@rezti/dsh-rez-suite 0.1.48 → 0.1.50

package/lib/index.js

@@ -3,9 +3,9 @@ import { homedir } from "node:os";
 import { dirname, join, relative } from "node:path";
 import { REZ_CREDENTIAL_REFS, REZ_DEFAULT_CONNECTIONS, REZ_SYSTEMS, lastMcpStartError, loadRezConnections, mergeConnections, readManagedCredential, secretConfigured, startMcpWhenSecret, writeManagedCredential } from "@rezti/dsh-rez-sso";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
 import { fileURLToPath } from "node:url";
-import { spawn } from "node:child_process";
 //#region ../../node_modules/.pnpm/@deepseek-ai+cosmokit@1.8.2/node_modules/@deepseek-ai/cosmokit/lib/index.js
 /** Return true when a value is `null` or `undefined`. */
 function isNullable(value) {
@@ -2935,7 +2935,7 @@ const COMPOSED_SERVERS = [
 	"tianyancha",
 	"esphome"
 ];
-/** Front panel hides these until install/docs are ready. Backend MCP can still start if a secret exists. TAPD 1154488930001001224. */
+/** Front panel hides webhook MCP wechat status; AI bots live in the Config WeCom bindings. TAPD 1154488930001001231. */
 const FRONT_HIDDEN_SERVERS = /* @__PURE__ */ new Set(["wechat"]);
 function mcpToolPrefix(server) {
 	if (server === "qcc") return "mcp__qcc-";
@@ -3062,6 +3062,7 @@ const REZ_API = {
 	auditReset: "/api/dsh-rez-suite/audit/reset",
 	weixin: "/api/dsh-rez-suite/weixin",
 	weixinVerify: "/api/dsh-rez-suite/weixin/verify",
+	wecomChannels: "/api/dsh-rez-suite/wecom/channels",
 	update: "/api/dsh-rez-suite/update"
 };
 //#endregion
@@ -3229,6 +3230,145 @@ function saveConfig(config) {
 	renameSync(tmp, path);
 }
 //#endregion
+//#region src/wecom-cli.ts
+/**
+* Official WeCom office APIs are @wecom/cli, not mcp__wechat__*.
+* TAPD bug 1154488930001000054: missing MCP row was treated as “no WeCom”.
+* Official CLI v1.1+ opened 通讯录 / 在线文档 etc. for every company size
+* (https://github.com/WecomTeam/wecom-cli). Kelvin enabled those modules.
+*/
+/** Official @wecom/cli >=1.1 catalog. Do not invent extra HTTP APIs. */
+const WECOM_CLI_CATALOG = [
+	{
+		id: "contact",
+		label: "通讯录"
+	},
+	{
+		id: "doc",
+		label: "在线文档"
+	},
+	{
+		id: "doc-manage",
+		label: "文档管理"
+	},
+	{
+		id: "sheet",
+		label: "在线表格"
+	},
+	{
+		id: "smartsheet",
+		label: "智能表格"
+	},
+	{
+		id: "smartpage",
+		label: "智能文档"
+	},
+	{
+		id: "todo",
+		label: "待办"
+	},
+	{
+		id: "calendar",
+		label: "日程"
+	},
+	{
+		id: "meeting",
+		label: "会议"
+	},
+	{
+		id: "email",
+		label: "邮件"
+	},
+	{
+		id: "disk",
+		label: "微盘"
+	},
+	{
+		id: "message",
+		label: "消息"
+	},
+	{
+		id: "media",
+		label: "媒体文件"
+	}
+];
+const MODULE_LABELS = WECOM_CLI_CATALOG.map((row) => row.label).join("/");
+const HINT_MISSING = [
+	`未安装官方 wecom-cli（@wecom/cli >=1.1）。企微办公能力（${MODULE_LABELS}）走 CLI，不是 MCP。`,
+	"安装：npm i -g @wecom/cli ，然后 wecom-cli auth init。",
+	"官方已面向各规模企业开放通讯录等能力，不要再说「超过 10 人只能用文档」。",
+	"不要因为 rez_status 没有 wechat MCP 行就说没有企微能力。"
+].join("");
+const HINT_UNAUTH = [
+	"已安装 wecom-cli，尚未授权。跑 wecom-cli auth init。",
+	`授权后可用：${MODULE_LABELS}。本企业已开通这些品类。`,
+	"CLI 报某模块未授权才说该能力未开通；不要说「没有企微 MCP」，也不要说 10 人限制。"
+].join("");
+const HINT_OK = [
+	`企微办公能力走 wecom-cli >=1.1（${MODULE_LABELS}）。本企业已开通。`,
+	"按房间里官方 wecomcli-* 技能执行，命令以 wecom-cli <模块> --help 为准。",
+	"不要用旧帮助中心「超过 10 人只能用文档」的说法。CLI 报未授权才说该模块未开通。",
+	"设置页 BotID+Secret 只是房间消息通道。不要把没有 mcp__wechat__* 当成没有企微能力。"
+].join("");
+function wecomCliCatalog() {
+	return WECOM_CLI_CATALOG.map((row) => ({ ...row }));
+}
+function defaultWecomCliRunner(argv) {
+	const result = spawnSync("wecom-cli", argv, {
+		encoding: "utf8",
+		timeout: 4e3,
+		env: process.env
+	});
+	const error = result.error;
+	return {
+		status: result.status,
+		stdout: typeof result.stdout === "string" ? result.stdout : "",
+		stderr: typeof result.stderr === "string" ? result.stderr : "",
+		errorCode: error?.code
+	};
+}
+function looksUnauthorized(text, status) {
+	if (status !== 0) return true;
+	return /未授权|未登录|未初始化|not (logged|auth)|unauthorized|请先.*auth|auth init/i.test(text);
+}
+function withCatalog(partial) {
+	return {
+		...partial,
+		modules: wecomCliCatalog()
+	};
+}
+function probeWecomCli(run = defaultWecomCliRunner) {
+	const help = run(["--help"]);
+	if (help.errorCode === "ENOENT") return withCatalog({
+		installed: false,
+		authorized: false,
+		hint: HINT_MISSING
+	});
+	const helpText = help.stdout + help.stderr;
+	if (help.status !== 0 && helpText.trim().length === 0) return withCatalog({
+		installed: false,
+		authorized: false,
+		hint: HINT_MISSING
+	});
+	const auth = run(["auth", "show"]);
+	const text = auth.stdout + auth.stderr;
+	if (auth.errorCode === "ENOENT") return withCatalog({
+		installed: false,
+		authorized: false,
+		hint: HINT_MISSING
+	});
+	if (looksUnauthorized(text, auth.status)) return withCatalog({
+		installed: true,
+		authorized: false,
+		hint: HINT_UNAUTH
+	});
+	return withCatalog({
+		installed: true,
+		authorized: true,
+		hint: HINT_OK
+	});
+}
+//#endregion
 //#region src/routes.ts
 const MAX_JSON_BODY_BYTES = 256 * 1024;
 const SECRET_MASK = "********";
@@ -3395,7 +3535,8 @@ function makeRoutes(deps) {
 				writeJson(res, 200, {
 					role: getConfig().role,
 					servers,
-					totalRegisteredTools
+					totalRegisteredTools,
+					wecomCli: probeWecomCli()
 				});
 			}
 		},
@@ -7719,9 +7860,10 @@ function toolAbortedBeforeDispatchResult(prior) {
 //#endregion
 //#region src/esphome-lab.ts
 /**
-* ESPHome lab: official dsh-mcp-client → lab MCP, plus HTTP fallback.
-* Lab server runs official `esphome compile`. Never puts firmware bytes
-* into the model context; the tool returns a click-later download link.
+* ESPHome lab client in Harness: official dsh-mcp-client → rezti-lab MCP.
+* The compiler lives in Mac Mini Docker (`deploy/lab`, compose name rezti-lab).
+* Missing lab / missing token must not block `dsh web` (failOnStartupError: false).
+* Never puts firmware bytes into the model context; the tool returns a click-later download link.
 */
 const ESPHOME_MCP_URL = "http://127.0.0.1:8100/mcp";
 /** POST /v1/compile 只交 YAML、立刻回链接。真机 `esphome compile` 在后台，最长见实验室 `ESPHOME_COMPILE_TIMEOUT`（默认 20 分钟）。 */
@@ -7852,10 +7994,24 @@ function text(value) {
 		text: value
 	}];
 }
-function rezStatusTool(host, config) {
+function renderWecomCli(cli) {
+	const row = cli ?? {
+		installed: false,
+		authorized: false,
+		modules: [],
+		hint: ""
+	};
+	const modules = (row.modules ?? []).map((item) => `${item.label}(${item.id})`).join("、");
+	return [
+		"wecom-cli（企微办公能力，不是 MCP）: installed=" + (row.installed ? "yes" : "no") + " authorized=" + (row.authorized ? "yes" : "no"),
+		modules.length > 0 ? "modules: " + modules : "modules: (官方目录见 wecomcli-* 技能)",
+		row.hint
+	].join("\n");
+}
+function rezStatusTool(host, config, wecomCli = probeWecomCli) {
 	return defineTool({
 		name: "rez_status",
-		description: "List the dsh-rez-suite MCP server statuses and how many tools each server registered for the current role. Triggers: rez, MCP, 连接状态.",
+		description: "List MCP server statuses plus WeCom office APIs (official wecom-cli, not mcp__wechat__). Triggers: rez, MCP, 连接状态, 企业微信, 企微能力.",
 		parameters: {},
 		output: {
 			schema: {
@@ -7896,6 +8052,43 @@ function rezStatusTool(host, config) {
 								startedAt: { type: "integer" }
 							}
 						}
+					},
+					wecomCli: {
+						type: "object",
+						required: true,
+						additionalProperties: false,
+						properties: {
+							installed: {
+								type: "boolean",
+								required: true
+							},
+							authorized: {
+								type: "boolean",
+								required: true
+							},
+							hint: {
+								type: "string",
+								required: true
+							},
+							modules: {
+								type: "array",
+								required: true,
+								items: {
+									type: "object",
+									additionalProperties: false,
+									properties: {
+										id: {
+											type: "string",
+											required: true
+										},
+										label: {
+											type: "string",
+											required: true
+										}
+									}
+								}
+							}
+						}
 					}
 				},
 				additionalProperties: false
@@ -7912,7 +8105,7 @@ function rezStatusTool(host, config) {
 					"server | state | discovered | registered | error",
 					"--- | --- | --- | --- | ---",
 					...rows
-				].join("\n"));
+				].join("\n") + "\n\n" + renderWecomCli(value.wecomCli));
 			}
 		},
 		async execute(_args, exec) {
@@ -7924,7 +8117,8 @@ function rezStatusTool(host, config) {
 			});
 			return {
 				role: config().role,
-				servers
+				servers,
+				wecomCli: wecomCli()
 			};
 		}
 	});
@@ -8007,7 +8201,7 @@ function rezEsphomeCompileTool() {
 * `workspaceRegistry.create` is idempotent: same canonical path returns the
 * existing record. New records are prepended, so we register in reverse then
 * `insertBefore` to pin 搞钱 → 产品 → 运营 → 人事助理 → 财务助理 → 法务助理
-* （运营身份：设计 → 人事助理 → 财务助理 → 法务助理；
+* （运营身份：设计 → 发布 → 电商 → 人事助理 → 财务助理 → 法务助理；
 * 工程师身份：实验室 → 人事助理 → 财务助理 → 法务助理）
 * (微信 stays after that block). `delete` only drops the registry row —
 * directories and session logs stay.
@@ -8085,10 +8279,20 @@ const STAFF_ROOMS = [
 	}
 ];
 /** 运营身份专用。不是全员助理，也不是老板「运营」简报室。 */
-const OPS_ROOMS = [{
-	id: "design",
-	folder: "设计"
-}];
+const OPS_ROOMS = [
+	{
+		id: "design",
+		folder: "设计"
+	},
+	{
+		id: "publish",
+		folder: "发布"
+	},
+	{
+		id: "ecommerce",
+		folder: "电商"
+	}
+];
 /** 工程师身份专用。ESPHome YAML → 实验室服务器编译 firmware.bin。 */
 const ENGINEER_ROOMS = [{
 	id: "lab",
@@ -8166,6 +8370,7 @@ function seedRoom(templatesRoot, destRoot, room) {
 		writeFileSync(target, readFileSync(abs));
 		written.push(rel);
 	}
+	seedSharedSkills(dest, written);
 	return {
 		id: room.id,
 		folder: room.folder,
@@ -8176,6 +8381,24 @@ function seedRoom(templatesRoot, destRoot, room) {
 		skipped
 	};
 }
+function defaultSharedTemplatesRoot() {
+	const here = fileURLToPath(new URL(".", import.meta.url));
+	const candidates = [join(here, "../templates/shared"), join(here, "../../templates/shared")];
+	for (const dir of candidates) if (existsSync(join(dir, "wecom-office", "SKILL.md"))) return dir;
+	throw new Error("missing shared workspace templates (expected templates/shared/wecom-office/SKILL.md)");
+}
+function seedSharedSkills(dest, written) {
+	const root = defaultSharedTemplatesRoot();
+	for (const name of readdirSync(root).sort()) {
+		const src = join(root, name, "SKILL.md");
+		if (!existsSync(src)) continue;
+		const rel = join(".agents", "skills", name, "SKILL.md");
+		const target = join(dest, rel);
+		mkdirSync(dirname(target), { recursive: true });
+		writeFileSync(target, readFileSync(src));
+		written.push(rel);
+	}
+}
 function listFiles(root) {
 	const out = [];
 	const walk = (dir) => {
@@ -8206,9 +8429,13 @@ const BOSS_GUIDANCE = [
 	"微信文件夹仍是收件箱，不要在那边查账、报销或砍 SKU。",
 	"用户用中文就中文、用英文就英文；不要因为工作区文件是中文就强制中文。"
 ].join("");
-const BOSS_ROLE_HINT = "搞钱 / 产品 / 运营仅角色选「老板」时出现。人事 / 财务 / 法务助理所有角色都会登记。设计工作房间仅「运营」身份出现。实验室仅「工程师」身份出现。";
+const BOSS_ROLE_HINT = "搞钱 / 产品 / 运营仅角色选「老板」时出现。人事 / 财务 / 法务助理所有角色都会登记。设计 / 发布 / 电商工作房间仅「运营」身份出现。实验室仅「工程师」身份出现。";
 const ENGINEER_LAB_GUIDANCE = ["当前身份是工程师。侧栏第一间是实验室：对方说板型/功能就自己写 ESPHome YAML，或用回形针/粘贴。调 mcp__esphome__compile（或 rez_esphome_compile）。", "立刻把下载链接发给对方。编译要时间：先点开可能是 README.md，编完刷新就是 firmware.bin；失败也是 README（含日志）。不要把 bin 贴进对话。未开通就说未开通。不要自写编译器，不要自写 Device Builder WebSocket，不要默认 OTA 刷机。"].join("");
-const OPS_DESIGN_GUIDANCE = ["当前身份是运营。侧栏第一间是设计工作房间：产品拍摄图、品牌规范、公司 VI 都在这里交。拍原片或 VI 图用官方 Comfy MCP 只修一次；规范 PDF / 源文件用回形针、不修。员工声明类型、Inbox 待审并转凯文。终审只在老板产品室。", "不要代批、不要直接写 RAW、不要写 Publish、不要做图生场景或白底。搞钱 / 产品 / 运营仅老板身份出现。"].join("");
+const OPS_DESIGN_GUIDANCE = [
+	"当前身份是运营。侧栏先是设计工作房间：产品拍摄图、品牌规范、公司 VI 都在这里交。拍原片或 VI 图用官方 Comfy MCP 只修一次；规范 PDF / 源文件用回形针、不修。员工声明类型、Inbox 待审并转凯文。终审只在老板产品室。",
+	"接着是发布工作间（媒体连接）：内容/社媒 PCP 与 MediaJob，preview 后确认才 submit。不要另建图库，不要做日历 UI；排期写企微一个共享发布日历。",
+	"再接着是电商工作间（ec operation）：一期只做阿里巴巴国际站 ListingJob。Amazon 现在没有号，看板标后续，有号再开。设置页「看板」看两室连接与 Odoo/企微权限。不要代批、不要直接写 RAW、不要做图生场景或白底。搞钱 / 产品 / 运营仅老板身份出现。"
+].join("");
 function workspaceGuidanceFor(role) {
 	if (role === "boss") return BOSS_GUIDANCE;
 	if (role === "operations") return STAFF_GUIDANCE + OPS_DESIGN_GUIDANCE;
@@ -8643,8 +8870,9 @@ const Config = Schema.object({
 });
 const SECTION_ORDER = 150;
 const REZ_GUIDANCE_CORE = [
-	"本机已安装 ReZ-TI 拆分包：工作身份由 dsh-rez-sso 提供，MCP 由官方 dsh-mcp-client 接入 Odoo / Nextcloud / 企业微信 / Home Assistant / TAPD / GSC。",
-	"工具名 mcp__odoo__*、mcp__nextcloud__*、mcp__wechat__*、mcp__homeassistant__*、mcp__tapd__*、mcp__gsc__*。",
+	"本机已安装 ReZ-TI 拆分包：工作身份由 dsh-rez-sso 提供，MCP 由官方 dsh-mcp-client 接入 Odoo / Nextcloud / Home Assistant / TAPD / GSC。",
+	"工具名 mcp__odoo__*、mcp__nextcloud__*、mcp__homeassistant__*、mcp__tapd__*、mcp__gsc__*。",
+	"企业微信办公能力不是 MCP：走官方 wecom-cli >=1.1（通讯录/在线文档/在线表格/智能表格/智能文档/待办/日程/会议/邮件/微盘/消息）。本企业已开通这些品类。看 rez_status 的 wecomCli.modules，按房间 wecomcli-* 技能执行。不要因为没有 mcp__wechat__* 就说没有企微能力，也不要说「超过 10 人只能用文档」。CLI 报某模块未授权才说该能力未开通。设置页 BotID+Secret 只是房间消息通道。旧群 webhook 兼容才会出现 mcp__wechat__*。",
 	"密钥：REZ_ODOO_TOKEN、REZ_NEXTCLOUD_PASSWORD、REZ_WECHAT_WEBHOOK、REZ_HA_TOKEN、REZ_TAPD_TOKEN、REZ_GSC_KEY。",
 	"个人微信（QClaw/ClawBot）：打开 设置 → 插件 → ReZ-TI → 微信 扫码，然后直接在微信里说话。消息进入网页左侧「微信」文件夹并延续同一会话，模型跟网页默认。网页归档了再从微信说话会自动恢复到侧栏。发「重启对话」会新开一条可见会话并把旧会话归档。网页端必须开着。不必再跑命令、也不要调用微信 MCP 工具。",
 	"意图用 rez_set_intent（erp/files/chat/home/auto）。审计用 rez_audit。",

package/lib/style.css

@@ -209,6 +209,17 @@
   height: 15px;
 }
 
+.LOjPTW_wecomRow {
+  grid-template-columns: minmax(7rem, .8fr) minmax(8rem, 1fr) minmax(8rem, 1fr) auto;
+  align-items: end;
+  gap: 8px;
+  display: grid;
+}
+
+.LOjPTW_wecomRow .LOjPTW_message {
+  grid-column: 1 / -1;
+}
+
 .LOjPTW_toolbar {
   flex-wrap: wrap;
   flex: none;
@@ -295,6 +306,13 @@
   padding: 8px 10px;
 }
 
+.LOjPTW_boardTitle {
+  color: var(--dsw-alias-label-primary);
+  margin: 16px 0 4px;
+  font-size: 13px;
+  font-weight: 600;
+}
+
 .LOjPTW_badge {
   border-radius: 999px;
   padding: 2px 8px;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rezti/dsh-rez-suite",
-  "description": "ReZ-TI one-package install for DeepSeek Harness. Update with: dsh plugin --profile web add @rezti/dsh-rez-suite@0.1.48",
-  "version": "0.1.48",
+  "description": "ReZ-TI one-package install for DeepSeek Harness. Update with: dsh plugin --profile web add @rezti/dsh-rez-suite@0.1.50",
+  "version": "0.1.50",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -45,7 +45,7 @@
     "@rezti/dsh-rez-sso": "^0.1.14",
     "@rezti/dsh-rez-tapd": "^0.1.1",
     "@rezti/dsh-rez-token-manager": "^0.1.4",
-    "@rezti/dsh-rez-wechat": "^0.1.14",
+    "@rezti/dsh-rez-wechat": "^0.1.16",
     "@rezti/dsh-web-file-uploader": "0.2.3",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3"
@@ -88,6 +88,7 @@
     "servers",
     "templates/boss/**/*",
     "templates/staff/**/*",
+    "templates/shared/**/*",
     "cordis.patch.yml",
     "README.md",
     "README.zh.md",

package/src/boss/mount.ts

@@ -28,7 +28,7 @@ export const BOSS_GUIDANCE = [
   '用户用中文就中文、用英文就英文；不要因为工作区文件是中文就强制中文。',
 ].join('')
 
-export const BOSS_ROLE_HINT = '搞钱 / 产品 / 运营仅角色选「老板」时出现。人事 / 财务 / 法务助理所有角色都会登记。设计工作房间仅「运营」身份出现。实验室仅「工程师」身份出现。'
+export const BOSS_ROLE_HINT = '搞钱 / 产品 / 运营仅角色选「老板」时出现。人事 / 财务 / 法务助理所有角色都会登记。设计 / 发布 / 电商工作房间仅「运营」身份出现。实验室仅「工程师」身份出现。'
 
 export const ENGINEER_LAB_GUIDANCE = [
   '当前身份是工程师。侧栏第一间是实验室：对方说板型/功能就自己写 ESPHome YAML，或用回形针/粘贴。调 mcp__esphome__compile（或 rez_esphome_compile）。',
@@ -36,8 +36,9 @@ export const ENGINEER_LAB_GUIDANCE = [
 ].join('')
 
 export const OPS_DESIGN_GUIDANCE = [
-  '当前身份是运营。侧栏第一间是设计工作房间：产品拍摄图、品牌规范、公司 VI 都在这里交。拍原片或 VI 图用官方 Comfy MCP 只修一次；规范 PDF / 源文件用回形针、不修。员工声明类型、Inbox 待审并转凯文。终审只在老板产品室。',
-  '不要代批、不要直接写 RAW、不要写 Publish、不要做图生场景或白底。搞钱 / 产品 / 运营仅老板身份出现。',
+  '当前身份是运营。侧栏先是设计工作房间：产品拍摄图、品牌规范、公司 VI 都在这里交。拍原片或 VI 图用官方 Comfy MCP 只修一次；规范 PDF / 源文件用回形针、不修。员工声明类型、Inbox 待审并转凯文。终审只在老板产品室。',
+  '接着是发布工作间（媒体连接）：内容/社媒 PCP 与 MediaJob，preview 后确认才 submit。不要另建图库，不要做日历 UI；排期写企微一个共享发布日历。',
+  '再接着是电商工作间（ec operation）：一期只做阿里巴巴国际站 ListingJob。Amazon 现在没有号，看板标后续，有号再开。设置页「看板」看两室连接与 Odoo/企微权限。不要代批、不要直接写 RAW、不要做图生场景或白底。搞钱 / 产品 / 运营仅老板身份出现。',
 ].join('')
 
 export function workspaceGuidanceFor(role: RezRoleId): string {

package/src/boss/register.ts

@@ -3,7 +3,7 @@
  * `workspaceRegistry.create` is idempotent: same canonical path returns the
  * existing record. New records are prepended, so we register in reverse then
  * `insertBefore` to pin 搞钱 → 产品 → 运营 → 人事助理 → 财务助理 → 法务助理
- * （运营身份：设计 → 人事助理 → 财务助理 → 法务助理；
+ * （运营身份：设计 → 发布 → 电商 → 人事助理 → 财务助理 → 法务助理；
  * 工程师身份：实验室 → 人事助理 → 财务助理 → 法务助理）
  * (微信 stays after that block). `delete` only drops the registry row —
  * directories and session logs stay.

package/src/boss/seed.ts

@@ -17,6 +17,8 @@ export const STAFF_ROOMS = [
 /** 运营身份专用。不是全员助理，也不是老板「运营」简报室。 */
 export const OPS_ROOMS = [
   { id: 'design', folder: '设计' },
+  { id: 'publish', folder: '发布' },
+  { id: 'ecommerce', folder: '电商' },
 ] as const
 
 /** 工程师身份专用。ESPHome YAML → 实验室服务器编译 firmware.bin。 */
@@ -162,6 +164,8 @@ function seedRoom(templatesRoot: string, destRoot: string, room: RoomSpec): Seed
     written.push(rel)
   }
 
+  seedSharedSkills(dest, written)
+
   return {
     id: room.id,
     folder: room.folder,
@@ -173,6 +177,31 @@ function seedRoom(templatesRoot: string, destRoot: string, room: RoomSpec): Seed
   }
 }
 
+export function defaultSharedTemplatesRoot(): string {
+  const here = fileURLToPath(new URL('.', import.meta.url))
+  const candidates = [
+    join(here, '../templates/shared'),
+    join(here, '../../templates/shared'),
+  ]
+  for (const dir of candidates) {
+    if (existsSync(join(dir, 'wecom-office', 'SKILL.md'))) return dir
+  }
+  throw new Error('missing shared workspace templates (expected templates/shared/wecom-office/SKILL.md)')
+}
+
+function seedSharedSkills(dest: string, written: string[]): void {
+  const root = defaultSharedTemplatesRoot()
+  for (const name of readdirSync(root).sort()) {
+    const src = join(root, name, 'SKILL.md')
+    if (!existsSync(src)) continue
+    const rel = join('.agents', 'skills', name, 'SKILL.md')
+    const target = join(dest, rel)
+    mkdirSync(dirname(target), { recursive: true })
+    writeFileSync(target, readFileSync(src))
+    written.push(rel)
+  }
+}
+
 function listFiles(root: string): string[] {
   const out: string[] = []
   const walk = (dir: string): void => {

package/src/changelog.ts

@@ -20,6 +20,54 @@ export interface ChangelogRelease {
 }
 
 export const SUITE_CHANGELOG: readonly ChangelogRelease[] = [
+  {
+    version: '0.1.50',
+    date: '2026-08-20',
+    sections: [
+      {
+        title: { zh: '运营发布工作间', en: 'Operations publish room' },
+        items: [
+          {
+            zh: '运营身份侧栏多了「发布」房间（合同 Post editor / 媒体连接）和「电商」房间（一期只阿里巴巴国际站；Amazon 等有号）。设置页「看板」看两室状态与 Odoo/企微权限。不建图库，排期写企微共享日历。员工机安装包仍钉已发布版本，不要改审批镜像。',
+            en: 'Operations now gets 发布 (media / Post editor) and 电商 (phase 1: Alibaba.com; Amazon waits for an account). The settings Board tab shows channel status plus Odoo/WeCom identity. No media library; schedule goes to one shared WeCom calendar. Do not bump the installer SUITE_VERSION.',
+          },
+        ],
+      },
+      {
+        title: { zh: '企微固定对话框', en: 'Sticky WeCom sessions' },
+        items: [
+          {
+            zh: '同一房间连续说话复用网页左侧同一条会话。只有「重启对话」才新开。',
+            en: 'WeCom turns in one room reuse the same sidebar session. Only “重启对话” opens a new one.',
+          },
+        ],
+      },
+      {
+        title: { zh: '企微办公能力', en: 'WeCom office APIs' },
+        items: [
+          {
+            zh: 'rez_status / 状态页报官方 wecom-cli >=1.1 品类（通讯录/在线文档/表格/待办/日程/会议/邮件/微盘等）。房间种入官方 wecomcli-* 技能。不要把「没有 wechat MCP」或旧的 10 人限制当成没有企微能力。BotID 只是房间消息通道。不改员工机安装包。',
+            en: 'rez_status lists official wecom-cli >=1.1 modules (contacts/docs/sheets/todos/calendar/meetings/mail/disk). Rooms get upstream wecomcli-* skills. A missing wechat MCP row is not “no WeCom”. BotID is only the room chat channel. Do not bump the installer.',
+          },
+        ],
+      },
+    ],
+  },
+  {
+    version: '0.1.49',
+    date: '2026-08-19',
+    sections: [
+      {
+        title: { zh: '企业微信智能机器人', en: 'WeCom AI bots' },
+        items: [
+          {
+            zh: '设置页按房间绑定企微智能机器人（BotID + Secret）。同事在企微跟哪个 bot 说话，就进网页左侧那个房间。密钥只存本机，不进 compose。',
+            en: 'Bind a WeCom AI bot (BotID + Secret) per Harness room. Talk to that bot in WeCom and the thread lands in that sidebar folder. Secrets stay on disk, not in compose.',
+          },
+        ],
+      },
+    ],
+  },
   {
     version: '0.1.48',
     date: '2026-08-19',

package/src/channel-board.ts

@@ -0,0 +1,55 @@
+/**
+ * Contract Account connections → two ops rooms + the settings 看板.
+ * Phase-1 ecommerce is Alibaba.com only (Amazon waits for an account). Media stays in 发布.
+ * Secrets never live here.
+ */
+
+export type ChannelKind = 'media' | 'ecommerce'
+export type ChannelPhase = '1' | 'later'
+
+export interface ChannelSpec {
+  id: string
+  nameZh: string
+  nameEn: string
+  kind: ChannelKind
+  room: '发布' | '电商'
+  phase: ChannelPhase
+}
+
+export const MEDIA_ROOM = '发布'
+export const ECOMMERCE_ROOM = '电商'
+
+export const CHANNEL_BOARD: readonly ChannelSpec[] = [
+  {
+    id: 'media_via_publish',
+    nameZh: '内容 / 社媒分发',
+    nameEn: 'Content / social',
+    kind: 'media',
+    room: MEDIA_ROOM,
+    phase: '1',
+  },
+  {
+    id: 'alibaba_icbu',
+    nameZh: '阿里巴巴国际站',
+    nameEn: 'Alibaba.com',
+    kind: 'ecommerce',
+    room: ECOMMERCE_ROOM,
+    phase: '1',
+  },
+  {
+    id: 'amazon',
+    nameZh: 'Amazon',
+    nameEn: 'Amazon',
+    kind: 'ecommerce',
+    room: ECOMMERCE_ROOM,
+    phase: 'later',
+  },
+]
+
+export function channelsFor(kind: ChannelKind): ChannelSpec[] {
+  return CHANNEL_BOARD.filter((row) => row.kind === kind)
+}
+
+export function wecomBound(room: string, bots: ReadonlyArray<{ room: string }>): boolean {
+  return bots.some((bot) => bot.room === room)
+}

package/src/client/api.ts

@@ -12,6 +12,7 @@ import {
   type RezUpdateApplyResult,
   type RezUpdateStatus,
   type RezWeixinStatus,
+  type RezWecomChannelsResponse,
 } from '../protocol.ts'
 
 export class RezApiError extends Error {
@@ -100,6 +101,20 @@ export class RezApi {
     return readJson<RezWeixinStatus>(response)
   }
 
+  async wecomChannels(): Promise<RezWecomChannelsResponse> {
+    const response = await fetch(REZ_API.wecomChannels)
+    return readJson<RezWecomChannelsResponse>(response)
+  }
+
+  async saveWecomChannels(bots: Array<{ room: string; botId: string; secret?: string }>): Promise<RezWecomChannelsResponse> {
+    const response = await fetch(REZ_API.wecomChannels, {
+      method: 'PUT',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ bots }),
+    })
+    return readJson<RezWecomChannelsResponse>(response)
+  }
+
   async updateStatus(): Promise<RezUpdateStatus> {
     const response = await fetch(REZ_API.update)
     return readJson<RezUpdateStatus>(response)