用法未定，TAPD 1154488930001001224。保存时仍回写已有 wechat 配置，不擦掉。 */}
       <McpSection
         title={t('config.ha')}
         row={config.connections.homeassistant}
@@ -320,6 +315,18 @@ export function ConfigTab({ api }: { api: RezApi }) {
           secretLabel={t('config.tianyancha.token')}
         />
       )}
+      {(config.role === 'engineer' || config.role === 'boss') && (
+        <McpSection
+          title={t('config.esphome')}
+          row={config.connections.esphome}
+          secret={secrets.esphome}
+          onEnabled={enabled => { patchConnection('esphome', { enabled }) }}
+          onUrl={url => { patchConnection('esphome', { url }) }}
+          onSecret={value => { setSecrets(prev => ({ ...prev, esphome: value })) }}
+          urlLabel={t('config.esphome.url')}
+          secretLabel={t('config.esphome.token')}
+        />
+      )}
 
       <Section title={t('config.billing')}>
         <Field label={t('config.billing.input')}>

package/src/client/panel/panel.module.css

@@ -376,3 +376,46 @@
   background: var(--dsw-alias-brand-primary);
   flex: none;
 }
+
+.changelogDate {
+  margin-left: 8px;
+  font-weight: 500;
+  font-variant-numeric: tabular-nums;
+  color: var(--dsw-alias-label-tertiary);
+}
+
+.changelogBlock {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+
+.changelogHeading {
+  font-size: 12.5px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.changelogList {
+  margin: 0;
+  padding-left: 18px;
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  font-size: 13px;
+  line-height: 1.55;
+  color: var(--dsw-alias-label-primary);
+}
+
+.changelogList li + li {
+  margin: 0;
+}
+
+.changelogCode {
+  font-size: 12px;
+  padding: 1px 6px;
+  border-radius: 6px;
+  background: var(--dsw-alias-bg-layer-3);
+  border: 1px solid var(--dsw-alias-border-l2);
+  word-break: break-all;
+}

package/src/client/settings-card.tsx

@@ -10,12 +10,13 @@ import type { TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'
 import { RezApi } from './api.ts'
 import { RezT } from './panel/helpers.ts'
 import { AuditTab } from './panel/AuditTab.tsx'
+import { ChangelogTab } from './panel/ChangelogTab.tsx'
 import { ConfigTab } from './panel/ConfigTab.tsx'
 import { StatusTab } from './panel/StatusTab.tsx'
 import { WeixinTab } from './panel/WeixinTab.tsx'
 import css from './panel/panel.module.css'
 
-export type RezTab = 'config' | 'weixin' | 'status' | 'audit'
+export type RezTab = 'config' | 'weixin' | 'status' | 'audit' | 'changelog'
 
 export function RezSettingsPage({ t }: { t: TranslateNS<'dsh-rez-suite'> }) {
   const api = useMemo(() => new RezApi(), [])
@@ -25,6 +26,7 @@ export function RezSettingsPage({ t }: { t: TranslateNS<'dsh-rez-suite'> }) {
     { id: 'weixin', label: t('tab.weixin') },
     { id: 'status', label: t('tab.status') },
     { id: 'audit', label: t('tab.audit') },
+    { id: 'changelog', label: t('tab.changelog') },
   ]
   return (
     <RezT.Provider value={t}>
@@ -48,6 +50,7 @@ export function RezSettingsPage({ t }: { t: TranslateNS<'dsh-rez-suite'> }) {
         {activeTab === 'weixin' && <WeixinTab api={api} />}
         {activeTab === 'status' && <StatusTab api={api} />}
         {activeTab === 'audit' && <AuditTab api={api} />}
+        {activeTab === 'changelog' && <ChangelogTab api={api} />}
       </div>
     </RezT.Provider>
   )

package/src/esphome-lab.ts

@@ -0,0 +1,181 @@
+/**
+ * ESPHome lab: official dsh-mcp-client → lab MCP, plus HTTP fallback.
+ * Lab server runs official `esphome compile`. Never puts firmware bytes
+ * into the model context; the tool returns a click-later download link.
+ */
+
+import { loadRezConnections, readManagedCredential, REZ_CREDENTIAL_REFS, startMcpWhenSecret } from '@rezti/dsh-rez-sso'
+import type { Context } from '@deepseek-ai/cordis'
+
+export const ESPHOME_MCP_URL = 'http://127.0.0.1:8100/mcp'
+/** POST /v1/compile 只交 YAML、立刻回链接。真机 `esphome compile` 在后台，最长见实验室 `ESPHOME_COMPILE_TIMEOUT`（默认 20 分钟）。 */
+export const ESPHOME_COMPILE_TIMEOUT_MS = 120 * 1000
+
+export interface EsphomeCompileResult {
+  jobId: string
+  device: string
+  status: string
+  download: string
+  direct?: string
+  nextcloud?: string
+  size?: number
+  sha256?: string
+  logTail?: string
+  error?: string
+}
+
+export function esphomeLabUrl(): string {
+  const url = loadRezConnections().esphome?.url
+  return typeof url === 'string' && url.length > 0 ? url.replace(/\/+$/, '') : ESPHOME_MCP_URL
+}
+
+/** MCP is :8100/mcp; click-later HTTP lives on :8099. */
+export function esphomeHttpOrigin(mcpUrl: string = esphomeLabUrl()): string {
+  try {
+    const url = new URL(mcpUrl)
+    if (url.port === '8100') url.port = '8099'
+    return url.origin
+  } catch {
+    return 'http://127.0.0.1:8099'
+  }
+}
+
+function labToken(): string | undefined {
+  const env = process.env.REZ_ESPHOME_TOKEN
+  if (typeof env === 'string' && env.length > 0) return env
+  return readManagedCredential(REZ_CREDENTIAL_REFS.esphome)
+}
+
+export function esphomeLabConfigured(): boolean {
+  const connections = loadRezConnections().esphome
+  if (connections?.enabled === false) return false
+  return labToken() !== undefined
+}
+
+export function bearerAuthorization(secret: string): string {
+  const trimmed = secret.trim()
+  if (/^bearer\s+/i.test(trimmed)) return 'Bearer ' + trimmed.replace(/^bearer\s+/i, '')
+  return 'Bearer ' + trimmed
+}
+
+export function esphomeMcpConfig(secret: string): Record<string, unknown> {
+  return {
+    serverName: 'esphome',
+    transport: 'streamable-http',
+    url: esphomeLabUrl(),
+    headers: { Authorization: bearerAuthorization(secret) },
+    failOnStartupError: false,
+    toolCallTimeoutMs: ESPHOME_COMPILE_TIMEOUT_MS,
+  }
+}
+
+interface CompileJson {
+  ok?: boolean
+  id?: string
+  device?: string
+  status?: string
+  download?: string
+  direct?: string
+  nextcloud?: string
+  size?: number
+  sha256?: string
+  log_tail?: string
+  error?: string
+}
+
+/** Submit YAML; return the click-later link. Does not fetch firmware bytes. */
+export async function startEsphomeCompile(input: {
+  yaml: string
+  fetchImpl?: typeof fetch
+}): Promise<EsphomeCompileResult> {
+  const token = labToken()
+  if (token === undefined) {
+    throw new Error('未配置 REZ_ESPHOME_TOKEN。设置 → 插件 → ReZ-TI → ESPHome 实验室 填 Token。')
+  }
+  const fetchImpl = input.fetchImpl ?? fetch
+  const controller = new AbortController()
+  const timer = setTimeout(() => { controller.abort() }, ESPHOME_COMPILE_TIMEOUT_MS)
+  try {
+    const response = await fetchImpl(esphomeHttpOrigin() + '/v1/compile', {
+      method: 'POST',
+      headers: {
+        authorization: bearerAuthorization(token),
+        'content-type': 'application/yaml',
+      },
+      body: input.yaml,
+      signal: controller.signal,
+    })
+    const compiled = await response.json() as CompileJson
+    if (!response.ok || compiled.ok !== true || typeof compiled.id !== 'string') {
+      throw new Error(compiled.error ?? ('compile HTTP ' + response.status))
+    }
+    const download = compiled.download
+      ?? compiled.nextcloud
+      ?? compiled.direct
+      ?? (esphomeHttpOrigin() + '/v1/jobs/' + compiled.id + '/download')
+    return {
+      jobId: compiled.id,
+      device: compiled.device ?? 'device',
+      status: compiled.status ?? 'compiling',
+      download,
+      direct: compiled.direct,
+      nextcloud: compiled.nextcloud,
+      size: compiled.size,
+      sha256: compiled.sha256,
+      logTail: compiled.log_tail,
+      error: compiled.error,
+    }
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/** @deprecated use startEsphomeCompile */
+export const compileEsphomeFirmware = startEsphomeCompile
+
+/** Start for every identity; execution is room-gated to 实验室. */
+export function mountEsphomeMcp(
+  ctx: Context,
+  start: typeof startMcpWhenSecret = startMcpWhenSecret,
+): () => void {
+  let session: (() => void) | undefined
+  let pending = false
+  let retryTimer: ReturnType<typeof setTimeout> | undefined
+
+  const hasRezSso = (): boolean => {
+    const host = ctx as Context & { get?: (name: string) => unknown }
+    if (typeof host.get !== 'function') return true
+    return host.get('rezSso') !== undefined
+  }
+
+  const ensure = (): void => {
+    void (async () => {
+      if (session !== undefined || pending) return
+      if (!hasRezSso()) {
+        if (retryTimer === undefined) {
+          retryTimer = setTimeout(() => {
+            retryTimer = undefined
+            ensure()
+          }, 300)
+        }
+        return
+      }
+      pending = true
+      try {
+        session = await start(ctx, {
+          system: 'esphome',
+          label: 'ESPHome 实验室',
+          config: esphomeMcpConfig,
+        })
+      } catch (error: unknown) {
+        const why = error instanceof Error ? error.message : String(error)
+        console.error('[dsh-rez-suite] esphome MCP start failed:', why)
+      } finally {
+        pending = false
+      }
+    })()
+  }
+
+  ensure()
+  return ensure
+}

package/src/index.ts

@@ -25,13 +25,14 @@ import {
 import { makeRoutes } from './routes.ts'
 import { defaultConfig, mergeConfig, saveConfig } from './store.ts'
 import { TokenManager } from './token-manager.ts'
-import { rezConfigTool, rezStatusTool } from './tools.ts'
+import { rezConfigTool, rezEsphomeCompileTool, rezStatusTool } from './tools.ts'
 import type { RezConfig } from './protocol.ts'
 import { workspaceGuidanceFor, mountRezWorkspaces } from './boss/mount.ts'
 import { liveSelfUpdate } from './self-update.ts'
 import { mountTianyanchaMcp } from './tianyancha.ts'
 import { mountQccMcp, QCC_COMPANY_MCP_URL } from './qcc.ts'
-import { qccRoomGuard } from './rooms.ts'
+import { mountEsphomeMcp } from './esphome-lab.ts'
+import { suiteRoomGuard } from './rooms.ts'
 
 export const name = 'rez-suite'
 
@@ -90,6 +91,10 @@ export const Config: z<RezConfig> = z.object({
       enabled: z.boolean().default(true),
       url: z.string().default(REZ_DEFAULT_CONNECTIONS.tianyancha?.url ?? 'https://mcp.tianyancha.com/mcp'),
     }).default(REZ_DEFAULT_CONNECTIONS.tianyancha ?? { enabled: true, url: 'https://mcp.tianyancha.com/mcp' }),
+    esphome: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.esphome?.url ?? 'http://127.0.0.1:8100/mcp'),
+    }).default(REZ_DEFAULT_CONNECTIONS.esphome ?? { enabled: true, url: 'http://127.0.0.1:8100/mcp' }),
   }).default(REZ_DEFAULT_CONNECTIONS),
   billing: z.object({
     inputCostPer1k: z.number().default(0.001),
@@ -109,6 +114,9 @@ export const REZ_GUIDANCE_CORE = [
   '涉及资金、对外发送、设备控制、生产写入时先征得用户批准。',
   'Match the user language: Chinese or English. Do not force 中文 when they write English.',
   '制度、手册、出差/报销标准、素材路径：打开 Nextcloud Documents/Standards/INDEX.yaml，按 code 取当前 effective_from 最新且未被 replace 的条目，再按相对 uri 打开。引用带路径+生效日。找不到就说「标准文件未归档」，不要用 MEMORY 旧数字。素材文件夹用首次创建标题，不用会变的 Odoo/销售名。',
+  '同事交说明书/规格书：用输入栏回形针上传原 PDF（不要拖进对话——官方只收图；也不要用微信发文件）。不要直接写 Marketing/Publish。先找到该产品对应 TAPD 需求（Wiki 写死的说明书/规格书 TAPD ID；没有则按首次创建标题搜「产品使用说明书」或「技术手册」），把 PDF 放到 Marketing/Inbox/{分类}/{首次创建标题}/manual/ 或 datasheet/（zh.pdf 或 en.pdf），评论该需求、状态改测试中（status_3）、处理人改凯文智能家居。规划中先转到开发中再测试中；已实现要先退回开发中。凯文说审批了哪份（产品、说明书或规格书、中英）之后，再把 Inbox 文件写入 Marketing/Publish 对应路径，TAPD 改已实现。拒绝则改已拒绝、不写 Publish。Wiki 缺 NC RAW、NC Publish、Git products/{slug}/models 与 motion 就说「Wiki 未归档」。这不是一件发布；不要拷下游、不要上渠道。',
+  '同事交拍摄原片：对话里交图即可。先调官方 Comfy MCP 只修一次，得到高精度干净原片；Harness 不做推理，不要自写 WebSocket。这不是图生场景图也不是图生白底图。修完后员工必须声明是什么图（white_bg/scene/label/gallery/packaging，写进 TAPD 评论）；未声明不准进审批。不要直接写 Marketing/RAW。两种都先放到 Marketing/Inbox/{分类}/{首次创建标题}/photo/shot/ 与 photo/clean/。对应 TAPD（Wiki 写死的拍摄图 TAPD ID；没有则按首次创建标题搜「产品拍摄」；还没有则评论 1154488930001001218）改测试中、处理人改凯文智能家居。凯文说审批了哪份之后，shot 与 clean 同时写入 Marketing/RAW 对应路径，TAPD 改已实现。拒绝不写 RAW。不要写 Publish、不要上渠道。现有 photo/ 根目录或产品根目录样板不强制搬家。',
+  '同事交品牌规范或公司 VI：这是公司级，写 Marketing/Brand/，不要写进某个产品 SKU 目录。规范 PDF 和 psd/ai 源文件用回形针；VI 图在对话里交，才调官方 Comfy MCP 只修一次。声明类型（guideline 或 logo/wordmark/icon/color/font/template）后，两种先入 Marketing/Inbox/Brand/guideline/ 或 vi/ 的 shot 与 clean。评论 1154488930001001220，改测试中、处理人凯文智能家居。凯文说审批了哪份之后，shot 与 clean 同时写入 Marketing/RAW/Brand 对应路径。拒绝不写 RAW。不要写 Publish。根上 VI/ 与 MKT/VI 是历史盘，不搬家、不再当正式路径。不要把规范抄进 Standards 正文。',
 ].join('')
 
 export function rezGuidanceFor(role: RezConfig['role']): string {
@@ -144,18 +152,20 @@ export function apply(ctx: Context, config?: RezConfig): void {
   const syncWorkspaces = mountRezWorkspaces(ctx, () => current().role)
   const syncQcc = mountQccMcp(ctx)
   const syncTianyancha = mountTianyanchaMcp(ctx, () => current().role)
+  const syncEsphome = mountEsphomeMcp(ctx)
 
   const tokens = new TokenManager(joinTokenDb())
   const host = delegatedHost(ctx, () => current())
   ctx.effect(() => () => { tokens.close() }, 'dsh-rez-suite: ledger view')
-  const toolsHost = ctx.tools as { guard?: (guard: typeof qccRoomGuard) => () => void }
+  const toolsHost = ctx.tools as { guard?: (guard: typeof suiteRoomGuard) => () => void }
   if (typeof toolsHost.guard === 'function') {
-    ctx.effect(() => toolsHost.guard!(qccRoomGuard), 'dsh-rez-suite: qcc room guard')
+    ctx.effect(() => toolsHost.guard!(suiteRoomGuard), 'dsh-rez-suite: room guard')
   }
 
   const tools = [
     rezStatusTool(host, () => current()),
     rezConfigTool(() => current()),
+    rezEsphomeCompileTool(),
   ]
 
   const routes = makeRoutes({
@@ -167,6 +177,7 @@ export function apply(ctx: Context, config?: RezConfig): void {
       syncWorkspaces()
       syncQcc()
       syncTianyancha()
+      syncEsphome()
       try {
         const settings = ctx.get('settings') as { update?: (namespace: unknown, value: unknown) => Promise<void> } | undefined
         if (settings?.update !== undefined) await settings.update(REZ_SETTINGS_NAMESPACE, value)
@@ -222,12 +233,14 @@ export function apply(ctx: Context, config?: RezConfig): void {
       syncWorkspaces()
       syncQcc()
       syncTianyancha()
+      syncEsphome()
     },
     onChange: () => {
       sync()
       syncWorkspaces()
       syncQcc()
       syncTianyancha()
+      syncEsphome()
     },
   })
 

package/src/observe-mcp.ts

@@ -8,12 +8,15 @@
 
 import { lastMcpStartError, REZ_CREDENTIAL_REFS, secretConfigured, type RezSystem } from '@rezti/dsh-rez-sso'
 import type { RezConfig, RezServerStatus, RezTestResult } from './protocol.ts'
-import { isLegalAssistantRoom, isQccToolName, QCC_STATUS_ROOM_OFF } from './rooms.ts'
+import { isLabRoom, isLegalAssistantRoom, isQccToolName, QCC_STATUS_ROOM_OFF } from './rooms.ts'
 
-export const COMPOSED_SERVERS = ['odoo', 'nextcloud', 'wechat', 'homeassistant', 'tapd', 'gsc', 'qcc', 'tianyancha'] as const
+export const COMPOSED_SERVERS = ['odoo', 'nextcloud', 'wechat', 'homeassistant', 'tapd', 'gsc', 'qcc', 'tianyancha', 'esphome'] as const
 
 export type ComposedServer = (typeof COMPOSED_SERVERS)[number]
 
+/** Front panel hides these until install/docs are ready. Backend MCP can still start if a secret exists. TAPD 1154488930001001224. */
+export const FRONT_HIDDEN_SERVERS: ReadonlySet<ComposedServer> = new Set(['wechat'])
+
 export function mcpToolPrefix(server: string): string {
   if (server === 'qcc') return 'mcp__qcc-'
   return 'mcp__' + server + '__'
@@ -109,13 +112,16 @@ export function observeServer(
 }
 
 function composedServersFor(input: ObserveInput): ComposedServer[] {
-  const servers = input.config.role === 'boss'
-    ? COMPOSED_SERVERS
+  let servers: ComposedServer[] = input.config.role === 'boss'
+    ? [...COMPOSED_SERVERS]
     : COMPOSED_SERVERS.filter((server) => server !== 'tianyancha')
   if (input.room !== undefined && !isLegalAssistantRoom(input.room)) {
-    return servers.filter((server) => server !== 'qcc')
+    servers = servers.filter((server) => server !== 'qcc')
+  }
+  if (input.room !== undefined && !isLabRoom(input.room)) {
+    servers = servers.filter((server) => server !== 'esphome')
   }
-  return [...servers]
+  return servers.filter((server) => !FRONT_HIDDEN_SERVERS.has(server))
 }
 
 function observeQccOutsideLegalRoom(input: ObserveInput): RezServerStatus {