@vicfei/dsh-super-agent 0.7.0 → 0.8.1

package/dist/telegram.js

@@ -0,0 +1,134 @@
+// Telegram channel (v0.8.1, issue #51) — the official Bot API, the simplest of the five
+// channels: one token from @BotFather, documented HTTP long-poll (getUpdates + offset cursor)
+// and sendMessage. The bot's own username comes from getMe, so group @mention detection is
+// precise with zero manual config (the Slack auth.test pattern). Bots never receive their own
+// sends — the echo filter remains as the second layer.
+export const TELEGRAM_DEFAULT_BASE = "https://api.telegram.org";
+export class TelegramClient {
+    fetchImpl;
+    base;
+    token;
+    constructor(opts) {
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+        this.base = (opts.baseUrl ?? TELEGRAM_DEFAULT_BASE).replace(/\/$/, "");
+        this.token = opts.token;
+    }
+    async call(method, body, signal) {
+        const res = await this.fetchImpl(`${this.base}/bot${this.token}/${method}`, {
+            method: "POST",
+            signal,
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        if (!res.ok)
+            throw new Error(`telegram ${method} → HTTP ${res.status}`);
+        const data = (await res.json());
+        if (data.ok === false)
+            throw new Error(`telegram ${method}: ${data.description ?? "not ok"}`);
+        return data;
+    }
+    getMe() {
+        return this.call("getMe", {});
+    }
+    getUpdates(offset, timeoutSec, signal) {
+        return this.call("getUpdates", { offset, timeout: timeoutSec, allowed_updates: ["message"] }, signal);
+    }
+    sendMessage(chatId, text) {
+        return this.call("sendMessage", { chat_id: chatId, text });
+    }
+}
+// ── trigger mapping ─────────────────────────────────────────────────────────────
+export function telegramTriggerFromMessage(m, botUsername) {
+    const chatId = m.chat?.id;
+    const msgId = m.message_id;
+    if (chatId === undefined || msgId === undefined)
+        return null;
+    const isPrivate = m.chat?.type === "private";
+    const text = m.text ?? m.caption ?? "";
+    const addressing = isPrivate ? true // a DM is inherently addressed
+        : botUsername ? (m.text ?? "").includes(`@${botUsername}`)
+            : false; // unknown bot username → fail closed (inferred via listedNotAddressing remains)
+    const login = m.from?.username ?? (m.from?.id !== undefined ? String(m.from.id) : "unknown");
+    return {
+        id: `telegram:msg/${chatId}/${msgId}`,
+        source: "telegram",
+        scope: isPrivate ? "im_dm" : "im_group",
+        threadId: `telegram:chat/${chatId}`,
+        author: { login, isBot: m.from?.is_bot === true },
+        addressing,
+        body: m.text !== undefined ? text : text ? `[caption] ${text}` : "",
+        ts: m.date ? new Date(m.date * 1000).toISOString() : new Date().toISOString(),
+    };
+}
+export class TelegramSource {
+    opts;
+    kind = "telegram";
+    botUsername;
+    me = null;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    discoverMe() {
+        this.me ??= (async () => {
+            const client = new TelegramClient({ token: this.opts.token, ...(this.opts.baseUrl ? { baseUrl: this.opts.baseUrl } : {}), ...(this.opts.fetchImpl ? { fetchImpl: this.opts.fetchImpl } : {}) });
+            try {
+                const me = await client.getMe();
+                this.botUsername = me.result?.username;
+                this.opts.log?.(`[telegram] bot @${this.botUsername ?? "?"} — group @mention detection ${this.botUsername ? "armed" : "unavailable (fail-closed)"}`);
+            }
+            catch (e) {
+                this.opts.log?.(`[telegram] getMe failed: ${e instanceof Error ? e.message : e} — group @mentions fail closed until it succeeds`);
+            }
+        })();
+        return this.me;
+    }
+    async collect(from, opts = {}) {
+        await this.discoverMe();
+        const client = new TelegramClient({ token: this.opts.token, ...(this.opts.baseUrl ? { baseUrl: this.opts.baseUrl } : {}), ...(this.opts.fetchImpl ? { fetchImpl: this.opts.fetchImpl } : {}) });
+        const abort = new AbortController();
+        const timer = setTimeout(() => abort.abort(), this.opts.pollTimeoutMs ?? 8000);
+        let updates;
+        try {
+            const res = await client.getUpdates(this.opts.loadOffset(), Math.floor((this.opts.pollTimeoutMs ?? 8000) / 1000), abort.signal);
+            updates = res.result ?? [];
+        }
+        catch (e) {
+            if (abort.signal.aborted)
+                return { triggers: [], next: from }; // our own timeout — offset hasn't moved, lossless
+            throw e;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const triggers = [];
+        for (const u of updates) {
+            if (u.update_id !== undefined)
+                this.opts.saveOffset(u.update_id + 1);
+            const t = u.message ? telegramTriggerFromMessage(u.message, this.botUsername) : null;
+            if (t && !opts.exclude?.has(t.id))
+                triggers.push(t);
+        }
+        return { triggers, next: from };
+    }
+}
+// ── ReplyChannel ────────────────────────────────────────────────────────────────
+export class TelegramReplyChannel {
+    clientOf;
+    chatIdOf;
+    constructor(clientOf, chatIdOf) {
+        this.clientOf = clientOf;
+        this.chatIdOf = chatIdOf;
+    }
+    matches(threadId) {
+        return threadId.startsWith("telegram:");
+    }
+    async deliver(threadId, body) {
+        const chatId = this.chatIdOf(threadId);
+        const res = await this.clientOf().sendMessage(chatId, body);
+        const msgId = res.result?.message_id;
+        if (msgId === undefined)
+            throw new Error("telegram sendMessage returned no message_id");
+        return { externalId: `msg/${chatId}/${msgId}` };
+    }
+}
+//# sourceMappingURL=telegram.js.map

package/dist/telegram.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram.js","sourceRoot":"","sources":["../src/telegram.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,8FAA8F;AAC9F,2FAA2F;AAC3F,8FAA8F;AAC9F,uDAAuD;AAKvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAuBhE,MAAM,OAAO,cAAc;IACR,SAAS,CAAe;IACxB,IAAI,CAAS;IACb,KAAK,CAAS;IAE/B,YAAY,IAA2B;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,MAAc,EAAE,IAA6B,EAAE,MAAoB;QACvF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+C,CAAC;QAC9E,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,MAAM,KAAK,IAAI,CAAC,WAAW,IAAI,QAAQ,EAAE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,UAAkB,EAAE,MAAoB;QACjE,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACxG,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,IAAY;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,mFAAmF;AAEnF,MAAM,UAAU,0BAA0B,CAAC,CAAY,EAAE,WAAoB;IAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC;IAC3B,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GACd,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B;QAChD,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC;YAC1D,CAAC,CAAC,KAAK,CAAC,CAAC,gFAAgF;IAC3F,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7F,OAAO;QACL,EAAE,EAAE,gBAAgB,MAAM,IAAI,KAAK,EAAE;QACrC,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;QACvC,QAAQ,EAAE,iBAAiB,MAAM,EAAE;QACnC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAAE;QACjD,UAAU;QACV,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QACnE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC9E,CAAC;AACJ,CAAC;AAgBD,MAAM,OAAO,cAAc;IAKI;IAJpB,IAAI,GAAG,UAAmB,CAAC;IAC5B,WAAW,CAAqB;IAChC,EAAE,GAAyB,IAAI,CAAC;IAExC,YAA6B,IAA2B;QAA3B,SAAI,GAAJ,IAAI,CAAuB;IAAG,CAAC;IAEpD,UAAU;QAChB,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAChM,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,IAAI,CAAC,WAAW,IAAI,GAAG,+BAA+B,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAC,CAAC;YACvJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC;YACpI,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAiB,EAAE,OAA0C,EAAE;QAC3E,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChM,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;QAC/E,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAChI,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,kDAAkD;YACjH,MAAM,CAAC,CAAC;QACV,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;CACF;AAED,mFAAmF;AAEnF,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAFnB,YACmB,QAA8B,EAC9B,QAAsC;QADtC,aAAQ,GAAR,QAAQ,CAAsB;QAC9B,aAAQ,GAAR,QAAQ,CAA8B;IACtD,CAAC;IAEJ,OAAO,CAAC,QAAgB;QACtB,OAAO,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,IAAY;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxF,OAAO,EAAE,UAAU,EAAE,OAAO,MAAM,IAAI,KAAK,EAAE,EAAE,CAAC;IAClD,CAAC;CACF"}

package/dist/usage.d.ts

@@ -1,4 +1,4 @@
-export declare const USAGE = "dsh-super-agent \u2014 admission control, observe mode & tickets for any CLI coding agent\n\nUsage: dsh-super-agent <command> [options]\n\nCommands:\n  poll      one pass: poll GitHub \u2192 gate \u2192 (assessment) \u2192 record; --post also drains queued replies\n  work      claim queued tickets \u2192 run the executor in a worktree \u2192 report\n  watch     poll + work + panel as one daemon (Ctrl-C stops after the current cycle)\n  tickets   list tickets; \"tickets stop <id>\" ends one\n  panel     serve the awaiting-human panel (http://127.0.0.1:8787)\n  merge     sweep open ticket PRs \u2014 merge those meeting policy.merge requirements (default off)\n  help      show this usage\n\nCommon options:\n  --repo owner/name         repository to watch\n  --agent-login <login>     the agent's GitHub login (mention detection)\n  --config <file>           policy config        (default policy.json, auto-scaffolded from examples/)\n  --executor-config <file>  executor config      (default executor.json, auto-scaffolded from examples/)\n  --db <file>               state database       (default .state/engine.db)\n  --token <token>           GitHub token (or env GITHUB_TOKEN)\n  --assessment <mode>       stub-positive | stub-negative | llm\n  --interval <seconds>      watch poll interval (\u00B120% jitter)\n  --no-panel                watch without the panel server\n  --post                    poll also posts queued replies (needs a token)\n\nEnvironment: GITHUB_TOKEN, or GitHub App auth (GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY[_PATH],\noptional GITHUB_APP_INSTALLATION_ID), ASSESS_BASE_URL, ASSESS_MODEL, ASSESS_API_KEY, PANEL_PORT.\nDocs: https://github.com/vicfei/dsh-super-agent#quick-start";
+export declare const USAGE = "dsh-super-agent \u2014 admission control, observe mode & tickets for any CLI coding agent\n\nUsage: dsh-super-agent <command> [options]\n\nCommands:\n  poll      one pass: poll GitHub \u2192 gate \u2192 (assessment) \u2192 record; --post also drains queued replies\n  work      claim queued tickets \u2192 run the executor in a worktree \u2192 report\n  watch     poll + work + panel as one daemon (Ctrl-C stops after the current cycle)\n  tickets   list tickets; \"tickets stop <id>\" ends one\n  panel     serve the awaiting-human panel (http://127.0.0.1:8787)\n  merge     sweep open ticket PRs \u2014 merge those meeting policy.merge requirements (default off)\n  wechat-login  iLink QR login: scan with WeChat, credentials land in the engine db\n  help      show this usage\n\nCommon options:\n  --repo owner/name         repository to watch\n  --agent-login <login>     the agent's GitHub login (mention detection)\n  --config <file>           policy config        (default policy.json, auto-scaffolded from examples/)\n  --executor-config <file>  executor config      (default executor.json, auto-scaffolded from examples/)\n  --db <file>               state database       (default .state/engine.db)\n  --token <token>           GitHub token (or env GITHUB_TOKEN)\n  --assessment <mode>       stub-positive | stub-negative | llm\n  --interval <seconds>      watch poll interval (\u00B120% jitter)\n  --no-panel                watch without the panel server\n  --post                    poll also posts queued replies (needs a token)\n\nEnvironment: GITHUB_TOKEN, or GitHub App auth (GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY[_PATH],\noptional GITHUB_APP_INSTALLATION_ID); Feishu channel (FEISHU_APP_ID + FEISHU_APP_SECRET,\noptional FEISHU_BOT_OPEN_ID); Slack channel (SLACK_BOT_TOKEN + SLACK_APP_TOKEN);\nTelegram channel (TELEGRAM_BOT_TOKEN); ASSESS_BASE_URL, ASSESS_MODEL, ASSESS_API_KEY, PANEL_PORT.\nDocs: https://github.com/vicfei/dsh-super-agent#quick-start";
 export declare function examplePath(name: string): string | null;
 /** Copy the packaged example to `target` when neither exists yet. True ⇒ caller should tell the user to edit & rerun. */
 export declare function scaffoldFromExample(target: string, example: string): boolean;

package/dist/usage.js

@@ -15,6 +15,7 @@ Commands:
   tickets   list tickets; "tickets stop <id>" ends one
   panel     serve the awaiting-human panel (http://127.0.0.1:8787)
   merge     sweep open ticket PRs — merge those meeting policy.merge requirements (default off)
+  wechat-login  iLink QR login: scan with WeChat, credentials land in the engine db
   help      show this usage
 
 Common options:
@@ -30,7 +31,9 @@ Common options:
   --post                    poll also posts queued replies (needs a token)
 
 Environment: GITHUB_TOKEN, or GitHub App auth (GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY[_PATH],
-optional GITHUB_APP_INSTALLATION_ID), ASSESS_BASE_URL, ASSESS_MODEL, ASSESS_API_KEY, PANEL_PORT.
+optional GITHUB_APP_INSTALLATION_ID); Feishu channel (FEISHU_APP_ID + FEISHU_APP_SECRET,
+optional FEISHU_BOT_OPEN_ID); Slack channel (SLACK_BOT_TOKEN + SLACK_APP_TOKEN);
+Telegram channel (TELEGRAM_BOT_TOKEN); ASSESS_BASE_URL, ASSESS_MODEL, ASSESS_API_KEY, PANEL_PORT.
 Docs: https://github.com/vicfei/dsh-super-agent#quick-start`;
 const examplesDir = join(dirname(fileURLToPath(import.meta.url)), "..", "examples");
 export function examplePath(name) {

package/dist/usage.js.map

@@ -1 +1 @@
-{"version":3,"file":"usage.js","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4FAA4F;AAC5F,yEAAyE;AAEzE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;4DA2BuC,CAAC;AAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AAEpF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,OAAe;IACjE,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;;;uGAG0E,CAAC"}
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4FAA4F;AAC5F,yEAAyE;AAEzE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4DA8BuC,CAAC;AAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AAEpF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,OAAe;IACjE,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;;;uGAG0E,CAAC"}

package/dist/watch.d.ts

@@ -1,14 +1,17 @@
 import type { Policy, Trigger } from "./domain.js";
 import type { Engine } from "./engine.js";
-import type { GitHubSource } from "./github/source.js";
+import type { ReplyChannel, Source } from "./source.js";
 import type { Executor } from "./executor.js";
 import type { GitHubClient } from "./github/client.js";
 export type AssessmentFn = (t: Trigger) => Promise<"positive" | "negative"> | "positive" | "negative";
 export interface WatchOptions {
     engine: Engine;
-    source: GitHubSource;
+    /** All sources, polled each cycle (v0.8); each keeps its own read state in the engine. */
+    sources: Source[];
     executor: Executor;
     client: GitHubClient | null;
+    /** Reply routes by threadId prefix (v0.8). */
+    channels: ReplyChannel[];
     repo: string;
     policy: Policy;
     assessment: AssessmentFn;

package/dist/watch.js

@@ -32,21 +32,25 @@ export async function runWatch(opts) {
     }
 }
 async function runCycle(opts, log) {
-    const { engine, source, executor, client, repo, policy } = opts;
-    const { triggers, next } = await source.collect(engine.positions(), { exclude: engine.selfPosted() });
+    const { engine, executor, client, channels, repo, policy } = opts;
     const batch = [];
-    for (const t of triggers)
-        batch.push(classify(t, policy, await opts.assessment(t)));
+    const nextBySource = {};
+    for (const source of opts.sources) {
+        const { triggers, next } = await source.collect(engine.sourceState(source.kind), { exclude: engine.selfPosted() });
+        nextBySource[source.kind] = next;
+        for (const t of triggers)
+            batch.push(classify(t, policy, await opts.assessment(t)));
+    }
     for (const outcome of batch)
         log(formatOutcome(outcome));
-    const report = engine.ingest(batch, next);
+    const report = engine.ingest(batch, nextBySource);
     for (const refusal of report.refusals)
         log(`[REFUSED] ${refusal}`);
-    const reports = await runWork(engine, executor, repo, client);
+    const reports = await runWork(engine, executor, repo, client, channels);
     for (const r of reports)
         log(`#${r.ticketId} [${r.outcome}] ${r.detail}`);
     // Auto-merge sweep (M6-1) — no-op unless policy.merge.enabled; structural brakes inside.
-    const merged = client ? await runMergeSweep(engine, client, repo, policy, (l) => log(`[merge] ${l}`)) : [];
+    const merged = client ? await runMergeSweep(engine, client, repo, policy, channels, (l) => log(`[merge] ${l}`)) : [];
     if (batch.length > 0 || reports.length > 0 || report.refusals.length > 0 || merged.length > 0) {
         log(`— cycle: fresh=${report.fresh} opened=${report.ticketsOpened} resumed=${report.resumed} joined=${report.joined} worked=${reports.length} merged=${merged.length}`);
         return true;

package/dist/watch.js.map

@@ -1 +1 @@
-{"version":3,"file":"watch.js","sourceRoot":"","sources":["../src/watch.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,qFAAqF;AACrF,mFAAmF;AACnF,iEAAiE;AAOjE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiBpC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE9B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7F,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,SAAS,GAAG,CAAC,CAAC,CAAC,kDAAkD;YACjE,IAAI,SAAS;gBAAE,SAAS,CAAC,qDAAqD;QAChF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,SAAS,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;YAC7E,GAAG,CAAC,iBAAiB,KAAK,YAAY,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM;QACxE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAkB,EAAE,GAAwB;IAClE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEtG,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,KAAK,MAAM,OAAO,IAAI,KAAK;QAAE,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;QAAE,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAEnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1E,yFAAyF;IACzF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3G,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,kBAAkB,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,aAAa,YAAY,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxK,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../src/watch.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,qFAAqF;AACrF,mFAAmF;AACnF,iEAAiE;AAOjE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBpC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE9B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7F,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,SAAS,GAAG,CAAC,CAAC,CAAC,kDAAkD;YACjE,IAAI,SAAS;gBAAE,SAAS,CAAC,qDAAqD;QAChF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,SAAS,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;YAC7E,GAAG,CAAC,iBAAiB,KAAK,YAAY,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM;QACxE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAkB,EAAE,GAAwB;IAClE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAElE,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,MAAM,YAAY,GAAgC,EAAE,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACnH,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,KAAK;QAAE,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;QAAE,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAEnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1E,yFAAyF;IACzF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,kBAAkB,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,aAAa,YAAY,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxK,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/wechat.d.ts

@@ -0,0 +1,142 @@
+import type { Trigger } from "./domain.js";
+import type { ReplyChannel, Source, SourceState } from "./source.js";
+export declare const WECHAT_DEFAULT_BASE = "https://ilinkai.weixin.qq.com";
+export interface WeixinMessage {
+    message_id?: string;
+    seq?: number;
+    from_user_id?: string;
+    to_user_id?: string;
+    session_id?: string;
+    group_id?: string;
+    /** 1 = USER, 2 = BOT. */
+    message_type?: number;
+    create_time_ms?: number;
+    item_list?: {
+        type?: number;
+        text_item?: {
+            text?: string;
+        };
+    }[];
+    context_token?: string;
+}
+export interface GetUpdatesResp {
+    ret?: number;
+    errcode?: number;
+    errmsg?: string;
+    msgs?: WeixinMessage[];
+    get_updates_buf?: string;
+}
+export interface SendMessageResp {
+    ret?: number;
+    errmsg?: string;
+    message_id?: string;
+}
+export interface WechatAuth {
+    token: string;
+    baseUrl: string;
+}
+export interface WechatRoute {
+    toUserId: string;
+    groupId?: string;
+    sessionId?: string;
+    contextToken: string;
+}
+export interface WechatStore {
+    loadAuth(): WechatAuth | null;
+    saveAuth(auth: WechatAuth): void;
+    loadCursor(): string;
+    saveCursor(buf: string): void;
+    loadRoute(threadId: string): WechatRoute | null;
+    saveRoute(threadId: string, route: WechatRoute): void;
+    /** Session expired (-14): drop everything, a new QR scan is required. */
+    clearAll(): void;
+}
+export declare class MemoryWechatStore implements WechatStore {
+    private auth;
+    private cursor;
+    private readonly routes;
+    loadAuth(): WechatAuth | null;
+    saveAuth(auth: WechatAuth): void;
+    loadCursor(): string;
+    saveCursor(buf: string): void;
+    loadRoute(threadId: string): WechatRoute | null;
+    saveRoute(threadId: string, route: WechatRoute): void;
+    clearAll(): void;
+}
+/** Production store over the engine's kv (same db as the tickets — one backup story). */
+export declare class EngineWechatStore implements WechatStore {
+    private readonly kv;
+    constructor(kv: {
+        kvGet(k: string): string | null;
+        kvSet(k: string, v: string): void;
+        kvDelete(k: string): void;
+    });
+    loadAuth(): WechatAuth | null;
+    saveAuth(auth: WechatAuth): void;
+    loadCursor(): string;
+    saveCursor(buf: string): void;
+    loadRoute(threadId: string): WechatRoute | null;
+    saveRoute(threadId: string, route: WechatRoute): void;
+    clearAll(): void;
+}
+export interface WechatClientOptions {
+    token: string;
+    baseUrl?: string;
+    apiBase?: string;
+    fetchImpl?: typeof fetch;
+}
+export declare class WechatApiClient {
+    private readonly fetchImpl;
+    private readonly base;
+    private readonly token;
+    constructor(opts: WechatClientOptions);
+    private post;
+    getUpdates(getUpdatesBuf: string, signal?: AbortSignal): Promise<GetUpdatesResp>;
+    sendMessage(msg: WeixinMessage): Promise<SendMessageResp>;
+}
+export interface QrPayload {
+    qrcode: string;
+    imgBase64: string;
+}
+/**
+ * QR login flow: fetch a QR (the caller renders/saves the image — it must be scanned by the
+ * human's WeChat app), long-poll status until confirmed, return credentials.
+ */
+export declare function wechatLogin(onQr: (qr: QrPayload) => void, opts?: {
+    apiBase?: string;
+    fetchImpl?: typeof fetch;
+    pollMs?: number;
+}): Promise<WechatAuth>;
+/** threadId for a message: groups are threads; a DM peer is a thread. */
+export declare function wechatThreadId(m: WeixinMessage): string;
+export declare function wechatTriggerFromMessage(m: WeixinMessage): Trigger | null;
+export interface WechatSourceOptions {
+    store: WechatStore;
+    /** Abort the long-poll after this many ms so a watch cycle is never blocked (default 8s). */
+    pollTimeoutMs?: number;
+    apiBase?: string;
+    fetchImpl?: typeof fetch;
+    log?: (l: string) => void;
+}
+export declare class WechatSource implements Source {
+    private readonly opts;
+    readonly kind: "wechat";
+    private warnedNoAuth;
+    constructor(opts: WechatSourceOptions);
+    collect(from: SourceState, opts?: {
+        exclude?: ReadonlySet<string>;
+    }): Promise<{
+        triggers: Trigger[];
+        next: SourceState;
+    }>;
+}
+export declare class WechatReplyChannel implements ReplyChannel {
+    private readonly store;
+    private readonly clientOf;
+    private readonly log;
+    constructor(store: WechatStore, clientOf: (auth: WechatAuth) => WechatApiClient, log?: (l: string) => void);
+    matches(threadId: string): boolean;
+    deliver(threadId: string, body: string): Promise<{
+        externalId: string;
+    }>;
+}

package/dist/wechat.js

@@ -0,0 +1,262 @@
+// WeChat channel (v0.8 M8-4, issue #45) — the iLink Bot Protocol: an HTTP, Telegram-bot-shaped
+// API on WeChat's own domain (ilinkai.weixin.qq.com), documented at wechatbot.dev/zh/protocol
+// and mirrored by the wire types of weixin-agent-sdk (derived from @tencent-weixin/openclaw-weixin).
+// Zero reverse-engineering: QR login → bot_token, long-poll getupdates with an opaque cursor,
+// sendmessage echoing the per-peer context_token. Text-first; media/AES is a later slice.
+//
+// Persistence is injected (Engine kv in production, in-memory in tests): credentials, the
+// getupdates cursor, and per-thread reply routes {toUserId, groupId, sessionId, contextToken}.
+import { randomBytes } from "node:crypto";
+export const WECHAT_DEFAULT_BASE = "https://ilinkai.weixin.qq.com";
+export class MemoryWechatStore {
+    auth = null;
+    cursor = "";
+    routes = new Map();
+    loadAuth() { return this.auth; }
+    saveAuth(auth) { this.auth = auth; }
+    loadCursor() { return this.cursor; }
+    saveCursor(buf) { this.cursor = buf; }
+    loadRoute(threadId) { return this.routes.get(threadId) ?? null; }
+    saveRoute(threadId, route) { this.routes.set(threadId, route); }
+    clearAll() { this.auth = null; this.cursor = ""; this.routes.clear(); }
+}
+/** Production store over the engine's kv (same db as the tickets — one backup story). */
+export class EngineWechatStore {
+    kv;
+    constructor(kv) {
+        this.kv = kv;
+    }
+    loadAuth() {
+        try {
+            const raw = this.kv.kvGet("wechat_auth");
+            return raw ? JSON.parse(raw) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    saveAuth(auth) {
+        this.kv.kvSet("wechat_auth", JSON.stringify(auth));
+    }
+    loadCursor() {
+        return this.kv.kvGet("wechat_cursor") ?? "";
+    }
+    saveCursor(buf) {
+        this.kv.kvSet("wechat_cursor", buf);
+    }
+    loadRoute(threadId) {
+        try {
+            const raw = this.kv.kvGet(`wechat_route:${threadId}`);
+            return raw ? JSON.parse(raw) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    saveRoute(threadId, route) {
+        this.kv.kvSet(`wechat_route:${threadId}`, JSON.stringify(route));
+        const index = new Set((this.kv.kvGet("wechat_route_index") ?? "").split("\n").filter(Boolean));
+        index.add(threadId);
+        this.kv.kvSet("wechat_route_index", [...index].join("\n"));
+    }
+    clearAll() {
+        // route keys are namespaced; policy/positions keys are unaffected
+        this.kv.kvGet("wechat_route_index")?.split("\n").filter(Boolean).forEach((k) => this.kv.kvDelete(`wechat_route:${k}`));
+        this.kv.kvSet("wechat_route_index", "");
+        this.kv.kvDelete("wechat_auth");
+        this.kv.kvDelete("wechat_cursor");
+    }
+}
+// ── API client ──────────────────────────────────────────────────────────────────
+/** X-WECHAT-UIN: random uint32 → decimal string → base64, fresh per request. */
+function randomWechatUin() {
+    return Buffer.from(String(randomBytes(4).readUInt32BE(0) >>> 0)).toString("base64");
+}
+const BOT_AGENT = "dsh-super-agent/0.8.0";
+export class WechatApiClient {
+    fetchImpl;
+    base;
+    token;
+    constructor(opts) {
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+        this.base = (opts.baseUrl ?? opts.apiBase ?? WECHAT_DEFAULT_BASE).replace(/\/$/, "");
+        this.token = opts.token;
+    }
+    async post(path, body, signal) {
+        const res = await this.fetchImpl(`${this.base}/${path}`, {
+            method: "POST",
+            signal,
+            headers: {
+                "content-type": "application/json",
+                AuthorizationType: "ilink_bot_token",
+                Authorization: `Bearer ${this.token}`,
+                "X-WECHAT-UIN": randomWechatUin(),
+            },
+            body: JSON.stringify({ ...body, base_info: { channel_version: "2.0.0", bot_agent: BOT_AGENT } }),
+        });
+        if (!res.ok)
+            throw new Error(`wechat ${path} → HTTP ${res.status}`);
+        return (await res.json());
+    }
+    getUpdates(getUpdatesBuf, signal) {
+        return this.post("ilink/bot/getupdates", { get_updates_buf: getUpdatesBuf }, signal);
+    }
+    sendMessage(msg) {
+        return this.post("ilink/bot/sendmessage", { msg });
+    }
+}
+/**
+ * QR login flow: fetch a QR (the caller renders/saves the image — it must be scanned by the
+ * human's WeChat app), long-poll status until confirmed, return credentials.
+ */
+export async function wechatLogin(onQr, opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const base = (opts.apiBase ?? WECHAT_DEFAULT_BASE).replace(/\/$/, "");
+    const headers = {
+        "content-type": "application/json",
+        AuthorizationType: "ilink_bot_token",
+        "X-WECHAT-UIN": randomWechatUin(),
+    };
+    const qrRes = await fetchImpl(`${base}/ilink/bot/get_bot_qrcode?bot_type=3`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ local_token_list: [] }),
+    });
+    if (!qrRes.ok)
+        throw new Error(`wechat get_bot_qrcode → HTTP ${qrRes.status}`);
+    const qr = (await qrRes.json());
+    if (!qr.qrcode)
+        throw new Error("wechat get_bot_qrcode returned no qrcode");
+    onQr({ qrcode: qr.qrcode, imgBase64: qr.qrcode_img_content ?? "" });
+    for (;;) {
+        await new Promise((r) => setTimeout(r, opts.pollMs ?? 2000));
+        const stRes = await fetchImpl(`${base}/ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(qr.qrcode)}`, { headers });
+        if (!stRes.ok)
+            throw new Error(`wechat get_qrcode_status → HTTP ${stRes.status}`);
+        const st = (await stRes.json());
+        if (st.status === "confirmed" && st.bot_token) {
+            return { token: st.bot_token, baseUrl: st.baseurl ?? base };
+        }
+        if (st.status === "expired")
+            throw new Error("wechat QR expired — run wechat-login again");
+        // wait | scaned → keep polling
+    }
+}
+// ── trigger mapping ─────────────────────────────────────────────────────────────
+/** threadId for a message: groups are threads; a DM peer is a thread. */
+export function wechatThreadId(m) {
+    return m.group_id ? `wechat:group/${m.group_id}` : `wechat:peer/${m.from_user_id ?? "unknown"}`;
+}
+export function wechatTriggerFromMessage(m) {
+    if (m.message_type === 2)
+        return null; // BOT traffic (incl. our own) — never a work request
+    if (!m.message_id && m.seq === undefined)
+        return null;
+    const firstText = m.item_list?.find((i) => i.type === 1)?.text_item?.text;
+    const anyItem = m.item_list?.[0];
+    const body = firstText ?? (anyItem?.type !== undefined && anyItem.type !== 1 ? `[${anyItem.type}]` : "");
+    const isGroup = m.group_id !== undefined;
+    return {
+        id: `wechat:msg/${m.message_id ?? `seq-${m.seq}`}`,
+        source: "wechat",
+        scope: isGroup ? "im_group" : "im_dm",
+        threadId: wechatThreadId(m),
+        author: { login: m.from_user_id ?? "unknown", isBot: false }, // message_type 2 already excluded
+        // DMs are inherently addressed; group @mention text format is not reliably parseable in
+        // this protocol — fail closed (allowed-list members still produce inferred).
+        addressing: !isGroup,
+        body,
+        ts: m.create_time_ms ? new Date(m.create_time_ms).toISOString() : new Date().toISOString(),
+    };
+}
+export class WechatSource {
+    opts;
+    kind = "wechat";
+    warnedNoAuth = false;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async collect(from, opts = {}) {
+        const auth = this.opts.store.loadAuth();
+        if (!auth) {
+            if (!this.warnedNoAuth) {
+                this.warnedNoAuth = true;
+                this.opts.log?.("[wechat] not logged in — run `wechat-login` with the same --db to arm this source");
+            }
+            return { triggers: [], next: from };
+        }
+        const client = new WechatApiClient({ token: auth.token, baseUrl: auth.baseUrl, ...(this.opts.apiBase ? { apiBase: this.opts.apiBase } : {}), ...(this.opts.fetchImpl ? { fetchImpl: this.opts.fetchImpl } : {}) });
+        const abort = new AbortController();
+        const timer = setTimeout(() => abort.abort(), this.opts.pollTimeoutMs ?? 8000);
+        let resp;
+        try {
+            resp = await client.getUpdates(this.opts.store.loadCursor(), abort.signal);
+        }
+        catch (e) {
+            if (abort.signal.aborted)
+                return { triggers: [], next: from }; // long-poll cut short by our own timeout — lossless, the cursor hasn't moved
+            throw e;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (resp.ret === 0) {
+            if (resp.get_updates_buf)
+                this.opts.store.saveCursor(resp.get_updates_buf);
+            const triggers = [];
+            for (const m of resp.msgs ?? []) {
+                // remember how to reply into this thread — the context_token is the routing key
+                if (m.from_user_id && m.context_token) {
+                    this.opts.store.saveRoute(wechatThreadId(m), {
+                        toUserId: m.from_user_id,
+                        ...(m.group_id ? { groupId: m.group_id } : {}),
+                        ...(m.session_id ? { sessionId: m.session_id } : {}),
+                        contextToken: m.context_token,
+                    });
+                }
+                const t = wechatTriggerFromMessage(m);
+                if (t && !opts.exclude?.has(t.id))
+                    triggers.push(t);
+            }
+            return { triggers, next: from };
+        }
+        if (resp.errcode === -14 || resp.ret === -14) {
+            this.opts.store.clearAll();
+            this.opts.log?.("[wechat] session expired (-14) — state cleared, run `wechat-login` again");
+            return { triggers: [], next: from };
+        }
+        throw new Error(`wechat getupdates ret=${resp.ret} errcode=${resp.errcode ?? "-"}: ${resp.errmsg ?? ""}`.trim());
+    }
+}
+// ── ReplyChannel ────────────────────────────────────────────────────────────────
+export class WechatReplyChannel {
+    store;
+    clientOf;
+    log;
+    constructor(store, clientOf, log = () => { }) {
+        this.store = store;
+        this.clientOf = clientOf;
+        this.log = log;
+    }
+    matches(threadId) {
+        return threadId.startsWith("wechat:");
+    }
+    async deliver(threadId, body) {
+        const auth = this.store.loadAuth();
+        const route = this.store.loadRoute(threadId);
+        if (!auth || !route)
+            throw new Error(`no wechat route for thread ${threadId} (not logged in, or the thread never sent us a message)`);
+        const resp = await this.clientOf(auth).sendMessage({
+            to_user_id: route.toUserId,
+            ...(route.groupId ? { group_id: route.groupId } : {}),
+            ...(route.sessionId ? { session_id: route.sessionId } : {}),
+            message_type: 2, // BOT
+            item_list: [{ type: 1, text_item: { text: body } }],
+            context_token: route.contextToken, // "回复时必须原样回传" — routes the reply
+        });
+        if (resp.ret !== 0)
+            throw new Error(`wechat sendmessage ret=${resp.ret}: ${resp.errmsg ?? ""}`.trim());
+        return { externalId: `msg/${resp.message_id ?? "unknown"}` };
+    }
+}
+//# sourceMappingURL=wechat.js.map