@soimy/dingtalk 3.5.3 → 3.6.1

package/src/config-schema.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { DEFAULT_MESSAGE_CONTEXT_TTL_DAYS } from "./message-context-store";
+import { buildSecretInputSchema } from "./secret-input";
 
 const AckReactionSchema = z.union([
   z.literal(""),
@@ -29,7 +30,7 @@ const DingTalkAccountConfigShape = {
   clientId: z.string().optional(),
 
   /** DingTalk App Secret (Client Secret) used to obtain DingTalk access tokens. */
-  clientSecret: z.string().optional(),
+  clientSecret: buildSecretInputSchema().optional(),
 
   /** Direct-message access policy: open, pairing, or allowlist. */
   dmPolicy: z.enum(["open", "pairing", "allowlist"]).optional().default("open"),
@@ -156,6 +157,25 @@ const DingTalkAccountConfigShape = {
    *  Set to a non-empty string (e.g. "✅ 回复完成") to enable — the value is used as the message text.
    *  Leave empty or omit to disable. */
   cardAtSender: z.string().optional(),
+
+  /** Status line visibility toggles for the AI card footer. */
+  cardStatusLine: z
+    .object({
+      /** Show model name. */
+      model: z.boolean().optional().default(true),
+      /** Show thinking effort level. */
+      effort: z.boolean().optional().default(true),
+      /** Show agent display name. */
+      agent: z.boolean().optional().default(true),
+      /** Show task elapsed time. */
+      taskTime: z.boolean().optional().default(false),
+      /** Show token usage summary (input/output/cache). */
+      tokens: z.boolean().optional().default(false),
+      /** Show DingTalk API call count. */
+      dapiUsage: z.boolean().optional().default(false),
+    })
+    .optional()
+    .default({ model: true, effort: true, agent: true, taskTime: false, tokens: false, dapiUsage: false }),
 } as const;
 
 const DingTalkAccountConfigSchema = z.object(DingTalkAccountConfigShape);

package/src/config.ts

@@ -1,17 +1,13 @@
-import * as os from "node:os";
-import * as path from "node:path";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/core";
-import type { DingTalkConfig } from "./types";
-
-const WINDOWS_ROOT_DIRECTORIES = new Set([
-  "Users",
-  "Program Files",
-  "Program Files (x86)",
-  "ProgramData",
-  "Windows",
-  "Documents and Settings",
-]);
+import {
+  formatSecretInputResolutionFailure,
+  hasConfiguredSecretInput,
+  resolveDingTalkSecretConfig,
+} from "./secret-input";
+import type { DingTalkChannelConfig, DingTalkConfig } from "./types";
+export { resolveRelativePath, resolveUserPath } from "./path-utils";
 const DEFAULT_LEARNING_NOTE_TTL_MS = 6 * 60 * 60 * 1000;
+export type RuntimeDingTalkConfig = Omit<DingTalkConfig, "clientSecret"> & { clientSecret: string };
 
 function normalizeLearningConfig(
   config: DingTalkConfig,
@@ -114,65 +110,26 @@ export function getConfig(cfg: OpenClawConfig, accountId?: string): DingTalkConf
 
 export function isConfigured(cfg: OpenClawConfig, accountId?: string): boolean {
   const config = getConfig(cfg, accountId);
-  return Boolean(config.clientId && config.clientSecret);
+  return Boolean(config.clientId && hasConfiguredSecretInput(config.clientSecret));
 }
 
-/**
- * Resolve relative paths against a base directory, with intelligent platform-specific handling.
- *
- * Supports:
- * - ~ and ~/ expansion to home directory
- * - Absolute paths (Unix: /path, Windows: \path or C:\path)
- * - Relative paths resolved against cwd
- * - Windows absolute paths without drive letters (e.g., Users\name\.openclaw\file.txt)
- * - Mixed path separators (/ and \)
- *
- * @param input - The path string to resolve
- * @returns The resolved absolute path
- */
-export function resolveRelativePath(input: string): string {
-  const trimmed = input.trim();
-  if (!trimmed) {
-    return trimmed;
-  }
-
-  const segments = (value: string): string[] => value.split(/[\\/]+/).filter(Boolean);
-  const pathSegments = segments(trimmed);
-  const firstSegment = pathSegments[0];
-
-  // Expand bare "~" and "~/" or "~\\" prefixes into the user home directory.
-  if (trimmed === "~") {
-    return path.resolve(os.homedir());
-  }
-  if (trimmed.startsWith("~/") || trimmed.startsWith("~\\")) {
-    return path.resolve(os.homedir(), ...segments(trimmed.slice(2)));
-  }
-
-  if (process.platform === "win32") {
-    // On Windows, OpenClaw may drop the leading "\" from root-based paths like
-    // "Users\name\.openclaw\workspace\file.xlsx". Only recover paths that start
-    // with well-known root directories to avoid misclassifying ordinary relative paths.
-    if (/^[a-zA-Z]:[\\/]/.test(trimmed)) {
-      return path.win32.normalize(trimmed);
-    }
-    if (firstSegment && /^[a-zA-Z]:$/.test(firstSegment)) {
-      return path.win32.resolve(`${firstSegment}\\`, ...pathSegments.slice(1));
-    }
-    if (firstSegment && WINDOWS_ROOT_DIRECTORIES.has(firstSegment)) {
-      return path.win32.resolve("\\", ...pathSegments);
-    }
-  }
-  // Treat both "/" and "\\" as absolute root prefixes for cross-platform input.
-  if (/^[\\/]/.test(trimmed)) {
-    return path.resolve(path.sep, ...pathSegments);
+export async function resolveRuntimeConfig(
+  config: DingTalkConfig,
+  log?: { warn?: (message: string, data?: unknown) => void },
+): Promise<RuntimeDingTalkConfig> {
+  const resolved = await resolveDingTalkSecretConfig(config, log);
+  if (!resolved.clientId || !resolved.clientSecret) {
+    const secretFailure = resolved.clientSecretResolutionFailure
+      ? `: clientSecret resolution failed for ${formatSecretInputResolutionFailure(resolved.clientSecretResolutionFailure)}`
+      : "";
+    throw new Error(`DingTalk clientId and resolved clientSecret are required${secretFailure}`);
   }
-
-  // Resolve relative path against cwd; supports mixed separators and "..\\..".
-  return path.resolve(process.cwd(), ...pathSegments);
+  return {
+    ...resolved,
+    clientSecret: resolved.clientSecret,
+  };
 }
 
-export const resolveUserPath = resolveRelativePath;
-
 /**
  * Resolve the robot code used by DingTalk APIs.
  * DingTalk robotCode is always equal to clientId; this helper trims whitespace.
@@ -272,3 +229,119 @@ export function stripTargetPrefix(target: string): { targetId: string; isExplici
   }
   return { targetId: target, isExplicitUser: false };
 }
+
+// ============ Onboarding Helper Functions ============
+
+const DEFAULT_ACCOUNT_ID = "default";
+
+
+/**
+ * List all DingTalk account IDs from config
+ */
+export function listDingTalkAccountIds(cfg: OpenClawConfig): string[] {
+  const dingtalk = cfg.channels?.dingtalk as DingTalkChannelConfig | undefined;
+  if (!dingtalk) {
+    return [];
+  }
+
+  const accountIds: string[] = [];
+
+  if (dingtalk.clientId || dingtalk.clientSecret) {
+    accountIds.push(DEFAULT_ACCOUNT_ID);
+  }
+
+  if (dingtalk.accounts) {
+    accountIds.push(...Object.keys(dingtalk.accounts));
+  }
+
+  return accountIds;
+}
+
+/**
+ * Resolved DingTalk account with configuration status
+ */
+export interface ResolvedDingTalkAccount extends DingTalkConfig {
+  accountId: string;
+  configured: boolean;
+}
+
+/**
+ * Resolve a specific DingTalk account configuration
+ */
+export function resolveDingTalkAccount(
+  cfg: OpenClawConfig,
+  accountId?: string | null,
+): ResolvedDingTalkAccount {
+  const id = accountId || DEFAULT_ACCOUNT_ID;
+  const dingtalk = cfg.channels?.dingtalk as DingTalkChannelConfig | undefined;
+
+  if (id === DEFAULT_ACCOUNT_ID) {
+    const rawConfig: DingTalkConfig = {
+      clientId: dingtalk?.clientId ?? "",
+      clientSecret: dingtalk?.clientSecret ?? "",
+      name: dingtalk?.name,
+      enabled: dingtalk?.enabled,
+      dmPolicy: dingtalk?.dmPolicy,
+      groupPolicy: dingtalk?.groupPolicy,
+      allowFrom: dingtalk?.allowFrom,
+      groupAllowFrom: dingtalk?.groupAllowFrom,
+      displayNameResolution: dingtalk?.displayNameResolution,
+      contextVisibility: dingtalk?.contextVisibility,
+      journalTTLDays: dingtalk?.journalTTLDays,
+      ackReaction: dingtalk?.ackReaction,
+      debug: dingtalk?.debug,
+      messageType: dingtalk?.messageType,
+      cardTemplateId: dingtalk?.cardTemplateId,
+      cardTemplateKey: dingtalk?.cardTemplateKey,
+      groups: dingtalk?.groups,
+      accounts: dingtalk?.accounts,
+      maxConnectionAttempts: dingtalk?.maxConnectionAttempts,
+      initialReconnectDelay: dingtalk?.initialReconnectDelay,
+      maxReconnectDelay: dingtalk?.maxReconnectDelay,
+      reconnectJitter: dingtalk?.reconnectJitter,
+      maxReconnectCycles: dingtalk?.maxReconnectCycles,
+      reconnectDeadlineMs: dingtalk?.reconnectDeadlineMs,
+      useConnectionManager: dingtalk?.useConnectionManager,
+      mediaMaxMb: dingtalk?.mediaMaxMb,
+      keepAlive: dingtalk?.keepAlive,
+      bypassProxyForSend: dingtalk?.bypassProxyForSend,
+      proactivePermissionHint: dingtalk?.proactivePermissionHint,
+      cardStreamingMode: dingtalk?.cardStreamingMode,
+      cardRealTimeStream: dingtalk?.cardRealTimeStream,
+      cardStreamInterval: dingtalk?.cardStreamInterval,
+      aicardDegradeMs: dingtalk?.aicardDegradeMs,
+      learningEnabled: dingtalk?.learningEnabled,
+      learningAutoApply: dingtalk?.learningAutoApply,
+      learningNoteTtlMs: dingtalk?.learningNoteTtlMs,
+      convertMarkdownTables: dingtalk?.convertMarkdownTables,
+      cardAtSender: dingtalk?.cardAtSender,
+    };
+    const config = stripRemovedLegacyFields(rawConfig);
+    return {
+      ...config,
+      accountId: id,
+      configured: Boolean(config.clientId && hasConfiguredSecretInput(config.clientSecret)),
+    };
+  }
+
+  const accountConfig = dingtalk?.accounts?.[id];
+  if (accountConfig) {
+    const merged = mergeAccountWithDefaults(
+      dingtalk as DingTalkConfig,
+      accountConfig,
+    );
+    const publicMerged = stripRemovedLegacyFields(merged);
+    return {
+      ...publicMerged,
+      accountId: id,
+      configured: Boolean(merged.clientId && hasConfiguredSecretInput(merged.clientSecret)),
+    };
+  }
+
+  return {
+    clientId: "",
+    clientSecret: "",
+    accountId: id,
+    configured: false,
+  };
+}

package/src/device-registration.ts

@@ -0,0 +1,245 @@
+import { execFile } from "node:child_process";
+import httpClient from "./http-client.js";
+
+// ── Constants ──────────────────────────────────────────────────────────────
+
+const REGISTRATION_BASE_URL = "https://oapi.dingtalk.com";
+const REGISTRATION_SOURCE = "openClaw";
+const RETRY_WINDOW_MS = 120_000; // 2 minutes for transient errors
+
+// ── Types ──────────────────────────────────────────────────────────────────
+
+export class RegistrationError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "RegistrationError";
+  }
+}
+
+export interface RegistrationResult {
+  clientId: string;
+  clientSecret: string;
+}
+
+interface BeginResult {
+  deviceCode: string;
+  verificationUrl: string;
+  expiresIn: number;
+  interval: number;
+}
+
+type PollStatus = "WAITING" | "SUCCESS" | "FAIL" | "EXPIRED";
+
+interface PollResult {
+  status: PollStatus;
+  clientId?: string;
+  clientSecret?: string;
+  failReason?: string;
+}
+
+// ── Internal helpers ───────────────────────────────────────────────────────
+
+function asString(value: unknown): string {
+  return typeof value === "string" ? value : "";
+}
+
+async function apiPost(
+  path: string,
+  payload: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+  const url = `${REGISTRATION_BASE_URL}${path}`;
+  const resp = await httpClient.post(url, payload, { timeout: 15_000 });
+  const data = resp.data as Record<string, unknown>;
+  const errcode = data.errcode;
+  if (errcode !== undefined && errcode !== 0) {
+    const errmsg = asString(data.errmsg) || "unknown error";
+    throw new RegistrationError(`API error [${path}]: ${errmsg} (errcode=${typeof errcode === "number" ? errcode : asString(errcode)})`);
+  }
+  return data;
+}
+
+// ── Step 1: init → nonce ───────────────────────────────────────────────────
+
+async function initRegistration(): Promise<string> {
+  const data = await apiPost("/app/registration/init", { source: REGISTRATION_SOURCE });
+  const nonce = asString(data.nonce).trim();
+  if (!nonce) {
+    throw new RegistrationError("init response missing nonce");
+  }
+  return nonce;
+}
+
+// ── Step 2: begin → deviceCode + verificationUrl ───────────────────────────
+
+async function beginRegistration(nonce: string): Promise<BeginResult> {
+  const data = await apiPost("/app/registration/begin", { nonce });
+  const deviceCode = asString(data.device_code).trim();
+  const verificationUrl = asString(data.verification_uri_complete).trim();
+  if (!deviceCode) {
+    throw new RegistrationError("begin response missing device_code");
+  }
+  if (!verificationUrl) {
+    throw new RegistrationError("begin response missing verification_uri_complete");
+  }
+  return {
+    deviceCode,
+    verificationUrl,
+    expiresIn: Number(data.expires_in ?? 7200) || 7200,
+    interval: Math.max(Number(data.interval ?? 3) || 3, 2),
+  };
+}
+
+// ── Step 3: poll ───────────────────────────────────────────────────────────
+
+async function pollRegistration(deviceCode: string): Promise<PollResult> {
+  const data = await apiPost("/app/registration/poll", { device_code: deviceCode });
+  const raw = asString(data.status).trim().toUpperCase();
+  const status: PollStatus = ["WAITING", "SUCCESS", "FAIL", "EXPIRED"].includes(raw)
+    ? (raw as PollStatus)
+    : "FAIL";
+  return {
+    status,
+    clientId: asString(data.client_id).trim() || undefined,
+    clientSecret: asString(data.client_secret).trim() || undefined,
+    failReason: asString(data.fail_reason).trim() || undefined,
+  };
+}
+
+// ── Public API ─────────────────────────────────────────────────────────────
+
+export interface DeviceRegistrationSession {
+  verificationUrl: string;
+  waitForResult: (options?: {
+    onWaiting?: () => void;
+    signal?: AbortSignal;
+  }) => Promise<RegistrationResult>;
+}
+
+export async function beginDeviceRegistration(): Promise<DeviceRegistrationSession> {
+  const nonce = await initRegistration();
+  const { deviceCode, verificationUrl, expiresIn, interval } = await beginRegistration(nonce);
+
+  const waitForResult = async (options?: {
+    onWaiting?: () => void;
+    signal?: AbortSignal;
+  }): Promise<RegistrationResult> => {
+    const deadline = Date.now() + expiresIn * 1000;
+    let networkRetryStart = 0;
+    let statusRetryStart = 0;
+
+    const signal = options?.signal;
+    let abortHandler: (() => void) | null = null;
+    const abortPromise = signal
+      ? new Promise<never>((_resolve, reject) => {
+          abortHandler = () => reject(new RegistrationError("registration cancelled"));
+          signal.addEventListener("abort", abortHandler, { once: true });
+        })
+      : null;
+    // Suppress unhandled rejection when abort fires outside Promise.race
+    abortPromise?.catch(() => {});
+
+    const sleep = () =>
+      new Promise((resolve) => setTimeout(resolve, interval * 1000));
+
+    try {
+      while (Date.now() < deadline) {
+        if (signal?.aborted) {
+          throw new RegistrationError("registration cancelled");
+        }
+
+        // AbortSignal-aware sleep
+        await (abortPromise ? Promise.race([sleep(), abortPromise]) : sleep());
+
+        // Check again after sleep — abort may have fired during sleep
+        if (signal?.aborted) {
+          throw new RegistrationError("registration cancelled");
+        }
+
+        let result: PollResult;
+        try {
+          result = await pollRegistration(deviceCode);
+        } catch {
+          if (!networkRetryStart) {
+            networkRetryStart = Date.now();
+          }
+          if (Date.now() - networkRetryStart < RETRY_WINDOW_MS) {
+            continue;
+          }
+          throw new RegistrationError("registration polling failed after retry window");
+        }
+
+        // Successful poll resets network retry window
+        networkRetryStart = 0;
+
+        const { status } = result;
+
+        if (status === "WAITING") {
+          statusRetryStart = 0;
+          options?.onWaiting?.();
+          continue;
+        }
+
+        if (status === "SUCCESS") {
+          const clientId = result.clientId;
+          const clientSecret = result.clientSecret;
+          if (!clientId || !clientSecret) {
+            throw new RegistrationError("authorization succeeded but credentials are missing");
+          }
+          return { clientId, clientSecret };
+        }
+
+        if (status === "EXPIRED") {
+          throw new RegistrationError("authorization expired, please restart registration");
+        }
+
+        // FAIL — retry within window
+        if (!statusRetryStart) {
+          statusRetryStart = Date.now();
+        }
+        if (Date.now() - statusRetryStart < RETRY_WINDOW_MS) {
+          continue;
+        }
+        throw new RegistrationError(`authorization failed: ${result.failReason ?? status}`);
+      }
+
+      throw new RegistrationError("authorization timed out, please retry");
+    } finally {
+      if (abortHandler && signal) {
+        signal.removeEventListener("abort", abortHandler);
+      }
+    }
+  };
+
+  return { verificationUrl, waitForResult };
+}
+
+// ── Browser helper ─────────────────────────────────────────────────────────
+
+export function openUrlInBrowser(url: string): void {
+  // Validate URL before handing to OS launcher
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" || !parsed.hostname.endsWith(".dingtalk.com")) {
+      return;
+    }
+  } catch {
+    return;
+  }
+
+  const platform = process.platform;
+  let bin: string;
+  let args: string[];
+  if (platform === "darwin") {
+    bin = "open";
+    args = [url];
+  } else if (platform === "win32") {
+    bin = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    bin = "xdg-open";
+    args = [url];
+  }
+  execFile(bin, args, (err) => {
+    void err;
+  });
+}