@xmanrui/dsh-im 0.13.0 → 0.15.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xmanrui/dsh-im",
-  "version": "0.13.0",
-  "description": "通过扫码或机器人凭据把IM机器人接入DeepSeek Harness（支持飞书、微信、钉钉、企业微信、QQ、Slack、Telegram、Discord和WhatsApp）。 Connect IM bots to DeepSeek Harness via QR code or credentials (9 channels).",
+  "version": "0.15.0",
+  "description": "把九种 IM 机器人和公网 AI Office 接入本机 DeepSeek Harness。 Connect nine IM channels and a public AI Office to a local DeepSeek Harness.",
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -19,7 +19,8 @@
     "slack",
     "telegram",
     "discord",
-    "whatsapp"
+    "whatsapp",
+    "ai-office"
   ],
   "author": {
     "name": "xmanrui",

package/plugin-src/client/build.mjs

@@ -1,4 +1,4 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -8,8 +8,6 @@ const sourceDirectory = dirname(fileURLToPath(import.meta.url));
 const packageRoot = resolve(sourceDirectory, '../..');
 const outputPath = resolve(packageRoot, 'lib/client.js');
 const loaderId = process.env.DSH_IM_CLIENT_ID ?? '@xmanrui/dsh-im';
-const logoPath = resolve(packageRoot, 'assets/logo-icon.png');
-const logoDataUrl = `data:image/png;base64,${(await readFile(logoPath)).toString('base64')}`;
 
 const result = await build({
   entryPoints: [resolve(sourceDirectory, 'index.js')],
@@ -18,9 +16,6 @@ const result = await build({
   platform: 'browser',
   target: ['chrome100'],
   external: ['react', 'react-dom'],
-  define: {
-    'globalThis.__DSH_IM_LOGO_DATA_URL__': JSON.stringify(logoDataUrl),
-  },
   write: false,
   minify: process.env.NODE_ENV === 'production',
   legalComments: 'none',

package/plugin-src/client/channel-logos.js

@@ -131,3 +131,15 @@ export function WhatsappLogoGlyph({ size } = {}) {
     d: 'M17.472 14.382c-.297-.149-1.758-.867-2.03-.967-.273-.099-.471-.148-.67.15-.197.297-.767.966-.94 1.164-.173.199-.347.223-.644.074-.297-.149-1.255-.462-2.39-1.475-.883-.788-1.48-1.761-1.653-2.059-.173-.297-.018-.458.13-.606.134-.133.298-.347.446-.521.149-.173.198-.297.298-.495.099-.198.05-.372-.025-.521-.075-.149-.669-1.612-.916-2.207-.242-.579-.487-.5-.669-.51a12.8 12.8 0 0 0-.57-.01c-.198 0-.52.074-.792.372-.272.297-1.04 1.016-1.04 2.479s1.065 2.875 1.213 3.074c.149.198 2.095 3.2 5.077 4.487.709.306 1.262.489 1.694.626.712.227 1.36.195 1.871.118.571-.085 1.758-.719 2.006-1.413.248-.694.248-1.29.173-1.413-.074-.124-.272-.198-.57-.347m-5.421 7.403h-.004a9.87 9.87 0 0 1-5.031-1.378l-.361-.214-3.741.981.999-3.648-.235-.374a9.86 9.86 0 0 1-1.51-5.26c.001-5.45 4.436-9.884 9.888-9.884 2.64 0 5.122 1.03 6.988 2.898a9.83 9.83 0 0 1 2.893 6.991c-.003 5.45-4.437 9.884-9.886 9.884m8.413-18.297A11.8 11.8 0 0 0 12.055 0C5.495 0 .16 5.335.157 11.892c0 2.096.547 4.142 1.588 5.945L.057 24l6.305-1.654a11.9 11.9 0 0 0 5.688 1.448h.005c6.557 0 11.892-5.335 11.895-11.893a11.82 11.82 0 0 0-3.486-8.413',
   }));
 }
+
+export function OfficeLogoGlyph({ size } = {}) {
+  return h('svg', {
+    ...dimensions(size),
+    viewBox: '0 0 24 24',
+    focusable: 'false',
+    'aria-hidden': 'true',
+    'data-im-channel-logo': 'office',
+  },
+  h('path', { fill: 'currentColor', d: 'M4 3.5h10.5a2 2 0 0 1 2 2v13H4v-15Zm2.2 3v1.8h2V6.5h-2Zm4.1 0v1.8h2V6.5h-2Zm-4.1 4v1.8h2v-1.8h-2Zm4.1 0v1.8h2v-1.8h-2ZM8.4 15v3.5h3V15h-3Z' }),
+  h('path', { fill: 'currentColor', d: 'M18.3 8.2h1.5v3h3v1.5h-3v3h-1.5v-3h-3v-1.5h3v-3Z' }));
+}

package/plugin-src/client/channels/office/api.js

@@ -0,0 +1,44 @@
+import {
+  OFFICE_PROTOCOL_VERSION,
+  OFFICE_RPC_CHANNEL,
+  OFFICE_RPC_ENDPOINTS,
+  officeHookUrls,
+} from '../../../../src/channels/office/protocol.mjs';
+
+function record(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+
+export function unwrapOfficeRpc(result) {
+  if (!record(result) || typeof result.ok !== 'boolean') throw new Error('AI Office 服务返回了无法识别的响应');
+  if (!result.ok) {
+    const error = new Error(typeof result.error?.message === 'string' ? result.error.message : 'AI Office 操作失败');
+    error.code = typeof result.error?.code === 'string' ? result.error.code : 'office-rpc-error';
+    throw error;
+  }
+  return result.value;
+}
+
+export function normalizeOfficeStatus(value) {
+  if (!record(value) || value.configured !== true) {
+    return { configured: false, connected: false, state: 'unconfigured', config: null, health: null };
+  }
+  const config = record(value.config) ? value.config : {};
+  return {
+    configured: true,
+    connected: value.connected === true,
+    state: typeof value.state === 'string' ? value.state : 'idle',
+    tokenConfigured: value.tokenConfigured === true,
+    config: {
+      protocolVersion: config.protocolVersion ?? OFFICE_PROTOCOL_VERSION,
+      baseUrl: typeof config.baseUrl === 'string' ? config.baseUrl : '',
+      deviceId: typeof config.deviceId === 'string' ? config.deviceId : '',
+      maxConcurrency: Number(config.maxConcurrency ?? 1),
+      heartbeatSeconds: Number(config.heartbeatSeconds ?? 30),
+      workspaces: record(config.workspaces) ? config.workspaces : {},
+      instructionPresets: record(config.instructionPresets) ? config.instructionPresets : {},
+      hooks: record(config.hooks) ? config.hooks : {},
+    },
+    health: record(value.health) ? value.health : null,
+  };
+}
+
+export { OFFICE_PROTOCOL_VERSION, OFFICE_RPC_CHANNEL, OFFICE_RPC_ENDPOINTS, officeHookUrls };

package/plugin-src/client/channels/office/index.js

@@ -0,0 +1,152 @@
+import * as React from 'react';
+
+import { h } from '../../i18n.js';
+import {
+  OFFICE_PROTOCOL_VERSION,
+  OFFICE_RPC_ENDPOINTS,
+  normalizeOfficeStatus,
+  officeHookUrls,
+  unwrapOfficeRpc,
+} from './api.js';
+
+function Button({ children, kind = 'secondary', ...props }) {
+  return h('button', { ...props, type: 'button', className: 'ddt-button', 'data-kind': kind }, children);
+}
+
+function mapText(value) {
+  return Object.entries(value ?? {}).map(([key, item]) => `${key}=${item}`).join('\n');
+}
+
+function parseMap(value, label) {
+  const output = {};
+  for (const raw of value.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line) continue;
+    const index = line.indexOf('=');
+    if (index < 1 || !line.slice(index + 1).trim()) {
+      throw new Error(label === 'Workspace 映射'
+        ? 'Workspace 映射每行必须使用 alias=value'
+        : 'Instruction Preset 映射每行必须使用 alias=value');
+    }
+    output[line.slice(0, index).trim()] = line.slice(index + 1).trim();
+  }
+  return output;
+}
+
+function stateLabel(model) {
+  if (model.connected) return '已连接 Office';
+  if (!model.configured) return '尚未配置';
+  if (model.state === 'connecting') return '正在连接';
+  if (model.state === 'reconnecting') return '等待重连';
+  if (model.state === 'missing-token') return '凭据缺失';
+  return '已配置';
+}
+
+export function OfficeSettingsTab({ rpcCall, initialStatus }) {
+  const [model, setModel] = React.useState(normalizeOfficeStatus(initialStatus));
+  const [phase, setPhase] = React.useState(initialStatus === undefined ? 'loading' : 'ready');
+  const [busy, setBusy] = React.useState('');
+  const [error, setError] = React.useState('');
+  const [notice, setNotice] = React.useState('');
+  const [form, setForm] = React.useState({
+    baseUrl: '', deviceId: 'local-harness', deviceToken: '',
+    maxConcurrency: '1', heartbeatSeconds: '30', workspaces: '', instructionPresets: '',
+  });
+
+  const invoke = React.useCallback(async (endpoint, payload = {}) => {
+    if (typeof rpcCall !== 'function') throw new Error('AI Office 设置页缺少 RPC 连接');
+    return unwrapOfficeRpc(await rpcCall(endpoint, payload));
+  }, [rpcCall]);
+
+  const adopt = React.useCallback((value) => {
+    const next = normalizeOfficeStatus(value?.snapshot ?? value);
+    setModel(next);
+    if (next.config) setForm((current) => ({
+      ...current,
+      baseUrl: next.config.baseUrl,
+      deviceId: next.config.deviceId,
+      maxConcurrency: String(next.config.maxConcurrency),
+      heartbeatSeconds: String(next.config.heartbeatSeconds),
+      workspaces: mapText(next.config.workspaces),
+      instructionPresets: mapText(next.config.instructionPresets),
+      deviceToken: '',
+    }));
+    return next;
+  }, []);
+
+  const load = React.useCallback(async () => {
+    try { adopt(await invoke(OFFICE_RPC_ENDPOINTS.status)); setPhase('ready'); setError(''); }
+    catch (caught) { setPhase('error'); setError(caught.message); }
+  }, [adopt, invoke]);
+
+  React.useEffect(() => { void load(); }, [load]);
+
+  const run = async (name, operation) => {
+    setBusy(name); setError(''); setNotice('');
+    try { const value = await operation(); adopt(value); setNotice(name === 'test' ? '连接测试通过。' : '配置已保存。'); }
+    catch (caught) { setError(caught.message); }
+    finally { setBusy(''); }
+  };
+
+  const hooks = React.useMemo(() => {
+    try { return officeHookUrls(form.baseUrl); } catch { return {}; }
+  }, [form.baseUrl]);
+  const health = model.health ?? {};
+
+  if (phase === 'loading') return h('div', { className: 'ddt-card ddt-loading', 'aria-busy': 'true' }, '正在读取 AI Office Connector…');
+
+  return h('section', { className: 'dof-page', 'aria-label': 'AI Office 设置' },
+    h('div', { className: 'dof-hero' },
+      h('div', { className: 'dof-heroCopy' },
+        h('h3', null, 'AI Office Connector'),
+        h('p', null, '本机主动连接公网 Office；Harness 不开放端口。协议 Hook 固定为 ', OFFICE_PROTOCOL_VERSION, '。')),
+      h('span', { className: 'dof-status', 'data-connected': String(model.connected) },
+        h('span', { className: 'dof-dot' }), stateLabel(model))),
+    model.configured ? h('div', { className: 'dof-metrics' },
+      h('div', { className: 'dof-metric' }, h('span', null, '最近心跳'), h('strong', null, health.lastHeartbeatAt ?? '尚无')),
+      h('div', { className: 'dof-metric' }, h('span', null, '最近事件'), h('strong', null, health.lastEventType ?? '尚无')),
+      h('div', { className: 'dof-metric' }, h('span', null, '重连次数'), h('strong', null, String(health.reconnects ?? 0))),
+      h('div', { className: 'dof-metric' }, h('span', null, 'Job Offer'), h('strong', null, String(health.jobsOffered ?? 0))),
+      h('div', { className: 'dof-metric' }, h('span', null, '运行 Job'), h('strong', null, String(health.jobs?.running ?? 0))),
+      h('div', { className: 'dof-metric' }, h('span', null, '完成 Job'), h('strong', null, String(health.jobs?.completed ?? 0)))) : null,
+    h('div', { className: 'dof-card' },
+      h('div', { className: 'dof-cardTitle' }, h('h4', null, '设备连接'), h('span', null, 'Token 只写入本机凭据存储')),
+      h('div', { className: 'dof-grid' },
+        h('label', { className: 'dof-field', 'data-wide': 'true' }, 'Office Base URL',
+          h('input', { value: form.baseUrl, placeholder: 'https://office.example.com', onChange: (event) => setForm({ ...form, baseUrl: event.target.value }) })),
+        h('label', { className: 'dof-field' }, 'Device ID',
+          h('input', { value: form.deviceId, placeholder: 'local-harness', onChange: (event) => setForm({ ...form, deviceId: event.target.value }) })),
+        h('label', { className: 'dof-field' }, 'Device Token',
+          h('input', { type: 'password', value: form.deviceToken, placeholder: model.tokenConfigured ? '已安全保存；留空保持不变' : '粘贴 Office 一次性凭据', autoComplete: 'new-password', onChange: (event) => setForm({ ...form, deviceToken: event.target.value }) })),
+        h('label', { className: 'dof-field' }, '最大并发',
+          h('input', { type: 'number', min: 1, max: 4, value: form.maxConcurrency, onChange: (event) => setForm({ ...form, maxConcurrency: event.target.value }) })),
+        h('label', { className: 'dof-field' }, 'Heartbeat 秒数',
+          h('input', { type: 'number', min: 10, max: 300, value: form.heartbeatSeconds, onChange: (event) => setForm({ ...form, heartbeatSeconds: event.target.value }) })),
+        h('label', { className: 'dof-field', 'data-wide': 'true' }, 'Workspace 映射',
+          h('textarea', { value: form.workspaces, placeholder: 'office-project=/Users/you/projects/ai-office', onChange: (event) => setForm({ ...form, workspaces: event.target.value }) }),
+          h('small', null, '每行 alias=/本机/绝对路径；Office 只能看到 alias。')),
+        h('label', { className: 'dof-field', 'data-wide': 'true' }, 'Instruction Preset 映射',
+          h('textarea', { value: form.instructionPresets, placeholder: 'action-items=转换为负责人、截止和验收明确的工单', onChange: (event) => setForm({ ...form, instructionPresets: event.target.value }) }),
+          h('small', null, '每行 alias=指令；新增 preset 不需要改 Office 代码。'))),
+      error ? h('p', { className: 'dof-error', role: 'alert' }, error) : null,
+      notice ? h('p', { className: 'dof-notice', role: 'status' }, notice) : null,
+      health.error?.message ? h('p', { className: 'dof-error' }, health.error.message) : null,
+      h('div', { className: 'dof-actions' },
+        h(Button, { kind: 'primary', disabled: Boolean(busy), onClick: () => void run('save', () => invoke(OFFICE_RPC_ENDPOINTS.configure, {
+          baseUrl: form.baseUrl,
+          deviceId: form.deviceId,
+          ...(form.deviceToken ? { deviceToken: form.deviceToken } : {}),
+          maxConcurrency: Number(form.maxConcurrency),
+          heartbeatSeconds: Number(form.heartbeatSeconds),
+          workspaces: parseMap(form.workspaces, 'Workspace 映射'),
+          instructionPresets: parseMap(form.instructionPresets, 'Instruction Preset 映射'),
+        })) }, busy === 'save' ? '保存中…' : '保存并连接'),
+        h(Button, { disabled: !model.configured || Boolean(busy), onClick: () => void run('test', () => invoke(OFFICE_RPC_ENDPOINTS.test)) }, busy === 'test' ? '测试中…' : '测试连接'),
+        h(Button, { disabled: !model.configured || Boolean(busy), onClick: () => void run('reconnect', () => invoke(OFFICE_RPC_ENDPOINTS.reconnect)) }, '重新连接'),
+        h(Button, { kind: 'danger', disabled: !model.configured || Boolean(busy), onClick: () => void run('remove', () => invoke(OFFICE_RPC_ENDPOINTS.remove, { confirm: true })) }, '移除连接'))),
+    h('div', { className: 'dof-card' },
+      h('div', { className: 'dof-cardTitle' }, h('h4', null, '协议 Hook 预览'), h('span', null, '由 Base URL 自动派生，不单独填写')),
+      h('div', { className: 'dof-hooks' },
+        [['SSE', hooks.stream], ['Heartbeat', hooks.heartbeat], ['Job', hooks.job], ['Result', hooks.result]].map(([label, url]) => h('div', { className: 'dof-hook', key: label }, h('strong', null, label), h('code', null, url ?? 'Base URL 无效'))))),
+    h('p', { className: 'dof-notice' }, 'Office Hook 尚未部署时，配置会安全保存并自动重试；出现 HTTP 404 代表协议端点待上线，不代表 Harness 故障。'));
+}

package/plugin-src/client/channels/office/styles.js

@@ -0,0 +1,50 @@
+export const OFFICE_STYLE_ID = 'xmanrui-dsh-im-office-settings';
+
+const CSS = `
+.dof-page { --dof-accent: var(--dsw-alias-brand-primary, #3964fe); }
+.dof-hero { position: relative; overflow: hidden; display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 16px; align-items: center; margin-bottom: 12px; padding: 18px; border: 1px solid var(--dsw-alias-border-l2, #e5e6eb); border-radius: 16px; background: linear-gradient(135deg, color-mix(in srgb, var(--dof-accent) 9%, var(--dsw-alias-bg-layer-1, #fff)), var(--dsw-alias-bg-layer-1, #fff) 62%); }
+.dof-hero::after { content: ""; position: absolute; width: 150px; height: 150px; right: -75px; top: -90px; border: 24px solid color-mix(in srgb, var(--dof-accent) 12%, transparent); border-radius: 50%; pointer-events: none; }
+.dof-heroCopy { min-width: 0; }
+.dof-heroCopy h3 { margin: 0; color: var(--dsw-alias-label-primary, #1f2329); font-size: 17px; line-height: 1.35; }
+.dof-heroCopy p { margin: 6px 0 0; color: var(--dsw-alias-label-secondary, #646a73); font-size: 12px; line-height: 1.6; }
+.dof-status { position: relative; z-index: 1; display: inline-flex; align-items: center; gap: 7px; padding: 7px 10px; border: 1px solid var(--dsw-alias-border-l2, #e5e6eb); border-radius: 999px; background: var(--dsw-alias-bg-layer-1, #fff); color: var(--dsw-alias-label-secondary, #646a73); font-size: 12px; white-space: nowrap; }
+.dof-dot { width: 8px; height: 8px; border-radius: 50%; background: var(--dsw-alias-state-warn-primary, #d97706); }
+.dof-status[data-connected="true"] .dof-dot { background: var(--dsw-alias-state-success-primary, #20a162); box-shadow: 0 0 0 3px color-mix(in srgb, var(--dsw-alias-state-success-primary, #20a162) 14%, transparent); }
+.dof-card { margin-top: 10px; padding: 16px; border: 1px solid var(--dsw-alias-border-l2, #e5e6eb); border-radius: 14px; background: var(--dsw-alias-bg-layer-1, #fff); }
+.dof-cardTitle { display: flex; justify-content: space-between; gap: 12px; align-items: baseline; margin-bottom: 12px; }
+.dof-cardTitle h4 { margin: 0; color: var(--dsw-alias-label-primary, #1f2329); font-size: 14px; }
+.dof-cardTitle span { color: var(--dsw-alias-label-tertiary, #8f959e); font-size: 11px; }
+.dof-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px; }
+.dof-field { min-width: 0; display: flex; flex-direction: column; gap: 6px; color: var(--dsw-alias-label-secondary, #646a73); font-size: 12px; }
+.dof-field[data-wide="true"] { grid-column: 1 / -1; }
+.dof-field input, .dof-field textarea { box-sizing: border-box; width: 100%; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 9px; background: var(--dsw-alias-bg-layer-1, #fff); color: var(--dsw-alias-label-primary, #1f2329); font: inherit; font-size: 13px; line-height: 1.5; outline: none; }
+.dof-field input { height: 38px; padding: 0 11px; }
+.dof-field textarea { min-height: 86px; resize: vertical; padding: 9px 11px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+.dof-field input:focus, .dof-field textarea:focus { border-color: var(--dof-accent); box-shadow: 0 0 0 3px color-mix(in srgb, var(--dof-accent) 12%, transparent); }
+.dof-field small { color: var(--dsw-alias-label-tertiary, #8f959e); line-height: 1.45; }
+.dof-hooks { display: grid; gap: 7px; }
+.dof-hook { min-width: 0; display: grid; grid-template-columns: 82px minmax(0, 1fr); gap: 10px; align-items: center; padding: 8px 10px; border-radius: 9px; background: var(--dsw-alias-interactive-bg-hover, #f7f8fa); }
+.dof-hook strong { color: var(--dsw-alias-label-secondary, #646a73); font-size: 11px; }
+.dof-hook code { overflow: hidden; color: var(--dsw-alias-label-primary, #1f2329); font-size: 11px; text-overflow: ellipsis; white-space: nowrap; }
+.dof-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 14px; }
+.dof-actions .ddt-button[data-kind="primary"] { color: #fff; border-color: var(--dof-accent); background: var(--dof-accent); }
+.dof-error, .dof-notice { margin: 10px 0 0; padding: 9px 11px; border-radius: 9px; font-size: 12px; line-height: 1.5; }
+.dof-error { color: var(--dsw-alias-state-error-primary, #d54941); background: var(--dsw-alias-state-error-secondary, #fff0ef); }
+.dof-notice { color: var(--dsw-alias-label-secondary, #646a73); background: var(--dsw-alias-interactive-bg-hover, #f7f8fa); }
+.dof-metrics { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 8px; margin-top: 12px; }
+.dof-metric { min-width: 0; padding: 9px; border-radius: 10px; background: var(--dsw-alias-interactive-bg-hover, #f7f8fa); }
+.dof-metric span { display: block; color: var(--dsw-alias-label-tertiary, #8f959e); font-size: 10px; }
+.dof-metric strong { display: block; overflow: hidden; margin-top: 4px; color: var(--dsw-alias-label-primary, #1f2329); font-size: 12px; text-overflow: ellipsis; white-space: nowrap; }
+@container (max-width: 680px) { .dof-grid { grid-template-columns: minmax(0, 1fr); } .dof-field[data-wide="true"] { grid-column: auto; } .dof-metrics { grid-template-columns: repeat(2, minmax(0, 1fr)); } }
+@media (prefers-reduced-motion: reduce) { .dof-page * { transition: none !important; } }
+`;
+
+export function installOfficeStyles() {
+  if (typeof document === 'undefined') return () => {};
+  if (document.querySelector(`style[data-plugin-css="${OFFICE_STYLE_ID}"]`)) return () => {};
+  const style = document.createElement('style');
+  style.dataset.pluginCss = OFFICE_STYLE_ID;
+  style.textContent = CSS;
+  document.head.append(style);
+  return () => style.remove();
+}

package/plugin-src/client/channels/shared/token-api.js

@@ -27,7 +27,9 @@ export const TOKEN_BOT_ENDPOINTS = Object.freeze({
   setWorkspace: 'bot.workspace.set',
 });
 
-export function createTokenChannelApi(channel, connectionSummary) {
+export function createTokenChannelApi(channel, connectionSummary, {
+  normalizeBotExtension = () => ({}),
+} = {}) {
   const unwrapRpcResult = (result) => {
     if (!isRecord(result) || typeof result.ok !== 'boolean') {
       throw new Error(`${channel} 服务返回了无法识别的响应`);
@@ -44,6 +46,7 @@ export function createTokenChannelApi(channel, connectionSummary) {
     if (!isRecord(value) || !id(value.botId)) return undefined;
     const connected = value.connected === true;
     const state = ACCOUNT_STATES.has(value.state) ? value.state : 'offline';
+    const extension = normalizeBotExtension(value);
     return {
       botId: id(value.botId),
       connected,
@@ -65,6 +68,7 @@ export function createTokenChannelApi(channel, connectionSummary) {
         code: text(value.error.code, `${channel.toUpperCase()}_ACCOUNT_ERROR`, 80),
         message: text(value.error.message, `${channel}连接尚未就绪`),
       } : null,
+      ...(isRecord(extension) ? extension : {}),
     };
   };
 

package/plugin-src/client/channels/shared/token-channel.js

@@ -59,9 +59,11 @@ export function createTokenChannelSettings(definition) {
     credentialCloseLabel = '收起凭据',
     credentialNoun = 'Bot Token',
     emptyActionLabel = '填写 Bot Token',
+    AccountSettings = null,
+    accountSettingsEndpoint = null,
   } = definition;
 
-  function AccountCard({ account, busy, testNotice, removing, onReconnect, onWorkspaceSave, onRequestRemove, onConfirmRemove, onCancelRemove }) {
+  function AccountCard({ account, busy, testNotice, removing, onReconnect, onWorkspaceSave, onAccountSettingsSave, onRequestRemove, onConfirmRemove, onCancelRemove }) {
     const state = busy === 'reconnect' ? 'connecting' : account.state;
     const tone = account.connected ? 'success' : state === 'error' ? 'error' : 'warning';
     const stateLabel = account.connected ? '运行正常' : state === 'connecting' ? '正在连接' : '连接未就绪';
@@ -88,6 +90,11 @@ export function createTokenChannelSettings(definition) {
           disabled: Boolean(busy),
           onSave: onWorkspaceSave,
         }),
+        AccountSettings ? h(AccountSettings, {
+          account,
+          busy: Boolean(busy),
+          onSave: onAccountSettingsSave,
+        }) : null,
         h('div', { className: 'ddt-accountFooter dim-cardFooter' },
           summary ? h('div', { className: 'ddt-summary dim-cardSummary' }, summary) : null,
           testNotice ? h('div', { className: 'ddt-summary dim-cardSummary', role: 'status' }, testNotice) : null,
@@ -260,6 +267,14 @@ export function createTokenChannelSettings(definition) {
                 endpoints.setWorkspace,
                 { botId: account.botId, workspace },
               ),
+              onAccountSettingsSave: AccountSettings && accountSettingsEndpoint
+                ? (payload) => botAction(
+                    account,
+                    'settings',
+                    accountSettingsEndpoint,
+                    { botId: account.botId, ...payload },
+                  )
+                : undefined,
               onRequestRemove: () => setRemoveTarget(account.botId),
               onCancelRemove: () => setRemoveTarget(null),
               onConfirmRemove: async () => {

package/plugin-src/client/channels/telegram/api.js

@@ -1,9 +1,24 @@
 import { TOKEN_BOT_ENDPOINTS, createTokenChannelApi } from '../shared/token-api.js';
 
 export const TELEGRAM_RPC_CHANNEL = '/telegram';
-export const TELEGRAM_ENDPOINTS = TOKEN_BOT_ENDPOINTS;
+export const TELEGRAM_ENDPOINTS = Object.freeze({
+  ...TOKEN_BOT_ENDPOINTS,
+  setAccessPolicy: 'bot.access-policy.set',
+});
 
-const api = createTokenChannelApi('Telegram', ' Bot API 长轮询');
+const api = createTokenChannelApi('Telegram', ' Bot API 长轮询', {
+  normalizeBotExtension: (value) => {
+    const source = value?.accessPolicy;
+    const accessMode = source?.accessMode === 'private-allowlist'
+      ? 'private-allowlist' : 'compatible';
+    const allowedUsers = Array.isArray(source?.allowedUsers)
+      ? [...new Set(source.allowedUsers.filter((entry) => (
+          typeof entry === 'string' && /^[1-9]\d{0,15}$/.test(entry)
+        )))]
+      : [];
+    return { accessPolicy: { accessMode, allowedUsers } };
+  },
+});
 
 export const unwrapRpcResult = api.unwrapRpcResult;
 export const normalizeSnapshot = api.normalizeSnapshot;

package/plugin-src/client/channels/telegram/index.js

@@ -1,11 +1,121 @@
+import * as React from 'react';
+
 import { TelegramLogoGlyph } from '../../channel-logos.js';
 import { createTokenChannelSettings } from '../shared/token-channel.js';
+import { h } from '../../i18n.js';
 import {
   TELEGRAM_ENDPOINTS,
   telegramClientApi,
 } from './api.js';
 import { installTelegramStyles } from './styles.js';
 
+function policyFor(account) {
+  return {
+    accessMode: account?.accessPolicy?.accessMode === 'private-allowlist'
+      ? 'private-allowlist' : 'compatible',
+    allowedUsers: Array.isArray(account?.accessPolicy?.allowedUsers)
+      ? account.accessPolicy.allowedUsers : [],
+  };
+}
+
+function allowedUsersFromText(value) {
+  const entries = value.split(/\r?\n/).map((entry) => entry.trim()).filter(Boolean);
+  if (entries.some((entry) => !/^[1-9]\d{0,15}$/.test(entry))) {
+    throw new TypeError('User ID 必须是 1–16 位正整数，每行一个。');
+  }
+  return [...new Set(entries)];
+}
+
+export function TelegramAccessSettings({ account, busy = false, onSave }) {
+  const policy = policyFor(account);
+  const sourceUsers = policy.allowedUsers.join('\n');
+  const accessHelpId = React.useId();
+  const [accessMode, setAccessMode] = React.useState(policy.accessMode);
+  const [allowedUsers, setAllowedUsers] = React.useState(sourceUsers);
+  const [error, setError] = React.useState(null);
+
+  React.useEffect(() => {
+    setAccessMode(policy.accessMode);
+    setAllowedUsers(sourceUsers);
+    setError(null);
+  }, [policy.accessMode, sourceUsers]);
+
+  const save = async (event) => {
+    event.preventDefault();
+    setError(null);
+    try {
+      const normalized = allowedUsersFromText(allowedUsers);
+      if (typeof onSave !== 'function') throw new Error('Telegram 访问设置暂不可用。');
+      await onSave({ accessMode, allowedUsers: normalized });
+    } catch (caught) {
+      setError(caught?.message ?? 'Telegram 访问设置保存失败。');
+    }
+  };
+
+  const privateAllowlist = accessMode === 'private-allowlist';
+  const savedPrivateAllowlist = policy.accessMode === 'private-allowlist';
+  const emptyAllowlist = privateAllowlist && allowedUsers.trim() === '';
+  return h('form', { className: 'dtg-access', onSubmit: save },
+    h('div', { className: 'dtg-accessHeading' },
+      h('strong', null, '访问设置'),
+      h('span', { className: 'dtg-accessStatus' },
+        h('span', { className: 'dtg-accessBadge', 'data-mode': policy.accessMode },
+          savedPrivateAllowlist ? '已生效：安全模式' : '已生效：兼容模式'),
+        h('span', { className: 'dtg-accessHelp' },
+          h('button', {
+            type: 'button',
+            className: 'dtg-accessHelpButton',
+            'aria-label': '查看 Telegram 访问模式说明',
+            'aria-describedby': accessHelpId,
+          }, h('span', { 'aria-hidden': 'true' }, '?')),
+          h('span', {
+            id: accessHelpId,
+            className: 'dtg-accessTooltip',
+            role: 'tooltip',
+          },
+          h('span', { className: 'dtg-accessTooltipItem' },
+            h('strong', null, '兼容模式'),
+            h('span', null, '保持原有行为：私聊直接响应，群聊在被提及或回复时响应。')),
+          h('span', { className: 'dtg-accessTooltipItem' },
+            h('strong', null, '安全模式'),
+            h('span', null, '群聊全部忽略，私聊仅允许白名单用户。')))))),
+    h('label', { className: 'dtg-accessField' },
+      h('span', null, '模式'),
+      h('select', {
+        value: accessMode,
+        disabled: busy,
+        'aria-label': 'Telegram 访问模式',
+        onChange: (event) => { setAccessMode(event.target.value); setError(null); },
+      },
+      h('option', { value: 'compatible' }, '兼容模式（默认）'),
+      h('option', { value: 'private-allowlist' }, '安全模式（私聊白名单）'))),
+    h('label', { className: 'dtg-accessField' },
+      h('span', null, '允许私聊的 Telegram User ID'),
+      h('textarea', {
+        value: allowedUsers,
+        disabled: busy || !privateAllowlist,
+        rows: 3,
+        placeholder: '每行一个数字 User ID',
+        'aria-label': '允许私聊的 Telegram User ID',
+        onChange: (event) => { setAllowedUsers(event.target.value); setError(null); },
+      }),
+      h('small', null, privateAllowlist
+        ? '白名单仅属于当前机器人。'
+        : '兼容模式下暂不使用白名单，切换模式时会保留。')),
+    emptyAllowlist
+      ? h('p', { className: 'dtg-accessWarning', role: 'status' },
+          '白名单为空；保存后该机器人会拒绝所有入站消息。')
+      : null,
+    error ? h('p', { className: 'dtg-accessError', role: 'alert' }, error) : null,
+    h('div', { className: 'dtg-accessActions' },
+      h('button', {
+        type: 'submit',
+        className: 'ddt-button',
+        'data-kind': 'secondary',
+        disabled: busy,
+      }, busy ? '正在保存…' : '保存访问设置')));
+}
+
 const channel = createTokenChannelSettings({
   channel: 'Telegram',
   endpoints: TELEGRAM_ENDPOINTS,
@@ -19,6 +129,8 @@ const channel = createTokenChannelSettings({
   emptyTitle: '接入 Telegram 机器人',
   emptyDescription: '先通过 @BotFather 获取 Bot Token，再在这里完成接入。',
   platformLabel: 'Telegram',
+  AccountSettings: TelegramAccessSettings,
+  accountSettingsEndpoint: TELEGRAM_ENDPOINTS.setAccessPolicy,
 });
 
 export const TelegramSettingsTab = channel.SettingsTab;

package/plugin-src/client/channels/telegram/styles.js

@@ -4,6 +4,32 @@ const CSS = String.raw`
 .dtg-page { --ddt-accent: #229ed9; --ddt-accent-deep: #1687bd; --ddt-accent-wash: #eaf7fd; }
 .dtg-avatar { color: #fff; background: #229ed9; }
 .dtg-avatar svg { display: block; }
+.dtg-access { display: grid; gap: 10px; padding: 12px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 10px; background: var(--dsw-alias-bg-layer-2, #f7f8fa); }
+.dtg-accessHeading { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.dtg-accessHeading > strong { font-size: 13px; }
+.dtg-accessStatus { min-width: 0; display: inline-flex; align-items: center; justify-content: flex-end; gap: 6px; }
+.dtg-accessBadge { flex: none; padding: 3px 8px; border-radius: 999px; color: #1687bd; background: #eaf7fd; font-size: 11px; font-weight: 700; }
+.dtg-accessBadge[data-mode="private-allowlist"] { color: #a15c00; background: #fff3d6; }
+.dtg-accessHelp { position: relative; display: inline-flex; flex: none; }
+.dtg-accessHelpButton { width: 20px; height: 20px; display: grid; place-items: center; padding: 0; border: 1px solid color-mix(in srgb, #229ed9 28%, var(--dsw-alias-border-l2, #dfe1e5)); border-radius: 50%; color: #1687bd; background: var(--dsw-alias-bg-layer-1, #fff); font: inherit; font-size: 12px; line-height: 1; font-weight: 750; cursor: help; transition: border-color .15s ease, color .15s ease, background .15s ease, box-shadow .15s ease; }
+.dtg-accessHelpButton:hover { border-color: #229ed9; color: #1178a8; background: #eaf7fd; }
+.dtg-accessHelpButton:focus-visible { outline: none; border-color: #229ed9; box-shadow: 0 0 0 3px color-mix(in srgb, #229ed9 18%, transparent); }
+.dtg-accessTooltip { position: absolute; top: calc(100% + 8px); right: 0; z-index: 30; width: 260px; max-width: min(280px, calc(100vw - 48px)); display: grid; gap: 8px; padding: 10px 11px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 9px; color: var(--dsw-alias-label-primary, #1f2329); background: var(--dsw-alias-bg-layer-3, #fff); box-shadow: 0 10px 28px rgb(31 35 41 / 16%); opacity: 0; visibility: hidden; transform: translateY(-3px); pointer-events: none; transition: opacity .15s ease, transform .15s ease, visibility .15s ease; }
+.dtg-accessTooltipItem { display: grid; gap: 2px; }
+.dtg-accessTooltipItem + .dtg-accessTooltipItem { padding-top: 8px; border-top: 1px solid var(--dsw-alias-border-l2, #eef0f3); }
+.dtg-accessTooltipItem strong { color: var(--dsw-alias-label-primary, #1f2329); font-size: 12px; line-height: 17px; font-weight: 700; }
+.dtg-accessTooltipItem > span { color: var(--dsw-alias-label-secondary, #646a73); font-size: 11px; line-height: 16px; font-weight: 400; }
+.dtg-accessHelp:hover .dtg-accessTooltip, .dtg-accessHelp:focus-within .dtg-accessTooltip { opacity: 1; visibility: visible; transform: translateY(0); }
+.dtg-accessField { display: grid; gap: 5px; color: var(--dsw-alias-label-primary, #1f2329); font-size: 12px; font-weight: 600; }
+.dtg-accessField select, .dtg-accessField textarea { width: 100%; box-sizing: border-box; border: 1px solid var(--dsw-alias-border-l1, #c9cdd4); border-radius: 7px; color: inherit; background: var(--dsw-alias-bg-layer-1, #fff); font: inherit; font-weight: 400; }
+.dtg-accessField select { height: 34px; padding: 0 9px; }
+.dtg-accessField textarea { min-height: 68px; padding: 8px 9px; resize: vertical; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+.dtg-accessField textarea:disabled { color: var(--dsw-alias-label-tertiary, #8f959e); background: var(--dsw-alias-bg-module-platform, #f2f3f5); cursor: not-allowed; resize: none; opacity: 1; }
+.dtg-accessField small { color: var(--dsw-alias-label-secondary, #646a73); font-weight: 400; }
+.dtg-accessWarning, .dtg-accessError { margin: 0; font-size: 12px; line-height: 1.5; }
+.dtg-accessWarning { color: #a15c00; }
+.dtg-accessError { color: var(--dsw-alias-state-error-primary, #d83931); }
+.dtg-accessActions { display: flex; justify-content: flex-end; }
 `;
 
 export function installTelegramStyles() {