@xmanrui/dsh-im 4.21.1 → 4.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmanrui/dsh-im",
-  "version": "4.21.1",
+  "version": "4.22.0",
   "description": "把十一种 IM 渠道和公网 AI Office 接入本机 DeepSeek Harness。 Connect eleven IM channels and a public AI Office to a local DeepSeek Harness.",
   "keywords": [
     "deepseek-harness",
@@ -114,6 +114,7 @@
     "src",
     "PROACTIVE_DELIVERY.md",
     "PROACTIVE_DELIVERY.en.md",
+    "docs/client-integration.md",
     "LICENSE",
     "README.md",
     "README.en.md",

package/plugin-src/client/channels/feishu/index.js

@@ -826,6 +826,7 @@ export function FeishuSettingsTab({ rpcCall }) {
   const [pageBusy, setPageBusy] = React.useState(false);
   const [provisionBusy, setProvisionBusy] = React.useState(false);
   const [credentialOpen, setCredentialOpen] = React.useState(false);
+  const [credentialDomain, setCredentialDomain] = React.useState("feishu");
   const [credentialBusy, setCredentialBusy] = React.useState(false);
   const [credentialError, setCredentialError] = React.useState(null);
   const [busyByBot, setBusyByBot] = React.useState({});
@@ -1041,13 +1042,13 @@ export function FeishuSettingsTab({ rpcCall }) {
     try {
       const snapshot = normalizeBotsSnapshot(await invoke(
         FEISHU_ENDPOINTS.bindCredentials,
-        { appId: identity, appSecret: secret },
+        { appId: identity, appSecret: secret, domain: credentialDomain },
       ));
       if (mountedRef.current && workspaceFence.canCommitMutation(snapshotVersion)) {
         mergeSnapshot(snapshot);
       }
       setCredentialOpen(false);
-      announce("飞书机器人凭据已绑定。");
+      announce(credentialDomain === "lark" ? "Lark 机器人凭据已绑定。" : "飞书机器人凭据已绑定。");
     } catch (error) {
       setCredentialError(presentError(error));
     } finally {
@@ -1055,7 +1056,7 @@ export function FeishuSettingsTab({ rpcCall }) {
       if (shouldRefresh && mountedRef.current) void loadStatus({ silent: true });
       setCredentialBusy(false);
     }
-  }, [announce, invoke, loadStatus, mergeSnapshot, workspaceFence]);
+  }, [announce, credentialDomain, invoke, loadStatus, mergeSnapshot, workspaceFence]);
 
   const cancelProvisioning = React.useCallback(async () => {
     const activeProvision = model.provisioning;
@@ -1449,16 +1450,30 @@ export function FeishuSettingsTab({ rpcCall }) {
 
   const credentialContent = credentialOpen
     ? h(CredentialBindingPanel, {
-        channel: "飞书",
+        key: credentialDomain,
+        channel: credentialDomain === "lark" ? "Lark" : "飞书",
         identityLabel: "App ID",
-        identityPlaceholder: "填写飞书开放平台 App ID",
+        identityPlaceholder: credentialDomain === "lark" ? "填写 Lark 开放平台 App ID" : "填写飞书开放平台 App ID",
         secretLabel: "App Secret",
-        secretPlaceholder: "填写飞书开放平台 App Secret",
+        secretPlaceholder: credentialDomain === "lark" ? "填写 Lark 开放平台 App Secret" : "填写飞书开放平台 App Secret",
         busy: credentialBusy,
         error: credentialError,
         onSubmit: bindCredentials,
         onCancel: () => { setCredentialOpen(false); setCredentialError(null); },
-      })
+      }, h("label", { className: "dim-credentialField" },
+        h("span", null, "应用平台"),
+        h("select", {
+          className: "dim-feishuGroupSelect",
+          "aria-label": "应用平台",
+          value: credentialDomain,
+          disabled: credentialBusy,
+          onChange: (event) => {
+            setCredentialDomain(event.target.value);
+            setCredentialError(null);
+          },
+        },
+        h("option", { value: "feishu" }, "飞书"),
+        h("option", { value: "lark" }, "Lark（国际版）"))))
     : null;
 
   const setCardRef = React.useCallback((botId, node) => {

package/plugin-src/client/credential-binding.js

@@ -47,6 +47,7 @@ export function CredentialBindingPanel({
   error = null,
   onSubmit,
   onCancel,
+  children,
 }) {
   const [identity, setIdentity] = React.useState('');
   const [secret, setSecret] = React.useState('');
@@ -66,6 +67,7 @@ export function CredentialBindingPanel({
     'aria-labelledby': headingId,
   },
   h('h3', { id: headingId, className: 'dim-credentialTitle' }, `手动接入${channel}机器人`),
+  children,
   h('form', {
     className: `dim-credentialForm${hasIdentity ? '' : ' dim-credentialFormSingle'}`,
     onSubmit: submit,

package/plugin-src/client/i18n.js

@@ -39,6 +39,7 @@ const EN = Object.freeze({
   'macOS Messages 权限': 'macOS Messages permissions',
   'IM机器人': 'IM bots',
   'IM机器人设置': 'IM bot settings',
+  'IM 面板加载失败': 'Could not load the IM panel',
   '更多机器人设置': 'More bot settings',
   '机器人设置': 'Bot settings',
   '机器人设置页签': 'Bot settings tabs',
@@ -698,6 +699,12 @@ const EN = Object.freeze({
   'Slack 工作区': 'Slack workspace',
   'Bot Token 与 App Token': 'Bot Token and App Token',
   '填写 Bot Token': 'Enter Bot Token',
+  '应用平台': 'App platform',
+  'Lark（国际版）': 'Lark (international)',
+  '手动接入Lark机器人': 'Connect Lark bot manually',
+  '填写 Lark 开放平台 App ID': 'Enter the Lark Developer App ID',
+  '填写 Lark 开放平台 App Secret': 'Enter the Lark Developer App Secret',
+  'Lark 机器人凭据已绑定。': 'Lark bot credentials connected.',
   '手动接入飞书机器人': 'Connect Feishu bot manually',
   '手动接入钉钉机器人': 'Connect DingTalk bot manually',
   '手动接入企业微信机器人': 'Connect WeCom bot manually',

package/plugin-src/client/index.js

@@ -74,6 +74,7 @@ import { installImStyles } from './styles.js';
 import { installSessionChannelLogos } from './session-channel-logos.js';
 import { UpdatePanel, UPDATE_RPC_CHANNEL } from './update-panel.js';
 import { WorkspaceDirectoryPickerContext } from './workspace-editor.js';
+import { IMPanelErrorBoundary } from './panel-error-boundary.js';
 
 export const name = 'im-settings';
 export const inject = ['slots', 'connection', 'locale', 'workspaces'];
@@ -209,10 +210,15 @@ export function IMSettingsTab({
   deliveryRpcCall,
   globalSettingsRpcCall,
   workspaceDirectoryPicker,
+  preferredSectionId,
   browserLocation = globalThis.location,
   navigateToRecoveryUrl = replacePageLocation,
 }) {
-  const [selected, setSelected] = React.useState('weixin');
+  const [selected, setSelected] = React.useState(() => (
+    preferredSectionId === GLOBAL_SETTINGS_TAB_ID
+      || CHANNELS.some((channel) => channel.id === preferredSectionId)
+      ? preferredSectionId : 'weixin'
+  ));
   const [loopbackRecovery, setLoopbackRecovery] = React.useState(null);
   const [runningVersion, setRunningVersion] = React.useState(IM_PLUGIN_VERSION);
   const [deliverySettings, setDeliverySettings] = React.useState(null);
@@ -471,29 +477,89 @@ export function apply(ctx) {
     pickDirectory: () => callWorkspaceDirectoryApi(ctx, 'pickDirectory'),
   });
 
-  ctx.slots.inject('settings.section', () => ctx.slots.register({
-    name: 'settings.section',
-    id: 'xmanrui-dsh-im',
-    order: 21,
-    label: () => t('IM机器人'),
-    locale: IM_LOCALE_NAMESPACE,
-    inject: () => ({
-      dingtalkRpcCall,
-      discordRpcCall,
-      feishuRpcCall,
-      qqRpcCall,
-      slackRpcCall,
-      telegramRpcCall,
-      wecomRpcCall,
-      wecomAppRpcCall,
-      weixinRpcCall,
-      whatsappRpcCall,
-      imessageRpcCall,
-      officeRpcCall,
-      updateRpcCall,
-      deliveryRpcCall,
-      globalSettingsRpcCall,
-      workspaceDirectoryPicker,
-    }),
-  }, IMSettingsTab));
+  const panelDependencies = {
+    dingtalkRpcCall,
+    discordRpcCall,
+    feishuRpcCall,
+    qqRpcCall,
+    slackRpcCall,
+    telegramRpcCall,
+    wecomRpcCall,
+    wecomAppRpcCall,
+    weixinRpcCall,
+    whatsappRpcCall,
+    imessageRpcCall,
+    officeRpcCall,
+    updateRpcCall,
+    deliveryRpcCall,
+    globalSettingsRpcCall,
+    workspaceDirectoryPicker,
+  };
+  const subscribeLocale = (listener) => typeof ctx.on === 'function'
+    ? ctx.on('locale/change', listener) : () => {};
+  const localeSnapshot = () => ctx.locale.getLocale?.()?.active ?? '';
+
+  // Stable for this plugin lifetime: creating an element must not create a
+  // new component type and reset the reader's selected tab or unsaved input.
+  function IMPanel({ preferredSectionId }) {
+    React.useSyncExternalStore(subscribeLocale, localeSnapshot, localeSnapshot);
+    return h(IMPanelErrorBoundary, null,
+      h(IMSettingsTab, { ...panelDependencies, preferredSectionId }));
+  }
+  const buildPanelElement = (props = {}) => h(IMPanel, {
+    preferredSectionId: props.preferredSectionId,
+  });
+
+  ctx.effect(() => {
+    let disposed = false;
+    let stopSettings = null;
+    let registered = false;
+    const setSettingsVisible = (visible) => {
+      if (disposed) return;
+      if (typeof visible !== 'boolean') throw new TypeError('visible must be a boolean');
+      if (visible === (stopSettings !== null)) return;
+      if (!visible) {
+        const stop = stopSettings;
+        stopSettings = null;
+        stop();
+        return;
+      }
+      // The existing slot controller owns late declarations, withdrawal and
+      // re-declaration. Cancelling it also cancels a pending registration.
+      stopSettings = ctx.slots.inject('settings.section', () => {
+        const unregister = ctx.slots.register({
+          name: 'settings.section',
+          id: 'xmanrui-dsh-im',
+          order: 21,
+          label: () => t('IM机器人'),
+          locale: IM_LOCALE_NAMESPACE,
+          inject: () => panelDependencies,
+        }, buildPanelElement);
+        registered = true;
+        return () => {
+          registered = false;
+          unregister();
+        };
+      });
+    };
+
+    // Publish only after the default registration is established, so a
+    // consumer hiding it during service discovery cannot be overridden.
+    setSettingsVisible(true);
+    if (typeof ctx.provide === 'function') {
+      ctx.provide('dshImClient', Object.freeze({
+        version: 1,
+        render: (props) => disposed ? null : buildPanelElement(props),
+        setSettingsVisible,
+        settingsVisible: () => !disposed && registered,
+      }));
+    }
+    return () => {
+      disposed = true;
+      const stop = stopSettings;
+      stopSettings = null;
+      registered = false;
+      stop?.();
+    };
+  }, 'im-settings: client panel service');
 }

package/plugin-src/client/panel-error-boundary.js

@@ -0,0 +1,21 @@
+import * as React from 'react';
+import { h } from './i18n.js';
+
+/** Keep a broken IM subtree local when a shell renders it outside a slot. */
+export class IMPanelErrorBoundary extends React.Component {
+  state = { failed: false };
+
+  static getDerivedStateFromError() {
+    return { failed: true };
+  }
+
+  render() {
+    if (!this.state.failed) return this.props.children;
+    return h('section', { className: 'dim-page', role: 'alert' },
+      h('p', null, 'IM 面板加载失败'),
+      h('button', {
+        type: 'button',
+        onClick: () => this.setState({ failed: false }),
+      }, '重试'));
+  }
+}

package/plugin-src/host/channels/dingtalk/production.mjs

@@ -14,6 +14,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
@@ -58,7 +59,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
@@ -105,6 +106,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const harness = new Harness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
     ...(commandExecutor ? { commandExecutor } : {}),

package/plugin-src/host/channels/feishu/production.mjs

@@ -26,6 +26,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
@@ -117,7 +118,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
@@ -201,6 +202,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const harness = new Harness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     // This plugin is already hosted by a running DSH process. Starting a
     // second DSH would create a competing server and lifecycle.
     autostart: false,

package/plugin-src/host/channels/feishu/rpc.mjs

@@ -401,9 +401,10 @@ function validPayload(endpoint, payload) {
       : 'Group message permission update requires a single valid botId.';
   }
   if (endpoint === FEISHU_ENDPOINTS.bindCredentials) {
-    return hasOnlyKeys(payload, new Set(['appId', 'appSecret']))
+    return hasOnlyKeys(payload, new Set(['appId', 'appSecret', 'domain']))
       && validCredential(payload.appId, 256)
       && validCredential(payload.appSecret, 1024)
+      && (payload.domain === undefined || payload.domain === 'feishu' || payload.domain === 'lark')
       ? null
       : 'Credential binding requires App ID and App Secret.';
   }

package/plugin-src/host/channels/qq/production.mjs

@@ -14,6 +14,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
@@ -55,7 +56,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
@@ -96,6 +97,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const harness = new Harness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
     ...(commandExecutor ? { commandExecutor } : {}),

package/plugin-src/host/channels/shared/production.mjs

@@ -16,6 +16,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import {
@@ -65,7 +66,7 @@ export async function createTokenProductionController(ctx, config, internals, de
   const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
   const paths = pluginPaths(config, channel);
   const configStore = await new ResolvedConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
@@ -105,6 +106,7 @@ export async function createTokenProductionController(ctx, config, internals, de
   const harness = new ResolvedHarness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
     ...(commandExecutor ? { commandExecutor } : {}),

package/plugin-src/host/channels/slack/production.mjs

@@ -12,6 +12,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
@@ -44,7 +45,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
   const paths = pluginPaths(config, 'slack');
   const configStore = await new ResolvedConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
@@ -84,6 +85,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const harness = new ResolvedHarness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
     ...(commandExecutor ? { commandExecutor } : {}),

package/plugin-src/host/channels/wecom/production.mjs

@@ -14,6 +14,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
@@ -55,7 +56,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
@@ -99,6 +100,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const harness = new Harness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
     ...(commandExecutor ? { commandExecutor } : {}),

package/plugin-src/host/channels/wecom-app/production.mjs

@@ -14,6 +14,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
@@ -69,7 +70,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
@@ -133,6 +134,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const harness = new Harness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
     ...(commandExecutor ? { commandExecutor } : {}),

package/plugin-src/host/channels/weixin/production.mjs

@@ -18,6 +18,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
@@ -90,7 +91,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = diagnosticWorkspaces(internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load());
@@ -131,6 +132,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const harness = new Harness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
     ...(commandExecutor ? { commandExecutor } : {}),

package/plugin-src/host/channels/whatsapp/production.mjs

@@ -17,6 +17,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
@@ -65,7 +66,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const createSupervisor = internals.createConnectionSupervisor ?? createTokenConnectionSupervisor;
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
@@ -105,6 +106,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const harness = new Harness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
     ...(commandExecutor ? { commandExecutor } : {}),

package/scripts/verify-lan-management.mjs

@@ -5,6 +5,7 @@ import { access, mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises
 import { request as httpRequest } from 'node:http';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
 
 const harnessRoot = process.argv[2];
 if (!harnessRoot || process.argv.includes('--help')) {
@@ -18,6 +19,7 @@ await access(join(pluginRoot, 'lib/index.js'));
 // DSH 0.1.5 CLI intentionally permits only loopback listening. Exercise its
 // real HTTP carrier with a trusted LAN authority, while keeping TCP local.
 const lanIp = '192.168.1.100';
+const domain = 'dsh.example.test';
 
 const directory = await mkdtemp(join(tmpdir(), 'dsh-im-lan-test-'));
 const home = join(directory, 'home');
@@ -43,12 +45,12 @@ function request(url, { method = 'GET', headers = {}, body } = {}) {
   });
 }
 
-function start() {
+function start(trustedHosts = [lanIp]) {
   const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => (
     !/^DSH_/i.test(key) && !/(?:KEY|SECRET|TOKEN|PASSWORD|PROXY)/i.test(key)
   )));
   child = spawn(process.execPath, [cli, 'web', '--no-open', '--host', '127.0.0.1',
-    '--port', '0', '--trusted-host', lanIp], {
+    '--port', '0', ...trustedHosts.flatMap(host => ['--trusted-host', host])], {
     cwd: directory,
     env: { ...env, DSH_HOME: home, DSH_AGENTS_HOME: join(directory, '.agents'),
       DSH_TELEMETRY_DISABLED: '1', SSH_CONNECTION: '', SSH_TTY: '' },
@@ -107,6 +109,18 @@ function rpc(browser, channel = 'feishu', method = 'connection.status', headers
   });
 }
 
+async function readyStatus(browser, channel = 'feishu') {
+  const deadline = Date.now() + 10_000;
+  // HTTP readiness can precede the channel controllers finishing startup.
+  for (;;) {
+    const response = await rpc(browser, channel);
+    const result = response.status === 200 ? JSON.parse(response.body).result : null;
+    if (result?.ok !== false || result.error?.code !== `${channel}-initializing`
+      || Date.now() >= deadline) return response;
+    await delay(100);
+  }
+}
+
 function expectStatus(name, response, expected, businessOk = false) {
   assert.equal(response.status, expected, `${name}: ${response.body.slice(0, 300)}`);
   if (businessOk) {
@@ -146,9 +160,10 @@ try {
   expectStatus('LAN authenticated web page', await request(new URL('/', lan.origin), {
     headers: { cookie: lan.cookie },
   }), 200);
-  for (const channel of ['feishu', 'weixin', 'dingtalk', 'wecom', 'wecom-app', 'qq',
-    'slack', 'telegram', 'discord', 'whatsapp', 'imessage', 'office']) {
-    expectStatus(`LAN default: ${channel}`, await rpc(lan, channel), 200, true);
+  const channels = ['feishu', 'weixin', 'dingtalk', 'wecom', 'wecom-app', 'qq',
+    'slack', 'telegram', 'discord', 'whatsapp', 'imessage', 'office'];
+  for (const channel of channels) {
+    expectStatus(`LAN default: ${channel}`, await readyStatus(lan, channel), 200, true);
   }
   const delivery = await rpc(lan, 'dsh-im-delivery', 'target.list', {}, { botId: 'bot_missing' });
   expectStatus('LAN delivery reaches business handler', delivery, 200);
@@ -159,15 +174,45 @@ try {
   expectStatus('LAN update remains local-only', await rpc(lan, 'dsh-im', 'update.status'), 403);
   expectStatus('LAN TTL remains local-only', await rpc(lan, 'dsh-im-settings', 'settings.inbound-ttl.get'), 403);
   const local = await login(launchUrl, '127.0.0.1');
-  expectStatus('Loopback default: feishu', await rpc(local), 200, true);
+  const localhost = await login(launchUrl, 'localhost');
+  for (const browser of [local, localhost]) {
+    const hostname = new URL(browser.origin).hostname;
+    for (const channel of channels) {
+      expectStatus(`${hostname} default: ${channel}`, await readyStatus(browser, channel), 200, true);
+    }
+    // Emulate a browser/proxy dropping the Origin port; this is a header-level
+    // reproduction, not evidence that a particular browser emits that header.
+    expectStatus(`${hostname} port-less Origin rejected`, await rpc(browser, 'dingtalk',
+      'connection.status', { origin: `http://${hostname}` }), 403);
+    expectStatus(`${hostname} cross-site request rejected`, await rpc(browser, 'dingtalk',
+      'connection.status', { 'sec-fetch-site': 'cross-site' }), 403);
+  }
+  expectStatus('Loopback Host/Origin hostname mismatch rejected', await rpc(local, 'dingtalk',
+    'connection.status', { origin: localhost.origin }), 403);
+  expectStatus('Authenticated domain without --trusted-host rejected',
+    await rpc(await login(launchUrl, domain), 'dingtalk'), 403);
+
+  await stop();
+  const domainLaunchUrl = await start([lanIp, domain]);
+  const trustedDomain = await login(domainLaunchUrl, domain);
+  expectStatus('Trusted domain without login rejected',
+    await rpc({ origin: trustedDomain.origin }, 'dingtalk'), 401);
+  for (const channel of channels) {
+    expectStatus(`Domain with --trusted-host: ${channel}`, await readyStatus(trustedDomain, channel), 200, true);
+  }
+  const otherTrustedOrigin = new URL(trustedDomain.origin);
+  otherTrustedOrigin.hostname = lanIp;
+  expectStatus('Two trusted hosts still require matching Origin', await rpc(trustedDomain,
+    'dingtalk', 'connection.status', { origin: otherTrustedOrigin.origin }), 403);
 
   await stop();
   await writeFile(join(profile, 'cordis.patch.yml'), '- id: xmanrui-dsh-im\n  config:\n    rpcAuthority: loopback\n');
   const restrictedUrl = await start();
   expectStatus('Explicit loopback rejects LAN', await rpc(await login(restrictedUrl, lanIp)), 403);
-  expectStatus('Explicit loopback accepts localhost', await rpc(await login(restrictedUrl, '127.0.0.1')), 200, true);
+  expectStatus('Explicit loopback accepts 127.0.0.1', await readyStatus(await login(restrictedUrl, '127.0.0.1')), 200, true);
+  expectStatus('Explicit loopback accepts localhost', await readyStatus(await login(restrictedUrl, 'localhost')), 200, true);
   console.table(results);
-  console.log(`Passed ${results.length} real HTTP checks using LAN Host/Origin ${lanIp}.`);
+  console.log(`Passed ${results.length} real HTTP checks using loopback, LAN ${lanIp} and domain ${domain}.`);
   console.log('TCP connections stayed on loopback. This checks the original CLI, authentication and built plugin, not a second-device browser.');
   console.log('The temporary profile contains no bot credentials and is removed after the server stops.');
 } finally {