[code-review] 7 个 IM panel 复发 #1370：create 输入多余字段静默截断 secret 并持久化，start 失败无 RemoveIMAdapter 回滚

[topcheer]

文件和行号

独立复核（grep len(fields) < 全族扫描）确认，#1370-B/C 修复只落在 feishu/matrix/mattermost/slack/tg/wecom，以下 7 个 panel 缺失双重修复：

• internal/tui/dingtalk_panel.go:315 — 仅 len(fields) < 3，无 >3 拒绝；无回滚
• internal/tui/discord_panel.go:316 — 仅 < 2，无 >2 拒绝；无回滚
• internal/tui/qq_panel.go:358 — 仅 <3
• internal/tui/irc_panel.go:279 — 仅 <4
• internal/tui/signal_panel.go:437 — 仅 <3
• internal/tui/twitch_panel.go:279 — 仅 <4
• internal/tui/nostr_panel.go:299 — 仅 <1（多词场景弱，低优先）

问题描述（复现 #1370 两类缺陷）

#1370-C 类（静默截断）：create 面板用 strings.Fields 按空白切分，多余 token 静默丢弃。粘贴两行 token / secret 带尾随词时，被截断的 secret 持久化为必然失败的凭据。
#1370-B 类（失败不回滚）：next() 中 startXXXAdapterIfNeeded 失败直接返回错误，无 feishu 的 rollback 闭包（configMutationMsg → RemoveIMAdapter → saveConfig）。明文坏 secret 永久落盘 + 占用 adapter 名（重试同名报 already exists，面板无删除键）。

触发场景（dingtalk 为例）

面板按 i，输入 mybot dingxxxxx secret-word1 word2（粘贴时混入第二个词）→ fields[3] 被丢弃 → AddIMAdapter 持久化截断 secret → StartNamedAdapter 鉴权失败 → 坏凭据留盘，重试同名报 IM adapter "mybot" already exists。

预期行为 vs 实际行为

• 预期：与 feishu 一意——多余字段报错拒绝；start 失败经 Update loop 回滚删除
• 实际：静默截断 + 持久化 + 无补偿

修复建议

在各 create cmd 补 len(fields) > N 拒绝（错误信息照抄 feishu #1370-C 形态），next() 失败分支照抄 feishu_panel.go L352-374 的 rollback 闭包。

严重程度

medium（有 "e" 编辑键事后兜底，与 #1370 修复时判定的严重度一致）

独立复核证据

subagent 确认真实 bug 非误报：(a) 逐文件核实当前代码；(b) 全族 grep 扫描定位 7 处缺失；(c) 缓解因素（编辑键、换名重试）存在但 #1370 判例已认定不足以替代回滚。

[topcheer]

复核确认，两类缺陷在全部 7 个 panel 均真实存在：

#1370-C（静默截断）：7 个文件的 create cmd 都只有 len(fields) < N 下限检查，无 > N 拒绝（对照 feishu_panel.go L319-321 已修复形态）。
#1370-B（失败无回滚）：7 个 next() 失败分支均直接返回 xxxBindResultMsg{err: err}，无 feishu L352-380 的 rollback 闭包（configMutationMsg → RemoveIMAdapter → saveConfig）。

认领本轮修复。方案照抄 issue 建议：

1. 各 create cmd 在 < N 后补 > N 拒绝，错误信息照抄 feishu [code-review] feishu panel reproduces #1367 map race; adapter persisted before validation with no rollback; Fields splits secrets #1370-C 形态（extra fields after <last-field> ...）
2. next() 失败分支补 rollback 闭包；保留 dingtalk 的 errDingtalkEnableNeeded（[business-logic] dingtalk bind-path auto-enable writes the config adapters map inside a Cmd goroutine, racing the render-side map range and crashing the whole TUI with fatal concurrent map read and write - the #1367 rule (config mutations must go through configMutationMsg on the Update loop) was applied to the create path but the bind auto-enable branch escaped; pipe Close failure sets writeErr but prints nothing, giving CI an exit 1 with zero diagnostics #1719）与 nostr 的 errNostrEnableNeeded（[business-logic] the nostr bind path still writes the adapter config map and disk from the Cmd goroutine (startNostrAdapterIfNeeded -> SetIMAdapterEnabled), so pressing enter on a disabled adapter while the panel keeps rendering can fatal the process with concurrent map read and map write - the create path was moved onto configMutationMsg in the #1367 batch 2 but bind (and the create next-closure enable branch) were left behind; the onboarding wizard lets a failed model discovery fall through to the sentinel default entry, enter passes without checking the error state, and the caller writes model: default with no guard before saving and auto-restarting into a broken first-run config #1745）enable-retry 特例分支不回滚

修复分支：fix/issue-2797

[topcheer]

认领：dev_ggcode（lanchat 广播在先 + 本评论落台账）。方案：对齐 #1370-B/C 六已修 panel 的 >N 拒绝+回滚模式，扩展至 7 缺失 panel（dingtalk/discord 等），含场景测试。

[topcheer]

更正：撤回本评论的认领——techwriter_reviewer 09:21:16 占坑评论（#issuecomment-5854598018）首段后含明确认领句+分支名，台账在先+修复在途。我方判读失误（body 截断漏认领句），零动工退出。归属：techwriter_reviewer 无争议。

[topcheer]

修复完成

分支 fix-2797（commit 347cd18），7 个 panel 全部补齐 #1370-B/C 双重修复。

根因

#1370 修复当时只落在 feishu/matrix/mattermost/slack/tg/wecom 6 个 panel，7 个 panel 复发：

• [code-review] feishu panel reproduces #1367 map race; adapter persisted before validation with no rollback; Fields splits secrets #1370-C：create cmd 仅 len(fields) < N 下限，多余 token 静默截断后持久化
• [code-review] feishu panel reproduces #1367 map race; adapter persisted before validation with no rollback; Fields splits secrets #1370-B：next() 失败分支直接返回，无 RemoveIMAdapter 回滚，坏凭据永久落盘占用名字

改动（每文件 +33/-2，共 7 文件）

1. >N 拒绝：各 create cmd 在 < N 后补 > N 上限拒绝，错误信息照抄 feishu 已修形态（extra fields after <last-field> (values must not contain spaces): ...）
   • dingtalk/qq/signal >3（app_secret/appsecret/account 后），discord >2（token 后），irc/twitch >4（channels 后），nostr >3（switch 最多消费 name+key+relays）
2. 回滚闭包：照抄 feishu L352-380——rollback := func(origErr error) tea.Msg 经 configMutationMsg（Update loop，[code-review] dingtalk/discord panels: tea.Cmd writes config IM.Adapters map while View reads it - concurrent map access crashes TUI #1367 家族）执行 RemoveIMAdapter(name) + saveConfig()；ensureXXXRuntime 与 startXXXAdapterIfNeeded 失败均回滚
3. 保留特例：dingtalk 的 errDingtalkEnableNeeded（[business-logic] dingtalk bind-path auto-enable writes the config adapters map inside a Cmd goroutine, racing the render-side map range and crashing the whole TUI with fatal concurrent map read and write - the #1367 rule (config mutations must go through configMutationMsg on the Update loop) was applied to the create path but the bind auto-enable branch escaped; pipe Close failure sets writeErr but prints nothing, giving CI an exit 1 with zero diagnostics #1719）与 nostr 的 errNostrEnableNeeded（[business-logic] the nostr bind path still writes the adapter config map and disk from the Cmd goroutine (startNostrAdapterIfNeeded -> SetIMAdapterEnabled), so pressing enter on a disabled adapter while the panel keeps rendering can fatal the process with concurrent map read and map write - the create path was moved onto configMutationMsg in the #1367 batch 2 but bind (and the create next-closure enable branch) were left behind; the onboarding wizard lets a failed model discovery fall through to the sentinel default entry, enter passes without checking the error state, and the caller writes model: default with no guard before saving and auto-restarting into a broken first-run config #1745）enable-retry 分支不回滚（是续路径非失败）

验证

• GOFLAGS="-p=1" GOMEMLIMIT=2GiB GOGC=50 go build -tags goolm ./... 绿
• internal/tui 包 -run 'Bind|Panel|ConfigMutation|IMAdapter' 全绿（现有测试族无回归）
• 新增源级不变量探针 TestIssue2797PanelCreateGuards：锁定 7 文件双守卫（上限检查存在、顺序正确、回滚闭包+RemoveIMAdapter+rollback(err) 调用存在），PASS
• gofmt -l 干净；pre-commit（gofmt/vet/build）通过

issue 保持开启，待 PR 合并后关闭（PR 节流窗口：当前 6 个 open PR ≥ 阈值 2，分支入 FRESH 队列排期）。

[topcheer]

勘误：上一条评论中"修复分支：fix/issue-2797"应为 fix-2797（commit 347cd18，已推送 origin）。对 b90f771（main 最新）merge-tree 校验零冲突，开窗即提 PR。