fix: remove XFT use-car submissions

README.md

@@ -41,7 +41,7 @@ Agent 不传 `userId`、员工号或单据所有者。网关从 OAuth Token 确
 
 模板出现在列表中不等于所有控件都能由开放 API 构造。`approval_get_submission_schema` 会返回 `submissionCapability`，准备阶段也会再次安全校验：
 
-- 薪福通：可安全构造的申请和报销模板通过正式创建 API 发起，并在创建后实时核验状态。结果可能进入待审批，也可能因企业流程中没有其他有效审批人等规则即时完成；后者返回 `completed`，不会错误地当成接口失败，也不会签发不可用的撤回引用。用车申请当前明确标记为 `client_only`：正式接口要求 `useCarInfo` 对象，但实时模板与现有文档不足以验证其业务结构，不能让 Agent 猜字段。
+- 薪福通：可安全构造的申请和报销模板通过正式创建 API 发起，并在创建后实时核验状态。结果可能进入待审批，也可能因企业流程中没有其他有效审批人等规则即时完成；后者返回 `completed`，不会错误地当成接口失败，也不会签发不可用的撤回引用。用车申请不属于 MCP 发起范围，不会出现在候选模板中。
 - 钉钉：当前 6 个候选模板均返回 `client_only`，必须在钉钉客户端发起。其中 5 个包含企业 OpenAPI 无法可靠构造的 `DDBizSuite` 考勤或费控套件；`业务招待申请_北极大`虽是普通明细表，但真实创建时新版企业接口返回系统异常、旧版接口拒绝组件格式，因此同样安全降级。
 
 发起审批固定为“列模板 → 取 Schema → 自动查重/预览 → 用户确认 → 正式提交”。准备阶段从新表单提取发票代码与号码、数电票唯一编号、票据号码、附件哈希；没有唯一编号时，金额、日期与商户组合只作为疑似提示。网关实时刷新当前用户本人近 30 天的钉钉和薪福通已发起审批：原单待审批、已通过或状态未知时默认阻止，原单拒绝、撤回、作废或弱匹配时警告。任一来源查询不完整也不会当成“没有重复”。只有用户看过匹配单号、状态和覆盖情况并明确要求继续后，Agent 才能以 `allowDuplicateInvoices=true` 重新准备。

docs/architecture.md

@@ -24,7 +24,7 @@
 
 Agent 面向统一审批语义，不直接理解钉钉 `processInstanceId/taskId`、薪福通员工号、上游响应或完整 Schema。网关在内部完成来源路由、字段抽取、动作调用和写后复核，只返回审批判断所需的精简字段与统一状态。
 
-薪福通所有选择字段按领域选项抽象。部门、城市和费用类型由选项工具返回精简 `label/code` 映射；模板内嵌下拉框被标准化成同样结构，固定枚举通过 `enumLabels` 提供中文名称，表格子字段递归应用相同规则。Agent 只把业务名称展示给用户，正式值仅用于内部构造请求。准备确认时，网关再用实时 Schema 把正式值反向解析为业务名称；预览不包含城市码、费用编码、自定义字段号或表格列号，任一选择无法反向解析时会在签发确认引用前安全失败。无法取得可靠名称映射的人员、档案、关联单据、分摊和部分舱位字段标记为 `client_only`，必填时安全停止、可选时允许省略，绝不转而索取工号或编码。用车申请的正式 `useCarInfo` 结构目前也无法从实时模板可靠推导，因此整体标记为 `client_only`。响应不包含完整数据源、内部身份或其他企业档案，选项目录也不持久化。
+薪福通所有选择字段按领域选项抽象。部门、城市和费用类型由选项工具返回精简 `label/code` 映射；模板内嵌下拉框被标准化成同样结构，固定枚举通过 `enumLabels` 提供中文名称，表格子字段递归应用相同规则。Agent 只把业务名称展示给用户，正式值仅用于内部构造请求。准备确认时，网关再用实时 Schema 把正式值反向解析为业务名称；预览不包含城市码、费用编码、自定义字段号或表格列号，任一选择无法反向解析时会在签发确认引用前安全失败。无法取得可靠名称映射的人员、档案、关联单据、分摊和部分舱位字段标记为 `client_only`，必填时安全停止、可选时允许省略，绝不转而索取工号或编码。用车申请已从 MCP 发起范围移除，实时模板列表会过滤，旧模板引用也会被网关拒绝。响应不包含完整数据源、内部身份或其他企业档案，选项目录也不持久化。
 
 所有工具以普通 `content.text` 中的精简 JSON 作为跨宿主可见结果，同时保留相同的精简 `structuredContent` 供支持结构化结果的宿主使用；两处都不携带诊断字段或上游原始响应。`raw` 仍是受过滤、分页和硬限额保护的按需诊断视图，不是默认数据通道。
 

docs/deployment.md

@@ -31,7 +31,6 @@ https://approval.justconn.top/oauth/dingtalk/callback
 - `itrip-gateway/v1/bills/apply/expense/create`；
 - `itrip-gateway/v1/bills/apply/entertainment/create`；
 - `itrip-gateway/v1/bills/apply/common/create`；
-- `itrip-gateway/v1/bills/apply/use-car/create`；
 - `itrip-gateway/v1/reimburse/bill/create`；
 - `itrip-gateway/v1/reimburse/bill/travel/create`。
 

docs/submission-templates.md

@@ -8,7 +8,6 @@
 | 薪福通 | 费用报销单 | 支持，有约束 | 报销总额、币种、费用明细；当前模板要求承担部门和费用说明 |
 | 薪福通 | 招待费用申请单 | 支持，有约束 | 企业模板类型为 `EXPENSE_APPLY`，使用费用申请创建接口的 `applyExpenses`（费用类型、金额等），而不是按模板名称误用招待申请专用 DTO；费用类型名称实时查询、编码内部映射；写后实时核验状态 |
 | 薪福通 | 出差费用申请单 | 支持，有约束 | 行程、城市和预计费用递归校验；实测仅有发起节点时流程即时完成并返回 `completed` |
-| 薪福通 | 用车申请单（若企业开放） | 仅客户端 | 正式创建接口要求 `useCarInfo`，但现有文档和实时模板未提供可验证的业务字段结构；MCP 不猜测对象结构 |
 | 钉钉 OA | 业务招待申请_北极大 | 仅客户端 | 普通字段和明细表可读取，但真实测试中新版企业创建接口返回系统异常、旧版企业接口拒绝组件格式 |
 | 钉钉 OA | 出差申请单_北极大 | 仅客户端 | `DDBizSuite` 出差套件包含日程、天数、同行人及考勤联动，企业 OpenAPI 没有可靠构造协议 |
 | 钉钉 OA | 外出_北极大 | 仅客户端 | `DDBizSuite` 外出套件包含类型、起止时间、时长和考勤联动 |
@@ -22,4 +21,4 @@
 
 薪福通的自定义字段接口可能同时列出标准单据抬头控件，也可能用动态字段号返回名为“承担部门/单据部门”的控件，但创建接口禁止把这些标准控件放进 `customFieldValues`。MCP 会剔除服务器管理控件并拒绝调用方显式指定公司或部门；两者省略时由薪福通根据当前登录申请人的档案默认填写。真正的业务部门选择字段则只展示当前用户可用的部门名称并在内部映射。
 
-任一来源模板的 `submissionCapability.status=client_only` 时，`approval_prepare_submission` 会再次拒绝，不能通过修改本地 Skill 或桥绕过。可安全构造的薪福通模板使用正式创建接口，并在写后实时核验：`billSts=1` 为待审批，`billSts=2` 为企业流程规则导致的即时完成；用车申请当前为 `client_only`。当前列出的 6 个钉钉模板也均为 `client_only`；对于以后可由 API 构造的钉钉模板，网关会先调用企业接口 `POST /v1.0/workflow/processes/forecast`，预测成功并补齐自选处理人后才生成提交确认。
+任一来源模板的 `submissionCapability.status=client_only` 时，`approval_prepare_submission` 会再次拒绝，不能通过修改本地 Skill 或桥绕过。可安全构造的薪福通模板使用正式创建接口，并在写后实时核验：`billSts=1` 为待审批，`billSts=2` 为企业流程规则导致的即时完成。薪福通用车申请已从 MCP 发起范围移除，不会出现在候选模板中，旧引用也不能继续使用。当前列出的 6 个钉钉模板均为 `client_only`；对于以后可由 API 构造的钉钉模板，网关会先调用企业接口 `POST /v1.0/workflow/processes/forecast`，预测成功并补齐自选处理人后才生成提交确认。

skills/dingtalk-approval/references/create-approval.md

@@ -5,7 +5,7 @@ Create only XFT approvals and these DingTalk templates: `出差申请单_北极
 1. Call `approval_list_submission_templates` and use only its returned `templateId`.
 2. Call `approval_get_submission_schema`. Compare every required field in `fields` and `inputContract` with information the user has already supplied. Never guess a missing value.
    Use `inputContract.values.minimalExample` only as the exact JSON shape for `values`. Replace every angle-bracket placeholder from the user's business answer or the selected live option; never submit a placeholder literally. Continue to enforce the recursive `standardFields` constraints even when the example omits optional fields.
-   If `submissionCapability.status` is `client_only`, stop API construction and tell the user to start that template in its native client. All six current DingTalk candidates are client-only: five contain unsupported business suites, while live enterprise-API tests rejected the ordinary table form in `业务招待申请_北极大`. Supported XFT templates use their formal create APIs and are verified against live status after submission; XFT use-car applications remain client-only because the formal endpoint's `useCarInfo` structure cannot yet be derived safely from the live form.
+   If `submissionCapability.status` is `client_only`, stop API construction and tell the user to start that template in its native client. All six current DingTalk candidates are client-only: five contain unsupported business suites, while live enterprise-API tests rejected the ordinary table form in `业务招待申请_北极大`. Supported XFT templates use their formal create APIs and are verified against live status after submission. XFT use-car applications are outside the MCP scope: they must not appear in the candidate list, and an old reference must be treated as unsupported rather than reconstructed.
    Treat every XFT selection as a label-only user interaction. For a field with `optionSource`, call `approval_get_submission_options` with the same `templateId` and show only returned `label` values. After the user chooses a label, copy that exact item's `code` into the corresponding `values` field for prepare/submit; never put the label itself into a code-valued field. Keep its `code` only inside tool arguments and never repeat it in conversation. Apply the same rule to inline `options`; for an inline enum show only `enumLabels` values and internally use the matching enum key. Department results are restricted to the current signed-in user's member record. Never show, explain, or ask the user for a field code, city code, organization code, employee number, archive number, numeric cabin value, `expenseNumber`, `expenseTypeNumber`, `expTypeCode`, or other internal ID. If `selectionCapability.status=client_only`, do not ask for the internal value or guess it: a required field stops MCP creation and requires the native client; an optional field may be skipped, or the user may choose native-client completion. If a required option source cannot return readable labels, stop and offer retry or native-client completion.
    For DingTalk, do not ask for or fill applicant and top-level department controls marked `serverManaged`; keep `deptId=-1` unless the user selected a department that the gateway can verify belongs to them. The gateway derives the default department from the authenticated user's live directory record.
 3. While any required field is missing or ambiguous, ask the user for the missing information and repeat the check after each answer. Prefer one concise question at a time, grouping fields only when they naturally belong together. Do not call `approval_prepare_submission` until all required fields are complete.

src/unified-approval.ts

@@ -18,12 +18,18 @@ const DINGTALK_SUBMISSION_TEMPLATES = {
   "捷康_费用报销": ["差旅费用报销_捷康", "业务招待费用报销_捷康", "业务招待申请_捷康"],
 } as const;
 const DINGTALK_SUBMISSION_CATEGORIES = Object.keys(DINGTALK_SUBMISSION_TEMPLATES);
+const ALLOWED_XFT_SUBMISSION_KINDS = new Set<XftSubmissionKind>([
+  "travel_apply", "expense_apply", "entertainment_apply", "common_apply",
+  "common_reimburse", "travel_reimburse",
+]);
+
+function assertXftSubmissionTemplateAllowed(template: XftSubmissionTemplate): void {
+  if (!ALLOWED_XFT_SUBMISSION_KINDS.has(template.kind)) {
+    throw new ApprovalSafetyError("该薪福通模板不在 MCP 支持的发起范围内，请重新列出可发起模板");
+  }
+}
+
 function xftSubmissionCapability(kind: XftSubmissionKind): Record<string, unknown> {
-  if (kind === "use_car_apply") return {
-    status: "client_only",
-    reason: "正式创建接口要求用车信息对象，但当前文档与实时模板未提供可验证的业务字段结构",
-    kind,
-  };
   return {
     status: "api_supported_with_constraints",
     finalValidation: "薪福通创建接口会在正式提交时完成预算、权限和流程业务校验；创建后网关实时核验结果，流程可能进入待审批，也可能按企业规则即时完成",
@@ -370,7 +376,8 @@ export class UnifiedApprovalService {
     if (source !== "dingtalk") {
       if (!this.xft) sourceStatus.xft = { status: "disabled" };
       else tasks.push(this.xft.listSubmissionTemplates(user, limit, query).then((templates) => {
-        xftItems = templates.map((template) => ({
+        const supported = templates.filter((template) => ALLOWED_XFT_SUBMISSION_KINDS.has(template.kind));
+        xftItems = supported.map((template) => ({
           templateId: this.signer.sign({
             kind: "submission_template", userId: user.userId, source: "xft", xftTemplate: template,
             exp: expiresInMinutes(30),
@@ -380,7 +387,7 @@ export class UnifiedApprovalService {
           kind: template.kind,
           eventType: template.eventType,
         }));
-        sourceStatus.xft = { status: "ok", count: templates.length };
+        sourceStatus.xft = { status: "ok", count: supported.length };
       }).catch((error) => { sourceStatus.xft = { status: "unavailable", message: errorMessage(error) }; }));
     }
     await Promise.all(tasks);
@@ -394,6 +401,7 @@ export class UnifiedApprovalService {
     const template = this.decodeSubmissionTemplate(user, templateId);
     if (template.source === "xft") {
       if (!this.xft || !template.xftTemplate) throw new ApprovalSafetyError("薪福通提单源未启用");
+      assertXftSubmissionTemplateAllowed(template.xftTemplate);
       const schema = await this.xft.getSubmissionSchema(user, template.xftTemplate);
       const requiredClientOnly = schema.fields.filter(requiredXftFieldNeedsNativeClient);
       const capability = requiredClientOnly.length ? {
@@ -445,6 +453,7 @@ export class UnifiedApprovalService {
     if (template.source !== "xft" || !this.xft || !template.xftTemplate) {
       throw new ApprovalSafetyError("实时提单选项查询当前仅用于薪福通模板");
     }
+    assertXftSubmissionTemplateAllowed(template.xftTemplate);
     return {
       templateId,
       source: "xft" as const,
@@ -464,6 +473,7 @@ export class UnifiedApprovalService {
     let fingerprint: string;
     if (template.source === "xft") {
       if (!this.xft || !template.xftTemplate) throw new ApprovalSafetyError("薪福通提单源未启用");
+      assertXftSubmissionTemplateAllowed(template.xftTemplate);
       const schema = await this.xft.getSubmissionSchema(user, template.xftTemplate);
       validateXftSubmissionValues(template.xftTemplate.kind, input.values, schema.fields);
       const identityValidation = await this.xft.validateSubmissionIdentity(user);
@@ -558,6 +568,7 @@ export class UnifiedApprovalService {
     try {
       if (confirmation.source === "xft") {
         if (!this.xft || !confirmation.xftTemplate) throw new ApprovalSafetyError("薪福通提单源未启用");
+        assertXftSubmissionTemplateAllowed(confirmation.xftTemplate);
         const schema = await this.xft.getSubmissionSchema(user, confirmation.xftTemplate);
         if (hashJson({ template: schema.template, fields: schema.fields }) !== confirmation.templateFingerprint) {
           throw new ApprovalSafetyError("薪福通表单在确认后发生变化，请重新准备并确认");
@@ -2026,9 +2037,6 @@ function validateXftSubmissionValues(
   values: Record<string, unknown>,
   customFields: XftSubmissionField[],
 ): void {
-  if (kind === "use_car_apply") {
-    throw new ApprovalSafetyError("用车申请的正式接口字段结构当前无法可靠构造，请在薪福通客户端发起");
-  }
   const required: Record<XftSubmissionKind, string[]> = {
     travel_apply: ["businessTrip"], expense_apply: ["applyExpenses"],
     entertainment_apply: ["entertainmentApplyApiCreateDTO"], common_apply: [], use_car_apply: ["useCarInfo"],

src/xft-open-api.ts

@@ -329,7 +329,7 @@ export class XftOpenApiClient implements XftApprovalProvider {
       for (const item of list) {
         if (stringAt(item, ["eventStatus"]) !== "1") continue;
         const template = normalizeSubmissionTemplate(item);
-        if (!template || !filterQuery([template], search).length) continue;
+        if (!template || template.kind === "use_car_apply" || !filterQuery([template], search).length) continue;
         output.push(template);
         if (output.length >= limit) break;
       }

test/unified.test.ts

@@ -1243,27 +1243,38 @@ test("Xft preparation fails before confirmation when a selected code has no read
   );
 });
 
-test("Xft use-car application is explicitly client-only and cannot be prepared", async () => {
-  const template: XftSubmissionTemplate = {
+test("Xft use-car application is omitted and old signed references are rejected", async () => {
+  const useCarTemplate: XftSubmissionTemplate = {
     eventSeqId: "event-car", eventNumber: "XFT-CAR", eventName: "用车申请单",
     eventType: "USE_CAR_APPLY", kind: "use_car_apply",
   };
+  const expenseTemplate: XftSubmissionTemplate = {
+    eventSeqId: "event-expense", eventNumber: "XFT-EXPENSE", eventName: "费用申请单",
+    eventType: "EXPENSE_APPLY", kind: "expense_apply",
+  };
+  let schemaReads = 0;
   const xft = {
-    async listSubmissionTemplates() { return [template]; },
+    async listSubmissionTemplates() { return [useCarTemplate, expenseTemplate]; },
     async getSubmissionSchema() {
-      return { template, fields: [], inputContract: { values: { standardFields: [] } }, diagnostics: {} };
+      schemaReads += 1;
+      return { template: useCarTemplate, fields: [], inputContract: { values: { standardFields: [] } }, diagnostics: {} };
     },
   };
   const service = new UnifiedApprovalService(config(), {} as ApprovalService, xft as never);
   const user = { userId: "user-1" };
-  const templateId = String((await service.listSubmissionTemplates(user, "xft", 10)).items[0]?.templateId);
-  const schema = await service.getSubmissionSchema(user, templateId);
-  assert.equal(schema.submissionCapability.status, "client_only");
-  assert.match(String(schema.submissionCapability.reason), /用车信息对象.*未提供可验证/);
+  const listed = await service.listSubmissionTemplates(user, "xft", 10);
+  assert.deepEqual(listed.items.map((item) => item.name), ["费用申请单"]);
+  assert.equal(listed.sourceStatus.xft?.count, 1);
+  const templateId = (service as any).signer.sign({
+    kind: "submission_template", userId: user.userId, source: "xft",
+    xftTemplate: useCarTemplate, exp: Date.now() + 60_000,
+  });
+  await assert.rejects(service.getSubmissionSchema(user, templateId), /不在 MCP 支持的发起范围/);
   await assert.rejects(
     service.prepareSubmission(user, { templateId, values: { useCarInfo: { purpose: "客户拜访" } } }),
-    /用车申请.*薪福通客户端/,
+    /不在 MCP 支持的发起范围/,
   );
+  assert.equal(schemaReads, 0);
 });
 
 test("Xft preparation reports standard and live custom required fields together", async () => {

test/xft-open-api.test.ts

@@ -790,7 +790,8 @@ test("Xft submission routes every supported template kind to its documented crea
     throw new Error(`unexpected ${path}`);
   });
   const templates = await client.listSubmissionTemplates({ userId: "ding-u1" }, 20);
-  assert.equal(templates.length, 8);
+  assert.equal(templates.length, 7);
+  assert.equal(templates.some((item) => item.eventNumber === "T5"), false);
   assert.equal(templates.find((item) => item.eventNumber === "T8")?.kind, "expense_apply");
   for (const template of templates) await client.submitApproval({ userId: "ding-u1" }, template, {});
   assert.deepEqual(createPaths.sort(), [
@@ -799,7 +800,6 @@ test("Xft submission routes every supported template kind to its documented crea
     "/itrip/xft-api/v1/bills/apply/expense/create",
     "/itrip/xft-api/v1/bills/apply/expense/create",
     "/itrip/xft-api/v1/bills/apply/travel/create",
-    "/itrip/xft-api/v1/bills/apply/use-car/create",
     "/itrip/xft-api/v1/reimburse/bill/create",
     "/itrip/xft-api/v1/reimburse/bill/travel/create",
   ]);