feat: add auth gate and Chinese command parsing

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/auth.test.ts

@@ -0,0 +1,16 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { isAuthorized } from '../src/auth.ts'
+
+test('empty allowlist rejects even with userId', () => {
+  assert.equal(isAuthorized({ allowAllUsers: false, allowedUserIds: [], userId: 1 }), false)
+})
+
+test('allowAllUsers accepts missing userId', () => {
+  assert.equal(isAuthorized({ allowAllUsers: true, allowedUserIds: [], userId: undefined }), true)
+})
+
+test('allowlist match', () => {
+  assert.equal(isAuthorized({ allowAllUsers: false, allowedUserIds: [42], userId: 42 }), true)
+  assert.equal(isAuthorized({ allowAllUsers: false, allowedUserIds: [42], userId: 7 }), false)
+})

tests/commands.test.ts

@@ -0,0 +1,18 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { MSG, parseCommand } from '../src/commands.ts'
+
+test('parse slash commands', () => {
+  assert.equal(parseCommand('/start').type, 'start')
+  assert.equal(parseCommand('/help extra').type, 'help')
+  assert.equal(parseCommand('/new').type, 'new')
+  assert.equal(parseCommand('/clear').type, 'new')
+  assert.equal(parseCommand('/foo').type, 'unknown')
+  assert.equal(parseCommand('hello').type, 'plain')
+})
+
+test('Chinese copy is non-empty', () => {
+  assert.ok(MSG.DENIED.includes('权限') || MSG.DENIED.includes('授权'))
+  assert.ok(MSG.HELP.includes('/new'))
+  assert.ok(MSG.WELCOME.length > 0)
+})