dsh-notify-me 1.12.0 → 1.13.0

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to **dsh-notify-me** are documented here.
 
+## [1.13.0] — 2026-10-23
+
+### 新增
+
+- **外部推送新增三种国内常用目标**（来自 [#17](https://github.com/chromoany/dsh-notify-me/issues/17) 的安卓端诉求）：`feishu`（飞书群机器人）、`serverchan`（Server酱 Turbo 与 Server酱³ 同一套 `…/send/<SendKey>.send` 地址 + `title`/`desp` 表单）、`wxpusher`（`appToken` + 接收者 UID，端点固定，没有可填错的 URL）。三种都走官方接口，浏览器页面能直连确认送达——飞书返回 `Access-Control-Allow-Origin: *`，Server酱与 WxPusher 回显页面 Origin。
+- **失败自动重试与失败记录**：明显临时的失败（网络中断、HTTP 5xx、429）按 `externalRetryDelays`（默认 2 秒 / 6 秒，带 ±25% 抖动）退避重试；其它错误立即停。重试仍失败的投递写进「失败记录」（最多 10 条，只留标题与正文摘要、事件类型与主机名，不留完整端点），设置页可查看与清空。
+- **每个目标可单独启停、并显示最近一次投递状态**：目标行右侧显示「上次成功 / 上次已送出（不可确认）/ 上次失败 + 原因 + 时间」，旁边一个独立开关（`enabled: false`）——某个端点临时不可用就单独关掉它，不必关掉整类事件。
+- **出站签名**：自定义目标填了签名密钥时，请求带 `X-DSH-Notify-Signature`（对请求体做 HMAC-SHA256，`sha256=<hex>`）与 `X-DSH-Notify-Timestamp`；飞书目标填了密钥时按官方算法在请求体里带 `timestamp`（秒）/ `sign`（`base64(HMAC(key = timestamp + "\n" + secret, data = ""))`）。
+- **消息模板**：飞书 / Server酱 / WxPusher / 自定义目标可填模板，占位符 `{{title}}` `{{body}}` `{{event}}` `{{time}}` `{{session}}`；留空是「标题 + 换行 + 正文」。
+- 服务端返回的失败原因如实写进状态：飞书/Server酱/WxPusher 的 `code` 判成功（WxPusher 为 `1000`），失败带上 `error` / `message` / `info` / `msg`。
+
+### 说明
+
+- **钉钉群机器人没有做成目标类型**：实测其接口不返回任何 CORS 头，且只接受 `application/json`——浏览器页面既读不到响应，也无法在 no-cors 下发出合规请求。文档与设置页提示：自建一个中转，用「自定义 Webhook」指向它。
+- **PushDeer / ntfy 同样没有做**：PushDeer 官方安卓客户端已停止维护、接口无 CORS 头；ntfy 自建在安卓上依赖常连保活、默认 `priority` 低于 4 不弹横幅。需要时仍可用自定义目标接自建 ntfy。
+
+### 测试
+
+- 冒烟新增：4 种目标各发一次并逐个校验报文形状（飞书 text + 签名、Server酱 form 编码、WxPusher token/uids、自定义模板与 HMAC 头）；网络错误/5xx 重试到耗尽进失败记录、4xx 不重试、第二次成功只记 `sent`；目标级 `enabled:false` 被裁剪；设置页的类型专属字段、目标启停开关、状态文案、失败记录展示与清空。
+
+### 文档
+
+- README 中英：外部推送整节重写（目标类型、可靠性、状态、签名、模板、钉钉为何不支持），控制台示例补 `externalRetryDelays` 与目标字段形状，已知限制口径同步；致谢加上 [@yuexian7](https://github.com/yuexian7) 与 #17。
+
 ## [1.12.0] — 2026-10-21
 
 ### 新增

package/README.en.md

@@ -26,11 +26,11 @@ A notification plugin for DSH Web / Desktop, so you can keep full access off wit
 - **When input is needed:** approval, plan review, and questions trigger notifications, sound, and a title marker.
 - **When a background reply finishes:** return to the result; click the notification to open its conversation. Pick "background only", "quiet for the open one", or "always".
 - **When you walk off but the window stays in front:** over 3 minutes without input counts as away, and the alert still fires; a toast you have not seen is not closed on a timer before you return.
-- **When you leave your computer:** optionally forward alerts to Discord, Bark, Gotify, or your own webhook.
+- **When you leave your computer:** optionally forward alerts to Discord, Bark, Gotify, Feishu group bots, ServerChan, WxPusher, or your own webhook.
 
 > Keep the page or desktop app running; backgrounding / minimizing is fine. System notifications require permission. Approval buttons need a Service Worker: Web (`http://127.0.0.1` or `https`) has one, the Desktop `dsh-app://` pages cannot register one, so their notifications carry no buttons — click the notification to decide in the conversation.
 
-> 🔎 Looking for it? Search `dsh-notify-me`, **message alerts**, **notification**, **desktop notification**, **reminder**, **approval alert**, **external notifications**, **Discord / Bark / Gotify push** or **可操作提醒 / 消息提醒 / 桌面通知 / 需要你操作** (npm keywords include both English and Chinese terms).
+> 🔎 Looking for it? Search `dsh-notify-me`, **message alerts**, **notification**, **desktop notification**, **reminder**, **approval alert**, **external notifications**, **Android push**, **Discord / Bark / Gotify / Feishu / ServerChan / WxPusher push** or **可操作提醒 / 消息提醒 / 桌面通知 / 需要你操作** (npm keywords include both English and Chinese terms).
 
 ## UI Preview
 
@@ -118,7 +118,7 @@ Open **Settings → Notify me**. The page runs as how you get told, when to aler
 
 - **Enable reminders**: master switch — off means no toasts, no sounds, and the tab title is left alone;
 - **Sound / Volume**: the switch is direct; the slider folds into that row — click the title (▸ turns into ▾) to reveal it. What it plays comes from Advanced → Alert sound;
-- **Decide approvals from the toast** (on by default): approvals carry Approve / Reject that settle the request in place. On Web that is a system notification with buttons; on Desktop `dsh-app://` cannot register a Service Worker, so the notification carries no buttons — click it to decide in the conversation. The line underneath states whether buttons are possible here.
+- **Decide approvals from the toast** (on by default): approvals carry Approve / Reject that settle the request in place. On Web that is a system notification with buttons; on Desktop `dsh-app://` cannot register a Service Worker, so the notification carries no buttons — click it to decide in the conversation. The line under the Try-it block states whether buttons are possible here.
 
 ### When to alert
 
@@ -152,12 +152,17 @@ Choose a built-in cue, custom audio file, or system notification sound independe
 
 ### External push
 
-Off by default. Supports Discord Webhook / Bark / Gotify / custom webhooks. Alert text is sent to the addresses you enter; use trusted endpoints.
+Off by default. Supports Discord Webhook / Bark / Gotify / Feishu group bots / ServerChan (Turbo and ServerChan³) / WxPusher / custom webhooks. Alert text is sent to the addresses you enter; use trusted endpoints.
 
 <details>
-<summary>Target URLs, forwarding switches, and test messages</summary>
+<summary>Target URLs, forwarding switches, test messages, and the failure log</summary>
 
-- **External notifications** (default off) — forward each alert to your own push endpoints as well, so it reaches you away from the machine: **Discord Webhook** / **Bark** / **Gotify** / **custom webhook**, any number of targets, each with a type and URL (Discord takes the webhook URL; Bark `https://api.day.app/<device key>`; Gotify `https://<server>/message?token=<app token>`; a custom endpoint receives one POST of JSON: `{source, event, title, body, sessionId, time}`). "Forward 'needs you'" and "Forward 'reply finished'" switch independently; **Send test notification** sends one test message to every target (not limited by those two switches, and never pretending to be a real alert). Forwarding follows exactly the same trigger rules as local alerts ("stay quiet for the conversation on screen" and friends apply to it too); the alert text is sent as-is to the addresses you fill in, so **only use endpoints you trust**;
+- **External notifications** (default off) — forward each alert to your own push endpoints as well, so it reaches you away from the machine: **Discord Webhook** / **Bark** / **Gotify** / **Feishu group bot** / **ServerChan** / **WxPusher** / **custom webhook**, any number of targets, each of which can be enabled or disabled on its own (Discord takes the webhook URL; Bark `https://api.day.app/<device key>`; Gotify `https://<server>/message?token=<app token>`; Feishu the group-bot webhook plus an optional verification secret; ServerChan the full `…/send/<SendKey>.send` URL; WxPusher the appToken and the receiver UID; a custom endpoint receives one POST of JSON: `{source, event, title, body, text, sessionId, time}`). "Forward 'needs you'" and "Forward 'reply finished'" switch independently; **Send test notification** sends one test message to every target (not limited by those two switches, and never pretending to be a real alert). Forwarding follows exactly the same trigger rules as local alerts ("stay quiet for the conversation on screen" and friends apply to it too); the alert text is sent as-is to the addresses you fill in, so **only use endpoints you trust**;
+- **Reliable delivery** — failures that look transient (network error, 5xx, 429) are retried after 2 s and 6 s; anything else stops at once. A delivery that still fails is recorded in the failure log (10 entries at most — title and body snippet plus host only, never the full endpoint), which the settings page shows and can clear;
+- **Per-target state** — the right end of each target row shows how its last delivery went (last delivery ok / sent-unverified / failed with the reason) next to a switch of its own, so an endpoint that is temporarily down can be turned off alone instead of muting a whole alert kind;
+- **Signing** — a custom target with a secret sends `X-DSH-Notify-Signature` (HMAC-SHA256 over the body, `sha256=<hex>`); a Feishu target with a secret carries `timestamp` / `sign` in the body per Feishu's own algorithm;
+- **Message template** (optional) — Feishu / ServerChan / WxPusher / custom targets accept a template with `{{title}}` `{{body}}` `{{event}}` `{{time}}` `{{session}}`; empty means "title, newline, body";
+- **DingTalk is not supported** — its robot endpoint answers no CORS header at all and only accepts `application/json`, so a page can neither read the reply nor send a conforming request (under no-cors the content type is restricted to the safelisted ones). To reach DingTalk, relay it through a machine you control and point a custom webhook at that.
 
 </details>
 
@@ -183,7 +188,7 @@ The last block inside Advanced. The page protocol is detected automatically to t
 - **System notification** — a toast through the browser into the Windows action center / macOS Notification Center (clicking it opens the conversation it came from; supported Web environments offer approval buttons, Desktop does not)
 - **Sound** — WebAudio beeps by default (distinct patterns for "needs you" vs "done"); each kind can instead play a picked audio file, or hand the sound over to the operating system's own notification sound
 - **Tab title marker** — while something is waiting on you, the tab title is prefixed with `🔔 Action needed · …` / `🔔 需要你 · …`; while a background session is **finished but unread**, with `✅ Reply finished · …` / `✅ 回复完成 · …`, gone once you open that session (or it starts running again). Both kinds can be up together, "needs you" first; a host title change is rebased under the markers
-- **External notifications** (optional, default off) — the same alert is also forwarded to the push targets you configure: Discord Webhook / Bark / Gotify / custom webhook — so the push channel on your phone picks it up while you step away from the machine
+- **External notifications** (optional, default off) — the same alert is also forwarded to the push targets you configure: Discord Webhook / Bark / Gotify / Feishu group bot / ServerChan / WxPusher / custom webhook — so the push channel on your phone picks it up while you step away from the machine
 
 This is a **browser-layer** plugin: the DSH page must stay open (minimized or backgrounded is fine — that's exactly the "away" state it watches for).
 
@@ -241,8 +246,14 @@ window.__dshNotifyMe.setConfig({
   externalEnabled: false,     // external-notification forwarding master switch (default off: no endpoint, nothing is sent)
   externalAttention: true,    // forward "needs you" (exactly the same trigger rules as local alerts)
   externalDone: true,         // forward "reply finished"
-  externalTargets: []         // push targets: [{id, type:'discord'|'bark'|'gotify'|'custom', url}]
+  externalRetryDelays: [2000, 6000], // backoff for retryable failures (ms, with jitter; [] = send once)
+  externalTargets: []         // push targets, see the shape below
 })
+// Target shape: {id, type, url, secret?, token?, uid?, template?, enabled?}
+// type: 'discord' | 'bark' | 'gotify' | 'feishu' | 'serverchan' | 'wxpusher' | 'custom'
+// token/uid only for wxpusher (its URL is fixed to the official endpoint); secret signs Feishu bodies
+// and custom HMAC headers; template is optional ({{title}} {{body}} {{event}} {{time}} {{session}});
+// enabled:false disables that one target
 window.__dshNotifyMe.resetConfig()                // restore defaults (also drops any picked audio files)
 window.__dshNotifyMe.decide("approval:3", "allowed-once")  // programmatic decision: "allowed-once" | "rejected"
 window.__dshNotifyMe.testExternal()               // explicit outbound test to valid targets; resolves {sent, unverified, failed, statuses}
@@ -300,13 +311,13 @@ There is no page-side fallback either: the shell preload only exposes `dshDeskto
 - Toasts are only produced once the notification permission is granted; declining means sound + title marker only.
 - On the Desktop shell (DSH Desktop 0.2.1-rc.2 / Windows) a toast click does not reliably bring the window forward: sometimes it does, sometimes only the conversation switches. The plugin's `dsh://open` deep link on its own failed 3/3 in isolation (see [How the Desktop window gets raised](#how-the-desktop-window-gets-raised)), so when it does come forward it is most likely the OS/Chromium activating the app on the notification click itself ([discussions #10446](https://github.com/deepseek-ai/deepseek-harness/discussions/10446)).
 - System notification banners are drawn on the primary display only: Windows has no setting and Chromium no API to aim one at another monitor, so on a multi-monitor setup the second screen never receives them. Forwarding to your phone with external notifications is the only route across screens (since 1.12.0 the page no longer draws an approval card).
-- Quick-decision buttons need a Service Worker: they work on `http://127.0.0.1` and `https`, not on plain `http://192.168.x.x`-style LAN addresses, and some browsers or desktop hosts never render notification buttons. **The Desktop (`dsh-app://`) is tested and cannot register a Service Worker**, so buttons never render there and approval toasts fall back to their buttonless form. The `bridge` field of `window.__dshNotifyMe.debug()` says why; everything else keeps working.
+- Quick-decision buttons need a Service Worker: they work on `http://127.0.0.1` and `https`, not on plain `http://192.168.x.x`-style LAN addresses, and some browsers or desktop hosts never render notification buttons. **The Desktop (`dsh-app://`) is tested and cannot register a Service Worker** (the shell does not grant the `allowServiceWorkers` privilege), so buttons never render there and approval toasts fall back to their buttonless form. The `bridge` field of `window.__dshNotifyMe.debug()` says why; everything else keeps working.
 - macOS: in the browser, alerts, sounds, the title marker and toast-click navigation carry no OS assumptions and work as on Windows. Two caveats: DSH Desktop (Electron) notifications require the app to be code-signed — unsigned builds simply emit no notification — and whether the official macOS build satisfies that is untested; and notification buttons on the macOS desktop host are likewise untested (the Windows desktop host is tested and renders none, see the line above), falling back to the buttonless form above.
 - Config lives in browser `localStorage`: switching browsers/devices or clearing site data returns to defaults (one-click restore in the Settings page).
 - On `>= 0.1.6` (including `0.2.0-rc.2`, `0.2.1-rc.2`) the "reply finished" toast body carries only the session label, no assistant snippet: host snapshots no longer expose `nodes`. The alert itself still fires.
 - The title marker is written into `document.title` alongside the host: when the host recomputes the title it can overwrite the marker until the next alert event rewrites it.
-- "Stay quiet for the conversation on screen" is judged by `document.hidden`: a window fully covered by other apps still counts as visible, so waits in the current conversation stay quiet there too.
-- External notification forwarding is subject to browser CORS rules: an endpoint that does not allow cross-origin requests falls back to a "sent but unverifiable" delivery (no-cors) and is reported honestly as such; Discord webhooks do allow cross-origin, so delivery to them is confirmed. HTTP errors are recorded as failures and never blindly retried. Forwarding runs only after the local alert has decided to fire, so anything the rules silence is never sent out.
+- "Stay quiet for the conversation on screen" is judged by whether the window has focus: a window covered by another app, a switched-away app, or a minimized one all count as background, so waits in the current conversation alert there too; once the window is back in front, or you touch the keyboard / mouse again (no longer idle), it goes quiet again.
+- External notification forwarding is subject to browser CORS rules: an endpoint that does not allow cross-origin requests falls back to a "sent but unverifiable" delivery (no-cors) and is reported honestly as such; Discord, Feishu, ServerChan, and WxPusher all allow cross-origin, so delivery to them is confirmed. DingTalk allows no CORS header at all and only accepts `application/json`, so a page cannot post to it — hence no DingTalk target type (relay it through your own box and use a custom webhook). A failure that looks transient (network error, 5xx, 429) is retried on the backoff; a delivery that still fails lands in the failure log, and anything else stops at once. Forwarding runs only after the local alert has decided to fire, so anything the rules silence is never sent out.
 
 - **The settings sidebar glyph relies on a DOM patch**: the shell hard-codes icons per section id and `settings.section` exposes no icon field, so the plugin can only swap the `<svg>` in its own row after the panel renders. It depends on the current panel structure (`data-shortcut-modal="settings"` plus a label `<span>` inside each nav button); if DSH changes that markup the patch silently stops working and the default gear shows instead — nothing else is affected.
 
@@ -332,6 +343,7 @@ Contributors (by handle; the link points at the PR / issue they worked on):
 - [@Wh1stle05](https://github.com/Wh1stle05) — [#10](https://github.com/chromoany/dsh-notify-me/pull/10): the per-kind alert sound source (built-in synth / picked audio file / system notification sound, chosen independently for "needs you" and "reply done"), with its settings UI, fallback chain, tests and docs; the two refinements — a "system" preview sending a real test notification instead of doing nothing, and the fake React holding hook state by index across renders — come from the same PR.
 - [@yanzhaohui1999](https://github.com/yanzhaohui1999) — [#13](https://github.com/chromoany/dsh-notify-me/issues/13) / [#14](https://github.com/chromoany/dsh-notify-me/pull/14): the 482-session idle-page CPU report (pinning `currentSessionId()` rescanning the whole table per row, 5.9%~6.5% of CPU) and the fix (derive the on-screen session once per list change), with a red-then-green regression assertion — a 4-row and a 40-row list change must cost the same (upstream reported 7 vs 43, 5 vs 5 after).
 - [@RiZhiZhaoYi](https://github.com/RiZhiZhaoYi) — [#12](https://github.com/chromoany/dsh-notify-me/issues/12): the external-notification forwarding suggestion (Discord Webhook / Bark / Gotify / custom webhook) and its use case (1.7.0).
+- [@yuexian7](https://github.com/yuexian7) — [#17](https://github.com/chromoany/dsh-notify-me/issues/17): the ask for alerts on an Android phone — Discord is awkward in mainland China and Bark has no Android app, so a self-hosted relay was the only option; 1.13.0's Feishu / ServerChan / WxPusher targets, retries, and failure log came out of it.
 - [@shrekcg](https://github.com/shrekcg) — [#16](https://github.com/chromoany/dsh-notify-me/pull/16): counting "in front but walked away" as away (`idleMinutes`, 3 minutes by default), deciding "reply finished" alerts by which conversation finished (`donePolicy`, three choices), the three-way toast self-dismiss policy (`autoDismiss`), with matching smoke cases and old-config migration; when it landed in 1.12.0 the maintainer added the idle-expiry replay for suppressed approvals, removed the leftover in-page approval card, and brought docs and version up to date.
 
 Attribution policy: external PRs are landed as maintainer commits — the original commit is not reused and no Co-authored-by trailer is added, so GitHub's contributors graph lists the maintainer only and contributors are credited above.

package/README.md

@@ -26,11 +26,11 @@ DSH Web / Desktop 的通知插件，让你敢不开完整访问，也不必一
 - **需要你操作时**：审批、方案确认、提问，用通知、提示音和标题标记提醒。
 - **后台回复完成时**：及时回来查看结果，点击通知可回到对应对话；提醒时机可选「仅后台 / 仅当前对话静默 / 总是提醒」。
 - **人走开但窗口没走**：窗口留在最前台、人却离开座位，超过 3 分钟没有输入也算离开，该提醒的照常提醒；收到的那条通知不会在你回来之前自己消失。
-- **离开电脑时**：可选转发到 Discord、Bark、Gotify 或自己的 Webhook。
+- **离开电脑时**：可选转发到 Discord、Bark、Gotify、飞书群机器人、Server酱、WxPusher 或自己的 Webhook。
 
 > 页面或桌面应用需保持运行，后台 / 最小化可以。系统通知需要通知权限。审批按钮靠 Service Worker 才能进通知：Web 端（`http://127.0.0.1` 或 `https`）有，桌面端 `dsh-app://` 页面注册不了，通知上没有按钮，点通知回到对话里裁决。
 
-> 🔎 想找这个插件？可以搜：`dsh-notify-me`、**消息提醒**、**可操作提醒**、**桌面通知**、**需要你操作**、**回复完成提醒**、**后台完成提醒**、**外部通知**、**Discord / Bark / Gotify 推送**（npm 关键词已含以上中英文词）。
+> 🔎 想找这个插件？可以搜：`dsh-notify-me`、**消息提醒**、**可操作提醒**、**桌面通知**、**需要你操作**、**回复完成提醒**、**后台完成提醒**、**外部通知**、**安卓推送**、**Discord / Bark / Gotify / 飞书 / Server酱 / WxPusher 推送**（npm 关键词已含以上中英文词）。
 
 ## 效果预览
 
@@ -73,14 +73,14 @@ dsh plugin --profile web add dsh-notify-me
 2. 打开 **设置 → 通知提醒**，确认出现该分区及底部插件版本号，保持「启用提醒」「提示音」开启。
 3. 点击设置页的「测试『回复完成』」按钮：应出现一条测试通知，并按当前音效设置播放声音。这个本地测试不会转发到外部通知端点，也不受「窗口在前台时也提醒」开关限制。
 
-Web 用户可再测试审批按钮。桌面端拿不到 Service Worker，这条测试会在窗口角落画一张带「同意 / 拒绝」的卡片（1.10.4 起；之前的版本这里只发普通通知）。
+Web 用户可再测审批按钮，通知上会带「同意 / 拒绝」。桌面端拿不到 Service Worker，这条测试只发一条普通通知；真实审批的提醒同理——只弹通知，点它回到对话里裁决。
 
 **控制台验证（可选）** — 支持 DevTools 的环境也可执行：
 
 ```js
 window.__dshNotifyMe.test("done")        // 「完成」示例
 window.__dshNotifyMe.test("attention")   // 「需要你」示例
-window.__dshNotifyMe.test("approval")    // 桥可用时带「同意 / 拒绝」按钮；桌面端画在窗口角落的卡片上
+window.__dshNotifyMe.test("approval")    // 桥可用时带「同意 / 拒绝」按钮；否则只发普通通知（桌面端即如此）
 window.__dshNotifyMe.debug()             // 桥接状态看 bridge 字段，active = 按钮可用
 ```
 
@@ -114,7 +114,7 @@ dsh-notify-me 把「监督」和「守在屏幕前」解耦：只在真的出现
 
 - **启用提醒** 总开关：关闭后不弹通知、不响提示音，也不改标签页标题；
 - **提示音 / 音量**：开关直接切；音量滑块收在该行里，点一下标题（▸ 变成 ▾）展开。具体播什么由「高级设置 → 音效来源」决定；
-- **审批通知上直接裁决**（默认开）：审批带「同意 / 拒绝」，点一下即完成裁决，不用切回页面。Web 走带按钮的系统通知；桌面端 `dsh-app://` 注册不了 Service Worker，通知上没有按钮，点通知回到对话里裁决。设置页那行下面会如实说明当前环境能不能给按钮。
+- **审批通知上直接裁决**（默认开）：审批带「同意 / 拒绝」，点一下即完成裁决，不用切回页面。Web 走带按钮的系统通知；桌面端 `dsh-app://` 注册不了 Service Worker，通知上没有按钮，点通知回到对话里裁决。设置页「试一试」下面那行会如实说明当前环境能不能给按钮。
 
 ### 什么时候提醒
 
@@ -148,12 +148,17 @@ dsh-notify-me 把「监督」和「守在屏幕前」解耦：只在真的出现
 
 ### 外部推送
 
-默认关闭。支持 Discord Webhook / Bark / Gotify / 自定义 Webhook；提醒正文会发往你填写的地址，只使用可信端点。
+默认关闭。支持 Discord Webhook / Bark / Gotify / 飞书群机器人 / Server酱（Turbo 与 Server酱³）/ WxPusher / 自定义 Webhook；提醒正文会发往你填写的地址，只使用可信端点。
 
 <details>
-<summary>目标地址、转发开关与发送测试</summary>
+<summary>目标地址、转发开关、发送测试与失败记录</summary>
 
-- **外部通知**（默认关）：把提醒同时转发到你自己的推送端点，人不在电脑前也能收到——支持 **Discord Webhook** / **Bark** / **Gotify** / **自定义 Webhook**，可加多个目标，每个选类型填地址（Discord 填 Webhook 地址；Bark 填 `https://api.day.app/<设备密钥>`；Gotify 填 `https://<服务器>/message?token=<应用令牌>`；自定义端点收一条 POST JSON：`{source, event, title, body, sessionId, time}`）；「转发「需要你」」「转发「回复完成」」各自独立开关；**发送测试通知**往所有目标发一条测试消息（不受这两类开关限制，也不会冒充真提醒）。转发跟本地提醒走同一套触发规则（「当前对话不弹通知」等开关同样管它）；提醒正文会原样发往你填的地址，**只填你自己信任的端点**；
+- **外部通知**（默认关）：把提醒同时转发到你自己的推送端点，人不在电脑前也能收到——支持 **Discord Webhook** / **Bark** / **Gotify** / **飞书群机器人** / **Server酱** / **WxPusher** / **自定义 Webhook**，可加多个目标，每个目标可单独启用/停用（Discord 填 Webhook 地址；Bark 填 `https://api.day.app/<设备密钥>`；Gotify 填 `https://<服务器>/message?token=<应用令牌>`；飞书填群机器人 Webhook，可选填签名校验密钥；Server酱 填 `…/send/<SendKey>.send` 完整地址；WxPusher 填 appToken 与接收者 UID；自定义端点收一条 POST JSON：`{source, event, title, body, text, sessionId, time}`）；「转发「需要你」」「转发「回复完成」」各自独立开关；**发送测试通知**往所有目标发一条测试消息（不受这两类开关限制，也不会冒充真提醒）。转发跟本地提醒走同一套触发规则（「当前对话不弹通知」等开关同样管它）；提醒正文会原样发往你填的地址，**只填你自己信任的端点**；
+- **可靠投递**：明显是临时故障的失败（网络中断、5xx、429）按 2 秒 / 6 秒自动重试两次，其它错误立即停；重试仍失败会把这一条记进「失败记录」（最多 10 条，只留标题与正文摘要和主机名，不留完整端点），设置页能一眼看到并清空；
+- **每个目标的状态**：目标行右侧显示它最近一次投递的结果（上次成功 / 上次已送出但不可确认 / 上次失败 + 原因），并各自带一个启停开关——某个端点临时不可用就单独关掉它，不用关掉整类事件；
+- **签名**：自定义目标填了签名密钥时，请求带 `X-DSH-Notify-Signature`（对请求体做 HMAC-SHA256，`sha256=<hex>`）；飞书填了签名密钥时按官方算法在请求体里带 `timestamp` / `sign`；
+- **消息模板**（可选）：飞书 / Server酱 / WxPusher / 自定义目标可填模板，占位符 `{{title}}` `{{body}}` `{{event}}` `{{time}}` `{{session}}`，留空默认是「标题 + 换行 + 正文」；
+- **钉钉不在支持列表里**：钉钉群机器人接口不返回任何 CORS 头，且只接受 `application/json`——浏览器页面既读不到响应，也无法发出符合要求的请求（no-cors 下 Content-Type 会被限制成 safelisted 类型）。要用钉钉，请在自己能控制的机器上搭一个中转，再把「自定义 Webhook」指向它。
 
 </details>
 
@@ -179,7 +184,7 @@ dsh-notify-me 把「监督」和「守在屏幕前」解耦：只在真的出现
 - **系统通知**：经浏览器弹出的系统通知，进 Windows 通知中心或 macOS 通知中心（点击回到提醒所属的对话；支持快捷裁决的 Web 环境可点审批按钮直接裁决，桌面端没有按钮）
 - **提示音**：默认是 WebAudio 合成音（「需要你」与「完成」使用不同音型）；可在设置里为两类提醒分别换成自定义音频文件，或改成让操作系统播放它自己的通知音
 - **标签页标题标记**：有待处理事项时，标题前出现 `🔔 需要你 · …` / `🔔 Action needed · …`；后台会话**完成但还没看**时出现 `✅ 回复完成 · …` / `✅ Reply finished · …`，打开对应会话（或它再次开跑）即消失。两种标记可同时出现，「需要你」在前；宿主改写标题后标记基于新标题重建
-- **外部通知**（可选，默认关）：按设置里配的推送目标，把同一条提醒转发到 Discord Webhook / Bark / Gotify / 自定义 Webhook——临时离开电脑时，手机上的推送渠道照样收到
+- **外部通知**（可选，默认关）：按设置里配的推送目标，把同一条提醒转发到 Discord Webhook / Bark / Gotify / 飞书群机器人 / Server酱 / WxPusher / 自定义 Webhook——临时离开电脑时，手机上的推送渠道照样收到
 
 本插件是**浏览器层**实现：DSH 页面需保持打开（最小化/后台即可——那正是它监听的「离开」状态）。
 
@@ -237,8 +242,13 @@ window.__dshNotifyMe.setConfig({
   externalEnabled: false,     // 外部通知转发主开关（默认关：不填端点就什么都不发）
   externalAttention: true,    // 转发「需要你」（触发规则跟本地提醒完全一致）
   externalDone: true,         // 转发「回复完成」
-  externalTargets: []         // 推送目标：[{id, type:'discord'|'bark'|'gotify'|'custom', url}]
+  externalRetryDelays: [2000, 6000], // 可重试失败的退避间隔（毫秒，带抖动；[] = 只发一次）
+  externalTargets: []         // 推送目标，见下方字段说明
 })
+// 目标的形状：{id, type, url, secret?, token?, uid?, template?, enabled?}
+// type: 'discord' | 'bark' | 'gotify' | 'feishu' | 'serverchan' | 'wxpusher' | 'custom'
+// token/uid 只用于 wxpusher（url 固定为官方端点）；secret 用于飞书签名与自定义 HMAC 签名；
+// template 可选，占位符 {{title}} {{body}} {{event}} {{time}} {{session}}；enabled:false 单独停用该目标
 window.__dshNotifyMe.resetConfig()                // 恢复默认（同时清掉已选的自定义音效文件）
 window.__dshNotifyMe.decide("approval:3", "allowed-once")  // 程序化裁决："allowed-once" | "rejected"
 window.__dshNotifyMe.testExternal()               // 显式外发测试：向有效目标发送，返回 {sent, unverified, failed, statuses}
@@ -296,13 +306,13 @@ DSH Desktop 是一层 Electron 壳，页面跑在 `dsh-app://app` 下：DOM 的
 - 系统通知横幅只画在主屏：Windows 没有设置项、Chromium 没有 API 能把它指到别的显示器（多屏时副屏收不到系统通知）。要跨屏提醒只能靠外部推送转到手机（1.12.0 起页面里不再画审批卡片）。
 - 每次页面加载后第一次出声/弹通知前，需在页面上点击过一次（浏览器自动播放与权限策略）。
 - 未授权通知权限时只有提示音与标题标记。
-- 快捷裁决按钮要 Service Worker：`http://127.0.0.1`、`https` 可用，`http://192.168.x.x` 这类局域网地址不行；**桌面端（`dsh-app://`）已实测无法注册 Service Worker**，按钮渲染不了，审批通知退回无按钮样式。浏览器或桌面宿主不渲染通知按钮时，`window.__dshNotifyMe.debug()` 的 `bridge` 字段会说明原因，其余功能不受影响。
+- 快捷裁决按钮要 Service Worker：`http://127.0.0.1`、`https` 可用，`http://192.168.x.x` 这类局域网地址不行；**桌面端（`dsh-app://`）已实测无法注册 Service Worker**（宿主未开放 `allowServiceWorkers` 特权），按钮渲染不了，审批通知退回无按钮样式。浏览器或桌面宿主不渲染通知按钮时，`window.__dshNotifyMe.debug()` 的 `bridge` 字段会说明原因，其余功能不受影响。
 - macOS：浏览器里提醒、提示音、标题标记、点通知跳转都没有平台假设，照常工作；但 DSH Desktop（Electron）的系统通知要求应用已签名，未签名的通知直接发不出去，官方 macOS 版是否满足这一前提未实测；审批按钮在 macOS 桌面宿主上的渲染同样未实测（Windows 桌面端已实测不渲染，见上条），不渲染时自动退回无按钮通知。
 - 配置存在浏览器 `localStorage`：换浏览器/设备或清除站点数据后会回到默认值（设置页可一键恢复默认）。
 - `≥ 0.1.6`（含 `0.2.0-rc.2`、`0.2.1-rc.2`）的「回复完成」提醒正文只有会话名，不再附带回复摘要——宿主快照已不再提供 `nodes`；提醒本身照常触发。
 - 标题标记由宿主与插件共同写 `document.title`：宿主重算标题时标记可能被覆盖，直到下一次提醒事件重新写成。
-- 「当前对话不弹通知」按「窗口是否在前台」判定：窗口被别的应用盖住、切到别的应用、最小化都算后台，此时当前对话的等待照常提醒；窗口回到前台再静默。
-- 外部通知转发受浏览器跨域（CORS）限制：端点不放行时自动降级为「送出但不可确认」（no-cors），如实标为「已送出不可确认」；Discord Webhook 官方放行跨域，可直接确认送达。HTTP 错误如实记失败、不重试。转发在本地提醒决定要发之后才触发，所以被「当前对话不弹通知」等规则静音的提醒也不会外发。
+- 「当前对话不弹通知」按「窗口是否在前台」判定：窗口被别的应用盖住、切到别的应用、最小化都算后台，此时当前对话的等待照常提醒；窗口回到前台、或重新有键鼠输入（不再闲置）之后，再恢复静默。
+- 外部通知转发受浏览器跨域（CORS）限制：端点不放行时自动降级为「送出但不可确认」（no-cors），如实标为「已送出不可确认」；Discord、飞书、Server酱、WxPusher 都放行跨域，可直接确认送达。钉钉不放行任何 CORS 头、又只收 `application/json`，页面发不出去，所以没有做成目标类型（自建中转 + 自定义目标才行）。明显临时的失败（网络中断、5xx、429）会按退避重试，重试仍失败进失败记录；其余错误立即停、不重试。转发在本地提醒决定要发之后才触发，所以被「当前对话不弹通知」等规则静音的提醒也不会外发。
 
 - **设置左侧导航行图标靠 DOM 补丁**：外壳按分区 id 硬编码图标且 `settings.section` 没有图标字段，插件只能在面板渲染后把那一行的 `<svg>` 换成铃铛。命中依赖宿主当前的面板结构（`data-shortcut-modal="settings"` + 导航按钮里的标签 `<span>`）；如果 DSH 改了这套结构，补丁会静默失效、显示回默认齿轮，其他功能不受影响。
 
@@ -328,6 +338,7 @@ npm pack --dry-run               # 预览发布包
 - [@Wh1stle05](https://github.com/Wh1stle05) — [#10](https://github.com/chromoany/dsh-notify-me/pull/10)：「音效来源」功能（内置合成音 / 自定义音频文件 / 系统通知音，「需要你」与「回复完成」各自独立选），含设置页交互、回落链与测试、文档；「系统通知音」试听改发测试通知、假 React 按索引跨渲染保持 hook 状态这两处修正同样出自该 PR。
 - [@yanzhaohui1999](https://github.com/yanzhaohui1999) — [#13](https://github.com/chromoany/dsh-notify-me/issues/13) / [#14](https://github.com/chromoany/dsh-notify-me/pull/14)：482 个会话下空闲页面烧 CPU 的性能报告（定位到 `currentSessionId()` 每行重扫全表，实测占 CPU 5.9%~6.5%）与修复（一次列表变化只推导一次「当前会话」），并带先红后绿的回归断言——4 行与 40 行的列表变化代价必须相等（上游报 7 vs 43，修后 5 vs 5）。
 - [@RiZhiZhaoYi](https://github.com/RiZhiZhaoYi) — [#12](https://github.com/chromoany/dsh-notify-me/issues/12)：外部通知转发（Discord Webhook / Bark / Gotify / 自定义 Webhook）的功能建议与使用场景（1.7.0）。
+- [@yuexian7](https://github.com/yuexian7) — [#17](https://github.com/chromoany/dsh-notify-me/issues/17)：安卓端收消息的诉求——Discord 在国内不便、Bark 没有安卓端，只能自己搭后台中转；1.13.0 的飞书 / Server酱 / WxPusher 三种目标、自动重试与失败记录都是据此做的。
 - [@shrekcg](https://github.com/shrekcg) — [#16](https://github.com/chromoany/dsh-notify-me/pull/16)：把「人在前台但离开了」并入离开判定（`idleMinutes`，默认 3 分钟）、「回复完成」按哪个对话完成决定是否提醒（`donePolicy` 三选一）、通知自动消失的三档策略（`autoDismiss`），并带上对应冒烟用例与旧配置迁移；1.12.0 落地时维护者补了闲置到期补发被压下的审批、删掉残留的页内审批卡片、补齐文档与版本。
 
 署名口径：本仓库收编外部 PR 时以维护者提交落地——不沿用原 commit、不挂 Co-authored-by，GitHub 的 contributors 图只显示维护者，贡献者以上面的致谢署名。

package/lib/client.js

@@ -277,13 +277,25 @@
       // dropped the approval card that outlived it: a second on-page copy next
       // to the notification is noise.
       // External forwarding: mirror every alert the plugin actually delivers to
-      // webhook endpoints (Discord / Bark / Gotify / custom), so a phone or
-      // another box can tell the user to come back. Off by default — nothing
-      // leaves the browser until the user fills in an endpoint of their own.
+      // webhook endpoints (Discord / Bark / Gotify / Feishu / ServerChan /
+      // WxPusher / custom), so a phone or another box can tell the user to come
+      // back. Off by default — nothing leaves the browser until the user fills
+      // in an endpoint of their own.
+      // DingTalk is deliberately absent: its robot endpoint answers no CORS
+      // header at all and only accepts application/json, so a page cannot send
+      // to it (a no-cors POST loses the content type). A relay on the user's
+      // own box, wired as a custom target, is the only route.
       externalEnabled: false,
       externalAttention: true, // forward the "needs you" alerts
       externalDone: true, // forward the "reply finished" alerts
-      // [{ id: string, type: 'discord' | 'bark' | 'gotify' | 'custom', url: string }]
+      // Backoff between delivery attempts. Failed attempts are retried on this
+      // schedule (with jitter) when the failure looks transient (network error,
+      // HTTP 5xx, 429); a non-retryable failure stops at once. An empty list
+      // means "send once".
+      externalRetryDelays: [2000, 6000],
+      // [{ id, type, url, secret?, token?, uid?, template?, enabled? }]
+      // type: 'discord' | 'bark' | 'gotify' | 'feishu'
+      //     | 'serverchan' | 'wxpusher' | 'custom'
       externalTargets: []
     };
     function readConfig() {
@@ -908,24 +920,143 @@
 
     // ───────────────────── external webhook forwarding ─────────────────────
     // Every alert fire() actually delivers is mirrored to the user's webhook
-    // targets (Discord / Bark / Gotify / custom), so being away from the
-    // machine does not mean missing the "come back" cue. Off by default:
-    // nothing leaves the browser until the user fills in an endpoint.
+    // targets (Discord / Bark / Gotify / Feishu / ServerChan / WxPusher /
+    // custom), so being away from the machine does not mean missing the "come
+    // back" cue. Off by default: nothing leaves the browser until the user
+    // fills in an endpoint.
     //
     // CORS reality: a page can only read a response the endpoint allows it to
-    // read. Discord webhooks answer with Access-Control-Allow-Origin: * and
-    // work directly; a self-hosted endpoint may not. So each send tries a
-    // plain CORS POST first and, only when the browser itself refuses the
-    // exchange (a rejection from fetch — not an HTTP error status, which means
-    // the server did see the request), retries as a no-cors POST with a
-    // text/plain content type: the request is still delivered, only the reply
-    // is unreadable ("unverified"). Bark gets a third chance in the classic
-    // GET shape `url/<title>/<body>`, which needs no CORS at all. Real HTTP
-    // errors are reported as failures and never retried blindly.
-    var externalStat = { sent: 0, unverified: 0, failed: 0, lastAt: null, lastStatus: null };
-    // Valid, enabled targets only. A stale entry (bad URL, unknown type) is
-    // skipped rather than breaking the others; the settings page only ever
-    // writes well-formed entries.
+    // read. Discord webhooks and Feishu bots answer with
+    // Access-Control-Allow-Origin: *; ServerChan and WxPusher echo the page
+    // origin; a self-hosted endpoint may do neither. So each send tries a plain
+    // CORS POST first and, only when the browser itself refuses the exchange (a
+    // rejection from fetch — not an HTTP error status, which means the server
+    // did see the request), retries as a no-cors POST with a text/plain content
+    // type: the request is still delivered, only the reply is unreadable
+    // ("unverified"). Bark gets a third chance in the classic GET shape
+    // `url/<title>/<body>`, which needs no CORS at all. A transient failure
+    // (network error, 5xx, 429) is retried on the configured backoff; anything
+    // else stops at once, and a final failure lands in the dead-letter log.
+    // ── SHA-256 / HMAC-SHA256 ──────────────────────────────────────────
+    // Two signing modes need HMAC-SHA256: Feishu's 签名校验 and the custom
+    // target's X-DSH-Notify-Signature header. Web Crypto's
+    // crypto.subtle only exists in a secure context, and this plugin also runs
+    // crypto.subtle only exists in a secure context, and this plugin also runs
+    // on plain-http LAN pages and inside the desktop shell, so the digest is
+    // implemented here: no dependency, no secure-context requirement, and the
+    // smoke suite cross-checks it against Node's crypto module.
+    var SHA256_K = [
+      0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+      0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+      0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+      0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+      0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+      0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+      0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+      0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+    ];
+    function utf8Bytes(s) {
+      if (typeof TextEncoder === "function") return new TextEncoder().encode(s);
+      var out = [];
+      for (var i = 0; i < s.length; i++) {
+        var c = s.charCodeAt(i);
+        if (c < 0x80) out.push(c);
+        else if (c < 0x800) out.push(0xc0 | (c >> 6), 0x80 | (c & 63));
+        else if (c >= 0xd800 && c <= 0xdbff) {
+          var cp = 0x10000 + ((c - 0xd800) << 10) + (s.charCodeAt(++i) - 0xdc00);
+          out.push(0xf0 | (cp >> 18), 0x80 | ((cp >> 12) & 63), 0x80 | ((cp >> 6) & 63), 0x80 | (cp & 63));
+        } else out.push(0xe0 | (c >> 12), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63));
+      }
+      return new Uint8Array(out);
+    }
+    function rotr(x, n) { return (x >>> n) | (x << (32 - n)); }
+    function sha256(bytes) {
+      var H = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
+      var l = bytes.length;
+      var total = (((l + 8) >> 6) + 1) << 6;
+      var buf = new Uint8Array(total);
+      buf.set(bytes);
+      buf[l] = 0x80;
+      var dv = new DataView(buf.buffer);
+      dv.setUint32(total - 8, Math.floor(l / 0x20000000));
+      dv.setUint32(total - 4, (l << 3) >>> 0);
+      var w = new Array(64);
+      for (var off = 0; off < total; off += 64) {
+        var i;
+        for (i = 0; i < 16; i++) w[i] = dv.getUint32(off + i * 4);
+        for (i = 16; i < 64; i++) {
+          var s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+          var s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+          w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0;
+        }
+        var a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], hh = H[7];
+        for (i = 0; i < 64; i++) {
+          var t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + SHA256_K[i] + w[i]) | 0;
+          var t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) | 0;
+          hh = g; g = f; f = e; e = (d + t1) | 0; d = c; c = b; b = a; a = (t1 + t2) | 0;
+        }
+        H[0] = (H[0] + a) | 0; H[1] = (H[1] + b) | 0; H[2] = (H[2] + c) | 0; H[3] = (H[3] + d) | 0;
+        H[4] = (H[4] + e) | 0; H[5] = (H[5] + f) | 0; H[6] = (H[6] + g) | 0; H[7] = (H[7] + hh) | 0;
+      }
+      var out = new Uint8Array(32);
+      var odv = new DataView(out.buffer);
+      for (var j = 0; j < 8; j++) odv.setUint32(j * 4, H[j] >>> 0);
+      return out;
+    }
+    function hmacSha256(keyStr, msgStr) {
+      var key = utf8Bytes(keyStr);
+      var msg = utf8Bytes(msgStr);
+      if (key.length > 64) key = sha256(key);
+      var k = new Uint8Array(64);
+      k.set(key);
+      var inner = new Uint8Array(64 + msg.length);
+      var outer = new Uint8Array(64 + 32);
+      for (var i = 0; i < 64; i++) {
+        inner[i] = k[i] ^ 0x36;
+        outer[i] = k[i] ^ 0x5c;
+      }
+      inner.set(msg, 64);
+      outer.set(sha256(inner), 64);
+      return sha256(outer);
+    }
+    function bytesToB64(bytes) {
+      // Hand-rolled instead of btoa(): the page container is not guaranteed to
+      // expose the legacy Web API global, and the signature is the one thing a
+      // user cannot verify by eye.
+      var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+      var s = "";
+      for (var i = 0; i < bytes.length; i += 3) {
+        var b0 = bytes[i];
+        var b1 = i + 1 < bytes.length ? bytes[i + 1] : -1;
+        var b2 = i + 2 < bytes.length ? bytes[i + 2] : -1;
+        s += B64.charAt(b0 >> 2);
+        s += B64.charAt(((b0 & 3) << 4) | (b1 < 0 ? 0 : b1 >> 4));
+        s += b1 < 0 ? "=" : B64.charAt(((b1 & 15) << 2) | (b2 < 0 ? 0 : b2 >> 6));
+        s += b2 < 0 ? "=" : B64.charAt(b2 & 63);
+      }
+      return s;
+    }
+    function bytesToHex(bytes) {
+      var s = "";
+      for (var i = 0; i < bytes.length; i++) s += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+      return s;
+    }
+
+    var externalStat = { sent: 0, unverified: 0, failed: 0, retried: 0, lastAt: null, lastStatus: null };
+    var LS_EXTERNAL_DEAD = "dshNotifyMe.external.dead";
+    var LS_EXTERNAL_HEALTH = "dshNotifyMe.external.health";
+    var EXTERNAL_DEAD_MAX = 10;
+    var WXPUSHER_ENDPOINT = "https://wxpusher.zjiecode.com/api/send/message";
+    // Unknown / retired type ids degrade to the generic JSON shape instead of
+    // dropping the target: an old profile keeps delivering after an upgrade.
+    function externalType(t) {
+      if (t === "discord" || t === "bark" || t === "gotify" || t === "feishu" ||
+          t === "serverchan" || t === "wxpusher") return t;
+      return "custom";
+    }
+    // Valid, enabled targets only. A stale entry (bad URL, missing token,
+    // unknown type) is skipped rather than breaking the others; the settings
+    // page only ever writes well-formed entries.
     function externalTargets() {
       var out = [];
       var list = config.externalTargets;
@@ -933,50 +1064,159 @@
       for (var i = 0; i < list.length; i++) {
         var t = list[i];
         if (!t || typeof t !== "object" || t.enabled === false) continue;
+        var type = externalType(t.type);
         var url = typeof t.url === "string" ? t.url.trim() : "";
+        var secret = typeof t.secret === "string" ? t.secret.trim() : "";
+        var template = typeof t.template === "string" ? t.template : "";
+        var id = typeof t.id === "string" ? t.id : "";
+        if (type === "wxpusher") {
+          // The appToken and the receiver id are the whole configuration; the
+          // endpoint itself is fixed, so there is no URL to get wrong.
+          var token = typeof t.token === "string" ? t.token.trim() : "";
+          var uid = typeof t.uid === "string" ? t.uid.trim() : "";
+          if (!token || !uid) continue;
+          out.push({ id: id, type: type, url: WXPUSHER_ENDPOINT, secret: "", template: template, token: token, uid: uid });
+          continue;
+        }
         if (!/^https?:\/\//i.test(url)) continue;
-        var type = t.type;
-        if (type !== "discord" && type !== "bark" && type !== "gotify") type = "custom";
-        out.push({ id: typeof t.id === "string" ? t.id : "", type: type, url: url });
+        out.push({ id: id, type: type, url: url, secret: secret, template: template, token: "", uid: "" });
       }
       return out;
     }
-    // Per-endpoint JSON body, each shaped by that service's own convention;
-    // the custom type gets the full generic event so any JSON endpoint works.
-    function externalBody(type, ev) {
-      if (type === "discord") {
-        var content = ev.title + "\n" + ev.body;
-        if (content.length > 1900) content = content.slice(0, 1900) + "…";
-        return JSON.stringify({ username: "DSH", content: content });
+    // The text every chat-style target shows. A target may pin its own template
+    // ({{title}} / {{body}} / {{event}} / {{time}} / {{session}}); without one
+    // the alert reads "title" then the body, which is what the previous
+    // version sent as one string.
+    function externalContent(target, ev) {
+      if (!target.template) return ev.title + "\n" + ev.body;
+      return target.template.replace(/\{\{\s*(title|body|event|time|session)\s*\}\}/g, function (m, key) {
+        if (key === "title") return ev.title;
+        if (key === "body") return ev.body;
+        if (key === "event") return ev.kind;
+        if (key === "session") return ev.sessionId || "";
+        return ev.time;
+      });
+    }
+    // Per-endpoint request, each shaped by that service's own convention.
+    // `noCorsType` is the content type used for the opaque fallback: only the
+    // three CORS-safelisted types may be set on a no-cors request, so a JSON
+    // payload falls back to text/plain and a form stays a form.
+    function externalRequest(target, ev) {
+      var text = externalContent(target, ev);
+      var jsonType = "application/json";
+      var plainType = "text/plain;charset=UTF-8";
+      var formType = "application/x-www-form-urlencoded;charset=UTF-8";
+      var req;
+      if (target.type === "discord") {
+        req = { url: target.url, contentType: jsonType, noCorsType: plainType, headers: {}, body: JSON.stringify({ username: "DSH", content: text.length > 1900 ? text.slice(0, 1900) + "…" : text }) };
+        return { type: "discord", req: req };
       }
-      if (type === "bark") {
-        return JSON.stringify({ title: ev.title, body: ev.body, group: "dsh-notify-me" });
+      if (target.type === "bark") {
+        return { type: "bark", req: { url: target.url, contentType: jsonType, noCorsType: plainType, headers: {}, body: JSON.stringify({ title: ev.title, body: text, group: "dsh-notify-me" }) } };
       }
-      if (type === "gotify") {
-        return JSON.stringify({ title: ev.title, message: ev.body, priority: ev.kind === "attention" ? 8 : 5 });
+      if (target.type === "gotify") {
+        return { type: "gotify", req: { url: target.url, contentType: jsonType, noCorsType: plainType, headers: {}, body: JSON.stringify({ title: ev.title, message: text, priority: ev.kind === "attention" ? 8 : 5 }) } };
       }
-      return JSON.stringify({
-        source: "dsh-notify-me",
-        version: api.version,
-        event: ev.kind,
-        title: ev.title,
-        body: ev.body,
-        sessionId: ev.sessionId || null,
-        time: ev.time
-      });
-    }
-    // Resolves to 'sent' | 'unverified' | 'failed (…)'; never rejects.
-    function postOnce(url, bodyStr, plain) {
-      return fetch(url, {
+      if (target.type === "feishu") {
+        // Feishu's signature is `base64(HMAC-SHA256(key = timestamp + "\n" +
+        // secret, data = ""))` with the timestamp in seconds, carried inside
+        // the JSON body (which Feishu's endpoint does expose to the browser).
+        var fb = { msg_type: "text", content: { text: text } };
+        if (target.secret) {
+          var fts = String(Math.floor(Date.now() / 1000));
+          fb.timestamp = fts;
+          fb.sign = bytesToB64(hmacSha256(fts + "\n" + target.secret, ""));
+        }
+        return { type: "feishu", req: { url: target.url, contentType: jsonType, noCorsType: plainType, headers: {}, body: JSON.stringify(fb) } };
+      }
+      if (target.type === "serverchan") {
+        // ServerChan (Turbo and ³ share this ABI) takes a form: title + desp,
+        // and answers {"code":0}. A form content type is CORS-safelisted, so
+        // the opaque fallback carries the same body unchanged. Turbo truncates
+        // the title at 32 chars and refuses a newline in it.
+        var sctTitle = String(ev.title || "").replace(/\s+/g, " ").slice(0, 32);
+        return { type: "serverchan", req: { url: target.url, contentType: formType, noCorsType: formType, headers: {}, body: "title=" + encodeURIComponent(sctTitle) + "&desp=" + encodeURIComponent(text) } };
+      }
+      if (target.type === "wxpusher") {
+        var uids = target.uid.split(/[,;\s]+/).filter(function (s) { return !!s; });
+        return { type: "wxpusher", req: { url: target.url, contentType: jsonType, noCorsType: plainType, headers: {}, body: JSON.stringify({ appToken: target.token, content: text, summary: ev.title, contentType: 1, uids: uids }) } };
+      }
+      // custom: the generic event plus the rendered text, so a plain endpoint
+      // (or a chat relay) can use either the fields or the text.
+      req = {
+        url: target.url,
+        contentType: jsonType,
+        noCorsType: plainType,
+        headers: {},
+        body: JSON.stringify({
+          source: "dsh-notify-me",
+          version: api.version,
+          event: ev.kind,
+          title: ev.title,
+          body: ev.body,
+          text: text,
+          sessionId: ev.sessionId || null,
+          time: ev.time
+        })
+      };
+      if (target.secret) {
+        // Outbound proof that the request came from this browser: the receiver
+        // recomputes HMAC-SHA256(secret, raw body) and compares. Custom headers
+        // make the request preflighted, so this only works on an endpoint that
+        // answers OPTIONS — the opaque fallback cannot carry it.
+        req.headers["X-DSH-Notify-Signature"] = "sha256=" + bytesToHex(hmacSha256(target.secret, req.body));
+        req.headers["X-DSH-Notify-Timestamp"] = ev.time;
+      }
+      return { type: "custom", req: req };
+    }
+    // HTTP status / service code -> {status, retry}. Only transient failures are
+    // worth another attempt; a wrong token or a malformed endpoint is not.
+    function externalVerdict(type, res, bodyText) {
+      if (!res) return { status: "failed (no response)", retry: true };
+      if (!res.ok) {
+        var retry = res.status >= 500 || res.status === 429;
+        return { status: "failed (HTTP " + res.status + ")", retry: retry };
+      }
+      var parsed = null;
+      if (bodyText) { try { parsed = JSON.parse(bodyText); } catch (e) { parsed = null; } }
+      if (type === "feishu" || type === "serverchan" || type === "wxpusher") {
+        // These answer 200 with a service code; a wrong token shows up there,
+        // not in the HTTP status. DingTalk does the same but cannot be reached
+        // from a page at all, hence no branch for it.
+        if (!parsed || typeof parsed !== "object") return { status: "sent", retry: false };
+        var code = parsed.code;
+        var okCode = type === "wxpusher" ? 1000 : 0;
+        if (code === okCode) return { status: "sent", retry: false };
+        var msg = parsed.error || parsed.message || parsed.info || parsed.msg || ("code " + code);
+        return { status: "failed (" + String(msg).slice(0, 120) + ")", retry: false };
+      }
+      return { status: "sent", retry: false };
+    }
+    // One attempt. Resolves to {status, retry}; never rejects.
+    function postOnce(spec, plain) {
+      var headers = {};
+      headers["Content-Type"] = plain ? spec.noCorsType : spec.contentType;
+      if (!plain) {
+        for (var k in spec.headers) {
+          if (Object.prototype.hasOwnProperty.call(spec.headers, k)) headers[k] = spec.headers[k];
+        }
+      }
+      return fetch(spec.url, {
         method: "POST",
         mode: plain ? "no-cors" : "cors",
         cache: "no-store",
-        headers: { "Content-Type": plain ? "text/plain;charset=UTF-8" : "application/json" },
-        body: bodyStr
+        headers: headers,
+        body: spec.body
       }).then(function (res) {
-        if (plain) return "unverified"; // opaque: delivered, reply unreadable
-        if (res && res.ok) return "sent";
-        return "failed (HTTP " + (res ? res.status : "?") + ")";
+        if (plain) return { status: "unverified", retry: false }; // opaque: delivered, reply unreadable
+        // Some hosts (and the smoke harness) hand back a response-like object
+        // without a body reader; the HTTP status is then all there is to judge.
+        if (typeof res.text !== "function") return externalVerdict(spec.type, res, "");
+        return res.text().then(function (text) {
+          return externalVerdict(spec.type, res, text);
+        }, function () {
+          return externalVerdict(spec.type, res, "");
+        });
       });
     }
     // Bark's path form: url/<title>/<body>. A plain GET first (readable), then
@@ -985,27 +1225,115 @@
     function barkGet(url, ev) {
       var u = url.replace(/\/+$/, "") + "/" + encodeURIComponent(ev.title || "DSH") + "/" + encodeURIComponent(ev.body || "");
       return fetch(u, { method: "GET", cache: "no-store" }).then(function (res) {
-        return res && res.ok ? "sent" : Promise.reject(new Error("HTTP " + (res ? res.status : "?")));
+        return res && res.ok ? { status: "sent", retry: false } : Promise.reject(new Error("HTTP " + (res ? res.status : "?")));
       }).catch(function () {
-        return fetch(u, { method: "GET", mode: "no-cors", cache: "no-store" }).then(function () { return "unverified"; });
+        return fetch(u, { method: "GET", mode: "no-cors", cache: "no-store" }).then(function () { return { status: "unverified", retry: false }; });
       });
     }
-    function postExternal(target, ev) {
-      if (typeof fetch !== "function") return Promise.resolve("failed (no fetch)");
-      var bodyStr = externalBody(target.type, ev);
-      return postOnce(target.url, bodyStr, false).catch(function (err) {
+    function deliverAttempt(target, ev) {
+      if (typeof fetch !== "function") return Promise.resolve({ status: "failed (no fetch)", retry: false });
+      var built;
+      try { built = externalRequest(target, ev); } catch (e) { return Promise.resolve({ status: "failed (payload)", retry: false }); }
+      var spec = built.req;
+      return postOnce(spec, false).catch(function (err) {
         var msg = "failed (" + (err && err.message ? err.message : String(err)) + ")";
-        return postOnce(target.url, bodyStr, true).then(null, function () {
-          if (target.type !== "bark") return msg;
-          return barkGet(target.url, ev).then(null, function () { return msg; });
+        // The browser refused the exchange (CORS or the network): the opaque
+        // path still gets the request out, only the reply is unreadable.
+        return postOnce(spec, true).catch(function () {
+          if (built.type !== "bark") return { status: msg, retry: true };
+          return barkGet(target.url, ev).then(null, function () { return { status: msg, retry: true }; });
+        });
+      });
+    }
+    function externalRetryDelays() {
+      var d = config.externalRetryDelays;
+      if (!Array.isArray(d)) return [2000, 6000];
+      var out = [];
+      for (var i = 0; i < d.length && out.length < 4; i++) {
+        var v = d[i];
+        if (typeof v === "number" && isFinite(v) && v >= 0) out.push(Math.min(v, 60000));
+      }
+      return out;
+    }
+    function readExternalDead() {
+      try {
+        var raw = localStorage.getItem(LS_EXTERNAL_DEAD);
+        var arr = raw ? JSON.parse(raw) : [];
+        return Array.isArray(arr) ? arr : [];
+      } catch (e) { return []; }
+    }
+    function addExternalDead(entry) {
+      var list = readExternalDead();
+      list.unshift(entry);
+      if (list.length > EXTERNAL_DEAD_MAX) list = list.slice(0, EXTERNAL_DEAD_MAX);
+      try { localStorage.setItem(LS_EXTERNAL_DEAD, JSON.stringify(list)); } catch (e) {}
+    }
+    function clearExternalDead() {
+      try { localStorage.removeItem(LS_EXTERNAL_DEAD); } catch (e) {}
+    }
+    var externalHealth = (function () {
+      try {
+        var raw = localStorage.getItem(LS_EXTERNAL_HEALTH);
+        var o = raw ? JSON.parse(raw) : null;
+        return o && typeof o === "object" ? o : {};
+      } catch (e) { return {}; }
+    })();
+    function recordExternalHealth(id, status, attempts, reason) {
+      if (!id) return;
+      externalHealth[id] = { status: status, at: new Date().toISOString(), attempts: attempts || 1, reason: reason || "" };
+      try {
+        var keys = Object.keys(externalHealth);
+        if (keys.length > 40) for (var i = 0; i < keys.length - 40; i++) delete externalHealth[keys[i]];
+        localStorage.setItem(LS_EXTERNAL_HEALTH, JSON.stringify(externalHealth));
+      } catch (e) {}
+    }
+    function maskExternalUrl(url) {
+      // The path of a webhook is usually the secret itself (Discord, Bark,
+      // Feishu hook id); the host is enough to recognise the target later.
+      // Deliberately not `new URL()`: this also runs in hosts whose page
+      // container lacks the URL global.
+      var m = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]+)/i.exec(String(url || ""));
+      if (!m) return "";
+      return m[1].split("@").pop();
+    }
+    // At-least-once delivery: transient failures are retried on the configured
+    // backoff with jitter (a page full of targets must not come back in
+    // lockstep). A final failure is written to the dead-letter log — the alert
+    // itself was already shown locally, so this log is the only trace that the
+    // phone did not get it.
+    function sendToTarget(target, ev) {
+      var delays = externalRetryDelays();
+      var attempts = 0;
+      function run() {
+        attempts++;
+        return deliverAttempt(target, ev).then(function (r) {
+          if (r.status === "sent" || r.status === "unverified") return r;
+          if (!r.retry || attempts > delays.length) return r;
+          var wait = Math.round(delays[attempts - 1] * (1 + Math.random() * 0.25));
+          return new Promise(function (resolve) { setTimeout(function () { resolve(run()); }, wait); });
         });
-      }).then(function (status) {
-        if (status === "sent") externalStat.sent++;
-        else if (status === "unverified") externalStat.unverified++;
-        else externalStat.failed++;
+      }
+      return run().then(function (r) {
+        var failed = r.status.indexOf("failed") === 0;
+        recordExternalHealth(target.id, r.status, attempts, failed ? r.status.slice(7) : "");
+        if (failed) {
+          externalStat.failed++;
+          addExternalDead({
+            at: new Date().toISOString(),
+            targetId: target.id || "",
+            type: target.type,
+            host: maskExternalUrl(target.url),
+            title: String(ev.title || "").slice(0, 120),
+            body: String(ev.body || "").slice(0, 280),
+            status: r.status,
+            attempts: attempts
+          });
+        } else if (r.status === "sent") externalStat.sent++;
+        else externalStat.unverified++;
+        if (attempts > 1) externalStat.retried++;
         externalStat.lastAt = new Date().toISOString();
-        externalStat.lastStatus = status;
-        return status;
+        externalStat.lastStatus = r.status;
+        return r.status;
       });
     }
     // Mirror one delivered alert to every enabled target. The alert path is
@@ -1031,7 +1359,7 @@
       };
       var ps = [];
       for (var i = 0; i < targets.length; i++) {
-        try { ps.push(postExternal(targets[i], ev)); } catch (e) { ps.push(Promise.resolve("failed (dispatch)")); }
+        try { ps.push(sendToTarget(targets[i], ev)); } catch (e) { ps.push(Promise.resolve("failed (dispatch)")); }
       }
       if (typeof onDone === "function") Promise.all(ps).then(onDone, function () {});
     }
@@ -1883,7 +2211,7 @@
       });
     } catch (e) {}
     // keep in sync with package.json "version" on every release
-    api.version = "1.12.0";
+    api.version = "1.13.0";
     api.setConfig = function (patch) { return setConfigLocal(patch); };
     api.resetConfig = function () {
       try {
@@ -1893,6 +2221,11 @@
         // quota with no UI left to remove them from.
         localStorage.removeItem(LS_SOUND.done);
         localStorage.removeItem(LS_SOUND.attention);
+        // Delivery bookkeeping is user-visible state too: a reset should not
+        // leave a dead-letter log (or stale per-target verdicts) behind.
+        localStorage.removeItem(LS_EXTERNAL_DEAD);
+        localStorage.removeItem(LS_EXTERNAL_HEALTH);
+        externalHealth = {};
       } catch (e) {}
       config = readConfig();
       return config;
@@ -1953,18 +2286,25 @@
         customSoundAttention: !!readSound("attention"),
         quickActions: config.quickActions,
         // external webhook forwarding: counts come from externalStat (tallied
-        // on every send), targets is the raw vs validated count.
+        // on every send), targets is the raw vs validated count. `deadLetters`
+        // is the persisted "never made it" log; `health` is the last verdict
+        // per target id, which the settings page renders next to each row.
         external: {
           enabled: config.externalEnabled,
           forwardAttention: config.externalAttention,
           forwardDone: config.externalDone,
           targets: Array.isArray(config.externalTargets) ? config.externalTargets.length : 0,
           activeTargets: externalTargets().length,
+          retryDelays: externalRetryDelays(),
           sent: externalStat.sent,
           unverified: externalStat.unverified,
           failed: externalStat.failed,
+          retried: externalStat.retried,
           lastAt: externalStat.lastAt,
-          lastStatus: externalStat.lastStatus
+          lastStatus: externalStat.lastStatus,
+          deadLetters: readExternalDead().length,
+          deadLettersLog: readExternalDead(),
+          health: externalHealth
         },
         // quick-decision bridge: 'active' is the only state in which approval
         // toasts carry working 同意/拒绝 buttons.
@@ -2048,7 +2388,7 @@
       soundOffHint: "「提示音」开关是关的：先打开它才能试听（关掉时提醒本身也确实不出声）。",
       soundPreviewSystem: "「系统通知音」是随通知由系统播放的，插件这边没有可播的音；已发一条测试提醒，声音就是它。",
       external: "外部通知",
-      externalHint: "把提醒同时推到 Discord / Bark / Gotify / 自定义 Webhook，人不在电脑前也能收到。与本地提醒同一套触发规则。",
+      externalHint: "把提醒同时推到 Discord / Bark / Gotify / 飞书 / Server酱 / WxPusher / 自定义 Webhook，人不在电脑前也能收到。与本地提醒同一套触发规则；投递失败会按 2 秒 / 6 秒自动重试，仍失败则记进失败记录。",
       externalEnable: "转发外部通知",
       externalEnableHint: "总开关：关闭后不向任何外部端点发送。",
       externalAttentionLabel: "转发「需要你」",
@@ -2056,17 +2396,41 @@
       externalDoneLabel: "转发「回复完成」",
       externalDoneHint: "回复跑完时一并推送到外部端点。",
       externalTargetsLabel: "推送目标",
-      externalTargetsHint: "可加多个。Discord 填 Webhook URL；Bark 填 https://api.day.app/<设备密钥>（自建填 http://<服务器>/<密钥>）；Gotify 填 https://<服务器>/message?token=<应用令牌>；自定义填任意收 JSON 的地址（POST：source / event / title / body / sessionId / time）。",
-      externalPrivacy: "提醒标题与正文（含会话名与摘要）会原样发到你填写的地址——只填你自己信任的端点。",
+      externalTargetsHint: "可加多个，每个目标可单独停用。飞书填群机器人 Webhook；Server酱 填 …/send/<SendKey>.send 完整地址（Turbo 与 Server酱³ 都行）；WxPusher 填 appToken 与接收者 UID；Discord 填 Webhook URL；Bark 填 https://api.day.app/<设备密钥>（自建填 http://<服务器>/<密钥>）；Gotify 填 https://<服务器>/message?token=<应用令牌>；自定义填任意收 JSON 的地址（POST：source / event / title / body / text / sessionId / time）。钉钉群机器人不在此列：它的接口不回 CORS 头、又只收 application/json，浏览器页面发不出去；要发钉钉请自建一个中转，用「自定义」指向它。",
+      externalPrivacy: "提醒标题与正文（含会话名与摘要）会原样发到你填写的地址——只填你自己信任的端点。自定义目标填了签名密钥时，请求会带 X-DSH-Notify-Signature（对请求体做 HMAC-SHA256）；该头会触发 CORS 预检，只对支持预检的接收端有效。飞书填了签名密钥时按官方算法在请求体里带 timestamp/sign。",
       externalTypeDiscord: "Discord Webhook",
       externalTypeBark: "Bark",
       externalTypeGotify: "Gotify",
+      externalTypeFeishu: "飞书群机器人",
+      externalTypeServerchan: "Server酱",
+      externalTypeWxpusher: "WxPusher",
       externalTypeCustom: "自定义 Webhook",
       externalUrlPlaceholder: "https://…",
       externalAdd: "添加目标",
       externalRemove: "删除这个目标",
       externalTypeField: "推送类型",
       externalUrlField: "推送地址",
+      externalTargetToggle: "启用或停用这个目标",
+      externalSecretField: "签名密钥",
+      externalSecretPlaceholderFeishu: "签名校验密钥（可选）",
+      externalSecretPlaceholderCustom: "HMAC 签名密钥（可选，留空不签名）",
+      externalTokenField: "appToken",
+      externalTokenPlaceholder: "AT_…",
+      externalUidField: "接收者 UID",
+      externalUidPlaceholder: "UID_…（多个用逗号分隔）",
+      externalTemplateField: "消息模板",
+      externalTemplatePlaceholder: "留空用默认：{{title}} 换行 {{body}}",
+      externalStatusNever: "尚未投递",
+      externalStatusSent: "上次成功",
+      externalStatusUnverified: "上次已送出（不可确认）",
+      externalStatusFailed: "上次失败",
+      externalDeadLabel: "失败记录",
+      externalDeadNone: "没有投递失败的记录。",
+      externalDeadHint: "彻底失败 ",
+      externalDeadUnit: " 条（最多保留 10 条，只记标题与正文摘要）",
+      externalDeadLast: "最后一条：",
+      externalDeadClear: "清空失败记录",
+      externalDeadCleared: "失败记录已清空。",
       externalEmpty: "还没有推送目标，点「添加目标」加一个。",
       externalTestLabel: "测一测外部通知",
       externalTestHint: "向上面所有推送目标各发一条测试消息（不受「转发」分类开关限制）。",
@@ -2173,7 +2537,7 @@
       soundOffHint: "The Sound switch is off: turn it on to preview (with it off the alerts themselves stay silent too).",
       soundPreviewSystem: "The system sound plays with a toast, not from the plugin — a test alert was sent instead; that sound is it.",
       external: "External notifications",
-      externalHint: "Also push alerts to Discord / Bark / Gotify / custom webhooks, so you hear about it away from the machine. Same trigger rules as local alerts.",
+      externalHint: "Also push alerts to Discord / Bark / Gotify / Feishu / ServerChan / WxPusher / custom webhooks, so you hear about it away from the machine. Same trigger rules as local alerts; a failed delivery is retried after 2 s and 6 s and, if it still fails, recorded in the failure log.",
       externalEnable: "Forward to external targets",
       externalEnableHint: "Master switch: when off, nothing is sent to any external endpoint.",
       externalAttentionLabel: "Forward \"needs you\"",
@@ -2181,17 +2545,41 @@
       externalDoneLabel: "Forward \"reply finished\"",
       externalDoneHint: "Push reply-finished alerts to the external endpoints too.",
       externalTargetsLabel: "Push targets",
-      externalTargetsHint: "Add as many as you like. Discord: the webhook URL; Bark: https://api.day.app/<device key> (self-hosted: http://<server>/<key>); Gotify: https://<server>/message?token=<app token>; custom: any endpoint accepting JSON (POST: source / event / title / body / sessionId / time).",
-      externalPrivacy: "The alert title and body (including the session name and snippet) are sent as-is to the address you enter — only use endpoints you trust.",
+      externalTargetsHint: "Add as many as you like; each one can be disabled on its own. Feishu: the group-bot webhook; ServerChan: the full .../send/<SendKey>.send URL (Turbo and ServerChan³ both work); WxPusher: the appToken and the receiver UID; Discord: the webhook URL; Bark: https://api.day.app/<device key> (self-hosted: http://<server>/<key>); Gotify: https://<server>/message?token=<app token>; custom: any endpoint accepting JSON (POST: source / event / title / body / text / sessionId / time). DingTalk is not on the list: its robot endpoint sends no CORS headers and only accepts application/json, so a page cannot post to it — relay it through your own box and point a custom target at that.",
+      externalPrivacy: "The alert title and body (including the session name and snippet) are sent as-is to the address you enter — only use endpoints you trust. When a custom target has a signing secret, the request carries X-DSH-Notify-Signature (HMAC-SHA256 over the body); that header triggers a CORS preflight, so it only works on a receiver that answers it. A Feishu target with a secret carries timestamp/sign in the body, per Feishu's own algorithm.",
       externalTypeDiscord: "Discord webhook",
       externalTypeBark: "Bark",
       externalTypeGotify: "Gotify",
+      externalTypeFeishu: "Feishu group bot",
+      externalTypeServerchan: "ServerChan",
+      externalTypeWxpusher: "WxPusher",
       externalTypeCustom: "Custom webhook",
       externalUrlPlaceholder: "https://…",
       externalAdd: "Add target",
       externalRemove: "Remove this target",
       externalTypeField: "Target type",
       externalUrlField: "Endpoint URL",
+      externalTargetToggle: "Enable or disable this target",
+      externalSecretField: "Signing secret",
+      externalSecretPlaceholderFeishu: "Verification secret (optional)",
+      externalSecretPlaceholderCustom: "HMAC signing secret (optional; empty = unsigned)",
+      externalTokenField: "appToken",
+      externalTokenPlaceholder: "AT_…",
+      externalUidField: "Receiver UID",
+      externalUidPlaceholder: "UID_… (comma-separated for several)",
+      externalTemplateField: "Message template",
+      externalTemplatePlaceholder: "Empty = default: {{title}} then {{body}}",
+      externalStatusNever: "not sent yet",
+      externalStatusSent: "last delivery ok",
+      externalStatusUnverified: "last delivery sent-unverified",
+      externalStatusFailed: "last delivery failed",
+      externalDeadLabel: "Failure log",
+      externalDeadNone: "No failed deliveries.",
+      externalDeadHint: "Failed ",
+      externalDeadUnit: " time(s) (10 kept at most; title and body snippet only)",
+      externalDeadLast: "Latest: ",
+      externalDeadClear: "Clear the failure log",
+      externalDeadCleared: "Failure log cleared.",
       externalEmpty: "No push targets yet — press \"Add target\" to create one.",
       externalTestLabel: "Test the external channel",
       externalTestHint: "Send one test message to every push target above (the per-kind forward toggles do not apply to this button).",
@@ -2366,6 +2754,12 @@
       ".dnm-file{font-size:12px;font-family:inherit;color:var(--dsw-alias-label-primary,rgba(20,20,20,.9));max-width:200px}" +
       ".dnm-targetRow{display:flex;align-items:center;gap:8px;padding:10px 14px;min-height:46px;box-sizing:border-box;flex-wrap:wrap}" +
       ".dnm-targetRow+.dnm-targetRow{border-top:1px solid var(--dsw-alias-border-l2,rgba(128,128,128,.35))}" +
+      // A target's secondary fields (signing secret, receiver id, template)
+      // hang under their row, same as dnm-rowSub does for the sound rows.
+      ".dnm-targetRowSub{padding-left:26px;background:var(--dsw-alias-bg-layer-2,rgba(128,128,128,.04))}" +
+      ".dnm-targetStatus{flex:none;max-width:230px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:12px;line-height:18px;color:var(--dsw-alias-label-tertiary,rgba(120,120,120,.9))}" +
+      ".dnm-targetStatus.ok{color:var(--dsw-alias-state-business-primary,#3b82f6)}" +
+      ".dnm-targetStatus.off{opacity:.55}" +
       ".dnm-input{flex:1;min-width:180px;border:1px solid var(--dsw-alias-border-l2,rgba(128,128,128,.4));background:var(--dsw-alias-bg-layer-1,rgba(255,255,255,.03));color:var(--dsw-alias-label-primary,rgba(20,20,20,.9));border-radius:8px;padding:5px 8px;font-size:12px;font-family:inherit}" +
       ".dnm-hint{font-size:12px;line-height:18px;color:var(--dsw-alias-label-tertiary,rgba(120,120,120,.9))}" +
       ".dnm-feedback{font-size:12px;line-height:18px;color:var(--dsw-alias-label-tertiary,rgba(120,120,120,.9));min-height:18px}" +
@@ -2731,31 +3125,72 @@
       // External forwarding rows. Target edits always patch with a fresh array
       // (readConfig may hand out the DEFAULTS entry itself; in-place mutation
       // would silently corrupt the defaults for the next reset).
+      var EXTERNAL_TYPE_OPTIONS = [
+        ["discord", "externalTypeDiscord"],
+        ["bark", "externalTypeBark"],
+        ["gotify", "externalTypeGotify"],
+        ["feishu", "externalTypeFeishu"],
+        ["serverchan", "externalTypeServerchan"],
+        ["wxpusher", "externalTypeWxpusher"],
+        ["custom", "externalTypeCustom"]
+      ];
+      // Last verdict for one target, as plain words. The record is written by
+      // the delivery engine on every send and survives a reload, so a target
+      // that has been silently failing says so where it is configured.
+      function externalStatusText(target) {
+        var rec = target && target.id ? externalHealth[target.id] : null;
+        if (!rec || !rec.at) return t("externalStatusNever");
+        var label = rec.status === "sent" ? t("externalStatusSent")
+          : rec.status === "unverified" ? t("externalStatusUnverified")
+            : t("externalStatusFailed");
+        var when = "";
+        try { when = new Date(rec.at).toLocaleTimeString(); } catch (e) { when = ""; }
+        var why = rec.status === "sent" || rec.status === "unverified" ? "" : (rec.reason ? " · " + rec.reason : "");
+        return label + why + (when ? " · " + when : "");
+      }
+      function targetField(field, i, value, placeholder, label) {
+        return h("input", {
+          className: "dnm-input",
+          value: value || "",
+          placeholder: placeholder,
+          "aria-label": label,
+          onChange: function (e) {
+            var fields = {};
+            fields[field] = e.currentTarget.value;
+            updateTarget(i, fields);
+          }
+        });
+      }
       function externalRows() {
         var rows = [];
         var targets = Array.isArray(cfg.externalTargets) ? cfg.externalTargets : [];
         for (var i = 0; i < targets.length; i++) {
           (function (i) {
             var target = targets[i] || {};
+            var type = externalType(target.type);
+            var enabled = target.enabled !== false;
+            var mainFields = type === "wxpusher"
+              ? targetField("token", i, target.token, t("externalTokenPlaceholder"), t("externalTokenField"))
+              : targetField("url", i, target.url, t("externalUrlPlaceholder"), t("externalUrlField"));
             rows.push(h("div", { className: "dnm-targetRow" }, [
               h("select", {
                 className: "dnm-select",
-                value: target.type || "custom",
+                value: type,
                 "aria-label": t("externalTypeField"),
                 onChange: function (e) { updateTarget(i, { type: e.currentTarget.value }); }
-              }, [
-                h("option", { value: "discord" }, t("externalTypeDiscord")),
-                h("option", { value: "bark" }, t("externalTypeBark")),
-                h("option", { value: "gotify" }, t("externalTypeGotify")),
-                h("option", { value: "custom" }, t("externalTypeCustom"))
-              ]),
-              h("input", {
-                className: "dnm-input",
-                value: target.url || "",
-                placeholder: t("externalUrlPlaceholder"),
-                "aria-label": t("externalUrlField"),
-                onChange: function (e) { updateTarget(i, { url: e.currentTarget.value }); }
-              }),
+              }, EXTERNAL_TYPE_OPTIONS.map(function (o) {
+                return h("option", { value: o[0] }, t(o[1]));
+              })),
+              mainFields,
+              h("span", { className: "dnm-targetStatus" + (enabled ? "" : " off") }, externalStatusText(target)),
+              h("button", {
+                type: "button",
+                role: "switch",
+                "aria-checked": enabled ? "true" : "false",
+                className: "dnm-switch" + (enabled ? " on" : ""),
+                "aria-label": t("externalTargetToggle"),
+                onClick: function () { updateTarget(i, { enabled: !enabled }); }
+              }, h("span", { className: "dnm-knob" })),
               h("button", {
                 type: "button",
                 className: "dnm-btn",
@@ -2763,10 +3198,49 @@
                 onClick: function () { removeTarget(i); }
               }, t("externalRemove"))
             ]));
+            // Fields that only some target types have. They live on their own
+            // line so the type select and the URL stay readable.
+            var sub = [];
+            if (type === "wxpusher") {
+              sub.push(targetField("uid", i, target.uid, t("externalUidPlaceholder"), t("externalUidField")));
+            }
+            if (type === "feishu" || type === "custom") {
+              var secretHint = type === "feishu" ? t("externalSecretPlaceholderFeishu")
+                : t("externalSecretPlaceholderCustom");
+              sub.push(targetField("secret", i, target.secret, secretHint, t("externalSecretField")));
+            }
+            if (type !== "discord" && type !== "bark" && type !== "gotify") {
+              sub.push(targetField("template", i, target.template, t("externalTemplatePlaceholder"), t("externalTemplateField")));
+            }
+            if (sub.length) rows.push(h("div", { className: "dnm-targetRow dnm-targetRowSub" }, sub));
           })(i);
         }
         return rows;
       }
+      // The persisted "these never made it" log: the alert was already shown
+      // locally, so this list is the only place a lost external delivery
+      // surfaces. Only a title/body snippet is kept, never the endpoint.
+      function deadLetterRow() {
+        var dead = readExternalDead();
+        var last = dead[0];
+        var text = dead.length
+          ? t("externalDeadHint") + dead.length + t("externalDeadUnit") + (last && last.at ? " · " + t("externalDeadLast") + (last.host ? last.host + " · " : "") + last.at : "")
+          : t("externalDeadNone");
+        return h("div", { className: "dnm-row" }, [
+          h("div", { className: "dnm-rowText" }, [
+            h("div", { className: "dnm-rowLabel" }, t("externalDeadLabel")),
+            h("div", { className: "dnm-hint" }, text)
+          ]),
+          dead.length ? h("div", { className: "dnm-btnRow" }, [
+            h("button", {
+              type: "button",
+              className: "dnm-btn",
+              "aria-label": t("externalDeadClear"),
+              onClick: function () { clearExternalDead(); setFeedback(t("externalDeadCleared")); patch({}); }
+            }, t("externalDeadClear"))
+          ]) : null
+        ]);
+      }
       function updateTarget(i, patchFields) {
         var list = (Array.isArray(cfg.externalTargets) ? cfg.externalTargets : []).slice();
         var cur = list[i] || {};
@@ -3029,6 +3503,7 @@
                 }, t("externalAdd"))
               ])
             ])],
+            [deadLetterRow()],
             [tipRow("dnm-row", t("externalTestHint"), [
               h("div", { className: "dnm-rowText" }, [
                 h("div", { className: "dnm-rowLabel" }, t("externalTestLabel")),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-notify-me",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "离开 DSH 页面也能收到提醒：需要你操作 / 后台回复完成时发系统通知、标题标记与提示音，支持审批快捷裁决与外部推送，Web 版与桌面版均可用。",
   "license": "MIT",
   "type": "module",
@@ -43,6 +43,9 @@
     "discord",
     "bark",
     "gotify",
+    "feishu",
+    "serverchan",
+    "wxpusher",
     "push-notification",
     "桌面通知",
     "消息提醒",