dsh-remote-web 0.7.12-beta.4 → 0.7.12-beta.5

package/lib/client.js

@@ -3593,7 +3593,7 @@ window.__ModuleLoader__.load({
       var imDingIdArr = useState(""); var imDingId = imDingIdArr[0]; var setImDingId = imDingIdArr[1];
       var imDingSecretArr = useState(""); var imDingSecret = imDingSecretArr[0]; var setImDingSecret = imDingSecretArr[1];
       var imDingRobotArr = useState(""); var imDingRobot = imDingRobotArr[0]; var setImDingRobot = imDingRobotArr[1];
-      // 钉钉扫码一键创建（2026-11-08）：authId/授权链接/等待态；手动配置默认折叠
+      // 钉钉扫码一键创建（2026-11-08，委托桥侧持久化授权）：本地只留等待态/链接/剩余时间；手动配置默认折叠
       var imDingAuthArr = useState(null); var imDingAuth = imDingAuthArr[0]; var setImDingAuth = imDingAuthArr[1];
       var imDingManualArr = useState(false); var imDingManual = imDingManualArr[0]; var setImDingManual = imDingManualArr[1];
       var imFeishuAppIdArr = useState(""); var imFeishuAppId = imFeishuAppIdArr[0]; var setImFeishuAppId = imFeishuAppIdArr[1];
@@ -6027,6 +6027,16 @@ window.__ModuleLoader__.load({
             var deps = b && b.status && b.status.deps && b.status.deps.feishu;
             if (deps) setImDeps(deps);
             loadImDeps();
+            // 授权会话在桥里持久化：重开面板时若仍在等待，恢复展示（URL/剩余时间从状态文件读）
+            api("/dsh-remote/im-dingtalk-auth/status").then(function (a) {
+              if (a && a.state === "waiting") {
+                setImDingAuth({
+                  phase: "waiting", url: String(a.url || ""), startedAt: Date.now(),
+                  expiresAt: Number(a.expiresAt) || (Date.now() + 15 * 60 * 1000),
+                  remainingSec: Number(a.remainingSec) || 0, error: ""
+                });
+              }
+            }).catch(function () { /* 忽略 */ });
           });
         }
         // 数据加载交给下面的 effect（按"弹层是否打开"触发）：
@@ -6745,28 +6755,24 @@ window.__ModuleLoader__.load({
         return IM_HUMAN_ERR[c] || "操作失败，请稍后重试";
       }
 
-      /** 钉钉扫码授权：开始（POST begin）→ 拿授权链接；deviceCode 只在服务端，不落浏览器。
-       *  轮询由**节点半后台**跑（关面板/刷新不影响），这里只查状态。 */
+      /** 钉钉扫码授权（2026-11-08 架构修正：委托桥侧持久化授权）。
+       *  面板只做三件事：写 begin 命令 → 轮询状态文件 → 展示。授权会话在桥那边落盘续轮询，
+       *  关面板/宿主重启都不会丢（用户"钉钉说成功、我们没接住"的根因）。 */
       function startDingAuth() {
         if (imPlatBusy) return;
         setImPlatBusy("auth");
         setImPlatMsg(null);
         setImPlatErr({});
         post("/dsh-remote/im-dingtalk-auth/begin", {}).then(function (b) {
-          if (!b || b.ok !== true || !b.url) {
+          if (!b || b.ok !== true) {
             setImDingAuth(null);
             setImPlatMsg({ kind: "err", text: "发起授权失败：" + imHumanErr(b && b.code, b && b.message) });
             return;
           }
-          var expiresIn = Math.max(60, Math.min(7200, Number(b.expiresIn) || 7200));
+          // begin 只写命令文件；URL/剩余时间要等桥跑完写进状态文件 → 由轮询拿
           setImDingAuth({
-            authId: String(b.authId || ""),
-            url: String(b.url || ""),
-            interval: Math.max(1, Math.min(10, Number(b.interval) || 3)),
-            expiresAt: Date.now() + expiresIn * 1000,
-            startedAt: Date.now(),
-            phase: "waiting",
-            error: ""
+            phase: "waiting", url: "", startedAt: Date.now(),
+            expiresAt: Date.now() + 15 * 60 * 1000, remainingSec: 0, error: ""
           });
         }).catch(function (e) {
           setImDingAuth(null);
@@ -6774,13 +6780,13 @@ window.__ModuleLoader__.load({
           setImPlatMsg({ kind: "err", text: "发起授权失败：" + imHumanErr(body.code || (e && e.code), body.message || (e && e.message)) });
         }).finally(function () { setImPlatBusy(""); });
       }
-      /** 查询一次授权状态；manual=true = 用户点「我已完成授权，检查一下」（立刻让服务端补轮一次）。 */
+      /** 读一次桥写的授权进度（GET status → 状态文件；不自己 poll 钉钉）。 */
       function pollDingAuth(manual) {
         var a = imDingAuth;
-        if (!a || !a.authId || a.phase !== "waiting") return;
-        var qs = "?id=" + encodeURIComponent(a.authId) + (manual ? "&check=1" : "");
-        api("/dsh-remote/im-dingtalk-auth/status" + qs).then(function (b) {
-          if (b && b.status === "success") {
+        if (!a || a.phase !== "waiting") return;
+        api("/dsh-remote/im-dingtalk-auth/status").then(function (b) {
+          var st2 = String((b && b.state) || "idle");
+          if (st2 === "success") {
             setImDingAuth(null);   // 成功后自动收起授权块
             setImPlatMsg({
               kind: "ok",
@@ -6789,31 +6795,49 @@ window.__ModuleLoader__.load({
             loadImBots();
             return;
           }
-          if (b && (b.status === "failed" || b.status === "expired")) {
-            setImDingAuth({ authId: a.authId, url: a.url, interval: a.interval, expiresAt: a.expiresAt, startedAt: a.startedAt, phase: "failed", error: imHumanErr(b.code, b.message) });
+          if (st2 === "failed" || st2 === "expired") {
+            setImDingAuth({
+              phase: "failed", url: a.url, startedAt: a.startedAt, expiresAt: a.expiresAt,
+              remainingSec: 0, error: imHumanErr(st2, b && b.message)
+            });
             return;
           }
-          // waiting：换新对象触发下一轮（服务端后台仍在推进，这里只负责刷新展示）
-          setImDingAuth({ authId: a.authId, url: a.url, interval: a.interval, expiresAt: a.expiresAt, startedAt: a.startedAt, phase: "waiting", error: "", polledAt: Date.now() });
+          // waiting / idle（桥还没开始）：刷新 url 与剩余时间，继续等
+          setImDingAuth({
+            phase: "waiting",
+            url: String((b && b.url) || a.url || ""),
+            startedAt: a.startedAt || Date.now(),
+            expiresAt: Number(b && b.expiresAt) || a.expiresAt || (Date.now() + 15 * 60 * 1000),
+            remainingSec: Number(b && b.remainingSec) || 0,
+            error: "", polledAt: Date.now()
+          });
         }).catch(function (e) {
-          // 网络抖动：不打断等待（手动按钮仍在），仅在自动轮询里静默
           if (manual) {
             var body = (e && e.body) || {};
             setImPlatMsg({ kind: "warn", text: "检查失败：" + imHumanErr(body.code, body.message || (e && e.message)) + "（可再试）" });
           }
         });
       }
-      /** 等待确认中：自动轮询 ~3s/次；**最多自动轮 10 分钟**，之后保留状态由用户手动检查。 */
+      /** 等待确认中：每 2s 读一次状态（桥后台在推进）；**最多自动看 15 分钟后停止**，手动按钮仍在。 */
       useEffect(function () {
         if (iaModal !== "channel" || iaChStep !== "dingtalk") return undefined;
         if (!imDingAuth || imDingAuth.phase !== "waiting") return undefined;
         var waited = Date.now() - (imDingAuth.startedAt || Date.now());
-        if (waited > 10 * 60 * 1000) return undefined;   // 停止自动轮询（不再"2 分钟就判死"）
+        if (waited > 15 * 60 * 1000) return undefined;
         var t = null;
-        try { t = setTimeout(function () { pollDingAuth(false); }, Math.max(1000, (imDingAuth.interval || 3) * 1000)); } catch (e) { /* 忽略 */ }
+        try { t = setTimeout(function () { pollDingAuth(false); }, 2000); } catch (e) { /* 忽略 */ }
         return function () { try { if (t) clearTimeout(t); } catch (e) { /* 忽略 */ } };
       }, [iaModal, iaChStep, imDingAuth]);
 
+      /** 取消授权：写 cancel 命令（桥停轮询 + 删持久化会话）。 */
+      function cancelDingAuth() {
+        post("/dsh-remote/im-dingtalk-auth/cancel", {}).catch(function () { /* 桥不在也不影响面板收起 */ })
+          .finally(function () {
+            setImDingAuth(null);
+            setImPlatMsg({ kind: "ok", text: "已取消本次扫码授权" });
+          });
+      }
+
       /** 钉钉手动创建 7 步（2026-11-08 业主给的官方链接；每步一句 + 链接）。 */
       var DINGTALK_STEPS = [
         { t: "用钉钉账号登录开发者后台", url: "https://open-dev.dingtalk.com/" },
@@ -6849,6 +6873,7 @@ window.__ModuleLoader__.load({
         var st = (imBots && imBots.status && imBots.status.dingtalk) || {};
         var err = imPlatErr || {};
         var auth = imDingAuth;
+        var authStatus = st.auth || {};
         var sourceText = (st.credentialSource || d.credentialSource) === "scan" ? "扫码创建"
           : (st.credentialSource || d.credentialSource) === "manual" ? "手动填写" : "";
         var clientTail = String(d.clientId || "").length > 4 ? String(d.clientId).slice(-4) : String(d.clientId || "");
@@ -6881,6 +6906,13 @@ window.__ModuleLoader__.load({
           //   · 有凭据/已连接 → 「已连接 · Client ID 尾号 · 来源：…」
           (function () {
             var configured = !!d.enabled || !!d.hasSecret || !!String(d.credentialSource || "").trim();
+            // 授权会话状态优先：failed/expired 是"授权"失败，不是"连接"失败（措辞不能混）
+            if (authStatus.state === "failed") {
+              return h("div", { className: "dru-ia-state is-err", role: "status" }, "授权失败：" + imHumanErr("", String(authStatus.message || "")));
+            }
+            if (authStatus.state === "expired") {
+              return h("div", { className: "dru-ia-state is-warn", role: "status" }, "授权已过期：" + imHumanErr("expired", String(authStatus.message || "")) + "（点下方按钮可重新获取链接）");
+            }
             var failState = st.state === "failed" || st.state === "error";
             if (!configured) return h("div", { className: "dru-ia-state" }, druIcon("chat"), "未配置：点下方按钮扫码创建机器人");
             if (failState) {
@@ -6892,38 +6924,43 @@ window.__ModuleLoader__.load({
             if (st.connected) return h("div", { className: "dru-ia-state is-ok" }, druIcon("check"), "已连接" + tailBit + srcBit);
             return h("div", { className: "dru-ia-state" }, druIcon("chat"), "已保存凭据，等待连接…" + tailBit + srcBit);
           })(),
-          // 扫码授权中：链接 + 提示 + 复制/打开（无 QR 库 → 降级，明确告知用手机钉钉扫码）
+          // 扫码授权中（桥侧持久化：begin 只写命令，URL 等桥跑完写进状态 → 轮询拿）
           (auth && auth.phase === "waiting")
             ? h("div", { className: "dru-ia-field" },
                 h("div", { className: "dru-ia-state", role: "status" }, h("span", { className: "dru-spin" }),
-                  "等待你在钉钉里确认…（用手机钉钉扫下方链接，或复制到手机打开）"),
+                  !auth.url
+                    ? "正在生成授权链接…（桥正在创建，约需几秒）"
+                    : (auth.remainingSec > 0
+                        ? "等待你在钉钉里确认…（剩余约 " + Math.max(1, Math.round(auth.remainingSec / 60)) + " 分钟；用手机钉钉扫码或打开链接）"
+                        : "等待你在钉钉里确认…（用手机钉钉扫码，或复制链接到手机打开）")),
+                h("div", { className: "dru-ia-hint" }, "关掉面板也不影响：桥会继续等你在钉钉里确认，回来点「我已完成授权，检查一下」即可。"),
                 (function () {
                   var waitedMin = Math.floor((Date.now() - (auth.startedAt || Date.now())) / 60000);
-                  return h("div", { className: "dru-ia-hint" },
-                    waitedMin >= 10
-                      ? "已等待 " + waitedMin + " 分钟：自动刷新先停下（后台仍在继续），完成授权后点「我已完成授权，检查一下」。"
-                      : "授权链接 2 小时内有效；关掉面板也不影响，回来点「我已完成授权，检查一下」即可。");
+                  return waitedMin >= 15
+                    ? h("div", { className: "dru-ia-hint" }, "已等待 " + waitedMin + " 分钟：自动刷新先停下（桥仍在继续），完成确认后点「我已完成授权，检查一下」。")
+                    : null;
                 })(),
-                h("button", {
-                  type: "button", className: "dru-ia-btn is-primary", style: { alignSelf: "flex-start" },
-                  onClick: function () { pollDingAuth(true); }
-                }, "我已完成授权，检查一下"),
-                h("div", { className: "dru-copy-row" },
-                  h("div", { className: "dru-copy-box" },
-                    h("span", { className: "dru-link-val" }, auth.url),
-                    h("button", {
-                      type: "button", className: "dru-copy-btn", "aria-label": "复制授权链接",
-                      onClick: function () {
-                        copyText(auth.url).then(function (ok) { if (!ok) setImPlatMsg({ kind: "err", text: "复制失败：请手动选中链接复制" }); });
-                      }
-                    }, "复制授权链接")),
-                  h("div", { className: "dru-actions", style: { marginTop: 8 } },
-                    h("a", { className: "dru-ia-btn is-primary", href: auth.url, target: "_blank", rel: "noopener" }, "在浏览器打开授权页"),
-                    h("button", { type: "button", className: "dru-ia-btn", onClick: function () { setImDingAuth(null); setImPlatMsg({ kind: "ok", text: "已取消本次扫码授权" }); } }, "取消授权"))))
+                auth.url
+                  ? h("div", { className: "dru-copy-row" },
+                      h("div", { className: "dru-copy-box" },
+                        h("span", { className: "dru-link-val" }, auth.url),
+                        h("button", {
+                          type: "button", className: "dru-copy-btn", "aria-label": "复制授权链接",
+                          onClick: function () {
+                            copyText(auth.url).then(function (ok) { if (!ok) setImPlatMsg({ kind: "err", text: "复制失败：请手动选中链接复制" }); });
+                          }
+                        }, "复制授权链接")),
+                      h("div", { className: "dru-actions", style: { marginTop: 8 } },
+                        h("a", { className: "dru-ia-btn is-primary", href: auth.url, target: "_blank", rel: "noopener" }, "在浏览器打开授权页"),
+                        h("button", { type: "button", className: "dru-ia-btn is-primary", onClick: function () { pollDingAuth(true); } }, "我已完成授权，检查一下"),
+                        h("button", { type: "button", className: "dru-ia-btn", onClick: cancelDingAuth }, "取消授权")))
+                  : h("div", { className: "dru-actions", style: { marginTop: 8 } },
+                      h("button", { type: "button", className: "dru-ia-btn is-primary", onClick: function () { pollDingAuth(true); } }, "我已完成授权，检查一下"),
+                      h("button", { type: "button", className: "dru-ia-btn", onClick: cancelDingAuth }, "取消授权")))
             : null,
           (auth && auth.phase === "failed")
             ? h("div", { className: "dru-ia-field" },
-                h("div", { className: "dru-ia-state is-err", role: "alert" }, auth.error || "授权失败"),
+                h("div", { className: "dru-ia-state is-err", role: "alert" }, "授权失败：" + (imHumanErr("", auth.error) || "请重试")),
                 h("button", { type: "button", className: "dru-ia-btn", onClick: function () { startDingAuth(); } }, "重试扫码授权"))
             : null,
           // 能力：主动推送 / 卡片（缺 Robot Code 时置灰，提示补 Robot Code）

package/lib/index.js

@@ -7802,7 +7802,7 @@ function imBotsView(relayDir) {
       sdkVersion: feishuCfgOf(bots).sdkVersion,
     },
     status: Object.assign({}, wecomStatusOf(stFile), {
-      dingtalk: imPlatformStatusOf(stFile, "dingtalk"),
+      dingtalk: Object.assign(imPlatformStatusOf(stFile, "dingtalk"), { auth: imDingtalkAuthStatusOf(relayDir) }),
       feishu: imPlatformStatusOf(stFile, "feishu"),
       deps: { feishu: feishuDepsInfo(relayDir) },
     }),
@@ -8095,211 +8095,61 @@ function startFeishuInstall(relayDir, opts = {}) {
   return { ok: true, started: true, taskId, deps: { feishu: feishuDepsInfo(relayDir) } };
 }
 
-// ── 钉钉「扫码一键创建机器人」（2026-11-08，官方 connector 同款 device-flow）─────────────
-// 流程（服务端代跑，device_code 只存内存、不下发浏览器）：
-//   POST .../app/registration/init  {source:"DING_DWS_CLAW"} → {nonce}
-//   POST .../app/registration/begin {nonce}                 → {device_code, verification_uri_complete, interval, expires_in}
-//   POST .../app/registration/poll  {device_code}           → {status:"WAITING"|"SUCCESS", client_id, client_secret}
-//
-// ★ 2026-11-08 生产实测修正（业主）：**轮询必须在节点半后台跑**，面板只查状态。
-//   原实现让面板每 2s 轮询、还把 TTL 设成 2 分钟 —— 但钉钉 device-flow 的 expires_in 是 7200 秒，
-//   用户「点按钮→手机扫码→页面加载→点一键创建」很容易超过 2 分钟 → 被误判过期。
-//   现在：begin 即启动 setInterval(~3s) 后台轮询，关闭面板/刷新页面都不影响；TTL 按钉钉 expires_in。
-const DINGTALK_REG_BASE = "https://oapi.dingtalk.com/app/registration";
-const DINGTALK_AUTH_TTL_MS = 7200 * 1000;          // 兜底上限：钉钉 device-flow 的 expires_in（7200s）
-const DINGTALK_AUTH_POLL_MS = 3000;                // 后台轮询间隔（测试可用 config.imAuthPollMs 覆盖）
-const dingtalkAuthSessions = new Map();            // authId → session（含后台 timer，绝不落盘）
-const dingtalkAuthSuperseded = new Map();          // 被新授权作废的 authId → at（查询时回 cancelled）
-
-/** 面向用户的中文人话（错误里**绝不出现裸 code / 裸 ok**）。 */
+// ── 钉钉「扫码一键创建机器人」：**委托桥侧持久化授权**（2026-11-08 架构修正）────────────
+// 生产踩坑：授权会话曾经存在插件进程内存里 —— 宿主重启/面板关掉就丢，用户遇到
+// 「钉钉说连接成功、我们没接住」。现在插件**不碰钉钉接口、不存内存会话**：
+//   · 插件写命令文件 <relayDir>/im-dingtalk-auth-cmd.json {action:"begin"|"cancel", at}
+//   · 桥（clients/dsh-remote/dingtalk-auth.mjs）持久化 device_code 并断点续轮询，处理完删命令文件
+//   · 桥把进度写进 im-bot-status.json 的 dingtalk.auth = {state,url,expiresAt,remainingSec,clientIdTail,message}
+//   · 成功后桥**自己**写 im-bots.json 的 dingtalk 段并连上 —— 插件只读状态
+const IM_DINGTALK_AUTH_CMD_FILE = "im-dingtalk-auth-cmd.json";
+
+/** 面向用户的中文人话（错误里**绝不出现裸 code / 裸 ok / errcode**）。 */
 const DINGTALK_AUTH_MSG = {
   network_error: "连不上钉钉接口，请检查网络后重试",
   dingtalk_api_rejected: "钉钉拒绝了请求，请稍后重试",
   expired: "授权已过期，请点「重试扫码」生成新的授权链接",
-  cancelled: "这次授权已被新的授权取代，请用最新链接完成确认",
+  cancelled: "这次授权已取消，请重新发起",
   write_failed: "拿到的凭据保存失败（磁盘/权限问题），请检查后重试"
 };
 function dingTalkHumanMessage(code, fallbackMessage) {
   const c = String(code || "");
   const msg = String(fallbackMessage || "").trim();
-  // 只接受"看起来是人话"的 message：含中文、且不是裸 code/ok/JSON 片段
   const looksHuman = /[\u4e00-\u9fa5]/.test(msg) && !/^\s*[{[]/.test(msg);
   if (looksHuman) return msg;
   if (DINGTALK_AUTH_MSG[c]) return DINGTALK_AUTH_MSG[c];
   return "操作失败，请稍后重试";
 }
 
-function jsonPostForAuth(fetchImpl, url, payload) {
-  return fetchImpl(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(payload || {}),
-    signal: AbortSignal.timeout(8000),
-  }).then(async (r) => {
-    let body = null;
-    try { body = await r.json(); } catch { body = null; }
-    return { ok: !!r.ok, status: r.status, body: body || {} };
-  });
-}
-
-/** 后台轮询一次（同一 session 不并发；成功后写盘并停表）。 */
-async function dingtalkAuthPollOnce(authId, opts = {}) {
-  const sess = dingtalkAuthSessions.get(String(authId || ""));
-  if (!sess || sess.inFlight) return sess;
-  if (sess.state !== "waiting") return sess;
-  if (Date.now() > sess.expiresAt) {
-    sess.state = "expired";
-    sess.message = dingTalkHumanMessage("expired");
-    stopDingAuthTimer(sess);
-    return sess;
-  }
-  const fetchImpl = typeof opts.imAuthFetch === "function" ? opts.imAuthFetch : fetch;
-  sess.inFlight = true;
-  try {
-    const r = await jsonPostForAuth(fetchImpl, `${DINGTALK_REG_BASE}/poll`, { device_code: sess.deviceCode });
-    const b = r.body || {};
-    const st = String(b.status || "").toUpperCase();
-    if (st === "WAITING" || st === "PENDING") return sess;
-    if (st === "SUCCESS" || (b.client_id && b.client_secret)) {
-      const saved = saveDingtalkScannedCredentials(sess.relayDir, b.client_id, b.client_secret);
-      if (!saved.ok) {
-        sess.state = "failed";
-        sess.message = dingTalkHumanMessage(saved.code, saved.message);
-      } else {
-        const cid = String(b.client_id || "");
-        sess.state = "success";
-        sess.clientIdTail = cid.length > 4 ? cid.slice(-4) : cid;
-        sess.credentialSource = "scan";
-      }
-      stopDingAuthTimer(sess);
-      return sess;
-    }
-    // 钉钉明确拒绝（创建被取消/参数过期等）：用中文人话，绝不把 errmsg 裸值直接渲染
-    sess.state = "failed";
-    sess.message = dingTalkHumanMessage("dingtalk_api_rejected", b.message || b.errmsg);
-    stopDingAuthTimer(sess);
-    return sess;
-  } catch (e) {
-    // 网络抖动**不作废授权**（后台继续轮询直到 expires_in）—— 只有明确拒绝/过期才终止。
-    return sess;
-  } finally {
-    sess.inFlight = false;
-  }
-}
-
-function stopDingAuthTimer(sess) {
-  if (!sess) return;
-  try { if (sess.timer) clearInterval(sess.timer); } catch { /* 忽略 */ }
-  sess.timer = null;
-}
-
-/**
- * 开始一次钉钉扫码授权（POST /dsh-remote/im-dingtalk-auth/begin）。
- * 同一 relayDir 同时只保留一个会话：begin 时把旧的作废（旧 authId 后续查询回 cancelled）。
- * TTL 按钉钉返回的 expires_in（生产实测 7200s），后台 setInterval 轮询，关闭面板不影响。
- */
-async function beginDingtalkAuth(relayDir, opts = {}) {
-  const fetchImpl = typeof opts.imAuthFetch === "function" ? opts.imAuthFetch : fetch;
-  // 作废旧会话（同时停掉它们的后台轮询表）
-  for (const [id, sess] of dingtalkAuthSessions) {
-    if (sess.relayDir === relayDir) {
-      stopDingAuthTimer(sess);
-      dingtalkAuthSessions.delete(id);
-      dingtalkAuthSuperseded.set(id, Date.now());
-    }
-  }
-  while (dingtalkAuthSuperseded.size > 20) {
-    const first = dingtalkAuthSuperseded.keys().next().value;
-    dingtalkAuthSuperseded.delete(first);
-  }
-  let init;
-  try {
-    init = await jsonPostForAuth(fetchImpl, `${DINGTALK_REG_BASE}/init`, { source: "DING_DWS_CLAW" });
-  } catch {
-    return { ok: false, code: "network_error", message: dingTalkHumanMessage("network_error") };
-  }
-  const nonce = init.ok && init.body && typeof init.body.nonce === "string" ? init.body.nonce : "";
-  if (!nonce) return { ok: false, code: "dingtalk_api_rejected", message: dingTalkHumanMessage("dingtalk_api_rejected") };
-  let begin;
-  try {
-    begin = await jsonPostForAuth(fetchImpl, `${DINGTALK_REG_BASE}/begin`, { nonce });
-  } catch {
-    return { ok: false, code: "network_error", message: dingTalkHumanMessage("network_error") };
-  }
-  const b = begin.body || {};
-  const deviceCode = typeof b.device_code === "string" ? b.device_code : "";
-  const url = typeof b.verification_uri_complete === "string" ? b.verification_uri_complete : "";
-  if (!begin.ok || !deviceCode || !url) {
-    return { ok: false, code: "dingtalk_api_rejected", message: dingTalkHumanMessage("dingtalk_api_rejected") };
-  }
-  const authId = `ding-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-  const interval = Math.max(1, Math.min(10, Number(b.interval) || 3));
-  // ★ TTL 用钉钉的 expires_in（生产 7200s），不再用以前写死的 2 分钟
-  const expiresIn = Math.max(60, Math.min(7200, Number(b.expires_in) || 7200));
-  const now = Date.now();
-  const sess = {
-    relayDir, deviceCode, url, interval,
-    createdAt: now,
-    expiresAt: Math.min(now + expiresIn * 1000, now + DINGTALK_AUTH_TTL_MS),
-    state: "waiting", message: "", inFlight: false, timer: null, clientIdTail: "", credentialSource: ""
-  };
-  // 启动后台轮询：面板关掉/刷新都不影响，用户 2 小时内确认都能成功
-  const pollMs = Math.max(10, Number(opts.imAuthPollMs) || DINGTALK_AUTH_POLL_MS);
-  try {
-    sess.timer = setInterval(() => { void dingtalkAuthPollOnce(authId, opts); }, pollMs);
-    sess.timer.unref?.();
-  } catch { sess.timer = null; }
-  dingtalkAuthSessions.set(authId, sess);
-  return { ok: true, authId, url, interval, expiresIn };
+/** 原子写命令文件（0600；桥是另一个进程，tmp+rename 防半写）。 */
+function writeDingtalkAuthCmd(relayDir, action) {
+  const file = join(relayDir, IM_DINGTALK_AUTH_CMD_FILE);
+  const tmp = `${file}.tmp`;
+  mkdirSync(relayDir, { recursive: true });
+  writeFileSync(tmp, JSON.stringify({ action, at: Date.now() }) + "\n", { mode: 0o600 });
+  try { chmodSync(tmp, 0o600); } catch { /* 非 POSIX */ }
+  renameSync(tmp, file);
+  try { chmodSync(file, 0o600); } catch { /* 忽略 */ }
+  return { ok: true };
 }
 
-/** 把扫码拿到的凭据写进 im-bots.json 的 dingtalk 段（0600 原子写；保留其它字段，自动 enabled）。 */
-function saveDingtalkScannedCredentials(relayDir, clientId, clientSecret) {
-  const bots = readImBots(relayDir);
-  const cur = dingtalkCfgOf(bots);
-  const next = {
-    ...cur,
-    enabled: true,
-    clientId: String(clientId || "").trim(),
-    clientSecret: String(clientSecret || "").trim(),
-    // 扫码流程只给 client_id/client_secret；robotCode 由桥连上后自动补齐/发现
-    credentialSource: "scan",
+/** 读桥写的授权进度（im-bot-status.json 的 dingtalk.auth；白名单 + 人话兜底）。 */
+function imDingtalkAuthStatusOf(relayDir) {
+  const st = readImBotStatus(relayDir);
+  const d = st && st.dingtalk && typeof st.dingtalk === "object" ? st.dingtalk : {};
+  const a = d.auth && typeof d.auth === "object" ? d.auth : {};
+  const states = ["idle", "waiting", "success", "failed", "expired"];
+  const state = states.includes(strOf(a.state)) ? strOf(a.state) : "idle";
+  const url = strOf(a.url);
+  return {
+    state,
+    // 只透出 https 链接（防止状态文件里塞 javascript:/data: 之类被面板当链接渲染）
+    url: /^https:\/\/[^\s]+$/i.test(url) ? url.slice(0, 2000) : "",
+    expiresAt: numOf(a.expiresAt),
+    remainingSec: numOf(a.remainingSec) || numOf(a.remainingSeconds),
+    clientIdTail: strOf(a.clientIdTail).slice(0, 20),
+    message: state === "idle" ? "" : dingTalkHumanMessage(state === "success" ? "" : state, a.message)
   };
-  try {
-    writeImBots(relayDir, { ...bots, version: 1, dingtalk: next });
-    return { ok: true };
-  } catch (e) {
-    return { ok: false, code: "write_failed", message: dingTalkHumanMessage("write_failed", `保存扫码凭据失败：${e?.message || e}`) };
-  }
-}
-
-/**
- * 查询扫码授权状态（GET /dsh-remote/im-dingtalk-auth/status?id=...&check=1）。
- * 默认只读后台轮询的结论；check=1（面板「我已完成授权，检查一下」）会**立刻补轮一次**再返回。
- * success 时凭据已经写盘，响应只回脱敏信息（绝不回 secret）。
- */
-async function dingtalkAuthStatus(authId, opts = {}) {
-  const key = String(authId || "");
-  const sess = dingtalkAuthSessions.get(key);
-  if (!sess) {
-    if (dingtalkAuthSuperseded.has(key)) {
-      dingtalkAuthSuperseded.delete(key);
-      return { ok: false, status: "failed", code: "cancelled", message: dingTalkHumanMessage("cancelled") };
-    }
-    return { ok: false, status: "expired", code: "expired", message: dingTalkHumanMessage("expired") };
-  }
-  if (opts.check === true && sess.state === "waiting") {
-    await dingtalkAuthPollOnce(key, opts);
-  }
-  if (sess.state === "waiting") return { ok: true, status: "waiting" };
-  if (sess.state === "success") {
-    return {
-      ok: true, status: "success", credentialSource: "scan",
-      clientIdTail: sess.clientIdTail || "", hasSecret: true
-    };
-  }
-  if (sess.state === "expired") return { ok: false, status: "expired", code: "expired", message: dingTalkHumanMessage("expired", sess.message) };
-  return { ok: false, status: "failed", code: "dingtalk_api_rejected", message: dingTalkHumanMessage("dingtalk_api_rejected", sess.message) };
 }
 
 /** 保存 dingtalk 配置（空 secret = 不修改；凭据完整性在返回里说清）。 */
@@ -9296,25 +9146,38 @@ function registerRoutes(ctx, relayDir, opts = {}) {
       },
     },
     {
-      // 钉钉扫码一键创建机器人：开始授权（返回授权链接；device_code 只存服务端内存）
+      // 钉钉扫码一键创建：**只写命令文件**（桥持久化 device_code 并断点续轮询）。
+      // 不返回 URL —— URL 由桥跑完写进状态文件，面板轮询 GET status 拿。
       method: "POST",
       path: "/dsh-remote/im-dingtalk-auth/begin",
       handler: async (_req, res) => {
-        const r = await beginDingtalkAuth(relayDir, { imAuthFetch: opts.imAuthFetch, imAuthPollMs: opts.imAuthPollMs });
-        sendJson(res, r.ok ? 200 : 502, r);
+        try {
+          writeDingtalkAuthCmd(relayDir, "begin");
+          sendJson(res, 200, { ok: true });
+        } catch (e) {
+          sendJson(res, 500, { ok: false, code: "write_failed", message: dingTalkHumanMessage("write_failed", `写入授权命令失败：${e?.message || e}`) });
+        }
       },
     },
     {
-      // 轮询授权状态：waiting / success（已写盘，只回脱敏结果）/ failed / expired
+      // 取消授权：写 cancel 命令（桥停轮询 + 删 auth 持久文件）
+      method: "POST",
+      path: "/dsh-remote/im-dingtalk-auth/cancel",
+      handler: async (_req, res) => {
+        try {
+          writeDingtalkAuthCmd(relayDir, "cancel");
+          sendJson(res, 200, { ok: true });
+        } catch (e) {
+          sendJson(res, 500, { ok: false, code: "write_failed", message: dingTalkHumanMessage("write_failed", `写入取消命令失败：${e?.message || e}`) });
+        }
+      },
+    },
+    {
+      // 授权进度：**直接读状态文件**（不自己 poll 钉钉）→ idle/waiting/success/failed/expired
       method: "GET",
       path: "/dsh-remote/im-dingtalk-auth/status",
-      handler: async (req, res) => {
-        const url = new URL(req.url ?? "/", "http://x");
-        const r = await dingtalkAuthStatus(url.searchParams.get("id") || "", {
-          imAuthFetch: opts.imAuthFetch,
-          check: url.searchParams.get("check") === "1"
-        });
-        sendJson(res, 200, r);
+      handler: async (_req, res) => {
+        sendJson(res, 200, { ok: true, ...imDingtalkAuthStatusOf(relayDir) });
       },
     },
     {
@@ -9705,9 +9568,6 @@ export function apply(ctx, config = {}) {
     imBotsWaitMs: Number(config.imBotsWaitMs) || undefined,
     // 测试钩子：飞书 SDK 安装的 npm spawn（用例注入假实现，**绝不真的联网装包**）。
     imDepsSpawn: typeof config.imDepsSpawn === "function" ? config.imDepsSpawn : undefined,
-    // 测试钩子：钉钉扫码授权的 fetch（用例注入假实现，**绝不真的打钉钉接口**）+ 后台轮询间隔。
-    imAuthFetch: typeof config.imAuthFetch === "function" ? config.imAuthFetch : undefined,
-    imAuthPollMs: Number(config.imAuthPollMs) || undefined,
   }), "dsh-remote-web: /dsh-remote routes");
   // 0.1.2-rc.1+ 浏览器会话代持：换取 Harness 会话 Cookie 供 bridge 上游携带（手机点设备不再 401 白页）
   ctx.effect(() => scheduleHarnessMint(ctx, relayDir), "dsh-remote-web: harness browser-session mint");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-web",
-  "version": "0.7.12-beta.4",
+  "version": "0.7.12-beta.5",
   "description": "公网远程控制 DeepSeek Harness（dsh web）：安装即得专属加密地址，人在外面也能用手机访问电脑上的 dsh——无需同一局域网/WiFi、无需公网 IP 与内网穿透，全程加密；手机端 100% 还原电脑体验（对话/工具/审批/设置）。技术用户可选自建服务，流量走自己的服务器。Remote control DeepSeek Harness (dsh web) from anywhere over the public internet — install, get an encrypted URL, use it from your phone on any network (dual-half cordis plugin: Settings panel + same-origin /dsh-remote routes). (2026-09 由 dsh-remote-ui 更名 / renamed from dsh-remote-ui; dsh-remote 的 dsh web 插件半，不是纯 UI/皮肤插件)",
   "type": "module",
   "main": "lib/index.js",

package/runtime/clients/dsh-remote/dingtalk-auth.mjs

@@ -0,0 +1,631 @@
+/**
+ * dingtalk-auth — 钉钉「扫码一键创建机器人」授权会话的**持久化 + 断点续轮询**（2026-11-08）。
+ *
+ * 要解决的根因
+ * -----------------------------------------------------------------
+ * 官方 connector 的授权是标准 device-flow：
+ *   POST /app/registration/init  {source:"DING_DWS_CLAW"} → {nonce}
+ *   POST /app/registration/begin {nonce}                 → {device_code, verification_uri_complete, interval, expires_in}
+ *   POST /app/registration/poll  {device_code}           → {status:"WAITING"|"SUCCESS", client_id, client_secret}
+ *
+ * 凭据**只在 poll 返回 SUCCESS 的那一次**给出。如果 device_code 只存在进程内存里（插件进程/面板关掉/宿主重启），
+ * 授权会话就丢了 —— 钉钉侧显示「连接成功」、机器人也建好了，但我们永远接不住凭据，用户只能去控制台重新复制。
+ *
+ * 本模块因此把授权会话**原子落盘**到 `<relayDir>/im-dingtalk-auth.json`（0600），
+ * bridge 启动时 `resumeDingtalkAuth()` 继续按 interval 轮询；拿到凭据后写 `im-bots.json` 的 dingtalk 段、
+ * 删除 auth 文件、写状态 `dingtalk.state="connected"`，随后现有 controller 的热更新会真正把机器人连上。
+ *
+ * 安全
+ * -----------------------------------------------------------------
+ *   · auth 文件含 device_code（等价于"授权票据"）→ 0600，且**不写状态文件**、不进日志。
+ *   · 拿到的 clientSecret 只写 im-bots.json（0600 原子写），日志只打 clientId 尾号。
+ *
+ * 对插件暴露的接口（插件侧改为委托调用，2026-11-08 Lead 确认）：
+ *   beginDingtalkAuth({relayDir, fetchImpl})   → {ok, url, expiresIn, interval, expiresAt}
+ *   authStatus({relayDir})                     → {ok, status:"idle|waiting|success|failed|expired", remainingSeconds, url?, message?, clientIdTail?}
+ *   cancelDingtalkAuth({relayDir})             → {ok:true}（停轮询 + 删 auth 文件）
+ *   resumeDingtalkAuth({relayDir, fetchImpl, onSuccess}) → bridge 启动时调用（fire-and-forget 也安全）
+ *   stopDingtalkAuthPolling()                  → 只停定时器（**保留** auth 文件，供下次启动续轮询）
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+import {
+  IM_BOTS_FILE,
+  IM_BOT_STATUS_FILE,
+  atomicWriteJson,
+  createScopedLogger,
+  readJsonFile,
+  truncateText
+} from "./wecom-bot.mjs";
+
+/** 授权会话文件（相对 relayDir；0600；含 device_code，绝不进状态/日志）。 */
+export const DINGTALK_AUTH_FILE = "im-dingtalk-auth.json";
+/**
+ * 控制命令文件（插件写、桥读，0600）：`{"action":"begin"|"cancel","at":<ts>}`。
+ * 桥用 `fs.watchFile` 盯它（1s），处理完删除文件；同一 `at` 不重复处理。
+ * 这样插件不需要点对点 HTTP 端点，也不需要持有 device_code —— 只发"开始/取消"意图。
+ */
+export const DINGTALK_AUTH_CMD_FILE = "im-dingtalk-auth-cmd.json";
+/** 官方 connector 用的注册端点（与插件侧 lib/index.js 的 DINGTALK_REG_BASE 保持一致）。 */
+export const DINGTALK_REG_BASE = "https://oapi.dingtalk.com/app/registration";
+/** 兜底 TTL 上限：钉钉 device-flow 的 expires_in 是 7200s（2 小时）。 */
+export const DINGTALK_AUTH_TTL_MS = 7200 * 1000;
+/** 默认轮询间隔（秒）；钉钉 begin 会返回 interval（实测 3s 左右）。 */
+const DEFAULT_POLL_SECONDS = 3;
+/** 单次 HTTP 超时。 */
+const REQUEST_TIMEOUT_MS = 8_000;
+/** auth 成功后 lastResult 保留多久（供插件轮询读结果）。 */
+const LAST_RESULT_TTL_MS = 10 * 60 * 1000;
+
+/** 面向用户的中文错误（绝不把裸 code / 钉钉 errmsg 直接渲染给用户）。 */
+const HUMAN = Object.freeze({
+  network_error: "连不上钉钉接口，请检查网络后重试",
+  rejected: "钉钉拒绝了这次授权请求，请重新扫码",
+  expired: "授权已过期，请重新扫码生成新的链接",
+  cancelled: "这次授权已被取消",
+  write_failed: "拿到的凭据保存失败（磁盘/权限问题），请检查后重试",
+  bad_credentials: "钉钉返回的凭据不完整，请重新扫码",
+  no_relay_dir: "缺少 relay 目录，无法保存授权会话",
+  no_session: "没有进行中的扫码授权",
+  success: "授权成功，机器人凭据已保存（正在自动连接）"
+});
+
+/** relayDir → 后台轮询会话（只存内存；device_code 同时持久化在 auth 文件里）。 */
+const sessions = new Map();
+/** relayDir → 最近一次结论（success/failed/expired/cancelled；供 authStatus 在文件删除后仍能读到）。 */
+const lastResults = new Map();
+let generationSeq = 0;
+
+function human(code, fallback) {
+  const text = String(fallback || "").trim();
+  if (/[\u4e00-\u9fa5]/.test(text) && !/^\s*[{[]/.test(text)) return truncateText(text, 120);
+  return HUMAN[code] || "操作失败，请稍后重试";
+}
+
+function nowOf(options) {
+  return typeof options.clock === "function" ? Number(options.clock()) || Date.now() : Date.now();
+}
+
+function authFileOf(relayDir) {
+  return path.join(String(relayDir || ""), DINGTALK_AUTH_FILE);
+}
+
+/** 读取授权会话文件（不存在/坏 JSON → null，绝不抛）。 */
+export function readDingtalkAuthSession(relayDir) {
+  if (!relayDir) return null;
+  const raw = readJsonFile(authFileOf(relayDir));
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const deviceCode = typeof raw.deviceCode === "string" ? raw.deviceCode : "";
+  if (!deviceCode) return null;
+  return {
+    deviceCode,
+    interval: Math.max(1, Math.min(10, Number(raw.interval) || DEFAULT_POLL_SECONDS)),
+    expiresAt: Number(raw.expiresAt) || 0,
+    url: typeof raw.url === "string" ? raw.url : "",
+    createdAt: Number(raw.createdAt) || 0,
+    credentialSource: "scan"
+  };
+}
+
+function removeAuthFile(relayDir) {
+  try { fs.rmSync(authFileOf(relayDir), { force: true }); } catch { /* 忽略 */ }
+}
+
+/** 合并写状态文件的 dingtalk 段（保留其它段/字段；绝不含 secret）。 */
+function patchDingtalkStatus(relayDir, patch, onWarn) {
+  if (!relayDir) return;
+  try {
+    const file = path.join(String(relayDir), IM_BOT_STATUS_FILE);
+    const prev = readJsonFile(file);
+    const base = prev && typeof prev === "object" && !Array.isArray(prev) ? prev : {};
+    const cur = base.dingtalk && typeof base.dingtalk === "object" ? base.dingtalk : {};
+    atomicWriteJson(file, {
+      ...base,
+      version: 1,
+      updatedAt: Date.now(),
+      dingtalk: { ...cur, ...patch }
+    }, { onWarn });
+  } catch { /* 状态写失败不影响授权本身 */ }
+}
+
+/** relayDir → 上次写入的 dingtalk.auth 快照（JSON；内容没变就不重复写文件）。 */
+const lastAuthSync = new Map();
+
+/** 把 authStatus() 的结果同步进状态文件 `dingtalk.auth`（**绝不含 deviceCode/secret**）。 */
+function syncAuthStatus(relayDir, onWarn) {
+  if (!relayDir) return null;
+  const st = authStatus({ relayDir });
+  const snapshot = {
+    state: String(st.status || "idle"),
+    url: st.status === "waiting" && st.url ? String(st.url) : "",
+    expiresAt: Number(st.expiresAt) || 0,
+    remainingSec: Math.max(0, Number(st.remainingSeconds) || 0),
+    clientIdTail: String(st.clientIdTail || ""),
+    message: String(st.message || "")
+  };
+  const sig = JSON.stringify(snapshot);
+  if (lastAuthSync.get(relayDir) === sig) return snapshot;
+  lastAuthSync.set(relayDir, sig);
+  patchDingtalkStatus(relayDir, { auth: snapshot }, onWarn);
+  return snapshot;
+}
+
+// ---------- 控制命令文件（插件 → 桥） ----------
+
+/** relayDir → { watcher 状态/去重信息 }（只存内存；命令文件处理完即删）。 */
+const cmdWatchers = new Map();
+
+function readCommandFile(relayDir) {
+  const file = path.join(String(relayDir || ""), DINGTALK_AUTH_CMD_FILE);
+  const raw = readJsonFile(file);
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const action = String(raw.action || "").toLowerCase();
+  if (action !== "begin" && action !== "cancel") return null;
+  return { action, at: Number(raw.at) || 0 };
+}
+
+function removeCommandFile(relayDir) {
+  try { fs.rmSync(path.join(String(relayDir || ""), DINGTALK_AUTH_CMD_FILE), { force: true }); } catch { /* 忽略 */ }
+}
+
+/**
+ * 处理命令文件（幂等）：读 → 去重(at) → 执行 → 删除文件 → 同步状态。
+ * 返回处理结果（测试/排障用）：`{ok, action?, skipped?}`。
+ */
+export async function handleDingtalkAuthCommand(options = {}) {
+  const relayDir = String(options.relayDir || "");
+  if (!relayDir) return { ok: false, code: "no_relay_dir" };
+  const state = cmdWatchers.get(relayDir) || { lastHandledAt: 0, handling: false };
+  if (state.handling) return { ok: false, code: "busy" };
+  const cmd = readCommandFile(relayDir);
+  if (!cmd) {
+    // 坏文件/未知 action：删掉，避免每 1s 刷日志（只记一次 debug）
+    if (fs.existsSync(path.join(relayDir, DINGTALK_AUTH_CMD_FILE))) {
+      removeCommandFile(relayDir);
+      if (options.logger) options.logger("debug", "[dingtalk-auth] 忽略无法识别的授权命令文件（已删除）");
+    }
+    return { ok: false, code: "no_command" };
+  }
+  const log = createScopedLogger({ sink: options.logger, prefix: "[dingtalk-auth]" });
+  if (cmd.at && cmd.at <= state.lastHandledAt) {
+    removeCommandFile(relayDir);
+    log.debug(`忽略重复的授权命令（at=${cmd.at} ≤ lastHandledAt=${state.lastHandledAt}）`);
+    return { ok: true, action: cmd.action, skipped: true, at: cmd.at };
+  }
+  state.handling = true;
+  cmdWatchers.set(relayDir, state);
+  try {
+    if (cmd.action === "begin") {
+      log.info("收到面板「开始扫码授权」命令 → 生成授权链接并持久化会话");
+      const r = await beginDingtalkAuth({
+        relayDir,
+        fetchImpl: options.fetchImpl,
+        logger: options.logger,
+        pollMs: options.pollMs,
+        onSuccess: options.onSuccess,
+        onWarn: options.onWarn
+      });
+      state.lastHandledAt = cmd.at || Date.now();
+      log.info(r.ok ? "已生成扫码授权链接（等待用户手机确认）" : `扫码授权发起失败：${r.message || r.code || "?"}`);
+      return { ok: r.ok, action: "begin", at: cmd.at, result: r };
+    }
+    log.info("收到面板「取消扫码授权」命令");
+    cancelDingtalkAuth({ relayDir, onWarn: options.onWarn });
+    state.lastHandledAt = cmd.at || Date.now();
+    return { ok: true, action: "cancel", at: cmd.at };
+  } finally {
+    removeCommandFile(relayDir);
+    state.handling = false;
+    cmdWatchers.set(relayDir, state);
+    syncAuthStatus(relayDir, options.onWarn);
+  }
+}
+
+/**
+ * 启动命令文件监听（bridge 启动时调用；幂等）。
+ * 同时每秒刷新一次 `dingtalk.auth`（remainingSec 会随时间减少），桥退出时 stop 掉。
+ * @param {{relayDir:string, fetchImpl?:Function, logger?:Function, onSuccess?:Function, onWarn?:Function,
+ *          intervalMs?:number, pollMs?:number}} options
+ */
+export function startDingtalkAuthCommandWatcher(options = {}) {
+  const relayDir = String(options.relayDir || "");
+  if (!relayDir) return { ok: false, code: "no_relay_dir" };
+  const existing = cmdWatchers.get(relayDir);
+  if (existing && existing.timer) return { ok: true, started: false };
+  const file = path.join(relayDir, DINGTALK_AUTH_CMD_FILE);
+  const intervalMs = Math.max(20, Number(options.intervalMs) || 1000);
+  const state = { lastHandledAt: 0, handling: false, timer: null, listener: null };
+  // ⚠️ 必须**先把 state 放进 map 再触发首次 handle**：否则启动时恰有命令文件的情况下，
+  //    handleDingtalkAuthCommand 会用自己的临时 state 覆盖 map，导致 stop 时拿不到 listener
+  //    → fs.watchFile 解不掉（测试进程/桥退出时泄漏）。
+  cmdWatchers.set(relayDir, state);
+  const tick = () => {
+    // 先处理命令（有就执行），再刷新状态（remainingSec 随时间变化）
+    void handleDingtalkAuthCommand(options)
+      .catch(() => { /* 内部已兜住 */ })
+      .finally(() => { syncAuthStatus(relayDir, options.onWarn); });
+  };
+  state.listener = () => { void handleDingtalkAuthCommand(options).catch(() => {}); };
+  try {
+    fs.watchFile(file, { interval: intervalMs }, state.listener);
+  } catch (e) {
+    if (options.logger) options.logger("warn", `[dingtalk-auth] 监听授权命令文件失败：${e && e.message ? e.message : e}`);
+  }
+  state.timer = setInterval(tick, intervalMs);
+  if (typeof state.timer.unref === "function") state.timer.unref();
+  // 启动时先检查一次（上次退出可能留下未处理命令），之后 interval 心跳兜底
+  void handleDingtalkAuthCommand(options).catch(() => {});
+  syncAuthStatus(relayDir, options.onWarn);
+  return { ok: true, started: true, intervalMs };
+}
+
+/** 停止命令文件监听（bridge 退出时调用；**保留** auth 文件，下次启动续轮询）。 */
+export function stopDingtalkAuthCommandWatcher(relayDir) {
+  const dirs = relayDir ? [String(relayDir)] : [...cmdWatchers.keys()];
+  for (const dir of dirs) {
+    const state = cmdWatchers.get(dir);
+    if (!state) continue;
+    try { if (state.timer) clearInterval(state.timer); } catch { /* 忽略 */ }
+    state.timer = null;
+    try {
+      if (state.listener) fs.unwatchFile(path.join(dir, DINGTALK_AUTH_CMD_FILE), state.listener);
+    } catch { /* 忽略 */ }
+    state.listener = null;
+    cmdWatchers.delete(dir);
+  }
+}
+
+/** 测试用：清空命令监听内存态（不动文件）。 */
+export function __resetDingtalkAuthCmdForTest() {
+  stopDingtalkAuthCommandWatcher();
+}
+
+function stopSession(relayDir) {
+  const sess = sessions.get(relayDir);
+  if (sess) {
+    try { if (sess.timer) clearInterval(sess.timer); } catch { /* 忽略 */ }
+    sess.timer = null;
+    sessions.delete(relayDir);
+  }
+}
+
+function setLastResult(relayDir, result) {
+  lastResults.set(relayDir, { ...result, at: Date.now() });
+  while (lastResults.size > 50) {
+    const first = lastResults.keys().next();
+    if (first.done) break;
+    lastResults.delete(first.value);
+  }
+}
+
+async function jsonPost(fetchImpl, url, payload) {
+  const res = await fetchImpl(url, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify(payload || {}),
+    signal: typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function"
+      ? AbortSignal.timeout(REQUEST_TIMEOUT_MS) : undefined
+  });
+  let body = null;
+  try { body = res && typeof res.json === "function" ? await res.json() : null; } catch { body = null; }
+  return { ok: Boolean(res && res.ok), status: Number(res && res.status) || 0, body: body && typeof body === "object" ? body : {} };
+}
+
+/** 把扫码拿到的凭据写进 im-bots.json 的 dingtalk 段（0600 原子写；保留其它段/字段，自动 enabled）。 */
+function saveScannedCredentials(relayDir, clientId, clientSecret, onWarn) {
+  const cid = String(clientId || "").trim();
+  const csec = String(clientSecret || "").trim();
+  if (!cid || !csec) return { ok: false, code: "bad_credentials", message: human("bad_credentials") };
+  try {
+    const file = path.join(String(relayDir), IM_BOTS_FILE);
+    const prev = readJsonFile(file);
+    const base = prev && typeof prev === "object" && !Array.isArray(prev) ? prev : {};
+    const cur = base.dingtalk && typeof base.dingtalk === "object" ? base.dingtalk : {};
+    const dingtalk = {
+      ...cur,
+      enabled: true,
+      clientId: cid,
+      clientSecret: csec,
+      credentialSource: "scan"
+    };
+    // 扫码流程只给 client_id/client_secret：robotCode 缺省用 clientId（Lead 2026-11-08 约定；
+    // 用户后续可在面板里改成正真的机器人编码 —— openapi/卡片能力由 dingtalk-bot 的 capabilities 表达）。
+    if (!String(dingtalk.robotCode || "").trim()) dingtalk.robotCode = cid;
+    atomicWriteJson(file, { ...base, version: 1, dingtalk }, { onWarn });
+    return { ok: true, clientIdTail: cid.length > 4 ? cid.slice(-4) : cid };
+  } catch (e) {
+    return { ok: false, code: "write_failed", message: human("write_failed", e && e.message) };
+  }
+}
+
+function expireAuth(relayDir, sess) {
+  stopSession(relayDir);
+  removeAuthFile(relayDir);
+  const message = human("expired");
+  patchDingtalkStatus(relayDir, { state: "failed", lastError: message, credentialSource: "scan" }, sess && sess.onWarn);
+  setLastResult(relayDir, { status: "expired", message, code: "expired" });
+  syncAuthStatus(relayDir, sess && sess.onWarn);
+  if (sess) sess.log.info(`扫码授权会话已过期（device_code 清理，可在面板重新发起）`);
+}
+
+function finishFailure(relayDir, sess, { code, message }) {
+  stopSession(relayDir);
+  removeAuthFile(relayDir);
+  patchDingtalkStatus(relayDir, { state: "failed", lastError: message, credentialSource: "scan" }, sess && sess.onWarn);
+  setLastResult(relayDir, { status: "failed", code, message });
+  syncAuthStatus(relayDir, sess && sess.onWarn);
+  sess.log.warn(`扫码授权失败：${code || "?"} — ${message}`);
+}
+
+function finishSuccess(relayDir, sess, { clientId, clientSecret }) {
+  const saved = saveScannedCredentials(relayDir, clientId, clientSecret, sess && sess.onWarn);
+  stopSession(relayDir);
+  if (!saved.ok) {
+    removeAuthFile(relayDir);
+    const message = saved.message || human("write_failed");
+    patchDingtalkStatus(relayDir, { state: "failed", lastError: message, credentialSource: "scan" }, sess && sess.onWarn);
+    setLastResult(relayDir, { status: "failed", code: saved.code || "write_failed", message });
+    syncAuthStatus(relayDir, sess && sess.onWarn);
+    sess.log.warn(`扫码凭据保存失败：${message}`);
+    return;
+  }
+  // 先删 auth 文件（凭据已落盘；device_code 不再需要）再写状态
+  removeAuthFile(relayDir);
+  patchDingtalkStatus(relayDir, { state: "connected", lastError: "", credentialSource: "scan" }, sess && sess.onWarn);
+  setLastResult(relayDir, { status: "success", credentialSource: "scan", clientIdTail: saved.clientIdTail, message: human("success") });
+  syncAuthStatus(relayDir, sess && sess.onWarn);
+  sess.log.info(`扫码授权成功：机器人凭据已写入 im-bots.json（clientId 尾号 ${saved.clientIdTail}，credentialSource=scan）`);
+  if (typeof sess.onSuccess === "function") {
+    try { sess.onSuccess({ clientIdTail: saved.clientIdTail, credentialSource: "scan" }); } catch { /* 忽略 */ }
+  }
+}
+
+async function pollOnce(relayDir, sess) {
+  if (sessions.get(relayDir) !== sess) return; // 已被新会话取代
+  if (sess.inFlight) return;
+  const at = sess.clock();
+  if (at >= sess.expiresAt) { expireAuth(relayDir, sess); return; }
+  sess.inFlight = true;
+  let r;
+  try {
+    r = await jsonPost(sess.fetchImpl, `${DINGTALK_REG_BASE}/poll`, { device_code: sess.deviceCode });
+  } catch {
+    sess.networkErrors += 1;
+    if (sess.networkErrors === 1) sess.log.warn("轮询钉钉接口网络异常：继续重试直到授权过期（不会丢会话）");
+    return;
+  } finally {
+    sess.inFlight = false;
+  }
+  if (sessions.get(relayDir) !== sess) return; // 期间被 begin 覆盖
+  const body = r.body || {};
+  const status = String(body.status || "").toUpperCase();
+  const clientId = body.client_id || body.clientId || "";
+  const clientSecret = body.client_secret || body.clientSecret || "";
+  if (status === "SUCCESS" || (clientId && clientSecret)) {
+    finishSuccess(relayDir, sess, { clientId, clientSecret });
+    return;
+  }
+  if (status === "FAIL" || status === "EXPIRED" || status === "REJECTED") {
+    finishFailure(relayDir, sess, {
+      code: status === "EXPIRED" ? "expired" : "rejected",
+      message: human(status === "EXPIRED" ? "expired" : "rejected", body.message || body.errmsg)
+    });
+    return;
+  }
+  if (status === "WAITING" || status === "PENDING" || status === "") {
+    sess.waits += 1;
+    syncAuthStatus(relayDir, sess.onWarn); // 顺带刷新 dingtalk.auth（remainingSec 随时间减少）
+    return; // 用户还没在手机钉钉里点「一键创建」
+  }
+  // 未知/异常响应：宽容地继续等（直到过期），避免一次怪响应把会话作废
+  sess.waits += 1;
+}
+
+function startPolling(relayDir, sess) {
+  stopSession(relayDir);
+  sessions.set(relayDir, sess);
+  const tick = () => { void pollOnce(relayDir, sess).catch(() => { /* 轮询内部已兜住 */ }); };
+  sess.timer = setInterval(tick, sess.pollMs);
+  if (typeof sess.timer.unref === "function") sess.timer.unref();
+  // 立刻先轮一次：用户在 begin 之前就点完确认也不耽误
+  void pollOnce(relayDir, sess).catch(() => { /* 忽略 */ });
+}
+
+function makeSession({ relayDir, session, fetchImpl, logger, onSuccess, clock, pollMs, onWarn }) {
+  const log = createScopedLogger({ sink: logger, prefix: "[dingtalk-auth]" });
+  const now = clock();
+  const gen = ++generationSeq;
+  return {
+    gen,
+    relayDir,
+    deviceCode: session.deviceCode,
+    expiresAt: session.expiresAt,
+    url: session.url,
+    fetchImpl,
+    logger,
+    onSuccess,
+    onWarn,
+    clock,
+    log,
+    pollMs: Math.max(10, Number(pollMs) || Math.max(1000, Number(session.interval || DEFAULT_POLL_SECONDS) * 1000)),
+    inFlight: false,
+    waits: 0,
+    networkErrors: 0
+  };
+}
+
+/**
+ * 开始一次扫码授权：init → begin → **把会话原子落盘** → 后台按 interval 轮询。
+ *
+ * 同一 relayDir 同时只保留一个会话：新的 begin 会作废旧会话（旧 auth 文件被覆盖/删除）。
+ * @returns {Promise<{ok:boolean, url?:string, expiresIn?:number, interval?:number, expiresAt?:number, code?:string, message?:string}>}
+ */
+export async function beginDingtalkAuth(options = {}) {
+  const relayDir = String(options.relayDir || "");
+  if (!relayDir) return { ok: false, code: "no_relay_dir", message: human("no_relay_dir") };
+  const fetchImpl = typeof options.fetchImpl === "function" ? options.fetchImpl : globalThis.fetch;
+  const log = createScopedLogger({ sink: options.logger, prefix: "[dingtalk-auth]" });
+  if (typeof fetchImpl !== "function") return { ok: false, code: "network_error", message: human("network_error") };
+  // 覆盖旧会话（并发 begin）：先停表、清旧文件，再发新请求 —— 旧链接从此失效
+  stopSession(relayDir);
+  removeAuthFile(relayDir);
+
+  let init;
+  try { init = await jsonPost(fetchImpl, `${DINGTALK_REG_BASE}/init`, { source: "DING_DWS_CLAW" }); }
+  catch { return { ok: false, code: "network_error", message: human("network_error") }; }
+  const nonce = init.ok && init.body && typeof init.body.nonce === "string" ? init.body.nonce : "";
+  if (!nonce) {
+    const message = human("rejected", init.body && (init.body.message || init.body.errmsg));
+    setLastResult(relayDir, { status: "failed", code: "rejected", message });
+    return { ok: false, code: "rejected", message };
+  }
+  let begin;
+  try { begin = await jsonPost(fetchImpl, `${DINGTALK_REG_BASE}/begin`, { nonce }); }
+  catch { return { ok: false, code: "network_error", message: human("network_error") }; }
+  const body = begin.body || {};
+  const deviceCode = typeof body.device_code === "string" ? body.device_code : "";
+  const url = typeof body.verification_uri_complete === "string" ? body.verification_uri_complete : "";
+  if (!begin.ok || !deviceCode || !url) {
+    const message = human("rejected", body.message || body.errmsg);
+    setLastResult(relayDir, { status: "failed", code: "rejected", message });
+    return { ok: false, code: "rejected", message };
+  }
+  const interval = Math.max(1, Math.min(10, Number(body.interval) || DEFAULT_POLL_SECONDS));
+  const expiresIn = Math.max(60, Math.min(7200, Number(body.expires_in) || DINGTALK_AUTH_TTL_MS / 1000));
+  const at = nowOf(options);
+  const expiresAt = at + Math.min(expiresIn * 1000, DINGTALK_AUTH_TTL_MS);
+  const persisted = { deviceCode, interval, expiresAt, url, createdAt: at, credentialSource: "scan" };
+  try {
+    atomicWriteJson(authFileOf(relayDir), { version: 1, ...persisted }, { onWarn: options.onWarn });
+  } catch (e) {
+    return { ok: false, code: "write_failed", message: human("write_failed", e && e.message) };
+  }
+  const sess = makeSession({
+    relayDir,
+    session: persisted,
+    fetchImpl,
+    logger: options.logger,
+    onSuccess: options.onSuccess,
+    clock: () => nowOf(options),
+    pollMs: options.pollMs,
+    onWarn: options.onWarn
+  });
+  startPolling(relayDir, sess);
+  setLastResult(relayDir, { status: "waiting", url, expiresAt });
+  syncAuthStatus(relayDir, options.onWarn);
+  log.info(`已生成扫码授权链接（device_code 已持久化，会话有效期 ${Math.round((expiresAt - at) / 1000)}s；关面板/重启桥都不丢）`);
+  return { ok: true, url, expiresIn: Math.round((expiresAt - at) / 1000), interval, expiresAt };
+}
+
+/**
+ * 断点续轮询：bridge 启动时调用。存在未过期会话 → 继续按 interval poll；
+ * 成功后写 `im-bots.json`（credentialSource:"scan"）、删 auth 文件、写状态 `state="connected"`。
+ * 不存在/已过期 → 返回 `{ok:false, code:"no_session"|"expired"}`（过期会顺手清理文件与状态）。
+ */
+export async function resumeDingtalkAuth(options = {}) {
+  const relayDir = String(options.relayDir || "");
+  if (!relayDir) return { ok: false, code: "no_relay_dir", message: human("no_relay_dir") };
+  const fetchImpl = typeof options.fetchImpl === "function" ? options.fetchImpl : globalThis.fetch;
+  const log = createScopedLogger({ sink: options.logger, prefix: "[dingtalk-auth]" });
+  const at = nowOf(options);
+  const session = readDingtalkAuthSession(relayDir);
+  if (!session) return { ok: false, code: "no_session", message: human("no_session") };
+  if (!session.expiresAt || at >= session.expiresAt) {
+    removeAuthFile(relayDir);
+    const message = human("expired");
+    patchDingtalkStatus(relayDir, { state: "failed", lastError: message, credentialSource: "scan" }, options.onWarn);
+    setLastResult(relayDir, { status: "expired", code: "expired", message });
+    log.info("发现已过期的扫码授权会话，已清理（可在面板重新发起）");
+    return { ok: false, code: "expired", message };
+  }
+  if (sessions.has(relayDir)) {
+    const cur = sessions.get(relayDir);
+    return {
+      ok: true,
+      status: "waiting",
+      url: session.url,
+      remainingSeconds: Math.max(0, Math.ceil((session.expiresAt - at) / 1000)),
+      pollMs: cur.pollMs
+    };
+  }
+  const sess = makeSession({
+    relayDir,
+    session,
+    fetchImpl,
+    logger: options.logger,
+    onSuccess: options.onSuccess,
+    clock: () => nowOf(options),
+    pollMs: options.pollMs,
+    onWarn: options.onWarn
+  });
+  startPolling(relayDir, sess);
+  setLastResult(relayDir, { status: "waiting", url: session.url, expiresAt: session.expiresAt });
+  syncAuthStatus(relayDir, options.onWarn);
+  log.info(`续接上次未完成的扫码授权（剩余 ${Math.round((session.expiresAt - at) / 1000)}s，device_code 来自磁盘）`);
+  return { ok: true, status: "waiting", url: session.url, remainingSeconds: Math.ceil((session.expiresAt - at) / 1000), interval: session.interval, pollMs: sess.pollMs };
+}
+
+/**
+ * 查询授权状态（给插件读）：waiting/success/failed/expired/idle + 剩余秒数。
+ * 只读，不会重启已停止的轮询（bridge 重启后由 resumeDingtalkAuth 负责续上）。
+ */
+export function authStatus(options = {}) {
+  const relayDir = String(options.relayDir || "");
+  const at = nowOf(options);
+  if (!relayDir) return { ok: false, status: "idle", remainingSeconds: 0, message: human("no_relay_dir") };
+  const session = readDingtalkAuthSession(relayDir);
+  if (session) {
+    if (at < session.expiresAt) {
+      return {
+        ok: true,
+        status: "waiting",
+        remainingSeconds: Math.max(0, Math.ceil((session.expiresAt - at) / 1000)),
+        url: session.url,
+        interval: session.interval,
+        expiresAt: session.expiresAt,
+        hasSecret: false
+      };
+    }
+    // 过期：顺手清理（读接口也允许做这种幂等清理；结果仍如实返回）
+    stopSession(relayDir);
+    removeAuthFile(relayDir);
+    const message = human("expired");
+    setLastResult(relayDir, { status: "expired", code: "expired", message });
+    patchDingtalkStatus(relayDir, { state: "failed", lastError: message, credentialSource: "scan" }, options.onWarn);
+    return { ok: false, status: "expired", remainingSeconds: 0, message };
+  }
+  const last = lastResults.get(relayDir);
+  if (last && at - last.at < LAST_RESULT_TTL_MS) {
+    return { ...last, ok: last.status === "success", status: last.status, remainingSeconds: 0 };
+  }
+  return { ok: false, status: "idle", remainingSeconds: 0 };
+}
+
+/** 用户显式取消：停轮询 + 删 auth 文件 + 状态标记取消。 */
+export function cancelDingtalkAuth(options = {}) {
+  const relayDir = String(options.relayDir || "");
+  if (!relayDir) return { ok: false, code: "no_relay_dir", message: human("no_relay_dir") };
+  stopSession(relayDir);
+  removeAuthFile(relayDir);
+  const message = human("cancelled");
+  setLastResult(relayDir, { status: "failed", code: "cancelled", message });
+  patchDingtalkStatus(relayDir, { state: "failed", lastError: message, credentialSource: "scan" }, options.onWarn);
+  syncAuthStatus(relayDir, options.onWarn);
+  return { ok: true };
+}
+
+/** 只停定时器（**保留** auth 文件）：bridge 正常退出/配置变化时调用，下次启动可续轮询。 */
+export function stopDingtalkAuthPolling() {
+  for (const relayDir of [...sessions.keys()]) stopSession(relayDir);
+}
+
+/** 测试用：清空内存态（定时器 + 最近结论），不动文件。 */
+export function __resetDingtalkAuthForTest() {
+  stopDingtalkAuthPolling();
+  stopDingtalkAuthCommandWatcher();
+  lastResults.clear();
+  lastAuthSync.clear();
+  generationSeq = 0;
+}

package/runtime/clients/dsh-remote/dsh-bridge.mjs

@@ -124,6 +124,15 @@ import { createAgentRuntime } from "./agent/index.mjs";
 import { createWecomBotController } from "./wecom-bot.mjs";
 // 钉钉 Stream 模式长连接（2026-11-08）：与企微同构、零新增依赖；默认关闭，配置在 im-bots.json 的 dingtalk 段。
 import { createDingtalkBotController } from "./dingtalk-bot.mjs";
+// 钉钉「扫码一键创建机器人」授权会话：**持久化 + 断点续轮询**（2026-11-08）。
+// 根因：device_code 只存在插件进程内存 → 面板关/宿主重启就丢，而凭据只在 poll SUCCESS 那次返回。
+// 现在授权会话落盘在 <relayDir>/im-dingtalk-auth.json，bridge 启动即续轮询，桥在跑就能接住。
+import {
+  resumeDingtalkAuth,
+  startDingtalkAuthCommandWatcher,
+  stopDingtalkAuthCommandWatcher,
+  stopDingtalkAuthPolling
+} from "./dingtalk-auth.mjs";
 // 飞书通道：官方 SDK 按需下载（41MB，不随包分发）、懒加载；未启用时零副作用
 import { createFeishuBotController } from "./feishu-bot.mjs";
 
@@ -3358,6 +3367,29 @@ function imBotLog(level, message) {
 }
 
 function startImBots() {
+  // ⓪ 钉钉扫码授权断点续轮询（fire-and-forget，绝不阻塞隧道/连接主链路）：
+  //    上次没等到用户确认就重启/关面板也没关系 —— 会话在磁盘上，桥一跑就继续 poll，
+  //    成功后自动写 im-bots.json（credentialSource:"scan"）→ controller 热更新把机器人连上。
+  try {
+    void resumeDingtalkAuth({
+      relayDir: RELAY_DIR,
+      logger: imBotLog,
+      onWarn: (m) => imBotLog("warn", m),
+      onSuccess: () => { try { startImBots(); } catch { /* 忽略 */ } }
+    }).catch((e) => {
+      console.warn(`[bridge] 钉钉扫码授权续轮询失败(不影响远程访问): ${redactText(e)}`);
+    });
+    // 控制命令文件：插件写 <relayDir>/im-dingtalk-auth-cmd.json（begin/cancel），桥读并执行。
+    // 插件不需要 device_code，也不需要 HTTP 端点 —— 只表达意图；桥在跑就能接住。
+    startDingtalkAuthCommandWatcher({
+      relayDir: RELAY_DIR,
+      logger: imBotLog,
+      onWarn: (m) => imBotLog("warn", m),
+      onSuccess: () => { try { startImBots(); } catch { /* 忽略 */ } }
+    });
+  } catch (e) {
+    console.warn(`[bridge] 钉钉扫码授权续轮询初始化失败(忽略): ${redactText(e)}`);
+  }
   // ① 企业微信（现有）
   try {
     if (!imBots) {
@@ -3437,6 +3469,9 @@ function startImBots() {
 
 /** 优雅退出 IM 机器人通道（企微 + 钉钉，互不影响）。失败只记日志。 */
 async function stopImBots() {
+  // 先停扫码授权轮询/命令监听（**保留** auth 文件：下次启动能续轮询；用户显式取消才删文件）
+  try { stopDingtalkAuthCommandWatcher(); } catch { /* 忽略 */ }
+  try { stopDingtalkAuthPolling(); } catch { /* 忽略 */ }
   const wecom = imBots;
   const dingtalk = imBotsDingtalk;
   const feishu = imBotsFeishu;

package/runtime/dsh-setup.mjs

@@ -149,7 +149,7 @@ function findDepWs(startDir) {
  * 漏同步就会出现「入口脚本在、依赖不在」的半装运行时（插件半据此判定「运行环境已就绪」，
  * 却永远起不来 bridge —— 2026-09-23 用户反馈的现场）。`src/channel-ref.mjs` 同理（本安装器也 import）。
  */
-const RUNTIME_CLIENT_FILES = ["mobile-adapter.mjs", "dsh-bridge.mjs", "e2ee-shim.mjs", "e2ee-client.mjs", "e2ee-shim-script.js", "mobile-adapter.test.mjs", "wechat-channel.mjs", "dsh-events.mjs", "wechat-runtime.mjs", "wecom-bot.mjs", "im-format.mjs", "dingtalk-bot.mjs", "feishu-bot.mjs", "src/lifecycle.mjs", "src/channel-ref.mjs"];
+const RUNTIME_CLIENT_FILES = ["mobile-adapter.mjs", "dsh-bridge.mjs", "e2ee-shim.mjs", "e2ee-client.mjs", "e2ee-shim-script.js", "mobile-adapter.test.mjs", "wechat-channel.mjs", "dsh-events.mjs", "wechat-runtime.mjs", "wecom-bot.mjs", "im-format.mjs", "dingtalk-bot.mjs", "dingtalk-auth.mjs", "feishu-bot.mjs", "src/lifecycle.mjs", "src/channel-ref.mjs"];
 
 /**
  * 把"客户端脚本"补齐到配置目录。