dsh-lark-bot 0.15.3 → 0.15.5

package/README.md

@@ -114,15 +114,14 @@ dsh --profile dsh-lark
 | `/retention [N\|default]` | 查看或设置保留消息条数（超出自动归档）|
 | `/archive [note]`、`/archive list [N]`、`/archive clean` | 手动归档 / 查看 / 清理会话记录|
 | `/density [compact\|standard\|detailed]` | 查看或设置卡片密度|
-| `/model` | 查看当前模型、dsh 默认模型与可用模型列表|
+| `/model`、`/providers`、`/provider`、`/key` | 打开交互式管理卡片（BotFather 式多轮向导；选择用按钮、填写用卡片输入、写入前确认）|
 | `/model use <id>` | 热切换当前会话模型（下一轮生效，无需重启）|
 | `/model default <id>` | 写入 dsh 默认模型 `agent-default-model`（管理员）|
 | `/model add\|remove <provider> <modelId>` | 添加 / 删除 provider 的模型（管理员）|
-| `/providers` | 查看 dsh 已配置 providers、模型与凭据状态|
 | `/provider add\|update\|remove <id>` | 管理 provider（管理员；deepseek-official 与自定义 pi-ai）|
 | `/key set\|remove\|list <引用名>` | 管理 dsh 凭据（set / remove 需管理员）|
 | `/ask <问题>` | 发送问答卡，回答写入会话上下文|
-| `/invite user\|admin\|group <id>`、`/invite list`、`/invite remove user\|group <id>` | 管理访问白名单|
+| `/invite user\|admin\|group <id>`、`/invite list`、`/invite remove user\|group <id>` | 管理访问白名单（写操作需管理员）|
 | `/help` | 查看帮助|
 
 飞书消息中的图片会下载到本地 media 目录并传给 dsh；文本类文件会读取内容并注入任务上下文。
@@ -154,9 +153,19 @@ dsh-lark-bot guardian install --dsh-profile dsh-lark
 
 配置以 dsh 官方方式持久化（与 dsh Web **Settings → Models** 同一存储协议），改动下一请求生效、无需重启：
 
+- **交互式管理卡片**：`/providers`（或 `/provider`、`/model`、`/key`）打开管理卡片，按
+  BotFather 式的多轮向导完成增删改查——能选择的用按钮点选（API 协议、provider、模型、凭据引用），
+  需要填值的用卡片输入（ID、Base URL、模型列表、密钥值），写入前有确认卡，随时可取消。
 - `/model use <id>`：按会话热切换模型（下一轮生效）；`/model default <id>`：写入 dsh 默认模型。
-- `/providers`：查看 provider、模型与凭据状态；`/provider add|update|remove`：管理自定义 provider（需 `--api` / `--base-url` / 至少一个 `--model`，与官方 schema 一致）或 `deepseek-official`。
-- `/key set|remove|list`：读写 `~/.dsh/.credentials.yaml`（0600）；settings 只存 `apiKeyEnv` 引用，字面密钥不进 settings / 聊天记录。
+- `/providers`：查看 provider、模型与凭据状态；`/provider add|update|remove`：管理自定义 provider
+  （需 `--api` / `--base-url` / 至少一个 `--model`，与官方 schema 一致）或 `deepseek-official`。
+- `/key set|remove|list`：读写 `~/.dsh/.credentials.yaml`（0600）；settings 只存 `apiKeyEnv` 引用，
+  字面密钥不进 settings / 聊天记录。
+- **凭据引用必须关联**：`/key set <引用名> <值>` 只写入凭据文件；provider 要生效还须在其
+  `apiKeyEnv` 字段引用同一名字（`/provider add|update ... --api-key-env <引用名>`，或向导中填写）。
+- **热重载**：桥接在每轮运行前把模型解析为「provider + model」路由并传给 dsh runtime；SDK 适配器
+  在路由变化时自动重建 runtime（下一轮生效）。pi-ai 的 Base URL 填根域名（如
+  `https://www.kingapi.xyz`）会自动补全为 `/v1`。
 
 安全提醒：在飞书会话输入密钥会对可见成员暴露，建议私聊使用或 `--api-key-env` 引用环境变量；bot 不在任何回复中回显密钥值。
 

package/README_EN.md

@@ -114,15 +114,14 @@ Send a normal message to the bot in Feishu to get started. Common commands:
 | `/retention [N\|default]` | View or set the live message retention window (overflow is archived) |
 | `/archive [note]`、`/archive list [N]`、`/archive clean` | Archive / list / clean session transcripts |
 | `/density [compact\|standard\|detailed]` | View or set card density |
-| `/model` | View current model, dsh default model and available models |
+| `/model`、`/providers`、`/provider`、`/key` | Open the interactive management hub (BotFather-style multi-turn wizard: tap-button selections, card text inputs, confirm-before-write) |
 | `/model use <id>` | Hot-switch the current session model (effective next message, no restart) |
 | `/model default <id>` | Write the dsh default model `agent-default-model` (admin) |
 | `/model add\|remove <provider> <modelId>` | Add / remove a provider model (admin) |
-| `/providers` | View configured dsh providers, models and credential status |
 | `/provider add\|update\|remove <id>` | Manage providers (admin; deepseek-official and custom pi-ai) |
 | `/key set\|remove\|list <ref>` | Manage dsh credentials (set / remove require admin) |
 | `/ask <question>` | Send a Q&A card; the answer is written back to session context |
-| `/invite user\|admin\|group <id>`、`/invite list`、`/invite remove user\|group <id>` | Manage the access allowlist |
+| `/invite user\|admin\|group <id>`、`/invite list`、`/invite remove user\|group <id>` | Manage the access allowlist (mutating commands require admin) |
 | `/help` | Show help |
 
 Images in Feishu messages are downloaded to the local media directory and passed to dsh; text files are read and their content is injected into the task context.
@@ -155,9 +154,17 @@ Skip it with `setup --no-guardian`; remove it later with `dsh-lark-bot guardian
 
 Configuration is persisted the official dsh way (the same storage protocol as the dsh Web **Settings → Models** page); changes take effect on the next request without restarting the bot:
 
+- **Interactive management hub**: `/providers` (or bare `/provider`, `/model`, `/key`) opens a
+  management card. BotFather-style multi-turn wizards cover add/update/remove flows — pick
+  options (API protocol, provider, model, credential ref) with buttons, type values (ID, Base URL,
+  model list, key value) into card inputs, review on a confirm card, and cancel any time.
 - `/model use <id>`: hot-switch the model for this session (effective next message); `/model default <id>`: write the dsh default model.
 - `/providers`: show providers, models and credential status; `/provider add|update|remove`: manage custom providers (needs `--api` / `--base-url` / at least one `--model`, matching the official schema) or `deepseek-official`.
 - `/key set|remove|list`: read / write `~/.dsh/.credentials.yaml` (0600); settings keep only `apiKeyEnv` references — literal keys never enter settings or chat history.
+- **Hot reload**: before each run the bridge resolves the model into a `provider + model` route and
+  passes it to the dsh runtime; the SDK adapter re-spawns the runtime automatically when the route
+  changes (effective on the next message). A bare pi-ai Base URL (e.g. `https://www.kingapi.xyz`)
+  is completed with `/v1` automatically.
 
 Security note: typing a key in a Feishu conversation exposes it to everyone who can see that chat; prefer private chats or `--api-key-env` references to environment variables. The bot never echoes key values in any reply.
 

package/SECURITY.md

@@ -47,9 +47,11 @@
    `DEFAULT_DENIED_INTERACTIVE_TOOLS` 提供工具级黑名单。
 8. **审批**：ACP 模式下敏感操作通过 `session/request_permission` 以飞书审批卡一问一答；
    run 结束 / dispose 时所有挂起审批卡结算为拒绝（`src/bot/approvals.ts`）。
-9. **管理操作鉴权**：飞书会话内对 dsh 配置的写操作（`/model default`、`/model add|remove`、
-   `/provider add|update|remove`、`/key set|remove`）仅管理员可执行（管理员由
-   `/invite admin <open_id>` 定义）；查看类命令（`/model`、`/providers`、`/key list`）开放。
+9. **管理操作鉴权**：飞书会话内对 dsh 配置与访问白名单的写操作（`/model default`、
+   `/model add|remove`、`/provider add|update|remove`、`/key set|remove`、`/invite user|admin|group`
+   与 `/invite remove …`）仅管理员可执行；首个扫码绑定的 operator 自动成为管理员，之后由现有
+   管理员经 `/invite admin <open_id>` 添加（`/invite list` 为只读、开放）。查看类命令
+   （`/model`、`/providers`、`/key list`）开放。
 10. **本地回调隔离**：`lark_notify` 工具的回调服务只绑定 `127.0.0.1`，每次启动生成随机
     token 鉴权（不落盘、不进日志），请求体限 1MB；`/notify` 与角色 / 配置写命令同为管理员操作。
 11. **安全网守护（默认随 `setup` 安装）**：