feat: extend feishu track sync

.env.example

@@ -2,6 +2,10 @@
 WINLOOP_PG_URL=postgresql://winloop:password@127.0.0.1:5432/winloop
 WINLOOP_REDIS_URL=redis://:password@127.0.0.1:6379/0
 
+# ===== 开发态地址契约（pnpm dev / pnpm dev:pwa 必填）=====
+WINLOOP_DEV_HOST=127.0.0.1
+WINLOOP_DEV_PORT=3510
+
 WINLOOP_STORAGE_PROVIDER=local
 WINLOOP_STORAGE_LOCAL_ROOT=./tmp/document-storage
 WINLOOP_STORAGE_ENDPOINT=
@@ -27,5 +31,48 @@ WINLOOP_ONLYOFFICE_ENDPOINT=
 WINLOOP_ONLYOFFICE_JWT_SECRET=
 # 应用外网基地址（推荐，必须为可访问应用的绝对地址，不带 /api；例如 https://app.example.com）
 WINLOOP_PUBLIC_BASE_URL=
+# draw.io embed 宿主（留空默认 https://embed.diagrams.net；若使用内网或自托管 draw.io，请填写可访问的绝对地址）
+WINLOOP_PUBLIC_DRAWIO_EMBED_BASE_URL=
+# tldraw 4.x 生产 license key（仅生产 HTTPS 非 localhost 部署必配）
+WINLOOP_TLDRAW_LICENSE_KEY=
 # 项目资源临时访问地址有效期（秒）
 WINLOOP_PROJECT_RESOURCE_ACCESS_URL_TTL_SECONDS=600
+
+# ===== 答辩 Realtime（当前验收主链路：Qwen + audio_video）=====
+WINLOOP_DEFENSE_REALTIME_QWEN_BASE_WS_URL=wss://dashscope.aliyuncs.com/api-ws/v1/inference
+WINLOOP_DEFENSE_REALTIME_QWEN_API_KEY=
+WINLOOP_DEFENSE_REALTIME_QWEN_WORKSPACE_ID=
+WINLOOP_DEFENSE_REALTIME_QWEN_APP_ID=
+WINLOOP_DEFENSE_REALTIME_QWEN_VOICE=
+WINLOOP_DEFENSE_REALTIME_QWEN_FRAME_INTERVAL_MS=1000
+
+# Coze 当前保留为备选链路，本轮默认不作为主验收路径
+WINLOOP_DEFENSE_REALTIME_COZE_BASE_URL=https://api.coze.cn
+WINLOOP_DEFENSE_REALTIME_COZE_BOT_ID=
+WINLOOP_DEFENSE_REALTIME_COZE_CONNECTOR_ID=
+WINLOOP_DEFENSE_REALTIME_COZE_VOICE_ID=
+WINLOOP_DEFENSE_REALTIME_COZE_AUTH_MODE=pat
+WINLOOP_DEFENSE_REALTIME_COZE_PAT_OR_OAUTH_SECRET=
+
+# ===== 本地 ASR dev bridge（可选；推荐先接 Groq 免费试用）=====
+MEETING_ASR_DEV_TRANSCRIBE_URL=https://api.groq.com/openai/v1/audio/transcriptions
+MEETING_ASR_DEV_TRANSCRIBE_MODEL=whisper-large-v3-turbo
+MEETING_ASR_DEV_TRANSCRIBE_MODEL_FALLBACKS=whisper-large-v3
+MEETING_ASR_DEV_TRANSCRIBE_LANGUAGE=zh
+MEETING_ASR_DEV_TRANSCRIBE_API_KEY=
+MEETING_ASR_DEV_CALLBACK_URL=http://127.0.0.1:3510/api/internal/meetings/asr-events
+MEETING_ASR_DEV_CALLBACK_SECRET=
+MEETING_ASR_DEV_MIN_CHUNK_MS=4000
+
+# ===== Sentry（可选；未配置时应用仍可运行，只是不启用上报）=====
+WINLOOP_SENTRY_DSN=
+# 仅支持 staging / production；本地开发可留空
+WINLOOP_SENTRY_ENVIRONMENT=
+WINLOOP_SENTRY_TRACES_SAMPLE_RATE=0.1
+# 可选；默认复用 WINLOOP_BUILD_VERSION
+WINLOOP_SENTRY_RELEASE=
+
+# ===== Sentry 构建期参数（仅 CI/CD 构建并上传 source map 时需要）=====
+SENTRY_AUTH_TOKEN=
+WINLOOP_SENTRY_ORG=
+WINLOOP_SENTRY_PROJECT=

.github/workflows/ci.yml

@@ -60,9 +60,8 @@ jobs:
       - name: Project Visibility Guard
         run: pnpm run test:project-visibility
 
-  build_and_smoke:
+  test_unit:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v5
@@ -79,8 +78,56 @@ jobs:
       - name: Install
         run: pnpm install --frozen-lockfile
 
-      - name: Build
-        run: pnpm run build
+      - name: Unit Tests
+        run: pnpm run test:unit
+
+  smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: lts/*
+          package-manager-cache: false
+
+      - name: Enable Corepack (pnpm)
+        run: |
+          corepack enable
+          corepack prepare pnpm@10.29.2 --activate
+          pnpm --version
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
 
       - name: Smoke
-        run: pnpm run ci:smoke
+        run: pnpm run test:smoke
+
+  e2e_smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: lts/*
+          package-manager-cache: false
+
+      - name: Enable Corepack (pnpm)
+        run: |
+          corepack enable
+          corepack prepare pnpm@10.29.2 --activate
+          pnpm --version
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: E2E Smoke
+        env:
+          WINLOOP_PG_URL: ${{ secrets.WINLOOP_PG_URL }}
+        run: |
+          if [ -z "$WINLOOP_PG_URL" ]; then
+            echo "WINLOOP_PG_URL 未配置，跳过 E2E smoke。"
+            exit 0
+          fi
+          pnpm run test:e2e

.github/workflows/github-feishu-notify.yml

@@ -0,0 +1,189 @@
+name: GitHub Feishu Notify
+
+on:
+  issues:
+    types:
+      - opened
+      - reopened
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - ready_for_review
+
+permissions:
+  contents: read
+
+jobs:
+  notify-feishu:
+    name: Notify Feishu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check webhook configuration
+        id: config
+        env:
+          FEISHU_WEBHOOK_URL: ${{ secrets.FEISHU_GITHUB_WEBHOOK_URL }}
+        run: |
+          set -euo pipefail
+
+          if [ -n "${FEISHU_WEBHOOK_URL}" ]; then
+            echo "enabled=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "enabled=false" >> "${GITHUB_OUTPUT}"
+            echo "Skip Feishu notification because FEISHU_GITHUB_WEBHOOK_URL is not configured."
+          fi
+
+      - name: Send Feishu notification
+        if: steps.config.outputs.enabled == 'true'
+        env:
+          FEISHU_WEBHOOK_URL: ${{ secrets.FEISHU_GITHUB_WEBHOOK_URL }}
+          FEISHU_WEBHOOK_SECRET: ${{ secrets.FEISHU_GITHUB_WEBHOOK_SECRET }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          GITHUB_EVENT_ACTION: ${{ github.event.action }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+          GITHUB_EVENT_PATH: ${{ github.event_path }}
+        run: |
+          set -euo pipefail
+
+          python3 <<'PY'
+          import base64
+          import hashlib
+          import hmac
+          import json
+          import os
+          import time
+          import urllib.request
+
+          def to_text(value) -> str:
+              return str(value or "").strip()
+
+          def shorten(value: str, limit: int = 180) -> str:
+              text = to_text(value)
+              if len(text) <= limit:
+                  return text
+              return f"{text[: max(0, limit - 3)]}..."
+
+          def read_event_payload() -> dict:
+              path = to_text(os.environ.get("GITHUB_EVENT_PATH"))
+              with open(path, "r", encoding="utf-8") as handle:
+                  return json.load(handle)
+
+          def build_issue_message(payload: dict) -> str:
+              issue = payload.get("issue") or {}
+              action = to_text(os.environ.get("GITHUB_EVENT_ACTION"))
+              number = issue.get("number") or payload.get("number") or "-"
+              title = to_text(issue.get("title")) or "-"
+              url = to_text(issue.get("html_url"))
+              labels = ", ".join(
+                  to_text(item.get("name"))
+                  for item in (issue.get("labels") or [])
+                  if to_text(item.get("name"))
+              ) or "-"
+              body_preview = shorten(issue.get("body") or "", 220) or "-"
+              actor = to_text(os.environ.get("GITHUB_ACTOR")) or "-"
+              repository = to_text(os.environ.get("GITHUB_REPOSITORY")) or "-"
+              action_label = "新建" if action == "opened" else "重新打开"
+              run_url = f"{to_text(os.environ.get('GITHUB_SERVER_URL'))}/{repository}/actions/runs/{to_text(os.environ.get('GITHUB_RUN_ID'))}"
+              return "\n".join([
+                  "GitHub Issue 通知",
+                  f"动作：{action_label}",
+                  f"仓库：{repository}",
+                  f"Issue：#{number} {title}",
+                  f"发起人：{actor}",
+                  f"标签：{labels}",
+                  f"摘要：{body_preview}",
+                  f"链接：{url}",
+                  f"Workflow：{run_url}",
+              ])
+
+          def build_pr_message(payload: dict) -> str:
+              pr = payload.get("pull_request") or {}
+              action = to_text(os.environ.get("GITHUB_EVENT_ACTION"))
+              number = pr.get("number") or payload.get("number") or "-"
+              title = to_text(pr.get("title")) or "-"
+              url = to_text(pr.get("html_url"))
+              actor = to_text(os.environ.get("GITHUB_ACTOR")) or "-"
+              repository = to_text(os.environ.get("GITHUB_REPOSITORY")) or "-"
+              base_ref = to_text(((pr.get("base") or {}).get("ref"))) or "-"
+              head_ref = to_text(((pr.get("head") or {}).get("ref"))) or "-"
+              is_draft = bool(pr.get("draft"))
+              labels = ", ".join(
+                  to_text(item.get("name"))
+                  for item in (pr.get("labels") or [])
+                  if to_text(item.get("name"))
+              ) or "-"
+              body_preview = shorten(pr.get("body") or "", 220) or "-"
+              action_label_map = {
+                  "opened": "新建",
+                  "reopened": "重新打开",
+                  "ready_for_review": "转为可评审",
+              }
+              action_label = action_label_map.get(action, action or "触发")
+              draft_label = "是" if is_draft else "否"
+              run_url = f"{to_text(os.environ.get('GITHUB_SERVER_URL'))}/{repository}/actions/runs/{to_text(os.environ.get('GITHUB_RUN_ID'))}"
+              return "\n".join([
+                  "GitHub PR 通知",
+                  f"动作：{action_label}",
+                  f"仓库：{repository}",
+                  f"PR：#{number} {title}",
+                  f"发起人：{actor}",
+                  f"分支：{head_ref} -> {base_ref}",
+                  f"Draft：{draft_label}",
+                  f"标签：{labels}",
+                  f"摘要：{body_preview}",
+                  f"链接：{url}",
+                  f"Workflow：{run_url}",
+              ])
+
+          def build_message() -> str:
+              payload = read_event_payload()
+              event_name = to_text(os.environ.get("GITHUB_EVENT_NAME"))
+              if event_name == "issues":
+                  return build_issue_message(payload)
+              if event_name == "pull_request_target":
+                  return build_pr_message(payload)
+              raise SystemExit(f"Unsupported event: {event_name}")
+
+          def build_signature(secret: str) -> tuple[str, str]:
+              timestamp = str(int(time.time()))
+              string_to_sign = f"{timestamp}\n{secret}"
+              signature = base64.b64encode(
+                  hmac.new(string_to_sign.encode("utf-8"), digestmod=hashlib.sha256).digest()
+              ).decode("utf-8")
+              return timestamp, signature
+
+          webhook_url = to_text(os.environ.get("FEISHU_WEBHOOK_URL"))
+          webhook_secret = to_text(os.environ.get("FEISHU_WEBHOOK_SECRET"))
+          if not webhook_url:
+              raise SystemExit("Missing FEISHU_GITHUB_WEBHOOK_URL")
+
+          payload = {
+              "msg_type": "text",
+              "content": {
+                  "text": build_message(),
+              },
+          }
+          if webhook_secret:
+              timestamp, sign = build_signature(webhook_secret)
+              payload["timestamp"] = timestamp
+              payload["sign"] = sign
+
+          request = urllib.request.Request(
+              webhook_url,
+              data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
+              headers={"Content-Type": "application/json; charset=utf-8"},
+              method="POST",
+          )
+          with urllib.request.urlopen(request, timeout=15) as response:
+              body = response.read().decode("utf-8", errors="replace")
+
+          result = json.loads(body) if body else {}
+          code = result.get("code", 0)
+          if code not in (0, "0", None):
+              raise SystemExit(f"Feishu webhook returned code={code}, msg={result.get('msg', '')}")
+
+          print("Feishu notification sent successfully.")
+          PY