dsh-im-union 0.0.0-stage → 0.0.1

package/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+本项目版本号遵循语义化版本；发布面与宿主兼容矩阵见 `scripts/hosts.mjs`（README 管理块同源）。
+
+## 0.0.1（首发占位，tag=next）
+
+预发布占位版本，非推荐安装线；语义为「协议层与跨版本骨架完成、真机验收进行中」。
+
+### Added
+
+- 跨版本窄腰（host-compat）：services 能力探测冻结 / settings-compat 三态代际分派（gen1/gen2/gen3）/ session-api（宿主 @Remote request-object 主形 + 位置参回退）/ interaction（waterfall 返回即接管）/ fs-api
+- 会话引擎：每聊天串行队列、follow-before-prompt 投递状态机（assistant/message 按 step 聚合 → 流式快照）、turn/end 六因映射、看门狗兜底
+- 命令面板 15 命令（/help /status /new /stop /steer /models /model /reasoning /presets /preset /workspace(s) /session(s) /menu），能力缺位=降级文案不抛
+- P0 五渠道协议层（净室重实现）：微信 iLink（官方 ClawBot 协议：长轮询/context_token/AES-128-ECB CDN 全链/typing/扫码绑定）、Telegram（Bot API 长轮询+编辑流式+Markdown 回退链）、Discord（Gateway v10+Thread 模型+表格转竖排）、飞书（官方 SDK 长连接+逐步消息）、企业微信智能机器人（长连接 aibot 协议+stream 编辑流式）
+- 审批与交互提问 IM 闭环（once-settle 状态机、发起者限定、fail-closed、5 分钟取消）
+- 图片输入公共层（宿主 capability 元数据判视觉、三重预算、渠道图片下载）
+- 多账号管理：AccountManager（原子文件态、secret 单向入库、暂停/恢复/白名单/诊断）+ 管理 API（requestRejection/Host/Origin/Cookie 三查、零凭据回包）+ client 半账号 CRUD 面板（九语）
+- 门禁四件套：typecheck / 单测 164 项 / dist 冒烟 / hosts:check 单源下发；peer 全枚举 0.1.2-rc.1..0.2.1-rc.1（11 tag）
+
+### Known (intentionally pre-release)
+
+- 各渠道真机 round-trip 验收进行中（T1.10）
+- 飞书流式卡片档/QR 创建机器人、企微原生进度显示、微信设置页扫码 UI 流为后续迭代

package/LICENSE

@@ -0,0 +1,28 @@
+MIT License
+
+Copyright (c) 2026 dsh-im-union contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+This project is a clean-room reimplementation of capabilities popularized by
+xmanrui/dsh-im (MIT) and MichengAI/dsh-im-connect (Apache-2.0). No source code
+was copied from either project; see THIRD_PARTY_NOTICES.md for attribution of
+protocol knowledge and external SDK dependencies.

package/README.en.md

@@ -0,0 +1,26 @@
+# dsh-im-union
+
+A union IM bridge for DeepSeek Harness — a clean-room reimplementation merging the capability sets of xmanrui/dsh-im and MichengAI/dsh-im-connect, with no source copied from either.
+
+<!-- host-compat:begin — generated by scripts/sync-hosts.mjs from scripts/hosts.mjs; DO NOT EDIT -->
+- **Supported DSH hosts:** `0.1.2-rc.1` `0.1.5-rc.1` `0.1.5-rc.2` `0.1.5-rc.3` `0.1.7-rc.1` `0.1.7-rc.2` `0.2.0-rc.1` `0.2.0-rc.2` `0.2.1-alpha.2` `0.2.1-alpha.3` `0.2.1-rc.1` (11 rc/alpha releases across lines 0.1.2 / 0.1.5 / 0.1.7 / 0.2.0 / 0.2.1)
+<!-- host-compat:end -->
+
+## Status
+
+Under development (M0 cross-version skeleton). See `tasks.md` for phasing.
+
+## Install (npm package available after M1)
+
+```sh
+dsh plugin --profile web add dsh-im-union@latest --registry=https://registry.npmjs.org/
+```
+
+## Development
+
+```sh
+npm install
+npm run typecheck
+npm test
+node scripts/sync-hosts.mjs --write
+```

package/README.md

@@ -1,3 +1,26 @@
-# Temporary Holding Version
+# dsh-im-union
+
+DeepSeek Harness 的 IM 联合桥——净室重写，能力合集来自社区两仓（xmanrui/dsh-im 与 MichengAI/dsh-im-connect），不复制其源码。
+
+<!-- host-compat:begin — generated by scripts/sync-hosts.mjs from scripts/hosts.mjs; DO NOT EDIT -->
+- **支持的 DSH 宿主：** `0.1.2-rc.1` `0.1.5-rc.1` `0.1.5-rc.2` `0.1.5-rc.3` `0.1.7-rc.1` `0.1.7-rc.2` `0.2.0-rc.1` `0.2.0-rc.2` `0.2.1-alpha.2` `0.2.1-alpha.3` `0.2.1-rc.1`（覆盖 0.1.2 / 0.1.5 / 0.1.7 / 0.2.0 / 0.2.1 共 11 个 rc/alpha）
+<!-- host-compat:end -->
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+## 状态
+
+开发中（M0 跨版本骨架）。能力分期见根目录 `tasks.md`。
+
+## 安装（M1 后提供 npm 包）
+
+```sh
+dsh plugin --profile web add dsh-im-union@latest --registry=https://registry.npmjs.org/
+```
+
+## 开发
+
+```sh
+npm install
+npm run typecheck
+npm test
+node scripts/sync-hosts.mjs --write   # 宿主版本声明单源下发
+```

package/SECURITY.md

@@ -0,0 +1,20 @@
+# Security policy (dsh-im-union)
+
+不可让渡红线（实现与评审均以此为准）：
+
+1. **凭据存储**：宿主 `ctx.credentials` 为主存储；仅当宿主无该服务时回退到
+   profile 目录下的文件 vault（原子写 tmp+rename、POSIX 0600 / Windows 继承 ACL）。
+   vault 文件损坏时抛错，**绝不覆盖唯一副本**。secret 单向提交给宿主，任何
+   RPC/HTTP 响应与状态接口不回传 token、secret、原始用户标识或内部异常细节。
+2. **管理 API**：`/api/dsh-im-union` 每个请求先过宿主 `connection.requestRejection`
+   （Host/trustedHosts + Origin + 登录 Cookie 三查）；`connection` 服务缺失时返回
+   503，**不降级为匿名可用**。写请求要求 `Content-Type: application/json` +
+   客户端标识头，body 上限 1 MiB；响应携带 `Cache-Control: no-store`。
+3. **工具审批**：审批只在任务发起的原聊天闭环处理；群聊仅接受任务发起者回复；
+   永不回退网页端处理；审批消息发送失败按拒绝处理；5 分钟无回复取消动作；
+   任何路径不自动恢复 allowAllUsers / 开放响应模式。
+4. **入站准入**：先验 userId；私聊白名单为空即拒；群聊仅响应显式 @ 本机器人。
+5. **投递语义**：平台接受 ≠ 已送达（Receipt）；发送结果不确定时不自动重发，
+   宁可漏发不双发。
+
+漏洞报告：仓库 GitHub Security Advisory。

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,27 @@
+# Third-party notices
+
+dsh-im-union is a clean-room reimplementation. No source code is copied from the
+projects below; capability inventory and public protocol knowledge informed
+this design, and the listed upstream SDKs are consumed as external npm
+dependencies only.
+
+## Prior art (capability references, code NOT derived from)
+
+- xmanrui/dsh-im — MIT License. Itself derives some protocol adapters from
+  Tencent/openclaw-weixin (MIT), DingTalk-Real-AI/dingtalk-openclaw-connector,
+  and @wecom/wecom-openclaw-cli (ISC); we re-implement against the same public
+  platform APIs without porting any of that code.
+- MichengAI/dsh-im-connect — Apache License 2.0 (includes the §3 patent grant
+  with retaliation termination; no code ported).
+
+## Runtime npm dependencies (consumed as-is, licenses per their packages)
+
+- @larksuiteoapi/node-sdk (MIT) — Feishu/Lark bot long-connection SDK
+- dingtalk-stream (MIT) — DingTalk Stream mode SDK
+- @wecom/aibot-node-sdk — WeCom intelligent-bot WebSocket SDK
+- @tencent-connect/qqbot-connector — QQ bot QR pairing helper (declared
+  UNLICENSED upstream; used as an external dependency only, never vendored)
+- qrcode (MIT) — QR rendering for scan-to-bind flows
+
+P1/P2 additions will be listed here as they land (Baileys, @matrix-org/olm,
+imapflow/nodemailer, sharp — none are dependencies at M0).