dsh-lark-bot 0.19.13 → 0.19.15

package/dist/cli.js

@@ -6190,7 +6190,7 @@ async function runDoctor(options) {
 
 // src/cli/commands/run.ts
 import { mkdir as mkdir22 } from "fs/promises";
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 import { join as join27 } from "path";
 
 // src/bot/active-runs.ts
@@ -11061,7 +11061,7 @@ async function usage(ctx) {
 
 // src/notify/sinks/channel-store.ts
 import { readFile as readFile23 } from "fs/promises";
-var SINK_TYPES = ["telegram", "wecom"];
+var SINK_TYPES = ["telegram", "wecom", "wechat", "qq"];
 var NotificationChannelStore = class {
   constructor(path) {
     this.path = path;
@@ -11142,7 +11142,8 @@ function normalizeChannel(id, value) {
   if (!value || typeof value !== "object" || !id.trim()) return void 0;
   const input = value;
   const type = input.type;
-  if (type !== "telegram" && type !== "wecom") return void 0;
+  if (typeof type !== "string" || !SINK_TYPES.includes(type)) return void 0;
+  const normalizedType = type;
   const label2 = typeof input.label === "string" ? input.label.trim() : "";
   const destination = typeof input.destination === "string" ? input.destination.trim() : "";
   const secret = typeof input.secret === "string" ? input.secret.trim() : "";
@@ -11155,7 +11156,7 @@ function normalizeChannel(id, value) {
   }
   return {
     id: id.trim(),
-    type,
+    type: normalizedType,
     label: label2,
     destination,
     secret,
@@ -11177,7 +11178,307 @@ function maskSecret(value) {
   return `${value.slice(0, 3)}\u2026${value.slice(-3)}`;
 }
 
+// src/onboard/sink-qr.ts
+var SinkQrRegistry = class {
+  constructor(providers = []) {
+    this.providers = providers;
+  }
+  providers;
+  forType(type) {
+    return this.providers.find((provider) => provider.type === type);
+  }
+  has(type) {
+    return this.forType(type) !== void 0;
+  }
+  supportedTypes() {
+    return this.providers.map((provider) => provider.type);
+  }
+};
+async function pollUntilCompleted(provider, sessionId, options = {}) {
+  const interval = options.intervalMs ?? 3e3;
+  const timeout = options.timeoutMs ?? 9e4;
+  const signal = options.signal;
+  const deadline = Date.now() + timeout;
+  let last = { phase: "pending" };
+  while (Date.now() < deadline) {
+    if (signal?.aborted) return { phase: "failed", error: "aborted" };
+    last = await provider.poll(sessionId, signal);
+    if (last.phase !== "pending") return last;
+    await sleep3(interval, signal);
+  }
+  return { phase: "expired" };
+}
+function sleep3(ms, signal) {
+  return new Promise((resolve6, reject) => {
+    if (signal?.aborted) return reject(abortError());
+    const timer = setTimeout(resolve6, ms);
+    timer.unref?.();
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        reject(abortError());
+      },
+      { once: true }
+    );
+  });
+}
+function abortError() {
+  const error = new Error("aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+// src/onboard/sink-qr-providers.ts
+import { createDecipheriv, randomBytes as randomBytes2, randomUUID as randomUUID8 } from "crypto";
+
+// src/notify/sinks/text.ts
+function renderSinkText(message) {
+  const zhLine = `${message.title.zh}\uFF08scope \`${message.scope}\`\uFF09${message.detail ? `\uFF1A${message.detail}` : ""}`;
+  const enLine = `${message.title.en} (scope \`${message.scope}\`)${message.detail ? `: ${message.detail}` : ""}`;
+  return `${stripMarkdown(zhLine)}
+
+${stripMarkdown(enLine)}`;
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function stripMarkdown(value) {
+  return value.replaceAll("`", "").replaceAll("**", "").replaceAll("*", "");
+}
+
+// src/notify/sinks/wechat.ts
+var WeChatIlinkSink = class {
+  constructor(baseUrl = "https://ilinkai.weixin.qq.com", randomUin = () => String(Math.floor(Math.random() * 1e9))) {
+    this.baseUrl = baseUrl;
+    this.randomUin = randomUin;
+  }
+  baseUrl;
+  randomUin;
+  type = "wechat";
+  async send(channel, message) {
+    const token = channel.secret;
+    const [toUserId, contextToken] = splitDestination(channel.destination);
+    if (!token || !toUserId || !contextToken) {
+      log.warn("sink:wechat", "missing-credential", { channel: channel.id });
+      return false;
+    }
+    const url = `${this.baseUrl}/ilink/bot/sendmessage`;
+    const body3 = JSON.stringify({
+      msg: {
+        from_user_id: "",
+        to_user_id: toUserId,
+        client_id: "",
+        message_type: 2,
+        message_state: 2,
+        item_list: [{ type: 1, text_item: { text: renderSinkText(message) } }],
+        context_token: contextToken
+      },
+      base_info: { channel_version: 1 }
+    });
+    const headers = {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`,
+      AuthorizationType: "ilink_bot_token",
+      "X-WECHAT-UIN": this.randomUin(),
+      "iLink-App-Id": "bot",
+      "iLink-App-ClientVersion": "131072"
+    };
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 1e4);
+      timer.unref?.();
+      const response = await fetch(url, { method: "POST", headers, body: body3, signal: controller.signal });
+      clearTimeout(timer);
+      const payload = await response.json().catch(() => ({}));
+      const ok = response.ok && (payload.ret === 0 || payload.ret === void 0);
+      if (!ok) {
+        log.warn("sink:wechat", "send-failed", {
+          channel: channel.id,
+          error: payload.msg ?? payload.errmsg ?? `http ${response.status}`
+        });
+        return false;
+      }
+      return true;
+    } catch (error) {
+      log.warn("sink:wechat", "send-error", { channel: channel.id, error });
+      return false;
+    }
+  }
+};
+function splitDestination(value) {
+  const sep3 = value.indexOf("|");
+  if (sep3 === -1) return [value, ""];
+  return [value.slice(0, sep3), value.slice(sep3 + 1)];
+}
+
+// src/onboard/sink-qr-providers.ts
+var API_HEADERS = { "content-type": "application/json", accept: "application/json" };
+var BIND_STATUS = { NONE: 0, PENDING: 1, COMPLETED: 2, EXPIRED: 3 };
+var QqQrProvider = class {
+  constructor(portalHost = process.env.DSH_LARK_QQ_PORTAL_HOST ?? "q.qq.com", fetchImpl = fetch, genKey = () => randomBytes2(32).toString("base64")) {
+    this.portalHost = portalHost;
+    this.fetchImpl = fetchImpl;
+    this.genKey = genKey;
+  }
+  portalHost;
+  fetchImpl;
+  genKey;
+  type = "qq";
+  sessions = /* @__PURE__ */ new Map();
+  async begin(_options) {
+    const aesKey = this.genKey();
+    const response = await this.fetchImpl(`https://${this.portalHost}/lite/create_bind_task`, {
+      method: "POST",
+      headers: API_HEADERS,
+      body: JSON.stringify({ key: aesKey })
+    });
+    const payload = await response.json().catch(() => ({}));
+    const taskId = payload.data?.task_id;
+    if (!response.ok || !taskId || payload.retcode !== void 0 && payload.retcode !== 0) {
+      throw new Error(`qq create_bind_task failed: ${payload.msg ?? ""} (http ${response.status})`);
+    }
+    const sessionId = randomUUID8();
+    this.sessions.set(sessionId, { taskId, aesKey });
+    const qrUrl = `https://q.qq.com/qqbot/openclaw/connect.html?task_id=${encodeURIComponent(taskId)}&_wv=2&source=dsh-lark-bot`;
+    return { providerType: this.type, sessionId, qrUrl, expireIn: 600 };
+  }
+  async poll(sessionId, _signal) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return { phase: "failed", error: "unknown session" };
+    let data = {};
+    try {
+      const response = await this.fetchImpl(`https://${this.portalHost}/lite/poll_bind_result`, {
+        method: "POST",
+        headers: API_HEADERS,
+        body: JSON.stringify({ task_id: state.taskId })
+      });
+      const payload = await response.json();
+      if (!response.ok || payload.retcode !== void 0 && payload.retcode !== 0) return { phase: "pending" };
+      data = payload.data ?? {};
+    } catch {
+      return { phase: "pending" };
+    }
+    const status = data.status ?? BIND_STATUS.NONE;
+    if (status === BIND_STATUS.COMPLETED && data.bot_appid && data.bot_encrypt_secret) {
+      let clientSecret;
+      try {
+        clientSecret = decryptSecret(data.bot_encrypt_secret, state.aesKey);
+      } catch (error) {
+        this.sessions.delete(sessionId);
+        return { phase: "failed", error: `decrypt failed: ${error instanceof Error ? error.message : String(error)}` };
+      }
+      const target = data.user_openid ? `user:${data.user_openid}` : "";
+      this.sessions.delete(sessionId);
+      return {
+        phase: "completed",
+        channel: {
+          id: "",
+          type: "qq",
+          label: "QQ",
+          destination: target,
+          secret: `${data.bot_appid}:${clientSecret}`
+        }
+      };
+    }
+    if (status === BIND_STATUS.EXPIRED) {
+      this.sessions.delete(sessionId);
+      return { phase: "expired" };
+    }
+    return { phase: "pending" };
+  }
+};
+var WeChatQrProvider = class {
+  constructor(baseUrl = process.env.DSH_LARK_WECHAT_ILINK_URL ?? "https://ilinkai.weixin.qq.com", fetchImpl = fetch) {
+    this.baseUrl = baseUrl;
+    this.fetchImpl = fetchImpl;
+  }
+  baseUrl;
+  fetchImpl;
+  type = "wechat";
+  sessions = /* @__PURE__ */ new Map();
+  async begin(_options) {
+    const response = await this.fetchImpl(`${this.baseUrl}/ilink/bot/get_bot_qrcode?bot_type=3`, {
+      method: "GET"
+    });
+    const payload = await response.json().catch(() => ({}));
+    const qrcode2 = payload.qrcode ?? payload.url ?? "";
+    if (!response.ok || !qrcode2) {
+      throw new Error(payload.msg ?? `wechat get_bot_qrcode failed: http ${response.status}`);
+    }
+    const sessionId = randomUUID8();
+    this.sessions.set(sessionId, { qrcode: qrcode2 });
+    return { providerType: this.type, sessionId, qrUrl: qrcode2, expireIn: 180 };
+  }
+  async poll(sessionId, _signal) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return { phase: "failed", error: "unknown session" };
+    const statusUrl = `${this.baseUrl}/ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(state.qrcode)}`;
+    try {
+      const response = await this.fetchImpl(statusUrl, {
+        method: "GET",
+        headers: { "iLink-App-Id": "bot", "iLink-App-ClientVersion": "131072" }
+      });
+      const payload = await response.json().catch(() => ({}));
+      const status = String(payload.status ?? "wait").toLowerCase();
+      if (status === "confirmed" || status === "success" || status === "scanned" || status === "2") {
+        const token = payload.token ?? payload.access_token ?? "";
+        const userId = payload.openid ?? payload.user_id ?? payload.to_user_id ?? "";
+        this.sessions.delete(sessionId);
+        return {
+          phase: "completed",
+          channel: { id: "", type: "wechat", label: "\u5FAE\u4FE1", destination: userId ? `${userId}|` : "", secret: token }
+        };
+      }
+      if (status === "expired") {
+        this.sessions.delete(sessionId);
+        return { phase: "expired" };
+      }
+      return { phase: "pending" };
+    } catch {
+      return { phase: "pending" };
+    }
+  }
+};
+function buildSinkQrProviders() {
+  return [new WeChatQrProvider(), new QqQrProvider()];
+}
+function coerceSinkQrChannel(input) {
+  const destination = input.type === "wechat" ? normalizeWechatDestination(input.destination) : input.destination;
+  return { id: input.id, type: input.type, label: input.label, destination, secret: input.secret };
+}
+function normalizeWechatDestination(value) {
+  if (value.includes("|")) return value;
+  const [id] = splitDestination(value);
+  return id ? `${id}|` : value;
+}
+function decryptSecret(encryptedBase64, keyBase64) {
+  const key = Buffer.from(keyBase64, "base64");
+  const raw = Buffer.from(encryptedBase64, "base64");
+  if (key.length !== 32) throw new Error("bind key must be 32 bytes");
+  if (raw.length < 12 + 16) throw new Error("ciphertext too short");
+  const iv = raw.subarray(0, 12);
+  const body3 = raw.subarray(12);
+  const tag = body3.subarray(body3.length - 16);
+  const ciphertext = body3.subarray(0, body3.length - 16);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+
+// src/onboard/qr-image.ts
+import { toBuffer } from "qrcode";
+async function renderQrPng(value, options = {}) {
+  return toBuffer(value, {
+    type: "png",
+    width: options.width ?? 400,
+    margin: options.margin ?? 2,
+    errorCorrectionLevel: "M"
+  });
+}
+
 // src/commands/channels.ts
+var QR_REGISTRY = new SinkQrRegistry(buildSinkQrProviders());
 async function reply6(ctx, zh, en) {
   await ctx.channel.sendMarkdown(ctx.chatId, bilingualMarkdown(zh, en), { replyTo: ctx.messageId });
 }
@@ -11206,6 +11507,8 @@ async function handleChannels(args, ctx) {
     }
     case "add":
       return addChannel(ctx, store, rest.join(" "));
+    case "accept":
+      return acceptChannel(ctx, store, rest.join(" "));
     case "remove": {
       const id = rest[0];
       if (!id) return usage2(ctx);
@@ -11250,6 +11553,7 @@ async function showChannel(ctx, channel) {
   await reply6(ctx, zh, en);
 }
 async function addChannel(ctx, store, raw) {
+  if (raw.trim().startsWith("--qr")) return addChannelByQr(ctx, store, raw.trim());
   const parsed = parseAddArgs(raw);
   if (!parsed || !parsed.type || !parsed.label || !parsed.destination || !parsed.secret) {
     await usage2(ctx);
@@ -11275,14 +11579,116 @@ async function addChannel(ctx, store, raw) {
   await store.add(channel);
   await reply6(ctx, `\u5DF2\u6DFB\u52A0\u901A\u77E5\u6E20\u9053 ${maskChannel(channel)}\u3002`, `Added notification channel ${maskChannel(channel)}.`);
 }
+function platformName(type) {
+  const names = {
+    telegram: "Telegram",
+    wecom: "\u4F01\u4E1A\u5FAE\u4FE1",
+    wechat: "\u5FAE\u4FE1",
+    qq: "QQ"
+  };
+  return names[type] ?? type;
+}
+async function addChannelByQr(ctx, store, raw) {
+  const parsed = parseQrArgs(raw);
+  const type = parsed.type;
+  if (!type) {
+    await reply6(ctx, "\u7528\u6CD5\uFF1A`/channels add --qr <wechat|qq|telegram> [--id <id>] [--label <label>]`", "Usage: `/channels add --qr <wechat|qq|telegram> [--id <id>] [--label <label>]`");
+    return;
+  }
+  if (!SINK_TYPES.includes(type)) {
+    await reply6(ctx, `\u4E0D\u652F\u6301\u7684\u6E20\u9053\u7C7B\u578B\uFF1A\`${type}\`\u3002\u53EF\u7528\uFF1A\`${SINK_TYPES.join("|")}\`\u3002`, `Unsupported channel type: \`${type}\`. Available: \`${SINK_TYPES.join("|")}\`.`);
+    return;
+  }
+  const provider = QR_REGISTRY.forType(type);
+  if (!provider) {
+    await reply6(ctx, `\`${type}\` \u6682\u65E0\u626B\u7801\u7ED1\u5B9A\u652F\u6301\uFF0C\u8BF7\u6539\u7528 \`/channels add ${type} <label> --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>\`\u3002`, `\`${type}\` has no QR binding yet. Use \`/channels add ${type} <label> --destination <target> --secret <token>\` instead.`);
+    return;
+  }
+  const id = parsed.id ?? `${type}-qr-${slugify2(parsed.label ?? platformName(type))}`;
+  if (store.get(id)) {
+    await reply6(ctx, `\u901A\u77E5\u6E20\u9053 \`${id}\` \u5DF2\u5B58\u5728\u3002\u7528 \`/channels remove ${id}\` \u5220\u9664\u540E\u91CD\u5EFA\u3002`, `Notification channel \`${id}\` already exists. Use \`/channels remove ${id}\` to recreate it.`);
+    return;
+  }
+  let session;
+  try {
+    session = await provider.begin({ id, label: parsed.label ?? platformName(type) });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    await reply6(
+      ctx,
+      `\u65E0\u6CD5\u53D1\u8D77 ${platformName(type)} \u626B\u7801\u7ED1\u5B9A\uFF1A${message}\u3002\u8BF7\u6539\u7528\u624B\u52A8\u65B9\u5F0F \`/channels add ${type} <label> --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>\`\u3002`,
+      `Could not start a ${platformName(type)} QR bind: ${message}. Use manual entry \`/channels add ${type} <label> --destination <target> --secret <token>\` instead.`
+    );
+    return;
+  }
+  const png = await renderQrPng(session.qrUrl);
+  const minutes = Math.max(1, Math.round(session.expireIn / 60));
+  const introZh = `${platformName(type)}\u626B\u7801\u7ED1\u5B9A\uFF1A\u8BF7\u7528\u300C${platformName(type)}\u300DApp \u626B\u63CF\u4E0B\u65B9\u4E8C\u7EF4\u7801\u521B\u5EFA / \u7ED1\u5B9A\u901A\u77E5\u4F1A\u8BDD\uFF0C\u4E8C\u7EF4\u7801\u7EA6 ${minutes} \u5206\u949F\u6709\u6548\u3002\u626B\u7801\u540E\u7B49\u5F85\u81EA\u52A8\u5B8C\u6210\uFF0C\u6216\u8D85\u65F6\u540E\u7528 \`/channels accept ${type} ${id} ${parsed.label ?? platformName(type)} <\u76EE\u6807> <\u5BC6\u94A5>\`\u3002`;
+  const introEn = `${platformName(type)} QR bind: scan the code below with the ${platformName(type)} app to create / bind the notification session. It stays valid for about ${minutes} minute(s). After scanning it auto-completes, or use \`/channels accept ${type} ${id} ${parsed.label ?? platformName(type)} <target> <token>\` on timeout.`;
+  if (typeof ctx.channel.sendImage === "function") {
+    await ctx.channel.sendImage(ctx.chatId, png, { replyTo: ctx.messageId });
+  } else {
+    await reply6(ctx, `\u5F53\u524D\u8FD0\u884C\u73AF\u5883\u4E0D\u652F\u6301\u53D1\u9001\u56FE\u7247\uFF0C\u8BF7\u6D4F\u89C8\u5668\u6253\u5F00\uFF1A${session.qrUrl}`, `Image sending is unavailable here; open in a browser: ${session.qrUrl}`);
+  }
+  await reply6(ctx, introZh, introEn);
+  const result = await pollUntilCompleted(provider, session.sessionId, { timeoutMs: 9e4 });
+  if (result.phase === "completed" && result.channel) {
+    const channel = {
+      ...coerceSinkQrChannel({
+        id,
+        type,
+        label: result.channel.label || parsed.label || platformName(type),
+        destination: result.channel.destination,
+        secret: result.channel.secret
+      }),
+      enabled: true
+    };
+    await store.add(channel);
+    await reply6(ctx, `\u2705 \u5DF2\u7ED1\u5B9A\u5E76\u6DFB\u52A0\u901A\u77E5\u6E20\u9053 ${maskChannel(channel)}\u3002`, `\u2705 Bound and added notification channel ${maskChannel(channel)}.`);
+    return;
+  }
+  const reason = result.phase === "expired" ? "\u4E8C\u7EF4\u7801\u5DF2\u8FC7\u671F" : result.error ?? "\u672A\u5728\u7B49\u5F85\u65F6\u95F4\u5185\u5B8C\u6210";
+  await reply6(
+    ctx,
+    `\u672A\u5B8C\u6210${platformName(type)}\u626B\u7801\u7ED1\u5B9A\uFF08${reason}\uFF09\u3002\u8BF7\u91CD\u65B0\u7528 \`/channels add --qr ${type}\` \u53D1\u8D77\uFF0C\u6216\u624B\u52A8\u586B \`/channels add ${type} <label> --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>\`\u3002`,
+    `${platformName(type)} QR bind did not complete (${reason}). Retry \`/channels add --qr ${type}\`, or enter it manually with \`/channels add ${type} <label> --destination <target> --secret <token>\`.`
+  );
+}
+async function acceptChannel(ctx, store, raw) {
+  const [type, id, label2, destination, secret] = raw.trim().split(/\s+/);
+  if (!type || !id || !label2 || !destination || !secret || !SINK_TYPES.includes(type)) {
+    await reply6(ctx, "\u7528\u6CD5\uFF1A`/channels accept <type> <id> <label> <destination> <secret>`", "Usage: `/channels accept <type> <id> <label> <destination> <secret>`");
+    return;
+  }
+  if (store.get(id)) {
+    await reply6(ctx, `\u901A\u77E5\u6E20\u9053 \`${id}\` \u5DF2\u5B58\u5728\u3002\u7528 \`/channels remove ${id}\` \u5220\u9664\u540E\u91CD\u5EFA\u3002`, `Notification channel \`${id}\` already exists. Remove it first.`);
+    return;
+  }
+  const channel = {
+    ...coerceSinkQrChannel({ id, type, label: label2, destination, secret }),
+    enabled: true
+  };
+  await store.add(channel);
+  await reply6(ctx, `\u5DF2\u6DFB\u52A0\u901A\u77E5\u6E20\u9053 ${maskChannel(channel)}\u3002`, `Added notification channel ${maskChannel(channel)}.`);
+}
+function parseQrArgs(raw) {
+  const typeMatch = raw.match(/--qr\s+(\S+)/);
+  const idMatch = raw.match(/--id\s+(\S+)/);
+  const labelMatch = raw.match(/--label\s+(.+?)(?:\s--|\s*$)/);
+  return {
+    ...typeMatch ? { type: typeMatch[1] } : {},
+    ...idMatch ? { id: idMatch[1] } : {},
+    ...labelMatch ? { label: labelMatch[1].trim() } : {}
+  };
+}
 async function notFound(ctx, id) {
   await reply6(ctx, `\u672A\u627E\u5230\u901A\u77E5\u6E20\u9053 \`${id}\`\u3002\u7528 \`/channels list\` \u67E5\u770B\u3002`, `Unknown notification channel \`${id}\`. Use \`/channels list\`.`);
 }
 async function usage2(ctx) {
   await reply6(
     ctx,
-    "\u7528\u6CD5\uFF1A`/channels list|show <id>|add <telegram|wecom> <label> [--id <id>] --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>|remove <id>|enable <id>|disable <id>`",
-    "Usage: `/channels list|show <id>|add <telegram|wecom> <label> [--id <id>] --destination <target> --secret <token>|remove <id>|enable <id>|disable <id>`"
+    "\u7528\u6CD5\uFF1A`/channels list|show <id>|add --qr <wechat|qq|telegram> [--id <id>] [--label <label>]|add <type> <label> [--id <id>] --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>|accept <type> <id> <label> <destination> <secret>|remove <id>|enable <id>|disable <id>`",
+    "Usage: `/channels list|show <id>|add --qr <wechat|qq|telegram> [--id <id>] [--label <label>]|add <type> <label> [--id <id>] --destination <target> --secret <token>|accept <type> <id> <label> <destination> <secret>|remove <id>|enable <id>|disable <id>`"
   );
 }
 function parseAddArgs(raw) {
@@ -12856,6 +13262,13 @@ function adaptLarkChannel(channel) {
         { file: { source: content, fileName } },
         toLarkSendOptions(options)
       );
+    },
+    async sendImage(chatId, content, options) {
+      await channel.send(
+        chatId,
+        { image: { source: content } },
+        toLarkSendOptions(options)
+      );
     }
   };
   return {
@@ -13300,7 +13713,7 @@ function safe(value, maxBytes) {
 }
 
 // src/session/projection-protocol.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var WebSessionProjectionSource = class {
   constructor(transport) {
     this.transport = transport;
@@ -13339,7 +13752,7 @@ var WebSessionProjectionSource = class {
     });
     return { events, hasMore: value.hasMore === true };
   }
-  async prompt(sessionId, text, rpcId = randomUUID8()) {
+  async prompt(sessionId, text, rpcId = randomUUID9()) {
     responseValue(await this.transport.rpc("session.prompt", {
       sessionId,
       mode: "queue",
@@ -14012,7 +14425,7 @@ function wait(ms) {
 }
 
 // src/commands/session-projection.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var SessionProjectionController = class {
   constructor(deps) {
     this.deps = deps;
@@ -14152,7 +14565,7 @@ workspace: \`${workspaceCwd}\``
     if (owner && owner.scope !== input.identity.scope && !this.deps.access.isAdmin(input.identity.actorId)) {
       throw new Error("\u8BE5 session \u5DF2\u7ED1\u5B9A\u5176\u4ED6\u98DE\u4E66 scope\uFF1B\u72EC\u5360\u8FC1\u79FB\u4EC5 profile \u7BA1\u7406\u5458\u53EF\u786E\u8BA4");
     }
-    const nonce = randomUUID9();
+    const nonce = randomUUID10();
     const expiresAt = Date.now() + (this.deps.confirmationTtlMs ?? 10 * 6e4);
     const timer = setTimeout(() => this.pending.delete(nonce), expiresAt - Date.now());
     timer.unref?.();
@@ -15177,13 +15590,19 @@ function attachRunCardAnchors(channel, anchors) {
       const result = await channel.sendFile(chatId, fileName, content, options);
       notify(chatId);
       return result;
+    },
+    async sendImage(chatId, content, options) {
+      if (typeof channel.sendImage !== "function") return void 0;
+      const result = await channel.sendImage(chatId, content, options);
+      notify(chatId);
+      return result;
     }
   };
 }
 
 // src/notify/server.ts
 import { createServer } from "http";
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 var NotifyServer = class {
   server;
   token;
@@ -15470,7 +15889,7 @@ function readBody(req) {
   });
 }
 function generateNotifyToken() {
-  return `dsh-lark-${randomBytes2(18).toString("hex")}`;
+  return `dsh-lark-${randomBytes3(18).toString("hex")}`;
 }
 
 // src/notify/ask-handler.ts
@@ -15662,7 +16081,7 @@ async function settleCancelledCard(deps, chatId, cardMessageId, options) {
 }
 
 // src/notify/approval-handler.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 init_tool_policy();
 function buildApprovalHandler(deps) {
   return async (payload, signal) => {
@@ -15705,7 +16124,7 @@ ${policyDenialText(denial)}
       return { ok: true, outcome: "rejected", denial };
     }
     if (payload.lowRisk) return { ok: true, outcome: "allowed-once" };
-    const id = `approval-${randomUUID10().replaceAll("-", "")}`;
+    const id = `approval-${randomUUID11().replaceAll("-", "")}`;
     const request = {
       id,
       ...payload.callId === void 0 ? {} : { callId: payload.callId },
@@ -15949,21 +16368,6 @@ async function postJson(url, body3) {
   }
 }
 
-// src/notify/sinks/text.ts
-function renderSinkText(message) {
-  const zhLine = `${message.title.zh}\uFF08scope \`${message.scope}\`\uFF09${message.detail ? `\uFF1A${message.detail}` : ""}`;
-  const enLine = `${message.title.en} (scope \`${message.scope}\`)${message.detail ? `: ${message.detail}` : ""}`;
-  return `${stripMarkdown(zhLine)}
-
-${stripMarkdown(enLine)}`;
-}
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-}
-function stripMarkdown(value) {
-  return value.replaceAll("`", "").replaceAll("**", "").replaceAll("*", "");
-}
-
 // src/notify/sinks/telegram.ts
 var TelegramSink = class {
   constructor(baseUrl = "https://api.telegram.org") {
@@ -16038,9 +16442,72 @@ var WeComSink = class {
   }
 };
 
+// src/notify/sinks/qq.ts
+var QqSink = class {
+  constructor(apiBase = "https://api.sgroup.qq.com", fetchAccessToken = getAppAccessToken) {
+    this.apiBase = apiBase;
+    this.fetchAccessToken = fetchAccessToken;
+  }
+  apiBase;
+  fetchAccessToken;
+  type = "qq";
+  async send(channel, message) {
+    const [appId, clientSecret] = splitAppCredential(channel.secret);
+    const target = channel.destination;
+    if (!appId || !clientSecret || !target) {
+      log.warn("sink:qq", "missing-credential", { channel: channel.id });
+      return false;
+    }
+    const isC2c = target.startsWith("user:");
+    const openId = isC2c ? target.slice("user:".length) : target;
+    const url = `${this.apiBase}/v2/${isC2c ? "users" : "groups"}/${encodeURIComponent(openId)}/messages`;
+    try {
+      const token = await this.fetchAccessToken(appId, clientSecret);
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 1e4);
+      timer.unref?.();
+      const response = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+        body: JSON.stringify({ content: renderSinkText(message), msg_type: 0 }),
+        signal: controller.signal
+      });
+      clearTimeout(timer);
+      const payload = await response.json().catch(() => ({}));
+      if (!response.ok || payload.code !== void 0 && payload.code !== 0) {
+        log.warn("sink:qq", "send-failed", {
+          channel: channel.id,
+          error: payload.message ?? `http ${response.status}`
+        });
+        return false;
+      }
+      return true;
+    } catch (error) {
+      log.warn("sink:qq", "send-error", { channel: channel.id, error });
+      return false;
+    }
+  }
+};
+function splitAppCredential(value) {
+  const sep3 = value.indexOf(":");
+  if (sep3 === -1) return [value, ""];
+  return [value.slice(0, sep3), value.slice(sep3 + 1)];
+}
+async function getAppAccessToken(appId, clientSecret) {
+  const response = await postJson(
+    "https://bots.qq.com/app/getAppAccessToken",
+    JSON.stringify({ appId, clientSecret })
+  );
+  const payload = await response.json();
+  if (!response.ok || !payload.access_token) {
+    throw new Error(payload.message ?? `access token http ${response.status}`);
+  }
+  return payload.access_token;
+}
+
 // src/notify/sinks/registry.ts
 var OutboundSinkRegistry = class {
-  constructor(store, sinks = [new TelegramSink(), new WeComSink()]) {
+  constructor(store, sinks = [new TelegramSink(), new WeComSink(), new WeChatIlinkSink(), new QqSink()]) {
     this.store = store;
     this.sinks = sinks;
   }
@@ -16665,7 +17132,7 @@ function normalizeContextSnapshot(value) {
 
 // src/session/projection-store.ts
 import { readFile as readFile26 } from "fs/promises";
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 var MAX_RECENT_MESSAGES = 64;
 var MAX_PROMPT_CORRELATIONS = 64;
 var PROMPT_CORRELATION_TTL_MS = 24 * 60 * 6e4;
@@ -16732,7 +17199,7 @@ var SessionProjectionStore = class {
         recentMessages: currentOwner?.scope === input.scope && currentOwner.workspaceCwd === input.workspaceCwd ? structuredClone(currentOwner.recentMessages) : [],
         promptCorrelations: structuredClone(currentOwner?.promptCorrelations ?? []),
         boundAt: (/* @__PURE__ */ new Date()).toISOString(),
-        generationId: randomUUID11()
+        generationId: randomUUID12()
       };
       this.data.bindings[targetKey] = binding;
       return {
@@ -16889,7 +17356,7 @@ function normalizeCorrelation(value) {
 
 // src/session/archive.ts
 import { execFile as execFile2 } from "child_process";
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 import { access, mkdir as mkdir17, readdir as readdir3, readFile as readFile27, unlink, writeFile as writeFile8 } from "fs/promises";
 import { join as join24 } from "path";
 import { promisify } from "util";
@@ -16900,7 +17367,7 @@ function archiveScopeSlug(scope) {
 }
 function timestampId() {
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
-  return `${stamp}-${randomBytes3(3).toString("hex")}`;
+  return `${stamp}-${randomBytes4(3).toString("hex")}`;
 }
 function renderMarkdown(input, record) {
   const lines = [
@@ -17214,7 +17681,7 @@ async function safeRemove(path) {
 
 // src/workspace/git-worktree.ts
 import { execFile as execFile3 } from "child_process";
-import { createHash as createHash2, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes5 } from "crypto";
 import { access as access2, copyFile, mkdir as mkdir18, realpath as realpath2 } from "fs/promises";
 import { dirname as dirname16, join as join25 } from "path";
 import { promisify as promisify2 } from "util";
@@ -17275,7 +17742,7 @@ var GitWorktreeManager = class {
         return { cwd: target, created: false };
       }
     }
-    const branch = `dsh-lark/${slug}-${Date.now().toString(36)}-${randomBytes4(3).toString("hex")}`;
+    const branch = `dsh-lark/${slug}-${Date.now().toString(36)}-${randomBytes5(3).toString("hex")}`;
     await mkdir18(this.options.worktreesRoot, { recursive: true });
     await this.runGit(["worktree", "add", "-b", branch, target, "HEAD"], base);
     await this.ensureProjectRules(base, target);
@@ -18259,7 +18726,7 @@ function projectDiagnosticLogs(lines) {
 }
 
 // src/secret/registry.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 var SecretRequestRegistry = class {
   constructor(writer, options = {}) {
     this.writer = writer;
@@ -18272,7 +18739,7 @@ var SecretRequestRegistry = class {
   now;
   register(input) {
     this.writer.validate(input.target, input.reference);
-    const id = `secret-${randomUUID12().replaceAll("-", "")}`;
+    const id = `secret-${randomUUID13().replaceAll("-", "")}`;
     let resolve6;
     const promise = new Promise((settle) => {
       resolve6 = settle;
@@ -18422,7 +18889,7 @@ function buildSecretHandler(deps) {
 init_own_package();
 
 // src/guardian/update-handoff.ts
-import { createHash as createHash3, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID14 } from "crypto";
 import { spawn as spawn7 } from "child_process";
 import { chmod, mkdir as mkdir21, readFile as readFile32, rm as rm10 } from "fs/promises";
 import { dirname as dirname19, join as join26 } from "path";
@@ -18596,7 +19063,7 @@ var GuardianUpdateHandoff = class {
     this.options = options;
     this.launch = options.launch ?? defaultLaunch;
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-    this.id = options.id ?? randomUUID13;
+    this.id = options.id ?? randomUUID14;
   }
   options;
   launch;
@@ -18712,14 +19179,14 @@ var GuardianUpdateHandoff = class {
 };
 
 // src/upgrade/channel-update.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 var OFFER_TTL_MS = 10 * 6e4;
 var ChannelUpdateController = class {
   constructor(options) {
     this.options = options;
     this.current = options.current ?? currentVersion();
     this.probe = options.probe ?? (() => latestVersion({ cacheMs: 0 }));
-    this.id = options.id ?? randomUUID14;
+    this.id = options.id ?? randomUUID15;
     this.now = options.now ?? Date.now;
     this.ttl = options.offerTtlMs ?? OFFER_TTL_MS;
   }
@@ -19078,7 +19545,7 @@ async function startBridgeEngine(options) {
         ledgerClaimed = await claimJobDispatch({
           jobs,
           messageIds: ledgerMessageIds,
-          runId: `dispatch-${randomUUID15()}`,
+          runId: `dispatch-${randomUUID16()}`,
           first,
           channel: streaming
         });
@@ -20193,7 +20660,7 @@ ${changeLines.join("\n")}
 import { join as join33 } from "path";
 
 // src/guardian/service.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir21 } from "os";
 import { join as join32 } from "path";
@@ -21040,7 +21507,7 @@ var GuardianService = class {
     }
     const transcript = this.transcripts.get(scope) ?? [];
     const prompt = buildSafePrompt(transcript, msg.content);
-    const runId = randomUUID16();
+    const runId = randomUUID17();
     const density = this.options.safeDensity;
     const timeoutMs = this.options.safeTimeoutMs;
     const now = Date.now();
@@ -21741,7 +22208,7 @@ function waitForExit(child) {
     child.once("error", done);
   });
 }
-function sleep3(ms) {
+function sleep4(ms) {
   return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
 }
 async function runSupervise(options, deps = {}) {
@@ -21811,7 +22278,7 @@ async function runSupervise(options, deps = {}) {
       restarts += 1;
       await writeStatus("restarting", void 0, restarts);
       const backoff = computeBackoffMs(restarts);
-      await sleep3(backoff);
+      await sleep4(backoff);
     }
   } finally {
     if (forceStopTimer) clearTimeout(forceStopTimer);