dsh-hooks 0.5.0 → 0.7.0

package/lib/feishu.d.ts

@@ -105,12 +105,18 @@ export interface FeishuSummary {
     target: string | null;
     /** Card content truncation length (from the credential file, or the default). */
     resultMaxChars: number;
+    /** Sample card content truncated at `resultMaxChars` (editor preview). */
+    preview: string;
 }
+/** Truncate the preview sample the way the notify script truncates content. */
+export declare function truncatePreview(text: string, max: number): string;
 /**
  * Inspect the credential file for a display-only summary. The app secret is
  * read for presence only and never enters any returned value.
  */
 export declare function readFeishuSummary(configPath?: string): FeishuSummary;
+/** Delete the credential file; returns whether it existed. */
+export declare function deleteFeishuConfig(configPath?: string): boolean;
 /**
  * Update the card truncation length in an existing credential file, keeping
  * every other field (credentials, target) untouched. Throws a user-facing

package/lib/feishu.js

@@ -9,7 +9,7 @@
  * time: the SDK resolves through a dynamic import on first setup, so
  * headless/CLI profiles without a web server pay nothing for the UI path.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import YAML from 'yaml';
@@ -224,6 +224,18 @@ export function maskId(value) {
         return value;
     return `${value.slice(0, 8)}…${value.slice(-4)}`;
 }
+/** Sample text long enough to demonstrate any truncation length. */
+const PREVIEW_SAMPLE = '✅ 任务已完成 · 示例会话（回合 #42）。本轮完成了依赖安装、代码实现与全部测试验证，' +
+    '飞书卡片正文会按设定的截断长度折叠，超出部分在行边界处省略并追加省略号。' +
+    '你可以用下面的长度输入框调整它，保存后立即生效，无需重启 dsh web。'.repeat(6);
+/** Truncate the preview sample the way the notify script truncates content. */
+export function truncatePreview(text, max) {
+    if (text.length <= max)
+        return text;
+    const cut = text.slice(0, max);
+    const lastNl = cut.lastIndexOf('\n');
+    return (lastNl > max / 2 ? cut.slice(0, lastNl) : cut) + '…';
+}
 /**
  * Inspect the credential file for a display-only summary. The app secret is
  * read for presence only and never enters any returned value.
@@ -235,6 +247,7 @@ export function readFeishuSummary(configPath = FEISHU_CONFIG_PATH) {
         targetKind: null,
         target: null,
         resultMaxChars: FEISHU_RESULT_MAX_CHARS_DEFAULT,
+        preview: truncatePreview(PREVIEW_SAMPLE, FEISHU_RESULT_MAX_CHARS_DEFAULT),
     };
     if (!existsSync(configPath))
         return empty;
@@ -247,14 +260,22 @@ export function readFeishuSummary(configPath = FEISHU_CONFIG_PATH) {
         const resultMaxChars = typeof file.result_max_chars === 'number' && Number.isFinite(file.result_max_chars) && file.result_max_chars > 0
             ? Math.floor(file.result_max_chars)
             : FEISHU_RESULT_MAX_CHARS_DEFAULT;
+        const preview = truncatePreview(PREVIEW_SAMPLE, resultMaxChars);
         if (appId === null || !secret || target === null)
-            return { ...empty, resultMaxChars };
-        return { configured: true, appId: maskId(appId), targetKind, target: maskId(target), resultMaxChars };
+            return { ...empty, resultMaxChars, preview };
+        return { configured: true, appId: maskId(appId), targetKind, target: maskId(target), resultMaxChars, preview };
     }
     catch {
         return empty;
     }
 }
+/** Delete the credential file; returns whether it existed. */
+export function deleteFeishuConfig(configPath = FEISHU_CONFIG_PATH) {
+    if (!existsSync(configPath))
+        return false;
+    unlinkSync(configPath);
+    return true;
+}
 /**
  * Update the card truncation length in an existing credential file, keeping
  * every other field (credentials, target) untouched. Throws a user-facing

package/lib/index.js

@@ -30,7 +30,7 @@ export function apply(ctx, config = {}) {
     if (webServer !== undefined) {
         const feishu = createFeishuSetupManager();
         ctx.effect(() => {
-            const unregister = registerHookRoutes(webServer, { hooks, history, feishu: { manager: feishu } });
+            const unregister = registerHookRoutes(webServer, { hooks, history, runner, feishu: { manager: feishu } });
             return () => {
                 unregister();
                 // Abort an in-flight QR scan so it never outlives the plugin.

package/lib/notify.d.ts

@@ -24,5 +24,5 @@ export declare function sendWebhook(spec: NotifySpec, ctx: HookContext, env?: No
  * through shell-string interpolation.
  */
 export declare function sendDesktop(spec: NotifySpec, ctx: HookContext): Promise<NotifyResult>;
-/** Fire a built-in notification; failures only warn. */
-export declare function fireNotify(spec: NotifySpec, ctx: HookContext, record?: NotifyRecord): Promise<void>;
+/** Fire a built-in notification; failures only warn and surface in the result. */
+export declare function fireNotify(spec: NotifySpec, ctx: HookContext, record?: NotifyRecord): Promise<NotifyResult>;

package/lib/notify.js

@@ -196,7 +196,7 @@ function runAndWait(argv, env, timeoutMs) {
         });
     });
 }
-/** Fire a built-in notification; failures only warn. */
+/** Fire a built-in notification; failures only warn and surface in the result. */
 export async function fireNotify(spec, ctx, record) {
     const startedAt = Date.now();
     const result = spec.channel === 'webhook' ? await sendWebhook(spec, ctx) : await sendDesktop(spec, ctx);
@@ -212,7 +212,7 @@ export async function fireNotify(spec, ctx, record) {
             durationMs: Date.now() - startedAt,
             error: result.error,
         });
-        return;
+        return result;
     }
     record?.({
         kind: 'notify',
@@ -223,4 +223,5 @@ export async function fireNotify(spec, ctx, record) {
         outcome: 'sent',
         durationMs: Date.now() - startedAt,
     });
+    return result;
 }

package/lib/patch-config.d.ts

@@ -0,0 +1,47 @@
+/** Wire shape for one hook as the settings panel sends it (string regexes). */
+export interface HookWireSpec {
+    on: string;
+    when?: string;
+    match?: Record<string, string>;
+    run?: string;
+    notify?: {
+        channel: 'webhook' | 'desktop';
+        url?: string;
+        slack?: boolean;
+    } | null;
+    input?: 'env' | 'stdin';
+    timeoutMs?: number;
+    retries?: number;
+    retryDelayMs?: number;
+}
+/** Parse a patch list; throws a user-facing error on malformed YAML. */
+export declare function parsePatchText(text: string): unknown[];
+/**
+ * Validate the wire hooks before they ever touch a file. Returns a
+ * user-facing error message, or null when every hook is valid.
+ */
+export declare function validateHookWire(hooks: HookWireSpec[]): string | null;
+/**
+ * Replace the dsh-hooks block's hooks in a patch list. Other entries and
+ * other config of the dsh-hooks entry (e.g. `history`) stay untouched; a
+ * missing dsh-hooks entry is appended.
+ */
+export declare function patchTextWithHooks(existingText: string, hooks: HookWireSpec[]): string;
+/** Timestamped backup path for a patch file. */
+export declare function backupPathFor(patchFile: string, now?: Date): string;
+export interface WriteHooksResult {
+    patchFile: string;
+    backupPath: string;
+    hookCount: number;
+}
+/**
+ * Validate and persist the hook list into a profile's cordis.patch.yml.
+ * The previous content is backed up beside the file first.
+ */
+export declare function writeHooksConfig(patchFile: string, hooks: HookWireSpec[]): WriteHooksResult;
+/**
+ * Drop every hook whose `run` references the given script (the stable
+ * notify-feishu.mjs copy), used by the Feishu disconnect flow. Other
+ * entries and config stay untouched.
+ */
+export declare function removeScriptHooks(patchFile: string, scriptMarker: string): void;

package/lib/patch-config.js

@@ -0,0 +1,141 @@
+/**
+ * Patch-file plumbing for the settings-panel hook editor and the Feishu
+ * disconnect flow: read a profile's cordis.patch.yml, replace the dsh-hooks
+ * block's hooks while keeping every other entry (and other dsh-hooks
+ * config, e.g. `history`) untouched, and write back with a timestamped
+ * backup. The profile layer is hot-reloaded by the harness's patch watcher,
+ * so a save applies without a restart.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import YAML from 'yaml';
+import { HOOK_EVENTS, TURN_END_REASONS } from './config.js';
+/** Parse a patch list; throws a user-facing error on malformed YAML. */
+export function parsePatchText(text) {
+    let entries;
+    try {
+        entries = YAML.parse(text || '[]\n');
+    }
+    catch {
+        throw new Error('cordis.patch.yml 解析失败，请先修复该文件');
+    }
+    if (!Array.isArray(entries))
+        throw new Error('cordis.patch.yml 顶层必须是 YAML 数组');
+    return entries;
+}
+/**
+ * Validate the wire hooks before they ever touch a file. Returns a
+ * user-facing error message, or null when every hook is valid.
+ */
+export function validateHookWire(hooks) {
+    for (const [i, hook] of hooks.entries()) {
+        const label = `hook #${i + 1}`;
+        if (!HOOK_EVENTS.includes(hook.on)) {
+            return `${label}：无效事件 ${hook.on}`;
+        }
+        if (hook.when !== undefined && !TURN_END_REASONS.includes(hook.when)) {
+            return `${label}：无效 when 原因 ${hook.when}`;
+        }
+        if (hook.match !== undefined) {
+            for (const [field, pattern] of Object.entries(hook.match)) {
+                if (field === '')
+                    return `${label}：match 字段名不能为空`;
+                try {
+                    new RegExp(pattern);
+                }
+                catch (error) {
+                    return `${label}：match.${field} 正则无效（${error instanceof Error ? error.message : String(error)}）`;
+                }
+            }
+        }
+        const hasRun = typeof hook.run === 'string' && hook.run.trim() !== '';
+        const hasNotify = hook.notify !== undefined && hook.notify !== null;
+        if (hasRun === hasNotify) {
+            return `${label}：run 与 notify 必须且只能声明一个`;
+        }
+        if (hasNotify && hook.notify.channel !== 'webhook' && hook.notify.channel !== 'desktop') {
+            return `${label}：无效通知渠道 ${hook.notify.channel}`;
+        }
+        for (const key of ['timeoutMs', 'retries', 'retryDelayMs']) {
+            const value = hook[key];
+            if (value !== undefined && (!Number.isFinite(value) || value < 0)) {
+                return `${label}：${key} 必须是非负数字`;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Replace the dsh-hooks block's hooks in a patch list. Other entries and
+ * other config of the dsh-hooks entry (e.g. `history`) stay untouched; a
+ * missing dsh-hooks entry is appended.
+ */
+export function patchTextWithHooks(existingText, hooks) {
+    const entries = parsePatchText(existingText);
+    let found = false;
+    for (const entry of entries) {
+        if (entry !== null && typeof entry === 'object' && entry.id === 'dsh-hooks') {
+            const target = entry;
+            target.name = 'dsh-hooks';
+            target.config = { ...(target.config ?? {}), hooks };
+            found = true;
+            break;
+        }
+    }
+    if (!found)
+        entries.push({ id: 'dsh-hooks', name: 'dsh-hooks', config: { hooks } });
+    return YAML.stringify(entries);
+}
+/** Timestamped backup path for a patch file. */
+export function backupPathFor(patchFile, now = new Date()) {
+    const pad = (n) => String(n).padStart(2, '0');
+    const stamp = `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
+    return `${patchFile}.bak-${stamp}`;
+}
+/**
+ * Validate and persist the hook list into a profile's cordis.patch.yml.
+ * The previous content is backed up beside the file first.
+ */
+export function writeHooksConfig(patchFile, hooks) {
+    const invalid = validateHookWire(hooks);
+    if (invalid !== null)
+        throw new Error(invalid);
+    const existing = existsSync(patchFile) ? readFileSync(patchFile, 'utf8') : '[]\n';
+    const backupPath = backupPathFor(patchFile);
+    writeFileSync(backupPath, existing, 'utf8');
+    writeFileSync(patchFile, patchTextWithHooks(existing, hooks), 'utf8');
+    return { patchFile, backupPath, hookCount: hooks.length };
+}
+/**
+ * Drop every hook whose `run` references the given script (the stable
+ * notify-feishu.mjs copy), used by the Feishu disconnect flow. Other
+ * entries and config stay untouched.
+ */
+export function removeScriptHooks(patchFile, scriptMarker) {
+    if (!existsSync(patchFile))
+        return;
+    const existing = readFileSync(patchFile, 'utf8');
+    const entries = parsePatchText(existing);
+    let changed = false;
+    for (const entry of entries) {
+        if (entry === null || typeof entry !== 'object' || entry.id !== 'dsh-hooks')
+            continue;
+        const config = entry.config;
+        const hooks = Array.isArray(config?.hooks) ? config.hooks : [];
+        const kept = hooks.filter((hook) => {
+            if (typeof hook.run !== 'string')
+                return true;
+            if (hook.run.includes(scriptMarker)) {
+                changed = true;
+                return false;
+            }
+            return true;
+        });
+        if (changed) {
+            config.hooks = kept;
+            const backupPath = backupPathFor(patchFile);
+            writeFileSync(backupPath, existing, 'utf8');
+            writeFileSync(patchFile, YAML.stringify(entries), 'utf8');
+        }
+        break;
+    }
+}

package/lib/runner.d.ts

@@ -10,8 +10,16 @@ export interface RunOutcome {
 /** Track in-flight hook runs so a missing parent never outlives teardown. */
 export interface HookRunner {
     run(spec: HookSpec, ctx: HookContext): RunOutcome;
+    /** Live counters for the web-panel diagnostics. */
+    stats(): HookRunnerStats;
     dispose(): void;
 }
+export interface HookRunnerStats {
+    /** Spawned children still running (waiting for their exit). */
+    inFlight: number;
+    /** Retry timers scheduled in the background. */
+    pendingRetries: number;
+}
 export type RunRecord = (record: Omit<HookRunRecord, 'ts'>) => void;
 export declare const DEFAULT_TIMEOUT_MS = 10000;
 export declare const DEFAULT_RETRY_DELAY_MS = 500;

package/lib/runner.js

@@ -142,5 +142,8 @@ export function createHookRunner(log = console.log, record) {
             terminate(child);
         children.clear();
     }
-    return { run, dispose };
+    function stats() {
+        return { inFlight: children.size, pendingRetries: pendingRetries.size };
+    }
+    return { run, stats, dispose };
 }

package/lib/server.d.ts

@@ -1,15 +1,18 @@
 /**
- * /dsh-hooks/* HTTP routes for the web profile: status, execution history,
- * a dry-run-style test trigger, and the Feishu connect flow (QR setup /
- * cancel / test card). Registered only when the shared webserver service
- * exists (web profile) — CLI/headless environments never see them.
- * Loopback-only with JSON envelopes; POSTs require an explicit
- * application/json content-type (CSRF hardening, same posture as
- * dsh-aionui-panel).
+ * /dsh-hooks/* HTTP routes for the web profile: status (incl. the hook
+ * list and live runner stats), execution history, a dry-run-style test
+ * trigger, notify-channel quick tests, the hook-list editor (writes back
+ * to the profile's cordis.patch.yml with a backup), and the Feishu connect
+ * flow (QR setup / cancel / config / test card / disconnect). Registered
+ * only when the shared webserver service exists (web profile) — CLI/headless
+ * environments never see them. Loopback-only by default, with JSON envelopes; POSTs
+ * require an explicit application/json content-type (CSRF hardening, same
+ * posture as dsh-aionui-panel).
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { HookSpec } from './config.js';
 import type { HistorySink } from './history.js';
+import { type HookRunner } from './runner.js';
 import { type FeishuSetupManager } from './feishu-session.js';
 import { runFeishuTest } from './feishu.js';
 /** Minimal structural shape of the shared web server (dsh-host-webserver). */
@@ -22,7 +25,7 @@ export interface WebServerLike {
 }
 /** Plugin version, read from package.json (this package ships its own). */
 export declare function pluginVersion(): string;
-/** Loopback fence: never let a LAN client reach /dsh-hooks operations. */
+/** DSH_HOOKS_ALLOWED_IPS: unset/empty = loopback; * = any; otherwise comma-separated IPs. */
 export declare function isLoopbackRequest(req: IncomingMessage): boolean;
 export interface FeishuRouteDeps {
     /** QR-scan session manager (one in-flight flow at a time). */
@@ -37,7 +40,30 @@ export interface HookRoutesOptions {
     history: HistorySink;
     version?: string;
     feishu?: FeishuRouteDeps;
+    /** Live runner counters for the diagnostics badge. */
+    runner?: Pick<HookRunner, 'stats'>;
+    /** Profile → patch-file resolver, injectable so tests never touch the real home. */
+    resolvePatchFile?: (profile: string) => string;
 }
+/** Sanitized per-hook description for the settings panel (regex sources, no RegExp objects). */
+export declare function describeHooks(hooks: readonly HookSpec[]): {
+    index: number;
+    on: "agent/created" | "agent/disposed" | "agent/error" | "agent/status" | "approval/asked" | "session/created" | "session/disposed" | "session/title" | "step/end" | "tool/call" | "tool/result" | "turn/end" | "turn/start" | "user/message";
+    when: "aborted" | "blocked" | "completed" | "error" | "interrupted" | "max-tokens" | undefined;
+    match: {
+        [k: string]: string;
+    } | undefined;
+    run: string | undefined;
+    notify: {
+        channel: "desktop" | "webhook";
+        url: string | undefined;
+        slack: boolean | undefined;
+    } | undefined;
+    input: "env" | "stdin" | undefined;
+    timeoutMs: number | undefined;
+    retries: number | undefined;
+    retryDelayMs: number | undefined;
+}[];
 /** Create the /dsh-hooks route handler (exported for tests). */
 export declare function createHookHandler(options: HookRoutesOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
 /** Register the /dsh-hooks prefix route on the shared web server. */

package/lib/server.js

@@ -1,9 +1,10 @@
 import { createRequire } from 'node:module';
-import { describeHook, evaluateHooks, mockContext } from './dry-run.js';
+import { describeHook, evaluateHooks, mockContext, patchFilePath } from './dry-run.js';
 import { createHookRunner } from './runner.js';
-import { fireNotify } from './notify.js';
+import { fireNotify, summarizeContext } from './notify.js';
 import { FEISHU_SETUP_BUSY } from './feishu-session.js';
-import { readFeishuSummary, runFeishuTest, updateFeishuResultMaxChars } from './feishu.js';
+import { deleteFeishuConfig, readFeishuSummary, runFeishuTest, updateFeishuResultMaxChars } from './feishu.js';
+import { removeScriptHooks, writeHooksConfig } from './patch-config.js';
 /** Plugin version, read from package.json (this package ships its own). */
 export function pluginVersion() {
     const require = createRequire(import.meta.url);
@@ -21,9 +22,17 @@ function json(res, envelope, status = 200) {
     res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
     res.end(JSON.stringify(envelope));
 }
-/** Loopback fence: never let a LAN client reach /dsh-hooks operations. */
+/** DSH_HOOKS_ALLOWED_IPS: unset/empty = loopback; * = any; otherwise comma-separated IPs. */
 export function isLoopbackRequest(req) {
+    const allowedIps = process.env.DSH_HOOKS_ALLOWED_IPS?.trim() ?? '';
+    if (allowedIps === '*')
+        return true;
+    // Check the direct peer only; never trust forwarded headers.
     const address = req.socket.remoteAddress ?? '';
+    if (allowedIps !== '') {
+        const normalize = (ip) => ip.trim().toLowerCase().replace(/^::ffff:/, '');
+        return address !== '' && allowedIps.split(',').some((ip) => normalize(ip) === normalize(address));
+    }
     return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
 }
 async function readJsonBody(req) {
@@ -46,6 +55,26 @@ async function readJsonBody(req) {
         return null;
     }
 }
+/** Sanitized per-hook description for the settings panel (regex sources, no RegExp objects). */
+export function describeHooks(hooks) {
+    return hooks.map((hook, i) => ({
+        index: i + 1,
+        on: hook.on,
+        when: hook.when,
+        match: hook.match === undefined
+            ? undefined
+            : Object.fromEntries(Object.entries(hook.match).map(([field, re]) => [field, re.source])),
+        run: hook.run,
+        notify: hook.notify === undefined || hook.notify === null
+            ? undefined
+            : { channel: hook.notify.channel, url: hook.notify.url, slack: hook.notify.slack },
+        input: hook.input,
+        timeoutMs: hook.timeoutMs,
+        retries: hook.retries,
+        retryDelayMs: hook.retryDelayMs,
+    }));
+}
+const FAILED_OUTCOMES = new Set(['exit-nonzero', 'timeout', 'spawn-failed', 'send-failed']);
 /** Create the /dsh-hooks route handler (exported for tests). */
 export function createHookHandler(options) {
     const { hooks, history } = options;
@@ -53,9 +82,11 @@ export function createHookHandler(options) {
     const feishu = options.feishu;
     const runFeishuTestCard = feishu?.runTest ?? runFeishuTest;
     const feishuConfigPath = feishu?.configPath;
+    const runnerStats = options.runner?.stats ?? (() => ({ inFlight: 0, pendingRetries: 0 }));
+    const resolvePatch = options.resolvePatchFile ?? patchFilePath;
     return async (req, res) => {
         if (!isLoopbackRequest(req)) {
-            json(res, FAIL('forbidden', 'loopback-only'), 403);
+            json(res, FAIL('forbidden', 'IP not allowed'), 403);
             return;
         }
         const url = new URL(req.url ?? '/', 'http://x');
@@ -64,7 +95,16 @@ export function createHookHandler(options) {
             // Pull in disk records (pre-restart and other-process appends) so the
             // badge reflects the durable log, not just this process's memory.
             history.sync();
-            json(res, OK({ name: 'dsh-hooks', version, hookCount: hooks.length, historyCount: history.recent().length }));
+            const records = history.recent();
+            const recentFailures = records.filter((record) => FAILED_OUTCOMES.has(record.outcome)).length;
+            json(res, OK({
+                name: 'dsh-hooks',
+                version,
+                hookCount: hooks.length,
+                historyCount: records.length,
+                hooks: describeHooks(hooks),
+                stats: { ...runnerStats(), recentFailures },
+            }));
             return;
         }
         if (req.method === 'GET' && pathname === '/dsh-hooks/history') {
@@ -212,6 +252,104 @@ export function createHookHandler(options) {
             }
             return;
         }
+        if (req.method === 'POST' && pathname === '/dsh-hooks/notify/test') {
+            const contentType = req.headers['content-type'] ?? '';
+            if (!contentType.toLowerCase().startsWith('application/json')) {
+                json(res, FAIL('bad-request', 'POST 需要 application/json'), 415);
+                return;
+            }
+            const payload = await readJsonBody(req);
+            if (typeof payload !== 'object' || payload === null) {
+                json(res, FAIL('bad-request', 'malformed JSON body'), 400);
+                return;
+            }
+            const body = payload;
+            const channel = body.channel;
+            if (channel !== 'webhook' && channel !== 'desktop') {
+                json(res, FAIL('bad-request', '缺少字段 channel（webhook 或 desktop）'), 400);
+                return;
+            }
+            const ctx = {
+                event: 'user/message',
+                sessionId: 'notify-test',
+                sessionName: '通知测试',
+                source: 'plugin',
+                content: '这是一条 dsh-hooks 测试通知：如果收到这条消息，说明该渠道配置正常。',
+                timestamp: new Date().toISOString(),
+            };
+            const result = await fireNotify({
+                channel,
+                url: typeof body.url === 'string' && body.url !== '' ? body.url : undefined,
+                slack: body.slack === true,
+            }, ctx, (record) => history.record(record));
+            if (!result.ok) {
+                json(res, FAIL('send-failed', result.error ?? '发送失败'), 500);
+                return;
+            }
+            json(res, OK({ message: '✅ 测试通知已发送', preview: summarizeContext(ctx) }));
+            return;
+        }
+        if (req.method === 'POST' && pathname === '/dsh-hooks/hooks/save') {
+            const contentType = req.headers['content-type'] ?? '';
+            if (!contentType.toLowerCase().startsWith('application/json')) {
+                json(res, FAIL('bad-request', 'POST 需要 application/json'), 415);
+                return;
+            }
+            const payload = await readJsonBody(req);
+            if (typeof payload !== 'object' || payload === null) {
+                json(res, FAIL('bad-request', 'malformed JSON body'), 400);
+                return;
+            }
+            const body = payload;
+            const profile = typeof body.profile === 'string' && body.profile.trim() !== '' ? body.profile.trim() : 'web';
+            const wireHooks = body.hooks;
+            if (!Array.isArray(wireHooks)) {
+                json(res, FAIL('bad-request', '缺少数组字段 hooks'), 400);
+                return;
+            }
+            const patchFile = resolvePatch(profile);
+            try {
+                const result = writeHooksConfig(patchFile, wireHooks);
+                json(res, OK({
+                    profile,
+                    hookCount: result.hookCount,
+                    patchFile: result.patchFile,
+                    backupPath: result.backupPath,
+                    message: `✅ 已保存 ${result.hookCount} 个 hook 到 ${profile} profile（已备份原文件）。若未立即生效请重启 dsh web。`,
+                }));
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                json(res, FAIL('save-failed', message), 400);
+            }
+            return;
+        }
+        if (feishu !== undefined && req.method === 'POST' && pathname === '/dsh-hooks/feishu/disconnect') {
+            const contentType = req.headers['content-type'] ?? '';
+            if (!contentType.toLowerCase().startsWith('application/json')) {
+                json(res, FAIL('bad-request', 'POST 需要 application/json'), 415);
+                return;
+            }
+            const payload = await readJsonBody(req);
+            const body = (typeof payload === 'object' && payload !== null ? payload : {});
+            const profile = typeof body.profile === 'string' && body.profile.trim() !== '' ? body.profile.trim() : 'web';
+            const removeHooks = body.removeHooks === true;
+            // Abort any in-flight scan session first.
+            feishu.manager.cancel();
+            const existed = deleteFeishuConfig(feishuConfigPath);
+            if (removeHooks) {
+                try {
+                    removeScriptHooks(resolvePatch(profile), 'notify-feishu.mjs');
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    json(res, FAIL('save-failed', message), 400);
+                    return;
+                }
+            }
+            json(res, OK({ disconnected: true, existed, removedHooks: removeHooks, message: '✅ 已断开飞书连接' }));
+            return;
+        }
         json(res, FAIL('not-found', `unknown route ${pathname}`), 404);
     };
 }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dsh-hooks",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "packageManager": "pnpm@11.21.0",
-  "description": "Config-driven lifecycle hooks plugin for DeepSeek Harness: declare event -> command hooks in cordis.patch.yml, no plugin code required. Includes a Hooks section in the Web GUI settings (history timeline + manual tester + Feishu connect).",
+  "description": "Config-driven lifecycle hooks plugin for DeepSeek Harness: declare event -> command hooks in cordis.patch.yml, no plugin code required. Includes a Hooks section in the Web GUI settings (history timeline + manual tester + notify tests + hook editor + Feishu connect).",
   "author": "PeterBon",
   "license": "MIT",
   "repository": {
@@ -73,10 +73,10 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.8",
     "@deepseek-ai/schemastery": "^3.18.1",
     "@tsdown/css": "^0.22.14",
     "@types/node": "^26.2.0",
@@ -86,7 +86,7 @@
     "react-dom": "^18.3.1",
     "tsdown": "^0.22.2",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "@larksuiteoapi/node-sdk": "^1.73.0",