dsh-agent-toolkit 0.2.6 → 0.2.8

package/lib/index.d.ts

@@ -45,6 +45,8 @@ interface BotsModuleConfig {
   processingReactionEmoji: string;
   /** 回传飞书的错误摘要最大字符数。 */
   errorDetailMaxChars: number;
+  /** 会话创建/恢复时注入「渠道 + 发起人 open_id」提示段（dsh-agent-toolkit:channel:sender）。 */
+  injectSender: boolean;
 }
 //#endregion
 //#region src/agents/team-preset.d.ts

package/lib/index.js

@@ -1835,6 +1835,15 @@ function createFeishuApi(client) {
 				data,
 				mediaType
 			};
+		},
+		async getBotOpenId() {
+			const res = await client.request({
+				method: "GET",
+				url: "https://open.feishu.cn/open-apis/bot/v3/info"
+			});
+			const openId = res.bot?.open_id;
+			if (typeof openId !== "string" || openId.length === 0) throw new Error(`获取机器人信息失败：code=${res.code} msg=${res.msg}`);
+			return openId;
 		}
 	};
 }
@@ -1888,8 +1897,10 @@ function parsePostContent(content) {
 * SDK handler 收到的 data 即事件体（README 示例 `data.message` 直接解构）；
 * 兼容包一层 { event } 的形态。过滤：机器人消息、非 text/post/image 类型、
 * 群内未 @机器人、无文本且无图片。
+* 群消息 @ 校验身份：mention 的 open_id 必须等于本机器人（应用若持全部群消息权限，
+* 会收到 @ 其他机器人的消息，不能误触发）。
 */
-function parseMessageEvent(data) {
+function parseMessageEvent(data, botOpenId) {
 	const wrapped = data;
 	const event = wrapped.event ?? wrapped;
 	if (event.sender?.sender_type !== "user") return null;
@@ -1900,7 +1911,7 @@ function parseMessageEvent(data) {
 	if (typeof msg.content !== "string") return null;
 	if (typeof msg.message_id !== "string" || typeof msg.chat_id !== "string") return null;
 	if (msg.chat_type !== "p2p" && msg.chat_type !== "group") return null;
-	if (msg.chat_type === "group" && !(msg.mentions ?? []).some((m) => m.mentioned_type === "bot")) return null;
+	if (msg.chat_type === "group" && !(msg.mentions ?? []).some((m) => m.mentioned_type === "bot" && m.id?.open_id === botOpenId)) return null;
 	let text = "";
 	let imageKeys = [];
 	if (msg.message_type === "text") try {
@@ -2353,11 +2364,12 @@ const feishuChannel = {
 			appId,
 			appSecret: bot.secret
 		}));
+		const botOpenId = await api.getBotOpenId();
 		const dedup = new MessageDedup();
 		const dispatcher = new lark.EventDispatcher({}).register({
 			"im.message.message_read_v1": async () => void 0,
 			"im.message.receive_v1": async (data) => {
-				const parsed = parseMessageEvent(data);
+				const parsed = parseMessageEvent(data, botOpenId);
 				if (parsed === null || !dedup.check(parsed.messageId)) return;
 				const reply = new FeishuReplyHandle(api, parsed.chatId, tunables, log);
 				const loadImages = parsed.imageKeys.length > 0 ? async () => Promise.all(parsed.imageKeys.map(async (key) => api.downloadImage(parsed.messageId, key))) : void 0;
@@ -2404,8 +2416,9 @@ const FeishuConfigSchema = z$1.object({
 const BotRecordSchema = z$1.object({
 	id: z$1.string().regex(BOT_ID_RE),
 	name: z$1.string().min(1).max(64),
-	channel: z$1.literal("feishu"),
-	feishu: FeishuConfigSchema,
+	/** 渠道类型；与 feishu 同有或同无（未绑定为双双缺省）。 */
+	channel: z$1.literal("feishu").optional(),
+	feishu: FeishuConfigSchema.optional(),
 	/** 绑定项目（agent 的 cwd，绝对路径）。一 bot 一项目。 */
 	project: z$1.string().min(1),
 	/** 透传到 agent 创作期的 persona 提示段。 */
@@ -2420,7 +2433,7 @@ const BotRecordSchema = z$1.object({
 	}).optional(),
 	createdAt: z$1.number().int().nonnegative(),
 	updatedAt: z$1.number().int().nonnegative()
-});
+}).refine((r) => r.channel === void 0 === (r.feishu === void 0), { message: "channel 与 feishu 必须同有或同无" });
 const BindingSchema = z$1.object({ sessionId: z$1.string().min(1) });
 /** domain 名受 UNIT_NAME_RE 约束（^[a-z][a-z0-9_]*$），不允许连字符。 */
 const projectBotDomain = defineDomain({
@@ -2571,7 +2584,7 @@ var Inbound = class {
 		if (bot === void 0) return;
 		const directive = parseDirective(msg.text);
 		if (directive === "new") {
-			await this.deps.router.reset(bot, msg.chatId, msg.reply);
+			await this.deps.router.reset(bot, msg.chatId, msg.reply, msg.userId);
 			await msg.reply.notice("已开启新会话");
 			return;
 		}
@@ -2588,7 +2601,7 @@ var Inbound = class {
 			await msg.reply.notice(rt === void 0 ? `项目：${bot.project}\n会话：未创建（发送消息即创建）` : `项目：${bot.project}\n会话：${rt.sessionId}\n状态：${rt.inflight !== void 0 ? "处理中" : "空闲"}`);
 			return;
 		}
-		const rt = await this.deps.router.ensure(bot, msg.chatId, msg.reply);
+		const rt = await this.deps.router.ensure(bot, msg.chatId, msg.reply, msg.userId);
 		if (rt.inflight !== void 0) {
 			await msg.reply.notice("上一条还在处理中，请稍候（或发送 /stop 取消）");
 			return;
@@ -2636,6 +2649,12 @@ function hooksOf(bot) {
 //#endregion
 //#region src/channels/router.ts
 /** 绑定路由：(botId, chatId) → 长期会话；create / resume / reset。 */
+/** 发起人提示段名：bot 会话声明来源渠道与发起人 open_id。 */
+const SENDER_SECTION_NAME = "dsh-agent-toolkit:channel:sender";
+/** sender 段文本（单聊语义；channel 取 BotRecord.channel，未来新渠道零改动透传）。 */
+function senderSectionText(channel, userId) {
+	return `本会话由 ${channel} 渠道的单聊会话发起。发起人 ID（${channel} open_id）：\`${userId}\`。`;
+}
 var Router = class {
 	agents;
 	bindings;
@@ -2644,7 +2663,8 @@ var Router = class {
 	workspace;
 	onWarn;
 	registry;
-	constructor(agents, bindings, sessions, defaultModel, workspace, onWarn, registry) {
+	injectSender;
+	constructor(agents, bindings, sessions, defaultModel, workspace, onWarn, registry, injectSender = true) {
 		this.agents = agents;
 		this.bindings = bindings;
 		this.sessions = sessions;
@@ -2652,9 +2672,10 @@ var Router = class {
 		this.workspace = workspace;
 		this.onWarn = onWarn;
 		this.registry = registry;
+		this.injectSender = injectSender;
 	}
 	/** 取（或建/恢复）该 chat 的会话 runtime；reply 刷新为最近一次入站携带的句柄。 */
-	async ensure(bot, chatId, reply) {
+	async ensure(bot, chatId, reply, userId) {
 		const bound = this.bindings.get(bot.id, chatId);
 		if (bound !== void 0) {
 			const existing = this.sessions.get(bound);
@@ -2664,7 +2685,7 @@ var Router = class {
 			}
 			const agent = await this.agents.resume({
 				sessionId: bound,
-				...this.resolveSession(bot)
+				...this.resolveSession(bot, userId)
 			});
 			await this.attach(bot.project, bound);
 			return this.adopt(bot.id, chatId, bound, agent, reply);
@@ -2673,7 +2694,7 @@ var Router = class {
 		const agent = await this.agents.create({
 			sessionId,
 			cwd: bot.project,
-			...this.resolveSession(bot)
+			...this.resolveSession(bot, userId)
 		});
 		await this.bindings.set(bot.id, chatId, sessionId);
 		await this.attach(bot.project, sessionId);
@@ -2687,24 +2708,33 @@ var Router = class {
 			this.onWarn(`[project-bot] 会话 ${sessionId} 挂载 workspace 失败：${error instanceof Error ? error.message : String(error)}`);
 		}
 	}
-	/** 有 agentOptions 原样透传；无则回退宿主默认模型（存量 bot 不抛 no provider/model）。 */
-	resolveOptions(bot) {
-		return bot.agentOptions ?? this.defaultModel();
+	/** injectSender 开启时向 hooks.sections 末尾追加 sender 段（主/角色形态通用）。 */
+	withSenderSection(hooks, bot, userId) {
+		if (!this.injectSender) return hooks;
+		const section = {
+			name: SENDER_SECTION_NAME,
+			order: 20,
+			text: senderSectionText(bot.channel ?? "unknown", userId)
+		};
+		return {
+			...hooks,
+			sections: [...hooks.sections ?? [], section]
+		};
 	}
 	/**
 	* 按 bot.agentRef 解析会话组装（agentOptions + 创作期 hooks）：
-	* - 缺省/指向 main → 主 Agent 形态：bot 自带 persona/tools + 默认模型回退；
+	* - 缺省/指向 main → 主 Agent 形态：bot 自带 persona/tools + 模型（自配 agentOptions 优先，缺省回退宿主默认模型）；
 	* - 指向角色 → 角色形态：persona 单 section + tools.restrict + role.model；
 	* - 指向不存在角色 → warn 并降级为主 Agent 形态。
 	*/
-	resolveSession(bot) {
+	resolveSession(bot, userId) {
 		const ref = bot.agentRef ?? "main";
 		const role = this.registry.get(ref);
 		if (role === void 0 || ref === "main") {
 			if (role === void 0 && ref !== "main") this.onWarn(`[project-bot] bot "${bot.id}" 的 agentRef "${ref}" 不存在，降级绑定主 Agent`);
 			return {
-				agentOptions: this.resolveOptions(bot),
-				hooks: hooksOf(bot)
+				agentOptions: bot.agentOptions ?? this.defaultModel(),
+				hooks: this.withSenderSection(hooksOf(bot), bot, userId)
 			};
 		}
 		const sections = role.persona === void 0 || role.persona.trim().length === 0 ? [] : [{
@@ -2713,22 +2743,22 @@ var Router = class {
 			text: role.persona
 		}];
 		return {
-			agentOptions: role.model ?? this.resolveOptions(bot),
-			hooks: {
+			agentOptions: role.model ?? this.defaultModel(),
+			hooks: this.withSenderSection({
 				...sections.length > 0 ? { sections } : {},
 				...role.tools !== void 0 ? { tools: role.tools.allow } : {}
-			}
+			}, bot, userId)
 		};
 	}
 	/** /new：取消旧会话、清绑定、开新会话。 */
-	async reset(bot, chatId, reply) {
+	async reset(bot, chatId, reply, userId) {
 		const bound = this.bindings.get(bot.id, chatId);
 		if (bound !== void 0) {
 			this.sessions.get(bound)?.agent.cancel();
 			this.sessions.delete(bound);
 			await this.bindings.delete(bot.id, chatId);
 		}
-		return this.ensure(bot, chatId, reply);
+		return this.ensure(bot, chatId, reply, userId);
 	}
 	lookup(botId, chatId) {
 		const bound = this.bindings.get(botId, chatId);
@@ -2761,7 +2791,7 @@ var BotRuntime = class {
 	constructor(deps) {
 		this.deps = deps;
 		const bindingStore = this.bindingStore();
-		this.router = new Router(deps.agents, bindingStore, this.sessions, deps.defaultModel, deps.workspace, (m) => deps.log.warn(m), deps.registry);
+		this.router = new Router(deps.agents, bindingStore, this.sessions, deps.defaultModel, deps.workspace, (m) => deps.log.warn(m), deps.registry, deps.injectSender ?? true);
 		this.inbound = new Inbound({
 			router: this.router,
 			bots: deps.bots,
@@ -2774,11 +2804,12 @@ var BotRuntime = class {
 	async startAll() {
 		for (const botId of [...this.deps.bots.keys()]) await this.reconcile(botId);
 	}
-	/** 按最新记录重建该 bot 的渠道（创建/更新后调用；记录已删则纯停止）。 */
+	/** 按最新记录重建该 bot 的渠道（创建/更新后调用；记录已删或未绑定则纯停止）。 */
 	async reconcile(botId) {
 		await this.stopChannel(botId);
 		const record = this.deps.bots.get(botId);
 		if (record === void 0) return;
+		if (record.feishu === void 0 || record.channel === void 0) return;
 		if (!this.deps.validateProject(record.project)) {
 			this.deps.log.warn(`[project-bot] bot "${botId}" 的项目路径不可用：${record.project}`);
 			return;
@@ -2812,7 +2843,17 @@ var BotRuntime = class {
 		}
 		await this.bindingStore().deleteBot(botId);
 	}
+	/** 解绑渠道：停渠道、取消在飞会话；绑定表与持久会话保留（重绑后 resume 接续）。 */
+	async unbindBot(botId) {
+		await this.stopChannel(botId);
+		for (const [sessionId, rt] of [...this.sessions]) if (rt.botId === botId) {
+			rt.agent.cancel();
+			this.sessions.delete(sessionId);
+		}
+	}
 	statusOf(botId) {
+		const record = this.deps.bots.get(botId);
+		if (record !== void 0 && record.feishu === void 0) return "unbound";
 		return this.handles.get(botId)?.status() ?? "not-running";
 	}
 	/** 卸载时序：取消在飞会话 → 等 idle → drain 出站链（卡片定格）→ 断全部渠道。 */
@@ -2920,7 +2961,7 @@ const CreateBodySchema = z$1.object({
 		/** 手动填写路径：明文密钥（立即入 credentials，不落表）。 */
 		appSecret: z$1.string().min(1).optional(),
 		/** 扫码路径：registerApp 已入库，直接给引用。 */
-		appSecretRef: z$1.string().optional()
+		appSecretRef: z$1.string().regex(CREDENTIAL_REF_RE).optional()
 	})
 });
 const UpdateBodySchema = z$1.object({
@@ -2933,11 +2974,12 @@ const UpdateBodySchema = z$1.object({
 		provider: z$1.string().min(1).optional(),
 		model: z$1.string().min(1).optional()
 	}).nullable().optional(),
-	/** 换绑应用：明文新密钥（立即入 credentials）。 */
+	/** 重绑：明文新密钥（立即入 credentials）或扫码引用（已入库）；null = 解绑渠道（删密钥、保留会话绑定）。 */
 	feishu: z$1.object({
 		appId: z$1.string().regex(FEISHU_APP_ID_RE),
-		appSecret: z$1.string().min(1)
-	}).optional()
+		appSecret: z$1.string().min(1).optional(),
+		appSecretRef: z$1.string().regex(CREDENTIAL_REF_RE).optional()
+	}).refine((f) => f.appSecret !== void 0 || f.appSecretRef !== void 0, { message: "缺少 appSecret 或 appSecretRef" }).nullable().optional()
 });
 function json(res, code, body) {
 	res.writeHead(code, { "content-type": "application/json" }).end(JSON.stringify(body));
@@ -2999,7 +3041,7 @@ function createApiHandler(deps) {
 				json(res, 409, { error: `bot id "${id}" 已存在` });
 				return;
 			}
-			for (const [, existing] of deps.bots.entries()) if (existing.feishu.appId === input.feishu.appId) {
+			for (const [, existing] of deps.bots.entries()) if (existing.feishu !== void 0 && existing.feishu.appId === input.feishu.appId) {
 				json(res, 409, { error: `appId 已被 bot "${existing.id}" 使用` });
 				return;
 			}
@@ -3054,23 +3096,40 @@ function createApiHandler(deps) {
 				return;
 			}
 			const input = parsed.data;
-			let feishu = existing.feishu;
-			if (input.feishu !== void 0) feishu = {
-				appId: input.feishu.appId,
-				appSecretRef: await deps.storeSecret(id, input.feishu.appSecret)
-			};
 			const project = input.project ?? existing.project;
 			if (!deps.validateProject(project)) {
 				json(res, 400, { error: `项目路径不可用：${project}` });
 				return;
 			}
-			const merged = {
-				...existing,
-				...input.name !== void 0 ? { name: input.name } : {},
-				project,
-				feishu,
-				updatedAt: deps.now()
-			};
+			if (input.feishu !== null && input.feishu !== void 0) {
+				for (const [, other] of deps.bots.entries()) if (other.id !== id && other.feishu?.appId === input.feishu.appId) {
+					json(res, 409, { error: `appId 已被 bot "${other.id}" 使用` });
+					return;
+				}
+			}
+			let appSecretRef;
+			if (input.feishu === null) {
+				await deps.runtime.unbindBot(id);
+				if (existing.feishu !== void 0) await deps.deleteSecret(existing.feishu.appSecretRef);
+			} else if (input.feishu !== void 0) {
+				if (input.feishu.appSecret !== void 0) appSecretRef = await deps.storeSecret(id, input.feishu.appSecret);
+				else appSecretRef = input.feishu.appSecretRef;
+				if (existing.feishu !== void 0 && existing.feishu.appSecretRef !== appSecretRef) await deps.deleteSecret(existing.feishu.appSecretRef);
+			}
+			const merged = { ...existing };
+			if (input.name !== void 0) merged.name = input.name;
+			merged.project = project;
+			merged.updatedAt = deps.now();
+			if (input.feishu === null) {
+				delete merged.channel;
+				delete merged.feishu;
+			} else if (input.feishu !== void 0 && appSecretRef !== void 0) {
+				merged.channel = "feishu";
+				merged.feishu = {
+					appId: input.feishu.appId,
+					appSecretRef
+				};
+			}
 			if (input.persona === null) delete merged.persona;
 			else if (input.persona !== void 0) merged.persona = input.persona;
 			if (input.agentRef === null) delete merged.agentRef;
@@ -3097,7 +3156,7 @@ function createApiHandler(deps) {
 			}
 			await deps.runtime.stopBot(id);
 			await deps.bots.delete(id);
-			await deps.deleteSecret(existing.feishu.appSecretRef);
+			if (existing.feishu !== void 0) await deps.deleteSecret(existing.feishu.appSecretRef);
 			json(res, 200, { ok: true });
 			return;
 		}
@@ -3321,6 +3380,7 @@ function setupBots(ctx, config, deps) {
 			tunables,
 			maxErrorDetailChars: config.errorDetailMaxChars,
 			attachments: attachmentsOf,
+			injectSender: config.injectSender,
 			resolveSecret: async (ref) => (await ctx.credentials.resolve(credentialRef(ref)))?.value,
 			validateProject: (path) => existsSync(path),
 			log
@@ -3546,14 +3606,16 @@ const Config = z.object({
 		processMaxBytes: z.number().default(8e3),
 		registerAppTimeoutMs: z.number().default(6e5),
 		processingReactionEmoji: z.string().default("OneSecond"),
-		errorDetailMaxChars: z.number().default(500)
+		errorDetailMaxChars: z.number().default(500),
+		injectSender: z.boolean().default(true)
 	}).default({
 		cardUpdateThrottleMs: 500,
 		cardMaxBytes: 28e3,
 		processMaxBytes: 8e3,
 		registerAppTimeoutMs: 6e5,
 		processingReactionEmoji: "OneSecond",
-		errorDetailMaxChars: 500
+		errorDetailMaxChars: 500,
+		injectSender: true
 	}),
 	agentTeamPreset: z.object({
 		enabled: z.boolean().default(true),