@xmanrui/dsh-im 4.14.0 → 4.16.0

package/plugin-src/host/channels/telegram/index.mjs

@@ -1,5 +1,6 @@
 import { createProductionController } from './production.mjs';
-import { installTelegramRpc } from './rpc.mjs';
+import { createTelegramRpcHandler, installTelegramRpc, TELEGRAM_RPC_CHANNEL } from './rpc.mjs';
+import { installProductionChannel } from '../shared/startup.mjs';
 
 export const name = 'dsh-im-telegram-host';
 export const inject = ['connection', 'credentials', 'typertGateway'];
@@ -8,15 +9,12 @@ export async function apply(ctx, config = {}) {
   if (config?.controller) {
     return installTelegramRpc(ctx, config.controller, config.rpcAuthority);
   }
-  const production = await createProductionController(ctx, config, config.internals ?? {});
-  const unregisterDelivery = config.deliveryService && production.deliveryAdapter
-    ? config.deliveryService.registerAdapter(production.deliveryAdapter) : undefined;
-  const disposeRpc = installTelegramRpc(ctx, production.controller, config.rpcAuthority);
-  ctx.effect(() => async () => {
-    await unregisterDelivery?.();
-    await production.close();
-  }, 'dsh-im: close Telegram bot connections');
-  return disposeRpc;
+  return installProductionChannel(ctx, config, {
+    channel: 'telegram',
+    rpcChannel: TELEGRAM_RPC_CHANNEL,
+    createProduction: () => createProductionController(ctx, config, config.internals ?? {}),
+    createHandler: controller => createTelegramRpcHandler(controller),
+  });
 }
 
 export function createTelegramHostPlugin(config) {

package/plugin-src/host/channels/wecom/index.mjs

@@ -1,5 +1,6 @@
 import { createProductionController } from './production.mjs';
-import { installWecomRpc } from './rpc.mjs';
+import { createWecomRpcHandler, installWecomRpc, WECOM_RPC_CHANNEL } from './rpc.mjs';
+import { installProductionChannel } from '../shared/startup.mjs';
 
 export const name = 'dsh-im-wecom-host';
 export const inject = ['connection', 'credentials', 'typertGateway'];
@@ -8,20 +9,12 @@ export async function apply(ctx, config = {}) {
   if (config?.controller) {
     return installWecomRpc(ctx, config.controller, config.rpcOptions, config.rpcAuthority);
   }
-  const production = await createProductionController(ctx, config, config.internals);
-  const unregisterDelivery = config.deliveryService && production.deliveryAdapter
-    ? config.deliveryService.registerAdapter(production.deliveryAdapter) : undefined;
-  const disposeRpc = installWecomRpc(
-    ctx,
-    production.controller,
-    config.rpcOptions,
-    config.rpcAuthority,
-  );
-  ctx.effect(() => async () => {
-    await unregisterDelivery?.();
-    await production.close();
-  }, 'dsh-im: close Enterprise WeChat bot connections');
-  return disposeRpc;
+  return installProductionChannel(ctx, config, {
+    channel: 'wecom',
+    rpcChannel: WECOM_RPC_CHANNEL,
+    createProduction: () => createProductionController(ctx, config, config.internals),
+    createHandler: controller => createWecomRpcHandler(controller, config.rpcOptions),
+  });
 }
 
 export function createWecomHostPlugin(config) {

package/plugin-src/host/channels/wecom/rpc.mjs

@@ -228,12 +228,17 @@ export function createWecomRpcHandler(controller, { encodeQr = qrDataUrl } = {})
 }
 
 export function installWecomRpc(ctx, controller, options, authority) {
+  return installWecomRpcHandler(ctx, createWecomRpcHandler(controller, options), authority);
+}
+
+/** Mount the existing Connection transport before the production controller is ready. */
+export function installWecomRpcHandler(ctx, handler, authority) {
   if (!ctx?.connection?.rpc || typeof ctx.connection.rpc.handle !== 'function') {
     throw new TypeError('DSH Host Connection RPC is required');
   }
   return ctx.connection.rpc.handle(
     WECOM_RPC_CHANNEL,
-    createWecomRpcHandler(controller, options),
+    handler,
     { authority: resolveRpcAuthority(authority) },
   );
 }

package/plugin-src/host/channels/wecom-app/index.mjs

@@ -0,0 +1,33 @@
+import { createProductionController } from './production.mjs';
+import { createWecomAppRpcHandler, installWecomAppRpc, WECOM_APP_RPC_CHANNEL } from './rpc.mjs';
+import { installProductionChannel } from '../shared/startup.mjs';
+
+export const name = 'dsh-im-wecom-app-host';
+export const inject = ['connection', 'credentials', 'typertGateway'];
+
+export async function apply(ctx, config = {}) {
+  if (config?.controller) {
+    return installWecomAppRpc(ctx, config.controller, config.rpcOptions, config.rpcAuthority);
+  }
+  return installProductionChannel(ctx, config, {
+    channel: 'wecom-app',
+    rpcChannel: WECOM_APP_RPC_CHANNEL,
+    createProduction: () => createProductionController(ctx, config, config.internals),
+    createHandler: controller => createWecomAppRpcHandler(controller, config.rpcOptions),
+  });
+}
+
+export function createWecomAppHostPlugin(config) {
+  return Object.freeze({ name, inject, apply: (ctx) => apply(ctx, config) });
+}
+
+export { createProductionController } from './production.mjs';
+export {
+  WECOM_APP_ENDPOINTS,
+  WECOM_APP_RPC_CHANNEL,
+  WECOM_APP_RPC_ENDPOINTS,
+  createWecomAppRpcHandler,
+  installWecomAppRpc,
+} from './rpc.mjs';
+export { WecomAppController } from '../../../../src/channels/wecom-app/wecom-app-controller.mjs';
+export { WecomAppRuntime } from '../../../../src/channels/wecom-app/wecom-app-runtime.mjs';

package/plugin-src/host/channels/wecom-app/production.mjs

@@ -0,0 +1,217 @@
+import { unlink } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+
+import { WecomAppConfigStore } from '../../../../src/channels/wecom-app/config-store.mjs';
+import { WecomAppHarnessClient } from '../../../../src/channels/wecom-app/harness-client.mjs';
+import { WecomAppStateStore } from '../../../../src/channels/wecom-app/state-store.mjs';
+import { WecomAppController } from '../../../../src/channels/wecom-app/wecom-app-controller.mjs';
+import { WecomAppRuntime } from '../../../../src/channels/wecom-app/wecom-app-runtime.mjs';
+import { WecomAppCallbackServer } from '../../../../src/channels/wecom-app/callback-server.mjs';
+import {
+  BotWorkspaceStore,
+  createBotWorkspaceScope,
+  createWorkspaceAwareController,
+  observeBotWorkspaceRemovals,
+} from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
+import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
+import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
+import { createConnectionSupervisor } from '../wecom/connection-supervisor.mjs';
+import { createHarnessCommandExecutor } from '../../harness-command-executor.mjs';
+import { harnessConnection } from '../../harness-connection.mjs';
+import { createHarnessSessionExecutors } from '../../harness-session-coordinator.mjs';
+import {
+  getInboundTtlRuntime,
+  registerInboundTtlWorkspaces,
+} from '../../inbound-ttl-runtime.mjs';
+import {
+  accessPolicyProvider,
+  initialAccessPolicyFor,
+} from '../shared/access-policy-production.mjs';
+
+function pluginPaths(config) {
+  const dshHome = resolve(config.dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh'));
+  const root = resolve(config.dataDir ?? join(dshHome, 'integrations', 'dsh-wecom-app'));
+  return {
+    config: resolve(config.configPath ?? join(root, 'config.json')),
+    bots: resolve(config.botsDir ?? join(root, 'bots')),
+    workspaces: resolve(config.workspacesPath ?? join(root, 'workspaces.json')),
+  };
+}
+
+function normalizeOrigin(value) {
+  const raw = typeof value === 'string' ? value.trim() : '';
+  return raw ? raw.replace(/\/+$/u, '') : null;
+}
+
+export async function createProductionController(ctx, config = {}, internals = {}) {
+  if (!ctx?.credentials) throw new TypeError('dsh-im Enterprise WeChat app requires ctx.credentials');
+  const connection = harnessConnection(ctx, config);
+
+  const ConfigStore = internals.ConfigStore ?? WecomAppConfigStore;
+  const StateStore = internals.StateStore ?? WecomAppStateStore;
+  const Harness = internals.HarnessClient ?? WecomAppHarnessClient;
+  const Controller = internals.Controller ?? WecomAppController;
+  const Runtime = internals.Runtime ?? WecomAppRuntime;
+  const CallbackServer = internals.CallbackServer ?? WecomAppCallbackServer;
+  const createSupervisor = internals.createConnectionSupervisor ?? createConnectionSupervisor;
+  const baseLogger = typeof ctx.logger === 'function' ? ctx.logger('dsh-im:wecom-app') : (ctx.logger ?? console);
+  // The cordis logger never surfaces in the web profile journal; tee every
+  // level to the process console so callback verification attempts stay
+  // observable (journald captures the dsh web process stdout).
+  const logger = {
+    log: (...args) => { baseLogger.log?.(...args); console.log('[dsh-im:wecom-app]', ...args); },
+    info: (...args) => { baseLogger.info?.(...args); console.info('[dsh-im:wecom-app]', ...args); },
+    warn: (...args) => { baseLogger.warn?.(...args); console.warn('[dsh-im:wecom-app]', ...args); },
+    error: (...args) => { baseLogger.error?.(...args); console.error('[dsh-im:wecom-app]', ...args); },
+  };
+  const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
+  const paths = pluginPaths(config);
+  const configStore = await new ConfigStore(paths.config).load();
+  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
+  const workspaces = internals.workspaces
+    ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
+  const configuredBots = configStore.list();
+  await workspaces.reconcile(configuredBots.map((bot) => bot.botId));
+  await Promise.all(configuredBots.map((bot) => workspaces.ensure(bot.botId, {
+    defaultAgentPreset: config.agentPreset,
+    initialAccessPolicy: initialAccessPolicyFor('wecom-app', bot),
+  })));
+  const observedConfigStore = typeof configStore.remove === 'function'
+    ? observeBotWorkspaceRemovals(configStore, { workspaces })
+    : configStore;
+  const callbackServer = internals.callbackServer ?? new CallbackServer({
+    host: config.callbackListenHost ?? '127.0.0.1',
+    port: config.callbackListenPort ?? 30987,
+    logger,
+  });
+  // The callback listener starts on demand with the first bound app and
+  // stops once the last app is removed, so hosts that never use this channel
+  // do not keep port 30987 occupied.
+  const ensureCallbackListener = async () => {
+    if (callbackServer.listening !== true) await callbackServer.start();
+    return callbackServer;
+  };
+  const baseRegisterRoute = callbackServer.registerRoute.bind(callbackServer);
+  callbackServer.registerRoute = (route) => ensureCallbackListener().then(() => baseRegisterRoute(route));
+  const baseUnregisterRoute = callbackServer.unregisterRoute.bind(callbackServer);
+  callbackServer.unregisterRoute = (botId) => {
+    baseUnregisterRoute(botId);
+    if (callbackServer.routeCount() === 0 && callbackServer.listening) return callbackServer.stop();
+  };
+  const publicOrigin = normalizeOrigin(config.callbackBaseUrl);
+  const buildCallbackUrl = (bot) => {
+    const origin = normalizeOrigin(bot?.callbackBaseUrl) ?? publicOrigin;
+    return origin ? `${origin}${callbackServer.routePath(bot)}` : null;
+  };
+  const stateStores = new Map();
+  const statePath = (botId) => resolve(paths.bots, botId, 'state.json');
+  const stateFor = async (botId) => {
+    let state = stateStores.get(botId);
+    if (!state) {
+      state = await new StateStore(statePath(botId)).load();
+      stateStores.set(botId, state);
+    }
+    return state;
+  };
+  const commandExecutor = createHarnessCommandExecutor(ctx, internals.commandExecutor);
+  const inboundTtl = internals.inboundTtl ?? getInboundTtlRuntime(ctx, config);
+  const inboundTtlService = inboundTtl?.service ?? inboundTtl;
+  registerInboundTtlWorkspaces(ctx, inboundTtlService, {
+    workspaces,
+    configStore: observedConfigStore,
+    defaultWorkspace,
+  });
+  const { controlExecutor, sessionMaintenanceExecutor, fileIngressExecutor } = createHarnessSessionExecutors(ctx, {
+    controlExecutor: internals.controlExecutor,
+    sessionMaintenanceExecutor: internals.sessionMaintenanceExecutor,
+    fileIngressExecutor: internals.fileIngressExecutor,
+    inboundTtlService,
+  });
+  const harness = new Harness({
+    ...connection,
+    workspace: defaultWorkspace,
+    autostart: false,
+    dshBin: config.dshBin ?? 'dsh',
+    ...(commandExecutor ? { commandExecutor } : {}),
+    ...(controlExecutor ? { controlExecutor } : {}),
+    ...(sessionMaintenanceExecutor ? { sessionMaintenanceExecutor } : {}),
+    ...(fileIngressExecutor ? { fileIngressExecutor } : {}),
+  });
+  const modelCatalog = () => listModelCatalog(harness);
+  const coreController = new Controller({
+    credentials: ctx.credentials,
+    configStore: observedConfigStore,
+    buildCallbackUrl,
+    logger,
+    createRuntime: async ({ botId, config: botConfig, secrets }) => {
+      const state = await stateFor(botId);
+      await workspaces.ensure(botId, {
+        defaultAgentPreset: config.agentPreset,
+        initialAccessPolicy: initialAccessPolicyFor('wecom-app', botConfig),
+      });
+      const workspaceScope = createBotWorkspaceScope(harness, {
+        botId, workspaces, state, agentPresetCatalog,
+      });
+      return new Runtime({
+        config: botConfig,
+        secrets,
+        harness: workspaceScope.harness,
+        state: workspaceScope.state,
+        contextEnhancement: { botId, getSettings: () => workspaces.contextEnhancementFor(botId) },
+        accessPolicy: accessPolicyProvider(workspaces, botId, {
+          channel: 'wecom-app', config: botConfig,
+        }),
+        callbackServer,
+        replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
+        logger: {
+          error: (...args) => logger.error?.(`[${botId}]`, ...args),
+          warn: (...args) => logger.warn?.(`[${botId}]`, ...args),
+          info: (...args) => logger.info?.(`[${botId}]`, ...args),
+          debug: (...args) => logger.debug?.(`[${botId}]`, ...args),
+        },
+      });
+    },
+    deleteState: async ({ botId }) => {
+      const state = stateStores.get(botId);
+      stateStores.delete(botId);
+      if (state && typeof state.remove === 'function') {
+        await state.remove();
+      } else {
+        try {
+          await unlink(statePath(botId));
+        } catch (error) {
+          if (error?.code !== 'ENOENT') throw error;
+        }
+      }
+    },
+  });
+  const controller = createWorkspaceAwareController(coreController, {
+    workspaces,
+    stateFor,
+    agentPresetCatalog,
+    modelCatalog,
+  });
+  const supervisor = createSupervisor({
+    controller,
+    harness,
+    logger,
+    retryDelaysMs: config.retryDelaysMs,
+    healthyIntervalMs: config.healthyIntervalMs,
+  }).start();
+  return {
+    controller,
+    deliveryAdapter: createDeliveryAdapter({
+      channel: 'wecom-app', workspaces, coreController, stateFor,
+    }),
+    ready: supervisor.ready,
+    async close() {
+      await supervisor.close();
+      await controller.close();
+      await callbackServer.stop();
+      harness.stopManagedProcess();
+    },
+  };
+}

package/plugin-src/host/channels/wecom-app/rpc.mjs

@@ -0,0 +1,225 @@
+import { SET_CONTEXT_ENHANCEMENT_ENDPOINT, validContextEnhancementPayload } from '../shared/context-enhancement-rpc.mjs';
+import { SET_ACCESS_POLICY_ENDPOINT, validAccessPolicyPayload } from '../shared/access-policy-rpc.mjs';
+import { resolveRpcAuthority } from '../../rpc-authority.mjs';
+import { publicWorkspaceError, SET_WORKSPACE_ENDPOINT, validWorkspacePayload } from '../shared/workspace-rpc.mjs';
+import { SET_AGENT_PRESET_ENDPOINT, validAgentPresetPayload } from '../shared/agent-preset-rpc.mjs';
+import { SET_MODEL_ENDPOINT, validModelPayload } from '../shared/model-setting-rpc.mjs';
+import {
+  connectionTestTargetUnavailable,
+  publicConnectionTestResult,
+} from '../../../../src/channels/shared/connection-test.mjs';
+
+export const WECOM_APP_RPC_CHANNEL = '/wecom-app';
+export const WECOM_APP_ENDPOINTS = Object.freeze({
+  status: 'connection.status',
+  bindApp: 'bot.bind',
+  updateSettings: 'bot.settings.update',
+  resetCallbackSecret: 'bot.callback-secret.reset',
+  reconnectBot: 'bot.reconnect',
+  deleteBot: 'bot.delete',
+  setWorkspace: SET_WORKSPACE_ENDPOINT,
+  setModel: SET_MODEL_ENDPOINT,
+  setAgentPreset: SET_AGENT_PRESET_ENDPOINT,
+  setContextEnhancement: SET_CONTEXT_ENHANCEMENT_ENDPOINT,
+  setAccessPolicy: SET_ACCESS_POLICY_ENDPOINT,
+});
+export const WECOM_APP_RPC_ENDPOINTS = Object.freeze(Object.values(WECOM_APP_ENDPOINTS));
+
+const FORBIDDEN_PUBLIC_KEYS = new Set([
+  'secret', 'secretRef', 'token', 'encodingAESKey', 'callbackTokenRef', 'callbackKeyRef',
+  'callbackSecret', 'corpSecret', 'bot_info',
+]);
+
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function exactKeys(value, allowed) {
+  return isRecord(value) && Object.keys(value).every((key) => allowed.includes(key));
+}
+
+function validId(value) {
+  return typeof value === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(value);
+}
+
+function validCredential(value, maxLength) {
+  return typeof value === 'string' && value.trim().length > 0 && value.length <= maxLength;
+}
+
+function payloadFailure(endpoint, payload) {
+  if (!isRecord(payload)) return 'Payload must be an object.';
+  if (endpoint === WECOM_APP_ENDPOINTS.status) return exactKeys(payload, []) ? null : 'connection.status does not accept fields.';
+  if (endpoint === WECOM_APP_ENDPOINTS.bindApp) {
+    const allowed = ['corpId', 'agentId', 'secret', 'token', 'encodingAESKey', 'apiBaseUrl', 'callbackBaseUrl', 'streamEnabled'];
+    if (!exactKeys(payload, allowed)) return 'bot.bind received unsupported fields.';
+    if (!validCredential(payload.corpId, 128) || !validCredential(payload.agentId, 32)
+      || !validCredential(payload.secret, 256) || !validCredential(payload.token, 128)
+      || !validCredential(payload.encodingAESKey, 128)) {
+      return 'bot.bind requires corpId, agentId, secret, token, and encodingAESKey.';
+    }
+    if (payload.apiBaseUrl !== undefined && payload.apiBaseUrl !== null && typeof payload.apiBaseUrl !== 'string') {
+      return 'bot.bind received an invalid apiBaseUrl.';
+    }
+    if (payload.callbackBaseUrl !== undefined && payload.callbackBaseUrl !== null && typeof payload.callbackBaseUrl !== 'string') {
+      return 'bot.bind received an invalid callbackBaseUrl.';
+    }
+    if (payload.streamEnabled !== undefined && payload.streamEnabled !== true && payload.streamEnabled !== false) {
+      return 'bot.bind received an invalid streamEnabled flag.';
+    }
+    return null;
+  }
+  if (endpoint === WECOM_APP_ENDPOINTS.updateSettings) {
+    if (!exactKeys(payload, ['botId', 'apiBaseUrl', 'callbackBaseUrl', 'streamEnabled']) || !validId(payload.botId)) {
+      return 'bot.settings.update requires a botId and settings fields.';
+    }
+    if (payload.apiBaseUrl !== undefined && payload.apiBaseUrl !== null && typeof payload.apiBaseUrl !== 'string') {
+      return 'bot.settings.update received an invalid apiBaseUrl.';
+    }
+    if (payload.callbackBaseUrl !== undefined && payload.callbackBaseUrl !== null && typeof payload.callbackBaseUrl !== 'string') {
+      return 'bot.settings.update received an invalid callbackBaseUrl.';
+    }
+    if (payload.streamEnabled !== undefined && payload.streamEnabled !== true && payload.streamEnabled !== false) {
+      return 'bot.settings.update received an invalid streamEnabled flag.';
+    }
+    return null;
+  }
+  if (endpoint === WECOM_APP_ENDPOINTS.resetCallbackSecret) {
+    return exactKeys(payload, ['botId']) && validId(payload.botId)
+      ? null : 'bot.callback-secret.reset requires a botId.';
+  }
+  if (endpoint === WECOM_APP_ENDPOINTS.reconnectBot) {
+    return exactKeys(payload, ['botId', 'sendTest'])
+      && validId(payload.botId)
+      && (payload.sendTest === undefined || payload.sendTest === true)
+      ? null : 'bot.reconnect requires a botId and optional sendTest=true.';
+  }
+  if (endpoint === WECOM_APP_ENDPOINTS.deleteBot) {
+    return exactKeys(payload, ['botId', 'confirm']) && validId(payload.botId) && payload.confirm === true
+      ? null : 'bot.delete requires a botId and confirm=true.';
+  }
+  if (endpoint === WECOM_APP_ENDPOINTS.setWorkspace) {
+    return validWorkspacePayload(payload) ? null : '请输入工作区绝对路径。';
+  }
+  if (endpoint === WECOM_APP_ENDPOINTS.setModel) {
+    return validModelPayload(payload) ? null : '请选择有效模型。';
+  }
+  if (endpoint === WECOM_APP_ENDPOINTS.setAgentPreset) {
+    return validAgentPresetPayload(payload) ? null : '请选择 Agent Preset。';
+  }
+  if (endpoint === WECOM_APP_ENDPOINTS.setContextEnhancement) {
+    return validContextEnhancementPayload(payload) ? null : '请提交有效的上下文增强设置。';
+  }
+  if (endpoint === WECOM_APP_ENDPOINTS.setAccessPolicy) {
+    return validAccessPolicyPayload(payload) ? null : '请提交有效的访问设置。';
+  }
+  return 'Unknown Enterprise WeChat app endpoint.';
+}
+
+function sanitizePublic(value) {
+  if (Array.isArray(value)) return value.map(sanitizePublic);
+  if (!isRecord(value)) return value;
+  const safe = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (!FORBIDDEN_PUBLIC_KEYS.has(key)) safe[key] = sanitizePublic(child);
+  }
+  return safe;
+}
+
+function publicStatus(status) {
+  return sanitizePublic(structuredClone(status));
+}
+
+export function createWecomAppRpcHandler(controller) {
+  for (const method of ['status', 'bindApp', 'updateAppSettings', 'resetCallbackSecret', 'reconnectBot', 'deleteBot']) {
+    if (typeof controller?.[method] !== 'function') {
+      throw new TypeError(`A complete Enterprise WeChat app controller is required (${method})`);
+    }
+  }
+  return async (endpoint, payload, signal) => {
+    if (signal?.aborted) return { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.', details: {} } };
+    if (!WECOM_APP_RPC_ENDPOINTS.includes(endpoint)) {
+      return { ok: false, error: { code: 'bad-request', message: 'Unknown Enterprise WeChat app endpoint.', details: {} } };
+    }
+    const invalid = payloadFailure(endpoint, payload);
+    if (invalid) return { ok: false, error: { code: 'bad-request', message: invalid } };
+    try {
+      let value;
+      if (endpoint === WECOM_APP_ENDPOINTS.status) value = await publicStatus(await controller.status());
+      else if (endpoint === WECOM_APP_ENDPOINTS.bindApp) {
+        value = await publicStatus(await controller.bindApp(payload));
+      } else if (endpoint === WECOM_APP_ENDPOINTS.updateSettings) {
+        value = await publicStatus(await controller.updateAppSettings(payload.botId, {
+          apiBaseUrl: payload.apiBaseUrl,
+          callbackBaseUrl: payload.callbackBaseUrl,
+          streamEnabled: payload.streamEnabled,
+        }));
+      } else if (endpoint === WECOM_APP_ENDPOINTS.resetCallbackSecret) {
+        value = await publicStatus(await controller.resetCallbackSecret(payload.botId));
+      } else if (endpoint === WECOM_APP_ENDPOINTS.reconnectBot) {
+        const snapshot = await controller.reconnectBot(payload.botId);
+        if (signal?.aborted) {
+          return { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.', details: {} } };
+        }
+        let testMessage;
+        if (payload.sendTest === true) {
+          const connected = snapshot?.bots?.some(
+            (bot) => bot?.botId === payload.botId && bot?.connected === true,
+          );
+          if (!connected || typeof controller.sendConnectionTest !== 'function') {
+            testMessage = publicConnectionTestResult(connectionTestTargetUnavailable('企业微信应用'));
+          } else {
+            try {
+              await controller.sendConnectionTest(payload.botId);
+              testMessage = publicConnectionTestResult();
+            } catch (error) {
+              testMessage = publicConnectionTestResult(error);
+            }
+          }
+        }
+        value = await publicStatus({ ...snapshot, ...(testMessage ? { testMessage } : {}) });
+      } else if (endpoint === WECOM_APP_ENDPOINTS.setWorkspace) {
+        if (typeof controller.updateWorkspace !== 'function') throw new Error('Workspace update is unavailable');
+        value = await publicStatus(await controller.updateWorkspace(payload.botId, payload.workspace));
+      } else if (endpoint === WECOM_APP_ENDPOINTS.setModel) {
+        if (typeof controller.updateModel !== 'function') throw new Error('Model update is unavailable');
+        value = await publicStatus(await controller.updateModel(payload.botId, payload.model));
+      } else if (endpoint === WECOM_APP_ENDPOINTS.setContextEnhancement) {
+        if (typeof controller.updateContextEnhancement !== 'function') throw new Error('Context enhancement update is unavailable');
+        value = await controller.updateContextEnhancement(
+          payload.botId, payload.config, (status) => publicStatus(status),
+        );
+      } else if (endpoint === WECOM_APP_ENDPOINTS.setAccessPolicy) {
+        if (typeof controller.updateAccessPolicy !== 'function') throw new Error('Access policy update is unavailable');
+        value = await controller.updateAccessPolicy(
+          payload.botId, payload.policy, (status) => publicStatus(status),
+        );
+      } else if (endpoint === WECOM_APP_ENDPOINTS.setAgentPreset) {
+        if (typeof controller.updateAgentPreset !== 'function') throw new Error('Agent Preset update is unavailable');
+        value = await publicStatus(await controller.updateAgentPreset(payload.botId, payload.agentPreset));
+      } else {
+        value = await publicStatus(await controller.deleteBot(payload.botId));
+      }
+      return signal?.aborted
+        ? { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.', details: {} } }
+        : { ok: true, value };
+    } catch (error) {
+      const workspaceError = publicWorkspaceError(error);
+      return signal?.aborted
+        ? { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.', details: {} } }
+        : { ok: false, error: workspaceError
+          ? { ...workspaceError, details: {} }
+          : { code: 'wecom-app-operation-failed', message: '企业微信应用操作失败，请稍后重试。', details: {} } };
+    }
+  };
+}
+
+export function installWecomAppRpc(ctx, controller, options, authority) {
+  if (!ctx?.connection?.rpc || typeof ctx.connection.rpc.handle !== 'function') {
+    throw new TypeError('DSH Host Connection RPC is required');
+  }
+  return ctx.connection.rpc.handle(
+    WECOM_APP_RPC_CHANNEL,
+    createWecomAppRpcHandler(controller, options),
+    { authority: resolveRpcAuthority(authority) },
+  );
+}

package/plugin-src/host/channels/weixin/index.mjs

@@ -1,5 +1,6 @@
 import { createProductionController } from './production.mjs';
-import { installWeixinRpc } from './rpc.mjs';
+import { createWeixinRpcHandler, installWeixinRpc, WEIXIN_RPC_CHANNEL } from './rpc.mjs';
+import { installProductionChannel } from '../shared/startup.mjs';
 
 export const name = 'dsh-weixin-host';
 export const inject = ['connection', 'credentials', 'typertGateway'];
@@ -9,20 +10,12 @@ export async function apply(ctx, config = {}) {
     return installWeixinRpc(ctx, config.controller, config.rpcOptions, config.rpcAuthority);
   }
 
-  const production = await createProductionController(ctx, config, config.internals);
-  const unregisterDelivery = config.deliveryService && production.deliveryAdapter
-    ? config.deliveryService.registerAdapter(production.deliveryAdapter) : undefined;
-  const disposeRpc = installWeixinRpc(
-    ctx,
-    production.controller,
-    config.rpcOptions,
-    config.rpcAuthority,
-  );
-  ctx.effect(() => async () => {
-    await unregisterDelivery?.();
-    await production.close();
-  }, 'dsh-weixin: close account connections');
-  return disposeRpc;
+  return installProductionChannel(ctx, config, {
+    channel: 'weixin',
+    rpcChannel: WEIXIN_RPC_CHANNEL,
+    createProduction: () => createProductionController(ctx, config, config.internals),
+    createHandler: controller => createWeixinRpcHandler(controller, config.rpcOptions),
+  });
 }
 
 export function createWeixinHostPlugin(config) {

package/plugin-src/host/channels/whatsapp/index.mjs

@@ -1,5 +1,6 @@
 import { createProductionController } from './production.mjs';
-import { installWhatsappRpc } from './rpc.mjs';
+import { createWhatsappRpcHandler, installWhatsappRpc, WHATSAPP_RPC_CHANNEL } from './rpc.mjs';
+import { installProductionChannel } from '../shared/startup.mjs';
 
 export const name = 'dsh-im-whatsapp-host';
 export const inject = ['connection', 'typertGateway'];
@@ -8,20 +9,12 @@ export async function apply(ctx, config = {}) {
   if (config?.controller) {
     return installWhatsappRpc(ctx, config.controller, config.rpcOptions, config.rpcAuthority);
   }
-  const production = await createProductionController(ctx, config, config.internals ?? {});
-  const unregisterDelivery = config.deliveryService && production.deliveryAdapter
-    ? config.deliveryService.registerAdapter(production.deliveryAdapter) : undefined;
-  const disposeRpc = installWhatsappRpc(
-    ctx,
-    production.controller,
-    config.rpcOptions,
-    config.rpcAuthority,
-  );
-  ctx.effect(() => async () => {
-    await unregisterDelivery?.();
-    await production.close();
-  }, 'dsh-im: close WhatsApp Web connections');
-  return disposeRpc;
+  return installProductionChannel(ctx, config, {
+    channel: 'whatsapp',
+    rpcChannel: WHATSAPP_RPC_CHANNEL,
+    createProduction: () => createProductionController(ctx, config, config.internals ?? {}),
+    createHandler: controller => createWhatsappRpcHandler(controller, config.rpcOptions),
+  });
 }
 
 export function createWhatsappHostPlugin(config) {

package/plugin-src/host/delivery-adapter.mjs

@@ -9,6 +9,7 @@ const CHANNELS = new Set([
   'feishu',
   'dingtalk',
   'wecom',
+  'wecom-app',
   'qq',
   'slack',
   'telegram',
@@ -82,6 +83,9 @@ function normalizeRoute(channel, kind, route) {
     case 'wecom':
       oneOf(kind, ['user', 'group']);
       return routeWithStrings(route, ['chatId']);
+    case 'wecom-app':
+      oneOf(kind, ['user']);
+      return routeWithStrings(route, ['chatId']);
     case 'qq':
       oneOf(kind, ['user', 'group']);
       return routeWithStrings(route, kind === 'user' ? ['userOpenId'] : ['groupOpenId']);