@xmanrui/dsh-im 0.13.0 → 0.14.0

package/plugin-src/client/i18n.js

@@ -8,6 +8,51 @@ const EN = Object.freeze({
   'IM机器人设置': 'IM bot settings',
   'IM 渠道': 'IM channels',
   '让 DeepSeek Harness 触手可及': 'DeepSeek Harness, always within reach',
+  'AI Office': 'AI Office',
+  'AI Office 设置': 'AI Office settings',
+  'AI Office 设置页缺少 RPC 连接': 'AI Office settings are missing an RPC connection',
+  '正在读取 AI Office Connector…': 'Loading AI Office Connector…',
+  '本机主动连接公网 Office；Harness 不开放端口。协议 Hook 固定为 ': 'This machine connects outward to the public Office; Harness exposes no port. Protocol hooks: ',
+  '尚未配置': 'Not configured',
+  '已连接 Office': 'Connected to Office',
+  '已配置': 'Configured',
+  '等待重连': 'Waiting to reconnect',
+  '凭据缺失': 'Credential missing',
+  '最近心跳': 'Last heartbeat',
+  '最近事件': 'Last event',
+  '重连次数': 'Reconnects',
+  '运行 Job': 'Running Jobs',
+  '完成 Job': 'Completed Jobs',
+  '尚无': 'None yet',
+  '设备连接': 'Device connection',
+  'Token 只写入本机凭据存储': 'Token is written only to the local credential store',
+  '粘贴 Office 一次性凭据': 'Paste the one-time Office credential',
+  '已安全保存；留空保持不变': 'Stored securely; leave blank to keep it',
+  '最大并发': 'Max concurrency',
+  'Heartbeat 秒数': 'Heartbeat seconds',
+  'Workspace 映射': 'Workspace mappings',
+  '每行 alias=/本机/绝对路径；Office 只能看到 alias。': 'One alias=/local/absolute/path per line; Office sees only aliases.',
+  'Instruction Preset 映射': 'Instruction preset mappings',
+  '每行 alias=指令；新增 preset 不需要改 Office 代码。': 'One alias=instruction per line; new presets require no Office code change.',
+  '保存并连接': 'Save and connect',
+  '测试连接': 'Test connection',
+  '测试中…': 'Testing…',
+  '重新连接': 'Reconnect',
+  '移除连接': 'Remove connection',
+  '连接测试通过。': 'Connection test passed.',
+  '配置已保存。': 'Configuration saved.',
+  '协议 Hook 预览': 'Protocol hook preview',
+  '由 Base URL 自动派生，不单独填写': 'Derived from Base URL; no separate input',
+  'Base URL 无效': 'Invalid Base URL',
+  'Office Hook 尚未部署时，配置会安全保存并自动重试；出现 HTTP 404 代表协议端点待上线，不代表 Harness 故障。': 'Configuration is saved and retried while Office hooks are unavailable; HTTP 404 means the protocol endpoint is pending, not a Harness failure.',
+  'Workspace 映射每行必须使用 alias=value': 'Each workspace mapping must use alias=value',
+  'Instruction Preset 映射每行必须使用 alias=value': 'Each instruction preset mapping must use alias=value',
+  'action-items=转换为负责人、截止和验收明确的工单': 'action-items=Turn this into accountable tasks with deadlines and acceptance criteria',
+  'AI Office 拒绝了 Device Token。': 'AI Office rejected the Device Token.',
+  'AI Office Connector Hook 尚未就绪。': 'AI Office Connector hooks are not available yet.',
+  'AI Office Connector 协议版本不兼容。': 'The AI Office Connector protocol is incompatible.',
+  '本机暂时无法访问 AI Office。': 'AI Office cannot currently be reached from this machine.',
+  'AI Office 连接已中断。': 'The AI Office connection was interrupted.',
   '帮助与反馈 · 前往 GitHub': 'Help & feedback · Open GitHub',
   '微信': 'WeChat',
   '飞书': 'Feishu',
@@ -236,6 +281,29 @@ const EN = Object.freeze({
   '接入 Telegram 机器人': 'Connect a Telegram bot',
   '先通过 @BotFather 获取 Bot Token，再在这里完成接入。': 'Get a Bot Token from @BotFather, then connect it here.',
   '填写 @BotFather 生成的 Bot Token': 'Enter the Bot Token from @BotFather',
+  '访问模式': 'Access mode',
+  '访问设置': 'Access settings',
+  'Telegram 访问模式': 'Telegram access mode',
+  '查看 Telegram 访问模式说明': 'View Telegram access mode details',
+  '群聊全部忽略，私聊仅允许白名单用户。': 'All group messages are ignored; only allowlisted users may send DMs.',
+  '保持原有行为：私聊直接响应，群聊在被提及或回复时响应。': 'Keep the original behavior: respond to DMs and to group mentions or replies.',
+  '安全模式': 'Safe mode',
+  '兼容模式': 'Compatible mode',
+  '已生效：安全模式': 'Active: Safe mode',
+  '已生效：兼容模式': 'Active: Compatible mode',
+  '模式': 'Mode',
+  '兼容模式（默认）': 'Compatible mode (default)',
+  '安全模式（私聊白名单）': 'Safe mode (private-chat allowlist)',
+  '允许私聊的 Telegram User ID': 'Telegram User IDs allowed to send DMs',
+  '每行一个数字 User ID': 'One numeric User ID per line',
+  '白名单仅属于当前机器人。': 'This allowlist belongs only to the current bot.',
+  '兼容模式下暂不使用白名单，切换模式时会保留。': 'Compatible mode does not enforce the allowlist; it is retained when modes change.',
+  '白名单为空；保存后该机器人会拒绝所有入站消息。': 'The allowlist is empty; this bot will reject all inbound messages after saving.',
+  '正在保存…': 'Saving…',
+  '保存访问设置': 'Save access settings',
+  'User ID 必须是 1–16 位正整数，每行一个。': 'Each User ID must be a 1–16 digit positive integer on its own line.',
+  'Telegram 访问设置暂不可用。': 'Telegram access settings are currently unavailable.',
+  'Telegram 访问设置保存失败。': 'Could not save Telegram access settings.',
   '接入 Discord 机器人': 'Connect a Discord bot',
   '先在 Developer Portal 创建 Bot 并邀请到服务器，再在这里完成接入。': 'Create a bot in the Developer Portal and invite it to your server, then connect it here.',
   '填写 Discord Developer Portal 的 Bot Token': 'Enter the Bot Token from the Discord Developer Portal',

package/plugin-src/client/index.js

@@ -4,6 +4,7 @@ import {
   DingtalkLogoGlyph,
   DiscordLogoGlyph,
   FeishuLogoGlyph,
+  OfficeLogoGlyph,
   QqLogoGlyph,
   SlackLogoGlyph,
   TelegramLogoGlyph,
@@ -22,6 +23,9 @@ import { installFeishuStyles } from './channels/feishu/styles.js';
 import { QQ_RPC_CHANNEL } from './channels/qq/api.js';
 import { QqSettingsTab } from './channels/qq/index.js';
 import { installQqStyles } from './channels/qq/styles.js';
+import { OFFICE_RPC_CHANNEL } from './channels/office/api.js';
+import { OfficeSettingsTab } from './channels/office/index.js';
+import { installOfficeStyles } from './channels/office/styles.js';
 import { SLACK_RPC_CHANNEL } from './channels/slack/api.js';
 import { SlackSettingsTab } from './channels/slack/index.js';
 import { installSlackStyles } from './channels/slack/styles.js';
@@ -44,8 +48,6 @@ import { WorkspaceDirectoryPickerContext } from './workspace-editor.js';
 export const name = 'im-settings';
 export const inject = ['slots', 'connection', 'locale', 'workspaces'];
 
-const IM_PLUGIN_LOGO_URL = globalThis.__DSH_IM_LOGO_DATA_URL__ ?? 'assets/logo-icon.png';
-
 const CHANNELS = Object.freeze([
   { id: 'weixin', label: '微信' },
   { id: 'feishu', label: '飞书' },
@@ -56,6 +58,7 @@ const CHANNELS = Object.freeze([
   { id: 'telegram', label: 'Telegram' },
   { id: 'discord', label: 'Discord' },
   { id: 'whatsapp', label: 'WhatsApp' },
+  { id: 'office', label: 'AI Office' },
 ]);
 
 function WeixinLogo() {
@@ -101,6 +104,11 @@ function WhatsappLogo() {
     h(WhatsappLogoGlyph));
 }
 
+function OfficeLogo() {
+  return h('span', { className: 'dim-logo dim-logoOffice', 'aria-hidden': 'true' },
+    h(OfficeLogoGlyph));
+}
+
 function ChannelLogo({ channel }) {
   if (channel === 'weixin') return h(WeixinLogo);
   if (channel === 'feishu') return h(FeishuLogo);
@@ -110,7 +118,8 @@ function ChannelLogo({ channel }) {
   if (channel === 'slack') return h(SlackLogo);
   if (channel === 'telegram') return h(TelegramLogo);
   if (channel === 'discord') return h(DiscordLogo);
-  return h(WhatsappLogo);
+  if (channel === 'whatsapp') return h(WhatsappLogo);
+  return h(OfficeLogo);
 }
 
 export function IMSettingsTab({
@@ -123,6 +132,7 @@ export function IMSettingsTab({
   wecomRpcCall,
   weixinRpcCall,
   whatsappRpcCall,
+  officeRpcCall,
   workspaceDirectoryPicker,
 }) {
   const [selected, setSelected] = React.useState('weixin');
@@ -132,13 +142,7 @@ export function IMSettingsTab({
     h('section', { className: 'dim-page', 'aria-label': 'IM机器人设置' },
     h('header', { className: 'dim-title' },
       h('div', { className: 'dim-brand' },
-        h('img', {
-          className: 'dim-brandLogo',
-          src: IM_PLUGIN_LOGO_URL,
-          alt: 'dsh-im',
-          width: 48,
-          height: 48,
-        }),
+        h('strong', { className: 'dim-brandName' }, 'DSH-IM'),
         h('p', null, '让 DeepSeek Harness 触手可及')),
       h('span', { className: 'dim-githubAction' },
         h('a', {
@@ -195,7 +199,9 @@ export function IMSettingsTab({
                   ? h(TelegramSettingsTab, { rpcCall: telegramRpcCall })
                   : active.id === 'discord'
                     ? h(DiscordSettingsTab, { rpcCall: discordRpcCall })
-                    : h(WhatsappSettingsTab, { rpcCall: whatsappRpcCall })),
+                    : active.id === 'whatsapp'
+                      ? h(WhatsappSettingsTab, { rpcCall: whatsappRpcCall })
+                      : h(OfficeSettingsTab, { rpcCall: officeRpcCall })),
     ),
   ));
 }
@@ -218,6 +224,7 @@ export function apply(ctx) {
       installTelegramStyles(),
       installDiscordStyles(),
       installWhatsappStyles(),
+      installOfficeStyles(),
       installImStyles(),
     ];
     return () => {
@@ -243,6 +250,8 @@ export function apply(ctx) {
     ctx.connection.rpc.call(WHATSAPP_RPC_CHANNEL, endpoint, payload, signal);
   const slackRpcCall = (endpoint, payload, signal) =>
     ctx.connection.rpc.call(SLACK_RPC_CHANNEL, endpoint, payload, signal);
+  const officeRpcCall = (endpoint, payload, signal) =>
+    ctx.connection.rpc.call(OFFICE_RPC_CHANNEL, endpoint, payload, signal);
   const workspaceDirectoryPicker = Object.freeze({
     listDirectory: (path, signal) => ctx.workspaces.listDirectory(path, signal),
     pickDirectory: () => ctx.workspaces.pickDirectory(),
@@ -264,6 +273,7 @@ export function apply(ctx) {
       wecomRpcCall,
       weixinRpcCall,
       whatsappRpcCall,
+      officeRpcCall,
       workspaceDirectoryPicker,
     }),
   }, IMSettingsTab));

package/plugin-src/client/styles.js

@@ -12,9 +12,9 @@ const CSS = String.raw`
 }
 .dim-page *, .dim-page *::before, .dim-page *::after { box-sizing: border-box; }
 .dim-title { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin: 0 0 18px; }
-.dim-brand { min-width: 0; display: flex; align-items: center; gap: 12px; }
-.dim-brandLogo { width: 48px; height: 48px; flex: 0 0 48px; display: block; object-fit: contain; filter: grayscale(1) contrast(1.08); }
-.dim-title p { margin: 0; color: var(--dsw-alias-label-primary, #1f2329); font-size: 14px; line-height: 20px; font-weight: 600; white-space: nowrap; }
+.dim-brand { min-width: 0; display: flex; flex-direction: column; align-items: flex-start; gap: 1px; }
+.dim-brandName { color: var(--dsw-alias-label-primary, #1f2329); font-size: 20px; line-height: 24px; font-weight: 800; letter-spacing: .04em; }
+.dim-title p { margin: 0; color: var(--dsw-alias-label-secondary, #646a73); font-size: 12px; line-height: 18px; font-weight: 500; white-space: nowrap; }
 .dim-githubAction { position: relative; display: inline-flex; flex: none; }
 .dim-githubLink { min-height: 30px; display: inline-flex; align-items: center; gap: 5px; flex: none; padding: 0 10px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 8px; color: var(--dsw-alias-label-secondary, #646a73); background: var(--dsw-alias-bg-layer-1, #fff); font-size: 12px; line-height: normal; font-weight: 560; text-decoration: none; transition: border-color .15s ease, color .15s ease, background .15s ease; }
 .dim-githubLink:hover { border-color: #aeb3bb; color: var(--dsw-alias-label-primary, #1f2329); background: var(--dsw-alias-interactive-bg-hover, #f7f8fa); }
@@ -44,6 +44,8 @@ const CSS = String.raw`
 .dim-logoWecom svg { width: 22px; height: 22px; }
 .dim-logoTelegram { color: white; background: #229ed9; }
 .dim-logoTelegram svg { width: 21px; height: 21px; }
+.dim-logoOffice { color: white; background: linear-gradient(145deg, #12213f, #3964fe); }
+.dim-logoOffice svg { width: 23px; height: 23px; }
 .dim-logoDiscord { color: white; background: #5865f2; }
 .dim-logoDiscord svg { width: 21px; height: 21px; }
 .dim-logoSlack { color: white; background: #4a154b; }

package/plugin-src/host/channels/office/index.mjs

@@ -0,0 +1,10 @@
+import { createProductionController } from './production.mjs';
+import { installOfficeRpc } from './rpc.mjs';
+
+export async function apply(ctx, config = {}) {
+  if (config.controller) return installOfficeRpc(ctx, config.controller, config.rpcAuthority);
+  const production = await createProductionController(ctx, config, config.internals ?? {});
+  const dispose = installOfficeRpc(ctx, production.controller, config.rpcAuthority);
+  ctx.effect(() => async () => production.close(), 'dsh-im: close AI Office connector');
+  return dispose;
+}

package/plugin-src/host/channels/office/production.mjs

@@ -0,0 +1,45 @@
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+
+import { OfficeConfigStore } from '../../../../src/channels/office/config-store.mjs';
+import { OfficeController } from '../../../../src/channels/office/office-controller.mjs';
+import { OfficeRuntime } from '../../../../src/channels/office/office-runtime.mjs';
+import { HarnessClient } from '../../../../src/channels/shared/harness-client.mjs';
+import { harnessOrigin } from '../shared/production.mjs';
+
+export function officePaths(config = {}) {
+  const dshHome = resolve(config.dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh'));
+  const root = resolve(config.dataDir ?? join(dshHome, 'integrations', 'dsh-office'));
+  return { root, config: resolve(config.configPath ?? join(root, 'config.json')) };
+}
+
+export async function createProductionController(ctx, config = {}, internals = {}) {
+  const Store = internals.ConfigStore ?? OfficeConfigStore;
+  const Controller = internals.Controller ?? OfficeController;
+  const Runtime = internals.Runtime ?? OfficeRuntime;
+  const ResolvedHarness = internals.HarnessClient ?? HarnessClient;
+  const paths = officePaths(config);
+  const configStore = await new Store(paths.config).load();
+  const logger = typeof ctx.logger === 'function' ? ctx.logger('dsh-im:office') : (ctx.logger ?? console);
+  const harnessBaseUrl = harnessOrigin(ctx.webServer, config.harnessBaseUrl);
+  const createHarness = internals.createHarness ?? (({ workspace }) => new ResolvedHarness({
+    baseUrl: harnessBaseUrl,
+    workspace,
+    autostart: false,
+    dshBin: config.dshBin ?? 'dsh',
+    rpcIdPrefix: 'office',
+    logPrefix: 'dsh-im:office',
+  }));
+  const controller = new Controller({
+    credentials: ctx.credentials,
+    configStore,
+    logger,
+    createRuntime: (options) => new Runtime({
+      ...options,
+      createHarness,
+      ...(internals.transport ? { transport: internals.transport } : {}),
+    }),
+  });
+  await controller.initialize();
+  return { controller, close: () => controller.close(), paths };
+}

package/plugin-src/host/channels/office/rpc.mjs

@@ -0,0 +1,48 @@
+import { resolveRpcAuthority } from '../../rpc-authority.mjs';
+import { OFFICE_RPC_CHANNEL, OFFICE_RPC_ENDPOINTS } from '../../../../src/channels/office/protocol.mjs';
+
+function record(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+function exact(value, keys) { return record(value) && Object.keys(value).every((key) => keys.includes(key)); }
+
+function validConfigure(payload) {
+  return exact(payload, [
+    'baseUrl', 'deviceId', 'deviceToken', 'maxConcurrency', 'heartbeatSeconds',
+    'workspaces', 'instructionPresets',
+  ]) && typeof payload.baseUrl === 'string' && typeof payload.deviceId === 'string'
+    && (payload.deviceToken === undefined || typeof payload.deviceToken === 'string')
+    && record(payload.workspaces) && record(payload.instructionPresets);
+}
+
+export function createOfficeRpcHandler(controller) {
+  for (const method of ['status', 'configure', 'reconnect', 'test', 'remove']) {
+    if (typeof controller?.[method] !== 'function') throw new TypeError(`AI Office controller requires ${method}()`);
+  }
+  return async (endpoint, payload, signal) => {
+    if (signal?.aborted) return { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.' } };
+    try {
+      let value;
+      if (endpoint === OFFICE_RPC_ENDPOINTS.status && exact(payload, [])) value = await controller.status();
+      else if (endpoint === OFFICE_RPC_ENDPOINTS.configure && validConfigure(payload)) value = await controller.configure(payload);
+      else if (endpoint === OFFICE_RPC_ENDPOINTS.reconnect && exact(payload, [])) value = await controller.reconnect();
+      else if (endpoint === OFFICE_RPC_ENDPOINTS.test && exact(payload, [])) value = await controller.test();
+      else if (endpoint === OFFICE_RPC_ENDPOINTS.remove && exact(payload, ['confirm']) && payload.confirm === true) value = await controller.remove();
+      else return { ok: false, error: { code: 'bad-request', message: 'Invalid AI Office connector request.' } };
+      return { ok: true, value };
+    } catch (error) {
+      const code = error?.code === 'invalid-device-token' ? 'invalid-device-token'
+        : error?.code === 'office-hook-unavailable' ? 'office-hook-unavailable' : 'office-operation-failed';
+      const message = code === 'invalid-device-token' ? 'AI Office Device Token 无效。'
+        : code === 'office-hook-unavailable' ? 'AI Office Hook 尚未上线或地址不正确。'
+          : error instanceof TypeError ? error.message : 'AI Office 连接操作失败，请稍后重试。';
+      return { ok: false, error: { code, message } };
+    }
+  };
+}
+
+export function installOfficeRpc(ctx, controller, authority) {
+  return ctx.connection.rpc.handle(
+    OFFICE_RPC_CHANNEL,
+    createOfficeRpcHandler(controller),
+    { authority: resolveRpcAuthority(authority) },
+  );
+}

package/plugin-src/host/channels/shared/production.mjs

@@ -32,7 +32,9 @@ export function pluginPaths(config, channel) {
 }
 
 export async function createTokenProductionController(ctx, config, internals, definitions) {
-  const { channel, ConfigStore, StateStore, HarnessClient, Controller, Runtime } = definitions;
+  const {
+    channel, ConfigStore, StateStore, HarnessClient, Controller, Runtime, runtimeOptions,
+  } = definitions;
   if (!ctx?.credentials) throw new TypeError(`dsh-im ${channel} requires ctx.credentials`);
   if (!ctx?.webServer) throw new TypeError(`dsh-im ${channel} requires ctx.webServer`);
 
@@ -41,6 +43,11 @@ export async function createTokenProductionController(ctx, config, internals, de
   const ResolvedHarness = internals.HarnessClient ?? HarnessClient;
   const ResolvedController = internals.Controller ?? Controller;
   const ResolvedRuntime = internals.Runtime ?? Runtime;
+  const channelRuntimeOptions = typeof runtimeOptions === 'function' ? runtimeOptions(config) : {};
+  if (!channelRuntimeOptions || typeof channelRuntimeOptions !== 'object'
+    || Array.isArray(channelRuntimeOptions)) {
+    throw new TypeError(`dsh-im ${channel} runtimeOptions must return an object`);
+  }
   const createSupervisor = internals.createConnectionSupervisor ?? createTokenConnectionSupervisor;
   const logger = typeof ctx.logger === 'function'
     ? ctx.logger(`dsh-im:${channel}`) : (ctx.logger ?? console);
@@ -91,6 +98,7 @@ export async function createTokenProductionController(ctx, config, internals, de
       await workspaces.ensure(botId);
       const workspaceScope = createBotWorkspaceScope(harness, { botId, workspaces, state });
       return new ResolvedRuntime({
+        ...channelRuntimeOptions,
         config: botConfig,
         token,
         harness: workspaceScope.harness,

package/plugin-src/host/channels/telegram/production.mjs

@@ -5,6 +5,8 @@ import { TelegramRuntime } from '../../../../src/channels/telegram/telegram-runt
 import { TelegramStateStore } from '../../../../src/channels/telegram/state-store.mjs';
 import { createTokenProductionController } from '../shared/production.mjs';
 
+export { normalizeTelegramAllowedUsers } from '../../../../src/channels/telegram/config-store.mjs';
+
 export function createProductionController(ctx, config = {}, internals = {}) {
   return createTokenProductionController(ctx, config, internals, {
     channel: 'telegram',

package/plugin-src/host/channels/telegram/rpc.mjs

@@ -1,21 +1,71 @@
 import {
   TOKEN_BOT_ENDPOINTS,
   createTokenBotRpcHandler,
-  installTokenBotRpc,
 } from '../shared/rpc.mjs';
+import { resolveRpcAuthority } from '../../rpc-authority.mjs';
+import { normalizeTelegramAccessPolicy } from '../../../../src/channels/telegram/config-store.mjs';
 
 export const TELEGRAM_RPC_CHANNEL = '/telegram';
-export const TELEGRAM_ENDPOINTS = TOKEN_BOT_ENDPOINTS;
+export const TELEGRAM_ENDPOINTS = Object.freeze({
+  ...TOKEN_BOT_ENDPOINTS,
+  setAccessPolicy: 'bot.access-policy.set',
+});
 export const TELEGRAM_RPC_ENDPOINTS = Object.freeze(Object.values(TELEGRAM_ENDPOINTS));
 
 export function createTelegramRpcHandler(controller) {
-  return createTokenBotRpcHandler(controller, { channel: 'Telegram' });
+  if (typeof controller?.setAccessPolicy !== 'function') {
+    throw new TypeError('A complete Telegram controller is required (setAccessPolicy)');
+  }
+  const sharedHandler = createTokenBotRpcHandler(controller, { channel: 'Telegram' });
+  return async (endpoint, payload, signal) => {
+    if (endpoint !== TELEGRAM_ENDPOINTS.setAccessPolicy) {
+      return sharedHandler(endpoint, payload, signal);
+    }
+    if (signal?.aborted) {
+      return { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.' } };
+    }
+    const keys = payload && typeof payload === 'object' && !Array.isArray(payload)
+      ? Object.keys(payload) : [];
+    if (keys.length !== 3 || !keys.every((key) => (
+      ['botId', 'accessMode', 'allowedUsers'].includes(key)
+    )) || typeof payload.botId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(payload.botId)) {
+      return {
+        ok: false,
+        error: { code: 'bad-request', message: 'bot.access-policy.set requires a valid policy.' },
+      };
+    }
+    let accessPolicy;
+    try {
+      accessPolicy = normalizeTelegramAccessPolicy(payload);
+    } catch {
+      return {
+        ok: false,
+        error: { code: 'bad-request', message: '请输入有效的 Telegram 访问模式和数字 User ID。' },
+      };
+    }
+    try {
+      const value = await controller.setAccessPolicy(payload.botId, accessPolicy);
+      return signal?.aborted
+        ? { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.' } }
+        : { ok: true, value };
+    } catch {
+      return signal?.aborted
+        ? { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.' } }
+        : {
+            ok: false,
+            error: { code: 'telegram-operation-failed', message: 'Telegram 操作失败，请稍后重试。' },
+          };
+    }
+  };
 }
 
 export function installTelegramRpc(ctx, controller, authority) {
-  return installTokenBotRpc(ctx, controller, {
-    channel: 'Telegram',
-    rpcChannel: TELEGRAM_RPC_CHANNEL,
-    authority,
-  });
+  if (!ctx?.connection?.rpc || typeof ctx.connection.rpc.handle !== 'function') {
+    throw new TypeError('DSH Host Connection RPC is required');
+  }
+  return ctx.connection.rpc.handle(
+    TELEGRAM_RPC_CHANNEL,
+    createTelegramRpcHandler(controller),
+    { authority: resolveRpcAuthority(authority) },
+  );
 }

package/plugin-src/host/index.mjs

@@ -1,5 +1,6 @@
 import { apply as applyDingtalk } from './channels/dingtalk/index.mjs';
 import { apply as applyDiscord } from './channels/discord/index.mjs';
+import { apply as applyOffice } from './channels/office/index.mjs';
 import { apply as applyFeishu } from './channels/feishu/index.mjs';
 import { apply as applyQq } from './channels/qq/index.mjs';
 import { apply as applySlack } from './channels/slack/index.mjs';
@@ -27,6 +28,7 @@ export function createImHostPlugin(internals = {}) {
   const startSlack = internals.applySlack ?? applySlack;
   const startTelegram = internals.applyTelegram ?? applyTelegram;
   const startDiscord = internals.applyDiscord ?? applyDiscord;
+  const startOffice = internals.applyOffice ?? applyOffice;
   const startWhatsapp = internals.applyWhatsapp ?? applyWhatsapp;
   return Object.freeze({
     name,
@@ -41,6 +43,7 @@ export function createImHostPlugin(internals = {}) {
       await startTelegram(ctx, channelConfig(config, 'telegram'));
       await startDiscord(ctx, channelConfig(config, 'discord'));
       await startWhatsapp(ctx, channelConfig(config, 'whatsapp'));
+      await startOffice(ctx, channelConfig(config, 'office'));
     },
   });
 }

package/src/channels/discord/discord-api.mjs

@@ -108,7 +108,7 @@ export class DiscordApi {
         headers: {
           authorization: `Bot ${this.#token}`,
           'content-type': 'application/json',
-          'user-agent': 'DeepSeek-Harness-dsh-im (https://github.com/xmanrui/dsh-im, 0.13.0)',
+          'user-agent': 'DeepSeek-Harness-dsh-im (https://github.com/xmanrui/dsh-im, 0.14.0)',
         },
         ...(body === undefined ? {} : { body: JSON.stringify(body) }),
         signal: requestSignal(signal, timeoutMs),

package/src/channels/office/config-store.mjs

@@ -0,0 +1,107 @@
+import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute } from 'node:path';
+
+import { normalizeOfficeBaseUrl, OFFICE_PROTOCOL_VERSION } from './protocol.mjs';
+
+const ALIAS = /^[a-z][a-z0-9-]{1,63}$/;
+const DEVICE_ID = /^[a-z0-9][a-z0-9_-]{2,63}$/i;
+
+function cleanString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function normalizeMap(value, { kind }) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const output = {};
+  for (const [rawId, rawValue] of Object.entries(value)) {
+    const id = cleanString(rawId);
+    const item = cleanString(rawValue);
+    if (!id || !ALIAS.test(id) || !item) return null;
+    if (kind === 'workspace' && !isAbsolute(item)) return null;
+    if (kind === 'preset' && item.length > 8_000) return null;
+    output[id] = item;
+  }
+  return Object.freeze(output);
+}
+
+export function normalizeOfficeConfig(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  let baseUrl;
+  try {
+    baseUrl = normalizeOfficeBaseUrl(value.baseUrl).origin;
+  } catch {
+    return null;
+  }
+  const deviceId = cleanString(value.deviceId);
+  const deviceTokenRef = cleanString(value.deviceTokenRef);
+  const workspaces = normalizeMap(value.workspaces ?? {}, { kind: 'workspace' });
+  const instructionPresets = normalizeMap(value.instructionPresets ?? {}, { kind: 'preset' });
+  const maxConcurrency = Number(value.maxConcurrency ?? 1);
+  const heartbeatSeconds = Number(value.heartbeatSeconds ?? 30);
+  if (!deviceId || !DEVICE_ID.test(deviceId) || !deviceTokenRef
+    || !/^DSH_OFFICE_DEVICE_TOKEN_[A-F0-9]{24}$/.test(deviceTokenRef)
+    || !workspaces || !instructionPresets
+    || !Number.isInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4
+    || !Number.isInteger(heartbeatSeconds) || heartbeatSeconds < 10 || heartbeatSeconds > 300) {
+    return null;
+  }
+  return Object.freeze({
+    version: 1,
+    protocolVersion: OFFICE_PROTOCOL_VERSION,
+    baseUrl,
+    deviceId,
+    deviceTokenRef,
+    maxConcurrency,
+    heartbeatSeconds,
+    workspaces,
+    instructionPresets,
+    createdAt: cleanString(value.createdAt) ?? new Date().toISOString(),
+    updatedAt: cleanString(value.updatedAt) ?? new Date().toISOString(),
+  });
+}
+
+export class OfficeConfigStore {
+  #path;
+  #value = null;
+  #queue = Promise.resolve();
+
+  constructor(path) { this.#path = path; }
+
+  async load() {
+    try {
+      const normalized = normalizeOfficeConfig(JSON.parse(await readFile(this.#path, 'utf8')));
+      if (!normalized) throw new Error('dsh-im AI Office config is invalid');
+      this.#value = normalized;
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+      this.#value = null;
+    }
+    return this;
+  }
+
+  get() { return this.#value ? structuredClone(this.#value) : null; }
+
+  async save(value) {
+    const normalized = normalizeOfficeConfig(value);
+    if (!normalized) throw new Error('Refusing to persist invalid AI Office configuration');
+    const operation = this.#queue.then(async () => {
+      await mkdir(dirname(this.#path), { recursive: true, mode: 0o700 });
+      const temporary = `${this.#path}.tmp`;
+      await writeFile(temporary, `${JSON.stringify(normalized, null, 2)}\n`, { mode: 0o600 });
+      await rename(temporary, this.#path);
+      this.#value = normalized;
+    });
+    this.#queue = operation.then(() => undefined, () => undefined);
+    await operation;
+    return this.get();
+  }
+
+  async clear() {
+    const operation = this.#queue.then(async () => {
+      try { await unlink(this.#path); } catch (error) { if (error?.code !== 'ENOENT') throw error; }
+      this.#value = null;
+    });
+    this.#queue = operation.then(() => undefined, () => undefined);
+    await operation;
+  }
+}