fix: add actionable DingTalk connection diagnostics

test/channels/dingtalk/rpc.test.mjs

@@ -6,6 +6,7 @@ import {
   createDingtalkRpcHandler,
   installDingtalkRpc,
 } from '../../../plugin-src/host/channels/dingtalk/rpc.mjs';
+import { dingtalkPublicConnectionError } from '../../../src/channels/dingtalk/connection-error.mjs';
 
 function controller(overrides = {}) {
   return {
@@ -96,6 +97,28 @@ test('credential RPC accepts Client ID fields while keeping Client Secret host-o
   assert.equal((await handler(DINGTALK_ENDPOINTS.bindCredentials, { clientId: 'manual-client' })).ok, false);
 });
 
+test('RPC returns only the safe connection diagnostic projection', async () => {
+  const cause = new Error('request body contains clientSecret=must-not-leak');
+  const publicError = {
+    code: 'stream-proxy-dependency-incompatible',
+    message: '钉钉 Stream 连接失败。',
+    hint: '请修复代理依赖后重试。',
+    referenceId: 'DT-CONN-DEADBEEF',
+  };
+  const handler = createDingtalkRpcHandler(controller({
+    reconnectBot: async () => {
+      throw dingtalkPublicConnectionError(publicError, cause);
+    },
+  }));
+
+  const result = await handler(DINGTALK_ENDPOINTS.reconnectBot, {
+    botId: 'dt_abc', sendTest: true,
+  });
+
+  assert.deepEqual(result, { ok: false, error: publicError });
+  assert.doesNotMatch(JSON.stringify(result), /must-not-leak|clientSecret|cause/);
+});
+
 test('RPC is registered for loopback clients only', () => {
   const registrations = [];
   const dispose = () => {};