ework-qq-bridge 0.1.0

package/bin/ework-qq-bridge.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import("../src/index.ts").catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/bun.lock

@@ -0,0 +1,29 @@
+{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "ework-qq-bridge",
+      "dependencies": {
+        "zod": "^3.23.8",
+      },
+      "devDependencies": {
+        "@types/bun": "latest",
+        "typescript": "^5.5.0",
+      },
+    },
+  },
+  "packages": {
+    "@types/bun": ["@types/bun@1.4.0", "", { "dependencies": { "bun-types": "1.4.0" } }, "sha512-K+lZULY23vRgK/CfTjFIV+tyifaNdSMlPh9j+6mQ/cLfpOznLyAuzgV/JQysyECpkBQLVMSyvjlr2fBUSA9wFQ=="],
+
+    "@types/node": ["@types/node@26.3.0", "", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-L3fgrnchriRC2ExBflb8j4uZZURHZfQsmQeyVzhjcHW4kkwVyo8/0h1B2MVzMTrYUJYu6G7EWs14hW/L9putqw=="],
+
+    "bun-types": ["bun-types@1.4.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-iIKw23BspnQQYd3prITOBxeUsxBHnwzX6YJfGMuNOZzeNcMmVqzIIVGRm1l69ogaPQmb4wB6BN8mA5bE9YuC5Q=="],
+
+    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+
+    "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
+
+    "zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+  }
+}

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "ework-qq-bridge",
+  "version": "0.1.0",
+  "description": "QQ group <-> ework issue bridge (OneBot 11 reverse WebSocket)",
+  "type": "module",
+  "main": "src/index.ts",
+  "scripts": {
+    "check": "tsc --noEmit",
+    "dev": "bun --watch src/index.ts",
+    "start": "bun src/index.ts"
+  },
+  "dependencies": {
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "typescript": "^5.5.0"
+  },
+  "engines": {
+    "bun": ">=1.1.0"
+  },
+  "bin": {
+    "ework-qq-bridge": "./bin/ework-qq-bridge.js"
+  }
+}

package/src/config.ts

@@ -0,0 +1,87 @@
+import { z } from "zod";
+
+const Schema = z.object({
+  // OneBot 11 reverse-WS server: NapCat connects OUT to us here.
+  PORT: z.coerce.number().int().positive().default(8080),
+  HOST: z.string().default("127.0.0.1"),
+  ONEBOT_WS_PATH: z.string().default("/onebot/v11/ws"),
+  // Shared secret NapCat sends as `Authorization: Bearer <token>` on connect.
+  ONEBOT_ACCESS_TOKEN: z.string().default(""),
+
+  // ework web (Gitea-compatible shim) — used to create issues / post comments.
+  EWORK_URL: z.string().url(),
+  EWORK_TOKEN: z.string().min(1),
+
+  // ework webhook ingest (same contract as ework-mirror): web fans issue
+  // comment events here so agent replies can be pushed back to the group.
+  EWORK_WEBHOOK_SECRET: z.string().default(""),
+
+  // group_id -> owner/repo mapping. Comma-separated:
+  //   "123456789:ranxianglei/billion-context,987654321:dog/test1"
+  GROUP_MAP: z.string().min(1),
+
+  // QQ user_ids allowed to dispatch AI work (comma-separated). Messages from
+  // other members are logged and ignored — same trust model as the GitHub
+  // side (WORK_WAKE_LOGINS): strangers never wake the AI.
+  QQ_WAKE_LIST: z.string().default(""),
+
+  // ework logins whose comments are agent replies worth forwarding to QQ.
+  // The bridge's own login is always skipped (echo guard).
+  AGENT_LOGINS: z.string().default("ework-daemon"),
+
+  // The ework login this bridge posts as. Must NOT be the daemon's own login
+  // (daemon ignores its own comments) and should be added to the daemon's
+  // WORK_WAKE_LOGINS so curated bridge comments dispatch the AI.
+  BRIDGE_LOGIN: z.string().default("qq-bridge"),
+
+  DB_PATH: z.string().default(""),
+
+  VERBOSE: z.coerce.boolean().default(false),
+
+  // Deployment-specific hostnames scrubbed from outbound QQ messages.
+  // Env-driven so the published package never reveals real infrastructure.
+  WORK_SCRUB_HOSTS: z.string().default(""),
+});
+
+export type Config = z.infer<typeof Schema>;
+
+export interface GroupBinding {
+  groupId: number;
+  owner: string;
+  repo: string;
+}
+
+export function parseGroupMap(raw: string): GroupBinding[] {
+  const out: GroupBinding[] = [];
+  for (const part of raw.split(",")) {
+    const item = part.trim();
+    if (!item) continue;
+    const m = /^(\d+):([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(item);
+    if (!m?.[1] || !m[2] || !m[3]) {
+      throw new Error(`invalid GROUP_MAP entry: ${item}`);
+    }
+    out.push({ groupId: Number(m[1]), owner: m[2], repo: m[3] });
+  }
+  if (out.length === 0) throw new Error("GROUP_MAP must define at least one group");
+  return out;
+}
+
+export function parseList(raw: string): string[] {
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+
+export function loadConfig(): Config {
+  const parsed = Schema.safeParse(process.env);
+  if (!parsed.success) {
+    console.error("Invalid config:");
+    for (const issue of parsed.error.issues) {
+      console.error(`  ${issue.path.join(".")}: ${issue.message}`);
+    }
+    process.exit(1);
+  }
+  const cfg = parsed.data;
+  if (!cfg.DB_PATH) {
+    cfg.DB_PATH = `${process.env.HOME ?? "/tmp"}/.ework-qq-bridge/qq-bridge.db`;
+  }
+  return cfg;
+}

package/src/db.ts

@@ -0,0 +1,46 @@
+import { Database } from "bun:sqlite";
+import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+
+export function initDB(path: string): void {
+  if (!path) return;
+  mkdirSync(dirname(path), { recursive: true });
+}
+
+export class BridgeStore {
+  private db: Database;
+
+  constructor(dbPath: string) {
+    this.db = new Database(dbPath, { create: true });
+    this.db.exec("PRAGMA journal_mode = WAL;");
+    this.db.exec(`CREATE TABLE IF NOT EXISTS seen_posts (
+      post_id TEXT PRIMARY KEY,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+    this.db.exec(`CREATE TABLE IF NOT EXISTS forwarded_comments (
+      comment_id INTEGER PRIMARY KEY,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  }
+
+  // QQ dedup: NapCat may redeliver events after reconnect; each post is
+  // handled exactly once.
+  seenPost(postId: string): boolean {
+    const row = this.db.query("SELECT 1 FROM seen_posts WHERE post_id = ?").get(postId);
+    if (row) return true;
+    this.db.query("INSERT OR IGNORE INTO seen_posts (post_id) VALUES (?)").run(postId);
+    return false;
+  }
+
+  // Webhook dedup: web retries deliveries; mark comment ids already pushed.
+  commentForwarded(commentId: number): boolean {
+    const row = this.db.query("SELECT 1 FROM forwarded_comments WHERE comment_id = ?").get(commentId);
+    if (row) return true;
+    this.db.query("INSERT OR IGNORE INTO forwarded_comments (comment_id) VALUES (?)").run(commentId);
+    return false;
+  }
+
+  close(): void {
+    this.db.close();
+  }
+}

package/src/ework.ts

@@ -0,0 +1,37 @@
+export interface EworkClient {
+  createIssue(owner: string, repo: string, title: string, body: string): Promise<number>;
+  addComment(owner: string, repo: string, number: number, body: string): Promise<void>;
+}
+
+export function createEworkClient(baseUrl: string, token: string): EworkClient {
+  const root = baseUrl.replace(/\/+$/, "");
+  const headers = {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${token}`,
+  };
+  async function request(path: string, body: unknown): Promise<Response> {
+    const res = await fetch(`${root}${path}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`ework ${path} -> ${res.status}: ${text.slice(0, 200)}`);
+    }
+    return res;
+  }
+  return {
+    async createIssue(owner, repo, title, body) {
+      const res = await request(`/repos/${owner}/${repo}/issues`, { title, body });
+      const data = (await res.json()) as { number?: unknown };
+      const n = Number(data.number);
+      if (!Number.isInteger(n) || n <= 0) throw new Error(`ework createIssue returned no number: ${JSON.stringify(data).slice(0, 200)}`);
+      return n;
+    },
+    async addComment(owner, repo, number, body) {
+      await request(`/repos/${owner}/${repo}/issues/${number}/comments`, { body });
+    },
+  };
+}

package/src/index.ts

@@ -0,0 +1,82 @@
+import { loadConfig, parseGroupMap, parseList } from "./config";
+import { BridgeStore } from "./db";
+import { createOneBotServer, type OneBotApi, type GroupMessageEvent } from "./onebot";
+import { createRouter } from "./router";
+import { createIngest } from "./ingest";
+import { createEworkClient } from "./ework";
+import { buildScrubber } from "./scrub";
+
+async function main() {
+  const cfg = loadConfig();
+  if (cfg.DB_PATH) {
+  const dir = cfg.DB_PATH.slice(0, cfg.DB_PATH.lastIndexOf("/"));
+  if (dir) await Bun.write(`${dir}/.keep`, "");
+}
+const store = new BridgeStore(cfg.DB_PATH || "/tmp/ework-qq-bridge.db");
+
+  const bindings = parseGroupMap(cfg.GROUP_MAP);
+  const groupIdOfProject = new Map<string, number>();
+  for (const b of bindings) groupIdOfProject.set(`${b.owner}/${b.repo}`, b.groupId);
+
+  let api: OneBotApi | null = null;
+  const send = async (groupId: number, text: string) => {
+    if (!api) throw new Error("OneBot client not connected");
+    await api.call("send_group_msg", { group_id: groupId, message: [{ type: "text", data: { text } }] });
+  };
+
+  const ework = createEworkClient(cfg.EWORK_URL, cfg.EWORK_TOKEN);
+  const scrub = buildScrubber(parseList(cfg.WORK_SCRUB_HOSTS));
+  const router = createRouter({
+    cfg,
+    bindings,
+    wakeList: new Set(parseList(cfg.QQ_WAKE_LIST)),
+    ework,
+    store,
+    reply: send,
+  });
+
+  const ingest = createIngest({
+    secret: cfg.EWORK_WEBHOOK_SECRET,
+    bridgeLogin: cfg.BRIDGE_LOGIN,
+    agentLogins: new Set(parseList(cfg.AGENT_LOGINS)),
+    scrub,
+    projectOf: (owner, repo) => groupIdOfProject.get(`${owner}/${repo}`) ?? null,
+    commentForwarded: (id) => store.commentForwarded(id),
+    send,
+  });
+
+  const server = createOneBotServer({
+    path: cfg.ONEBOT_WS_PATH,
+    accessToken: cfg.ONEBOT_ACCESS_TOKEN,
+    onEvent: async (ev: GroupMessageEvent) => {
+      await router.handleGroupMessage(ev);
+    },
+    onReady: (a: OneBotApi) => {
+      api = a;
+      console.log("[qq-bridge] OneBot client connected");
+    },
+  });
+
+  Bun.serve({
+    port: cfg.PORT,
+    websocket: server.handlers,
+    fetch(req, srv) {
+      const url = new URL(req.url);
+      if (url.pathname === "/healthz") return new Response("ok");
+      if (url.pathname === cfg.ONEBOT_WS_PATH) {
+        if (cfg.ONEBOT_ACCESS_TOKEN) {
+          const auth = req.headers.get("authorization") ?? "";
+          if (auth !== `Bearer ${cfg.ONEBOT_ACCESS_TOKEN}`) return new Response("unauthorized", { status: 401 });
+        }
+        if (srv.upgrade(req, { data: undefined })) return;
+        return new Response("upgrade failed", { status: 400 });
+      }
+      if (url.pathname === "/ingest/ework") return ingest(req);
+      return new Response("not found", { status: 404 });
+    },
+  });
+
+  console.log(`[qq-bridge] listening on :${cfg.PORT} (ws ${cfg.ONEBOT_WS_PATH}, ingest /ingest/ework)`);
+}
+
+main();

package/src/ingest.ts

@@ -0,0 +1,83 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+export interface WebhookComment {
+  commentId: number;
+  owner: string;
+  repo: string;
+  number: number;
+  author: string;
+  body: string;
+}
+
+interface IngestDeps {
+  secret: string;
+  bridgeLogin: string;
+  agentLogins: Set<string>;
+  scrub: (text: string) => string;
+  projectOf(owner: string, repo: string): number | null;
+  commentForwarded(commentId: number): boolean;
+  send(groupId: number, text: string): Promise<void>;
+}
+
+export function verifySignature(secret: string, body: string, header: string | null): boolean {
+  if (!secret) return true;
+  if (!header) return false;
+  const expected = `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;
+  const a = Buffer.from(expected);
+  const b = Buffer.from(header);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
+export function createIngest(deps: IngestDeps) {
+  return async function ingest(req: Request): Promise<Response> {
+    const event = req.headers.get("x-gitea-event") ?? "";
+    if (req.method !== "POST") return new Response("method not allowed", { status: 405 });
+    const raw = await req.text();
+    if (!verifySignature(deps.secret, raw, req.headers.get("x-gitea-signature"))) {
+      console.warn(`[qq-bridge] rejecting webhook: bad signature (event=${event})`);
+      return new Response("bad signature", { status: 401 });
+    }
+    if (event !== "issue_comment") return new Response("ignored", { status: 200 });
+
+    let parsed: Record<string, unknown>;
+    try {
+      parsed = JSON.parse(raw) as Record<string, unknown>;
+    } catch {
+      return new Response("bad json", { status: 400 });
+    }
+    const action = String(parsed.action ?? "");
+    if (action !== "created") return new Response("ignored", { status: 200 });
+
+    const repo = (parsed.repository ?? {}) as Record<string, unknown>;
+    const owner = ((repo.owner ?? {}) as Record<string, unknown>).login;
+    const issue = (parsed.issue ?? {}) as Record<string, unknown>;
+    const comment = (parsed.comment ?? {}) as Record<string, unknown>;
+    if (typeof owner !== "string" || typeof repo.name !== "string") return new Response("ignored", { status: 200 });
+
+    const author = String(((comment.user ?? {}) as Record<string, unknown>).login ?? "");
+    const body = String(comment.body ?? "");
+    const number = Number(issue.number);
+    const commentId = Number(comment.id);
+
+    // Echo guard: our own posts and plumbing notices must never loop back.
+    if (author === deps.bridgeLogin) return new Response("skipped:self", { status: 200 });
+    if (body.startsWith("[system]") || body.startsWith("[SYSTEM ")) return new Response("skipped:system", { status: 200 });
+    if (!deps.agentLogins.has(author)) return new Response("skipped:non-agent", { status: 200 });
+
+    const groupId = deps.projectOf(owner, String(repo.name));
+    if (groupId === null) return new Response("skipped:unmapped", { status: 200 });
+    if (!Number.isInteger(commentId) || deps.commentForwarded(commentId)) {
+      return new Response("skipped:dup", { status: 200 });
+    }
+
+    const text = deps.scrub(`[#${number}] ${body}`);
+    try {
+      await deps.send(groupId, text);
+    } catch (err) {
+      console.error(`[qq-bridge] send_group_msg failed: ${err instanceof Error ? err.message : err}`);
+      return new Response("send failed", { status: 502 });
+    }
+    return new Response("forwarded", { status: 200 });
+  };
+}

package/src/onebot.ts

@@ -0,0 +1,131 @@
+import type { ServerWebSocket } from "bun";
+
+ type HeadersInitLike = Record<string, string>;
+
+export interface GroupMessageEvent {
+  postId: string;
+  groupId: number;
+  userId: number;
+  nickname: string;
+  rawMessage: string;
+  post_type: string;
+  message_type: string;
+}
+
+interface OneBotEvent {
+  post_id?: number | string;
+  post_type?: string;
+  message_type?: string;
+  group_id?: number;
+  user_id?: number;
+  sender?: { card?: string; nickname?: string };
+  raw_message?: string;
+  time?: number;
+  [key: string]: unknown;
+}
+
+interface ApiRequest {
+  action: string;
+  params: Record<string, unknown>;
+  echo?: string;
+}
+
+interface ApiResult {
+  status: string;
+  retcode: number;
+  data?: unknown;
+}
+
+// Public API handle: call() sends OneBot actions and waits for the echo-matched
+// result; connection lifecycle is owned by the server.
+export interface OneBotApi {
+  call(action: string, params: Record<string, unknown>): Promise<ApiResult>;
+}
+
+export interface OneBotServerOptions {
+  path: string;
+  accessToken: string;
+  onEvent(ev: GroupMessageEvent): void | Promise<void>;
+  onReady(api: OneBotApi): void;
+}
+
+interface PendingEntry {
+  resolve: (r: ApiResult) => void;
+  reject: (e: Error) => void;
+  timer: ReturnType<typeof setTimeout>;
+}
+
+export function createOneBotServer(opts: OneBotServerOptions) {
+  const pending = new Map<string, PendingEntry>();
+  let ws: ServerWebSocket<unknown> | null = null;
+
+  function rejectAll(reason: string) {
+    for (const [, entry] of pending) {
+      entry.reject(new Error(reason));
+    }
+    pending.clear();
+    ws = null;
+  }
+
+  return {
+    get connected() {
+      return ws !== null;
+    },
+
+    // Bun handlers: wire these into Bun.serve({websocket:{...}})
+    handlers: {
+      open(client: ServerWebSocket<unknown>) {
+        if (ws) {
+          client.close(4000, "duplicate connection");
+          return;
+        }
+        ws = client;
+        const api: OneBotApi = {
+          call(action, params) {
+            const echo = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            return new Promise<ApiResult>((resolve, reject) => {
+              const timer = setTimeout(() => {
+                pending.delete(echo);
+                reject(new Error(`OneBot call ${action} timed out`));
+              }, 10_000);
+              pending.set(echo, { resolve, reject, timer });
+              const req: ApiRequest = { action, params, echo };
+              client.send(JSON.stringify(req));
+            });
+          },
+        };
+        opts.onReady(api);
+      },
+      message(_client: ServerWebSocket<unknown>, data: string | Buffer) {
+        let msg: OneBotEvent & { echo?: string; status?: string; retcode?: number; data?: unknown };
+        try {
+          msg = JSON.parse(String(data)) as typeof msg;
+        } catch {
+          return;
+        }
+        if (typeof msg.echo === "string" && pending.has(msg.echo)) {
+          const entry = pending.get(msg.echo)!;
+          pending.delete(msg.echo);
+          clearTimeout(entry.timer);
+          entry.resolve({ status: msg.status ?? "unknown", retcode: msg.retcode ?? -1, data: msg.data });
+          return;
+        }
+        if (msg.post_type === "message" && msg.message_type === "group") {
+          const ev: GroupMessageEvent = {
+            postId: String(msg.post_id ?? `${msg.time ?? 0}-${msg.user_id ?? 0}`),
+            groupId: Number(msg.group_id ?? 0),
+            userId: Number(msg.user_id ?? 0),
+            nickname: String(msg.sender?.card || msg.sender?.nickname || String(msg.user_id ?? "")),
+            rawMessage: String(msg.raw_message ?? ""),
+            post_type: "message",
+            message_type: "group",
+          };
+          void opts.onEvent(ev);
+        }
+      },
+      close() {
+        rejectAll("connection closed");
+      },
+    },
+  };
+}

package/src/router.ts

@@ -0,0 +1,82 @@
+import type { GroupBinding, Config } from "./config";
+import type { EworkClient } from "./ework";
+import type { GroupMessageEvent } from "./onebot";
+import type { BridgeStore } from "./db";
+
+const HELP_TEXT = [
+  "用法：",
+  "  任务 <标题> —— 新建 issue，AI 自动接单",
+  "  #<编号> <内容> —— 给指定 issue 追加内容",
+  "  查询 —— 列出最近 issue",
+].join("\n");
+
+export interface RouterDeps {
+  cfg: Config;
+  bindings: GroupBinding[];
+  wakeList: Set<string>;
+  ework: EworkClient;
+  store: BridgeStore;
+  reply(groupId: number, text: string): Promise<void>;
+}
+
+interface ParsedCommand {
+  kind: "create" | "comment" | "help";
+  title?: string;
+  number?: number;
+  body?: string;
+}
+
+export function parseCommand(raw: string): ParsedCommand | null {
+  const text = raw.trim();
+  if (text === "帮助" || text === "help" || text === "查询") return { kind: "help" };
+  const create = /^(?:任务|task|新任务)\s+(.+)$/i.exec(text);
+  if (create?.[1]) return { kind: "create", title: create[1].trim() };
+  const comment = /^#(\d{1,6})\s+([\s\S]+)$/.exec(text);
+  if (comment?.[1] && comment[2]) return { kind: "comment", number: Number(comment[1]), body: comment[2].trim() };
+  return null;
+}
+
+export function createRouter(deps: RouterDeps) {
+  const { cfg, bindings, wakeList, ework, store } = deps;
+
+  async function handleGroupMessage(ev: GroupMessageEvent): Promise<void> {
+    if (store.seenPost(ev.postId)) return;
+    const binding = bindings.find((b) => b.groupId === ev.groupId);
+    if (!binding) return;
+
+    if (!wakeList.has(String(ev.userId))) {
+      if (cfg.VERBOSE) console.log(`[qq-bridge] ignore non-whitelisted ${ev.userId} in ${ev.groupId}`);
+      return;
+    }
+
+    const cmd = parseCommand(ev.rawMessage);
+    if (!cmd) {
+      if (cfg.VERBOSE) console.log(`[qq-bridge] unrecognized message from ${ev.userId}: ${ev.rawMessage.slice(0, 80)}`);
+      return;
+    }
+    if (cmd.kind === "help") {
+      await deps.reply(ev.groupId, HELP_TEXT);
+      return;
+    }
+
+    const attribution = `> 来自 QQ 群用户 **${ev.nickname}** (${ev.userId})`;
+
+    try {
+      if (cmd.kind === "create") {
+        const n = await ework.createIssue(binding.owner, binding.repo, cmd.title ?? "", `${attribution}\n\n${cmd.title ?? ""}`);
+        await deps.reply(ev.groupId, `✅ 已创建 issue #${n}，AI 已接单：${cmd.title ?? ""}`);
+        return;
+      }
+      if (cmd.kind === "comment" && cmd.number !== undefined) {
+        await ework.addComment(binding.owner, binding.repo, cmd.number, `${attribution}\n\n${cmd.body ?? ""}`);
+        await deps.reply(ev.groupId, `✅ 已追加到 #${cmd.number}`);
+        return;
+      }
+    } catch (err) {
+      console.error(`[qq-bridge] ework call failed: ${err instanceof Error ? err.message : err}`);
+      await deps.reply(ev.groupId, `❌ 处理失败：${err instanceof Error ? err.message : "unknown"}`);
+    }
+  }
+
+  return { handleGroupMessage };
+}

package/src/scrub.ts

@@ -0,0 +1,26 @@
+// Outbound text hygiene: never leak internal hostnames/IPs into QQ groups.
+// IP ranges are always scrubbed (RFC1918); hostnames come from env so the
+// published package carries no real infrastructure names (same policy as
+// ework-mirror).
+
+const IP_PATTERNS = [
+  /192\.168\.\d{1,3}\.\d{1,3}/g,
+  /10\.\d{1,3}\.\d{1,3}\.\d{1,3}/g,
+  /172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}/g,
+];
+
+export function buildScrubber(hosts: string[]): (text: string) => string {
+  const hostPatterns = hosts
+    .map((h) => h.trim())
+    .filter((h) => h.length > 0)
+    .map((h) => ({ re: new RegExp(h.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), h }));
+  return (text: string): string => {
+    let out = text;
+    for (const p of IP_PATTERNS) out = out.replace(p, "[内网IP]");
+    for (const { re, h } of hostPatterns) {
+      if (h.includes(out)) continue;
+      out = out.replace(re, "[内部主机]");
+    }
+    return out;
+  };
+}

package/tests/bridge.test.ts

@@ -0,0 +1,73 @@
+import { describe, test, expect } from "bun:test";
+import { parseCommand } from "../src/router";
+import { parseGroupMap, parseList } from "../src/config";
+import { buildScrubber } from "../src/scrub";
+import { verifySignature } from "../src/ingest";
+
+describe("parseCommand", () => {
+  test("create via 任务/task", () => {
+    expect(parseCommand("任务 修复登录超时")).toEqual({ kind: "create", title: "修复登录超时" });
+    expect(parseCommand("task add dark mode")).toEqual({ kind: "create", title: "add dark mode" });
+    expect(parseCommand("新任务 优化缓存")).toEqual({ kind: "create", title: "优化缓存" });
+  });
+
+  test("comment via #N", () => {
+    expect(parseCommand("#42 这个问题还在")).toEqual({ kind: "comment", number: 42, body: "这个问题还在" });
+    expect(parseCommand("#123\n多行\n内容")).toEqual({ kind: "comment", number: 123, body: "多行\n内容" });
+  });
+
+  test("help keywords", () => {
+    for (const k of ["帮助", "help", "查询"]) expect(parseCommand(k)?.kind).toBe("help");
+  });
+
+  test("unrecognized returns null", () => {
+    expect(parseCommand("今天天气不错")).toBeNull();
+    expect(parseCommand("")).toBeNull();
+    expect(parseCommand("#999")).toBeNull();
+  });
+});
+
+describe("parseGroupMap", () => {
+  test("valid mapping", () => {
+    expect(parseGroupMap("123456:ranxianglei/billion-context, 987654:dog/test1")).toEqual([
+      { groupId: 123456, owner: "ranxianglei", repo: "billion-context" },
+      { groupId: 987654, owner: "dog", repo: "test1" },
+    ]);
+  });
+
+  test("invalid entries throw", () => {
+    expect(() => parseGroupMap("123456:billion-context")).toThrow();
+    expect(() => parseGroupMap("abc:x/y")).toThrow();
+    expect(() => parseGroupMap(",,")).toThrow();
+  });
+});
+
+describe("buildScrubber", () => {
+  test("scrubs RFC1918 IPs always", () => {
+    const scrub = buildScrubber([]);
+    expect(scrub("server at 192.168.1.5 and 10.0.0.2")).not.toContain("192.168.1.5");
+    expect(scrub("server at 192.168.1.5 and 10.0.0.2")).not.toContain("10.0.0.2");
+  });
+
+  test("scrubs configured hosts but keeps others", () => {
+    const scrub = buildScrubber(["internal.example", "box-one"]);
+    const out = scrub("see internal.example and box-one but example.org is fine");
+    expect(out).toContain("[内部主机]");
+    expect(out).toContain("example.org");
+  });
+});
+
+describe("verifySignature", () => {
+  test("valid HMAC passes", () => {
+    const body = JSON.stringify({ a: 1 });
+    const crypto = require("node:crypto");
+    const mac = `sha256=${crypto.createHmac("sha256", "secret").update(body).digest("hex")}`;
+    expect(verifySignature("secret", body, mac)).toBe(true);
+  });
+
+  test("wrong signature and missing header fail; empty secret allows", () => {
+    expect(verifySignature("secret", "x", "sha256=deadbeef")).toBe(false);
+    expect(verifySignature("secret", "x", null)).toBe(false);
+    expect(verifySignature("", "x", null)).toBe(true);
+  });
+});

package/tsconfig.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ESNext"],
+    "types": ["bun-types"],
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "noImplicitOverride": true,
+    "noFallthroughCasesInSwitch": true,
+    "exactOptionalPropertyTypes": true,
+    "isolatedModules": true,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "resolveJsonModule": true,
+    "noEmit": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src/**/*.ts", "bin/**/*.js"],
+  "exclude": ["node_modules"]
+}