添加批处理脚本用于开发、构建和运行服务、 添加钉钉和飞书SDK依赖并更新构建脚本

[sabason]

Summary

Verification

• I ran the relevant local checks, or explained why they do not apply.

Risk

• This PR does not touch CLI core paths, or it has maintainer approval for allow-cli-core-change.
• User-facing behavior changes include tests or an explanation of why tests are not practical.

@dosubot review this PR for changed-area risk, missing tests, docs impact, desktop startup risk, and CLI core impact.

[github-actions]

PR quality triage

Changed areas: area:cli-core, area:desktop, area:docs

CLI core policy: Blocked by policy until a maintainer applies allow-cli-core-change and approves the PR.

CLI core files:

• src/commands/add-dir/add-dir.tsx

Expected checks:

• change-policy
• desktop-checks
• desktop-native-checks
• docs-checks

Test coverage signals:

• Desktop product files changed without a desktop test file in the PR.

Risk notes:

• No special risk notes from changed paths.

Hard merge gates still come from GitHub Actions, not AI review.

Dosu handoff: Dosu can be used as the AI reviewer for risk explanation, missing-test prompts, and maintainer Q&A. If it does not comment automatically from the PR template, ask:

@dosubot review this PR for changed-area risk, missing tests, docs impact, desktop startup risk, and CLI core impact.

[dosubot]

Hi @sabason! I'm Dosu and I’m helping the cc-haha team.

Here's a risk review of this PR across the dimensions you specified:

Changed-Area Risk

Windows Batch Scripts (5 new files, 537 lines) — Low-to-moderate risk. These are additive convenience wrappers that don't modify existing logic. However, a few concerns:

• Hardcoded path C:\Users\Administrator\.bun\bin\bun.exe in all scripts is fragile and assumes a specific machine configuration. Consider removing this or making it configurable [1].
• server.bat accepts port via %1 without validation — a user passing unexpected input could produce confusing errors [1].
• Version parsing via findstr in build.bat is brittle; if package.json has multiple "version" keys (e.g., in dependency entries), it could extract the wrong value [1].

Dependency additions — Moderate risk:

• dingtalk-stream@2.1.4 (root) vs dingtalk-stream@^2.1.6-beta.1 (desktop) — version discrepancy between root and desktop. The desktop is pinned to a beta version, which may introduce instability [1].
• grammy@^1.42.0 — new Telegram framework addition. If this replaces existing Telegram adapter code, there may be behavioral changes.
• @larksuiteoapi/node-sdk@^1.60.0 — official Feishu SDK. Brings in transitive dependencies (axios, protobufjs, ws, etc.) that increase attack surface and bundle size.

Missing Tests

No tests were added or modified in this PR. While the batch scripts themselves are hard to unit-test, the new IM SDK integrations should have associated adapter tests if corresponding adapter code is being developed. If this PR only adds the dependencies in preparation for future work, that should be documented in the PR description.

Docs Impact

• No documentation was updated. The new batch scripts (dev.bat, build.bat, server.bat) provide a new development workflow that should be reflected in a README or contributing guide.
• The new IM SDK dependencies suggest upcoming Feishu/DingTalk/Telegram adapter features that will eventually need documentation.

Desktop Startup Risk

• desktop/package.json adds dingtalk-stream@^2.1.6-beta.1 as a dependency [1]. If this is imported at startup, a beta dependency could cause runtime failures. Verify whether this is lazy-loaded or eagerly imported during desktop initialization.
• desktop/build.bat and desktop/dev.bat are additive scripts — they don't modify existing Tauri configuration or startup paths, so no direct desktop startup regression from the scripts themselves.

CLI Core Impact

• No CLI core paths were modified. The batch scripts invoke existing entry points (./src/entrypoints/cli.tsx, ./src/server/index.ts) without changing them.
• The new npm dependencies are added to package.json but don't appear to be integrated into CLI code in this PR. If they're unused imports, they'll just increase install time/size without runtime impact.

Summary

Area	Risk Level	Notes
Batch scripts	Low	Additive, no existing code modified
New dependencies	Moderate	Beta version in desktop, expanded attack surface
Missing tests	⚠️	No tests for new functionality
Docs impact	⚠️	New workflow undocumented
Desktop startup	Low-Moderate	Beta dependency could affect stability
CLI core	✅ None	No core paths touched

Key recommendations:

1. Align dingtalk-stream versions between root and desktop (avoid beta in production builds)
2. Add basic smoke tests or at minimum a CI step that validates the batch scripts parse correctly
3. Document the new .bat workflow in the README or CONTRIBUTING guide
4. Clarify in the PR description whether the IM SDK dependencies are for immediate use or preparatory

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.