@agentconnect.md/cli 1.17.1-rc.1 → 1.18.0-rc.7

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-import fs, { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import fs, { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import path, { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { EventEmitter } from "node:events";
@@ -8113,11 +8113,19 @@ const IntegrationDiscordConfig = object({
 * signing secret). `appId` is a semi-public identifier (`cli_…`); `appSecret` is
 * plaintext secret material — NEVER log it. `botOpenId` is the bot's own open_id
 * for @-mention routing; lazily resolved by the daemon via `bot/info` if absent.
+*
+* `region` selects the open-platform gateway the daemon SDK (and CP verifier)
+* talk to — `'feishu'` = mainland China (`open.feishu.cn`, the SDK default) vs
+* `'lark'` = international (`open.larksuite.com`). Same app model, different host;
+* an app is registered in exactly one region. Defaults to `'feishu'` so existing
+* installs are unaffected.
 */
+const FeishuRegion = _enum(["feishu", "lark"]);
 const IntegrationFeishuConfig = object({
 	appId: string(),
 	appSecret: string(),
 	botOpenId: string().optional(),
+	region: FeishuRegion.default("feishu"),
 	allowedUserIds: array(string()).default([]),
 	bindRules: array(IntegrationBindRule).default([])
 });
@@ -14807,10 +14815,31 @@ function assertValidControlPlane(raw) {
 	if (typeof cp.key !== "string" || cp.key.length === 0) throw new Error("invalid config: controlPlane.key must be a non-empty string");
 	if (raw.daemonId !== void 0 && typeof raw.daemonId !== "string") throw new Error("invalid config: daemonId must be a string");
 }
+function protectCredentialsFile(file) {
+	if (!existsSync(file)) return;
+	try {
+		if ((statSync(file).mode & 511) !== 384) chmodSync(file, 384);
+	} catch (err) {
+		if (process.platform !== "win32") throw err;
+	}
+}
+function writeCredentialsFile(file, raw) {
+	mkdirSync(dirname(file), {
+		recursive: true,
+		mode: 448
+	});
+	protectCredentialsFile(file);
+	writeFileSync(file, JSON.stringify(raw, null, 2) + "\n", {
+		encoding: "utf8",
+		mode: 384
+	});
+	protectCredentialsFile(file);
+}
 /** Merge url/token into config.json (validated), returning the written path. */
 function persistCredentials(opts) {
 	const root = resolveRoot(opts.root);
 	const file = opts.configPath ?? configPath(root);
+	protectCredentialsFile(file);
 	const raw = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : { version: 1 };
 	raw.controlPlane = {
 		...raw.controlPlane ?? {},
@@ -14820,8 +14849,7 @@ function persistCredentials(opts) {
 	};
 	if (opts.daemonId) raw.daemonId = opts.daemonId;
 	assertValidControlPlane(raw);
-	mkdirSync(dirname(file), { recursive: true });
-	writeFileSync(file, JSON.stringify(raw, null, 2) + "\n");
+	writeCredentialsFile(file, raw);
 	return file;
 }
 /**