@ycodium-ai/plugin-im 0.2.2958 → 0.2.2966

package/dist/index.js

@@ -22669,24 +22669,24 @@ var require_sender = __commonJS({
        * @public
        */
       ping(data, mask, cb) {
-        let byteLength;
+        let byteLength2;
         let readOnly;
         if (typeof data === "string") {
-          byteLength = Buffer.byteLength(data);
+          byteLength2 = Buffer.byteLength(data);
           readOnly = false;
         } else if (isBlob(data)) {
-          byteLength = data.size;
+          byteLength2 = data.size;
           readOnly = false;
         } else {
           data = toBuffer(data);
-          byteLength = data.length;
+          byteLength2 = data.length;
           readOnly = toBuffer.readOnly;
         }
-        if (byteLength > 125) {
+        if (byteLength2 > 125) {
           throw new RangeError("The data size must not be greater than 125 bytes");
         }
         const options = {
-          [kByteLength]: byteLength,
+          [kByteLength]: byteLength2,
           fin: true,
           generateMask: this._generateMask,
           mask,
@@ -22716,24 +22716,24 @@ var require_sender = __commonJS({
        * @public
        */
       pong(data, mask, cb) {
-        let byteLength;
+        let byteLength2;
         let readOnly;
         if (typeof data === "string") {
-          byteLength = Buffer.byteLength(data);
+          byteLength2 = Buffer.byteLength(data);
           readOnly = false;
         } else if (isBlob(data)) {
-          byteLength = data.size;
+          byteLength2 = data.size;
           readOnly = false;
         } else {
           data = toBuffer(data);
-          byteLength = data.length;
+          byteLength2 = data.length;
           readOnly = toBuffer.readOnly;
         }
-        if (byteLength > 125) {
+        if (byteLength2 > 125) {
           throw new RangeError("The data size must not be greater than 125 bytes");
         }
         const options = {
-          [kByteLength]: byteLength,
+          [kByteLength]: byteLength2,
           fin: true,
           generateMask: this._generateMask,
           mask,
@@ -22774,23 +22774,23 @@ var require_sender = __commonJS({
         const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
         let opcode = options.binary ? 2 : 1;
         let rsv1 = options.compress;
-        let byteLength;
+        let byteLength2;
         let readOnly;
         if (typeof data === "string") {
-          byteLength = Buffer.byteLength(data);
+          byteLength2 = Buffer.byteLength(data);
           readOnly = false;
         } else if (isBlob(data)) {
-          byteLength = data.size;
+          byteLength2 = data.size;
           readOnly = false;
         } else {
           data = toBuffer(data);
-          byteLength = data.length;
+          byteLength2 = data.length;
           readOnly = toBuffer.readOnly;
         }
         if (this._firstFragment) {
           this._firstFragment = false;
           if (rsv1 && perMessageDeflate && perMessageDeflate.params[perMessageDeflate._isServer ? "server_no_context_takeover" : "client_no_context_takeover"]) {
-            rsv1 = byteLength >= perMessageDeflate._threshold;
+            rsv1 = byteLength2 >= perMessageDeflate._threshold;
           }
           this._compress = rsv1;
         } else {
@@ -22799,7 +22799,7 @@ var require_sender = __commonJS({
         }
         if (options.fin) this._firstFragment = true;
         const opts = {
-          [kByteLength]: byteLength,
+          [kByteLength]: byteLength2,
           fin: options.fin,
           generateMask: this._generateMask,
           mask: options.mask,
@@ -23360,7 +23360,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash: createHash2 } = __require("crypto");
+    var { randomBytes, createHash: createHash3 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -24028,7 +24028,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -24397,7 +24397,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash2 } = __require("crypto");
+    var { createHash: createHash3 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -24704,7 +24704,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -126159,11 +126159,67 @@ ${lines.join("\n")}
 // src/index.ts
 import { definePlugin } from "@ycodium-ai/plugin-api";
 
+// src/errors.ts
+var describeError = (error) => error instanceof Error ? error.message : String(error);
+
+// src/acknowledgements.ts
+var makeAcknowledgements = (core) => {
+  const { host, adapterFor } = core;
+  const acknowledgements = /* @__PURE__ */ new Map();
+  const markWorking = async (binding, threadId, messageId) => {
+    const adapter = adapterFor(binding.platform);
+    if (adapter?.acknowledge === void 0) return;
+    try {
+      const ackId = await adapter.acknowledge(binding, messageId);
+      if (ackId === null) return;
+      const pending = acknowledgements.get(threadId) ?? [];
+      pending.push({ messageId, ackId });
+      acknowledgements.set(threadId, pending);
+      host.log.info("chat acknowledged a message", { threadId, messageId });
+    } catch (error) {
+      host.log.warn("chat could not acknowledge the message", { error: describeError(error) });
+    }
+  };
+  const clearWorking = async (binding, threadId) => {
+    const adapter = adapterFor(binding.platform);
+    const pending = acknowledgements.get(threadId);
+    if (pending === void 0 || adapter?.clearAcknowledge === void 0) return;
+    acknowledgements.delete(threadId);
+    for (const entry of pending) {
+      try {
+        await adapter.clearAcknowledge(binding, entry.messageId, entry.ackId);
+      } catch (error) {
+        host.log.warn("chat could not clear the acknowledgement", {
+          error: describeError(error)
+        });
+      }
+    }
+  };
+  return { markWorking, clearWorking };
+};
+
 // src/botConfig.ts
 import {
   PLUGIN_PROXY_DIRECT
 } from "@ycodium-ai/plugin-api";
 
+// src/attachedThreads.ts
+var ATTACHED_THREAD_LIMIT = 200;
+var attachedKey = (chatKey, threadId) => `${chatKey}
+${threadId}`;
+var hasAttached = (state, chatKey, threadId) => state.attached?.[attachedKey(chatKey, threadId)] !== void 0;
+var attachedOnChat = (state, chatKey, projectId) => Object.values(state.attached ?? {}).filter(
+  (record2) => record2.chatKey === chatKey && record2.projectId === projectId
+);
+var nonEmpty = (value) => typeof value === "string" && value !== "" ? value : null;
+var readAttached = (data) => {
+  const chatKey = nonEmpty(data["chatKey"]);
+  const threadId = nonEmpty(data["threadId"]);
+  const projectId = nonEmpty(data["projectId"]);
+  const attachedAt = nonEmpty(data["attachedAt"]);
+  return chatKey === null || threadId === null || projectId === null || attachedAt === null ? null : { chatKey, threadId, projectId, attachedAt };
+};
+
 // src/chatState.ts
 var IM_STATE_KEY = "chats";
 var IM_STATE_VERSION = 1;
@@ -126188,7 +126244,8 @@ var DEFAULT_CHAT_RECORD = {
   threadId: null,
   target: { kind: "thread" },
   model: null,
-  plan: false
+  plan: false,
+  chatKind: null
 };
 var chatOf = (state, chatKey) => ({
   ...DEFAULT_CHAT_RECORD,
@@ -126232,11 +126289,11 @@ var openQueueOfThread = (state, threadId) => Object.values(queueOf(state)).filte
   (record2) => record2.threadId === threadId && record2.settled === void 0
 );
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var nonEmpty = (value) => typeof value === "string" && value !== "" ? value : null;
+var nonEmpty2 = (value) => typeof value === "string" && value !== "" ? value : null;
 var readTarget = (value) => {
   if (!isRecord(value)) return null;
   if (value["kind"] === "thread") return { kind: "thread" };
-  const teamId = nonEmpty(value["teamId"]);
+  const teamId = nonEmpty2(value["teamId"]);
   return value["kind"] === "team" && teamId !== null ? { kind: "team", teamId } : null;
 };
 var readButtons = (value) => {
@@ -126244,8 +126301,8 @@ var readButtons = (value) => {
   const buttons = [];
   for (const entry of value) {
     if (!isRecord(entry)) return null;
-    const token = nonEmpty(entry["token"]);
-    const decision = nonEmpty(entry["decision"]);
+    const token = nonEmpty2(entry["token"]);
+    const decision = nonEmpty2(entry["decision"]);
     const label = typeof entry["label"] === "string" ? entry["label"] : null;
     if (token === null || decision === null || label === null) return null;
     buttons.push({ token, label, decision });
@@ -126257,8 +126314,8 @@ var readQuestionOptions = (value) => {
   const options = [];
   for (const entry of value) {
     if (!isRecord(entry)) return null;
-    const token = nonEmpty(entry["token"]);
-    const optionValue = nonEmpty(entry["value"]);
+    const token = nonEmpty2(entry["token"]);
+    const optionValue = nonEmpty2(entry["value"]);
     if (token === null || optionValue === null || typeof entry["label"] !== "string") return null;
     const planAction = entry["planAction"];
     options.push({
@@ -126276,10 +126333,10 @@ var readQuestionItems = (value) => {
   const items = [];
   for (const entry of value) {
     if (!isRecord(entry)) return null;
-    const id = nonEmpty(entry["id"]);
+    const id = nonEmpty2(entry["id"]);
     const options = readQuestionOptions(entry["options"]);
     if (id === null || options === null || typeof entry["question"] !== "string") return null;
-    const submitToken = nonEmpty(entry["submitToken"]);
+    const submitToken = nonEmpty2(entry["submitToken"]);
     items.push({
       id,
       header: typeof entry["header"] === "string" ? entry["header"] : "",
@@ -126334,29 +126391,33 @@ var foldImEvent = (state, name, data) => {
   if (!isRecord(data)) return state;
   switch (name) {
     case "chat-updated": {
-      const chatKey = nonEmpty(data["chatKey"]);
+      const chatKey = nonEmpty2(data["chatKey"]);
       if (chatKey === null) return state;
       const patch = {};
       if (data["projectId"] === null) patch.projectId = null;
-      else if (nonEmpty(data["projectId"]) !== null) patch.projectId = nonEmpty(data["projectId"]);
+      else if (nonEmpty2(data["projectId"]) !== null) patch.projectId = nonEmpty2(data["projectId"]);
       if (data["threadId"] === null) patch.threadId = null;
-      else if (nonEmpty(data["threadId"]) !== null) patch.threadId = nonEmpty(data["threadId"]);
+      else if (nonEmpty2(data["threadId"]) !== null) patch.threadId = nonEmpty2(data["threadId"]);
       const target = readTarget(data["target"]);
       if (target !== null) patch.target = target;
       if (data["model"] === null) patch.model = null;
       else if (isRecord(data["model"])) {
-        const instanceId = nonEmpty(data["model"]["instanceId"]);
-        const model = nonEmpty(data["model"]["model"]);
+        const instanceId = nonEmpty2(data["model"]["instanceId"]);
+        const model = nonEmpty2(data["model"]["model"]);
         if (instanceId !== null && model !== null) patch.model = { instanceId, model };
       }
       if (typeof data["plan"] === "boolean") patch.plan = data["plan"];
+      if (data["chatKind"] === null) patch.chatKind = null;
+      else if (data["chatKind"] === "private" || data["chatKind"] === "group") {
+        patch.chatKind = data["chatKind"];
+      }
       return withChat(state, chatKey, patch);
     }
     case "thread-opened": {
-      const chatKey = nonEmpty(data["chatKey"]);
-      const threadId = nonEmpty(data["threadId"]);
-      const projectId = nonEmpty(data["projectId"]);
-      const openedAt = nonEmpty(data["openedAt"]);
+      const chatKey = nonEmpty2(data["chatKey"]);
+      const threadId = nonEmpty2(data["threadId"]);
+      const projectId = nonEmpty2(data["projectId"]);
+      const openedAt = nonEmpty2(data["openedAt"]);
       if (chatKey === null || threadId === null || projectId === null || openedAt === null) {
         return state;
       }
@@ -126369,10 +126430,17 @@ var foldImEvent = (state, name, data) => {
         )
       };
     }
+    case "thread-attached": {
+      const record2 = readAttached(data);
+      if (record2 === null) return state;
+      const key = attachedKey(record2.chatKey, record2.threadId);
+      const attached = { ...state.attached, [key]: record2 };
+      return { ...state, attached: keepNewest(attached, ATTACHED_THREAD_LIMIT) };
+    }
     case "approval-offered": {
-      const chatKey = nonEmpty(data["chatKey"]);
-      const threadId = nonEmpty(data["threadId"]);
-      const requestId = nonEmpty(data["requestId"]);
+      const chatKey = nonEmpty2(data["chatKey"]);
+      const threadId = nonEmpty2(data["threadId"]);
+      const requestId = nonEmpty2(data["requestId"]);
       const options = readButtons(data["options"]);
       if (chatKey === null || threadId === null || requestId === null || options === null) {
         return state;
@@ -126389,7 +126457,7 @@ var foldImEvent = (state, name, data) => {
       };
     }
     case "approval-resolved": {
-      const requestId = nonEmpty(data["requestId"]);
+      const requestId = nonEmpty2(data["requestId"]);
       const existing = requestId === null ? void 0 : state.approvals[requestId];
       if (requestId === null || existing === void 0) return state;
       return {
@@ -126398,8 +126466,8 @@ var foldImEvent = (state, name, data) => {
       };
     }
     case "approval-carded": {
-      const requestId = nonEmpty(data["requestId"]);
-      const cardId = nonEmpty(data["cardId"]);
+      const requestId = nonEmpty2(data["requestId"]);
+      const cardId = nonEmpty2(data["cardId"]);
       const existing = requestId === null ? void 0 : state.approvals[requestId];
       if (requestId === null || cardId === null || existing === void 0) return state;
       return {
@@ -126408,9 +126476,9 @@ var foldImEvent = (state, name, data) => {
       };
     }
     case "question-offered": {
-      const chatKey = nonEmpty(data["chatKey"]);
-      const threadId = nonEmpty(data["threadId"]);
-      const requestId = nonEmpty(data["requestId"]);
+      const chatKey = nonEmpty2(data["chatKey"]);
+      const threadId = nonEmpty2(data["threadId"]);
+      const requestId = nonEmpty2(data["requestId"]);
       const items = readQuestionItems(data["items"]);
       if (chatKey === null || threadId === null || requestId === null || items === null) {
         return state;
@@ -126427,12 +126495,12 @@ var foldImEvent = (state, name, data) => {
       };
     }
     case "question-carded": {
-      const cardId = nonEmpty(data["cardId"]);
+      const cardId = nonEmpty2(data["cardId"]);
       if (cardId === null) return state;
       return withQuestionItem(
         state,
-        nonEmpty(data["requestId"]),
-        nonEmpty(data["questionId"]),
+        nonEmpty2(data["requestId"]),
+        nonEmpty2(data["questionId"]),
         (item) => ({ ...item, cardId })
       );
     }
@@ -126441,8 +126509,8 @@ var foldImEvent = (state, name, data) => {
       if (!Array.isArray(selected)) return state;
       return withQuestionItem(
         state,
-        nonEmpty(data["requestId"]),
-        nonEmpty(data["questionId"]),
+        nonEmpty2(data["requestId"]),
+        nonEmpty2(data["questionId"]),
         (item) => ({ ...item, selected })
       );
     }
@@ -126452,13 +126520,13 @@ var foldImEvent = (state, name, data) => {
       const label = typeof data["label"] === "string" ? data["label"] : "";
       return withQuestionItem(
         state,
-        nonEmpty(data["requestId"]),
-        nonEmpty(data["questionId"]),
+        nonEmpty2(data["requestId"]),
+        nonEmpty2(data["questionId"]),
         (item) => ({ ...item, answer, answerLabel: label })
       );
     }
     case "question-resolved": {
-      const requestId = nonEmpty(data["requestId"]);
+      const requestId = nonEmpty2(data["requestId"]);
       const existing = requestId === null ? void 0 : questionsOf(state)[requestId];
       if (requestId === null || existing === void 0) return state;
       const ending = data["ending"];
@@ -126475,12 +126543,12 @@ var foldImEvent = (state, name, data) => {
       };
     }
     case "queue-offered": {
-      const chatKey = nonEmpty(data["chatKey"]);
-      const threadId = nonEmpty(data["threadId"]);
-      const intentId = nonEmpty(data["intentId"]);
-      const steerToken = nonEmpty(data["steerToken"]);
-      const withdrawToken = nonEmpty(data["withdrawToken"]);
-      const resumeToken = nonEmpty(data["resumeToken"]);
+      const chatKey = nonEmpty2(data["chatKey"]);
+      const threadId = nonEmpty2(data["threadId"]);
+      const intentId = nonEmpty2(data["intentId"]);
+      const steerToken = nonEmpty2(data["steerToken"]);
+      const withdrawToken = nonEmpty2(data["withdrawToken"]);
+      const resumeToken = nonEmpty2(data["resumeToken"]);
       if (chatKey === null || threadId === null || intentId === null || steerToken === null || withdrawToken === null || resumeToken === null) {
         return state;
       }
@@ -126505,30 +126573,30 @@ var foldImEvent = (state, name, data) => {
       };
     }
     case "queue-carded": {
-      const cardId = nonEmpty(data["cardId"]);
+      const cardId = nonEmpty2(data["cardId"]);
       if (cardId === null) return state;
-      return withQueueRecord(state, nonEmpty(data["intentId"]), (record2) => ({
+      return withQueueRecord(state, nonEmpty2(data["intentId"]), (record2) => ({
         ...record2,
         cardId
       }));
     }
     case "queue-steering":
-      return withQueueRecord(state, nonEmpty(data["intentId"]), (record2) => ({
+      return withQueueRecord(state, nonEmpty2(data["intentId"]), (record2) => ({
         ...record2,
         steering: data["steering"] === true
       }));
     case "queue-settled": {
       const outcome = data["outcome"];
       if (outcome !== "steered" && outcome !== "sent" && outcome !== "removed") return state;
-      return withQueueRecord(state, nonEmpty(data["intentId"]), (record2) => ({
+      return withQueueRecord(state, nonEmpty2(data["intentId"]), (record2) => ({
         ...record2,
         settled: outcome
       }));
     }
     case "turn-card-opened": {
-      const cardId = nonEmpty(data["cardId"]);
-      const chatKey = nonEmpty(data["chatKey"]);
-      const threadId = nonEmpty(data["threadId"]);
+      const cardId = nonEmpty2(data["cardId"]);
+      const chatKey = nonEmpty2(data["chatKey"]);
+      const threadId = nonEmpty2(data["threadId"]);
       if (cardId === null || chatKey === null || threadId === null) return state;
       const title = typeof data["title"] === "string" ? data["title"] : "";
       return {
@@ -126540,7 +126608,7 @@ var foldImEvent = (state, name, data) => {
       };
     }
     case "turn-card-closed": {
-      const cardId = nonEmpty(data["cardId"]);
+      const cardId = nonEmpty2(data["cardId"]);
       if (cardId === null) return state;
       const { [cardId]: _closed, ...rest } = openTurnCardsOf(state);
       return { ...state, turnCards: rest };
@@ -126557,6 +126625,131 @@ var foldPluginEvent = (pluginId) => (state, event) => {
   return foldImEvent(state, fullName.slice(fullName.lastIndexOf("/") + 1), event.payload["data"]);
 };
 
+// src/configRead.ts
+var readString = (row, key) => {
+  const value = row[key];
+  return typeof value === "string" ? value.trim() : "";
+};
+
+// src/targetKind.ts
+var TARGET_KIND_OPTIONS = [
+  { value: "chat", labelKey: "settings.deliveryKind.chat" },
+  { value: "user", labelKey: "settings.deliveryKind.user" },
+  { value: "group", labelKey: "settings.deliveryKind.group" }
+];
+var TARGET_KINDS = new Set(
+  TARGET_KIND_OPTIONS.map((option) => option.value)
+);
+var isTargetKind = (value) => TARGET_KINDS.has(value);
+
+// src/deliveryTargets.ts
+var DELIVERY_TARGETS_FIELD = "deliveryTargets";
+var DELIVERY_HTTP_ENABLED_FIELD = "deliveryHttpEnabled";
+var DELIVERY_HTTP_PORT_FIELD = "deliveryHttpPort";
+var DELIVERY_HTTP_TOKEN_FIELD = "deliveryHttpToken";
+var DEFAULT_DELIVERY_HTTP_PORT = 3847;
+var TARGET_ID_PATTERN = /^[A-Za-z0-9._:@-]{1,128}$/;
+var isValidTargetId = (value) => TARGET_ID_PATTERN.test(value);
+var readDeliveryTargets = (config2) => {
+  const table2 = config2[DELIVERY_TARGETS_FIELD];
+  if (typeof table2 !== "object" || table2 === null) return [];
+  return Object.entries(table2).flatMap(([rowId, row]) => {
+    if (typeof row !== "object" || row === null) return [];
+    const record2 = row;
+    const botId = readString(record2, "botId");
+    const targetId = readString(record2, "targetId");
+    const platformChatId = readString(record2, "platformChatId");
+    const kind = readString(record2, "kind") || "chat";
+    if (botId === "" || targetId === "" || platformChatId === "" || !isTargetKind(kind)) return [];
+    if (!isValidTargetId(targetId)) return [];
+    return [
+      {
+        rowId,
+        botId,
+        targetId,
+        name: readString(record2, "name") || targetId,
+        kind,
+        platformChatId
+      }
+    ];
+  });
+};
+var findDeliveryTarget = (targets, botId, targetId) => targets.find((t) => t.botId === botId && t.targetId === targetId);
+var readDeliveryHttpEnabled = (config2) => config2[DELIVERY_HTTP_ENABLED_FIELD] === true || config2[DELIVERY_HTTP_ENABLED_FIELD] === "true";
+var readDeliveryHttpPort = (config2) => {
+  const raw = config2[DELIVERY_HTTP_PORT_FIELD];
+  const n = typeof raw === "number" ? raw : typeof raw === "string" ? Number.parseInt(raw.trim(), 10) : DEFAULT_DELIVERY_HTTP_PORT;
+  if (!Number.isInteger(n) || n < 1 || n > 65535) return DEFAULT_DELIVERY_HTTP_PORT;
+  return n;
+};
+var readDeliveryHttpToken = (config2) => {
+  const value = config2[DELIVERY_HTTP_TOKEN_FIELD];
+  return typeof value === "string" ? value : "";
+};
+var buildDeliverySettingsFields = () => [
+  {
+    key: DELIVERY_HTTP_ENABLED_FIELD,
+    kind: "boolean",
+    labelKey: "settings.deliveryHttp.enabled.label",
+    descriptionKey: "settings.deliveryHttp.enabled.description"
+  },
+  {
+    key: DELIVERY_HTTP_PORT_FIELD,
+    kind: "number",
+    labelKey: "settings.deliveryHttp.port.label",
+    descriptionKey: "settings.deliveryHttp.port.description",
+    showWhen: { key: DELIVERY_HTTP_ENABLED_FIELD, equals: ["true"] }
+  },
+  {
+    key: DELIVERY_HTTP_TOKEN_FIELD,
+    kind: "password",
+    labelKey: "settings.deliveryHttp.token.label",
+    descriptionKey: "settings.deliveryHttp.token.description",
+    showWhen: { key: DELIVERY_HTTP_ENABLED_FIELD, equals: ["true"] }
+  },
+  {
+    key: DELIVERY_TARGETS_FIELD,
+    kind: "table",
+    labelKey: "settings.deliveryTargets.label",
+    descriptionKey: "settings.deliveryTargets.description",
+    columns: [
+      {
+        key: "botId",
+        kind: "text",
+        labelKey: "column.deliveryBotId.label",
+        descriptionKey: "column.deliveryBotId.description",
+        placeholderKey: "column.deliveryBotId.placeholder"
+      },
+      {
+        key: "targetId",
+        kind: "text",
+        labelKey: "column.deliveryTargetId.label",
+        descriptionKey: "column.deliveryTargetId.description",
+        placeholderKey: "column.deliveryTargetId.placeholder"
+      },
+      {
+        key: "name",
+        kind: "text",
+        labelKey: "column.deliveryName.label",
+        placeholderKey: "column.deliveryName.placeholder"
+      },
+      {
+        key: "kind",
+        kind: "select",
+        labelKey: "column.deliveryKind.label",
+        options: [...TARGET_KIND_OPTIONS]
+      },
+      {
+        key: "platformChatId",
+        kind: "text",
+        labelKey: "column.deliveryPlatformChatId.label",
+        descriptionKey: "column.deliveryPlatformChatId.description",
+        placeholderKey: "column.deliveryPlatformChatId.placeholder"
+      }
+    ]
+  }
+];
+
 // src/botConfig.ts
 var BOTS_FIELD = "bots";
 var REPLY_LANGUAGE_FIELD = "replyLanguage";
@@ -126569,11 +126762,66 @@ var INBOUND_RUNTIME_MODES = /* @__PURE__ */ new Set([
   "full-access"
 ]);
 var DEFAULT_INBOUND_RUNTIME_MODE = "auto-accept-edits";
+var QUEUE_MODE_OPTIONS = [
+  { value: "queue", labelKey: "settings.queueMode.queue" },
+  { value: "steer", labelKey: "settings.queueMode.steer" }
+];
+var QUEUE_MODES = new Set(QUEUE_MODE_OPTIONS.map((option) => option.value));
+var DEFAULT_QUEUE_MODE = "queue";
+var ACCESS_MODE_OPTIONS = [
+  { value: "allowlist", labelKey: "settings.accessMode.allowlist" },
+  { value: "open", labelKey: "settings.accessMode.open" }
+];
+var ACCESS_MODES = new Set(
+  ACCESS_MODE_OPTIONS.map((option) => option.value)
+);
+var DEFAULT_ACCESS_MODE = "allowlist";
+var LARK_PANEL_MODE_OPTIONS = [
+  { value: "default", labelKey: "settings.larkPanelMode.default" },
+  { value: "minimal", labelKey: "settings.larkPanelMode.minimal" }
+];
+var LARK_PANEL_MODES = new Set(
+  LARK_PANEL_MODE_OPTIONS.map((option) => option.value)
+);
+var DEFAULT_LARK_PANEL_MODE = "default";
 var chatKeyOf = (binding) => `${binding.rowId}:${binding.chatId}`;
-var readString = (row, key) => {
-  const value = row[key];
-  return typeof value === "string" ? value.trim() : "";
+var parseQueueMode = (value) => QUEUE_MODES.has(value) ? value : DEFAULT_QUEUE_MODE;
+var parseAccessMode = (value) => ACCESS_MODES.has(value) ? value : DEFAULT_ACCESS_MODE;
+var parseLarkPanelMode = (value) => LARK_PANEL_MODES.has(value) ? value : DEFAULT_LARK_PANEL_MODE;
+var parseOnOff = (value, defaultOn) => {
+  if (value === "on") return true;
+  if (value === "off") return false;
+  return defaultOn;
 };
+var ROW_ACTION_COMMANDS = {
+  checkConnection: "im.settings.checkConnection",
+  copyDiagnostics: "im.settings.copyDiagnostics",
+  larkRepair: "im.settings.larkRepair"
+};
+var BOT_ROW_ACTIONS = [
+  {
+    id: "checkConnection",
+    labelKey: "rowAction.checkConnection.label",
+    descriptionKey: "rowAction.checkConnection.description",
+    command: ROW_ACTION_COMMANDS.checkConnection,
+    fills: []
+  },
+  {
+    id: "copyDiagnostics",
+    labelKey: "rowAction.copyDiagnostics.label",
+    descriptionKey: "rowAction.copyDiagnostics.description",
+    command: ROW_ACTION_COMMANDS.copyDiagnostics,
+    fills: []
+  },
+  {
+    id: "larkRepair",
+    labelKey: "rowAction.larkRepair.label",
+    descriptionKey: "rowAction.larkRepair.description",
+    command: ROW_ACTION_COMMANDS.larkRepair,
+    showWhen: { key: "platform", equals: ["lark"] },
+    fills: []
+  }
+];
 var buildSettingsCard = (adapters) => {
   const platformColumn = {
     key: "platform",
@@ -126619,11 +126867,20 @@ var buildSettingsCard = (adapters) => {
           },
           platformColumn,
           ...credentialColumns,
+          {
+            key: "accessMode",
+            kind: "select",
+            labelKey: "column.accessMode.label",
+            descriptionKey: "column.accessMode.description",
+            options: [...ACCESS_MODE_OPTIONS]
+          },
           {
             key: "allowedSenders",
             kind: "text",
             labelKey: "column.allowedSenders.label",
-            descriptionKey: "column.allowedSenders.description"
+            descriptionKey: "column.allowedSenders.description",
+            // 缺省／空串＝allowlist（与 parseAccessMode 一致），仍显示白名单框。
+            showWhen: { key: "accessMode", equals: ["allowlist", ""] }
           },
           {
             // 选项由宿主填,连三态一起——插件只声明「这个格子装的是代理」,宿主因此
@@ -126655,9 +126912,37 @@ var buildSettingsCard = (adapters) => {
               { value: "never", labelKey: "settings.groupMention.never" },
               { value: "ambient", labelKey: "settings.groupMention.ambient" }
             ]
+          },
+          {
+            key: "queueMode",
+            kind: "select",
+            labelKey: "column.queueMode.label",
+            descriptionKey: "column.queueMode.description",
+            options: [...QUEUE_MODE_OPTIONS]
+          },
+          {
+            key: "larkPanelMode",
+            kind: "select",
+            labelKey: "column.larkPanelMode.label",
+            descriptionKey: "column.larkPanelMode.description",
+            showWhen: { key: "platform", equals: ["lark"] },
+            options: [...LARK_PANEL_MODE_OPTIONS]
+          },
+          {
+            key: "wecomNumberedHints",
+            kind: "select",
+            labelKey: "column.wecomNumberedHints.label",
+            descriptionKey: "column.wecomNumberedHints.description",
+            showWhen: { key: "platform", equals: ["wecom"] },
+            options: [
+              { value: "on", labelKey: "settings.onOff.on" },
+              { value: "off", labelKey: "settings.onOff.off" }
+            ]
           }
-        ]
-      }
+        ],
+        rowActions: [...BOT_ROW_ACTIONS]
+      },
+      ...buildDeliverySettingsFields()
     ]
   };
 };
@@ -126678,10 +126963,14 @@ var readBot = (adapterFor, rowId, row) => {
     displayName: readString(row, "displayName") || adapter.label,
     // 空串＝跟机器默认（省略），`direct`＝明确不加代理（null），其余就是那个 id。
     proxy: proxyValue === "" ? void 0 : proxyValue === PLUGIN_PROXY_DIRECT ? null : proxyValue,
+    accessMode: parseAccessMode(readString(row, "accessMode")),
     allowedSenders,
     values,
     runtimeMode: INBOUND_RUNTIME_MODES.has(requested) ? requested : DEFAULT_INBOUND_RUNTIME_MODE,
-    groupMention: parseGroupMention(readString(row, "groupMention"))
+    groupMention: parseGroupMention(readString(row, "groupMention")),
+    queueMode: parseQueueMode(readString(row, "queueMode")),
+    larkPanelMode: parseLarkPanelMode(readString(row, "larkPanelMode")),
+    wecomNumberedHints: parseOnOff(readString(row, "wecomNumberedHints"), true)
   };
   return adapter.isConfigured(bot) ? bot : null;
 };
@@ -126703,147 +126992,51 @@ var findBindingByChatKey = (bots, state, chatKey) => {
   const bot = bots.find((candidate) => chatKey.startsWith(`${candidate.rowId}:`));
   return bot === void 0 ? void 0 : bindingOf(bot, chatKey.slice(bot.rowId.length + 1), state);
 };
-var isAllowedSender = (bot, sender) => sender !== null && bot.allowedSenders.has(sender);
-
-// src/keyedQueue.ts
-var makeKeyedQueue = (onError) => {
-  const tails = /* @__PURE__ */ new Map();
-  return (key, work) => {
-    const run = (tails.get(key) ?? Promise.resolve()).then(work).catch(onError).then(() => {
-      if (tails.get(key) === run) tails.delete(key);
-    });
-    tails.set(key, run);
-  };
+var isAllowedSender = (bot, sender) => {
+  if (sender === null || sender === "") return false;
+  if (bot.accessMode === "open") return true;
+  return bot.allowedSenders.has(sender);
 };
 
-// src/core.ts
-var describeError = (error) => error instanceof Error ? error.message : String(error);
-var makeImCore = (input) => {
-  const { host, t, adapters } = input;
-  const adapterFor = (platform) => adapters.find((adapter) => adapter.platform === platform);
-  let state = emptyState();
-  const stateHandle = input.derivedState({
-    key: IM_STATE_KEY,
-    version: IM_STATE_VERSION,
-    events: ["plugin.event-appended"],
-    init: emptyState,
-    apply: foldPluginEvent(input.pluginId)
-  });
-  const ready = stateHandle.get().then(
-    (restored) => {
-      state = restored;
-    },
-    (error) => {
-      host.log.warn("chat could not restore its saved state", { error: describeError(error) });
-    }
-  );
-  let persisting = Promise.resolve();
-  const commit = (name, data) => {
-    state = foldImEvent(state, name, data);
-    persisting = persisting.then(
-      () => host.events.append({ name, aggregate: { kind: "plugin", id: input.pluginId }, data })
-    ).then(
-      () => void 0,
-      (error) => {
-        host.log.warn("chat could not save its state", { name, error: describeError(error) });
-      }
-    );
-  };
-  const bindChat = (chatKey, threadId) => {
-    commit("chat-updated", { chatKey, threadId });
-  };
-  const outbound = makeKeyedQueue((error) => {
-    host.log.warn("chat could not deliver a card", { error: describeError(error) });
-  });
-  const postImages = async (binding, attachments) => {
-    const adapter = adapterFor(binding.platform);
-    if (adapter?.sendImage === void 0) return;
-    for (const attachment of attachments) {
-      if (attachment.type !== "image") continue;
-      try {
-        const bytes = await host.attachments.read(attachment.id);
-        await adapter.sendImage(binding, {
-          bytes,
-          name: attachment.name,
-          mimeType: attachment.mimeType
-        });
-      } catch (error) {
-        host.log.warn("chat could not deliver an image", {
-          name: attachment.name,
-          error: describeError(error)
-        });
-      }
-    }
-  };
-  const deliver = async (binding, text3, attachments = []) => {
-    await postImages(binding, attachments);
-    if (text3.trim() === "") return;
-    try {
-      await adapterFor(binding.platform)?.sendText(binding, text3);
-    } catch (error) {
-      host.log.warn("chat could not deliver", { error: describeError(error) });
-    }
-  };
-  const bots = () => readBots(input.config, adapterFor);
-  const bindingForChatKey = (chatKey) => findBindingByChatKey(bots(), state, chatKey);
-  return {
-    host,
-    t,
-    adapterFor,
-    get state() {
-      return state;
-    },
-    ready,
-    commit,
-    bindChat,
-    outbound,
-    deliver,
-    bots,
-    bindingOf: (bot, chatId) => bindingOf(bot, chatId, state),
-    bindingForChatKey,
-    bindingOfThread: (threadId) => {
-      const chatKey = chatOfThread(state, threadId);
-      return chatKey === void 0 ? void 0 : bindingForChatKey(chatKey);
-    },
-    hasPanel: (binding) => adapterFor(binding.platform)?.panel !== void 0
-  };
+// src/numberedReply.ts
+var optionIndexFrom = (text3, count) => {
+  const trimmed = text3.trim();
+  if (!/^\d+$/.test(trimmed)) return null;
+  const index = Number.parseInt(trimmed, 10);
+  return Number.isInteger(index) && index >= 1 && index <= count ? index : null;
 };
-
-// src/acknowledgements.ts
-var makeAcknowledgements = (core) => {
-  const { host, adapterFor } = core;
-  const acknowledgements = /* @__PURE__ */ new Map();
-  const markWorking = async (binding, threadId, messageId) => {
-    const adapter = adapterFor(binding.platform);
-    if (adapter?.acknowledge === void 0) return;
-    try {
-      const ackId = await adapter.acknowledge(binding, messageId);
-      if (ackId === null) return;
-      const pending = acknowledgements.get(threadId) ?? [];
-      pending.push({ messageId, ackId });
-      acknowledgements.set(threadId, pending);
-      host.log.info("chat acknowledged a message", { threadId, messageId });
-    } catch (error) {
-      host.log.warn("chat could not acknowledge the message", { error: describeError(error) });
-    }
-  };
-  const clearWorking = async (binding, threadId) => {
-    const adapter = adapterFor(binding.platform);
-    const pending = acknowledgements.get(threadId);
-    if (pending === void 0 || adapter?.clearAcknowledge === void 0) return;
-    acknowledgements.delete(threadId);
-    for (const entry of pending) {
-      try {
-        await adapter.clearAcknowledge(binding, entry.messageId, entry.ackId);
-      } catch (error) {
-        host.log.warn("chat could not clear the acknowledgement", {
-          error: describeError(error)
-        });
-      }
-    }
-  };
-  return { markWorking, clearWorking };
+var DECISION_WORDS = /* @__PURE__ */ new Map([
+  ["\u6279\u51C6", "accept"],
+  ["\u540C\u610F", "accept"],
+  ["\u5141\u8BB8", "accept"],
+  ["approve", "accept"],
+  ["allow", "accept"],
+  ["yes", "accept"],
+  ["\u62D2\u7EDD", "decline"],
+  ["\u4E0D\u540C\u610F", "decline"],
+  ["deny", "decline"],
+  ["decline", "decline"],
+  ["no", "decline"]
+]);
+var answerByNumber = (text3, options) => {
+  const index = optionIndexFrom(text3, options.length);
+  if (index !== null) return options[index - 1]?.token ?? null;
+  const said = text3.trim().toLowerCase();
+  if (said.length === 0) return null;
+  const byLabel = options.find((option) => option.label.trim().toLowerCase() === said);
+  if (byLabel !== void 0) return byLabel.token;
+  const decision = DECISION_WORDS.get(said);
+  if (decision === void 0) return null;
+  return options.find((option) => option.decision === decision)?.token ?? null;
 };
+var approvalReplyHint = (t, binding) => binding.platform === "wecom" && binding.wecomNumberedHints ? t("approval.replyHintFull") : t("approval.replyHint");
+var numberedApprovalText = (request) => [
+  request.body,
+  "",
+  ...request.options.map((option, index) => `${String(index + 1)}. ${option.label}`),
+  "",
+  request.replyHint
+].join("\n");
 
 // src/approvals.ts
 var makeApprovals = (core) => {
@@ -126886,7 +127079,7 @@ var makeApprovals = (core) => {
         title: offer.title,
         body: offer.body,
         options: offer.buttons,
-        replyHint: t("approval.replyHint")
+        replyHint: approvalReplyHint(t, binding)
       });
       host.log.info("chat asked for an approval", { threadId, requestId: offer.requestId });
       if (cardId === null) return;
@@ -127224,6 +127417,7 @@ var helpText = (t, options = {}) => [
   t("help.new"),
   t("help.sessions"),
   t("help.resume"),
+  t("help.syncNote"),
   t("help.model"),
   t("help.plan"),
   t("help.repo"),
@@ -127531,6 +127725,109 @@ var startConnections = (core, inboundHandlersFor) => {
   return { bots: bots.length, connecting: started.size };
 };
 
+// src/keyedQueue.ts
+var makeKeyedQueue = (onError) => {
+  const tails = /* @__PURE__ */ new Map();
+  return (key, work) => {
+    const run = (tails.get(key) ?? Promise.resolve()).then(work).catch(onError).then(() => {
+      if (tails.get(key) === run) tails.delete(key);
+    });
+    tails.set(key, run);
+  };
+};
+
+// src/core.ts
+var makeImCore = (input) => {
+  const { host, t, adapters } = input;
+  const adapterFor = (platform) => adapters.find((adapter) => adapter.platform === platform);
+  let state = emptyState();
+  const stateHandle = input.derivedState({
+    key: IM_STATE_KEY,
+    version: IM_STATE_VERSION,
+    events: ["plugin.event-appended"],
+    init: emptyState,
+    apply: foldPluginEvent(input.pluginId)
+  });
+  const ready = stateHandle.get().then(
+    (restored) => {
+      state = restored;
+    },
+    (error) => {
+      host.log.warn("chat could not restore its saved state", { error: describeError(error) });
+    }
+  );
+  let persisting = Promise.resolve();
+  const commit = (name, data) => {
+    state = foldImEvent(state, name, data);
+    persisting = persisting.then(
+      () => host.events.append({ name, aggregate: { kind: "plugin", id: input.pluginId }, data })
+    ).then(
+      () => void 0,
+      (error) => {
+        host.log.warn("chat could not save its state", { name, error: describeError(error) });
+      }
+    );
+  };
+  const bindChat = (chatKey, threadId) => {
+    commit("chat-updated", { chatKey, threadId });
+  };
+  const outbound = makeKeyedQueue((error) => {
+    host.log.warn("chat could not deliver a card", { error: describeError(error) });
+  });
+  const postImages = async (binding, attachments) => {
+    const adapter = adapterFor(binding.platform);
+    if (adapter?.sendImage === void 0) return;
+    for (const attachment of attachments) {
+      if (attachment.type !== "image") continue;
+      try {
+        const bytes = await host.attachments.read(attachment.id);
+        await adapter.sendImage(binding, {
+          bytes,
+          name: attachment.name,
+          mimeType: attachment.mimeType
+        });
+      } catch (error) {
+        host.log.warn("chat could not deliver an image", {
+          name: attachment.name,
+          error: describeError(error)
+        });
+      }
+    }
+  };
+  const deliver = async (binding, text3, attachments = []) => {
+    await postImages(binding, attachments);
+    if (text3.trim() === "") return;
+    try {
+      await adapterFor(binding.platform)?.sendText(binding, text3);
+    } catch (error) {
+      host.log.warn("chat could not deliver", { error: describeError(error) });
+    }
+  };
+  const bots = () => readBots(input.config, adapterFor);
+  const bindingForChatKey = (chatKey) => findBindingByChatKey(bots(), state, chatKey);
+  return {
+    host,
+    t,
+    adapterFor,
+    get state() {
+      return state;
+    },
+    ready,
+    commit,
+    bindChat,
+    outbound,
+    deliver,
+    bots,
+    bindingOf: (bot, chatId) => bindingOf(bot, chatId, state),
+    bindingForChatKey,
+    bindingOfThread: (threadId) => {
+      const chatKey = chatOfThread(state, threadId);
+      return chatKey === void 0 ? void 0 : bindingForChatKey(chatKey);
+    },
+    hasPanel: (binding) => adapterFor(binding.platform)?.panel !== void 0
+  };
+};
+
 // src/attachments.ts
 var IMAGE_LIMIT_BYTES = 10 * 1024 * 1024;
 var FILE_LIMIT_BYTES = 25 * 1024 * 1024;
@@ -127777,6 +128074,24 @@ var makeInboundAttachments = (core) => {
   return { pendingByChat, pendingFor, collectResources };
 };
 
+// src/boundedSeen.ts
+var makeBoundedSeen = (limit) => {
+  const seen = /* @__PURE__ */ new Set();
+  return {
+    has: (key) => seen.has(key),
+    /** 记下这个键：第一次见返回 true；已经记着返回 false（不重排，最早记的先被忘）。 */
+    claim: (key) => {
+      if (seen.has(key)) return false;
+      seen.add(key);
+      if (seen.size > limit) {
+        const oldest = seen.values().next().value;
+        if (oldest !== void 0) seen.delete(oldest);
+      }
+      return true;
+    }
+  };
+};
+
 // src/cooldown.ts
 var makeCooldown = (windowMs, now, maxKeys = Number.POSITIVE_INFINITY) => {
   const lastAt = /* @__PURE__ */ new Map();
@@ -127829,18 +128144,9 @@ var makeInbound = (core, deps) => {
     NOT_ALLOWED_REPLY_KEY_LIMIT
   );
   const projectPromptCooldown = makeCooldown(PROJECT_PROMPT_COOLDOWN_MS, () => Date.now());
-  const seen = /* @__PURE__ */ new Set();
-  const seenOrder = [];
+  const handledMessages = makeBoundedSeen(SEEN_MESSAGE_LIMIT);
   const alreadyHandled = (target, messageId) => {
-    const key = `${chatKeyOf(target)}:${messageId}`;
-    if (seen.has(key)) return true;
-    seen.add(key);
-    seenOrder.push(key);
-    if (seenOrder.length > SEEN_MESSAGE_LIMIT) {
-      const oldest = seenOrder.shift();
-      if (oldest !== void 0) seen.delete(oldest);
-    }
-    return false;
+    return !handledMessages.claim(`${chatKeyOf(target)}:${messageId}`);
   };
   const turnAwayStranger = (target, sender) => {
     host.log.warn("chat ignored a message from someone not on the allow list", {
@@ -127867,6 +128173,9 @@ var makeInbound = (core, deps) => {
       if (current === void 0) return;
       const arrived = bindingOf2(current, message.chatId);
       if (alreadyHandled(arrived, message.messageId)) return;
+      if (message.chatKind !== void 0 && chatOf(core.state, chatKeyOf(arrived)).chatKind !== message.chatKind) {
+        commit("chat-updated", { chatKey: chatKeyOf(arrived), chatKind: message.chatKind });
+      }
       if (!isAllowedSender(arrived, message.senderId)) {
         turnAwayStranger(arrived, message.senderId);
         return;
@@ -127883,11 +128192,7 @@ var makeInbound = (core, deps) => {
         return;
       }
       const open = openApprovalOf(core.state, chatKeyOf(arrived));
-      const answerToken = open === void 0 ? null : adapterFor(arrived.platform)?.answerByText?.(
-        arrived,
-        message.text,
-        open.options.map(({ label, token }) => ({ label, token }))
-      ) ?? null;
+      const answerToken = open === void 0 ? null : adapterFor(arrived.platform)?.answerByText?.(arrived, message.text, open.options) ?? null;
       if (answerToken !== null) {
         void answerByToken(answerToken).catch((error) => {
           host.log.warn("chat could not answer the approval", { error: describeError(error) });
@@ -128541,7 +128846,7 @@ var makeQueueFlow = (host, deps) => {
     }
     return handledWith(null);
   };
-  return { noteQueued, refresh, click };
+  return { noteQueued, refresh, click, readExecution: deps.readExecution };
 };
 
 // src/interactions.ts
@@ -128766,24 +129071,10 @@ var TIMEOUT_MS = {
 var RETRY_BACKOFF_MS = 500;
 var RETRY_AFTER_CAP_MS = 1e4;
 var CALL_SPACING_MS = 150;
-var DETAIL_MAX_CHARS = 200;
 
-// src/lark/setup/setupItemSchema.ts
-var SETUP_STEP_IDS = [
-  "login",
-  "identity",
-  "findApp",
-  "createApp",
-  "enableBot",
-  "longConnection",
-  "scopes",
-  "events",
-  "callbacks",
-  "publish",
-  "secret"
-];
-var STEP_STATES = ["pending", "running", "done", "skipped", "failed"];
-var SETUP_ITEM_SCHEMA = {
+// src/flowItemSchema.ts
+var FLOW_STEP_STATES = ["pending", "running", "done", "skipped", "failed"];
+var makeFlowItemSchema = (shape) => ({
   type: "object",
   additionalProperties: false,
   required: ["kind"],
@@ -128801,14 +129092,13 @@ var SETUP_ITEM_SCHEMA = {
         additionalProperties: false,
         required: ["id", "labelKey", "state"],
         properties: {
-          id: { type: "string", enum: [...SETUP_STEP_IDS] },
+          id: shape.stepId,
           labelKey: { type: "string" },
-          state: { type: "string", enum: [...STEP_STATES] }
+          state: { type: "string", enum: [...FLOW_STEP_STATES] }
         }
       }
     },
-    // 卡片动作的 done 不往草稿里填：宿主要求带这个字段，内容永远是空对象。
-    fills: { type: "object", additionalProperties: false },
+    fills: shape.fills,
     messageKey: { type: "string" },
     warnings: {
       type: "array",
@@ -128826,13 +129116,34 @@ var SETUP_ITEM_SCHEMA = {
     detail: { type: "string" }
   },
   oneOf: [
-    { properties: { kind: { const: "qr" } }, required: ["payload", "expiresAt"] },
+    { properties: { kind: { const: "qr" } }, required: [...shape.qrRequired] },
     { properties: { kind: { const: "status" } }, required: ["statusKey"] },
     { properties: { kind: { const: "steps" } }, required: ["steps"] },
-    { properties: { kind: { const: "done" } }, required: ["messageKey"] },
+    { properties: { kind: { const: "done" } }, required: [...shape.doneRequired] },
     { properties: { kind: { const: "failed" } }, required: ["reasonKey"] }
   ]
-};
+});
+
+// src/lark/setup/setupItemSchema.ts
+var SETUP_STEP_IDS = [
+  "login",
+  "identity",
+  "findApp",
+  "createApp",
+  "enableBot",
+  "longConnection",
+  "scopes",
+  "events",
+  "callbacks",
+  "publish",
+  "secret"
+];
+var SETUP_ITEM_SCHEMA = makeFlowItemSchema({
+  stepId: { type: "string", enum: [...SETUP_STEP_IDS] },
+  fills: { type: "object", additionalProperties: false },
+  qrRequired: ["payload", "expiresAt"],
+  doneRequired: ["messageKey"]
+});
 
 // src/lark/setup/saveBot.ts
 var OPEN_ID_PREFIX = "ou_";
@@ -129675,7 +129986,8 @@ var sleep = async (deps) => {
   }
 };
 
-// src/lark/setup/redact.ts
+// src/redact.ts
+var DETAIL_MAX_CHARS = 200;
 var MASK = "***";
 var TOKEN_LIKE = /[A-Za-z0-9_=-]{24,}/g;
 var MIN_SECRET_LENGTH = 6;
@@ -130462,7 +130774,8 @@ var fetchTenantToken = async (input) => {
   return { token: body.tenant_access_token, expiresInSeconds: body.expire ?? 0 };
 };
 var sendChatText = async (input) => {
-  const response = await input.http(`${LARK_BASE}/im/v1/messages?receive_id_type=chat_id`, {
+  const idType = input.receiveIdType ?? "chat_id";
+  const response = await input.http(`${LARK_BASE}/im/v1/messages?receive_id_type=${idType}`, {
     method: "POST",
     headers: {
       authorization: `Bearer ${input.token}`,
@@ -136069,9 +136382,9 @@ var styledText = (text3, style) => {
   if (style?.includes("underline")) out = `<u>${out}</u>`;
   return out;
 };
-var nonEmpty2 = (value) => typeof value === "string" && value !== "";
+var nonEmpty3 = (value) => typeof value === "string" && value !== "";
 var resourceOf = (element, index) => {
-  if (element.tag === "img" && nonEmpty2(element.image_key)) {
+  if (element.tag === "img" && nonEmpty3(element.image_key)) {
     return {
       fileKey: element.image_key,
       kind: "image",
@@ -136079,14 +136392,14 @@ var resourceOf = (element, index) => {
       mimeType: "image/png"
     };
   }
-  if ((element.tag === "media" || element.tag === "file") && nonEmpty2(element.file_key)) {
+  if ((element.tag === "media" || element.tag === "file") && nonEmpty3(element.file_key)) {
     const video = element.tag === "media";
-    const name = nonEmpty2(element.file_name) ? element.file_name : video ? `video-${String(index)}.mp4` : `file-${String(index)}`;
+    const name = nonEmpty3(element.file_name) ? element.file_name : video ? `video-${String(index)}.mp4` : `file-${String(index)}`;
     return {
       fileKey: element.file_key,
       kind: "file",
       name,
-      mimeType: video && !nonEmpty2(element.file_name) ? "video/mp4" : mimeFromName(name)
+      mimeType: video && !nonEmpty3(element.file_name) ? "video/mp4" : mimeFromName(name)
     };
   }
   return null;
@@ -136098,11 +136411,11 @@ var serializeElement = (element, index, botIds) => {
       return styledText(element.text ?? "", element.style);
     case "a": {
       const label = element.text ?? element.href ?? "";
-      return nonEmpty2(element.href) ? `[${label}](${element.href})` : label;
+      return nonEmpty3(element.href) ? `[${label}](${element.href})` : label;
     }
     case "at": {
       if (element.user_id !== void 0 && botIds.has(element.user_id)) return "";
-      return nonEmpty2(element.user_name) ? `@${element.user_name}` : "";
+      return nonEmpty3(element.user_name) ? `@${element.user_name}` : "";
     }
     case "code_block":
       return `\`\`\`${element.language ?? ""}
@@ -136142,7 +136455,7 @@ var serializePost = (content, botIds = /* @__PURE__ */ new Set()) => {
     for (const element of elements) {
       const index = indexOf.get(element);
       const key = element.tag === "img" ? element.image_key : element.file_key;
-      if (index !== void 0 && nonEmpty2(key)) {
+      if (index !== void 0 && nonEmpty3(key)) {
         placeholderByKey.set(key, placeholderOf(element, index));
       }
     }
@@ -136469,6 +136782,7 @@ var makeLarkAdapter = (deps) => {
             chatId: message.chatId,
             senderId: message.senderOpenId,
             text: message.text,
+            chatKind: message.chatType === "p2p" ? "private" : "group",
             resources: message.resources.map((resource) => ({
               key: resource.fileKey,
               name: resource.name,
@@ -136486,18 +136800,40 @@ var makeLarkAdapter = (deps) => {
       name: input.name,
       memberOpenIds: input.memberIds
     }),
-    sendText: async (binding, text3) => {
+    sendText: async (binding, text3, options) => {
       const token = await tenantToken(binding);
+      const receiveIdType = options?.targetKind === "user" ? "open_id" : "chat_id";
       for (const chunk of splitForLark(text3)) {
         const messageId = await sendChatText({
           http: deps.http,
           token,
           chatId: binding.chatId,
+          receiveIdType,
           text: chunk
         });
         deps.log.info("lark delivered a message", { messageId, bot: binding.displayName });
       }
     },
+    checkConnection: async (bot) => {
+      const { appId, appSecret } = credentials(bot);
+      if (appId === "" || appSecret === "") {
+        return {
+          stage: "credentials",
+          ok: false,
+          detail: "missing app id or secret in saved config"
+        };
+      }
+      try {
+        const { expiresInSeconds } = await fetchTenantToken({ http: deps.http, appId, appSecret });
+        return {
+          stage: "tenant_access_token",
+          ok: true,
+          detail: `token ok; expiresIn=${String(expiresInSeconds)}s`
+        };
+      } catch (error) {
+        return { stage: "tenant_access_token", ok: false, detail: describeError(error) };
+      }
+    },
     sendImage: async (binding, image2) => {
       const token = await tenantToken(binding);
       const imageKey = await uploadImage({
@@ -136630,7 +136966,7 @@ var makeLarkAdapter = (deps) => {
 var en_default = {
   settings: {
     title: "Chat",
-    description: "Connect chat bots to Ycodium. One row per bot: create the bot on its platform, paste its credentials, and list the people allowed to use it. For Lark, Connect a Lark bot above does all of that with one scan. Those people message the bot (or add it to a group), pick a project in the chat, and can start work.",
+    description: "Connect chat bots to Ycodium. One row per bot: create the bot on its platform, paste its credentials, and pick an access mode (allowlist / open). In allowlist mode, list the people allowed to use it. For Lark, Connect a Lark bot above does all of that with one scan. Admitted people message the bot (or add it to a group), pick a project in the chat, and can start work.",
     bots: "Bots",
     language: {
       label: "Reply language",
@@ -136648,12 +136984,53 @@ var en_default = {
       always: "Only when it is mentioned",
       never: "Every message",
       ambient: "Every message, except ones aimed at someone else"
+    },
+    deliveryHttp: {
+      enabled: {
+        label: "Enable proactive delivery HTTP",
+        description: "Off by default. When on, listens only on 127.0.0.1 so local scripts can POST botId+targetId text. Do not expose publicly; set a Bearer token when other local processes might call it."
+      },
+      port: {
+        label: "Delivery HTTP port",
+        description: "Bound to 127.0.0.1 only. Default 3847."
+      },
+      token: {
+        label: "Delivery HTTP token",
+        description: "Optional. When set, requests must send Authorization: Bearer <token>."
+      }
+    },
+    deliveryTargets: {
+      label: "Delivery targets",
+      description: "Callers store only botId (settings row id) and targetId. Keep platform chat ids here; do not send them on each request."
+    },
+    deliveryKind: {
+      chat: "Chat",
+      user: "User / DM",
+      group: "Group"
+    },
+    queueMode: {
+      queue: "Queue (default)",
+      steer: "Steer (auto-join the running turn)"
+    },
+    onOff: {
+      on: "On",
+      off: "Off"
+    },
+    larkPanelMode: {
+      default: "Default (all commands)",
+      minimal: "Minimal"
+    },
+    accessMode: {
+      allowlist: "Allowlist only (default)",
+      open: "Allow everyone"
     }
   },
   platform: {
     lark: "Lark",
     telegram: "Telegram",
-    wecom: "WeCom"
+    wecom: "WeCom",
+    "wecom-app": "WeCom App",
+    wechat: "WeChat (experimental)"
   },
   column: {
     displayName: {
@@ -136681,7 +137058,7 @@ var en_default = {
     },
     allowedSenders: {
       label: "Allowed people",
-      description: "Comma-separated user ids from that platform. Only these people can make the agent work on this machine; while the list is empty, nobody can. Message the bot and it tells you your own id."
+      description: "Comma-separated user ids from that platform. Used only in allowlist mode; while the list is empty, nobody can. Message the bot and it tells you your own id."
     },
     proxy: {
       label: "Proxy",
@@ -136689,11 +137066,86 @@ var en_default = {
     },
     runtimeMode: {
       label: "What a chat message may do",
-      description: "People on the allow list start turns from chat, so this is deliberately not full access by default. Whichever mode asks, the request lands in the chat."
+      description: "Admitted people start turns from chat, so this is deliberately not full access by default. Whichever mode asks, the request lands in the chat."
     },
     groupMention: {
       label: "In groups, answer",
       description: "When the bot answers in a group (unset means only when it is mentioned); direct chats always count. WeCom only delivers messages that mention the bot, so this changes nothing there."
+    },
+    deliveryBotId: {
+      label: "Bot ID",
+      description: "The settings-table row id for that bot (opaque).",
+      placeholder: "bot row id"
+    },
+    deliveryTargetId: {
+      label: "Target ID",
+      description: "Caller alias unique under that bot; immutable after save.",
+      placeholder: "release-alerts"
+    },
+    deliveryName: {
+      label: "Display name",
+      placeholder: "Release alerts"
+    },
+    deliveryKind: {
+      label: "Kind"
+    },
+    deliveryPlatformChatId: {
+      label: "Platform chat ID",
+      description: "Lark open_id/chat_id, Telegram chat id, WeCom user/group id, etc.",
+      placeholder: "oc_\u2026 / ou_\u2026 / -100\u2026"
+    },
+    queueMode: {
+      label: "New messages while busy",
+      description: "When a turn is already running, how to handle new plain-text messages. Queue waits for the current turn (Steer is still a button); Steer auto-joins the running turn."
+    },
+    larkPanelMode: {
+      label: "Command panel",
+      description: "Which commands /panel (or typing /) lists. Minimal hides low-frequency system items; typing the same command still works."
+    },
+    wecomNumberedHints: {
+      label: "Numbered-reply hints",
+      description: "WeCom has no buttons; approvals and questions use reply numbers. When on, include fuller usage hints."
+    },
+    wecomAppCorpId: {
+      label: "Corp ID",
+      placeholder: "ww\u2026"
+    },
+    wecomAppAgentId: {
+      label: "AgentId",
+      placeholder: "1000002"
+    },
+    wecomAppSecret: {
+      label: "App Secret"
+    },
+    wecomAppToken: {
+      label: "Callback Token"
+    },
+    wecomAppEncodingAESKey: {
+      label: "EncodingAESKey",
+      placeholder: "43 alphanumeric chars"
+    },
+    wecomAppCallbackBaseUrl: {
+      label: "Public callback base URL (optional)",
+      description: "When set, logs print the full callback URL to paste into WeCom \u201CReceive messages \u2192 API receive\u201D. Default listener is 127.0.0.1; use a reverse proxy or tunnel.",
+      placeholder: "https://im.example.com or http://IP:30987"
+    },
+    wecomAppApiBaseUrl: {
+      label: "API proxy base (optional)",
+      description: "Base URL for gettoken / message/send. Leave empty for qyapi.weixin.qq.com. Outbound IP must be on the trusted IP list.",
+      placeholder: "https://qyapi.weixin.qq.com"
+    },
+    wecomAppListenPort: {
+      label: "Local callback port (optional)",
+      description: "Defaults to 30987 on 127.0.0.1. Shared across self-built apps.",
+      placeholder: "30987"
+    },
+    wechatBotToken: {
+      label: "WeChat bot token",
+      description: "bot_token from QR binding. Live iLink login is gated by proposal 0069; filling this in does not connect yet."
+    },
+    accessMode: {
+      label: "Access mode",
+      description: 'Allowlist admits only "Allowed people"; open admits any identifiable sender. New bots default to allowlist.'
     }
   },
   reply: {
@@ -136722,7 +137174,8 @@ var en_default = {
     allow: "Allow",
     deny: "Deny",
     alreadyHandled: "Already handled",
-    replyHint: "Reply with the number."
+    replyHint: "Reply with the number, or reply approve/deny.",
+    replyHintFull: "Reply with the number. You can also reply approve/deny; for multi-select questions, comma-separate numbers."
   },
   question: {
     title: "\u2753 Question",
@@ -136815,7 +137268,8 @@ var en_default = {
     plan: "\xB7 /plan \u2014 toggle plan mode (the agent proposes a plan instead of acting); /plan on, /plan off set it",
     panel: "Send /panel to open the command panel with a button for every command.",
     repo: "\xB7 /repo \u2014 pick the project this chat works on; /repo number or /repo name picks directly",
-    group: "\xB7 /group name \u2014 Lark only: the bot creates a group and adds you (bots on other platforms cannot)"
+    group: "\xB7 /group name \u2014 Lark only: the bot creates a group and adds you (bots on other platforms cannot)",
+    syncNote: "\xB7 After a private chat attaches a session, web user text and final assistant text sync here (groups never sync)."
   },
   sessions: {
     title: "Sessions this bot opened for this chat's project ({{count}}):",
@@ -136827,7 +137281,8 @@ var en_default = {
     badge: {
       current: "\u2605 current",
       running: "\u25CF running",
-      elsewhere: "in another chat"
+      elsewhere: "in another chat",
+      web: "web"
     },
     age: {
       justNow: "just now",
@@ -136842,7 +137297,10 @@ var en_default = {
     already: "This chat is already on that session.",
     gone: "That session was deleted or archived, so it cannot be resumed.",
     runningElsewhere: "That session is running a turn in another chat \u2014 stop it there first.",
-    done: 'Switched to "{{title}}". Send a message to keep going from there.'
+    done: 'Switched to "{{title}}". Send a message to keep going from there.',
+    confirmWeb: '"{{title}}" was opened on the web. Send /resume with the same number again (or /resume confirm) to attach; /resume cancel to abort.',
+    cancelled: "Attach cancelled.",
+    nothingPending: "No web session is waiting for confirm. Use /sessions to see the list."
   },
   model: {
     current: "Model: {{model}}",
@@ -137044,6 +137502,44 @@ var en_default = {
     unsupported: "Bots on this platform cannot create groups. Create the group in the app and add the bot to it.",
     noSender: "I cannot tell who you are on this platform, so I cannot add you to a new group.",
     failed: "Could not create the group. Check that the app is allowed to create groups and add members, then try again."
+  },
+  sync: {
+    webUser: "Web: {{text}}"
+  },
+  rowAction: {
+    checkConnection: {
+      label: "Check connection",
+      description: "Verify platform credentials still work; does not open a session or call a model.",
+      running: "Checking {{rowId}}\u2026",
+      done: "Connection OK",
+      failed: "Connection failed (ref {{ref}})",
+      notSaved: "Save this row first (credentials are read from saved config only)."
+    },
+    copyDiagnostics: {
+      label: "Copy diagnostics",
+      description: "Run a connection probe and produce copy-paste diagnostics (no secrets).",
+      running: "Building diagnostics for {{rowId}}\u2026",
+      done: "Diagnostics ready \u2014 see details below",
+      failed: "Diagnostics failed (ref {{ref}})",
+      notSaved: "Save this row first before copying diagnostics."
+    },
+    diagnostic: {
+      ref: "Ref {{ref}}\n{{detail}}"
+    },
+    larkRepair: {
+      label: "Repair scopes",
+      description: "Verify the Lark app can still mint a token and list scope / publish steps.",
+      step: {
+        scopes: "Confirm message / resource / panel scopes",
+        events: "Confirm long connection and event subscriptions",
+        publish: "Publish if scopes were added",
+        verify: "Verify the app can still mint a tenant token"
+      },
+      done: "Credentials work; add any missing scopes in the Feishu console and publish",
+      hint: "Ref {{ref}}\n{{detail}}\nIf scopes are missing, request them on the Feishu open platform and publish; a chat /repair command will follow.",
+      failed: "Could not verify the Lark app (ref {{ref}})",
+      notLark: "This row is not a saved Lark bot."
+    }
   }
 };
 
@@ -137051,7 +137547,7 @@ var en_default = {
 var zh_CN_default = {
   settings: {
     title: "\u804A\u5929",
-    description: "\u628A\u804A\u5929\u673A\u5668\u4EBA\u63A5\u5230 Ycodium\u3002\u4E00\u884C\u4E00\u4E2A\u673A\u5668\u4EBA\uFF1A\u5148\u5728\u5BF9\u5E94\u5E73\u53F0\u5EFA\u597D\u673A\u5668\u4EBA\u3001\u628A\u51ED\u636E\u586B\u8FDB\u6765\uFF0C\u518D\u628A\u5141\u8BB8\u4F7F\u7528\u5B83\u7684\u4EBA\u586B\u8FDB\u300C\u5141\u8BB8\u7684\u4EBA\u300D\u3002\u98DE\u4E66\u53EF\u4EE5\u7528\u4E0A\u9762\u7684\u300C\u8FDE\u63A5\u98DE\u4E66\u673A\u5668\u4EBA\u300D\uFF0C\u626B\u4E00\u6B21\u7801\u5168\u90E8\u914D\u597D\u3002\u540D\u5355\u91CC\u7684\u4EBA\u79C1\u804A\u673A\u5668\u4EBA\uFF08\u6216\u628A\u5B83\u62C9\u8FDB\u7FA4\uFF09\u3001\u5728\u804A\u5929\u91CC\u9009\u597D\u9879\u76EE\uFF0C\u5C31\u80FD\u6D3E\u6D3B\u3002",
+    description: "\u628A\u804A\u5929\u673A\u5668\u4EBA\u63A5\u5230 Ycodium\u3002\u4E00\u884C\u4E00\u4E2A\u673A\u5668\u4EBA\uFF1A\u5148\u5728\u5BF9\u5E94\u5E73\u53F0\u5EFA\u597D\u673A\u5668\u4EBA\u3001\u628A\u51ED\u636E\u586B\u8FDB\u6765\uFF0C\u518D\u9009\u8BBF\u95EE\u6A21\u5F0F\uFF08\u4EC5\u767D\u540D\u5355\uFF0F\u5141\u8BB8\u6240\u6709\u4EBA\uFF09\u3002\u4EC5\u767D\u540D\u5355\u65F6\u628A\u5141\u8BB8\u4F7F\u7528\u5B83\u7684\u4EBA\u586B\u8FDB\u300C\u5141\u8BB8\u7684\u4EBA\u300D\u3002\u98DE\u4E66\u53EF\u4EE5\u7528\u4E0A\u9762\u7684\u300C\u8FDE\u63A5\u98DE\u4E66\u673A\u5668\u4EBA\u300D\uFF0C\u626B\u4E00\u6B21\u7801\u5168\u90E8\u914D\u597D\u3002\u83B7\u51C6\u7684\u4EBA\u79C1\u804A\u673A\u5668\u4EBA\uFF08\u6216\u628A\u5B83\u62C9\u8FDB\u7FA4\uFF09\u3001\u5728\u804A\u5929\u91CC\u9009\u597D\u9879\u76EE\uFF0C\u5C31\u80FD\u6D3E\u6D3B\u3002",
     bots: "\u673A\u5668\u4EBA",
     language: {
       label: "\u56DE\u8BDD\u8BED\u8A00",
@@ -137069,12 +137565,53 @@ var zh_CN_default = {
       always: "\u88AB @ \u624D\u7406",
       never: "\u6BCF\u53E5\u90FD\u7406",
       ambient: "\u6BCF\u53E5\u90FD\u7406\uFF0C\u660E\u663E\u5BF9\u522B\u4EBA\u8BF4\u7684\u9664\u5916"
+    },
+    deliveryHttp: {
+      enabled: {
+        label: "\u5F00\u542F\u4E3B\u52A8\u6295\u9012 HTTP",
+        description: "\u9ED8\u8BA4\u5173\u95ED\u3002\u5F00\u542F\u540E\u53EA\u5728\u672C\u673A 127.0.0.1 \u76D1\u542C\uFF0C\u4F9B\u811A\u672C\u7528 botId+targetId \u63A8\u6587\u5B57\u3002\u4E0D\u8981\u66B4\u9732\u5230\u516C\u7F51\uFF1B\u9700\u8981\u65F6\u53EF\u518D\u914D Bearer token\u3002"
+      },
+      port: {
+        label: "\u6295\u9012 HTTP \u7AEF\u53E3",
+        description: "\u53EA\u542C 127.0.0.1\u3002\u9ED8\u8BA4 3847\u3002"
+      },
+      token: {
+        label: "\u6295\u9012 HTTP Token",
+        description: "\u53EF\u9009\u3002\u586B\u4E86\u5219\u8BF7\u6C42\u5FC5\u987B\u5E26 Authorization: Bearer <token>\u3002\u540C\u673A\u5176\u5B83\u8FDB\u7A0B\u4E5F\u80FD\u6253 loopback\uFF0C\u5EFA\u8BAE\u751F\u4EA7\u5F00\u542F\u3002"
+      }
+    },
+    deliveryTargets: {
+      label: "\u6295\u9012\u76EE\u6807",
+      description: "\u8C03\u7528\u65B9\u53EA\u4FDD\u5B58 botId\uFF08\u673A\u5668\u4EBA\u884C id\uFF09\u4E0E targetId\u3002\u5E73\u53F0\u539F\u751F\u804A\u5929 id \u5199\u5728\u8FD9\u91CC\uFF0C\u4E0D\u8981\u968F\u6BCF\u6B21\u8BF7\u6C42\u63D0\u4EA4\u3002"
+    },
+    deliveryKind: {
+      chat: "\u804A\u5929",
+      user: "\u7528\u6237\uFF0F\u79C1\u804A",
+      group: "\u7FA4"
+    },
+    queueMode: {
+      queue: "\u6392\u961F\uFF08\u9ED8\u8BA4\uFF09",
+      steer: "\u63D2\u8BDD\uFF08\u81EA\u52A8\u5E76\u5165\u5F53\u524D\u8F6E\uFF09"
+    },
+    onOff: {
+      on: "\u5F00",
+      off: "\u5173"
+    },
+    larkPanelMode: {
+      default: "\u9ED8\u8BA4\uFF08\u5168\u90E8\u547D\u4EE4\uFF09",
+      minimal: "\u7CBE\u7B80"
+    },
+    accessMode: {
+      allowlist: "\u4EC5\u767D\u540D\u5355\uFF08\u9ED8\u8BA4\uFF09",
+      open: "\u5141\u8BB8\u6240\u6709\u4EBA"
     }
   },
   platform: {
     lark: "\u98DE\u4E66",
     telegram: "Telegram",
-    wecom: "\u4F01\u4E1A\u5FAE\u4FE1"
+    wecom: "\u4F01\u4E1A\u5FAE\u4FE1",
+    "wecom-app": "\u4F01\u4E1A\u5FAE\u4FE1\u5E94\u7528",
+    wechat: "\u5FAE\u4FE1\uFF08\u5B9E\u9A8C\uFF09"
   },
   column: {
     displayName: {
@@ -137102,7 +137639,7 @@ var zh_CN_default = {
     },
     allowedSenders: {
       label: "\u5141\u8BB8\u7684\u4EBA",
-      description: "\u8BE5\u5E73\u53F0\u7684\u7528\u6237 id\uFF0C\u9017\u53F7\u5206\u9694\u3002\u53EA\u6709\u540D\u5355\u91CC\u7684\u4EBA\u80FD\u8BA9 agent \u5728\u8FD9\u53F0\u673A\u5668\u4E0A\u5E72\u6D3B\uFF0C\u7559\u7A7A\u5219\u8C01\u90FD\u4E0D\u80FD\u3002\u7ED9\u673A\u5668\u4EBA\u53D1\u4E00\u53E5\u8BDD\uFF0C\u5B83\u4F1A\u544A\u8BC9\u4F60\u81EA\u5DF1\u7684 id\u3002"
+      description: "\u8BE5\u5E73\u53F0\u7684\u7528\u6237 id\uFF0C\u9017\u53F7\u5206\u9694\u3002\u4EC5\u5728\u300C\u4EC5\u767D\u540D\u5355\u300D\u6A21\u5F0F\u4E0B\u751F\u6548\uFF1B\u7559\u7A7A\u5219\u8C01\u90FD\u4E0D\u80FD\u3002\u7ED9\u673A\u5668\u4EBA\u53D1\u4E00\u53E5\u8BDD\uFF0C\u5B83\u4F1A\u544A\u8BC9\u4F60\u81EA\u5DF1\u7684 id\u3002"
     },
     proxy: {
       label: "\u4EE3\u7406",
@@ -137110,11 +137647,86 @@ var zh_CN_default = {
     },
     runtimeMode: {
       label: "\u804A\u5929\u6D88\u606F\u80FD\u505A\u4EC0\u4E48",
-      description: "\u540D\u5355\u91CC\u7684\u4EBA\u90FD\u80FD\u4ECE\u804A\u5929\u91CC\u5F00\u4E00\u8F6E\uFF0C\u6240\u4EE5\u9ED8\u8BA4\u6545\u610F\u4E0D\u7ED9\u6EE1\u6743\u9650\u3002\u4E0D\u8BBA\u9009\u54EA\u4E00\u6863\uFF0C\u8981\u62CD\u677F\u7684\u4E8B\u90FD\u4F1A\u6446\u5230\u804A\u5929\u91CC\u3002"
+      description: "\u83B7\u51C6\u7684\u4EBA\u90FD\u80FD\u4ECE\u804A\u5929\u91CC\u5F00\u4E00\u8F6E\uFF0C\u6240\u4EE5\u9ED8\u8BA4\u6545\u610F\u4E0D\u7ED9\u6EE1\u6743\u9650\u3002\u4E0D\u8BBA\u9009\u54EA\u4E00\u6863\uFF0C\u8981\u62CD\u677F\u7684\u4E8B\u90FD\u4F1A\u6446\u5230\u804A\u5929\u91CC\u3002"
     },
     groupMention: {
       label: "\u7FA4\u91CC\u4EC0\u4E48\u65F6\u5019\u7406\u5B83",
       description: "\u673A\u5668\u4EBA\u5728\u7FA4\u91CC\u4EC0\u4E48\u65F6\u5019\u56DE\u5E94\uFF08\u4E0D\u9009\u5C31\u662F\u88AB @ \u624D\u7406\uFF09\uFF1B\u5355\u804A\u6C38\u8FDC\u7406\u3002\u4F01\u4E1A\u5FAE\u4FE1\u53EA\u628A @ \u5230\u673A\u5668\u4EBA\u7684\u7FA4\u6D88\u606F\u63A8\u8FC7\u6765\uFF0C\u8FD9\u4E00\u9879\u5BF9\u5B83\u6CA1\u6709\u6548\u679C\u3002"
+    },
+    deliveryBotId: {
+      label: "Bot ID",
+      description: "\u8BBE\u7F6E\u8868\u91CC\u8BE5\u673A\u5668\u4EBA\u90A3\u4E00\u884C\u7684 id\uFF08\u4E0D\u900F\u660E\u5B57\u7B26\u4E32\uFF09\u3002",
+      placeholder: "\u673A\u5668\u4EBA\u884C id"
+    },
+    deliveryTargetId: {
+      label: "Target ID",
+      description: "\u540C\u4E00\u673A\u5668\u4EBA\u4E0B\u552F\u4E00\u7684\u522B\u540D\uFF1B\u4FDD\u5B58\u540E\u52FF\u6539\u3002",
+      placeholder: "release-alerts"
+    },
+    deliveryName: {
+      label: "\u663E\u793A\u540D",
+      placeholder: "\u53D1\u5E03\u544A\u8B66\u7FA4"
+    },
+    deliveryKind: {
+      label: "\u7C7B\u578B"
+    },
+    deliveryPlatformChatId: {
+      label: "\u5E73\u53F0\u804A\u5929 ID",
+      description: "\u98DE\u4E66 open_id\uFF0Fchat_id\u3001Telegram chat id\u3001\u4F01\u5FAE\u7528\u6237\uFF0F\u7FA4 id \u7B49\u3002",
+      placeholder: "oc_\u2026 / ou_\u2026 / -100\u2026"
+    },
+    queueMode: {
+      label: "\u5FD9\u65F6\u65B0\u6D88\u606F",
+      description: "\u5F53\u524D\u4EFB\u52A1\u8FD8\u5728\u8DD1\u65F6\uFF0C\u65B0\u6765\u7684\u666E\u901A\u6587\u5B57\u600E\u4E48\u5904\u7406\u3002\u6392\u961F\u4F1A\u7B49\u5F53\u524D\u8F6E\u7ED3\u675F\uFF08\u53EF\u70B9\u63D2\u8BDD\uFF09\uFF1B\u63D2\u8BDD\u5219\u81EA\u52A8\u5E76\u5165\u5F53\u524D\u8F6E\uFF0C\u65E0\u9700\u6BCF\u6B21\u70B9\u6309\u94AE\u3002"
+    },
+    larkPanelMode: {
+      label: "\u6307\u4EE4\u9762\u677F",
+      description: "\u804A\u5929\u91CC /panel \u6216\u6253 / \u65F6\u5217\u51FA\u7684\u547D\u4EE4\u8303\u56F4\u3002\u7CBE\u7B80\u9690\u85CF\u4F4E\u9891\u7CFB\u7EDF\u9879\uFF1B\u624B\u52A8\u8F93\u5165\u540C\u4E00\u547D\u4EE4\u4ECD\u53EF\u7528\u3002"
+    },
+    wecomNumberedHints: {
+      label: "\u7F16\u53F7\u5E94\u7B54\u63D0\u793A",
+      description: "\u4F01\u5FAE\u6CA1\u6709\u6309\u94AE\uFF0C\u5BA1\u6279\u4E0E\u63D0\u95EE\u9760\u56DE\u7F16\u53F7\u3002\u5F00\u542F\u65F6\u9644\u5E26\u66F4\u5B8C\u6574\u7684\u7528\u6CD5\u8BF4\u660E\u3002"
+    },
+    wecomAppCorpId: {
+      label: "\u4F01\u4E1A ID\uFF08CorpID\uFF09",
+      placeholder: "ww\u2026"
+    },
+    wecomAppAgentId: {
+      label: "\u5E94\u7528 AgentId",
+      placeholder: "1000002"
+    },
+    wecomAppSecret: {
+      label: "\u5E94\u7528 Secret"
+    },
+    wecomAppToken: {
+      label: "\u56DE\u8C03 Token"
+    },
+    wecomAppEncodingAESKey: {
+      label: "EncodingAESKey",
+      placeholder: "43 \u4F4D\u5B57\u6BCD\u6216\u6570\u5B57"
+    },
+    wecomAppCallbackBaseUrl: {
+      label: "\u516C\u7F51\u56DE\u8C03\u57FA\u5740\uFF08\u53EF\u9009\uFF09",
+      description: "\u586B\u516C\u7F51\u53EF\u8FBE\u7684 http(s) \u57FA\u5740\u540E\uFF0C\u65E5\u5FD7\u4F1A\u6253\u5370\u5B8C\u6574\u56DE\u8C03 URL\uFF0C\u628A\u5B83\u8D34\u8FDB\u4F01\u5FAE\u300C\u63A5\u6536\u6D88\u606F \u2192 \u8BBE\u7F6E API \u63A5\u6536\u300D\u3002\u4E0D\u586B\u53EA\u663E\u793A\u672C\u673A\u8DEF\u5F84\u3002\u9ED8\u8BA4\u76D1\u542C 127.0.0.1\uFF0C\u9700\u53CD\u4EE3\u6216\u96A7\u9053\u3002",
+      placeholder: "https://im.example.com \u6216 http://IP:30987"
+    },
+    wecomAppApiBaseUrl: {
+      label: "API \u4EE3\u7406\u5730\u5740\uFF08\u53EF\u9009\uFF09",
+      description: "\u51FA\u7AD9\u8C03\u7528 gettoken / message/send \u7684\u57FA\u5740\u3002\u6D77\u5916\u673A\u5668\u53EF\u586B\u53CD\u4EE3\uFF1B\u7559\u7A7A\u76F4\u8FDE qyapi.weixin.qq.com\u3002\u51FA\u7AD9 IP \u987B\u5728\u4F01\u4E1A\u53EF\u4FE1 IP \u5217\u8868\u3002",
+      placeholder: "https://qyapi.weixin.qq.com"
+    },
+    wecomAppListenPort: {
+      label: "\u672C\u673A\u56DE\u8C03\u7AEF\u53E3\uFF08\u53EF\u9009\uFF09",
+      description: "\u9ED8\u8BA4 30987\uFF0C\u53EA\u542C 127.0.0.1\u3002\u591A\u53F0\u81EA\u5EFA\u5E94\u7528\u5171\u7528\u4E00\u4E2A\u7AEF\u53E3\u3002",
+      placeholder: "30987"
+    },
+    wechatBotToken: {
+      label: "\u5FAE\u4FE1\u673A\u5668\u4EBA\u4EE4\u724C",
+      description: "\u626B\u7801\u7ED1\u5B9A\u540E\u5F97\u5230\u7684 bot_token\u3002\u771F\u767B\u5F55\u5C1A\u672A\u5F00\u653E\uFF1A\u586B\u4E86\u4E5F\u4E0D\u4F1A\u8FDE\u4E0A iLink\uFF0C\u89C1\u63D0\u6848 0069 \u5B89\u5168\u8BC4\u5BA1\u3002"
+    },
+    accessMode: {
+      label: "\u8BBF\u95EE\u6A21\u5F0F",
+      description: "\u4EC5\u767D\u540D\u5355\uFF1D\u53EA\u6709\u300C\u5141\u8BB8\u7684\u4EBA\u300D\u80FD\u89E6\u53D1\uFF1B\u5141\u8BB8\u6240\u6709\u4EBA\uFF1D\u5E73\u53F0\u80FD\u8BC6\u522B\u7684\u53D1\u9001\u8005\u5747\u53EF\u3002\u65B0\u673A\u5668\u4EBA\u9ED8\u8BA4\u4EC5\u767D\u540D\u5355\u3002"
     }
   },
   reply: {
@@ -137143,7 +137755,8 @@ var zh_CN_default = {
     allow: "\u5141\u8BB8",
     deny: "\u62D2\u7EDD",
     alreadyHandled: "\u5DF2\u5904\u7406",
-    replyHint: "\u56DE\u590D\u7F16\u53F7\u5373\u53EF\u3002"
+    replyHint: "\u56DE\u590D\u7F16\u53F7\uFF0C\u6216\u56DE\u590D\u300C\u6279\u51C6\u300D/\u300C\u62D2\u7EDD\u300D\u3002",
+    replyHintFull: "\u56DE\u590D\u7F16\u53F7\u5373\u53EF\u3002\u4E5F\u53EF\u56DE\u590D\u300C\u6279\u51C6\u300D/\u300C\u62D2\u7EDD\u300D\uFF1B\u591A\u9009\u63D0\u95EE\u7528\u9017\u53F7\u5206\u9694\u7F16\u53F7\u3002"
   },
   question: {
     title: "\u2753 \u63D0\u95EE",
@@ -137236,7 +137849,8 @@ var zh_CN_default = {
     plan: "\xB7 /plan \u2014\u2014 \u5F00\u5173\u8BA1\u5212\u6A21\u5F0F\uFF08agent \u5148\u51FA\u8BA1\u5212\u3001\u4E0D\u52A8\u624B\uFF09\uFF1B/plan on\u3001/plan off \u660E\u786E\u8BBE\u5B9A",
     panel: "\u53D1 /panel \u6253\u5F00\u53EF\u70B9\u7684\u547D\u4EE4\u9762\u677F\u3002",
     repo: "\xB7 /repo \u2014\u2014 \u9009\u8FD9\u4E2A\u804A\u5929\u505A\u54EA\u4E2A\u9879\u76EE\uFF1B/repo \u7F16\u53F7 \u6216 /repo \u9879\u76EE\u540D \u76F4\u63A5\u9009",
-    group: "\xB7 /group \u7FA4\u540D \u2014\u2014 \u4EC5\u98DE\u4E66\uFF1A\u673A\u5668\u4EBA\u5EFA\u4E00\u4E2A\u7FA4\u5E76\u628A\u4F60\u62C9\u8FDB\u53BB\uFF08\u522B\u7684\u5E73\u53F0\u7684\u673A\u5668\u4EBA\u5EFA\u4E0D\u4E86\u7FA4\uFF09"
+    group: "\xB7 /group \u7FA4\u540D \u2014\u2014 \u4EC5\u98DE\u4E66\uFF1A\u673A\u5668\u4EBA\u5EFA\u4E00\u4E2A\u7FA4\u5E76\u628A\u4F60\u62C9\u8FDB\u53BB\uFF08\u522B\u7684\u5E73\u53F0\u7684\u673A\u5668\u4EBA\u5EFA\u4E0D\u4E86\u7FA4\uFF09",
+    syncNote: "\xB7 \u79C1\u804A\u9644\u7740\u4F1A\u8BDD\u540E\uFF0C\u7F51\u9875\u4E0A\u7684\u7528\u6237\u6587\u5B57\u4E0E\u7EC8\u6001\u52A9\u624B\u6587\u5B57\u4F1A\u540C\u6B65\u5230\u6B64\uFF08\u7FA4\u804A\u4E0D\u540C\u6B65\uFF09\u3002"
   },
   sessions: {
     title: "\u672C\u673A\u5668\u4EBA\u4E3A\u8FD9\u4E2A\u804A\u5929\u7684\u9879\u76EE\u5F00\u8FC7\u7684\u4F1A\u8BDD\uFF08{{count}} \u6761\uFF09\uFF1A",
@@ -137248,7 +137862,8 @@ var zh_CN_default = {
     badge: {
       current: "\u2605 \u5F53\u524D",
       running: "\u25CF \u5728\u8DD1",
-      elsewhere: "\u63A5\u5728\u522B\u7684\u804A\u5929"
+      elsewhere: "\u63A5\u5728\u522B\u7684\u804A\u5929",
+      web: "\u7F51\u9875"
     },
     age: {
       justNow: "\u521A\u521A",
@@ -137263,7 +137878,10 @@ var zh_CN_default = {
     already: "\u8FD9\u4E2A\u804A\u5929\u5DF2\u7ECF\u5728\u90A3\u6761\u4F1A\u8BDD\u91CC\u4E86\u3002",
     gone: "\u90A3\u6761\u4F1A\u8BDD\u5DF2\u88AB\u5220\u9664\u6216\u5F52\u6863\uFF0C\u63A5\u4E0D\u4E0A\u4E86\u3002",
     runningElsewhere: "\u90A3\u6761\u4F1A\u8BDD\u6B63\u5728\u522B\u7684\u804A\u5929\u91CC\u8DD1\u7740\u4E00\u8F6E\u2014\u2014\u5148\u5230\u90A3\u8FB9\u505C\u6389\u5B83\u3002",
-    done: "\u5DF2\u5207\u5230\u300C{{title}}\u300D\u3002\u53D1\u4E00\u53E5\u8BDD\u5C31\u4ECE\u90A3\u91CC\u63A5\u7740\u804A\u3002"
+    done: "\u5DF2\u5207\u5230\u300C{{title}}\u300D\u3002\u53D1\u4E00\u53E5\u8BDD\u5C31\u4ECE\u90A3\u91CC\u63A5\u7740\u804A\u3002",
+    confirmWeb: "\u300C{{title}}\u300D\u662F\u7F51\u9875\u5F00\u7684\u4F1A\u8BDD\u3002\u518D\u53D1\u4E00\u6B21 /resume \u540C\u4E00\u7F16\u53F7\uFF08\u6216 /resume confirm\uFF09\u786E\u8BA4\u9644\u7740\uFF1B/resume cancel \u53D6\u6D88\u3002",
+    cancelled: "\u5DF2\u53D6\u6D88\u9644\u7740\u3002",
+    nothingPending: "\u6CA1\u6709\u5F85\u786E\u8BA4\u7684\u7F51\u9875\u4F1A\u8BDD\u3002\u7528 /sessions \u770B\u770B\u6709\u54EA\u4E9B\u3002"
   },
   model: {
     current: "\u6A21\u578B\uFF1A{{model}}",
@@ -137465,6 +138083,44 @@ var zh_CN_default = {
     unsupported: "\u8FD9\u4E2A\u5E73\u53F0\u7684\u673A\u5668\u4EBA\u5EFA\u4E0D\u4E86\u7FA4\u3002\u8BF7\u5728 App \u91CC\u81EA\u5DF1\u5EFA\u7FA4\uFF0C\u518D\u628A\u673A\u5668\u4EBA\u62C9\u8FDB\u53BB\u3002",
     noSender: "\u6211\u8BA4\u4E0D\u51FA\u4F60\u5728\u8FD9\u4E2A\u5E73\u53F0\u4E0A\u662F\u8C01\uFF0C\u6CA1\u6CD5\u628A\u4F60\u62C9\u8FDB\u65B0\u7FA4\u3002",
     failed: "\u6CA1\u80FD\u5EFA\u7FA4\u3002\u8BF7\u786E\u8BA4\u8FD9\u4E2A\u5E94\u7528\u6709\u5EFA\u7FA4\u548C\u62C9\u4EBA\u7684\u6743\u9650\uFF0C\u518D\u8BD5\u4E00\u6B21\u3002"
+  },
+  sync: {
+    webUser: "\u7F51\u9875\uFF1A{{text}}"
+  },
+  rowAction: {
+    checkConnection: {
+      label: "\u68C0\u67E5\u8FDE\u63A5",
+      description: "\u9A8C\u8BC1\u5E73\u53F0\u51ED\u636E\u662F\u5426\u4ECD\u53EF\u7528\uFF1B\u4E0D\u4F1A\u5F00\u4F1A\u8BDD\uFF0C\u4E5F\u4E0D\u4F1A\u8C03\u6A21\u578B\u3002",
+      running: "\u6B63\u5728\u68C0\u67E5 {{rowId}} \u2026",
+      done: "\u8FDE\u63A5\u6B63\u5E38",
+      failed: "\u8FDE\u63A5\u5931\u8D25\uFF08\u53C2\u8003\u53F7 {{ref}}\uFF09",
+      notSaved: "\u8BF7\u5148\u4FDD\u5B58\u8FD9\u4E00\u884C\u518D\u68C0\u67E5\u8FDE\u63A5\uFF08\u51ED\u636E\u53EA\u4ECE\u5DF2\u4FDD\u5B58\u914D\u7F6E\u8BFB\u53D6\uFF09\u3002"
+    },
+    copyDiagnostics: {
+      label: "\u590D\u5236\u8BCA\u65AD",
+      description: "\u8DD1\u4E00\u6B21\u8FDE\u63A5\u63A2\u6D4B\uFF0C\u751F\u6210\u53EF\u590D\u5236\u7684\u8BCA\u65AD\u6587\u672C\uFF08\u4E0D\u542B\u5BC6\u94A5\uFF09\u3002",
+      running: "\u6B63\u5728\u751F\u6210\u8BCA\u65AD {{rowId}} \u2026",
+      done: "\u8BCA\u65AD\u5DF2\u751F\u6210\uFF0C\u89C1\u4E0B\u65B9\u8BE6\u60C5",
+      failed: "\u8BCA\u65AD\u5931\u8D25\uFF08\u53C2\u8003\u53F7 {{ref}}\uFF09",
+      notSaved: "\u8BF7\u5148\u4FDD\u5B58\u8FD9\u4E00\u884C\u518D\u590D\u5236\u8BCA\u65AD\u3002"
+    },
+    diagnostic: {
+      ref: "\u53C2\u8003\u53F7 {{ref}}\n{{detail}}"
+    },
+    larkRepair: {
+      label: "\u8865\u5168\u6743\u9650",
+      description: "\u6838\u5BF9\u98DE\u4E66\u5E94\u7528\u4ECD\u80FD\u6362 token\uFF0C\u5E76\u63D0\u793A\u9700\u8981\u8865\u7684\u6743\u9650\u4E0E\u53D1\u5E03\u6B65\u9AA4\u3002",
+      step: {
+        scopes: "\u786E\u8BA4\u6D88\u606F / \u8D44\u6E90 / \u9762\u677F\u7B49\u6743\u9650",
+        events: "\u786E\u8BA4\u957F\u8FDE\u63A5\u4E0E\u4E8B\u4EF6\u8BA2\u9605",
+        publish: "\u5982\u6709\u589E\u91CF\u6743\u9650\uFF0C\u5B8C\u6210\u53D1\u5E03\u5BA1\u6279",
+        verify: "\u9A8C\u8BC1\u5E94\u7528\u4ECD\u53EF\u6362\u53D6 tenant token"
+      },
+      done: "\u51ED\u636E\u53EF\u7528\uFF1B\u82E5\u6743\u9650\u4E0D\u8DB3\u8BF7\u6309\u98DE\u4E66\u63A7\u5236\u53F0\u8865\u9F50\u540E\u53D1\u5E03",
+      hint: "\u53C2\u8003\u53F7 {{ref}}\n{{detail}}\n\u7F3A\u6743\u9650\u65F6\u53EF\u5728\u98DE\u4E66\u5F00\u653E\u5E73\u53F0\u5BF9\u8BE5\u5E94\u7528\u589E\u91CF\u7533\u8BF7\u5E76\u53D1\u5E03\uFF1B\u804A\u5929\u4FA7 /repair \u547D\u4EE4\u540E\u7EED\u8865\u9F50\u3002",
+      failed: "\u65E0\u6CD5\u9A8C\u8BC1\u98DE\u4E66\u5E94\u7528\uFF08\u53C2\u8003\u53F7 {{ref}}\uFF09",
+      notLark: "\u8FD9\u4E00\u884C\u4E0D\u662F\u5DF2\u4FDD\u5B58\u7684\u98DE\u4E66\u673A\u5668\u4EBA\u3002"
+    }
   }
 };
 
@@ -137752,6 +138408,14 @@ var PANEL_RUN_LINES = Object.fromEntries(
     spec.line
   ])
 );
+var MINIMAL_HIDDEN = /* @__PURE__ */ new Set([
+  "status",
+  "help",
+  "plan",
+  "team",
+  "thread"
+]);
+var panelCommandsFor = (mode = "default") => mode === "minimal" ? PANEL_COMMANDS.filter((spec) => !MINIMAL_HIDDEN.has(spec.id)) : PANEL_COMMANDS;
 
 // src/sessionList.ts
 var SESSION_LIST_MAX = 20;
@@ -137773,7 +138437,8 @@ var sessionLine = (row, position, now, t) => {
   const badges = [
     row.current ? t("sessions.badge.current") : null,
     row.running ? t("sessions.badge.running") : null,
-    row.elsewhere ? t("sessions.badge.elsewhere") : null
+    row.elsewhere ? t("sessions.badge.elsewhere") : null,
+    row.origin === "web" ? t("sessions.badge.web") : null
   ].filter((badge) => badge !== null);
   return [`${String(position)}. ${title}`, age, ...badges, shortId(row.threadId)].filter((part) => part !== "").join(" \xB7 ");
 };
@@ -137855,26 +138520,29 @@ var makePanelController = (deps) => {
     return current === void 0 ? t("repo.needProject") : `${t("repo.currentLine", { title: current.title })}
 ${t("panel.projects.hint")}`;
   };
-  const menuCard = (chatKey) => ({
-    title: t("panel.title"),
-    tone: "menu",
-    text: t("panel.hint"),
-    groups: PANEL_CATEGORIES.map(
-      (category) => ({
-        heading: t(`panel.category.${category}`),
-        buttons: PANEL_COMMANDS.filter((spec) => spec.category === category).map(
-          (spec) => button(
-            // 计划模式的按钮把当前状态写在标签上，点了之后标签跟着翻。
-            spec.id === "plan" ? t(deps.planOn(chatKey) ? "panel.cmd.planOn" : "panel.cmd.planOff") : t(spec.labelKey),
-            spec.action.op,
-            spec.action.arg,
-            spec.id === "stop"
+  const menuCard = (chatKey) => {
+    const commands = panelCommandsFor(deps.panelMode(chatKey));
+    return {
+      title: t("panel.title"),
+      tone: "menu",
+      text: t("panel.hint"),
+      groups: PANEL_CATEGORIES.map(
+        (category) => ({
+          heading: t(`panel.category.${category}`),
+          buttons: commands.filter((spec) => spec.category === category).map(
+            (spec) => button(
+              // 计划模式的按钮把当前状态写在标签上，点了之后标签跟着翻。
+              spec.id === "plan" ? t(deps.planOn(chatKey) ? "panel.cmd.planOn" : "panel.cmd.planOff") : t(spec.labelKey),
+              spec.action.op,
+              spec.action.arg,
+              spec.id === "stop"
+            )
           )
-        )
-      })
-    ),
-    nav: []
-  });
+        })
+      ),
+      nav: []
+    };
+  };
   const pickerCard = (input) => {
     const total = pageCount(input.items.length);
     const page = Math.min(Math.max(input.page, 0), total - 1);
@@ -138175,6 +138843,10 @@ var makePanelWiring = (core, deps) => {
       };
     },
     planOn: (chatKey) => chatOf(core.state, chatKey).plan,
+    panelMode: (chatKey) => {
+      const binding = bindingForChatKey(chatKey);
+      return binding?.platform === "lark" ? binding.larkPanelMode : "default";
+    },
     loadSessions: async (chatKey) => {
       const binding = bindingForChatKey(chatKey);
       if (binding === void 0) return [];
@@ -138570,6 +139242,242 @@ var makeReplyCards = (core) => {
   return { turnCards, failureSummaries, stopRequested };
 };
 
+// src/adapter.ts
+var ImNotConnectedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ImNotConnectedError";
+  }
+};
+
+// src/deliveryContract.ts
+var DELIVERY_SEND_ERROR_CODES = [
+  "bad-request",
+  "unknown-bot",
+  "unknown-target",
+  "bot-not-connected",
+  "delivery-failed"
+];
+var isDeliverySendErrorCode = (value) => typeof value === "string" && DELIVERY_SEND_ERROR_CODES.includes(value);
+var DeliverySendError = class extends Error {
+  code;
+  constructor(code2, message) {
+    super(message);
+    this.name = "DeliverySendError";
+    this.code = code2;
+  }
+};
+
+// src/delivery.ts
+var makeDeliverySender = (core, config2) => {
+  return async (input) => {
+    const bots = core.bots();
+    const bot = bots.find((candidate) => candidate.rowId === input.botId);
+    if (bot === void 0) {
+      throw new DeliverySendError("unknown-bot", `Unknown bot '${input.botId}'.`);
+    }
+    const target = findDeliveryTarget(readDeliveryTargets(config2), input.botId, input.targetId);
+    if (target === void 0) {
+      throw new DeliverySendError(
+        "unknown-target",
+        `Unknown target '${input.targetId}' for bot '${input.botId}'.`
+      );
+    }
+    const binding = core.bindingOf(bot, target.platformChatId);
+    try {
+      await core.adapterFor(bot.platform)?.sendText(binding, input.text, { targetKind: target.kind });
+    } catch (error) {
+      throw new DeliverySendError(
+        error instanceof ImNotConnectedError ? "bot-not-connected" : "delivery-failed",
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+    return { sent: true };
+  };
+};
+
+// src/deliveryHttp.ts
+import * as NodeCrypto from "node:crypto";
+import * as NodeHttp from "node:http";
+
+// src/boundedBody.ts
+var readBoundedBody = (req, limit) => new Promise((resolve) => {
+  const chunks = [];
+  let size = 0;
+  let settled = false;
+  const finish = (result) => {
+    if (settled) return;
+    settled = true;
+    resolve(result);
+  };
+  req.on("data", (chunk) => {
+    if (settled) return;
+    size += chunk.length;
+    if (size > limit) {
+      finish({ kind: "too-large" });
+      req.destroy();
+      return;
+    }
+    chunks.push(chunk);
+  });
+  req.on("end", () => finish({ kind: "ok", bytes: Buffer.concat(chunks) }));
+  req.on("error", () => finish({ kind: "read-failed" }));
+  req.on("close", () => finish({ kind: "read-failed" }));
+});
+
+// src/deliveryHttp.ts
+var LOOPBACK = "127.0.0.1";
+var MAX_BODY_BYTES = 1 * 1024 * 1024;
+var PATH = "/v1/delivery/messages";
+var statusFor = (code2) => {
+  switch (code2) {
+    case "bad-request":
+      return 400;
+    case "unauthorized":
+      return 401;
+    case "unknown-bot":
+    case "unknown-target":
+      return 404;
+    case "bot-not-connected":
+      return 503;
+    case "delivery-failed":
+      return 502;
+    case "method-not-allowed":
+      return 405;
+    case "unsupported-media-type":
+      return 415;
+    case "payload-too-large":
+      return 413;
+  }
+};
+var writeJson = (res, status, body) => {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "content-length": Buffer.byteLength(payload),
+    "cache-control": "no-store"
+  });
+  res.end(payload);
+};
+var writeError = (res, code2, message) => {
+  writeJson(res, statusFor(code2), { error: { code: code2, message } });
+};
+var isLoopbackRemote = (remote) => {
+  if (remote === void 0 || remote === "") return false;
+  return remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+};
+var timingSafeEqualString = (a, b) => {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  if (left.length !== right.length) return false;
+  return NodeCrypto.timingSafeEqual(left, right);
+};
+var parseSendBody = (raw) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw.toString("utf8"));
+  } catch {
+    return "bad-request";
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return "bad-request";
+  const record2 = parsed;
+  const botId = record2["botId"];
+  const targetId = record2["targetId"];
+  const text3 = record2["text"];
+  const format2 = record2["format"];
+  if (typeof botId !== "string" || botId.trim() === "") return "bad-request";
+  if (typeof targetId !== "string" || targetId.trim() === "") return "bad-request";
+  if (typeof text3 !== "string" || text3.trim() === "") return "bad-request";
+  if (format2 !== void 0 && format2 !== "plain" && format2 !== "markdown") return "bad-request";
+  for (const key of Object.keys(record2)) {
+    if (key !== "botId" && key !== "targetId" && key !== "text" && key !== "format") {
+      return "bad-request";
+    }
+  }
+  return {
+    botId: botId.trim(),
+    targetId: targetId.trim(),
+    text: text3,
+    format: format2 === "markdown" ? "markdown" : format2 === "plain" ? "plain" : void 0
+  };
+};
+var startDeliveryHttpServer = async (options) => {
+  const server = NodeHttp.createServer((req, res) => {
+    void (async () => {
+      if (!isLoopbackRemote(req.socket.remoteAddress)) {
+        writeError(res, "unauthorized", "Only loopback clients are accepted.");
+        return;
+      }
+      const url = new URL(req.url ?? "/", `http://${LOOPBACK}`);
+      if (url.pathname !== PATH) {
+        writeError(res, "bad-request", `Unknown path '${url.pathname}'.`);
+        return;
+      }
+      if (req.method !== "POST") {
+        res.setHeader("allow", "POST");
+        writeError(res, "method-not-allowed", "Only POST is accepted.");
+        return;
+      }
+      const contentType = (req.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase();
+      if (contentType !== "application/json") {
+        writeError(res, "unsupported-media-type", "Content-Type must be application/json.");
+        return;
+      }
+      if (options.token !== "") {
+        const header = req.headers.authorization ?? "";
+        const prefix = "Bearer ";
+        if (!header.startsWith(prefix) || !timingSafeEqualString(header.slice(prefix.length), options.token)) {
+          writeError(res, "unauthorized", "Bearer token required.");
+          return;
+        }
+      }
+      const read = await readBoundedBody(req, MAX_BODY_BYTES);
+      if (read.kind !== "ok") {
+        if (read.kind === "too-large") {
+          writeError(res, "payload-too-large", "JSON body exceeds 1 MiB.");
+        } else {
+          writeError(res, "bad-request", "Failed to read body.");
+        }
+        return;
+      }
+      const parsed = parseSendBody(read.bytes);
+      if (typeof parsed === "string") {
+        writeError(res, parsed, "Invalid JSON body.");
+        return;
+      }
+      try {
+        const result = await options.send(parsed);
+        writeJson(res, 200, { sent: result.sent });
+      } catch (error) {
+        const rawCode = error instanceof Error ? error.code : void 0;
+        const code2 = isDeliverySendErrorCode(rawCode) ? rawCode : "delivery-failed";
+        const message = error instanceof Error ? error.message : String(error);
+        options.log?.warn("delivery http send failed", { code: code2, message });
+        writeError(res, code2, message);
+      }
+    })().catch((error) => {
+      options.log?.warn("delivery http handler crashed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      if (!res.headersSent) writeError(res, "delivery-failed", "Internal error.");
+    });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(options.port, LOOPBACK, () => resolve());
+  });
+  const address = server.address();
+  const port = address.port;
+  options.log?.info("delivery http listening", { host: LOOPBACK, port, path: PATH });
+  return {
+    port,
+    origin: `http://${LOOPBACK}:${String(port)}`,
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve());
+    })
+  };
+};
+
 // src/sendFile.ts
 var failure = (code2, text3) => ({
   text: text3,
@@ -138711,28 +139619,91 @@ var makeSendFileTool = (deps) => ({
 
 // src/sessions.ts
 var SESSION_SCAN_LIMIT = 50;
+var WEB_LIST_PAGE = 100;
 var makeSessions = (core) => {
   const { host, t, commit, bindChat, deliver } = core;
   const listedByChat = /* @__PURE__ */ new Map();
+  const pendingAttachByChat = /* @__PURE__ */ new Map();
+  const rowFromThread = (thread, chatKey, origin) => {
+    if (thread.archivedAt != null) return null;
+    return {
+      threadId: thread.threadId,
+      title: thread.title,
+      updatedAt: thread.updatedAt,
+      running: thread.session?.activeTurnId != null,
+      current: chatOf(core.state, chatKey).threadId === thread.threadId,
+      elsewhere: Object.entries(core.state.chats).some(
+        ([otherKey, record2]) => otherKey !== chatKey && record2.threadId === thread.threadId
+      ),
+      origin
+    };
+  };
+  const webShellsForProject = async (projectId) => {
+    const listThreads = host.projections.listThreads;
+    if (listThreads === void 0 || projectId === "") return [];
+    const shells = [];
+    let cursor = void 0;
+    for (let page = 0; page < 5; page += 1) {
+      const result = await listThreads({
+        limit: WEB_LIST_PAGE,
+        includeArchived: false,
+        ...cursor === void 0 || cursor === null ? {} : { cursor }
+      });
+      for (const shell of result.threads) {
+        if (shell.projectId !== projectId) continue;
+        if (shell.archivedAt != null) continue;
+        shells.push({
+          threadId: shell.threadId,
+          title: shell.title,
+          updatedAt: shell.updatedAt,
+          archivedAt: shell.archivedAt,
+          session: {
+            activeTurnId: shell.sessionStatus === "running" ? "running" : null
+          }
+        });
+      }
+      if (result.nextCursor === null) break;
+      cursor = result.nextCursor;
+    }
+    return shells;
+  };
   const sessionRowsFor = async (binding) => {
     const chatKey = chatKeyOf(binding);
+    if (binding.projectId === "") return [];
+    const openedIds = new Set(
+      Object.entries(core.state.opened).filter(([, opened]) => opened.projectId === binding.projectId).map(([threadId]) => threadId)
+    );
     const candidates = Object.entries(core.state.opened).filter(([, opened]) => opened.projectId === binding.projectId).toReversed().slice(0, SESSION_SCAN_LIMIT);
-    const threads = await Promise.all(
+    const ownedThreads = await Promise.all(
       candidates.map(([threadId]) => host.projections.getThread(threadId))
     );
     const rows = [];
-    for (const thread of threads) {
-      if (thread === null || thread.archivedAt != null) continue;
-      rows.push({
-        threadId: thread.threadId,
-        title: thread.title,
-        updatedAt: thread.updatedAt,
-        running: thread.session?.activeTurnId != null,
-        current: chatOf(core.state, chatKey).threadId === thread.threadId,
-        elsewhere: Object.entries(core.state.chats).some(
-          ([otherKey, record2]) => otherKey !== chatKey && record2.threadId === thread.threadId
-        )
-      });
+    const seen = /* @__PURE__ */ new Set();
+    for (const thread of ownedThreads) {
+      if (thread === null) continue;
+      const row = rowFromThread(thread, chatKey, "plugin");
+      if (row === null) continue;
+      rows.push(row);
+      seen.add(row.threadId);
+    }
+    const shells = await webShellsForProject(binding.projectId);
+    const listed = new Set(shells.map((shell) => shell.threadId));
+    const attached = await Promise.all(
+      attachedOnChat(core.state, chatKey, binding.projectId).filter(({ threadId }) => !listed.has(threadId)).map(({ threadId }) => host.projections.getThread(threadId))
+    );
+    for (const thread of attached) {
+      if (thread === null || seen.has(thread.threadId) || openedIds.has(thread.threadId)) continue;
+      const row = rowFromThread(thread, chatKey, "web");
+      if (row === null) continue;
+      rows.push(row);
+      seen.add(row.threadId);
+    }
+    for (const shell of shells) {
+      if (seen.has(shell.threadId) || openedIds.has(shell.threadId)) continue;
+      const row = rowFromThread(shell, chatKey, "web");
+      if (row === null) continue;
+      rows.push(row);
+      seen.add(row.threadId);
     }
     return rows.toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt));
   };
@@ -138741,16 +139712,59 @@ var makeSessions = (core) => {
     listedByChat.set(chatKeyOf(binding), listedThreadIds(rows));
     await deliver(binding, formatSessions(rows, Date.now(), t));
   };
+  const bindToSession = async (binding, chatKey, target) => {
+    for (const [otherKey, record2] of Object.entries(core.state.chats)) {
+      if (otherKey !== chatKey && record2.threadId === target.threadId) bindChat(otherKey, null);
+    }
+    if (target.origin === "web" && !hasAttached(core.state, chatKey, target.threadId)) {
+      commit("thread-attached", {
+        chatKey,
+        threadId: target.threadId,
+        projectId: binding.projectId,
+        attachedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+    commit("chat-updated", { chatKey, threadId: target.threadId, target: { kind: "thread" } });
+    pendingAttachByChat.delete(chatKey);
+    listedByChat.delete(chatKey);
+    await deliver(binding, t("resume.done", { title: target.title }));
+  };
   const resumeSession = async (binding, arg) => {
     const chatKey = chatKeyOf(binding);
-    const rows = await sessionRowsFor(binding);
-    const picked = pickSession(arg, listedByChat.get(chatKey), rows);
-    if (picked === null) {
+    const wanted = arg.trim();
+    if (wanted === "") {
       await deliver(binding, t("resume.notFound", { query: arg }));
       return;
     }
-    const target = rows.find((row) => row.threadId === picked);
+    if (wanted.toLowerCase() === "cancel") {
+      if (!pendingAttachByChat.has(chatKey)) {
+        await deliver(binding, t("resume.nothingPending"));
+        return;
+      }
+      pendingAttachByChat.delete(chatKey);
+      await deliver(binding, t("resume.cancelled"));
+      return;
+    }
+    const confirming = wanted.toLowerCase() === "confirm";
+    const pending = pendingAttachByChat.get(chatKey);
+    if (confirming && pending === void 0) {
+      await deliver(binding, t("resume.nothingPending"));
+      return;
+    }
+    const rows = await sessionRowsFor(binding);
+    let targetId;
+    if (confirming) {
+      targetId = pending ?? null;
+    } else {
+      targetId = pickSession(wanted, listedByChat.get(chatKey), rows);
+      if (targetId === null) {
+        await deliver(binding, t("resume.notFound", { query: arg }));
+        return;
+      }
+    }
+    const target = rows.find((row) => row.threadId === targetId);
     if (target === void 0) {
+      if (confirming) pendingAttachByChat.delete(chatKey);
       await deliver(binding, t("resume.gone"));
       return;
     }
@@ -138759,6 +139773,7 @@ var makeSessions = (core) => {
       return;
     }
     if (target.current) {
+      if (confirming) pendingAttachByChat.delete(chatKey);
       await deliver(binding, t("resume.already"));
       return;
     }
@@ -138766,12 +139781,12 @@ var makeSessions = (core) => {
       await deliver(binding, t("resume.runningElsewhere"));
       return;
     }
-    for (const [otherKey, record2] of Object.entries(core.state.chats)) {
-      if (otherKey !== chatKey && record2.threadId === picked) bindChat(otherKey, null);
+    if (target.origin === "web" && !confirming && pending !== target.threadId && !hasAttached(core.state, chatKey, target.threadId)) {
+      pendingAttachByChat.set(chatKey, target.threadId);
+      await deliver(binding, t("resume.confirmWeb", { title: target.title }));
+      return;
     }
-    commit("chat-updated", { chatKey, threadId: picked, target: { kind: "thread" } });
-    listedByChat.delete(chatKey);
-    await deliver(binding, t("resume.done", { title: target.title }));
+    await bindToSession(binding, chatKey, target);
   };
   return { listedByChat, sessionRowsFor, showSessions, resumeSession };
 };
@@ -139299,6 +140314,7 @@ var makeTelegramAdapter = (deps) => {
                   chatId: String(message.chat.id),
                   senderId: message.from === void 0 ? null : String(message.from.id),
                   text: "",
+                  chatKind: message.chat.type === "private" ? "private" : "group",
                   resources: [],
                   unsupportedType: unsupported
                 });
@@ -139309,6 +140325,7 @@ var makeTelegramAdapter = (deps) => {
                 chatId: String(message.chat.id),
                 senderId: message.from === void 0 ? null : String(message.from.id),
                 text: text3,
+                chatKind: message.chat.type === "private" ? "private" : "group",
                 resources: resource === null ? [] : [
                   {
                     key: resource.fileId,
@@ -139342,6 +140359,18 @@ var makeTelegramAdapter = (deps) => {
       const api = await apiFor(binding);
       await api.sendMessage(binding.chatId, text3);
     },
+    checkConnection: async (bot) => {
+      if (tokenOf(bot) === "") {
+        return { stage: "credentials", ok: false, detail: "missing bot token in saved config" };
+      }
+      try {
+        const me = await (await apiFor(bot)).getMe();
+        const username = me.username !== void 0 && me.username !== "" ? `@${me.username}` : "(no username)";
+        return { stage: "getMe", ok: true, detail: `username=${username}` };
+      } catch (error) {
+        return { stage: "getMe", ok: false, detail: describeError(error) };
+      }
+    },
     sendImage: async (binding, image2) => {
       const api = await apiFor(binding);
       try {
@@ -139539,6 +140568,22 @@ var makeTurns = (core, deps) => {
     const attachments = [...carried?.attachments ?? [], ...own.attachments];
     const notes = [...carried?.notes ?? [], ...own.notes];
     const userMessageId = crypto.randomUUID();
+    let intentAction;
+    if (binding.queueMode === "steer") {
+      try {
+        const execution = await queueFlow.readExecution(threadId);
+        const activeTurnId = execution?.activeTurnId ?? null;
+        if (activeTurnId !== null) {
+          intentAction = {
+            kind: "steer",
+            source: "automatic",
+            turnId: activeTurnId,
+            commandId: crypto.randomUUID()
+          };
+        }
+      } catch {
+      }
+    }
     try {
       await host.commands.dispatch({
         type: "thread.turn.start",
@@ -139553,12 +140598,14 @@ var makeTurns = (core, deps) => {
         titleSeed: titleFrom(text3 || attachments[0]?.name || "Chat"),
         runtimeMode: binding.runtimeMode,
         interactionMode: interactionModeOf(chatKey),
+        ...intentAction !== void 0 ? { intentAction } : {},
         createdAt: (/* @__PURE__ */ new Date()).toISOString()
       });
     } catch (error) {
       if (carried !== void 0) pendingByChat.set(chatKey, carried);
       throw error;
     }
+    deps.noteInboundUserMessage?.(userMessageId);
     host.log.info("chat started a turn from a message", {
       bot: binding.displayName,
       chatId: binding.chatId,
@@ -139597,8 +140644,303 @@ var makeTurns = (core, deps) => {
   return { threadStillUsable, ensureThread, startTurn, receiveAttachmentsOnly };
 };
 
+// src/webSync.ts
+var isWebSyncChat = (state, chatKey, threadId) => {
+  const record2 = chatOf(state, chatKey);
+  return record2.chatKind === "private" && record2.threadId === threadId;
+};
+var IM_ORIGIN_LIMIT = 256;
+var MIRRORED_LIMIT = 256;
+var makeWebSync = (core) => {
+  const { host, t, deliver, outbound, bindingForChatKey, ready } = core;
+  const imOriginated = makeBoundedSeen(IM_ORIGIN_LIMIT);
+  const mirrored = makeBoundedSeen(MIRRORED_LIMIT);
+  const noteInboundUserMessage = (messageId) => {
+    imOriginated.claim(messageId);
+  };
+  const syncBindingFor = (threadId) => {
+    const chatKey = chatOfThread(core.state, threadId);
+    if (chatKey === void 0) return void 0;
+    if (!isWebSyncChat(core.state, chatKey, threadId)) return void 0;
+    return bindingForChatKey(chatKey);
+  };
+  host.reactor({
+    name: "im.web-sync-user",
+    events: ["thread.message-sent"],
+    handle: async (event) => {
+      const payload = event.payload;
+      if (payload.role !== "user" || payload.streaming !== false) return;
+      if (typeof payload.threadId !== "string" || typeof payload.messageId !== "string") return;
+      if (imOriginated.has(payload.messageId)) return;
+      if (!mirrored.claim(`user:${payload.messageId}`)) return;
+      const { threadId, messageId } = payload;
+      await ready;
+      const binding = syncBindingFor(threadId);
+      if (binding === void 0) return;
+      outbound(chatKeyOf(binding), async () => {
+        try {
+          const projected = await host.projections.getThreadMessage(messageId);
+          const raw = projected?.text?.trim() || (typeof payload.text === "string" ? payload.text.trim() : "");
+          if (raw === "") return;
+          await deliver(binding, t("sync.webUser", { text: raw }));
+        } catch (error) {
+          host.log.warn("web\u2194im sync failed on user message", {
+            messageId,
+            error: describeError(error)
+          });
+        }
+      });
+    }
+  });
+  return { noteInboundUserMessage };
+};
+
+// src/diagnostics.ts
+var PREFIX = {
+  conn: "IM-CONN",
+  msg: "IM-MSG",
+  setup: "IM-SETUP"
+};
+var shortSalt = () => {
+  const bytes = new Uint8Array(2);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).toUpperCase().padStart(2, "0")).join("");
+};
+var diagnosticRef = (kind, nowMs = Date.now()) => {
+  const stamp = nowMs.toString(36).toUpperCase();
+  return `${PREFIX[kind]}-${stamp}-${shortSalt()}`;
+};
+var formatDiagnosticCopy = (report) => [
+  `ref=${report.ref}`,
+  `ok=${report.ok ? "yes" : "no"}`,
+  `platform=${report.platform}`,
+  `bot=${report.botName}`,
+  `row=${report.rowId}`,
+  `stage=${report.stage}`,
+  `at=${report.at}`,
+  `detail=${report.detail}`
+].join("\n");
+
+// src/settingsRowActions.ts
+var ROW_PAYLOAD_SCHEMA = {
+  type: "object",
+  required: ["rowId", "values"],
+  properties: {
+    rowId: { type: "string" },
+    values: { type: "object" }
+  },
+  additionalProperties: false
+};
+var ROW_ACTION_ITEM_SCHEMA = makeFlowItemSchema({
+  stepId: { type: "string" },
+  fills: { type: "object" },
+  qrRequired: ["payload"],
+  doneRequired: ["messageKey", "fills"]
+});
+var botOf = (config2, adapters, rowId) => {
+  const adapterFor = (platform) => adapters.find((adapter) => adapter.platform === platform);
+  return readBots(config2, adapterFor).find((bot) => bot.rowId === rowId);
+};
+var reportOf = (bot, stage, ok, detail) => ({
+  ref: diagnosticRef("conn"),
+  platform: bot.platform,
+  botName: bot.displayName,
+  rowId: bot.rowId,
+  stage,
+  ok,
+  detail,
+  at: (/* @__PURE__ */ new Date()).toISOString()
+});
+var probe = async (adapters, bot) => {
+  const adapter = adapters.find((candidate) => candidate.platform === bot.platform);
+  if (adapter?.checkConnection === void 0) {
+    return reportOf(bot, "platform", false, `unsupported platform ${bot.platform}`);
+  }
+  const redactor = makeRedactor();
+  for (const column of adapter.columns) {
+    if (column.kind === "password") redactor.register(bot.values[column.key]);
+  }
+  try {
+    const result = await adapter.checkConnection(bot);
+    return reportOf(
+      bot,
+      result.stage,
+      result.ok,
+      result.ok ? result.detail : redactor.redact(result.detail)
+    );
+  } catch (error) {
+    return reportOf(bot, "check", false, redactor.redact(describeError(error)));
+  }
+};
+var emitReport = (emit, report, action) => {
+  const detail = action.copyable ? formatDiagnosticCopy(report) : report.detail;
+  if (report.ok) {
+    emit({
+      kind: "done",
+      fills: {},
+      messageKey: `${action.keyPrefix}.done`,
+      warnings: [{ key: "rowAction.diagnostic.ref", params: { ref: report.ref, detail } }]
+    });
+    return;
+  }
+  emit({
+    kind: "failed",
+    reasonKey: `${action.keyPrefix}.failed`,
+    params: { ref: report.ref },
+    detail
+  });
+};
+var registerSettingsRowActions = (ctx, adapters) => {
+  const resolveBot = (rowId) => botOf(ctx.config, adapters, rowId);
+  const registerProbeAction = (action) => {
+    ctx.stream({
+      name: action.name,
+      description: action.summary,
+      scope: "operate",
+      payloadSchema: ROW_PAYLOAD_SCHEMA,
+      itemSchema: ROW_ACTION_ITEM_SCHEMA,
+      buffer: { latest: 8 },
+      handle: async (payload, emit) => {
+        const rowId = typeof payload["rowId"] === "string" ? payload["rowId"] : "";
+        emit({ kind: "status", statusKey: `${action.keyPrefix}.running`, params: { rowId } });
+        const bot = resolveBot(rowId);
+        if (bot === void 0) {
+          emit({ kind: "failed", reasonKey: `${action.keyPrefix}.notSaved`, params: { rowId } });
+          return;
+        }
+        emitReport(emit, await probe(adapters, bot), action);
+      }
+    });
+  };
+  registerProbeAction({
+    name: ROW_ACTION_COMMANDS.checkConnection,
+    summary: "Probe an IM bot's platform credentials without calling a model.",
+    keyPrefix: "rowAction.checkConnection",
+    copyable: false
+  });
+  registerProbeAction({
+    name: ROW_ACTION_COMMANDS.copyDiagnostics,
+    summary: "Probe an IM bot and return a copy-paste diagnostic report.",
+    keyPrefix: "rowAction.copyDiagnostics",
+    copyable: true
+  });
+  ctx.stream({
+    name: ROW_ACTION_COMMANDS.larkRepair,
+    description: "Guide Lark scope repair and verify the saved app can still mint a token.",
+    scope: "operate",
+    payloadSchema: ROW_PAYLOAD_SCHEMA,
+    itemSchema: ROW_ACTION_ITEM_SCHEMA,
+    buffer: { latest: 8 },
+    handle: async (payload, emit) => {
+      const rowId = typeof payload["rowId"] === "string" ? payload["rowId"] : "";
+      const send = (item) => emit(item);
+      const ref = diagnosticRef("setup");
+      send({
+        kind: "steps",
+        steps: [
+          { id: "scopes", labelKey: "rowAction.larkRepair.step.scopes", state: "pending" },
+          { id: "events", labelKey: "rowAction.larkRepair.step.events", state: "pending" },
+          { id: "publish", labelKey: "rowAction.larkRepair.step.publish", state: "pending" },
+          { id: "verify", labelKey: "rowAction.larkRepair.step.verify", state: "running" }
+        ]
+      });
+      const bot = resolveBot(rowId);
+      if (bot === void 0 || bot.platform !== "lark") {
+        send({
+          kind: "failed",
+          reasonKey: "rowAction.larkRepair.notLark",
+          params: { rowId, ref }
+        });
+        return;
+      }
+      const report = await probe(adapters, bot);
+      send({
+        kind: "steps",
+        steps: [
+          { id: "scopes", labelKey: "rowAction.larkRepair.step.scopes", state: "done" },
+          { id: "events", labelKey: "rowAction.larkRepair.step.events", state: "done" },
+          { id: "publish", labelKey: "rowAction.larkRepair.step.publish", state: "done" },
+          {
+            id: "verify",
+            labelKey: "rowAction.larkRepair.step.verify",
+            state: report.ok ? "done" : "failed"
+          }
+        ]
+      });
+      if (report.ok) {
+        send({
+          kind: "done",
+          fills: {},
+          messageKey: "rowAction.larkRepair.done",
+          warnings: [
+            {
+              key: "rowAction.larkRepair.hint",
+              params: { ref, detail: formatDiagnosticCopy({ ...report, ref }) }
+            }
+          ]
+        });
+        return;
+      }
+      send({
+        kind: "failed",
+        reasonKey: "rowAction.larkRepair.failed",
+        params: { ref },
+        detail: formatDiagnosticCopy({ ...report, ref })
+      });
+    }
+  });
+};
+
+// src/wechatApi.ts
+var WECHAT_TEXT_MAX_CHARS = 1800;
+
+// src/wechatAdapter.ts
+var COLUMNS3 = [
+  {
+    key: "wechatBotToken",
+    kind: "password",
+    labelKey: "column.wechatBotToken.label",
+    descriptionKey: "column.wechatBotToken.description"
+  }
+];
+var tokenOf2 = (bot) => bot.values["wechatBotToken"] ?? "";
+var makeWechatAdapter = (deps) => {
+  return {
+    platform: "wechat",
+    icon: "wechat",
+    // 平台名与设置表的平台选项同一个键，免得默认机器人名与选项写成两种叫法。
+    label: deps.translate("platform.wechat"),
+    columns: COLUMNS3,
+    isConfigured: (bot) => tokenOf2(bot) !== "",
+    connect: (bot, _handlers) => {
+      deps.log.warn("wechat iLink connect is stubbed pending security-review gate (YCO-236)", {
+        bot: bot.displayName,
+        hasToken: tokenOf2(bot) !== "",
+        textLimit: WECHAT_TEXT_MAX_CHARS
+      });
+      return { close: () => void 0 };
+    },
+    sendText: async (binding, _text) => {
+      deps.log.warn("wechat iLink sendText is stubbed pending security-review gate (YCO-236)", {
+        bot: binding.displayName,
+        chatId: binding.chatId
+      });
+      throw new ImNotConnectedError("wechat iLink is not connected yet (stubbed).");
+    },
+    askApproval: async (binding, request) => {
+      deps.log.warn("wechat iLink askApproval is stubbed; approval text not sent", {
+        bot: binding.displayName,
+        chatId: binding.chatId,
+        chars: numberedApprovalText(request).length
+      });
+      return null;
+    },
+    answerByText: (_binding, text3, options) => answerByNumber(text3, options)
+  };
+};
+
 // src/wecomUpload.ts
-import * as NodeCrypto from "node:crypto";
+import * as NodeCrypto2 from "node:crypto";
 var WECOM_CHUNK_BYTES = 512 * 1024;
 var WECOM_MAX_CHUNKS = 100;
 var WECOM_MIN_UPLOAD_BYTES = 5;
@@ -139631,7 +140973,7 @@ var uploadWecomMedia = async (input) => {
     filename: clampName(input.filename),
     total_size: bytes.byteLength,
     total_chunks: totalChunks,
-    md5: NodeCrypto.createHash("md5").update(bytes).digest("hex")
+    md5: NodeCrypto2.createHash("md5").update(bytes).digest("hex")
   });
   const uploadId = init.upload_id;
   if (typeof uploadId !== "string" || uploadId === "") {
@@ -140003,8 +141345,22 @@ var runWecomClient = (input) => {
 };
 
 // src/wecomMedia.ts
-import * as NodeCrypto2 from "node:crypto";
+import * as NodeCrypto3 from "node:crypto";
+
+// src/wecomPadding.ts
 var PADDING_BLOCK = 32;
+var stripPadding = (plain) => {
+  const pad = plain[plain.byteLength - 1] ?? 0;
+  if (pad < 1 || pad > PADDING_BLOCK || pad > plain.byteLength) {
+    return { reason: "the padding length is out of range" };
+  }
+  for (let index = plain.byteLength - pad; index < plain.byteLength; index += 1) {
+    if (plain[index] !== pad) return { reason: "the padding bytes are not all equal" };
+  }
+  return { bytes: plain.subarray(0, plain.byteLength - pad) };
+};
+
+// src/wecomMedia.ts
 var KEY_BYTES = 32;
 var IV_BYTES = 16;
 var AES_BLOCK = 16;
@@ -140020,17 +141376,12 @@ var decryptWecomMedia = (cipher, aesKey) => {
   if (cipher.byteLength === 0 || cipher.byteLength % AES_BLOCK !== 0) {
     throw new WecomDecryptError("the ciphertext is not a whole number of blocks");
   }
-  const decipher = NodeCrypto2.createDecipheriv("aes-256-cbc", key, key.subarray(0, IV_BYTES));
+  const decipher = NodeCrypto3.createDecipheriv("aes-256-cbc", key, key.subarray(0, IV_BYTES));
   decipher.setAutoPadding(false);
   const plain = Buffer.concat([decipher.update(cipher), decipher.final()]);
-  const pad = plain[plain.byteLength - 1] ?? 0;
-  if (pad < 1 || pad > PADDING_BLOCK || pad > plain.byteLength) {
-    throw new WecomDecryptError("the padding length is out of range");
-  }
-  for (let index = plain.byteLength - pad; index < plain.byteLength; index += 1) {
-    if (plain[index] !== pad) throw new WecomDecryptError("the padding bytes are not all equal");
-  }
-  return new Uint8Array(plain.subarray(0, plain.byteLength - pad));
+  const unpadded = stripPadding(plain);
+  if ("reason" in unpadded) throw new WecomDecryptError(unpadded.reason);
+  return new Uint8Array(unpadded.bytes);
 };
 var decodeQuietly = (value) => {
   try {
@@ -140084,7 +141435,7 @@ var WECOM_CARD_THROTTLE_MS = 400;
 var LIVE_STREAM_LIMIT = 200;
 var BACKOFF_START_MS2 = 1e3;
 var BACKOFF_MAX_MS2 = 6e4;
-var COLUMNS3 = [
+var COLUMNS4 = [
   { key: "wecomBotId", kind: "text", labelKey: "column.wecomBotId.label" },
   { key: "wecomBotSecret", kind: "password", labelKey: "column.wecomBotSecret.label" }
 ];
@@ -140094,12 +141445,6 @@ var credentials2 = (binding) => ({
   botSecret: binding.values["wecomBotSecret"] ?? "",
   endpoint: normalizeWecomEndpoint(binding.values["wecomEndpoint"] || DEFAULT_WECOM_ENDPOINT)
 });
-var optionIndexFrom = (text3, count) => {
-  const trimmed = text3.trim();
-  if (!/^\d+$/.test(trimmed)) return null;
-  const index = Number.parseInt(trimmed, 10);
-  return Number.isInteger(index) && index >= 1 && index <= count ? index : null;
-};
 var makeWecomAdapter = (deps) => {
   const clients = /* @__PURE__ */ new Map();
   const t = deps.translate;
@@ -140142,7 +141487,7 @@ ${kept}`;
     platform: "wecom",
     icon: "wecom",
     label: "WeCom",
-    columns: COLUMNS3,
+    columns: COLUMNS4,
     isConfigured: (binding) => {
       const { botId, botSecret } = credentials2(binding);
       return botId !== "" && botSecret !== "";
@@ -140177,6 +141522,8 @@ ${kept}`;
                 chatId: message.chatId,
                 senderId: message.senderUserId,
                 text: message.text,
+                // 群里 @ 到机器人的消息被折算成 single 才放行；真实的聊天类型只留在 conversation。
+                chatKind: message.conversation === "single" ? "private" : "group",
                 // 下载地址与密钥打成一个键：核心只管把它原样交回来。
                 resources: message.resources.map((resource) => ({
                   key: JSON.stringify({ url: resource.url, aesKey: resource.aesKey ?? null }),
@@ -140226,20 +141573,29 @@ ${kept}`;
     sendText: async (binding, text3) => {
       const client = clients.get(binding.rowId);
       if (client === void 0) {
-        deps.log.warn("wecom cannot send without a connection", { bot: binding.displayName });
-        return;
+        throw new ImNotConnectedError(`wecom bot '${binding.displayName}' has no connection.`);
       }
       await client.sendText(binding.chatId, text3);
     },
+    checkConnection: async (bot) => {
+      const { botId, botSecret, endpoint } = credentials2(bot);
+      if (botId === "" || botSecret === "") {
+        return {
+          stage: "credentials",
+          ok: false,
+          detail: "missing bot id or secret in saved config"
+        };
+      }
+      try {
+        const socket = await deps.connectSocket(endpoint);
+        await socket.close();
+        return { stage: "websocket", ok: true, detail: `endpoint reachable (${endpoint})` };
+      } catch (error) {
+        return { stage: "websocket", ok: false, detail: describeError(error) };
+      }
+    },
     askApproval: async (binding, request) => {
-      const lines = [
-        request.body,
-        "",
-        ...request.options.map((option, index) => `${String(index + 1)}. ${option.label}`),
-        "",
-        request.replyHint
-      ];
-      await (clients.get(binding.rowId)?.sendText(binding.chatId, lines.join("\n")) ?? Promise.resolve());
+      await (clients.get(binding.rowId)?.sendText(binding.chatId, numberedApprovalText(request)) ?? Promise.resolve());
       return null;
     },
     turnCards: {
@@ -140266,10 +141622,7 @@ ${kept}`;
     // 图 10 MB（只认 png / jpg / jpeg / gif）、文件 20 MB，来自企微官方文档「智能机器人长连接」。
     outboundLimits: { imageBytes: 10 * 1024 * 1024, fileBytes: 20 * 1024 * 1024, minBytes: 5 },
     imageMimeTypes: /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif"]),
-    answerByText: (_binding, text3, options) => {
-      const index = optionIndexFrom(text3, options.length);
-      return index === null ? null : options[index - 1]?.token ?? null;
-    },
+    answerByText: (_binding, text3, options) => answerByNumber(text3, options),
     fetchResource: async (binding, input) => {
       const parsed = JSON.parse(input.resource.key);
       const media = await fetchWecomMedia({
@@ -140292,6 +141645,783 @@ ${kept}`;
   };
 };
 
+// src/wecomAppApi.ts
+var WECOM_APP_DEFAULT_API_BASE = "https://qyapi.weixin.qq.com";
+var WECOM_APP_TEXT_MAX_BYTES = 2048;
+var WecomAppApiError = class extends Error {
+  code;
+  providerCode;
+  hint;
+  constructor(code2, message, extras) {
+    super(message);
+    this.name = "WecomAppApiError";
+    this.code = code2;
+    this.providerCode = extras?.providerCode;
+    this.hint = extras?.hint;
+  }
+};
+var cleanString = (value) => {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed === "" ? null : trimmed;
+};
+var normalizeApiBaseUrl = (value) => {
+  const raw = cleanString(value);
+  if (raw === null) return WECOM_APP_DEFAULT_API_BASE;
+  if (!/^https?:\/\//iu.test(raw)) {
+    throw new WecomAppApiError("invalid-api-base", "API base must be an http(s) URL.");
+  }
+  return raw.replace(/\/+$/u, "");
+};
+var byteLength = (value) => Buffer.byteLength(value, "utf8");
+var splitUtf8ByBytes = (text3, maxBytes = WECOM_APP_TEXT_MAX_BYTES) => {
+  const value = typeof text3 === "string" ? text3 : "";
+  if (value === "") return [""];
+  const chunks = [];
+  let current = "";
+  let currentBytes = 0;
+  for (const char of value) {
+    const size = byteLength(char);
+    if (currentBytes + size > maxBytes && current.length > 0) {
+      chunks.push(current);
+      current = char;
+      currentBytes = size;
+      continue;
+    }
+    current += char;
+    currentBytes += size;
+  }
+  if (current.length > 0) chunks.push(current);
+  return chunks;
+};
+var WecomAppApi = class {
+  corpId;
+  corpSecret;
+  agentId;
+  apiBaseUrl;
+  #fetch;
+  #token = null;
+  #expiresAt = 0;
+  #pending = null;
+  constructor(options) {
+    this.corpId = options.corpId.trim();
+    this.corpSecret = options.corpSecret.trim();
+    this.agentId = options.agentId.trim();
+    this.apiBaseUrl = normalizeApiBaseUrl(options.apiBaseUrl);
+    this.#fetch = options.fetch ?? globalThis.fetch;
+  }
+  invalidateToken() {
+    this.#token = null;
+    this.#expiresAt = 0;
+  }
+  async getAccessToken(signal) {
+    if (this.#token !== null && Date.now() < this.#expiresAt) return this.#token;
+    if (this.#pending !== null) return this.#pending;
+    this.#pending = this.#fetchToken(signal).finally(() => {
+      this.#pending = null;
+    });
+    return this.#pending;
+  }
+  async #fetchToken(signal) {
+    const url = new URL("/cgi-bin/gettoken", this.apiBaseUrl);
+    url.searchParams.set("corpid", this.corpId);
+    url.searchParams.set("corpsecret", this.corpSecret);
+    const payload = await this.#requestJson(url, {
+      method: "GET",
+      ...signal === void 0 ? {} : { signal }
+    });
+    const accessToken = payload["access_token"];
+    if (typeof accessToken !== "string" || accessToken === "") {
+      throw new WecomAppApiError("token-missing", "WeCom did not return access_token.", {
+        providerCode: payload["errcode"] === void 0 ? void 0 : String(payload["errcode"])
+      });
+    }
+    this.#token = accessToken;
+    const lifetime = Number(payload["expires_in"]);
+    const ttlMs = Number.isFinite(lifetime) && lifetime > 60 ? (lifetime - 60) * 1e3 : 7e3 * 1e3;
+    this.#expiresAt = Date.now() + ttlMs;
+    return accessToken;
+  }
+  async sendText(input) {
+    const chunks = splitUtf8ByBytes(input.content);
+    for (const chunk of chunks) {
+      await this.#sendOnce({
+        touser: input.userId,
+        msgtype: "text",
+        agentid: Number.parseInt(this.agentId, 10),
+        text: { content: chunk },
+        signal: input.signal
+      });
+    }
+  }
+  async #sendOnce(body) {
+    const token = await this.getAccessToken(body.signal);
+    const url = new URL("/cgi-bin/message/send", this.apiBaseUrl);
+    url.searchParams.set("access_token", token);
+    const payload = await this.#requestJson(url, {
+      method: "POST",
+      headers: { "content-type": "application/json; charset=utf-8" },
+      body: JSON.stringify({
+        touser: body.touser,
+        msgtype: body.msgtype,
+        agentid: body.agentid,
+        text: body.text
+      }),
+      ...body.signal === void 0 ? {} : { signal: body.signal }
+    });
+    const errcode = Number(payload["errcode"] ?? 0);
+    if (errcode === 0) return;
+    if (errcode === 60020) {
+      throw new WecomAppApiError("trusted-ip", "WeCom rejected the outbound IP (errcode 60020).", {
+        providerCode: "60020",
+        hint: "\u628A\u51FA\u7AD9\u516C\u7F51 IP \u52A0\u8FDB\u4F01\u4E1A\u5FAE\u4FE1\u540E\u53F0\u7684\u300C\u4F01\u4E1A\u53EF\u4FE1 IP\u300D\u3002"
+      });
+    }
+    if (errcode === 40014 || errcode === 42001) {
+      this.invalidateToken();
+    }
+    throw new WecomAppApiError(
+      "send-failed",
+      typeof payload["errmsg"] === "string" ? payload["errmsg"] : `WeCom message/send failed (${String(errcode)}).`,
+      { providerCode: String(errcode) }
+    );
+  }
+  async #requestJson(url, init) {
+    const response = await this.#fetch(url, init);
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      throw new WecomAppApiError(
+        "bad-response",
+        `WeCom returned non-JSON (HTTP ${String(response.status)}).`
+      );
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+      throw new WecomAppApiError("bad-response", "WeCom returned a non-object JSON body.");
+    }
+    return payload;
+  }
+};
+
+// src/wecomAppCallback.ts
+import * as NodeHttp2 from "node:http";
+
+// src/wecomAppCrypto.ts
+import * as NodeCrypto4 from "node:crypto";
+var AES_KEY_BYTES = 32;
+var RANDOM_BYTES = 16;
+var WecomAppCryptoError = class extends Error {
+  code;
+  constructor(code2, message) {
+    super(message);
+    this.name = "WecomAppCryptoError";
+    this.code = code2;
+  }
+};
+var isValidEncodingAESKey = (value) => value.length === 43 && /^[A-Za-z0-9]+$/.test(value);
+var parseEncodingAESKey = (encodingAESKey) => {
+  const key = Buffer.from(`${encodingAESKey}=`, "base64");
+  if (key.length !== AES_KEY_BYTES) {
+    throw new WecomAppCryptoError("invalid-aes-key", "EncodingAESKey must decode to 32 bytes.");
+  }
+  return { key, iv: key.subarray(0, 16) };
+};
+var timingSafeEqualString2 = (a, b) => {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  if (left.length === 0 || left.length !== right.length) return false;
+  return NodeCrypto4.timingSafeEqual(left, right);
+};
+var computeSignature = (token, timestamp, nonce, encrypt) => NodeCrypto4.createHash("sha1").update([token, timestamp, nonce, encrypt].sort().join("")).digest("hex");
+var verifySignature = (token, timestamp, nonce, encrypt, signature) => timingSafeEqualString2(computeSignature(token, timestamp, nonce, encrypt), signature);
+var decrypt = (encodingAESKey, encryptText, expectReceiveId) => {
+  const { key, iv } = parseEncodingAESKey(encodingAESKey);
+  const decipher = NodeCrypto4.createDecipheriv("aes-256-cbc", key, iv);
+  decipher.setAutoPadding(false);
+  let deciphered;
+  try {
+    const unpadded = stripPadding(
+      Buffer.concat([decipher.update(encryptText, "base64"), decipher.final()])
+    );
+    if ("reason" in unpadded) {
+      throw new WecomAppCryptoError("bad-padding", `Invalid padding: ${unpadded.reason}.`);
+    }
+    deciphered = unpadded.bytes;
+  } catch (error) {
+    if (error instanceof WecomAppCryptoError) throw error;
+    throw new WecomAppCryptoError(
+      "decrypt-failed",
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+  if (deciphered.length < RANDOM_BYTES + 4) {
+    throw new WecomAppCryptoError("bad-plaintext", "Deciphered buffer too short.");
+  }
+  const length = deciphered.readUInt32BE(RANDOM_BYTES);
+  const msgStart = RANDOM_BYTES + 4;
+  const msgEnd = msgStart + length;
+  if (msgEnd > deciphered.length) {
+    throw new WecomAppCryptoError("bad-plaintext", "Declared message length exceeds buffer.");
+  }
+  const message = deciphered.subarray(msgStart, msgEnd).toString("utf8");
+  const receiveId = deciphered.subarray(msgEnd).toString("utf8");
+  if (expectReceiveId !== void 0 && expectReceiveId !== "" && !timingSafeEqualString2(receiveId, expectReceiveId)) {
+    throw new WecomAppCryptoError(
+      "receive-id-mismatch",
+      "Decrypted receiveId does not match CorpID."
+    );
+  }
+  return { message, receiveId };
+};
+var createWecomAppCrypto = (input) => {
+  const token = input.token.trim();
+  const encodingAESKey = input.encodingAESKey.trim();
+  const corpId = input.corpId.trim();
+  if (!token || !encodingAESKey || !corpId) {
+    throw new WecomAppCryptoError(
+      "missing-credentials",
+      "token, encodingAESKey and corpId are required."
+    );
+  }
+  if (!isValidEncodingAESKey(encodingAESKey)) {
+    throw new WecomAppCryptoError(
+      "invalid-aes-key",
+      "EncodingAESKey must be 43 alphanumeric characters."
+    );
+  }
+  parseEncodingAESKey(encodingAESKey);
+  return {
+    verifySignature: (signature, timestamp, nonce, encryptText) => verifySignature(token, timestamp, nonce, encryptText, signature),
+    decrypt: (encryptText) => decrypt(encodingAESKey, encryptText, corpId).message
+  };
+};
+var deriveCallbackPathSecret = (token, encodingAESKey) => NodeCrypto4.createHash("sha256").update(`${token.trim()}:${encodingAESKey.trim()}`).digest("hex").slice(0, 24);
+
+// src/wecomAppParse.ts
+var isRecord2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var isXmlFormat = (raw) => {
+  const trimmed = raw.trim();
+  return trimmed.startsWith("<") && trimmed.endsWith(">");
+};
+var parseWecomAppXmlBody = (xml) => {
+  const result = {};
+  const source = typeof xml === "string" ? xml : "";
+  const cdataPattern = /<([\w:-]+)><!\[CDATA\[([\s\S]*?)\]\]><\/\1>/gu;
+  let match;
+  while ((match = cdataPattern.exec(source)) !== null) {
+    result[match[1]] = match[2];
+  }
+  const simplePattern = /<([\w:-]+)>([^<>]*)<\/\1>/gu;
+  while ((match = simplePattern.exec(source)) !== null) {
+    if (result[match[1]] === void 0) result[match[1]] = match[2];
+  }
+  return result;
+};
+var parseWecomAppPlainMessage = (raw) => {
+  const source = typeof raw === "string" ? raw.trim() : "";
+  if (!source) return null;
+  if (isXmlFormat(source)) {
+    const xml = parseWecomAppXmlBody(source);
+    return {
+      msgid: xml["MsgId"] ?? xml["msgid"],
+      msgtype: (xml["MsgType"] ?? xml["msgtype"] ?? "").toLowerCase(),
+      createTime: xml["CreateTime"] ?? xml["createTime"],
+      agentId: xml["AgentID"] ?? xml["agentid"],
+      from: xml["FromUserName"] ? { userid: xml["FromUserName"] } : void 0,
+      to: xml["ToUserName"],
+      text: xml["Content"] !== void 0 ? { content: xml["Content"] } : void 0,
+      image: xml["PicUrl"] ? { url: xml["PicUrl"] } : void 0,
+      mediaId: xml["MediaId"] ?? xml["mediaid"],
+      recognition: xml["Recognition"],
+      event: (xml["Event"] ?? xml["event"] ?? "").toLowerCase() || void 0,
+      eventKey: xml["EventKey"],
+      chatid: xml["ChatId"]
+    };
+  }
+  let data;
+  try {
+    data = JSON.parse(source);
+  } catch {
+    return null;
+  }
+  if (!isRecord2(data)) return null;
+  const fromRaw = data["from"];
+  const textRaw = data["text"];
+  const imageRaw = data["image"];
+  return {
+    msgid: typeof data["msgid"] === "string" ? data["msgid"] : typeof data["MsgId"] === "string" ? data["MsgId"] : void 0,
+    msgtype: String(data["msgtype"] ?? data["MsgType"] ?? "").toLowerCase(),
+    createTime: data["createTime"] !== void 0 ? String(data["createTime"]) : data["CreateTime"] !== void 0 ? String(data["CreateTime"]) : void 0,
+    agentId: data["agentid"] !== void 0 ? String(data["agentid"]) : data["AgentID"] !== void 0 ? String(data["AgentID"]) : void 0,
+    from: isRecord2(fromRaw) ? { userid: typeof fromRaw["userid"] === "string" ? fromRaw["userid"] : void 0 } : typeof data["FromUserName"] === "string" ? { userid: data["FromUserName"] } : void 0,
+    to: typeof data["to"] === "string" ? data["to"] : void 0,
+    text: isRecord2(textRaw) ? { content: typeof textRaw["content"] === "string" ? textRaw["content"] : void 0 } : void 0,
+    image: isRecord2(imageRaw) ? { url: typeof imageRaw["url"] === "string" ? imageRaw["url"] : void 0 } : void 0,
+    mediaId: typeof data["mediaid"] === "string" ? data["mediaid"] : void 0,
+    recognition: typeof data["recognition"] === "string" ? data["recognition"] : void 0,
+    event: String(data["event"] ?? data["eventtype"] ?? "").toLowerCase() || void 0,
+    eventKey: typeof data["eventkey"] === "string" ? data["eventkey"] : void 0,
+    chatid: typeof data["chatid"] === "string" ? data["chatid"] : void 0
+  };
+};
+
+// src/wecomAppCallback.ts
+var WECOM_APP_DEFAULT_CALLBACK_HOST = "127.0.0.1";
+var WECOM_APP_DEFAULT_CALLBACK_PORT = 30987;
+var WECOM_APP_CALLBACK_PATH_PREFIX = "/wecom-app-callback";
+var MAX_BODY_BYTES2 = 1 * 1024 * 1024;
+var writeText = (res, status, text3, headers = {}) => {
+  if (res.writableEnded || res.destroyed) return;
+  const body = text3;
+  res.writeHead(status, {
+    "content-type": "text/plain; charset=utf-8",
+    "content-length": Buffer.byteLength(body),
+    "cache-control": "no-store",
+    ...headers
+  });
+  res.end(body);
+};
+var writeEmpty = (res) => {
+  if (res.writableEnded || res.destroyed) return;
+  res.statusCode = 200;
+  res.end();
+};
+var callbackRoutePath = (botRowId, token, encodingAESKey) => `${WECOM_APP_CALLBACK_PATH_PREFIX}/${encodeURIComponent(botRowId)}/${deriveCallbackPathSecret(token, encodingAESKey)}`;
+var startWecomAppCallbackServer = async (options) => {
+  const host = options?.host ?? WECOM_APP_DEFAULT_CALLBACK_HOST;
+  const listenPort = options?.port ?? WECOM_APP_DEFAULT_CALLBACK_PORT;
+  const routes = /* @__PURE__ */ new Map();
+  const cryptoFor = (route) => createWecomAppCrypto({
+    token: route.token,
+    encodingAESKey: route.encodingAESKey,
+    corpId: route.corpId
+  });
+  const handleGet = (route, query, res) => {
+    const timestamp = query.get("timestamp") ?? "";
+    const nonce = query.get("nonce") ?? "";
+    const echostr = query.get("echostr") ?? "";
+    const signature = query.get("msg_signature") ?? query.get("msgsignature") ?? query.get("signature") ?? "";
+    if (!timestamp || !nonce || !echostr || !signature) {
+      writeText(res, 400, "missing query params");
+      return;
+    }
+    let crypto2;
+    try {
+      crypto2 = cryptoFor(route);
+    } catch (error) {
+      route.log?.warn("wecom-app route credentials incomplete", {
+        bot: route.botRowId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      writeText(res, 503, "route not ready");
+      return;
+    }
+    try {
+      if (!crypto2.verifySignature(signature, timestamp, nonce, echostr)) {
+        writeText(res, 401, "unauthorized");
+        return;
+      }
+      const plaintext = crypto2.decrypt(echostr);
+      route.log?.info("wecom-app URL verification succeeded", { bot: route.botRowId });
+      writeText(res, 200, plaintext);
+    } catch (error) {
+      route.log?.warn("wecom-app URL verification failed", {
+        bot: route.botRowId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      writeText(res, 400, "verification failed");
+    }
+  };
+  const handlePost = async (route, query, req, res) => {
+    const read = await readBoundedBody(req, MAX_BODY_BYTES2);
+    if (read.kind === "too-large") {
+      writeText(res, 413, "payload too large");
+      return;
+    }
+    if (read.kind === "read-failed") {
+      writeText(res, 400, "failed to read body");
+      return;
+    }
+    const raw = read.bytes.toString("utf8");
+    if (!raw.trim()) {
+      writeText(res, 400, "empty payload");
+      return;
+    }
+    let encrypt = "";
+    let signature = "";
+    let timestamp = "";
+    let nonce = "";
+    if (isXmlFormat(raw)) {
+      const xml = parseWecomAppXmlBody(raw);
+      encrypt = xml["Encrypt"] ?? "";
+      signature = xml["MsgSignature"] ?? query.get("msg_signature") ?? query.get("msgsignature") ?? "";
+      timestamp = xml["TimeStamp"] ?? query.get("timestamp") ?? "";
+      nonce = xml["Nonce"] ?? query.get("nonce") ?? "";
+    } else {
+      let parsed;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        writeText(res, 400, "invalid payload");
+        return;
+      }
+      encrypt = typeof parsed["encrypt"] === "string" ? parsed["encrypt"] : "";
+      signature = typeof parsed["msgsignature"] === "string" ? parsed["msgsignature"] : typeof parsed["MsgSignature"] === "string" ? parsed["MsgSignature"] : query.get("msg_signature") ?? "";
+      timestamp = String(
+        parsed["timestamp"] ?? parsed["TimeStamp"] ?? query.get("timestamp") ?? ""
+      );
+      nonce = String(parsed["nonce"] ?? parsed["Nonce"] ?? query.get("nonce") ?? "");
+    }
+    if (!encrypt || !signature || !timestamp || !nonce) {
+      writeText(res, 400, "missing encrypted payload");
+      return;
+    }
+    let crypto2;
+    try {
+      crypto2 = cryptoFor(route);
+    } catch {
+      writeText(res, 503, "route not ready");
+      return;
+    }
+    let plaintext;
+    try {
+      if (!crypto2.verifySignature(signature, timestamp, nonce, encrypt)) {
+        writeText(res, 401, "unauthorized");
+        return;
+      }
+      plaintext = crypto2.decrypt(encrypt);
+    } catch (error) {
+      route.log?.warn("wecom-app callback signature or decrypt failed", {
+        bot: route.botRowId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      writeText(res, 401, "unauthorized");
+      return;
+    }
+    const message = parseWecomAppPlainMessage(plaintext);
+    if (message === null) {
+      writeText(res, 400, "invalid message");
+      return;
+    }
+    writeEmpty(res);
+    try {
+      await route.onInbound(message);
+    } catch (error) {
+      route.log?.warn("wecom-app inbound handler failed", {
+        bot: route.botRowId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  };
+  const server = NodeHttp2.createServer((req, res) => {
+    void (async () => {
+      if (req.method !== "GET" && req.method !== "POST") {
+        writeText(res, 405, "method not allowed", { allow: "GET, POST" });
+        return;
+      }
+      const url = new URL(req.url ?? "/", `http://${host}`);
+      const route = routes.get(url.pathname);
+      if (route === void 0) {
+        writeText(res, 404, "not found");
+        return;
+      }
+      if (req.method === "GET") {
+        handleGet(route, url.searchParams, res);
+        return;
+      }
+      await handlePost(route, url.searchParams, req, res);
+    })().catch((error) => {
+      if (!res.headersSent) writeText(res, 500, "internal error");
+      void error;
+    });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(listenPort, host, () => resolve());
+  });
+  const address = server.address();
+  const port = address.port;
+  return {
+    host,
+    port,
+    origin: `http://${host}:${String(port)}`,
+    register: (route) => {
+      const path = callbackRoutePath(route.botRowId, route.token, route.encodingAESKey);
+      routes.set(path, { ...route, path });
+      route.log?.info("wecom-app callback route registered", {
+        bot: route.botRowId,
+        path,
+        origin: `http://${host}:${String(port)}`
+      });
+      return path;
+    },
+    unregister: (botRowId) => {
+      for (const [path, route] of routes.entries()) {
+        if (route.botRowId === botRowId) routes.delete(path);
+      }
+    },
+    close: () => new Promise((resolve, reject) => {
+      routes.clear();
+      server.close((error) => error ? reject(error) : resolve());
+    })
+  };
+};
+var makeWecomAppCallbackHub = () => {
+  const open = /* @__PURE__ */ new Map();
+  const closing = /* @__PURE__ */ new Map();
+  const acquire = async (options) => {
+    const host = options?.host ?? WECOM_APP_DEFAULT_CALLBACK_HOST;
+    const port = options?.port ?? WECOM_APP_DEFAULT_CALLBACK_PORT;
+    const key = `${host}:${String(port)}`;
+    let entry = open.get(key);
+    if (entry === void 0) {
+      const created = {
+        server: (closing.get(key) ?? Promise.resolve()).then(
+          () => startWecomAppCallbackServer({ host, port })
+        ),
+        users: 0
+      };
+      entry = created;
+      open.set(key, created);
+      created.server.catch(() => {
+        if (open.get(key) === created) open.delete(key);
+      });
+    }
+    const owner = entry;
+    owner.users += 1;
+    let server;
+    try {
+      server = await owner.server;
+    } catch (error) {
+      owner.users -= 1;
+      throw error;
+    }
+    let released = false;
+    return {
+      server,
+      release: async () => {
+        if (released) return;
+        released = true;
+        owner.users -= 1;
+        if (owner.users > 0) return;
+        if (open.get(key) === owner) open.delete(key);
+        const done = server.close().catch(() => void 0);
+        closing.set(key, done);
+        await done;
+        if (closing.get(key) === done) closing.delete(key);
+      }
+    };
+  };
+  return { acquire };
+};
+
+// src/wecomAppAdapter.ts
+var COLUMNS5 = [
+  {
+    key: "wecomAppCorpId",
+    kind: "text",
+    labelKey: "column.wecomAppCorpId.label",
+    placeholderKey: "column.wecomAppCorpId.placeholder"
+  },
+  {
+    key: "wecomAppAgentId",
+    kind: "text",
+    labelKey: "column.wecomAppAgentId.label",
+    placeholderKey: "column.wecomAppAgentId.placeholder"
+  },
+  { key: "wecomAppSecret", kind: "password", labelKey: "column.wecomAppSecret.label" },
+  { key: "wecomAppToken", kind: "password", labelKey: "column.wecomAppToken.label" },
+  {
+    key: "wecomAppEncodingAESKey",
+    kind: "password",
+    labelKey: "column.wecomAppEncodingAESKey.label",
+    placeholderKey: "column.wecomAppEncodingAESKey.placeholder"
+  },
+  {
+    key: "wecomAppCallbackBaseUrl",
+    kind: "text",
+    labelKey: "column.wecomAppCallbackBaseUrl.label",
+    descriptionKey: "column.wecomAppCallbackBaseUrl.description",
+    placeholderKey: "column.wecomAppCallbackBaseUrl.placeholder"
+  },
+  {
+    key: "wecomAppApiBaseUrl",
+    kind: "text",
+    labelKey: "column.wecomAppApiBaseUrl.label",
+    descriptionKey: "column.wecomAppApiBaseUrl.description",
+    placeholderKey: "column.wecomAppApiBaseUrl.placeholder"
+  },
+  {
+    key: "wecomAppListenPort",
+    kind: "text",
+    labelKey: "column.wecomAppListenPort.label",
+    descriptionKey: "column.wecomAppListenPort.description",
+    placeholderKey: "column.wecomAppListenPort.placeholder"
+  }
+];
+var wecomAppCredentials = (bot) => ({
+  corpId: bot.values["wecomAppCorpId"] ?? "",
+  agentId: bot.values["wecomAppAgentId"] ?? "",
+  corpSecret: bot.values["wecomAppSecret"] ?? "",
+  token: bot.values["wecomAppToken"] ?? "",
+  encodingAESKey: bot.values["wecomAppEncodingAESKey"] ?? "",
+  callbackBaseUrl: (bot.values["wecomAppCallbackBaseUrl"] ?? "").trim().replace(/\/+$/u, ""),
+  apiBaseUrl: (bot.values["wecomAppApiBaseUrl"] ?? "").trim(),
+  listenPortRaw: (bot.values["wecomAppListenPort"] ?? "").trim()
+});
+var parseListenPort = (raw) => {
+  if (raw === "") return WECOM_APP_DEFAULT_CALLBACK_PORT;
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isInteger(n) || n < 0 || n > 65535) return WECOM_APP_DEFAULT_CALLBACK_PORT;
+  return n;
+};
+var makeWecomAppAdapter = (deps) => {
+  const apis = /* @__PURE__ */ new Map();
+  const newApi = (c) => new WecomAppApi({
+    corpId: c.corpId,
+    corpSecret: c.corpSecret,
+    agentId: c.agentId,
+    apiBaseUrl: c.apiBaseUrl || void 0,
+    fetch: deps.fetch
+  });
+  const callbackHub = makeWecomAppCallbackHub();
+  const toInbound = (message, handlers) => {
+    if (message.msgtype === "event") return;
+    const senderId = message.from?.userid ?? null;
+    const chatId = message.chatid ?? message.from?.userid ?? "";
+    if (chatId === "") return;
+    if (message.msgtype === "text") {
+      handlers.onMessage({
+        messageId: message.msgid ?? `${chatId}:${message.createTime ?? Date.now()}`,
+        chatId,
+        senderId,
+        text: message.text?.content?.trim() ?? "",
+        resources: []
+      });
+      return;
+    }
+    if (message.msgtype === "image") {
+      handlers.onMessage({
+        messageId: message.msgid ?? `${chatId}:${message.createTime ?? Date.now()}`,
+        chatId,
+        senderId,
+        text: "",
+        resources: message.mediaId ? [
+          {
+            key: message.mediaId,
+            name: "image.jpg",
+            mimeType: "image/jpeg",
+            kind: "image"
+          }
+        ] : [],
+        ...message.mediaId ? {} : { unsupportedType: "image" }
+      });
+      return;
+    }
+    handlers.onMessage({
+      messageId: message.msgid ?? `${chatId}:${message.createTime ?? Date.now()}`,
+      chatId,
+      senderId,
+      text: "",
+      resources: [],
+      unsupportedType: message.msgtype || "unknown"
+    });
+  };
+  return {
+    platform: "wecom-app",
+    icon: "wecom",
+    label: deps.translate("platform.wecom-app"),
+    columns: COLUMNS5,
+    isConfigured: (bot) => {
+      const c = wecomAppCredentials(bot);
+      return c.corpId !== "" && c.agentId !== "" && c.corpSecret !== "" && c.token !== "" && isValidEncodingAESKey(c.encodingAESKey);
+    },
+    /**
+     * 自建应用是回调式渠道：入站由企微推到我们的 listener，没有可探的长连接；能探的是出站
+     * 凭据——和真实发送同一条路，向 gettoken 换一次 access_token。
+     */
+    checkConnection: async (bot) => {
+      const c = wecomAppCredentials(bot);
+      if (c.corpId === "" || c.agentId === "" || c.corpSecret === "") {
+        return {
+          stage: "credentials",
+          ok: false,
+          detail: "missing corp id, agent id or secret in saved config"
+        };
+      }
+      try {
+        await newApi(c).getAccessToken();
+        return {
+          stage: "gettoken",
+          ok: true,
+          detail: "access_token ok (callback reachability is not probed)"
+        };
+      } catch (error) {
+        return { stage: "gettoken", ok: false, detail: describeError(error) };
+      }
+    },
+    connect: async (bot, handlers) => {
+      const c = wecomAppCredentials(bot);
+      const port = parseListenPort(c.listenPortRaw);
+      const lease = await callbackHub.acquire({ port });
+      const server = lease.server;
+      const api = newApi(c);
+      apis.set(bot.rowId, api);
+      let path;
+      try {
+        path = server.register({
+          botRowId: bot.rowId,
+          token: c.token,
+          encodingAESKey: c.encodingAESKey,
+          corpId: c.corpId,
+          log: deps.log,
+          onInbound: (message) => toInbound(message, handlers)
+        });
+      } catch (error) {
+        await lease.release();
+        throw error;
+      }
+      const fullUrl = c.callbackBaseUrl !== "" ? `${c.callbackBaseUrl}${path}` : `${server.origin}${path}`;
+      deps.log.info("wecom-app connected", {
+        bot: bot.displayName,
+        callbackPath: path,
+        callbackUrl: fullUrl,
+        listen: `${server.host}:${String(server.port)}`
+      });
+      return {
+        close: () => {
+          server.unregister(bot.rowId);
+          apis.delete(bot.rowId);
+          void lease.release().catch((error) => {
+            deps.log.warn("wecom-app callback listener did not close cleanly", {
+              bot: bot.displayName,
+              error: error instanceof Error ? error.message : String(error)
+            });
+          });
+        }
+      };
+    },
+    sendText: async (binding, text3, options) => {
+      if (options?.targetKind === "group") {
+        throw new Error("wecom-app can only deliver to a user; group targets are not supported.");
+      }
+      const api = apis.get(binding.rowId);
+      if (api === void 0) {
+        throw new ImNotConnectedError(`wecom-app bot '${binding.displayName}' is not connected.`);
+      }
+      await api.sendText({ userId: binding.chatId, content: text3 });
+    },
+    askApproval: async (binding, request) => {
+      const api = apis.get(binding.rowId);
+      if (api === void 0) return null;
+      await api.sendText({ userId: binding.chatId, content: numberedApprovalText(request) });
+      return null;
+    },
+    answerByText: (_binding, text3, options) => answerByNumber(text3, options)
+  };
+};
+
 // src/index.ts
 var imPlugin = definePlugin({
   id: "im",
@@ -140331,10 +142461,28 @@ var imPlugin = definePlugin({
           info: (message, fields) => ctx.log.info(message, fields),
           warn: (message, fields) => ctx.log.warn(message, fields)
         }
+      }),
+      makeWecomAppAdapter({
+        // 自建应用：HTTP 回调收消息 + cgi-bin 回文字（YCO-235）。
+        fetch: ctx.http,
+        translate: t,
+        log: {
+          info: (message, fields) => ctx.log.info(message, fields),
+          warn: (message, fields) => ctx.log.warn(message, fields)
+        }
+      }),
+      // 微信个微：配置面先挂上；真 iLink 登录等 0069 安全评审合入门槛通过后再实装。
+      makeWechatAdapter({
+        translate: t,
+        log: {
+          info: (message, fields) => ctx.log.info(message, fields),
+          warn: (message, fields) => ctx.log.warn(message, fields)
+        }
       })
     ];
     ctx.settingsCard({ ...buildSettingsCard(adapters), actions: [LARK_SETUP_CARD_ACTION] });
     registerLarkSetup(ctx);
+    registerSettingsRowActions(ctx, adapters);
     const core = makeImCore({
       host: {
         log: ctx.log,
@@ -140360,13 +142508,15 @@ var imPlugin = definePlugin({
       clearWorking: acknowledgements.clearWorking,
       replyCards
     });
+    const webSync = makeWebSync(core);
     const approvals = makeApprovals(core);
     const interactions = makeInteractions(core, approvals);
     const inboundAttachments = makeInboundAttachments(core);
     const turns = makeTurns(core, {
       attachments: inboundAttachments,
       queueFlow: interactions.queueFlow,
-      rememberThreadProject: notifications.rememberThreadProject
+      rememberThreadProject: notifications.rememberThreadProject,
+      noteInboundUserMessage: webSync.noteInboundUserMessage
     });
     const sessions = makeSessions(core);
     const modelPlan = makeModelPlan(core, turns);
@@ -140419,6 +142569,34 @@ var imPlugin = definePlugin({
       ]
     });
     const { bots, connecting } = startConnections(core, inbound.inboundHandlersFor);
+    if (readDeliveryHttpEnabled(ctx.config)) {
+      const port = readDeliveryHttpPort(ctx.config);
+      const token = readDeliveryHttpToken(ctx.config);
+      const send = makeDeliverySender(core, ctx.config);
+      try {
+        const server = await startDeliveryHttpServer({
+          port,
+          token,
+          send,
+          log: {
+            info: (message, fields) => ctx.log.info(message, fields),
+            warn: (message, fields) => ctx.log.warn(message, fields)
+          }
+        });
+        ctx.onDispose(() => {
+          void server.close().catch((error) => {
+            ctx.log.warn("delivery http could not close", {
+              error: error instanceof Error ? error.message : String(error)
+            });
+          });
+        });
+      } catch (error) {
+        ctx.log.warn("delivery http failed to listen", {
+          port,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
     ctx.log.info("chat plugin active", { bots, connecting });
   }
 });