@xmanrui/dsh-im 4.21.0 → 4.21.2

package/README.en.md

@@ -253,6 +253,16 @@ node bin/dsh-im.mjs install --source .
 
 IM management uses Harness browser authentication and Host/Origin trust checks by default. Once Harness allows and authenticates access from your LAN address, you can view and configure IM bots without any extra dsh-im configuration.
 
+When accessing DSH through a custom domain, if IM settings report `transport failure for /api/dsh-im/...: HTTP 403`, add the browser-facing domain to your existing DSH launch command and restart DSH:
+
+```sh
+dsh web --trusted-host dsh.example.com
+```
+
+Replace `dsh.example.com` with the actual domain, without `http://`, `https://`, or a path. A domain without a port allows any port on that domain; use `--trusted-host dsh.example.com:8443` to restrict it to a particular access port. Repeat `--trusted-host` for multiple domains. This is a DSH option; dsh-im's `rpcAuthority: trusted-host` does not add domains to DSH's trust list. Local access through `localhost` or `127.0.0.1` normally needs no extra entry.
+
+With a reverse proxy, preserve the browser-facing domain and port in the `Host` sent to DSH. The host parsed from an attached `Origin`, including any non-default port, must match that `Host`; adding two different hosts to the trust list still produces 403. `--trusted-host` configures the access check; the browser must still authenticate using a valid launch link.
+
 To additionally restrict IM management to local access, set the following in the active Web profile's `cordis.patch.yml`:
 
 ```yaml

package/README.md

@@ -256,6 +256,16 @@ node bin/dsh-im.mjs install --source .
 
 IM 管理接口默认沿用 Harness 的浏览器认证和 Host／Origin 信任检查。只要 Harness 已允许并认证当前局域网访问，便可直接查看和配置 IM 机器人，无需额外修改 dsh-im 配置。
 
+通过自定义域名访问时，如果 IM 设置页出现 `transport failure for /api/dsh-im/...: HTTP 403`，请在原 DSH 启动命令中添加浏览器访问的域名，并重启 DSH：
+
+```sh
+dsh web --trusted-host dsh.example.com
+```
+
+将 `dsh.example.com` 替换为实际访问域名，不带 `http://`、`https://` 或路径。只写域名允许该域名的任意端口；如需限制到指定访问端口，使用 `--trusted-host dsh.example.com:8443`。多个域名可重复传入 `--trusted-host`。这个参数属于 DSH；dsh-im 的 `rpcAuthority: trusted-host` 本身不会把域名加入 DSH 信任列表。本机通过 `localhost` 或 `127.0.0.1` 访问通常不需要额外配置。
+
+使用反向代理时，代理传给 DSH 的 `Host` 应保留浏览器访问的域名及端口；浏览器携带的 `Origin` 解析出的 host（含非默认端口）必须与该 `Host` 一致，仅将两者分别加入信任列表仍会返回 403。`--trusted-host` 只配置访问校验，浏览器仍需通过有效启动链接完成认证。
+
 如需将 IM 管理额外限制为仅本机访问，可在当前 Web profile 的 `cordis.patch.yml` 中设置：
 
 ```yaml

package/lib/client.js

@@ -582,7 +582,7 @@ var React31 = __toESM(require("react"), 1);
 // package.json
 var package_default = {
   name: "@xmanrui/dsh-im",
-  version: "4.21.0",
+  version: "4.21.2",
   description: "\u628A\u5341\u4E00\u79CD IM \u6E20\u9053\u548C\u516C\u7F51 AI Office \u63A5\u5165\u672C\u673A DeepSeek Harness\u3002 Connect eleven IM channels and a public AI Office to a local DeepSeek Harness.",
   keywords: [
     "deepseek-harness",
@@ -1789,6 +1789,12 @@ var EN = Object.freeze({
   "Slack \u5DE5\u4F5C\u533A": "Slack workspace",
   "Bot Token \u4E0E App Token": "Bot Token and App Token",
   "\u586B\u5199 Bot Token": "Enter Bot Token",
+  "\u5E94\u7528\u5E73\u53F0": "App platform",
+  "Lark\uFF08\u56FD\u9645\u7248\uFF09": "Lark (international)",
+  "\u624B\u52A8\u63A5\u5165Lark\u673A\u5668\u4EBA": "Connect Lark bot manually",
+  "\u586B\u5199 Lark \u5F00\u653E\u5E73\u53F0 App ID": "Enter the Lark Developer App ID",
+  "\u586B\u5199 Lark \u5F00\u653E\u5E73\u53F0 App Secret": "Enter the Lark Developer App Secret",
+  "Lark \u673A\u5668\u4EBA\u51ED\u636E\u5DF2\u7ED1\u5B9A\u3002": "Lark bot credentials connected.",
   "\u624B\u52A8\u63A5\u5165\u98DE\u4E66\u673A\u5668\u4EBA": "Connect Feishu bot manually",
   "\u624B\u52A8\u63A5\u5165\u9489\u9489\u673A\u5668\u4EBA": "Connect DingTalk bot manually",
   "\u624B\u52A8\u63A5\u5165\u4F01\u4E1A\u5FAE\u4FE1\u673A\u5668\u4EBA": "Connect WeCom bot manually",
@@ -2867,6 +2873,14 @@ var CONTEXT_ENHANCEMENT_FIELDS = Object.freeze([
   "threadId",
   "botId"
 ]);
+var INJECTED_CONTEXT_TAGS = Object.freeze({
+  sourceOpen: "<dsh_im_source>",
+  sourceClose: "</dsh_im_source>",
+  guidanceOpen: "<dsh_im_source_guidance>",
+  guidanceClose: "</dsh_im_source_guidance>",
+  replyOpen: "<dsh_im_reply_to>",
+  replyClose: "</dsh_im_reply_to>"
+});
 var CONTEXT_ENHANCEMENT_GUIDANCE_MAX_LENGTH = 8e3;
 var CONTEXT_GROUP_GUIDANCE_EXAMPLE = `\u4EC5\u4F9D\u636E\u5F53\u524D\u6D88\u606F\u7684 <dsh_im_source> \u4E2D\u5B9E\u9645\u63D0\u4F9B\u7684\u5B57\u6BB5\u7406\u89E3\u6765\u6E90\uFF1B\u6CA1\u6709\u63D0\u4F9B\u7684\u5B57\u6BB5\u4E0D\u8981\u731C\u6D4B\u6216\u8865\u5168\u3002
 \u5F53\u524D\u6D88\u606F\u6765\u81EA\u7FA4\u804A\uFF0C\u8BF7\u4F7F\u7528\u4E25\u8083\u3001\u514B\u5236\u3001\u7B80\u6D01\u7684\u8868\u8FBE\u65B9\u5F0F\u3002`;
@@ -3501,7 +3515,8 @@ function CredentialBindingPanel({
   busy = false,
   error = null,
   onSubmit,
-  onCancel
+  onCancel,
+  children
 }) {
   const [identity, setIdentity] = React6.useState("");
   const [secret, setSecret] = React6.useState("");
@@ -3521,6 +3536,7 @@ function CredentialBindingPanel({
       "aria-labelledby": headingId
     },
     h2("h3", { id: headingId, className: "dim-credentialTitle" }, `\u624B\u52A8\u63A5\u5165${channel5}\u673A\u5668\u4EBA`),
+    children,
     h2(
       "form",
       {
@@ -7700,6 +7716,7 @@ function FeishuSettingsTab({ rpcCall }) {
   const [pageBusy, setPageBusy] = React16.useState(false);
   const [provisionBusy, setProvisionBusy] = React16.useState(false);
   const [credentialOpen, setCredentialOpen] = React16.useState(false);
+  const [credentialDomain, setCredentialDomain] = React16.useState("feishu");
   const [credentialBusy, setCredentialBusy] = React16.useState(false);
   const [credentialError, setCredentialError] = React16.useState(null);
   const [busyByBot, setBusyByBot] = React16.useState({});
@@ -7882,13 +7899,13 @@ function FeishuSettingsTab({ rpcCall }) {
     try {
       const snapshot = normalizeBotsSnapshot(await invoke(
         FEISHU_ENDPOINTS.bindCredentials,
-        { appId: identity, appSecret: secret }
+        { appId: identity, appSecret: secret, domain: credentialDomain }
       ));
       if (mountedRef.current && workspaceFence.canCommitMutation(snapshotVersion)) {
         mergeSnapshot(snapshot);
       }
       setCredentialOpen(false);
-      announce("\u98DE\u4E66\u673A\u5668\u4EBA\u51ED\u636E\u5DF2\u7ED1\u5B9A\u3002");
+      announce(credentialDomain === "lark" ? "Lark \u673A\u5668\u4EBA\u51ED\u636E\u5DF2\u7ED1\u5B9A\u3002" : "\u98DE\u4E66\u673A\u5668\u4EBA\u51ED\u636E\u5DF2\u7ED1\u5B9A\u3002");
     } catch (error) {
       setCredentialError(presentError3(error));
     } finally {
@@ -7896,7 +7913,7 @@ function FeishuSettingsTab({ rpcCall }) {
       if (shouldRefresh && mountedRef.current) void loadStatus({ silent: true });
       setCredentialBusy(false);
     }
-  }, [announce, invoke, loadStatus, mergeSnapshot, workspaceFence]);
+  }, [announce, credentialDomain, invoke, loadStatus, mergeSnapshot, workspaceFence]);
   const cancelProvisioning = React16.useCallback(async () => {
     const activeProvision = model.provisioning;
     const attemptId = activeProvision?.attemptId;
@@ -8232,11 +8249,12 @@ function FeishuSettingsTab({ rpcCall }) {
     });
   }
   const credentialContent = credentialOpen ? h2(CredentialBindingPanel, {
-    channel: "\u98DE\u4E66",
+    key: credentialDomain,
+    channel: credentialDomain === "lark" ? "Lark" : "\u98DE\u4E66",
     identityLabel: "App ID",
-    identityPlaceholder: "\u586B\u5199\u98DE\u4E66\u5F00\u653E\u5E73\u53F0 App ID",
+    identityPlaceholder: credentialDomain === "lark" ? "\u586B\u5199 Lark \u5F00\u653E\u5E73\u53F0 App ID" : "\u586B\u5199\u98DE\u4E66\u5F00\u653E\u5E73\u53F0 App ID",
     secretLabel: "App Secret",
-    secretPlaceholder: "\u586B\u5199\u98DE\u4E66\u5F00\u653E\u5E73\u53F0 App Secret",
+    secretPlaceholder: credentialDomain === "lark" ? "\u586B\u5199 Lark \u5F00\u653E\u5E73\u53F0 App Secret" : "\u586B\u5199\u98DE\u4E66\u5F00\u653E\u5E73\u53F0 App Secret",
     busy: credentialBusy,
     error: credentialError,
     onSubmit: bindCredentials,
@@ -8244,7 +8262,26 @@ function FeishuSettingsTab({ rpcCall }) {
       setCredentialOpen(false);
       setCredentialError(null);
     }
-  }) : null;
+  }, h2(
+    "label",
+    { className: "dim-credentialField" },
+    h2("span", null, "\u5E94\u7528\u5E73\u53F0"),
+    h2(
+      "select",
+      {
+        className: "dim-feishuGroupSelect",
+        "aria-label": "\u5E94\u7528\u5E73\u53F0",
+        value: credentialDomain,
+        disabled: credentialBusy,
+        onChange: (event) => {
+          setCredentialDomain(event.target.value);
+          setCredentialError(null);
+        }
+      },
+      h2("option", { value: "feishu" }, "\u98DE\u4E66"),
+      h2("option", { value: "lark" }, "Lark\uFF08\u56FD\u9645\u7248\uFF09")
+    )
+  )) : null;
   const setCardRef = React16.useCallback((botId, node) => {
     if (node) cardRefs.current.set(botId, node);
     else cardRefs.current.delete(botId);