@yaoyuanchao/dingtalk 1.7.1 → 1.7.2

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.5.11] - 2026-03-30
+
+### Added
+
+- **Per-group sender allowlist** — New `groups.<conversationId>.allowFrom` config field.
+  When set, the bot silently ignores @ messages from anyone not in the list.
+  Supports `"*"` wildcard to allow all senders (same as omitting the field).
+  Useful for restricting a shared group bot to specific authorized users.
+
 ## [1.5.3] - 2026-02-03
 
 ### Improved

package/README.md

@@ -61,6 +61,9 @@ clawdbot gateway
 | `messageFormat` | 消息格式: `text`/`markdown`/`auto` | `auto` |
 | `typingIndicator` | 显示"思考中"提示 | `true` |
 | `longTextMode` | 长文本处理: `chunk`/`file` | `chunk` |
+| `groups.<id>.systemPrompt` | 指定群的额外 system prompt | - |
+| `groups.<id>.enabled` | 是否启用该群（false = 完全忽略） | `true` |
+| `groups.<id>.allowFrom` | 该群只响应这些 staffId 的消息（支持 `"*"` 通配符） | `[]`（不限制） |
 
 </details>
 
@@ -80,6 +83,32 @@ Access denied. Your staffId: 050914XXXXXXXXX
 ```
 把这个 ID 加到 `dm.allowFrom` 里，重启 gateway 即可。
 
+## 🔒 群聊发言人限制（Per-group allowFrom）
+
+可以让机器人在某个群里**只响应指定用户**的 @ 消息，其他人 @ 会被静默忽略。
+
+```json
+{
+  "channels": {
+    "dingtalk": {
+      "groups": {
+        "<conversationId>": {
+          "allowFrom": ["050914185922786044"]
+        }
+      }
+    }
+  }
+}
+```
+
+**获取 conversationId：** 机器人收到群消息时日志里会打印，或通过钉钉开放平台 API 查询。
+
+**支持通配符：** `"allowFrom": ["*"]` 表示允许所有人（等同于不设置）。
+
+**与 `dm.allowFrom` 的区别：**
+- `dm.allowFrom` — 私聊白名单（全局）
+- `groups.<id>.allowFrom` — 指定群的发言人白名单（per-group）
+
 ## 📝 更新日志
 
 **v1.5.0** — 新增 Typing Indicator（思考中提示，自动撤回）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaoyuanchao/dingtalk",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "type": "module",
   "description": "DingTalk channel plugin for ClawdBot/OpenClaw with Stream Mode support",
   "license": "MIT",

package/src/config-schema.ts

@@ -1,167 +1,169 @@
-import { z } from 'zod';
-
-// 定义枚举类型
-export const dmPolicySchema = z.enum(['disabled', 'pairing', 'allowlist', 'open'], {
-  description: 'DM access control policy',
-});
-
-export const groupPolicySchema = z.enum(['disabled', 'allowlist', 'open'], {
-  description: 'Group chat access control policy',
-});
-
-export const messageFormatSchema = z.enum(['text', 'markdown', 'richtext', 'auto'], {
-  description: 'Message format for bot responses (richtext is an alias for markdown, auto detects markdown features)',
-});
-
-export const longTextModeSchema = z.enum(['chunk', 'file']);
-
-// Per-account config schema (everything that can be overridden per account)
-export const dingTalkAccountConfigSchema = z.object({
-  enabled: z.boolean().default(true).describe('Enable this account'),
-  name: z.string().optional().describe('Display name for this account'),
-
-  // Credentials
-  clientId: z.string().optional()
-    .describe('DingTalk application AppKey'),
-  clientSecret: z.string().optional()
-    .describe('DingTalk application AppSecret'),
-  robotCode: z.string().optional()
-    .describe('Robot code (optional, defaults to clientId if not provided)'),
-
-  // DM config
-  dm: z.object({
-    enabled: z.boolean().default(true)
-      .describe('Enable direct messages'),
-    policy: dmPolicySchema.default('pairing')
-      .describe(
-        'Access control policy:\n' +
-        '  - disabled: No DM allowed\n' +
-        '  - pairing: Show staffId on first contact, admin adds to allowlist\n' +
-        '  - allowlist: Only specified users can DM\n' +
-        '  - open: Anyone can DM (not recommended)'
-      ),
-    allowFrom: z.array(z.string()).default([])
-      .describe('Allowed staff IDs (for pairing/allowlist policy)'),
-  }).default({}),
-
-  // Group config
-  groupPolicy: groupPolicySchema.default('allowlist')
-    .describe(
-      'Group chat policy:\n' +
-      '  - disabled: No groups\n' +
-      '  - allowlist: Only specified groups\n' +
-      '  - open: All groups'
-    ),
-  groupAllowlist: z.array(z.string()).default([])
-    .describe('Allowed group conversation IDs (only used when groupPolicy is "allowlist")'),
-  requireMention: z.boolean().default(true)
-    .describe('Require @ mention in group chats'),
-
-  // Message format
-  messageFormat: messageFormatSchema.default('text')
-    .describe(
-      'Message format:\n' +
-      '  - text: Plain text (recommended, supports tables)\n' +
-      '  - markdown: DingTalk markdown (limited support, no tables)\n' +
-      '  - richtext: Alias for markdown (deprecated, use markdown instead)\n' +
-      '  - auto: Auto-detect markdown features in response'
-    ),
-
-  // Thinking feedback
-  showThinking: z.boolean().default(false)
-    .describe('Send "正在思考..." feedback before AI responds'),
-
-  // Advanced
-  textChunkLimit: z.number().int().positive().default(2000).optional()
-    .describe('Text chunk size limit for long messages'),
-
-  longTextMode: longTextModeSchema.default('chunk')
-    .describe(
-      'How to handle long text messages:\n' +
-      '  - chunk: Split into multiple messages (default, same as official channels)\n' +
-      '  - file: Convert to .md file and send as attachment'
-    ),
-  longTextThreshold: z.number().int().positive().default(8000).optional()
-    .describe('Character threshold for longTextMode=file (default 8000)'),
-
-  // Per-group overrides
-  groups: z.record(z.string(), z.object({
-    systemPrompt: z.string().optional()
-      .describe('Per-group extra system prompt injected as GroupSystemPrompt'),
-    enabled: z.boolean().optional()
-      .describe('Disable this group (false = ignore all messages)'),
-  })).optional().default({})
-    .describe('Per-group overrides keyed by conversationId'),
-
-  // Message aggregation
-  messageAggregation: z.boolean().default(true)
-    .describe(
-      'Aggregate messages from the same sender within a short time window.\n' +
-      'Useful when DingTalk splits link cards into multiple messages.'
-    ),
-  messageAggregationDelayMs: z.number().int().positive().default(2000).optional()
-    .describe('Time window in milliseconds to wait for additional messages (default 2000)'),
-}).passthrough();
-
-// Top-level DingTalk config: account config + multi-account support
-export const dingTalkConfigSchema = dingTalkAccountConfigSchema.extend({
-  accounts: z.record(z.string(), dingTalkAccountConfigSchema.partial().optional()).optional()
-    .describe('Named accounts that override top-level settings'),
-  defaultAccount: z.string().optional()
-    .describe('Default account ID (if accounts are defined)'),
-});
-
-// 导出配置类型
-export type DingTalkAccountConfig = z.infer<typeof dingTalkAccountConfigSchema>;
-export type DingTalkConfig = z.infer<typeof dingTalkConfigSchema>;
-
-/**
- * 验证 DingTalk 配置
- * @param config - 原始配置对象
- * @returns 验证后的配置
- * @throws ZodError 如果配置无效
- */
-export function validateDingTalkConfig(config: unknown): DingTalkConfig {
-  try {
-    return dingTalkConfigSchema.parse(config);
-  } catch (error) {
-    if (error instanceof z.ZodError) {
-      const formatted = error.issues.map(e => {
-        const path = e.path.join('.');
-        return `  - ${path || 'root'}: ${e.message}`;
-      }).join('\n');
-      throw new Error(`DingTalk config validation failed:\n${formatted}`);
-    }
-    throw error;
-  }
-}
-
-/**
- * Validate per-account config (partial, used for account overrides)
- */
-export function validateDingTalkAccountConfig(config: unknown): DingTalkAccountConfig {
-  return dingTalkAccountConfigSchema.parse(config);
-}
-
-/**
- * 安全地验证配置，返回错误而不抛出异常
- * @param config - 原始配置对象
- * @returns { success: true, data } 或 { success: false, error }
- */
-export function safeValidateDingTalkConfig(config: unknown):
-  | { success: true; data: DingTalkConfig }
-  | { success: false; error: string } {
-  try {
-    const data = dingTalkConfigSchema.parse(config);
-    return { success: true, data };
-  } catch (error) {
-    if (error instanceof z.ZodError) {
-      const formatted = error.issues.map(e => {
-        const path = e.path.join('.');
-        return `${path || 'root'}: ${e.message}`;
-      }).join('; ');
-      return { success: false, error: formatted };
-    }
-    return { success: false, error: String(error) };
-  }
-}
+import { z } from 'zod';
+
+// 定义枚举类型
+export const dmPolicySchema = z.enum(['disabled', 'pairing', 'allowlist', 'open'], {
+  description: 'DM access control policy',
+});
+
+export const groupPolicySchema = z.enum(['disabled', 'allowlist', 'open'], {
+  description: 'Group chat access control policy',
+});
+
+export const messageFormatSchema = z.enum(['text', 'markdown', 'richtext', 'auto'], {
+  description: 'Message format for bot responses (richtext is an alias for markdown, auto detects markdown features)',
+});
+
+export const longTextModeSchema = z.enum(['chunk', 'file']);
+
+// Per-account config schema (everything that can be overridden per account)
+export const dingTalkAccountConfigSchema = z.object({
+  enabled: z.boolean().default(true).describe('Enable this account'),
+  name: z.string().optional().describe('Display name for this account'),
+
+  // Credentials
+  clientId: z.string().optional()
+    .describe('DingTalk application AppKey'),
+  clientSecret: z.string().optional()
+    .describe('DingTalk application AppSecret'),
+  robotCode: z.string().optional()
+    .describe('Robot code (optional, defaults to clientId if not provided)'),
+
+  // DM config
+  dm: z.object({
+    enabled: z.boolean().default(true)
+      .describe('Enable direct messages'),
+    policy: dmPolicySchema.default('pairing')
+      .describe(
+        'Access control policy:\n' +
+        '  - disabled: No DM allowed\n' +
+        '  - pairing: Show staffId on first contact, admin adds to allowlist\n' +
+        '  - allowlist: Only specified users can DM\n' +
+        '  - open: Anyone can DM (not recommended)'
+      ),
+    allowFrom: z.array(z.string()).default([])
+      .describe('Allowed staff IDs (for pairing/allowlist policy)'),
+  }).default({}),
+
+  // Group config
+  groupPolicy: groupPolicySchema.default('allowlist')
+    .describe(
+      'Group chat policy:\n' +
+      '  - disabled: No groups\n' +
+      '  - allowlist: Only specified groups\n' +
+      '  - open: All groups'
+    ),
+  groupAllowlist: z.array(z.string()).default([])
+    .describe('Allowed group conversation IDs (only used when groupPolicy is "allowlist")'),
+  requireMention: z.boolean().default(true)
+    .describe('Require @ mention in group chats'),
+
+  // Message format
+  messageFormat: messageFormatSchema.default('text')
+    .describe(
+      'Message format:\n' +
+      '  - text: Plain text (recommended, supports tables)\n' +
+      '  - markdown: DingTalk markdown (limited support, no tables)\n' +
+      '  - richtext: Alias for markdown (deprecated, use markdown instead)\n' +
+      '  - auto: Auto-detect markdown features in response'
+    ),
+
+  // Thinking feedback
+  showThinking: z.boolean().default(false)
+    .describe('Send "正在思考..." feedback before AI responds'),
+
+  // Advanced
+  textChunkLimit: z.number().int().positive().default(2000).optional()
+    .describe('Text chunk size limit for long messages'),
+
+  longTextMode: longTextModeSchema.default('chunk')
+    .describe(
+      'How to handle long text messages:\n' +
+      '  - chunk: Split into multiple messages (default, same as official channels)\n' +
+      '  - file: Convert to .md file and send as attachment'
+    ),
+  longTextThreshold: z.number().int().positive().default(8000).optional()
+    .describe('Character threshold for longTextMode=file (default 8000)'),
+
+  // Per-group overrides
+  groups: z.record(z.string(), z.object({
+    systemPrompt: z.string().optional()
+      .describe('Per-group extra system prompt injected as GroupSystemPrompt'),
+    enabled: z.boolean().optional()
+      .describe('Disable this group (false = ignore all messages)'),
+    allowFrom: z.array(z.string()).optional()
+      .describe('Only respond to messages from these senderStaffIds in this group (supports "*" wildcard). If omitted, all senders are allowed.'),
+  })).optional().default({})
+    .describe('Per-group overrides keyed by conversationId'),
+
+  // Message aggregation
+  messageAggregation: z.boolean().default(true)
+    .describe(
+      'Aggregate messages from the same sender within a short time window.\n' +
+      'Useful when DingTalk splits link cards into multiple messages.'
+    ),
+  messageAggregationDelayMs: z.number().int().positive().default(2000).optional()
+    .describe('Time window in milliseconds to wait for additional messages (default 2000)'),
+}).passthrough();
+
+// Top-level DingTalk config: account config + multi-account support
+export const dingTalkConfigSchema = dingTalkAccountConfigSchema.extend({
+  accounts: z.record(z.string(), dingTalkAccountConfigSchema.partial().optional()).optional()
+    .describe('Named accounts that override top-level settings'),
+  defaultAccount: z.string().optional()
+    .describe('Default account ID (if accounts are defined)'),
+});
+
+// 导出配置类型
+export type DingTalkAccountConfig = z.infer<typeof dingTalkAccountConfigSchema>;
+export type DingTalkConfig = z.infer<typeof dingTalkConfigSchema>;
+
+/**
+ * 验证 DingTalk 配置
+ * @param config - 原始配置对象
+ * @returns 验证后的配置
+ * @throws ZodError 如果配置无效
+ */
+export function validateDingTalkConfig(config: unknown): DingTalkConfig {
+  try {
+    return dingTalkConfigSchema.parse(config);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      const formatted = error.issues.map(e => {
+        const path = e.path.join('.');
+        return `  - ${path || 'root'}: ${e.message}`;
+      }).join('\n');
+      throw new Error(`DingTalk config validation failed:\n${formatted}`);
+    }
+    throw error;
+  }
+}
+
+/**
+ * Validate per-account config (partial, used for account overrides)
+ */
+export function validateDingTalkAccountConfig(config: unknown): DingTalkAccountConfig {
+  return dingTalkAccountConfigSchema.parse(config);
+}
+
+/**
+ * 安全地验证配置，返回错误而不抛出异常
+ * @param config - 原始配置对象
+ * @returns { success: true, data } 或 { success: false, error }
+ */
+export function safeValidateDingTalkConfig(config: unknown):
+  | { success: true; data: DingTalkConfig }
+  | { success: false; error: string } {
+  try {
+    const data = dingTalkConfigSchema.parse(config);
+    return { success: true, data };
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      const formatted = error.issues.map(e => {
+        const path = e.path.join('.');
+        return `${path || 'root'}: ${e.message}`;
+      }).join('; ');
+      return { success: false, error: formatted };
+    }
+    return { success: false, error: String(error) };
+  }
+}

package/src/monitor.ts

@@ -1231,6 +1231,17 @@ async function processInboundMessage(
     // Check @mention requirement
     const requireMention = account.config.requireMention !== false;
     if (requireMention && !msg.isInAtList) return;
+
+    // Check per-group sender allowlist
+    const groupConfig = (account.config.groups ?? {})[conversationId];
+    const groupAllowFrom = groupConfig?.allowFrom;
+    if (groupAllowFrom && groupAllowFrom.length > 0) {
+      log?.info?.("[dingtalk] Group allowFrom check: senderId=" + senderId + " allowFrom=" + JSON.stringify(groupAllowFrom));
+      if (!isSenderAllowed(senderId, groupAllowFrom)) {
+        log?.info?.("[dingtalk] Group sender not in allowFrom: " + senderId + " for group " + conversationId);
+        return;
+      }
+    }
   }
 
   const sessionKey = "dingtalk:" + account.accountId + ":" + (isDm ? "dm" : "group") + ":" + conversationId;
@@ -1374,21 +1385,20 @@ async function dispatchMessage(params: {
   const queueKey = `${account.accountId}:${conversationId}`;
   const isQueueBusy = sessionQueues.has(queueKey);
 
-  // If queue is busy, send a recallable notification so it disappears when processing starts
+  // If queue is busy, add emotion reaction on user's message to indicate queued
   let queueAckCleanup: (() => Promise<void>) | null = null;
   if (isQueueBusy) {
-    const phrase = QUEUE_BUSY_PHRASES[Math.floor(Math.random() * QUEUE_BUSY_PHRASES.length)];
-    log?.info?.("[dingtalk] Queue busy for " + queueKey + ", notifying user");
+    log?.info?.("[dingtalk] Queue busy for " + queueKey + ", adding queue reaction");
     try {
-      if (account.clientId && account.clientSecret) {
+      if (account.clientId && account.clientSecret && params.msg.msgId && conversationId) {
         const robotCode = account.robotCode || account.clientId;
-        const result = await sendTypingIndicator({
+        const result = await addEmotionReply({
           clientId: account.clientId,
           clientSecret: account.clientSecret,
           robotCode,
-          userId: params.isDm ? params.senderId : undefined,
-          conversationId: !params.isDm ? conversationId : undefined,
-          message: '⏳ ' + phrase,
+          msgId: params.msg.msgId,
+          conversationId,
+          emotionName: '⏳排队中',
         });
         if (!result.error) {
           queueAckCleanup = result.cleanup;
@@ -1527,16 +1537,16 @@ async function dispatchMessageInternal(params: {
     runtime?.channel?.reply?.dispatchReplyFromConfig
   );
 
-  // Track if we've already cleaned up the typing indicator
+  // Track if we've already cleaned up the thinking feedback
   let typingCleaned = false;
   const cleanupTyping = async () => {
     if (typingCleanup && !typingCleaned) {
       typingCleaned = true;
       try {
         await typingCleanup();
-        log?.info?.('[dingtalk] Typing indicator recalled');
+        log?.info?.('[dingtalk] Thinking feedback recalled');
       } catch (err) {
-        log?.info?.('[dingtalk] Failed to recall typing indicator: ' + err);
+        log?.info?.('[dingtalk] Failed to recall thinking feedback: ' + err);
       }
     }
   };