From bd80b2d7d816f83abdf79faf74f3cb281538ec08 Mon Sep 17 00:00:00 2001
From: ABAPPLO <1134226402@qq.com>
Date: Thu, 3 Sep 2026 11:30:26 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E9=A1=B9=E7=9B=AE=E8=B4=9F=E8=B4=A3?=
 =?UTF-8?q?=E4=BA=BA+=E5=86=85=E9=83=A8=E4=BB=BB=E5=8A=A1=E7=BE=A4+portal?=
 =?UTF-8?q?=20=E5=86=85=E9=83=A8=E8=BA=AB=E4=BB=BD=E9=A2=86=E5=8F=96+?=
 =?UTF-8?q?=E7=BE=A4=E4=B8=BB=E9=93=BE=E6=8E=A5=E5=BD=92=E5=B1=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 迁移 0012：projects.owner_userid / tasks.task_chat_id / claims.owner_partner_id
- lib/task-group-service.ts：懒建 appchat 任务群（首个内部群主领取时创建，成员 diff 补员），播报/卡片文案
- wecom-client 新增 appchat create/update/get/send 封装
- OAuth ticket 增可选 uid（v:1 兼容），内部成员领取按 wecom_userid 解析群主身份
- 外部 OAuth 领取人 upsert 打 partner_type='group_owner'
- portal 链接带 ?owner= 穿透 OAuth 往返，claims 记录归属群主
- 后台任务卡「群主链接」面板：复制链接/推送内部群主/任务群状态
- 催办与超期升级同步播报进任务群
---
 app/admin-app.tsx                      | 223 +++++++++++++++-
 app/api/action/route.ts                |  80 ++++++
 app/api/partner/route.ts               | 134 ++++++++--
 app/api/wecom-oauth/route.ts           |  12 +-
 db/schema.ts                           |   5 +
 koc-portal/app/page.tsx                |  24 +-
 lib/project-service.ts                 |  19 +-
 lib/task-group-service.ts              | 158 +++++++++++
 lib/wecom-client.ts                    | 134 +++++++++-
 lib/wecom-notifier-service.ts          |  35 +++
 lib/wecom-oauth-service.ts             |  21 +-
 mysql/0012_project_owner_task_chat.sql |   5 +
 tests/partner-wecom-claim.test.mjs     |  71 +++++
 tests/project-service.test.mjs         |  14 +-
 tests/task-group-service.test.mjs      | 352 +++++++++++++++++++++++++
 tests/wecom-client.test.mjs            | 176 +++++++++++++
 tests/wecom-oauth-service.test.mjs     |  42 +++
 17 files changed, 1466 insertions(+), 39 deletions(-)
 create mode 100644 lib/task-group-service.ts
 create mode 100644 mysql/0012_project_owner_task_chat.sql
 create mode 100644 tests/task-group-service.test.mjs

diff --git a/app/admin-app.tsx b/app/admin-app.tsx
index 5491764..0c47346 100644
--- a/app/admin-app.tsx
+++ b/app/admin-app.tsx
@@ -532,6 +532,7 @@ export default function Home({ currentUser }: { currentUser: AuthUser }) {
   const [taskModalOpen, setTaskModalOpen] = useState(false);
   const [groupPushTask, setGroupPushTask] = useState<Task | null>(null);
   const [onePushTask, setOnePushTask] = useState<Task | null>(null);
+  const [ownerLinksTask, setOwnerLinksTask] = useState<Task | null>(null);
   const [metricModal, setMetricModal] = useState<Distribution | null>(null);
   const [taskForm, setTaskForm] = useState({
     taskType: "content_publish" as "content_publish" | "screenshot_collect",
@@ -1175,6 +1176,7 @@ export default function Home({ currentUser }: { currentUser: AuthUser }) {
                   onCopyShare={copyTaskShareLink}
                   onPushToGroups={(task) => setGroupPushTask(task)}
                   onOneClickPush={(task) => setOnePushTask(task)}
+                  onOwnerLinks={(task) => setOwnerLinksTask(task)}
                   onRelease={async (distribution) =>
                     runAction(
                       {
@@ -1515,6 +1517,14 @@ export default function Home({ currentUser }: { currentUser: AuthUser }) {
         />
       )}
 
+      {ownerLinksTask && (
+        <OwnerLinksModal
+          task={ownerLinksTask}
+          onClose={() => setOwnerLinksTask(null)}
+          setToast={setToast}
+        />
+      )}
+
       {toast && <div className="toast"><span>✓</span>{toast}</div>}
       {working && <div className="working-bar" />}
     </div>
@@ -2486,6 +2496,7 @@ type ProjectSummary = {
   note: string;
   createdAt: string;
   mainGroupMemberIds: string[];
+  ownerUserid: string;
   taskCount: number;
   groupChatCount: number;
 };
@@ -2541,11 +2552,12 @@ type ProjectEditorDraft = {
   id: string;
   name: string;
   brand: string;
+  owner: string;
   members: string;
   note: string;
 };
 
-const EMPTY_PROJECT_DRAFT: ProjectEditorDraft = { id: "", name: "", brand: "", members: "", note: "" };
+const EMPTY_PROJECT_DRAFT: ProjectEditorDraft = { id: "", name: "", brand: "", owner: "", members: "", note: "" };
 
 function ProjectSection({
   project,
@@ -2560,6 +2572,7 @@ function ProjectSection({
   onCopyShare,
   onPushToGroups,
   onOneClickPush,
+  onOwnerLinks,
 }: {
   project: ProjectSummary;
   tasks: Task[];
@@ -2573,6 +2586,7 @@ function ProjectSection({
   onCopyShare: (task: Task) => void;
   onPushToGroups: (task: Task) => void;
   onOneClickPush: (task: Task) => void;
+  onOwnerLinks: (task: Task) => void;
 }) {
   const [expanded, setExpanded] = useState(false);
   const [detail, setDetail] = useState<ProjectDetailData | null>(null);
@@ -2711,6 +2725,7 @@ function ProjectSection({
               onCopyShare={onCopyShare}
               onPushToGroups={onPushToGroups}
               onOneClickPush={onOneClickPush}
+              onOwnerLinks={onOwnerLinks}
             />
           ))}
         </div>
@@ -2910,6 +2925,15 @@ function ProjectEditorModal({
             />
           </label>
         </div>
+        <label>
+          <span>项目负责人 userid</span>
+          <input
+            value={draft.owner}
+            onChange={(event) => onChange({ ...draft, owner: event.target.value })}
+            placeholder="例如：zhangsan"
+          />
+          <small>任务群创建时自动把负责人拉进群；请确保该成员在自建应用可见范围内。</small>
+        </label>
         <label>
           <span>项目总群成员 userid（一行一个）</span>
           <textarea
@@ -3907,6 +3931,187 @@ function OverviewPage({
   );
 }
 
+type OwnerLinkRow = {
+  partnerId: string;
+  name: string;
+  wecomUserid: string;
+  isInternal: boolean;
+  link: string;
+};
+
+type TaskGroupLinksView = {
+  taskName: string;
+  taskChatId: string;
+  claimUrl: string;
+  owners: OwnerLinkRow[];
+};
+
+function OwnerLinksModal({
+  task,
+  onClose,
+  setToast,
+}: {
+  task: Task;
+  onClose: () => void;
+  setToast: (message: string) => void;
+}) {
+  const [view, setView] = useState<TaskGroupLinksView | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [pushing, setPushing] = useState(false);
+  const [pushResult, setPushResult] = useState<{
+    sent: number;
+    failed: number;
+    failList: string[];
+  } | null>(null);
+
+  const postAction = useCallback(
+    async <T,>(payload: Record<string, unknown>, fallback: string) => {
+      const response = await fetch("/api/action", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+      });
+      const parsed = await readApiResponse<T & { error?: string }>(
+        response,
+        fallback,
+      );
+      if (!response.ok) throw new Error(parsed.error || fallback);
+      return parsed;
+    },
+    [],
+  );
+
+  useEffect(() => {
+    const timer = window.setTimeout(() => {
+      void (async () => {
+        try {
+          const parsed = await postAction<TaskGroupLinksView>(
+            { action: "task_group_links", taskId: task.id },
+            "读取群主链接失败",
+          );
+          setView(parsed);
+        } catch (reason) {
+          setToast(
+            reason instanceof Error ? reason.message : "读取群主链接失败",
+          );
+        } finally {
+          setLoading(false);
+        }
+      })();
+    }, 0);
+    return () => window.clearTimeout(timer);
+  }, [postAction, task.id, setToast]);
+
+  const copyLink = async (label: string, link: string) => {
+    try {
+      await navigator.clipboard.writeText(link);
+      setToast(`${label}已复制`);
+    } catch {
+      window.prompt(`复制${label}`, link);
+    }
+  };
+
+  const pushLinks = async () => {
+    setPushing(true);
+    try {
+      const parsed = await postAction<{
+        sent: number;
+        failed: number;
+        failList: string[];
+      }>({ action: "task_group_push", taskId: task.id }, "推送群主链接失败");
+      setPushResult(parsed);
+      setToast(
+        parsed.failList.length > 0
+          ? `已送达 ${parsed.sent} 位群主；失败：${parsed.failList.join("、")}`
+          : `已送达 ${parsed.sent} 位群主`,
+      );
+    } catch (reason) {
+      setToast(reason instanceof Error ? reason.message : "推送群主链接失败");
+    } finally {
+      setPushing(false);
+    }
+  };
+
+  const internalCount = view?.owners.filter((owner) => owner.isInternal).length ?? 0;
+
+  return (
+    <div className="modal-backdrop" role="presentation" onMouseDown={onClose}>
+      <div className="modal-card" onMouseDown={(event) => event.stopPropagation()}>
+        <div className="modal-heading">
+          <div>
+            <p className="eyebrow">任务中心 · 群主领取链接</p>
+            <h2>{task.name}</h2>
+          </div>
+          <button type="button" onClick={onClose} aria-label="关闭">×</button>
+        </div>
+        {loading ? (
+          <div className="wecom-picker-empty">正在读取群主列表…</div>
+        ) : !view || view.owners.length === 0 ? (
+          <div className="wecom-picker-empty">
+            还没有登记群主，请先在「合作方管理」新建群主合作方（需填写企业微信 userid）。
+          </div>
+        ) : (
+          <>
+            <div className="project-detail-block-head">
+              <h4>任务群状态</h4>
+              <small>
+                {view.taskChatId
+                  ? "已建群，群主领取后自动进群"
+                  : "未建群：内部群主领取任务后自动创建（需项目已填负责人）"}
+              </small>
+            </div>
+            {view.claimUrl && (
+              <p className="project-empty-line">
+                通用领取链接（不带群主归属）：
+                <button
+                  type="button"
+                  className="share-link-button"
+                  onClick={() => void copyLink("通用领取链接", view.claimUrl)}
+                >
+                  复制
+                </button>
+              </p>
+            )}
+            <ul className="project-member-list">
+              {view.owners.map((owner) => (
+                <li key={owner.partnerId}>
+                  <span>
+                    {owner.name}
+                    {owner.isInternal ? "" : "（外部群主）"}
+                  </span>
+                  <button
+                    type="button"
+                    className="share-link-button"
+                    onClick={() => void copyLink(`${owner.name} 的领取链接`, owner.link)}
+                  >
+                    复制链接
+                  </button>
+                </li>
+              ))}
+            </ul>
+            <div className="modal-actions">
+              <button type="button" className="ghost-button" onClick={onClose} disabled={pushing}>
+                关闭
+              </button>
+              <button
+                type="button"
+                className="primary-button"
+                onClick={() => void pushLinks()}
+                disabled={pushing || internalCount === 0}
+              >
+                {pushing ? "推送中…" : "推送内部群主（应用消息）"}
+              </button>
+            </div>
+            {pushResult && pushResult.failList.length > 0 && (
+              <small>推送失败：{pushResult.failList.join("、")}</small>
+            )}
+          </>
+        )}
+      </div>
+    </div>
+  );
+}
+
 function TaskRowCard({
   task,
   portalUrl,
@@ -3914,6 +4119,7 @@ function TaskRowCard({
   onCopyShare,
   onPushToGroups,
   onOneClickPush,
+  onOwnerLinks,
 }: {
   task: Task;
   portalUrl: string;
@@ -3921,6 +4127,7 @@ function TaskRowCard({
   onCopyShare: (task: Task) => void;
   onPushToGroups: (task: Task) => void;
   onOneClickPush: (task: Task) => void;
+  onOwnerLinks: (task: Task) => void;
 }) {
   const progress = Math.round((task.claimed_quantity / task.quantity) * 100);
   return (
@@ -3971,6 +4178,13 @@ function TaskRowCard({
         >
           一键推送
         </button>
+        <button
+          className="share-link-button"
+          onClick={() => onOwnerLinks(task)}
+          disabled={!portalUrl || !task.share_token}
+        >
+          群主链接
+        </button>
         {portalUrl && task.share_token && (
           <a
             className="round-arrow"
@@ -4000,6 +4214,7 @@ function TasksPage({
   onCopyShare,
   onPushToGroups,
   onOneClickPush,
+  onOwnerLinks,
   onRelease,
 }: {
   tasks: Task[];
@@ -4014,6 +4229,7 @@ function TasksPage({
   onCopyShare: (task: Task) => void;
   onPushToGroups: (task: Task) => void;
   onOneClickPush: (task: Task) => void;
+  onOwnerLinks: (task: Task) => void;
   onRelease: (distribution: Distribution) => Promise<boolean>;
 }) {
   const [selectedTaskId, setSelectedTaskId] = useState<string | null>(null);
@@ -4057,6 +4273,7 @@ function TasksPage({
       id: project?.id ?? "",
       name: project?.name ?? "",
       brand: project?.brand ?? "",
+      owner: project?.ownerUserid ?? "",
       members: (project?.mainGroupMemberIds ?? []).join("\n"),
       note: project?.note ?? "",
     });
@@ -4076,6 +4293,7 @@ function TasksPage({
           id: editorDraft.id,
           name: editorDraft.name,
           brand: editorDraft.brand,
+          ownerUserid: editorDraft.owner,
           mainGroupMemberIds: editorDraft.members,
           note: editorDraft.note,
         },
@@ -4182,6 +4400,7 @@ function TasksPage({
                 onCopyShare={onCopyShare}
                 onPushToGroups={onPushToGroups}
                 onOneClickPush={onOneClickPush}
+                onOwnerLinks={onOwnerLinks}
               />
             ))
           )}
@@ -4202,6 +4421,7 @@ function TasksPage({
                     onCopyShare={onCopyShare}
                     onPushToGroups={onPushToGroups}
                     onOneClickPush={onOneClickPush}
+                    onOwnerLinks={onOwnerLinks}
                   />
                 ))}
               </div>
@@ -4223,6 +4443,7 @@ function TasksPage({
                 onCopyShare={onCopyShare}
                 onPushToGroups={onPushToGroups}
                 onOneClickPush={onOneClickPush}
+                onOwnerLinks={onOwnerLinks}
               />
             ))}
           </div>
diff --git a/app/api/action/route.ts b/app/api/action/route.ts
index 7962be1..175322f 100644
--- a/app/api/action/route.ts
+++ b/app/api/action/route.ts
@@ -731,6 +731,7 @@ export async function POST(request: Request) {
           name: body.name,
           brand: body.brand,
           mainGroupMemberIds: body.mainGroupMemberIds,
+          ownerUserid: body.ownerUserid,
           note: body.note,
         }),
       });
@@ -814,6 +815,85 @@ export async function POST(request: Request) {
       return Response.json({ refresh: status });
     } else if (body.action === "account_field_refresh_status") {
       return Response.json({ refresh: getAccountFieldRefreshStatus() });
+    } else if (body.action === "task_group_links") {
+      const taskId = String(body.taskId ?? "").trim();
+      const task = await db
+        .prepare(
+          "SELECT id, name, share_token, task_chat_id FROM tasks WHERE id = ?",
+        )
+        .bind(taskId)
+        .first<{
+          id: string;
+          name: string;
+          share_token: string | null;
+          task_chat_id: string;
+        }>();
+      if (!task) return Response.json({ error: "任务不存在" }, { status: 404 });
+      const portalUrl = String(env.KOC_PORTAL_URL ?? "").replace(/\/$/, "");
+      const owners = await listGroupOwnerPartners(db);
+      return Response.json({
+        taskName: task.name,
+        taskChatId: task.task_chat_id ?? "",
+        claimUrl: task.share_token
+          ? `${portalUrl}/?task=${task.share_token}`
+          : "",
+        owners: task.share_token
+          ? owners.map((owner) => ({
+              partnerId: owner.id,
+              name: owner.name,
+              wecomUserid: owner.wecom_userid,
+              isInternal: Boolean(owner.wecom_userid),
+              link: `${portalUrl}/?task=${task.share_token}&owner=${owner.id}`,
+            }))
+          : [],
+      });
+    } else if (body.action === "task_group_push") {
+      const taskId = String(body.taskId ?? "").trim();
+      const task = await db
+        .prepare(
+          "SELECT id, name, share_token FROM tasks WHERE id = ?",
+        )
+        .bind(taskId)
+        .first<{ id: string; name: string; share_token: string | null }>();
+      if (!task) return Response.json({ error: "任务不存在" }, { status: 404 });
+      if (!task.share_token) {
+        return Response.json({ error: "任务缺少领取链接" }, { status: 400 });
+      }
+      const owners = (await listGroupOwnerPartners(db)).filter(
+        (owner) => owner.wecom_userid,
+      );
+      if (owners.length === 0) {
+        return Response.json(
+          { error: "没有可推送的内部群主，请先在后台登记群主 userid" },
+          { status: 400 },
+        );
+      }
+      const portalUrl = String(env.KOC_PORTAL_URL ?? "").replace(/\/$/, "");
+      const wecomConfig = resolveWecomConfig(env as unknown as WecomBindings);
+      let sent = 0;
+      let failed = 0;
+      const failList: string[] = [];
+      for (const owner of owners) {
+        const link = `${portalUrl}/?task=${task.share_token}&owner=${owner.id}`;
+        try {
+          const result = await sendWecomAppMessage(
+            [owner.wecom_userid],
+            `【任务派发】${task.name}\n请把领取链接转发给你的 KOC（链接已绑定你的群主身份）：\n${link}`,
+            wecomConfig,
+          );
+          if (result.skipped) {
+            failed += 1;
+            failList.push(owner.name);
+          } else {
+            sent += result.sent;
+            failed += result.failed;
+          }
+        } catch {
+          failed += 1;
+          failList.push(owner.name);
+        }
+      }
+      return Response.json({ sent, failed, failList });
     } else if (body.action === "wecom_group_chats") {
       const groups = await listGroupChatRows(db);
       return Response.json({ groups });
diff --git a/app/api/partner/route.ts b/app/api/partner/route.ts
index 6270ab4..003d7bb 100644
--- a/app/api/partner/route.ts
+++ b/app/api/partner/route.ts
@@ -36,6 +36,12 @@ import {
   resolveWecomConfig,
   type WecomBindings,
 } from "../../../lib/wecom-client";
+import {
+  ensureTaskChatForMembers,
+  sendTaskChatMessage,
+  taskChatIntroText,
+  taskClaimBroadcastText,
+} from "../../../lib/task-group-service";
 import {
   partnerOptions,
   withPartnerCors,
@@ -53,6 +59,7 @@ type PartnerBody = {
   claimantIdentifier?: string;
   claimantName?: string;
   identityTicket?: string;
+  owner?: string;
   quantity?: number;
   publishUrl?: string;
   exposure?: number | string;
@@ -477,9 +484,22 @@ async function handlePost(request: Request) {
         64,
       );
       const claimantIdentifier = parseClaimantIdentifier(identifierInput);
-      const wecomPartnerId = wecomIdentity
-        ? (await resolveWecomClaimant(db, wecomIdentity.externalUserId)).partnerId
-        : null;
+      let wecomPartnerId: string | null = null;
+      if (wecomIdentity?.userId) {
+        const internalPartner = await db
+          .prepare(
+            `SELECT id FROM partners
+             WHERE wecom_userid = ? AND partner_type = 'group_owner'
+             LIMIT 1`,
+          )
+          .bind(wecomIdentity.userId.trim())
+          .first<{ id: string }>();
+        wecomPartnerId = internalPartner?.id ?? null;
+      } else if (wecomIdentity?.externalUserId) {
+        wecomPartnerId = (
+          await resolveWecomClaimant(db, wecomIdentity.externalUserId)
+        ).partnerId;
+      }
       if (!claimantIdentifier && identifierInput.length < 2 && !wecomPartnerId) {
         return Response.json(
           { error: "请输入领取时使用的正确微信号或手机号" },
@@ -563,14 +583,50 @@ async function handlePost(request: Request) {
           { status: 400 },
         );
       }
-      const partnerId = wecomIdentity
-        ? (await resolveWecomClaimant(db, wecomIdentity.externalUserId)).partnerId
-        : `partner-ext-${hashText(
-            `claimant:${claimantIdentifier?.canonical}`,
-          )}`;
-      const claimantName = wecomIdentity
-        ? wecomIdentity.displayName
-        : (claimantIdentifier?.display ?? "");
+      const internalUserid = wecomIdentity?.userId?.trim() ?? "";
+      const externalIdentity =
+        !internalUserid && wecomIdentity ? wecomIdentity : null;
+      let partnerId: string;
+      let claimantName: string;
+      if (internalUserid) {
+        const ownerPartner = await db
+          .prepare(
+            `SELECT id, name FROM partners
+             WHERE wecom_userid = ? AND partner_type = 'group_owner'
+             LIMIT 1`,
+          )
+          .bind(internalUserid)
+          .first<{ id: string; name: string }>();
+        if (!ownerPartner) {
+          return Response.json(
+            { error: "未找到你的群主身份，请先联系运营在后台登记" },
+            { status: 403 },
+          );
+        }
+        partnerId = ownerPartner.id;
+        claimantName = ownerPartner.name || internalUserid;
+      } else if (externalIdentity) {
+        partnerId = (
+          await resolveWecomClaimant(db, externalIdentity.externalUserId)
+        ).partnerId;
+        claimantName = externalIdentity.displayName;
+      } else {
+        partnerId = `partner-ext-${hashText(
+          `claimant:${claimantIdentifier?.canonical}`,
+        )}`;
+        claimantName = claimantIdentifier?.display ?? "";
+      }
+      const ownerInput = textValue(body.owner, 64);
+      let ownerPartnerId = "";
+      if (ownerInput) {
+        const ownerRow = await db
+          .prepare(
+            `SELECT id FROM partners WHERE id = ? AND partner_type = 'group_owner'`,
+          )
+          .bind(ownerInput)
+          .first<{ id: string }>();
+        if (ownerRow) ownerPartnerId = ownerRow.id;
+      }
       const claimId = uid("claim");
       const claimToken = crypto.randomUUID().replaceAll("-", "");
       const claimResult = await db.transaction(async (tx) => {
@@ -586,23 +642,24 @@ async function handlePost(request: Request) {
           .all<{ id: string }>();
         if (available.results.length === 0) return null;
         const statements: DatabaseStatement[] = [
-          wecomIdentity
+          externalIdentity
             ? db
                 .prepare(
                   `INSERT INTO partners
                     (id, name, wecom_name, owner, claimed_total, completed_total,
-                     wecom_external_user_id)
-                   VALUES (?, ?, ?, '外部KOC', 0, 0, ?)
+                     wecom_external_user_id, partner_type)
+                   VALUES (?, ?, ?, '外部KOC', 0, 0, ?, 'group_owner')
                    ON CONFLICT(id) DO UPDATE SET
                      name = excluded.name,
                      wecom_name = excluded.wecom_name,
-                     wecom_external_user_id = excluded.wecom_external_user_id`,
+                     wecom_external_user_id = excluded.wecom_external_user_id,
+                     partner_type = 'group_owner'`,
                 )
                 .bind(
                   partnerId,
                   claimantName,
                   claimantName,
-                  wecomIdentity.externalUserId,
+                  externalIdentity.externalUserId,
                 )
             : db
                 .prepare(
@@ -617,13 +674,14 @@ async function handlePost(request: Request) {
           db
             .prepare(
               `INSERT INTO claims
-                (id, task_id, partner_id, claimant_name, claim_token, quantity)
-               VALUES (?, ?, ?, ?, ?, ?)`,
+                (id, task_id, partner_id, owner_partner_id, claimant_name, claim_token, quantity)
+               VALUES (?, ?, ?, ?, ?, ?, ?)`,
             )
             .bind(
               claimId,
               task.id,
               partnerId,
+              ownerPartnerId,
               claimantName,
               claimToken,
               available.results.length,
@@ -668,6 +726,46 @@ async function handlePost(request: Request) {
       if (!claimResult) {
         return Response.json({ error: "当前任务已领完" }, { status: 409 });
       }
+      runInBackground(
+        (async () => {
+          const wecomConfig = resolveWecomConfig(
+            env as unknown as WecomBindings,
+          );
+          const ensure = await ensureTaskChatForMembers(
+            db,
+            {
+              taskId: task.id,
+              ...(internalUserid ? { addUserids: [internalUserid] } : {}),
+            },
+            wecomConfig,
+          );
+          if (!ensure.chatId) return;
+          if (ensure.created) {
+            await sendTaskChatMessage(
+              db,
+              task.id,
+              taskChatIntroText({
+                name: task.name,
+                brand: task.brand,
+                quantity: task.quantity,
+                dueAt: task.due_at,
+              }),
+              wecomConfig,
+            );
+          }
+          await sendTaskChatMessage(
+            db,
+            task.id,
+            taskClaimBroadcastText(
+              task.name,
+              claimantName,
+              claimResult.claimedCount,
+            ),
+            wecomConfig,
+          );
+        })(),
+        `task-group-claim-${task.id}`,
+      );
       return Response.json(claimResult);
     }
 
diff --git a/app/api/wecom-oauth/route.ts b/app/api/wecom-oauth/route.ts
index 93501fe..fc59629 100644
--- a/app/api/wecom-oauth/route.ts
+++ b/app/api/wecom-oauth/route.ts
@@ -45,9 +45,19 @@ async function handlePost(request: Request) {
         expiresIn,
       });
     }
+    const userId = identity.userId ?? "";
+    if (!userId) {
+      return Response.json({ error: "企业微信未返回有效身份" }, { status: 400 });
+    }
+    const { ticket, expiresIn } = await signWecomIdentityTicket("", "", {
+      userId,
+    });
     return Response.json({
       userType: "internal",
-      userId: identity.userId ?? "",
+      userId,
+      identityTicket: ticket,
+      displayName: userId,
+      expiresIn,
     });
   } catch (error) {
     const status = error instanceof WecomClientError ? error.status : 500;
diff --git a/db/schema.ts b/db/schema.ts
index 7403241..93352f5 100644
--- a/db/schema.ts
+++ b/db/schema.ts
@@ -58,6 +58,7 @@ export const tasks = mysqlTable(
       fsp: 3,
     }),
     projectId: varchar("project_id", { length: 64 }).notNull().default(""),
+    taskChatId: varchar("task_chat_id", { length: 64 }).notNull().default(""),
     createdAt: timestamp("created_at"),
   },
   (table) => [uniqueIndex("tasks_share_token_idx").on(table.shareToken)],
@@ -112,6 +113,9 @@ export const claims = mysqlTable(
     id: varchar("id", { length: 64 }).primaryKey(),
     taskId: varchar("task_id", { length: 64 }).notNull(),
     partnerId: varchar("partner_id", { length: 64 }).notNull(),
+    ownerPartnerId: varchar("owner_partner_id", { length: 64 })
+      .notNull()
+      .default(""),
     claimantName: varchar("claimant_name", { length: 255 }).notNull(),
     claimToken: varchar("claim_token", { length: 128 }).notNull(),
     quantity: int("quantity").notNull(),
@@ -310,6 +314,7 @@ export const projects = mysqlTable("projects", {
   name: varchar("name", { length: 255 }).notNull(),
   brand: varchar("brand", { length: 255 }).notNull().default(""),
   mainGroupMemberIds: text("main_group_member_ids").notNull(),
+  ownerUserid: varchar("owner_userid", { length: 64 }).notNull().default(""),
   status: varchar("status", { length: 32 }).notNull().default("active"),
   note: text("note").notNull(),
   createdAt: timestamp("created_at"),
diff --git a/koc-portal/app/page.tsx b/koc-portal/app/page.tsx
index 763d3e2..e5d8048 100644
--- a/koc-portal/app/page.tsx
+++ b/koc-portal/app/page.tsx
@@ -133,6 +133,7 @@ type PortalParams = {
   claim: string;
   share: string;
   note: string;
+  owner: string;
 };
 
 function readSessionValue<T>(key: string): T | null {
@@ -201,6 +202,7 @@ function buildWecomOAuthState(params: PortalParams): string {
   if (params.claim) compact.set("c", params.claim);
   if (params.share) compact.set("s", params.share);
   if (params.note) compact.set("n", params.note);
+  if (params.owner) compact.set("o", params.owner);
   if (compact.toString().length <= WECOM_OAUTH_STATE_LIMIT) {
     return compact.toString();
   }
@@ -211,6 +213,7 @@ function buildWecomOAuthState(params: PortalParams): string {
   const fallback = new URLSearchParams();
   if (params.task) fallback.set("t", params.task);
   if (params.share) fallback.set("s", params.share);
+  if (params.owner) fallback.set("o", params.owner);
   return fallback.toString();
 }
 
@@ -225,14 +228,17 @@ function restoreParamsFromWecomState(state: string): PortalParams {
     } catch {
       // 忽略清理失败
     }
-    if (stored?.task || stored?.share) return stored;
-    return { task: "", claim: "", share: "", note: "" };
+    if (stored?.task || stored?.share) {
+      return { ...stored, owner: stored.owner ?? "" };
+    }
+    return { task: "", claim: "", share: "", note: "", owner: "" };
   }
   return {
     task: parsed.get("t") ?? "",
     claim: parsed.get("c") ?? "",
     share: parsed.get("s") ?? "",
     note: parsed.get("n") ?? "",
+    owner: parsed.get("o") ?? "",
   };
 }
 
@@ -434,6 +440,7 @@ export default function Home() {
   const [claimToken, setClaimToken] = useState("");
   const [delegationToken, setDelegationToken] = useState("");
   const [selectedId, setSelectedId] = useState("");
+  const [ownerPartnerId, setOwnerPartnerId] = useState("");
   const [payload, setPayload] = useState<TaskPayload | null>(null);
   const [loading, setLoading] = useState(true);
   const [working, setWorking] = useState(false);
@@ -546,7 +553,7 @@ export default function Home() {
         };
         if (
           response.ok &&
-          result.userType === "external" &&
+          (result.userType === "external" || result.userType === "internal") &&
           result.identityTicket
         ) {
           const identity: WecomPortalIdentity = {
@@ -559,7 +566,11 @@ export default function Home() {
           writeSessionValue(WECOM_IDENTITY_SESSION_KEY, identity);
           setWecomIdentity(identity);
           setManualEntry(false);
-          setToast(`企微身份已确认：${identity.name}`);
+          setToast(
+            result.userType === "internal"
+              ? `企业内部身份已确认：${identity.name}`
+              : `企微身份已确认：${identity.name}`,
+          );
         } else {
           markSessionFlag(WECOM_AUTH_FAILED_KEY);
           setToast(
@@ -576,6 +587,7 @@ export default function Home() {
       setClaimToken(restored.claim);
       setDelegationToken(restored.share);
       setSelectedId(restored.note);
+      setOwnerPartnerId(restored.owner);
       if (!restored.task && !restored.share) {
         setLoading(false);
         setError("任务链接不完整，请向运营重新获取");
@@ -606,10 +618,12 @@ export default function Home() {
       const claim = params.get("claim") ?? "";
       const delegation = params.get("share") ?? "";
       const note = params.get("note") ?? "";
+      const owner = params.get("owner") ?? "";
       setTaskToken(task);
       setClaimToken(claim);
       setDelegationToken(delegation);
       setSelectedId(note);
+      setOwnerPartnerId(owner);
       if (!task && !delegation) {
         setLoading(false);
         setError("任务链接不完整，请向运营重新获取");
@@ -628,6 +642,7 @@ export default function Home() {
               claim,
               share: delegation,
               note,
+              owner,
             }),
           ),
         );
@@ -682,6 +697,7 @@ export default function Home() {
           ...(wecomIdentity && !manualEntry
             ? { identityTicket: wecomIdentity.ticket }
             : {}),
+          ...(ownerPartnerId ? { owner: ownerPartnerId } : {}),
           quantity,
         }),
       });
diff --git a/lib/project-service.ts b/lib/project-service.ts
index d80718e..f221b66 100644
--- a/lib/project-service.ts
+++ b/lib/project-service.ts
@@ -5,6 +5,7 @@ export type ProjectRow = {
   name: string;
   brand: string;
   main_group_member_ids: string;
+  owner_userid: string;
   status: string;
   note: string;
   created_at: string;
@@ -18,6 +19,7 @@ export type ProjectSummary = {
   note: string;
   createdAt: string;
   mainGroupMemberIds: string[];
+  ownerUserid: string;
   taskCount: number;
   groupChatCount: number;
 };
@@ -95,7 +97,7 @@ function parseJsonArray(value: string): string[] {
 export async function listProjects(db: DatabaseClient): Promise<ProjectSummary[]> {
   const result = await db
     .prepare(
-      `SELECT p.id, p.name, p.brand, p.main_group_member_ids, p.status, p.note, p.created_at,
+      `SELECT p.id, p.name, p.brand, p.main_group_member_ids, p.owner_userid, p.status, p.note, p.created_at,
               (SELECT COUNT(*) FROM tasks t WHERE t.project_id = p.id) AS task_count,
               (SELECT COUNT(*) FROM project_group_chats g WHERE g.project_id = p.id) AS group_chat_count
        FROM projects p
@@ -110,6 +112,7 @@ export async function listProjects(db: DatabaseClient): Promise<ProjectSummary[]
     note: row.note,
     createdAt: row.created_at,
     mainGroupMemberIds: parseJsonArray(row.main_group_member_ids),
+    ownerUserid: row.owner_userid ?? "",
     taskCount: Number(row.task_count),
     groupChatCount: Number(row.group_chat_count),
   }));
@@ -122,7 +125,7 @@ export async function getProjectDetail(
   const id = text(projectId);
   const project = await db
     .prepare(
-      `SELECT id, name, brand, main_group_member_ids, status, note, created_at
+      `SELECT id, name, brand, main_group_member_ids, owner_userid, status, note, created_at
        FROM projects WHERE id = ?`,
     )
     .bind(id)
@@ -170,6 +173,7 @@ export async function getProjectDetail(
       note: project.note,
       createdAt: project.created_at,
       mainGroupMemberIds: parseJsonArray(project.main_group_member_ids),
+      ownerUserid: project.owner_userid ?? "",
       taskCount: tasks.results.length,
       groupChatCount: chats.results.length,
     },
@@ -192,6 +196,7 @@ export type SaveProjectInput = {
   name?: unknown;
   brand?: unknown;
   mainGroupMemberIds?: unknown;
+  ownerUserid?: unknown;
   note?: unknown;
 };
 
@@ -204,6 +209,7 @@ export async function saveProject(
   const brand = text(input.brand);
   const note = text(input.note ?? "");
   const memberIds = parseMemberIds(input.mainGroupMemberIds);
+  const ownerUserid = text(input.ownerUserid).slice(0, 64);
   if (!name) throw new ProjectError("请填写项目名称");
 
   const now = new Date().toISOString();
@@ -212,10 +218,10 @@ export async function saveProject(
     const result = await db
       .prepare(
         `UPDATE projects
-         SET name = ?, brand = ?, main_group_member_ids = ?, note = ?
+         SET name = ?, brand = ?, main_group_member_ids = ?, owner_userid = ?, note = ?
          WHERE id = ?`,
       )
-      .bind(name, brand, JSON.stringify(memberIds), note, id)
+      .bind(name, brand, JSON.stringify(memberIds), ownerUserid, note, id)
       .run();
     if (result.meta.changes === 0) throw new ProjectError("项目不存在", 404);
   } else {
@@ -223,14 +229,15 @@ export async function saveProject(
     await db
       .prepare(
         `INSERT INTO projects
-          (id, name, brand, main_group_member_ids, status, note, created_at)
-         VALUES (?, ?, ?, ?, 'active', ?, ?)`,
+          (id, name, brand, main_group_member_ids, owner_userid, status, note, created_at)
+         VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`,
       )
       .bind(
         projectId,
         name,
         brand,
         JSON.stringify(memberIds),
+        ownerUserid,
         note,
         now,
       )
diff --git a/lib/task-group-service.ts b/lib/task-group-service.ts
new file mode 100644
index 0000000..956e349
--- /dev/null
+++ b/lib/task-group-service.ts
@@ -0,0 +1,158 @@
+import type { DatabaseClient } from "./database";
+import {
+  createAppChat,
+  getAppChat,
+  hasAppCredentials,
+  sendAppChatMessage,
+  updateAppChat,
+  type WecomConfig,
+} from "./wecom-client";
+
+type FetchLike = typeof fetch;
+
+export type TaskChatEnsureResult = {
+  chatId: string | null;
+  created: boolean;
+  reason?: "no_task" | "no_owner" | "not_enough_members" | "no_credentials";
+};
+
+type TaskChatRow = {
+  id: string;
+  name: string;
+  task_chat_id: string | null;
+  owner_userid: string | null;
+};
+
+function text(value: unknown) {
+  return String(value ?? "").trim();
+}
+
+export function taskChatId(taskId: string) {
+  return `tgc_${text(taskId)}`;
+}
+
+function chatNameForTask(taskName: string) {
+  return `【任务】${text(taskName)}`.slice(0, 20);
+}
+
+async function syncMembers(
+  config: WecomConfig,
+  chatid: string,
+  members: string[],
+  fetchImpl: FetchLike,
+) {
+  const info = await getAppChat(config, chatid, fetchImpl);
+  if (!info) return;
+  const existing = new Set(info.userlist);
+  const missing = members.filter((userid) => !existing.has(userid));
+  if (missing.length > 0) {
+    await updateAppChat(config, { chatid, addUserList: missing }, fetchImpl);
+  }
+}
+
+export async function ensureTaskChatForMembers(
+  db: DatabaseClient,
+  params: { taskId: string; addUserids?: string[] },
+  config: WecomConfig,
+  fetchImpl: FetchLike = fetch,
+): Promise<TaskChatEnsureResult> {
+  const taskId = text(params.taskId);
+  if (!taskId) return { chatId: null, created: false, reason: "no_task" };
+  if (!hasAppCredentials(config)) {
+    return { chatId: null, created: false, reason: "no_credentials" };
+  }
+  const task = await db
+    .prepare(
+      `SELECT t.id, t.name, t.task_chat_id, p.owner_userid AS owner_userid
+       FROM tasks t
+       LEFT JOIN projects p ON p.id = t.project_id
+       WHERE t.id = ?`,
+    )
+    .bind(taskId)
+    .first<TaskChatRow>();
+  if (!task) return { chatId: null, created: false, reason: "no_task" };
+  const ownerUserid = text(task.owner_userid);
+  if (!ownerUserid) {
+    return { chatId: null, created: false, reason: "no_owner" };
+  }
+  const members = [
+    ...new Set(
+      [ownerUserid, ...(params.addUserids ?? []).map((id) => text(id))].filter(
+        Boolean,
+      ),
+    ),
+  ];
+
+  let chatId = text(task.task_chat_id);
+  let createdNow = false;
+  if (!chatId) {
+    chatId = taskChatId(taskId);
+    const existing = await getAppChat(config, chatId, fetchImpl);
+    if (!existing) {
+      if (members.length < 2) {
+        return { chatId: null, created: false, reason: "not_enough_members" };
+      }
+      const created = await createAppChat(
+        config,
+        { name: chatNameForTask(task.name), userlist: members, chatid: chatId },
+        fetchImpl,
+      );
+      chatId = created.chatid;
+      createdNow = true;
+    }
+    await db
+      .prepare("UPDATE tasks SET task_chat_id = ? WHERE id = ?")
+      .bind(chatId, taskId)
+      .run();
+  }
+
+  await syncMembers(config, chatId, members, fetchImpl);
+  return { chatId, created: createdNow };
+}
+
+export async function sendTaskChatMessage(
+  db: DatabaseClient,
+  taskId: string,
+  message: string,
+  config: WecomConfig,
+  fetchImpl: FetchLike = fetch,
+): Promise<boolean> {
+  try {
+    const content = text(message);
+    if (!content) return false;
+    const row = await db
+      .prepare("SELECT task_chat_id FROM tasks WHERE id = ?")
+      .bind(text(taskId))
+      .first<{ task_chat_id: string | null }>();
+    const chatId = text(row?.task_chat_id);
+    if (!chatId) return false;
+    await sendAppChatMessage(config, { chatid: chatId, text: content }, fetchImpl);
+    return true;
+  } catch (error) {
+    console.error(
+      `[KOC LOOP] 任务群消息发送失败（task=${taskId}）`,
+      error instanceof Error ? error.message : error,
+    );
+    return false;
+  }
+}
+
+export function taskClaimBroadcastText(
+  taskName: string,
+  claimantName: string,
+  quantity: number,
+) {
+  return `【领取】${text(claimantName)} 认领 ${quantity} 份 · ${text(taskName)}`;
+}
+
+export function taskChatIntroText(task: {
+  name: string;
+  brand: string;
+  quantity: number;
+  dueAt: string;
+}) {
+  return [
+    `【新任务】${text(task.name)}`,
+    `品牌：${text(task.brand)}｜数量：${task.quantity} 份｜截止：${text(task.dueAt)}`,
+  ].join("\n");
+}
diff --git a/lib/wecom-client.ts b/lib/wecom-client.ts
index 6d49184..5f2b534 100644
--- a/lib/wecom-client.ts
+++ b/lib/wecom-client.ts
@@ -96,7 +96,7 @@ function parseDueDays(value: string | undefined) {
   return Math.min(30, Math.floor(parsed));
 }
 
-function hasAppCredentials(config: WecomConfig) {
+export function hasAppCredentials(config: WecomConfig) {
   return Boolean(config.corpId && config.agentId && config.secret);
 }
 
@@ -635,3 +635,135 @@ export async function fetchWecomExternalContactName(
     return null;
   }
 }
+
+async function postAppChat(
+  config: WecomConfig,
+  path: string,
+  body: Record<string, unknown>,
+  errorLabel: string,
+  fetchImpl: FetchLike,
+): Promise<Record<string, unknown>> {
+  if (!hasAppCredentials(config)) {
+    throw new WecomClientError(
+      "企业微信自建应用未配置（WECOM_CORP_ID / WECOM_AGENT_ID / WECOM_SECRET）",
+      400,
+    );
+  }
+  const token = await fetchAccessToken(config, fetchImpl);
+  const url = `${WECOM_API_ORIGIN}${path}?access_token=${encodeURIComponent(token)}`;
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json; charset=utf-8" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(12_000),
+  });
+  const payload = await readEnvelope(response, errorLabel);
+  if (!response.ok) {
+    throw new WecomClientError(`${errorLabel}（HTTP ${response.status}）`, 502);
+  }
+  ensureOk(payload, errorLabel);
+  return payload;
+}
+
+export async function createAppChat(
+  config: WecomConfig,
+  params: { name: string; userlist: string[]; chatid: string },
+  fetchImpl: FetchLike = fetch,
+): Promise<{ chatid: string }> {
+  const userlist = params.userlist
+    .map((id) => bindingValue(id))
+    .filter((id) => id.length > 0);
+  if (userlist.length < 2) {
+    throw new WecomClientError("创建群聊会话至少需要 2 名成员", 400);
+  }
+  const chatid = bindingValue(params.chatid);
+  if (!chatid || chatid.length > 32) {
+    throw new WecomClientError("群聊 chatid 缺失或超过 32 字符", 400);
+  }
+  const name = bindingValue(params.name).slice(0, 20);
+  const payload = await postAppChat(
+    config,
+    "/cgi-bin/appchat/create",
+    { name, owner: Number(config.agentId), userlist, chatid },
+    "创建企业微信群聊会话失败",
+    fetchImpl,
+  );
+  return { chatid: bindingValue(payload.chatid) || chatid };
+}
+
+export async function updateAppChat(
+  config: WecomConfig,
+  params: {
+    chatid: string;
+    addUserList?: string[];
+    delUserList?: string[];
+  },
+  fetchImpl: FetchLike = fetch,
+): Promise<void> {
+  const body: Record<string, unknown> = {
+    chatid: bindingValue(params.chatid),
+  };
+  const addUserList = (params.addUserList ?? [])
+    .map((id) => bindingValue(id))
+    .filter((id) => id.length > 0);
+  const delUserList = (params.delUserList ?? [])
+    .map((id) => bindingValue(id))
+    .filter((id) => id.length > 0);
+  if (addUserList.length === 0 && delUserList.length === 0) return;
+  if (addUserList.length > 0) body.add_user_list = addUserList;
+  if (delUserList.length > 0) body.del_user_list = delUserList;
+  await postAppChat(
+    config,
+    "/cgi-bin/appchat/update",
+    body,
+    "更新企业微信群聊会话失败",
+    fetchImpl,
+  );
+}
+
+export async function getAppChat(
+  config: WecomConfig,
+  chatid: string,
+  fetchImpl: FetchLike = fetch,
+): Promise<{ chatId: string; name: string; userlist: string[] } | null> {
+  try {
+    const payload = await postAppChat(
+      config,
+      "/cgi-bin/appchat/get",
+      { chatid: bindingValue(chatid) },
+      "获取企业微信群聊会话失败",
+      fetchImpl,
+    );
+    const detail = payload.chat_info as
+      | { chatid?: unknown; name?: unknown; userlist?: unknown[] }
+      | undefined;
+    if (!detail) return null;
+    return {
+      chatId: bindingValue(detail.chatid),
+      name: bindingValue(detail.name),
+      userlist: Array.isArray(detail.userlist)
+        ? detail.userlist.map((id: unknown) => bindingValue(id)).filter(Boolean)
+        : [],
+    };
+  } catch {
+    return null;
+  }
+}
+
+export async function sendAppChatMessage(
+  config: WecomConfig,
+  params: { chatid: string; text: string },
+  fetchImpl: FetchLike = fetch,
+): Promise<void> {
+  const chatid = bindingValue(params.chatid);
+  const content = bindingValue(params.text);
+  if (!chatid || !content) return;
+  await postAppChat(
+    config,
+    "/cgi-bin/appchat/send",
+    { chatid, safe: 0, msgtype: "text", text: { content } },
+    "发送企业微信群聊消息失败",
+    fetchImpl,
+  );
+}
+
diff --git a/lib/wecom-notifier-service.ts b/lib/wecom-notifier-service.ts
index 5c73071..a7e533a 100644
--- a/lib/wecom-notifier-service.ts
+++ b/lib/wecom-notifier-service.ts
@@ -6,6 +6,7 @@ import {
   sendWecomTemplateCard,
   type WecomConfig,
 } from "./wecom-client";
+import { sendTaskChatMessage } from "./task-group-service";
 import { getRuntimeEnv } from "./runtime-env";
 import { releaseUnfinishedDistribution } from "./distribution-release-service";
 
@@ -24,6 +25,7 @@ type DueSoonRow = {
   partner_id: string;
   partner_name: string;
   wecom_external_user_id: string | null;
+  task_id: string;
   task_name: string;
   due_at: string;
   content_title: string;
@@ -56,6 +58,7 @@ export async function runDueSoonWecomNotifications(
         d.partner_id,
         p.name AS partner_name,
         p.wecom_external_user_id,
+        t.id AS task_id,
         t.name AS task_name,
         t.due_at,
         c.title AS content_title
@@ -140,6 +143,31 @@ export async function runDueSoonWecomNotifications(
     );
   }
 
+  const byTask = new Map<
+    string,
+    { taskName: string; dueAt: string; rows: DueSoonRow[] }
+  >();
+  for (const row of result.results) {
+    const entry = byTask.get(row.task_id) ?? {
+      taskName: row.task_name,
+      dueAt: row.due_at,
+      rows: [],
+    };
+    entry.rows.push(row);
+    byTask.set(row.task_id, entry);
+  }
+  for (const [taskId, entry] of byTask) {
+    const partners = [...new Set(entry.rows.map((row) => row.partner_name))];
+    const overflow = partners.length > 5 ? ` 等 ${partners.length} 位` : "";
+    await sendTaskChatMessage(
+      db,
+      taskId,
+      `【催办】《${truncate(entry.taskName, 24)}》有 ${entry.rows.length} 条内容待发布（截止 ${entry.dueAt}）：\n${partners.slice(0, 5).join("、")}${overflow}`,
+      config,
+      fetchImpl,
+    );
+  }
+
   let digestSent = false;
   if (config.robotWebhook && digestTasks.length > 0) {
     const digest =
@@ -276,6 +304,13 @@ export async function runOverdueEscalation(
   const env = getRuntimeEnv();
   const cardUrl = bindingValue(env.APP_ORIGIN) || bindingValue(env.KOC_PORTAL_URL);
   for (const [taskId, entry] of byTask) {
+    await sendTaskChatMessage(
+      db,
+      taskId,
+      `【超期催办】《${truncate(entry.taskName, 24)}》（截止 ${entry.dueAt}）有 ${entry.count} 条内容超期未发布，请跟进催办或释放。`,
+      config,
+      fetchImpl,
+    );
     if (!entry.projectId) continue;
     try {
       const project = await db
diff --git a/lib/wecom-oauth-service.ts b/lib/wecom-oauth-service.ts
index 2b9136c..e161e92 100644
--- a/lib/wecom-oauth-service.ts
+++ b/lib/wecom-oauth-service.ts
@@ -8,6 +8,7 @@ const WECOM_IDENTITY_GRACE_MS = 60 * 1_000;
 type WecomIdentityPayload = {
   v: 1;
   ext: string;
+  uid?: string;
   name: string;
   iat: number;
   exp: number;
@@ -17,6 +18,7 @@ type WecomIdentityPayload = {
 export type WecomIdentity = {
   externalUserId: string;
   displayName: string;
+  userId?: string;
 };
 
 export function getWecomOAuthSecret(): string {
@@ -74,13 +76,19 @@ function constantTimeEquals(a: Uint8Array, b: Uint8Array): boolean {
 export async function signWecomIdentityTicket(
   externalUserId: string,
   displayName: string,
-  options: { secret?: string; nowMs?: number; ttlMs?: number } = {},
+  options: {
+    secret?: string;
+    nowMs?: number;
+    ttlMs?: number;
+    userId?: string;
+  } = {},
 ): Promise<{ ticket: string; expiresIn: number }> {
   const secret = options.secret ?? getWecomOAuthSecret();
   const issuedAt = options.nowMs ?? Date.now();
   const ttl = options.ttlMs ?? WECOM_IDENTITY_TTL_MS;
   const ext = String(externalUserId ?? "").trim();
-  if (!ext) throw new Error("缺少企微外部联系人 ID");
+  const uid = String(options.userId ?? "").trim().slice(0, 64);
+  if (!ext && !uid) throw new Error("缺少企微身份 ID（外部联系人或内部成员）");
   const payload: WecomIdentityPayload = {
     v: 1,
     ext,
@@ -89,6 +97,7 @@ export async function signWecomIdentityTicket(
     exp: issuedAt + ttl,
     jti: toBase64Url(crypto.getRandomValues(new Uint8Array(12))),
   };
+  if (uid) payload.uid = uid;
   const payloadSegment = toBase64Url(
     new TextEncoder().encode(JSON.stringify(payload)),
   );
@@ -122,11 +131,14 @@ export async function verifyWecomIdentityTicket(
   if (
     payload?.v !== 1 ||
     typeof payload.ext !== "string" ||
-    !payload.ext.trim() ||
     typeof payload.exp !== "number"
   ) {
     return null;
   }
+  const extId = payload.ext.trim();
+  const uid =
+    typeof payload.uid === "string" ? payload.uid.trim().slice(0, 64) : "";
+  if (!extId && !uid) return null;
   const secret = options.secret ?? getWecomOAuthSecret();
   const expected = await hmacSha256(secret, payloadSegment);
   const provided = fromBase64Url(signatureSegment);
@@ -134,8 +146,9 @@ export async function verifyWecomIdentityTicket(
   const now = options.nowMs ?? Date.now();
   if (now > payload.exp + WECOM_IDENTITY_GRACE_MS) return null;
   return {
-    externalUserId: payload.ext.trim(),
+    externalUserId: extId,
     displayName: payload.name || "企微客户",
+    ...(uid ? { userId: uid } : {}),
   };
 }
 
diff --git a/mysql/0012_project_owner_task_chat.sql b/mysql/0012_project_owner_task_chat.sql
new file mode 100644
index 0000000..c216c04
--- /dev/null
+++ b/mysql/0012_project_owner_task_chat.sql
@@ -0,0 +1,5 @@
+ALTER TABLE `projects` ADD COLUMN `owner_userid` VARCHAR(64) NOT NULL DEFAULT '' AFTER `main_group_member_ids`;
+-- statement-breakpoint
+ALTER TABLE `tasks` ADD COLUMN `task_chat_id` VARCHAR(64) NOT NULL DEFAULT '' AFTER `project_id`;
+-- statement-breakpoint
+ALTER TABLE `claims` ADD COLUMN `owner_partner_id` VARCHAR(64) NOT NULL DEFAULT '' AFTER `partner_id`;
diff --git a/tests/partner-wecom-claim.test.mjs b/tests/partner-wecom-claim.test.mjs
index a8c6f9b..e7806cb 100644
--- a/tests/partner-wecom-claim.test.mjs
+++ b/tests/partner-wecom-claim.test.mjs
@@ -7,6 +7,11 @@ const routeSource = readFileSync(
   "utf8",
 );
 
+const portalSource = readFileSync(
+  new URL("../koc-portal/app/page.tsx", import.meta.url),
+  "utf8",
+);
+
 test("partner route accepts identityTicket for wecom-backed claim", () => {
   assert.match(routeSource, /identityTicket\?: string/);
   assert.match(routeSource, /verifyWecomIdentityTicket/);
@@ -33,6 +38,72 @@ test("claim with ticket upserts wecom_external_user_id for reminders", () => {
   );
 });
 
+test("internal identity claim resolves the group_owner partner by wecom_userid", () => {
+  assert.match(
+    routeSource,
+    /WHERE wecom_userid = \? AND partner_type = 'group_owner'/,
+  );
+  assert.match(routeSource, /未找到你的群主身份/);
+  assert.match(
+    routeSource,
+    /claimantName = ownerPartner\.name \|\| internalUserid/,
+  );
+});
+
+test("external wecom claim upserts partner_type group_owner", () => {
+  assert.match(
+    routeSource,
+    /wecom_external_user_id, partner_type\)\s*\n\s*VALUES \(\?, \?, \?, '外部KOC', 0, 0, \?, 'group_owner'\)/,
+  );
+  assert.match(
+    routeSource,
+    /partner_type = 'group_owner'`/,
+  );
+});
+
+test("claim records owner_partner_id after validating a group_owner partner", () => {
+  assert.match(routeSource, /owner\?: string/);
+  assert.match(
+    routeSource,
+    /SELECT id FROM partners WHERE id = \? AND partner_type = 'group_owner'/,
+  );
+  assert.match(
+    routeSource,
+    /INSERT INTO claims\s*\n\s*\(\s*id, task_id, partner_id, owner_partner_id, claimant_name, claim_token, quantity\)/,
+  );
+});
+
+test("claim schedules task group creation and broadcast in background", () => {
+  assert.match(routeSource, /ensureTaskChatForMembers/);
+  assert.match(routeSource, /taskClaimBroadcastText/);
+  assert.match(routeSource, /taskChatIntroText/);
+  assert.match(routeSource, /runInBackground\(/);
+  assert.match(
+    routeSource,
+    /internalUserid \? \{ addUserids: \[internalUserid\] \} : \{\}/,
+  );
+});
+
+test("recover resolves internal identity via wecom_userid as well", () => {
+  assert.match(
+    routeSource,
+    /wecomIdentity\?\.userId[\s\S]{0,200}WHERE wecom_userid = \? AND partner_type = 'group_owner'/,
+  );
+});
+
+test("portal preserves owner param through the oauth round trip and sends it with claim", () => {
+  assert.match(portalSource, /owner: string;/);
+  assert.match(portalSource, /compact\.set\("o", params\.owner\)/);
+  assert.match(portalSource, /fallback\.set\("o", params\.owner\)/);
+  assert.match(portalSource, /parsed\.get\("o"\) \?\? ""/);
+  assert.match(portalSource, /params\.get\("owner"\) \?\? ""/);
+  assert.match(
+    portalSource,
+    /ownerPartnerId \? \{ owner: ownerPartnerId \} : \{\}/,
+  );
+  assert.match(portalSource, /userType === "internal"/);
+});
+
 test("recover builds dynamic partner candidates including wecom identity", () => {
   assert.match(
     routeSource,
diff --git a/tests/project-service.test.mjs b/tests/project-service.test.mjs
index bcab4c9..1f895be 100644
--- a/tests/project-service.test.mjs
+++ b/tests/project-service.test.mjs
@@ -27,20 +27,22 @@ function fakeProjectDb({
         name: params[1],
         brand: params[2],
         main_group_member_ids: params[3],
+        owner_userid: params[4],
         status: "active",
-        note: params[4],
-        created_at: params[5],
+        note: params[5],
+        created_at: params[6],
       });
       return 1;
     }
     if (/^UPDATE projects/.test(normalized)) {
-      const row = projects.find((item) => item.id === params[4]);
+      const row = projects.find((item) => item.id === params[5]);
       if (!row) return 0;
       Object.assign(row, {
         name: params[0],
         brand: params[1],
         main_group_member_ids: params[2],
-        note: params[3],
+        owner_userid: params[3],
+        note: params[4],
       });
       return 1;
     }
@@ -177,10 +179,12 @@ test("saveProject inserts with proj- prefixed id and JSON members", async () =>
     name: "暑期焕新",
     brand: "青柠实验室",
     mainGroupMemberIds: "zhangsan\nlisi\nzhangsan",
+    ownerUserid: "owner-zhang",
     note: "备注",
   });
   assert.match(project.id, /^proj-/);
   assert.equal(project.name, "暑期焕新");
+  assert.equal(project.ownerUserid, "owner-zhang");
   assert.deepEqual(project.mainGroupMemberIds, ["zhangsan", "lisi"]);
   assert.equal(db.projects.length, 1);
   assert.equal(db.projects[0].status, "active");
@@ -205,9 +209,11 @@ test("saveProject updates existing row and rejects blank name", async () => {
     name: "新名",
     brand: "品牌",
     mainGroupMemberIds: ["wangwu"],
+    ownerUserid: "owner-li",
   });
   assert.equal(db.projects[0].name, "新名");
   assert.equal(db.projects[0].brand, "品牌");
+  assert.equal(db.projects[0].owner_userid, "owner-li");
   assert.deepEqual(JSON.parse(db.projects[0].main_group_member_ids), ["wangwu"]);
   assert.equal(db.projects.length, 1, "update must not insert");
 
diff --git a/tests/task-group-service.test.mjs b/tests/task-group-service.test.mjs
new file mode 100644
index 0000000..417a4a0
--- /dev/null
+++ b/tests/task-group-service.test.mjs
@@ -0,0 +1,352 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  ensureTaskChatForMembers,
+  sendTaskChatMessage,
+  taskChatId,
+  taskClaimBroadcastText,
+  taskChatIntroText,
+} from "../lib/task-group-service.ts";
+import {
+  clearWecomAccessTokenCacheForTests,
+  resolveWecomConfig,
+} from "../lib/wecom-client.ts";
+
+const baseBindings = {
+  WECOM_CORP_ID: "corp-test",
+  WECOM_AGENT_ID: "1000001",
+  WECOM_SECRET: "secret-test",
+};
+
+test.beforeEach(() => {
+  clearWecomAccessTokenCacheForTests();
+});
+
+function fakeWecom(options = {}) {
+  const calls = [];
+  const chats = new Map(
+    options.chats ?? [
+      ["tgc_task-existing", { name: "【任务】已有群", userlist: ["owner-a"] }],
+    ],
+  );
+  const fetchImpl = async (input, init = {}) => {
+    const url = new URL(String(input));
+    calls.push({ url, init });
+    if (url.pathname.endsWith("/cgi-bin/gettoken")) {
+      return Response.json({
+        errcode: 0,
+        errmsg: "ok",
+        access_token: "token-test",
+        expires_in: 7200,
+      });
+    }
+    if (url.pathname.endsWith("/cgi-bin/appchat/create")) {
+      const body = JSON.parse(String(init.body ?? "{}"));
+      chats.set(body.chatid, { name: body.name, userlist: body.userlist });
+      return Response.json({ errcode: 0, errmsg: "ok", chatid: body.chatid });
+    }
+    if (url.pathname.endsWith("/cgi-bin/appchat/update")) {
+      const body = JSON.parse(String(init.body ?? "{}"));
+      const chat = chats.get(body.chatid);
+      if (!chat) {
+        return Response.json({ errcode: 60111, errmsg: "chat not found" });
+      }
+      for (const userid of body.add_user_list ?? []) {
+        if (!chat.userlist.includes(userid)) chat.userlist.push(userid);
+      }
+      return Response.json({ errcode: 0, errmsg: "ok" });
+    }
+    if (url.pathname.endsWith("/cgi-bin/appchat/get")) {
+      const body = JSON.parse(String(init.body ?? "{}"));
+      const chat = chats.get(body.chatid);
+      if (!chat) {
+        return Response.json({ errcode: 60111, errmsg: "chat not found" });
+      }
+      return Response.json({
+        errcode: 0,
+        errmsg: "ok",
+        chat_info: {
+          chatid: body.chatid,
+          name: chat.name,
+          userlist: chat.userlist,
+        },
+      });
+    }
+    if (url.pathname.endsWith("/cgi-bin/appchat/send")) {
+      const body = JSON.parse(String(init.body ?? "{}"));
+      if (!chats.has(body.chatid)) {
+        return Response.json({ errcode: 60111, errmsg: "chat not found" });
+      }
+      return Response.json({ errcode: 0, errmsg: "ok" });
+    }
+    return new Response("not found", { status: 404 });
+  };
+  return { calls, fetchImpl, chats };
+}
+
+function fakeDb({ task }) {
+  const statements = [];
+  const db = {
+    prepare(sql) {
+      return {
+        bind(...values) {
+          return {
+            async first() {
+              if (/FROM tasks t\s+LEFT JOIN projects p/.test(sql)) {
+                return task;
+              }
+              if (/SELECT task_chat_id FROM tasks/.test(sql)) {
+                return { task_chat_id: task.task_chat_id ?? null };
+              }
+              return null;
+            },
+            async run() {
+              statements.push({ sql, values });
+              return { meta: { changes: 1, last_row_id: 0 } };
+            },
+            async all() {
+              return { results: [] };
+            },
+          };
+        },
+      };
+    },
+  };
+  return { db, statements };
+}
+
+test("taskChatId derives a deterministic chatid within 32 chars", () => {
+  const taskId = "task-1a2b3c4d";
+  const chatid = taskChatId(taskId);
+  assert.equal(chatid, `tgc_${taskId}`);
+  assert.ok(chatid.length <= 32);
+});
+
+test("ensureTaskChatForMembers skips when project has no owner", async () => {
+  const wecom = fakeWecom();
+  const { db } = fakeDb({
+    task: {
+      id: "task-1",
+      name: "任务一",
+      task_chat_id: null,
+      owner_userid: null,
+    },
+  });
+  const result = await ensureTaskChatForMembers(
+    db,
+    { taskId: "task-1", addUserids: ["zhangsan"] },
+    resolveWecomConfig(baseBindings),
+    wecom.fetchImpl,
+  );
+  assert.equal(result.chatId, null);
+  assert.equal(result.reason, "no_owner");
+  assert.equal(wecom.calls.length, 0);
+});
+
+test("ensureTaskChatForMembers skips creation when fewer than 2 members", async () => {
+  const wecom = fakeWecom();
+  const { db } = fakeDb({
+    task: {
+      id: "task-1",
+      name: "任务一",
+      task_chat_id: null,
+      owner_userid: "owner-a",
+    },
+  });
+  const result = await ensureTaskChatForMembers(
+    db,
+    { taskId: "task-1" },
+    resolveWecomConfig(baseBindings),
+    wecom.fetchImpl,
+  );
+  assert.equal(result.chatId, null);
+  assert.equal(result.reason, "not_enough_members");
+  assert.equal(
+    wecom.calls.filter((c) => c.url.pathname.endsWith("/cgi-bin/appchat/create"))
+      .length,
+    0,
+  );
+});
+
+test("ensureTaskChatForMembers creates the chat lazily and stores chat id", async () => {
+  const wecom = fakeWecom({ chats: [] });
+  const { db, statements } = fakeDb({
+    task: {
+      id: "task-1a2b3c4d",
+      name: "任务一",
+      task_chat_id: null,
+      owner_userid: "owner-a",
+    },
+  });
+  const result = await ensureTaskChatForMembers(
+    db,
+    { taskId: "task-1a2b3c4d", addUserids: ["zhangsan"] },
+    resolveWecomConfig(baseBindings),
+    wecom.fetchImpl,
+  );
+  assert.equal(result.chatId, "tgc_task-1a2b3c4d");
+  assert.equal(result.created, true);
+  const createBody = JSON.parse(
+    String(
+      wecom.calls.find((c) => c.url.pathname.endsWith("/cgi-bin/appchat/create"))
+        .init.body,
+    ),
+  );
+  assert.deepEqual(createBody.userlist.sort(), ["owner-a", "zhangsan"]);
+  assert.ok(
+    statements.some(
+      (statement) =>
+        /UPDATE tasks SET task_chat_id/.test(statement.sql) &&
+        statement.values[0] === "tgc_task-1a2b3c4d",
+    ),
+    "chat id persisted to tasks",
+  );
+});
+
+test("ensureTaskChatForMembers reuses stored chat and diffs members", async () => {
+  const wecom = fakeWecom();
+  const { db, statements } = fakeDb({
+    task: {
+      id: "task-existing",
+      name: "已有任务",
+      task_chat_id: "tgc_task-existing",
+      owner_userid: "owner-a",
+    },
+  });
+  const result = await ensureTaskChatForMembers(
+    db,
+    { taskId: "task-existing", addUserids: ["zhangsan"] },
+    resolveWecomConfig(baseBindings),
+    wecom.fetchImpl,
+  );
+  assert.equal(result.chatId, "tgc_task-existing");
+  assert.equal(result.created, false);
+  assert.equal(
+    statements.filter((s) => /UPDATE tasks/.test(s.sql)).length,
+    0,
+    "no redundant chat id update",
+  );
+  const updateBody = JSON.parse(
+    String(
+      wecom.calls.find((c) => c.url.pathname.endsWith("/cgi-bin/appchat/update"))
+        .init.body,
+    ),
+  );
+  assert.deepEqual(updateBody.add_user_list, ["zhangsan"]);
+});
+
+test("ensureTaskChatForMembers recovers when chat exists remotely but not in db", async () => {
+  const wecom = fakeWecom();
+  const { db, statements } = fakeDb({
+    task: {
+      id: "task-existing",
+      name: "已有任务",
+      task_chat_id: null,
+      owner_userid: "owner-a",
+    },
+  });
+  const result = await ensureTaskChatForMembers(
+    db,
+    { taskId: "task-existing", addUserids: ["zhangsan"] },
+    resolveWecomConfig(baseBindings),
+    wecom.fetchImpl,
+  );
+  assert.equal(result.chatId, "tgc_task-existing");
+  assert.equal(result.created, false);
+  assert.ok(statements.some((s) => /UPDATE tasks SET task_chat_id/.test(s.sql)));
+});
+
+test("ensureTaskChatForMembers skips without app credentials", async () => {
+  const wecom = fakeWecom();
+  const { db } = fakeDb({
+    task: {
+      id: "task-1",
+      name: "任务一",
+      task_chat_id: null,
+      owner_userid: "owner-a",
+    },
+  });
+  const result = await ensureTaskChatForMembers(
+    db,
+    { taskId: "task-1", addUserids: ["zhangsan"] },
+    resolveWecomConfig({ ...baseBindings, WECOM_SECRET: "" }),
+    wecom.fetchImpl,
+  );
+  assert.equal(result.reason, "no_credentials");
+  assert.equal(wecom.calls.length, 0);
+});
+
+test("sendTaskChatMessage no-ops without chat id and swallows errors", async () => {
+  const wecom = fakeWecom();
+  const noChat = fakeDb({
+    task: { id: "task-1", task_chat_id: null },
+  });
+  assert.equal(
+    await sendTaskChatMessage(
+      noChat.db,
+      "task-1",
+      "hi",
+      resolveWecomConfig(baseBindings),
+      wecom.fetchImpl,
+    ),
+    false,
+  );
+  assert.equal(wecom.calls.length, 0);
+
+  const failing = fakeWecom({ chats: [] });
+  const withChat = fakeDb({
+    task: { id: "task-existing", task_chat_id: "tgc_task-existing" },
+  });
+  assert.equal(
+    await sendTaskChatMessage(
+      withChat.db,
+      "task-existing",
+      "hi",
+      resolveWecomConfig(baseBindings),
+      failing.fetchImpl,
+    ),
+    false,
+    "provider error swallowed",
+  );
+});
+
+test("sendTaskChatMessage sends text into the task chat", async () => {
+  const wecom = fakeWecom();
+  const { db } = fakeDb({
+    task: { id: "task-existing", task_chat_id: "tgc_task-existing" },
+  });
+  assert.equal(
+    await sendTaskChatMessage(
+      db,
+      "task-existing",
+      "【领取】张三 认领 5 份",
+      resolveWecomConfig(baseBindings),
+      wecom.fetchImpl,
+    ),
+    true,
+  );
+  const sendBody = JSON.parse(
+    String(
+      wecom.calls.find((c) => c.url.pathname.endsWith("/cgi-bin/appchat/send"))
+        .init.body,
+    ),
+  );
+  assert.equal(sendBody.chatid, "tgc_task-existing");
+  assert.equal(sendBody.text.content, "【领取】张三 认领 5 份");
+});
+
+test("broadcast and intro text builders format messages", () => {
+  assert.equal(
+    taskClaimBroadcastText("任务一", "张三", 5),
+    "【领取】张三 认领 5 份 · 任务一",
+  );
+  const intro = taskChatIntroText({
+    name: "任务一",
+    brand: "品牌A",
+    quantity: 10,
+    dueAt: "2026-09-30",
+  });
+  assert.match(intro, /【新任务】任务一/);
+  assert.match(intro, /品牌：品牌A/);
+  assert.match(intro, /截止：2026-09-30/);
+});
diff --git a/tests/wecom-client.test.mjs b/tests/wecom-client.test.mjs
index 93a3c2c..93d14af 100644
--- a/tests/wecom-client.test.mjs
+++ b/tests/wecom-client.test.mjs
@@ -3,14 +3,18 @@ import test from "node:test";
 import {
   buildWecomOAuthUrl,
   clearWecomAccessTokenCacheForTests,
+  createAppChat,
   createGroupMsgTemplate,
   exchangeWecomOAuthCode,
   fetchWecomExternalContactName,
+  getAppChat,
   listCustomerGroupChats,
   listExternalContacts,
   resolveWecomConfig,
+  sendAppChatMessage,
   sendWecomAppMessage,
   sendWecomRobotMessage,
+  updateAppChat,
   WecomClientError,
 } from "../lib/wecom-client.ts";
 
@@ -771,3 +775,175 @@ test("fetchWecomExternalContactName resolves name and falls back to null", async
     null,
   );
 });
+
+function fakeAppChat(options = {}) {
+  const calls = [];
+  const chats = new Map(
+    options.chats ?? [
+      ["tgc_task-existing", { name: "【任务】已有群", userlist: ["owner-a"] }],
+    ],
+  );
+  const fetchImpl = async (input, init = {}) => {
+    const url = new URL(String(input));
+    calls.push({ url, init });
+    if (url.pathname.endsWith("/cgi-bin/gettoken")) {
+      return Response.json({
+        errcode: 0,
+        errmsg: "ok",
+        access_token: "token-test",
+        expires_in: 7200,
+      });
+    }
+    if (url.pathname.endsWith("/cgi-bin/appchat/create")) {
+      const body = JSON.parse(String(init.body ?? "{}"));
+      chats.set(body.chatid, { name: body.name, userlist: body.userlist });
+      return Response.json({ errcode: 0, errmsg: "ok", chatid: body.chatid });
+    }
+    if (url.pathname.endsWith("/cgi-bin/appchat/update")) {
+      const body = JSON.parse(String(init.body ?? "{}"));
+      const chat = chats.get(body.chatid);
+      if (!chat) {
+        return Response.json({ errcode: 60111, errmsg: "chat not found" });
+      }
+      for (const userid of body.add_user_list ?? []) {
+        if (!chat.userlist.includes(userid)) chat.userlist.push(userid);
+      }
+      return Response.json({ errcode: 0, errmsg: "ok" });
+    }
+    if (url.pathname.endsWith("/cgi-bin/appchat/get")) {
+      const body = JSON.parse(String(init.body ?? "{}"));
+      const chat = chats.get(body.chatid);
+      if (!chat) {
+        return Response.json({ errcode: 60111, errmsg: "chat not found" });
+      }
+      return Response.json({
+        errcode: 0,
+        errmsg: "ok",
+        chat_info: {
+          chatid: body.chatid,
+          name: chat.name,
+          userlist: chat.userlist,
+        },
+      });
+    }
+    if (url.pathname.endsWith("/cgi-bin/appchat/send")) {
+      const body = JSON.parse(String(init.body ?? "{}"));
+      if (!chats.has(body.chatid)) {
+        return Response.json({ errcode: 60111, errmsg: "chat not found" });
+      }
+      return Response.json({ errcode: 0, errmsg: "ok" });
+    }
+    return new Response("not found", { status: 404 });
+  };
+  return { calls, fetchImpl, chats };
+}
+
+test("createAppChat posts name/userlist/chatid and returns chatid", async () => {
+  const { calls, fetchImpl } = fakeAppChat();
+  const result = await createAppChat(
+    resolveWecomConfig(baseBindings),
+    { name: "【任务】任务名超长会被截断到二十个字符", userlist: ["owner-a", "owner-b"], chatid: "tgc_task-new" },
+    fetchImpl,
+  );
+  assert.equal(result.chatid, "tgc_task-new");
+  const call = calls.find((c) => c.url.pathname.endsWith("/cgi-bin/appchat/create"));
+  assert.ok(call, "appchat/create was called");
+  assert.equal(call.url.searchParams.get("access_token"), "token-test");
+  const body = JSON.parse(String(call.init.body));
+  assert.equal(body.chatid, "tgc_task-new");
+  assert.equal(body.userlist.length, 2);
+  assert.ok(body.name.length <= 20, "chat name truncated to 20 chars");
+});
+
+test("createAppChat rejects fewer than 2 members and oversized chatid", async () => {
+  const { calls, fetchImpl } = fakeAppChat();
+  const config = resolveWecomConfig(baseBindings);
+  await assert.rejects(
+    () => createAppChat(config, { name: "x", userlist: ["only"], chatid: "tgc_t" }, fetchImpl),
+    /至少需要 2 名成员/,
+  );
+  await assert.rejects(
+    () =>
+      createAppChat(
+        config,
+        { name: "x", userlist: ["a", "b"], chatid: "c".repeat(33) },
+        fetchImpl,
+      ),
+    /32 字符/,
+  );
+  assert.equal(calls.length, 0, "no API calls for invalid payload");
+});
+
+test("updateAppChat adds and removes members", async () => {
+  const { calls, fetchImpl, chats } = fakeAppChat();
+  await updateAppChat(
+    resolveWecomConfig(baseBindings),
+    { chatid: "tgc_task-existing", addUserList: ["owner-b"], delUserList: [] },
+    fetchImpl,
+  );
+  const call = calls.find((c) => c.url.pathname.endsWith("/cgi-bin/appchat/update"));
+  assert.ok(call, "appchat/update was called");
+  const body = JSON.parse(String(call.init.body));
+  assert.deepEqual(body.add_user_list, ["owner-b"]);
+  assert.deepEqual(chats.get("tgc_task-existing").userlist, ["owner-a", "owner-b"]);
+});
+
+test("updateAppChat skips the API call when there is nothing to change", async () => {
+  const { calls, fetchImpl } = fakeAppChat();
+  await updateAppChat(
+    resolveWecomConfig(baseBindings),
+    { chatid: "tgc_task-existing", addUserList: [], delUserList: [] },
+    fetchImpl,
+  );
+  assert.equal(
+    calls.filter((c) => c.url.pathname.endsWith("/cgi-bin/appchat/update")).length,
+    0,
+  );
+});
+
+test("getAppChat returns member list or null on error", async () => {
+  const { fetchImpl } = fakeAppChat();
+  const info = await getAppChat(
+    resolveWecomConfig(baseBindings),
+    "tgc_task-existing",
+    fetchImpl,
+  );
+  assert.equal(info.chatId, "tgc_task-existing");
+  assert.deepEqual(info.userlist, ["owner-a"]);
+  assert.equal(
+    await getAppChat(resolveWecomConfig(baseBindings), "tgc_task-missing", fetchImpl),
+    null,
+  );
+});
+
+test("sendAppChatMessage posts text payload to appchat/send", async () => {
+  const { calls, fetchImpl } = fakeAppChat();
+  await sendAppChatMessage(
+    resolveWecomConfig(baseBindings),
+    { chatid: "tgc_task-existing", text: "【领取】张三 认领 5 份" },
+    fetchImpl,
+  );
+  const call = calls.find((c) => c.url.pathname.endsWith("/cgi-bin/appchat/send"));
+  assert.ok(call, "appchat/send was called");
+  const body = JSON.parse(String(call.init.body));
+  assert.equal(body.chatid, "tgc_task-existing");
+  assert.equal(body.msgtype, "text");
+  assert.equal(body.text.content, "【领取】张三 认领 5 份");
+});
+
+test("sendAppChatMessage throws WecomClientError when provider errors", async () => {
+  const { fetchImpl } = fakeAppChat({ chats: [] });
+  await assert.rejects(
+    () =>
+      sendAppChatMessage(
+        resolveWecomConfig(baseBindings),
+        { chatid: "tgc_task-missing", text: "hello" },
+        fetchImpl,
+      ),
+    (error) => {
+      assert.ok(error instanceof WecomClientError);
+      assert.equal(error.status, 502);
+      return true;
+    },
+  );
+});
diff --git a/tests/wecom-oauth-service.test.mjs b/tests/wecom-oauth-service.test.mjs
index 5574568..b11a506 100644
--- a/tests/wecom-oauth-service.test.mjs
+++ b/tests/wecom-oauth-service.test.mjs
@@ -41,6 +41,48 @@ test("identity ticket sign → verify roundtrip", async () => {
   assert.deepEqual(identity, { externalUserId: "wmExt123", displayName: "张三" });
 });
 
+test("internal identity ticket carries userId and no external id", async () => {
+  const { ticket } = await signWecomIdentityTicket("", "", {
+    secret: SECRET,
+    userId: "zhangsan",
+  });
+  const identity = await verifyWecomIdentityTicket(ticket, { secret: SECRET });
+  assert.equal(identity.externalUserId, "");
+  assert.equal(identity.userId, "zhangsan");
+});
+
+test("signWecomIdentityTicket rejects when neither external nor internal id present", async () => {
+  await assert.rejects(
+    () => signWecomIdentityTicket("", "", { secret: SECRET }),
+    /缺少企微身份/,
+  );
+});
+
+test("internal identity ticket forgery is rejected", async () => {
+  const { ticket } = await signWecomIdentityTicket("", "", {
+    secret: SECRET,
+    userId: "zhangsan",
+  });
+  const [payload, signature] = ticket.split(".");
+  const decoded = JSON.parse(
+    Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(
+      "utf8",
+    ),
+  );
+  decoded.uid = "wangwu";
+  const forgedPayload = Buffer.from(JSON.stringify(decoded))
+    .toString("base64")
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "");
+  assert.equal(
+    await verifyWecomIdentityTicket(`${forgedPayload}.${signature}`, {
+      secret: SECRET,
+    }),
+    null,
+  );
+});
+
 test("identity ticket falls back to default display name when empty", async () => {
   const { ticket } = await signWecomIdentityTicket("wmExt123", "  ", {
     secret: SECRET,