feat(platform): add WPS Xiezuo native platform (#921)

* feat(wps-xiezuo): add native Go platform for WPS Xiezuo

Replace the Python bridge adapter with a native Go platform that compiles
directly into the cc-connect binary. Users only need to configure app_id and
app_secret in config.toml.

- WebSocket long connection with KSO-1 HMAC-SHA256 authentication
- AES-256-CBC event decryption with PKCS7 padding
- Event signature verification (HMAC-SHA256, base64url)
- X-Ack-Mode with writeLoop-serialized ACK responses
- Client/Server ping-pong with 90s deadline timeout
- REST API for sending messages (P2P and group)
- Emoji reaction typing indicator
- Token management (client_credentials, form-urlencoded)
- Dedup and allow_from support

Co-Authored-By: Claude Opus 4.6 <noreply@anthropicxxxxxx.com>

* fix(wps-xiezuo): address lint errors (errcheck, unused, staticcheck)

- Check SetReadDeadline return values with _ = prefix
- Remove unused tokenRequest struct (now using url.Values)
- Replace deprecated websocket.Upgrade with websocket.Upgrader

Co-Authored-By: Claude Opus 4.6 <noreply@anthropicxxxxxx.com>

* fix(wps-xiezuo): check Stop() return value in handleGoAway

Co-Authored-By: Claude Opus 4.6 <noreply@anthropicxxxxxx.com>

* fix(wps-xiezuo): fix data race in writeLoop channel access

Pass writeCh as parameter to writeLoop instead of reading p.writeCh
directly, eliminating race between close/nil assignment in defer and
channel read in writeLoop goroutine.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropicxxxxxx.com>

* docs(wps-xiezuo): prepare native platform PR

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropicxxxxxx.com>

README.md

@@ -184,15 +184,15 @@ High-level view of what each **built-in platform** can do in cc-connect.
 
 † **QQ (NapCat / OneBot)** — unofficial self-hosted bridge; behaviour depends on your NapCat / network setup.
 
-| Capability | Feishu | DingTalk | Telegram | Slack | Discord | LINE | WeCom | Weibo | **Weixin**<br>*(personal)* | QQ† | QQ Bot |
-|------------|:------:|:--------:|:--------:|:-----:|:-------:|:----:|:-----:|:-----:|:-------------------------:|:---:|:------:|
-| Text & slash commands | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-| Markdown / cards | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ⚠️ | ❌ | ✅ | ✅ | ✅ |
-| Streaming / chunked replies | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-| Images & files | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ✅ | ❌ | ✅ | ✅ | ✅ |
-| Voice / STT / TTS | ⚠️ | ⚠️ | ✅ | ⚠️ | ⚠️ | ❌ | ⚠️ | ❌ | ✅ | ⚠️ | ⚠️ |
-| Private (DM) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-| Group / channel | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ✅ | ❌ | ✅ | ✅ | ✅ |
+| Capability | Feishu | WPS Xiezuo | DingTalk | Telegram | Slack | Discord | LINE | WeCom | Weibo | **Weixin**<br>*(personal)* | QQ† | QQ Bot |
+|------------|:------:|:----------:|:--------:|:--------:|:-----:|:-------:|:----:|:-----:|:-----:|:-------------------------:|:---:|:------:|
+| Text & slash commands | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Markdown / cards | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ⚠️ | ❌ | ✅ | ✅ | ✅ |
+| Streaming / chunked replies | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Images & files | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ✅ | ❌ | ✅ | ✅ | ✅ |
+| Voice / STT / TTS | ⚠️ | ❌ | ⚠️ | ✅ | ⚠️ | ⚠️ | ❌ | ⚠️ | ❌ | ✅ | ⚠️ | ⚠️ |
+| Private (DM) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Group / channel | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ✅ | ❌ | ✅ | ✅ | ✅ |
 
 > **WeCom:** Webhook mode needs a **public URL**; long-connection / WS style setups often do not.  
 > **Voice row:** many platforms need `[speech]` / TTS providers enabled in `config.toml`; values are a best-effort summary.  
@@ -205,7 +205,7 @@ High-level view of what each **built-in platform** can do in cc-connect.
 **10+ AI Agents** — Claude Code, Codex, Cursor Agent, Kimi CLI, Qoder CLI, Gemini CLI, OpenCode, iFlow CLI, Pi, Devin — plus any agent that supports the [Agent Client Protocol (ACP)](https://agentclientprotocol.com/get-started/agents). Use whichever fits your workflow, or all of them at once.
 
 ### 📱 Platform Flexibility
-**11 Chat Platforms** — Feishu, DingTalk, Slack, Telegram, Discord, WeChat Work, Weibo, LINE, QQ, QQ Bot (Official), plus **Weixin (personal ilink)** for **personal WeChat**. Most platforms need **zero public IP**.
+**12 Chat Platforms** — Feishu, WPS Xiezuo, DingTalk, Slack, Telegram, Discord, WeChat Work, Weibo, LINE, QQ, QQ Bot (Official), plus **Weixin (personal ilink)** for **personal WeChat**. Most platforms need **zero public IP**.
 
 ### 🔄 Multi-Agent Orchestration
 **Multi-Bot Relay** — Bind multiple bots in a group chat and let them communicate with each other. Ask Claude, get insights from Gemini — all in one conversation.
@@ -342,6 +342,7 @@ cc-connect update --pre     # Include pre-releases
 | Agent | Aider | 🔜 Planned |
 | Platform | Feishu (Lark) | ✅ WebSocket — no public IP needed |
 | Platform | DingTalk | ✅ Stream — no public IP needed |
+| Platform | WPS Xiezuo | ✅ WebSocket — no public IP needed |
 | Platform | Telegram | ✅ Long Polling — no public IP needed |
 | Platform | Slack | ✅ Socket Mode — no public IP needed |
 | Platform | Discord | ✅ Gateway — no public IP needed |
@@ -359,6 +360,7 @@ cc-connect update --pre     # Include pre-releases
 |----------|-------|------------|------------|
 | Feishu (Lark) | [docs/feishu.md](docs/feishu.md) | WebSocket | No |
 | DingTalk | [docs/dingtalk.md](docs/dingtalk.md) | Stream | No |
+| WPS Xiezuo | [docs/wps-xiezuo.md](docs/wps-xiezuo.md) | WebSocket | No |
 | Telegram | [docs/telegram.md](docs/telegram.md) | Long Polling | No |
 | Slack | [docs/slack.md](docs/slack.md) | Socket Mode | No |
 | Discord | [docs/discord.md](docs/discord.md) | Gateway | No |

README.zh-CN.md

@@ -184,15 +184,15 @@ MiniMax M2.7 是 MiniMax 首个深度参与自我迭代的模型，可自主构
 
 † **QQ（NapCat / OneBot）** — 非官方自建桥接，体验依赖你的 NapCat 与网络环境。
 
-| 能力 | 飞书 | 钉钉 | Telegram | Slack | Discord | LINE | 企业微信 | 微博 | **微信个人号**<br>（ilink） | QQ† | QQ 官方机器人 |
-|------|:----:|:----:|:--------:|:-----:|:-------:|:----:|:--------:|:----:|:--------------------------:|:---:|:------------:|
-| 文本与斜杠命令 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-| Markdown / 卡片 | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ⚠️ | ❌ | ✅ | ✅ | ✅ |
-| 流式 / 分片回复 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-| 图片与文件 | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ✅ | ❌ | ✅ | ✅ | ✅ |
-| 语音 / STT / TTS | ⚠️ | ⚠️ | ✅ | ⚠️ | ⚠️ | ❌ | ⚠️ | ❌ | ✅ | ⚠️ | ⚠️ |
-| 私聊 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-| 群聊 / 频道 | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ✅ | ❌ | ✅ | ✅ | ✅ |
+| 能力 | 飞书 | WPS 协作 | 钉钉 | Telegram | Slack | Discord | LINE | 企业微信 | 微博 | **微信个人号**<br>（ilink） | QQ† | QQ 官方机器人 |
+|------|:----:|:--------:|:----:|:--------:|:-----:|:-------:|:----:|:--------:|:----:|:--------------------------:|:---:|:------------:|
+| 文本与斜杠命令 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Markdown / 卡片 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ⚠️ | ❌ | ✅ | ✅ | ✅ |
+| 流式 / 分片回复 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| 图片与文件 | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ✅ | ❌ | ✅ | ✅ | ✅ |
+| 语音 / STT / TTS | ⚠️ | ❌ | ⚠️ | ✅ | ⚠️ | ⚠️ | ❌ | ⚠️ | ❌ | ✅ | ⚠️ | ⚠️ |
+| 私聊 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| 群聊 / 频道 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ✅ | ❌ | ✅ | ✅ | ✅ |
 
 > **企业微信：** Webhook 模式需要**公网 URL**；长连接等模式多数**不需要**。  
 > **语音行：** 多数平台要在 `config.toml` 里配置 `[speech]` / TTS 等，表中为经验性归纳。  
@@ -205,7 +205,7 @@ MiniMax M2.7 是 MiniMax 首个深度参与自我迭代的模型，可自主构
 **10+ 大 AI Agent** — Claude Code、Codex、Cursor Agent、Kimi CLI、Qoder CLI、Gemini CLI、OpenCode、iFlow CLI、Pi、Devin，还可通过 [Agent Client Protocol (ACP)](https://agentclientprotocol.com/get-started/agents) 接入更多 Agent。按需选用，或同时使用全部。
 
 ### 📱 平台灵活性
-**11 大聊天平台** — 飞书、钉钉、Slack、Telegram、Discord、企业微信、微博、LINE、QQ、QQ 官方机器人，以及 **微信个人号（ilink）**。大部分平台**无需公网 IP**。
+**12 大聊天平台** — 飞书、WPS 协作、钉钉、Slack、Telegram、Discord、企业微信、微博、LINE、QQ、QQ 官方机器人，以及 **微信个人号（ilink）**。大部分平台**无需公网 IP**。
 
 ### 🔄 多 Agent 编排
 **多机器人中继** — 在群聊中绑定多个机器人，让它们相互协作。问 Claude，再听 Gemini 的见解 — 同一个对话搞定。
@@ -342,6 +342,7 @@ cc-connect update --pre     # 含预发布版本
 | Agent | Aider | 🔜 计划中 |
 | Platform | 飞书 (Lark) | ✅ WebSocket — 无需公网 IP |
 | Platform | 钉钉 | ✅ Stream — 无需公网 IP |
+| Platform | WPS 协作 | ✅ WebSocket — 无需公网 IP |
 | Platform | Telegram | ✅ Long Polling — 无需公网 IP |
 | Platform | Slack | ✅ Socket Mode — 无需公网 IP |
 | Platform | Discord | ✅ Gateway — 无需公网 IP |
@@ -359,6 +360,7 @@ cc-connect update --pre     # 含预发布版本
 |------|------|---------|-------------|
 | 飞书 (Lark) | [docs/feishu.md](docs/feishu.md) | WebSocket | 不需要 |
 | 钉钉 | [docs/dingtalk.md](docs/dingtalk.md) | Stream | 不需要 |
+| WPS 协作 | [docs/wps-xiezuo.md](docs/wps-xiezuo.md) | WebSocket | 不需要 |
 | Telegram | [docs/telegram.md](docs/telegram.md) | Long Polling | 不需要 |
 | Slack | [docs/slack.md](docs/slack.md) | Socket Mode | 不需要 |
 | Discord | [docs/discord.md](docs/discord.md) | Gateway | 不需要 |

cmd/cc-connect/plugin_platform_wps_xiezuo.go

@@ -0,0 +1,5 @@
+//go:build !no_wps_xiezuo
+
+package main
+
+import _ "github.com/chenhg5/cc-connect/platform/wps-xiezuo"

config.example.toml

@@ -962,6 +962,25 @@ app_secret = "your-feishu-app-secret"
 # allow_from = "*"  # Allowed staff IDs / 允许的员工 ID
 # share_session_in_channel = false  # If true, all users in a group share one agent session / 群聊共享会话
 
+# WPS Xiezuo / WPS 协作 (uncomment to enable / 取消注释以启用)
+# 1. Create a WPS Open Platform app and enable event WebSocket delivery
+#    创建 WPS 开放平台应用，并启用事件 WebSocket 推送
+# 2. Subscribe to app chat message events such as kso.app_chat.message
+#    订阅应用会话消息事件，如 kso.app_chat.message
+# 3. Fill in app_id and app_secret below
+#    填入下方 app_id 和 app_secret
+# Connection: WebSocket — no public URL required / 无需公网地址
+
+# [[projects.platforms]]
+# type = "wps-xiezuo"
+#
+# [projects.platforms.options]
+# app_id = "your-wps-xiezuo-app-id"
+# app_secret = "your-wps-xiezuo-app-secret"
+# allow_from = "*"             # Allowed WPS user IDs / 允许的 WPS 用户 ID
+# clean_reply = false          # Strip thinking/tool progress lines from replies / 过滤思考和工具进度行
+# base_url = "https://openapi.wps.cn"  # Optional API base URL override / 可选 API 基础地址覆盖
+
 # Telegram (uncomment to enable / 取消注释以启用)
 # 1. Message @BotFather on Telegram, send /newbot to create a bot
 #    在 Telegram 中找 @BotFather，发送 /newbot 创建机器人

docs/usage.md

@@ -1016,7 +1016,7 @@ mode = "default"
 provider = "anthropic"
 
 [[projects.platforms]]
-type = "feishu"  # or dingtalk, telegram, slack, discord, wecom, weixin, line, qq, qqbot
+type = "feishu"  # or wps-xiezuo, dingtalk, telegram, slack, discord, wecom, weixin, line, qq, qqbot
 
 [projects.platforms.options]
 # platform-specific options

docs/usage.zh-CN.md

@@ -928,7 +928,7 @@ mode = "default"
 provider = "anthropic"
 
 [[projects.platforms]]
-type = "feishu"  # 或 dingtalk, telegram, slack, discord, wecom, weixin, line, qq, qqbot
+type = "feishu"  # 或 wps-xiezuo, dingtalk, telegram, slack, discord, wecom, weixin, line, qq, qqbot
 
 [projects.platforms.options]
 # 平台特定配置

docs/wps-xiezuo.md

@@ -0,0 +1,113 @@
+# WPS Xiezuo Platform Setup Guide
+
+This guide explains how to connect **cc-connect** to WPS Xiezuo (WPS 365 collaboration) so users can talk to an AI coding agent from WPS chats.
+
+## Prerequisites
+
+- A WPS Open Platform application with app chat events enabled
+- `app_id` and `app_secret` for the application
+- A machine running cc-connect; no public IP is required
+- An agent such as Claude Code, Codex, or Gemini CLI configured in cc-connect
+
+## Connection Model
+
+The platform uses WPS event WebSocket delivery and WPS REST APIs:
+
+- Incoming events: WebSocket at `wss://openapi.wps.cn/v7/event/ws`
+- Authentication: KSO-1 HMAC-SHA256 headers
+- Event payloads: encrypted with AES-256-CBC and verified with HMAC-SHA256 signatures
+- Outgoing replies: REST API with a cached `client_credentials` access token
+
+cc-connect sends ACK frames on the WebSocket writer loop, so no public callback URL is needed.
+
+## Configure WPS
+
+In the WPS Open Platform console:
+
+1. Create or select an application.
+2. Enable app chat/message capabilities for the application.
+3. Enable event WebSocket delivery.
+4. Subscribe to message events:
+   - `kso.app_chat.message`
+   - `kso.app_chat.message.recall` if recall notifications are needed
+5. Grant the permissions needed to send app chat messages and reactions.
+6. Copy the application `app_id` and `app_secret`.
+
+The exact console names may vary by WPS tenant and app type. If the connection fails with authorization errors, verify that the app is published/enabled for the target organization and has the required app chat permissions.
+
+## Configure cc-connect
+
+Add `wps-xiezuo` to a project in `config.toml`:
+
+```toml
+[[projects]]
+name = "my-project"
+
+[projects.agent]
+type = "claudecode"
+
+[projects.agent.options]
+work_dir = "/path/to/your/project"
+
+[[projects.platforms]]
+type = "wps-xiezuo"
+
+[projects.platforms.options]
+app_id = "your-wps-xiezuo-app-id"
+app_secret = "your-wps-xiezuo-app-secret"
+allow_from = "*"        # optional; set to WPS user IDs in production
+clean_reply = false     # optional; strip thinking/tool progress lines
+```
+
+### Options
+
+| Option | Required | Default | Description |
+|--------|----------|---------|-------------|
+| `app_id` | yes | - | WPS Open Platform application ID |
+| `app_secret` | yes | - | WPS Open Platform application secret |
+| `allow_from` | no | all users | Comma-separated WPS user IDs allowed to use the bot; set this in production |
+| `clean_reply` | no | `false` | Removes common thinking/tool progress lines from replies before sending |
+| `base_url` | no | `https://openapi.wps.cn` | Override WPS REST API base URL for private or test environments |
+
+## Start and Verify
+
+Start cc-connect:
+
+```bash
+cc-connect -config /path/to/config.toml
+```
+
+Expected logs include:
+
+```text
+level=INFO msg="wps-xiezuo: connecting" endpoint=wss://openapi.wps.cn/v7/event/ws
+level=INFO msg="wps-xiezuo: connected"
+level=INFO msg="platform started" project=my-project platform=wps-xiezuo
+```
+
+Send a message to the WPS app chat. cc-connect should receive the encrypted event, ACK it, forward the text to the configured agent, and send the reply back through the WPS message API.
+
+## Security Notes
+
+- Always set `allow_from` for production deployments.
+- Keep `app_secret` out of source control. Environment variable substitution is supported in `config.toml`, for example `app_secret = "${WPS_XIEZUO_APP_SECRET}"`.
+- Debug logs avoid printing decrypted WPS message payloads by default.
+
+## Troubleshooting
+
+**Connection fails immediately**
+
+- Confirm `app_id` and `app_secret` are correct.
+- Confirm the app has WebSocket event delivery enabled.
+- Confirm the app is available to the organization where you are testing.
+
+**Messages arrive but replies fail**
+
+- Confirm the app has message send permissions.
+- Check whether the tenant requires the `/oauth2/token` or `/openapi/oauth2/token` token endpoint; cc-connect tries both.
+- Verify the target chat allows app messages.
+
+**Bot responds to unexpected users**
+
+- Set `allow_from` to a comma-separated list of WPS user IDs.
+- Users can send `/whoami` to discover the ID used by cc-connect.