@ai-setting/roy-agent-core 1.7.77 → 1.7.85

package/dist/shared/@ai-setting/{roy-agent-core-3gpygqcx.js → roy-agent-core-xf6z96qy.js}

@@ -1,29 +1,40 @@
 import {
   defaultLarkCliRunner
-} from "./roy-agent-core-bxkjk7zx.js";
+} from "./roy-agent-core-vx8zc847.js";
 import {
   cliCommandHandler
 } from "./roy-agent-core-v0hf14bj.js";
+import {
+  guardConfigWrite
+} from "./roy-agent-core-2stt4rp5.js";
 import {
   TaskTagPlugin,
   createLarkCliTaskNotifyHook,
   createPerTaskGroupChatPlugin,
+  createWecomCardStateStore,
+  createWecomTaskNotifyHook,
   extractPerTaskChatId,
   extractPerTaskChatName
-} from "./roy-agent-core-rsn44n9y.js";
+} from "./roy-agent-core-b31v3qpv.js";
+import {
+  WecomCardActionKey,
+  buildWecomCardUpdateFrame,
+  registerWecomRespondTarget,
+  unregisterWecomRespondTarget
+} from "./roy-agent-core-m3vjepzz.js";
 import {
   getSharedEventStore
 } from "./roy-agent-core-na18zwj0.js";
 import {
   createLarkCliWorkflowNotifyHook
-} from "./roy-agent-core-hd3n57zs.js";
+} from "./roy-agent-core-d1n4jbza.js";
 import {
   LarkCardPatchNotifier,
   buildTaskCard
-} from "./roy-agent-core-w0qjeq2v.js";
+} from "./roy-agent-core-7dd0s3xb.js";
 import {
   notifyReactFailure
-} from "./roy-agent-core-6cy43nss.js";
+} from "./roy-agent-core-rykf7c04.js";
 import {
   normalizeLarkAtMentions
 } from "./roy-agent-core-m880qz3y.js";
@@ -55,11 +66,133 @@ import {
 } from "./roy-agent-core-fs0mn2jk.js";
 
 // src/env/event-source/event-source-handlers.ts
-import { spawn as spawn2, exec as execSync } from "child_process";
+import { spawn as spawn3, exec as execSync } from "child_process";
 import { promisify as promisify2 } from "node:util";
 init_global_hook_manager();
 init_context();
 
+// src/env/event-source/es-plugins.ts
+init_global_hook_manager();
+var BUILT_IN_PLUGIN_FACTORIES = {
+  LarkCliTaskNotifyPlugin: (cfg) => createLarkCliTaskNotifyHook(cfg),
+  WecomTaskNotifyPlugin: (cfg) => createWecomTaskNotifyHook(cfg),
+  LarkCliWorkflowNotifyPlugin: (cfg) => createLarkCliWorkflowNotifyHook(cfg),
+  PerTaskGroupChatPlugin: (cfg) => createPerTaskGroupChatPlugin(cfg),
+  "task-tag": () => new TaskTagPlugin
+};
+function getWecomPluginFactories() {
+  return BUILT_IN_PLUGIN_FACTORIES;
+}
+function getPluginHookPointsShared(plugin) {
+  if (Array.isArray(plugin.hooks)) {
+    return plugin.hooks.map((h) => h.point || h);
+  }
+  if (Array.isArray(plugin.hookPoints)) {
+    return plugin.hookPoints.map((h) => h.point || h);
+  }
+  if (typeof plugin.execute === "function" && plugin.hookPoint) {
+    return [plugin.hookPoint];
+  }
+  if (plugin.name && typeof plugin.execute === "function") {
+    return [
+      "task:after.create",
+      "task:after.update",
+      "task:operation:after.create",
+      "task:after.complete",
+      "task:after.delete"
+    ];
+  }
+  return [];
+}
+function registerPluginHooksShared(plugin, pluginName, sourceId) {
+  const hookPoints = getPluginHookPointsShared(plugin);
+  if (typeof plugin.init === "function") {
+    const pluginEnv = {
+      getComponent: () => null,
+      registerAgent: () => {},
+      registerTool: () => {},
+      registerHook: (hook) => {
+        globalHookManager.register(hook.point, {
+          name: `${pluginName}:${hook.point}`,
+          priority: hook.priority ?? 0,
+          pluginName,
+          sourceId,
+          execute: hook.handler
+        });
+      },
+      logger: {
+        debug: (...args) => console.debug(`[plugin:${pluginName}]`, ...args),
+        info: (...args) => console.info(`[plugin:${pluginName}]`, ...args),
+        warn: (...args) => console.warn(`[plugin:${pluginName}]`, ...args),
+        error: (...args) => console.error(`[plugin:${pluginName}]`, ...args)
+      }
+    };
+    plugin.init(pluginEnv);
+    return hookPoints;
+  }
+  if (typeof plugin.execute === "function") {
+    if (plugin.hookPoint) {
+      globalHookManager.register(plugin.hookPoint, {
+        name: `${pluginName}:${plugin.hookPoint}`,
+        priority: plugin.priority ?? 0,
+        pluginName,
+        sourceId,
+        execute: plugin.execute.bind(plugin)
+      });
+    } else {
+      for (const hookPoint of hookPoints) {
+        globalHookManager.register(hookPoint, {
+          name: `${pluginName}:${hookPoint}`,
+          priority: plugin.priority ?? 0,
+          pluginName,
+          sourceId,
+          execute: plugin.execute.bind(plugin)
+        });
+      }
+    }
+    return hookPoints;
+  }
+  if (Array.isArray(plugin.hooks)) {
+    for (const hook of plugin.hooks) {
+      const hookPoint = hook.point || hook;
+      const priority = hook.priority ?? 0;
+      globalHookManager.register(hookPoint, {
+        name: `${pluginName}:${hookPoint}`,
+        priority,
+        pluginName,
+        sourceId,
+        execute: async (ctx) => {
+          await plugin.execute(ctx);
+        }
+      });
+    }
+    return hookPoints;
+  }
+  return hookPoints;
+}
+function importPluginShared(name, factories, pluginConfig = {}) {
+  const factory = factories[name];
+  if (!factory) {
+    console.error(`[es-plugins] Unknown plugin: ${name}`);
+    return null;
+  }
+  try {
+    return factory({
+      sourceId: "",
+      pluginName: name,
+      ...pluginConfig
+    });
+  } catch (error) {
+    console.error(`[es-plugins] Failed to instantiate plugin ${name}:`, error);
+    return null;
+  }
+}
+function unregisterPluginHooksShared(pluginName, hookPoints) {
+  for (const hookPoint of hookPoints) {
+    globalHookManager.unregister(hookPoint, `${pluginName}:${hookPoint}`);
+  }
+}
+
 // src/env/task/plugins/lark-card-action-handler.ts
 init_logger();
 import { exec } from "node:child_process";
@@ -788,13 +921,19 @@ class BountyIMInstance {
     const { email } = readBountyIMConfig(this.config);
     return email || "unknown";
   }
+  cachedSystemPrompt;
+  systemPromptResolved = false;
   getCurrentSystemPrompt() {
-    const { email, imServerUrl } = readBountyIMConfig(this.config);
-    return resolveBountyIMSystemPrompt({
-      configSystemPrompt: this.config.systemPrompt,
-      currentEmail: email,
-      imServerUrl
-    });
+    if (!this.systemPromptResolved) {
+      const { email, imServerUrl } = readBountyIMConfig(this.config);
+      this.cachedSystemPrompt = resolveBountyIMSystemPrompt({
+        configSystemPrompt: this.config.systemPrompt,
+        currentEmail: email,
+        imServerUrl
+      });
+      this.systemPromptResolved = true;
+    }
+    return this.cachedSystemPrompt;
   }
   getStatus() {
     return this.status;
@@ -1126,145 +1265,1585 @@ class BountyCliInstance {
   setStatus(status) {
     this.status = status;
   }
-  async start() {
-    if (this.status === "running")
+  async start() {
+    if (this.status === "running")
+      return;
+    this.setStatus("starting");
+    const { channel, profile, customCommand } = readBountyCliConfig(this.config);
+    if (!channel && !customCommand) {
+      throw new Error("bounty-cli event source requires 'channel' (or 'command') in config");
+    }
+    const command = customCommand || buildDefaultCommand(profile, channel);
+    this.child = spawn(`exec ${command}`, [], {
+      shell: true,
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true
+    });
+    let stdoutBuffer = "";
+    let stderrBuffer = "";
+    this.child.stdout?.on("data", (data) => {
+      const str = data.toString();
+      stdoutBuffer += str;
+      this.processStdout(stdoutBuffer, channel ?? "");
+      stdoutBuffer = "";
+    });
+    this.child.stderr?.on("data", (data) => {
+      const output = data.toString();
+      stderrBuffer += output;
+      this.processStderr(stderrBuffer);
+      stderrBuffer = "";
+    });
+    this.child.on("exit", (code, signal) => {
+      if (code !== 0 && signal !== "SIGINT" && signal !== "SIGTERM") {
+        this.setStatus("error");
+      } else {
+        this.setStatus("stopped");
+      }
+    });
+    this.child.on("error", (err) => {
+      console.error(`[bounty-cli] spawn error: ${err.message}`);
+      this.setStatus("error");
+    });
+    this.setStatus("running");
+  }
+  processStdout(buffer, fallbackChannel) {
+    const lines = buffer.split(`
+`);
+    const tail = lines.pop() ?? "";
+    this.buffer = tail;
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed)
+        continue;
+      this.handleEventLine(trimmed, fallbackChannel);
+    }
+  }
+  processStderr(buffer) {
+    const lines = buffer.split(`
+`);
+    const tail = lines.pop() ?? "";
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed)
+        continue;
+      if (trimmed.startsWith("{") && trimmed.includes("event_id")) {
+        this.handleEventLine(trimmed, readBountyCliConfig(this.config).channel ?? "");
+      }
+    }
+    if (tail.trim().length > 0) {
+      this.buffer = tail;
+    } else {
+      this.buffer = "";
+    }
+  }
+  handleEventLine(line, fallbackChannel) {
+    let raw;
+    try {
+      raw = JSON.parse(line);
+    } catch {
+      console.error(`[bounty-cli] failed to parse event line: ${line.slice(0, 200)}`);
+      return;
+    }
+    const { metadata, replyChannel } = translateEvent(raw, fallbackChannel);
+    const event = {
+      metadata,
+      rawEvent: raw,
+      replyChannel,
+      recommendedAction: buildBountyCliRecommendedAction({
+        profile: readBountyCliConfig(this.config).profile,
+        channelName: String(metadata.channelName ?? fallbackChannel)
+      })
+    };
+    if (this.eventHandler) {
+      try {
+        this.eventHandler(event);
+      } catch (err) {
+        console.error(`[bounty-cli] event handler threw: ${err}`);
+      }
+    }
+  }
+  async stop() {
+    if (this.status === "stopped" || this.status === "created")
+      return;
+    if (this.child && !this.child.killed) {
+      this.child.kill("SIGINT");
+      await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+          if (this.child && !this.child.killed) {
+            this.child.kill("SIGKILL");
+          }
+          resolve();
+        }, 3000);
+        if (this.child) {
+          this.child.on("exit", () => {
+            clearTimeout(timer);
+            resolve();
+          });
+        } else {
+          clearTimeout(timer);
+          resolve();
+        }
+      });
+    }
+    this.setStatus("stopped");
+  }
+}
+var bountyCliHandler = {
+  type: "bounty-cli",
+  validateConfig(config) {
+    const errors = [];
+    if (!config.id)
+      errors.push("EventSource ID is required");
+    if (!config.name)
+      errors.push("EventSource name is required");
+    const { channel, customCommand } = readBountyCliConfig(config);
+    if (!channel && !customCommand) {
+      errors.push("Bounty CLI 'channel' (top-level channel or options.channel) is required");
+    }
+    return errors;
+  },
+  createInstance(config) {
+    return new BountyCliInstance(config);
+  }
+};
+
+// src/env/event-source/wecom-cli-handler.ts
+import { spawn as spawn2 } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { delimiter, isAbsolute, join as join2 } from "path";
+
+// src/env/event-source/wecom-ws-bridge.ts
+var WECOM_WS_URL = "wss://openws.work.weixin.qq.com";
+var WECOM_HEARTBEAT_INTERVAL_MS = 30000;
+var WECOM_RECONNECT_BASE_DELAY_MS = 1000;
+var WECOM_RECONNECT_MAX_DELAY_MS = 60000;
+var WECOM_MAX_RECONNECT_ATTEMPTS = 10;
+var WECOM_MAX_AUTH_FAILURE_ATTEMPTS = 5;
+function randomString() {
+  return Math.random().toString(36).slice(2, 10);
+}
+function generateWecomReqId(prefix) {
+  return `${prefix}_${Date.now()}_${randomString()}`;
+}
+function buildWecomAuthFrame(botId, secret) {
+  return {
+    cmd: "aibot_subscribe",
+    headers: { req_id: generateWecomReqId("aibot_subscribe") },
+    body: { bot_id: botId, secret }
+  };
+}
+function buildWecomHeartbeatFrame() {
+  return {
+    cmd: "ping",
+    headers: { req_id: generateWecomReqId("ping") }
+  };
+}
+function buildWecomRespondFrame(reqId, body) {
+  const id = reqId.trim();
+  if (!id) {
+    throw new Error("buildWecomRespondFrame: req_id is required (reply must reference the original message frame)");
+  }
+  return {
+    cmd: "aibot_respond_msg",
+    headers: { req_id: id },
+    body
+  };
+}
+function isWecomAuthResponse(frame) {
+  if (frame.cmd)
+    return false;
+  const reqId = frame.headers?.req_id ?? "";
+  return reqId.startsWith("aibot_subscribe_");
+}
+function isWecomHeartbeatResponse(frame) {
+  if (frame.cmd)
+    return false;
+  const reqId = frame.headers?.req_id ?? "";
+  return reqId.startsWith("ping_");
+}
+function isWecomDisconnectedEvent(frame) {
+  if (!frame || typeof frame !== "object")
+    return false;
+  const f = frame;
+  if (f.cmd !== "aibot_event_callback")
+    return false;
+  return f.body?.event?.eventtype === "disconnected_event";
+}
+function sanitizeWecomFrame(frame) {
+  const clean = { ...frame };
+  if ("secret" in clean)
+    delete clean.secret;
+  if (clean.body && typeof clean.body === "object") {
+    clean.body = { ...clean.body };
+    if ("secret" in clean.body)
+      delete clean.body.secret;
+  }
+  return clean;
+}
+function backoffDelay(attempt, base, max) {
+  return Math.min(base * Math.pow(2, attempt - 1), max);
+}
+
+class WecomWsBridge {
+  opts;
+  botId;
+  secret;
+  wsFactory;
+  wsUrl;
+  ws;
+  heartbeatTimer;
+  reconnectTimer;
+  reconnectAttempts = 0;
+  authFailureAttempts = 0;
+  manualClose = false;
+  lastCloseWasAuthFailure = false;
+  stopped = false;
+  onMessageCb;
+  onAuthenticatedCb;
+  onReconnectingCb;
+  onErrorCb;
+  constructor(opts) {
+    this.opts = {
+      heartbeatIntervalMs: opts.heartbeatIntervalMs ?? WECOM_HEARTBEAT_INTERVAL_MS,
+      reconnectBaseDelayMs: opts.reconnectBaseDelayMs ?? WECOM_RECONNECT_BASE_DELAY_MS,
+      reconnectMaxDelayMs: opts.reconnectMaxDelayMs ?? WECOM_RECONNECT_MAX_DELAY_MS,
+      maxReconnectAttempts: opts.maxReconnectAttempts ?? WECOM_MAX_RECONNECT_ATTEMPTS,
+      maxAuthFailureAttempts: opts.maxAuthFailureAttempts ?? WECOM_MAX_AUTH_FAILURE_ATTEMPTS
+    };
+    this.botId = opts.botId;
+    this.secret = opts.secret;
+    this.wsUrl = opts.wsUrl ?? WECOM_WS_URL;
+    this.wsFactory = opts.wsFactory ?? ((url) => {
+      throw new Error("wsFactory is required in production (inject WebSocket from 'ws')");
+    });
+  }
+  onMessage(cb) {
+    this.onMessageCb = cb;
+  }
+  onAuthenticated(cb) {
+    this.onAuthenticatedCb = cb;
+  }
+  onReconnecting(cb) {
+    this.onReconnectingCb = cb;
+  }
+  onError(cb) {
+    this.onErrorCb = cb;
+  }
+  connect() {
+    if (this.stopped)
+      return;
+    const ws = this.wsFactory(this.wsUrl);
+    this.ws = ws;
+    ws.on("open", () => {
+      this.lastCloseWasAuthFailure = false;
+      this.sendFrame(buildWecomAuthFrame(this.optsBotId(), this.optsSecret()));
+    });
+    ws.on("message", (data) => {
+      try {
+        const raw = String(data).replace(/[\x00-\x08\x0B-\x0D\x0E-\x1F]/g, "");
+        const frame = JSON.parse(raw);
+        this.handleFrame(frame);
+      } catch {}
+    });
+    ws.on("close", () => {
+      this.stopHeartbeat();
+      if (this.manualClose || this.stopped)
+        return;
+      this.scheduleReconnect();
+    });
+    ws.on("error", (err) => {
+      this.onErrorCb?.(err);
+    });
+  }
+  optsBotId() {
+    return this.botId;
+  }
+  optsSecret() {
+    return this.secret;
+  }
+  handleFrame(frame) {
+    if (isWecomAuthResponse(frame)) {
+      if ((frame.errcode ?? 0) !== 0) {
+        this.lastCloseWasAuthFailure = true;
+        this.onErrorCb?.(new Error(`wecom auth failed: ${frame.errmsg ?? "?"} (code=${frame.errcode})`));
+        this.ws?.terminate();
+        return;
+      }
+      this.reconnectAttempts = 0;
+      this.authFailureAttempts = 0;
+      this.startHeartbeat();
+      this.onAuthenticatedCb?.();
+      return;
+    }
+    if (isWecomHeartbeatResponse(frame))
+      return;
+    if (isWecomDisconnectedEvent(frame)) {
+      this.lastCloseWasAuthFailure = false;
+      this.onErrorCb?.(new Error("wecom disconnected_event: server kicked this connection " + "(bot allows only 1 long connection) — reconnecting"));
+      this.stopHeartbeat();
+      const stale = this.ws;
+      this.ws = undefined;
+      try {
+        stale?.close?.();
+      } catch {}
+      this.scheduleReconnect();
+      return;
+    }
+    this.onMessageCb?.(sanitizeWecomFrame(frame));
+  }
+  sendFrame(frame) {
+    try {
+      this.ws?.send(JSON.stringify(frame));
+    } catch (err) {
+      this.onErrorCb?.(err);
+    }
+  }
+  respond(reqId, body) {
+    if (this.stopped || this.manualClose) {
+      return new Error("wecom bridge stopped, cannot respond");
+    }
+    if (!this.ws || this.ws.readyState !== 1) {
+      return new Error("wecom bridge not connected, cannot respond");
+    }
+    try {
+      let frame;
+      try {
+        frame = buildWecomRespondFrame(reqId, body);
+      } catch (err) {
+        return err;
+      }
+      this.ws.send(JSON.stringify(frame));
+      return;
+    } catch (err) {
+      return err instanceof Error ? err : new Error(String(err));
+    }
+  }
+  sendCmd(cmd, body) {
+    if (this.stopped || this.manualClose) {
+      return new Error("wecom bridge stopped, cannot send");
+    }
+    if (!this.ws || this.ws.readyState !== 1) {
+      return new Error("wecom bridge not connected, cannot send");
+    }
+    try {
+      this.ws.send(JSON.stringify({
+        cmd,
+        headers: { req_id: generateWecomReqId(cmd) },
+        body
+      }));
+      return;
+    } catch (err) {
+      return err instanceof Error ? err : new Error(String(err));
+    }
+  }
+  sendFrameWithReqId(frame) {
+    if (this.stopped || this.manualClose) {
+      return new Error("wecom bridge stopped, cannot send");
+    }
+    if (!this.ws || this.ws.readyState !== 1) {
+      return new Error("wecom bridge not connected, cannot send");
+    }
+    if (!frame.headers?.req_id?.trim()) {
+      return new Error("sendFrameWithReqId: req_id is required (must reference the original frame)");
+    }
+    try {
+      this.ws.send(JSON.stringify(frame));
+      return;
+    } catch (err) {
+      return err instanceof Error ? err : new Error(String(err));
+    }
+  }
+  startHeartbeat() {
+    this.stopHeartbeat();
+    this.heartbeatTimer = setInterval(() => {
+      this.sendFrame(buildWecomHeartbeatFrame());
+    }, this.opts.heartbeatIntervalMs);
+  }
+  stopHeartbeat() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = undefined;
+    }
+  }
+  scheduleReconnect() {
+    if (this.manualClose || this.stopped)
+      return;
+    if (this.reconnectTimer)
+      return;
+    const isAuthFailure = this.lastCloseWasAuthFailure;
+    if (isAuthFailure) {
+      if (this.authFailureAttempts >= this.opts.maxAuthFailureAttempts) {
+        this.onErrorCb?.(new Error(`wecom auth failed ${this.authFailureAttempts} times, giving up`));
+        return;
+      }
+      this.authFailureAttempts++;
+    } else {
+      if (this.reconnectAttempts >= this.opts.maxReconnectAttempts) {
+        this.onErrorCb?.(new Error(`wecom reconnect exhausted (${this.reconnectAttempts} attempts)`));
+        return;
+      }
+      this.reconnectAttempts++;
+    }
+    const attempt = isAuthFailure ? this.authFailureAttempts : this.reconnectAttempts;
+    const delay = backoffDelay(attempt, this.opts.reconnectBaseDelayMs, this.opts.reconnectMaxDelayMs);
+    this.onReconnectingCb?.(attempt);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = undefined;
+      if (this.manualClose || this.stopped)
+        return;
+      this.connect();
+    }, delay);
+  }
+  stop() {
+    this.stopped = true;
+    this.manualClose = true;
+    this.stopHeartbeat();
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = undefined;
+    }
+    try {
+      this.ws?.close();
+    } catch {}
+    this.ws = undefined;
+  }
+}
+
+// src/env/event-source/wecom-card-action-handler.ts
+init_logger();
+var logger2 = createLogger("wecom:card-action");
+var cardActionInflight2 = new Map;
+var ROY_TASK_PREFIX = "roy-task-";
+function parseRoyTaskId(cardTaskId) {
+  if (!cardTaskId.startsWith(ROY_TASK_PREFIX))
+    return null;
+  const rest = cardTaskId.slice(ROY_TASK_PREFIX.length);
+  const m = rest.match(/^(\d+)/);
+  if (!m)
+    return null;
+  const n = Number(m[1]);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+function extractWecomCardAction(frame) {
+  if (!frame || typeof frame !== "object")
+    return null;
+  const f = frame;
+  if (f.cmd !== "aibot_event_callback")
+    return null;
+  const body = f.body;
+  if (!body || typeof body !== "object")
+    return null;
+  const event = body.event;
+  if (event?.eventtype !== "template_card_event")
+    return null;
+  const tce = event.template_card_event;
+  if (!tce)
+    return null;
+  const cardTaskId = String(tce.task_id ?? "");
+  const from = body.from ?? {};
+  return {
+    eventKey: String(tce.event_key ?? ""),
+    cardTaskId,
+    taskId: parseRoyTaskId(cardTaskId),
+    userId: from.userid ?? "",
+    reqId: f.headers?.req_id ?? ""
+  };
+}
+var ACTION_CARD_LABEL = {
+  view: {
+    statusLabel: "\uD83D\uDC40 已查看",
+    note: "用户已查看任务"
+  },
+  mark_done: {
+    statusLabel: "\uD83C\uDF89 已完成",
+    note: "用户已确认任务完成"
+  },
+  reopen: {
+    statusLabel: "\uD83D\uDD04 进行中",
+    note: "用户已重新打开任务"
+  }
+};
+async function handleWecomCardAction(frame, ports) {
+  const action = extractWecomCardAction(frame);
+  if (!action) {
+    return { ok: false, error: "not a template_card_event frame" };
+  }
+  const inflightKey = `${action.cardTaskId}:${action.eventKey}`;
+  const inflight = cardActionInflight2.get(inflightKey);
+  if (inflight) {
+    logger2.warn(`handleWecomCardAction: ${inflightKey} 已有同操作在处理中` + `（疑似用户重复点击），本次忽略。`);
+    return { ok: false, error: "同操作处理中，已忽略重复点击" };
+  }
+  const job = doHandle(action, ports).finally(() => {
+    cardActionInflight2.delete(inflightKey);
+  });
+  cardActionInflight2.set(inflightKey, job);
+  return job;
+}
+async function doHandle(action, ports) {
+  let actionType;
+  if (action.eventKey === WecomCardActionKey.MARK_DONE) {
+    actionType = "mark_done";
+  } else if (action.eventKey === WecomCardActionKey.REOPEN) {
+    actionType = "reopen";
+  } else if (action.eventKey === WecomCardActionKey.VIEW) {
+    actionType = "view";
+  } else {
+    return { ok: false, error: `unknown event_key: ${action.eventKey}` };
+  }
+  if (action.taskId === null && actionType !== "view") {
+    return {
+      ok: false,
+      error: `cannot parse roy task id from card task_id: ${action.cardTaskId}`
+    };
+  }
+  let opError;
+  try {
+    if (actionType === "mark_done" && action.taskId !== null) {
+      await ports.markTaskDone(action.taskId);
+    } else if (actionType === "reopen" && action.taskId !== null) {
+      await ports.reopenTask(action.taskId);
+    }
+  } catch (err) {
+    opError = err instanceof Error ? err.message : String(err);
+    logger2.error(`handleWecomCardAction: task op failed for #${action.taskId}: ${opError}`);
+  }
+  const label = ACTION_CARD_LABEL[actionType];
+  const note = actionType === "view" ? label.note : opError ? `${label.note}（操作失败：${opError}）` : label.note;
+  let timeline;
+  if ((actionType === "view" || actionType === "reopen") && action.taskId !== null) {
+    try {
+      timeline = ports.loadTimeline?.(action.taskId) ?? [];
+      if (timeline.length === 0) {
+        logger2.warn(`handleWecomCardAction: task #${action.taskId} 无时间线记录，` + `降级为简单按钮态更新`);
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      logger2.warn(`handleWecomCardAction: loadTimeline failed for ` + `task #${action.taskId}: ${msg}（降级为简单按钮态更新）`);
+      timeline = [];
+    }
+  }
+  let taskExtra;
+  try {
+    const t = action.taskId !== null ? await ports.loadTaskTitle?.(action.taskId) : undefined;
+    if (t && (t.title || t.number !== undefined)) {
+      taskExtra = { taskNumber: t.number, taskTitle: t.title };
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    logger2.warn(`handleWecomCardAction: loadTaskTitle failed for ` + `task #${action.taskId}: ${msg}（降级为无标题更新）`);
+  }
+  try {
+    await ports.updateCard(action.reqId, action.cardTaskId, label.statusLabel, note, timeline, actionType, taskExtra);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    logger2.error(`handleWecomCardAction: updateCard failed: ${msg}`);
+    return {
+      ok: false,
+      action: actionType,
+      error: `card update failed: ${msg}`
+    };
+  }
+  if (opError) {
+    return { ok: false, action: actionType, error: opError };
+  }
+  logger2.info(`handleWecomCardAction: task #${action.taskId} → ${actionType} ` + `(by ${action.userId})`);
+  return { ok: true, action: actionType };
+}
+function buildWecomCardUpdateBody(input) {
+  const refreshable = input.action === "view" || input.action === "reopen";
+  const frame = buildWecomCardUpdateFrame({
+    reqId: "placeholder",
+    taskId: input.cardTaskId,
+    statusLabel: input.statusLabel,
+    note: input.note,
+    timeline: input.timeline,
+    taskTitle: input.taskTitle,
+    taskNumber: input.taskNumber,
+    buttonOverrides: refreshable ? [{ text: "刷新详情", key: WecomCardActionKey.VIEW, style: 1 }] : [{ text: "已处理", key: "task_done_ack", style: 4 }]
+  });
+  return { cmd: frame.cmd, body: frame.body };
+}
+
+// src/env/event-source/wecom-media.ts
+import { createDecipheriv } from "crypto";
+import { mkdirSync, writeFileSync } from "fs";
+import { basename, join, resolve } from "path";
+var WECOM_MEDIA_DIR = "/tmp/wecom-media";
+var WECOM_MEDIA_BLOCK_SIZE = 32;
+var mediaDirOverride;
+function getWecomMediaDir() {
+  return mediaDirOverride ?? WECOM_MEDIA_DIR;
+}
+function decryptWecomMedia(encrypted, aesKeyBase64) {
+  if (!encrypted || encrypted.length === 0) {
+    throw new Error("decryptWecomMedia: encrypted buffer is empty");
+  }
+  if (!aesKeyBase64 || typeof aesKeyBase64 !== "string") {
+    throw new Error("decryptWecomMedia: aesKey must be a non-empty string");
+  }
+  const key = Buffer.from(aesKeyBase64, "base64");
+  if (key.length !== 32) {
+    throw new Error(`decryptWecomMedia: aesKey must decode to 32 bytes (got ${key.length})`);
+  }
+  const iv = key.subarray(0, 16);
+  const decipher = createDecipheriv("aes-256-cbc", key, iv);
+  decipher.setAutoPadding(false);
+  const decrypted = Buffer.concat([
+    decipher.update(encrypted),
+    decipher.final()
+  ]);
+  const padLen = decrypted[decrypted.length - 1];
+  if (padLen < 1 || padLen > WECOM_MEDIA_BLOCK_SIZE || padLen > decrypted.length) {
+    throw new Error(`decryptWecomMedia: invalid PKCS#7 padding value: ${padLen}`);
+  }
+  for (let i = decrypted.length - padLen;i < decrypted.length; i++) {
+    if (decrypted[i] !== padLen) {
+      throw new Error("decryptWecomMedia: invalid PKCS#7 padding (bytes mismatch)");
+    }
+  }
+  return decrypted.subarray(0, decrypted.length - padLen);
+}
+function refFromField(kind, field) {
+  if (!field || typeof field !== "object")
+    return null;
+  const url = typeof field.url === "string" ? field.url : undefined;
+  const aeskey = typeof field.aeskey === "string" ? field.aeskey : undefined;
+  if (!url || !aeskey)
+    return null;
+  return {
+    kind,
+    url,
+    aeskey,
+    filename: typeof field.filename === "string" ? field.filename : undefined
+  };
+}
+function extractWecomMediaRefs(body) {
+  const refs = [];
+  const msgType = String(body.msgtype ?? "");
+  const single = refFromField(msgType, body[msgType]);
+  if (single)
+    refs.push(single);
+  if (msgType === "mixed") {
+    const mixed = body.mixed;
+    for (const item of mixed?.msg_item ?? []) {
+      if (!item || typeof item !== "object")
+        continue;
+      const it = item;
+      const itemType = String(it.msgtype ?? "");
+      const ref = refFromField(itemType, it[itemType]);
+      if (ref)
+        refs.push(ref);
+    }
+  }
+  return refs;
+}
+async function defaultWecomMediaFetcher(url) {
+  const resp = await fetch(url);
+  const status = resp.status;
+  if (!resp.ok) {
+    return { ok: false, status, buffer: Buffer.alloc(0) };
+  }
+  const ab = await resp.arrayBuffer();
+  const disposition = resp.headers.get("content-disposition") ?? "";
+  let filename;
+  const utf8Match = disposition.match(/filename\*=UTF-8''([^;\s]+)/i);
+  if (utf8Match) {
+    filename = decodeURIComponent(utf8Match[1]);
+  } else {
+    const m = disposition.match(/filename="?([^";\s]+)"?/i);
+    if (m)
+      filename = decodeURIComponent(m[1]);
+  }
+  return {
+    ok: true,
+    status,
+    buffer: Buffer.from(ab),
+    filename
+  };
+}
+async function fetchAndSaveWecomMedia(input) {
+  const fetcher = input.fetcher ?? defaultWecomMediaFetcher;
+  const result = await fetcher(input.url);
+  if (!result.ok) {
+    throw new Error("fetchAndSaveWecomMedia: download failed (HTTP " + result.status + ")" + " for msgid=" + input.msgid + " url=" + input.url.slice(0, 120));
+  }
+  const decrypted = decryptWecomMedia(result.buffer, input.aeskey);
+  return saveWecomMediaFile({
+    msgid: input.msgid,
+    filename: input.filename ?? result.filename,
+    buffer: decrypted,
+    chatId: input.chatId
+  });
+}
+async function saveWecomMediaFile(input) {
+  const root = getWecomMediaDir();
+  mkdirSync(root, { recursive: true, mode: 448 });
+  const safeMsgid = input.msgid.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 80);
+  const safeName = input.filename ? basename(input.filename) : `${safeMsgid}.bin`;
+  const safeChatId = input.chatId ? input.chatId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 120) : undefined;
+  const dir = safeChatId ? join(resolve(root), safeChatId) : resolve(root);
+  if (safeChatId)
+    mkdirSync(dir, { recursive: true, mode: 448 });
+  const filePath = join(dir, `${safeMsgid}_${safeName}`);
+  writeFileSync(filePath, input.buffer);
+  return filePath;
+}
+
+// src/env/event-source/wecom-cli-handler.ts
+var WECOM_CLI_ES_TYPE = "wecom-cli";
+var WECOM_CHAT_ID_PREFIX = "wecom:";
+var WECOM_WS_DEFAULT_URL = "wss://openws.work.weixin.qq.com";
+function readWecomCliConfig(config) {
+  const top = config;
+  const opts = config.options ?? {};
+  return {
+    botId: top.botId || opts.botId || undefined,
+    secret: top.secret || opts.secret || undefined,
+    command: top.command || opts.command || undefined,
+    webhook: top.webhook || opts.webhook || undefined,
+    credentialsPath: top.credentialsPath || opts.credentialsPath || undefined
+  };
+}
+var WECOM_CREDENTIALS_DEFAULT_PATH = join2(process.env.HOME || "/tmp", ".roy-agent", "wecom-credentials.json");
+function readWecomCredentialsFile(path) {
+  try {
+    const raw = readFileSync(path, "utf-8");
+    const parsed = JSON.parse(raw);
+    const agentId = typeof parsed.agent_id === "string" ? parsed.agent_id : undefined;
+    const botId = typeof parsed.bot_id === "string" ? parsed.bot_id : undefined;
+    const secret = typeof parsed.secret === "string" ? parsed.secret : undefined;
+    const id = botId || agentId;
+    if (!id || !secret)
+      return null;
+    return { botId: id, secret };
+  } catch {
+    return null;
+  }
+}
+function resolveWecomCredentials(config, credentialsPath = WECOM_CREDENTIALS_DEFAULT_PATH) {
+  const cliConfig = readWecomCliConfig(config);
+  if (cliConfig.botId && cliConfig.secret) {
+    return { botId: cliConfig.botId, secret: cliConfig.secret };
+  }
+  const fromFile = readWecomCredentialsFile(cliConfig.credentialsPath ?? credentialsPath);
+  if (fromFile)
+    return fromFile;
+  return;
+}
+function buildWecomReplyChannel(input) {
+  const chatType = input.chatType === "group" ? "group" : "single";
+  const userId = input.userId?.trim() || undefined;
+  const rawChatId = input.chatId?.trim() || undefined;
+  const chatId = rawChatId ?? userId ?? `${WECOM_CHAT_ID_PREFIX}unknown`;
+  return {
+    type: WECOM_CLI_ES_TYPE,
+    chatId,
+    messageId: input.messageId?.trim() || undefined,
+    params: {
+      chatType,
+      userId,
+      wecomChatId: rawChatId,
+      wecomUserId: userId,
+      ...input.sourceId ? { sourceId: input.sourceId } : {},
+      ...input.reqId ? { reqId: input.reqId } : {}
+    }
+  };
+}
+function hasWecomMediaRef(body, kind) {
+  const field = body[kind];
+  return !!field && typeof field === "object" && typeof field.url === "string" && typeof field.aeskey === "string";
+}
+function extractText(body) {
+  const msgType = String(body.msgtype ?? "");
+  switch (msgType) {
+    case "text": {
+      const t = body.text;
+      return t?.content ?? "";
+    }
+    case "mixed": {
+      const mixed = body.mixed;
+      const items = mixed?.msg_item ?? [];
+      const parts = [];
+      for (const it of items) {
+        const item = it;
+        if (item?.msgtype === "text" && item.text?.content) {
+          parts.push(item.text.content);
+        } else if (item?.msgtype) {
+          parts.push(`[${item.msgtype}]`);
+        }
+      }
+      return parts.join(`
+`);
+    }
+    case "image":
+      return hasWecomMediaRef(body, "image") ? "[image](media:downloading)" : "[image]";
+    case "voice":
+      return hasWecomMediaRef(body, "voice") ? "[voice](media:downloading)" : "[voice]";
+    case "file":
+      return hasWecomMediaRef(body, "file") ? "[file](media:downloading)" : "[file]";
+    case "video":
+      return hasWecomMediaRef(body, "video") ? "[video](media:downloading)" : "[video]";
+    default:
+      return msgType ? `[${msgType}]` : "";
+  }
+}
+function extractWecomQuotedText(body) {
+  const quote = body.quote;
+  if (!quote || typeof quote !== "object")
+    return;
+  const msgType = String(quote.msgtype ?? "");
+  if (msgType === "text") {
+    const content = quote.text?.content;
+    return typeof content === "string" && content ? content : undefined;
+  }
+  return msgType ? `[${msgType}]` : undefined;
+}
+function buildWecomUserMessage(text, replyContext) {
+  const quotedText = replyContext?.quotedText;
+  if (!quotedText)
+    return text;
+  return `${text}
+
+[引用消息] ${quotedText}`;
+}
+function parseWecomFrame(raw) {
+  if (!raw || typeof raw !== "object")
+    return null;
+  const frame = raw;
+  const cmd = String(frame.cmd ?? "");
+  const body = frame.body;
+  if (!body || typeof body !== "object")
+    return null;
+  const msgid = typeof body.msgid === "string" ? body.msgid : undefined;
+  const isMsg = cmd === "aibot_msg_callback";
+  const isEvent = cmd === "aibot_event_callback";
+  if (!isMsg && !isEvent)
+    return null;
+  if (isMsg && !msgid)
+    return null;
+  const msgType = String(body.msgtype ?? (isEvent ? "event" : ""));
+  const from = body.from ?? {};
+  const senderId = from.userid ?? "";
+  const chattype = typeof body.chattype === "string" ? body.chattype : undefined;
+  const rawChatId = typeof body.chatid === "string" ? body.chatid : undefined;
+  let eventType;
+  let text;
+  if (isEvent) {
+    const event = body.event ?? {};
+    const eventTypeName = event.eventtype ?? "unknown";
+    eventType = `wecom.event.${eventTypeName}`;
+    text = `[wecom-event:${eventTypeName}]`;
+  } else {
+    eventType = "wecom.message.receive";
+    text = extractText(body);
+  }
+  const metadata = {
+    sourceType: WECOM_CLI_ES_TYPE,
+    eventType,
+    eventId: msgid,
+    appId: typeof body.aibotid === "string" ? body.aibotid : undefined,
+    chatId: rawChatId ?? senderId ?? undefined,
+    chatType: chattype,
+    messageId: msgid,
+    messageType: msgType,
+    senderId,
+    sourceTime: typeof body.create_time === "number" ? new Date(body.create_time * 1000).toISOString() : undefined,
+    payload: body
+  };
+  const quotedText = extractWecomQuotedText(body);
+  if (quotedText) {
+    metadata.replyContext = { quotedText };
+  }
+  return {
+    metadata,
+    text,
+    reqId: frame.headers?.req_id
+  };
+}
+var WECOM_CHANNEL_PROMPT_SECTION_TITLE = "⭐ 企业微信回复规范（system prompt 注入版）";
+function buildWecomChannelSystemPrompt(opts) {
+  const botLine = opts.botId ? `本渠道智能机器人 BotID：${opts.botId}。` : `本渠道未配置 BotID（使用事件回调里的 aibotid）。`;
+  return [
+    `# ${WECOM_CHANNEL_PROMPT_SECTION_TITLE}`,
+    ``,
+    `本节是企业微信渠道的**回复规范**（静态规则，随 system prompt 注入）。`,
+    `每条企微事件的 \`recommendedAction\` 只带动态定位（chatId / messageId），`,
+    `所有回复规则都在本节 —— replyChannel 给出的 chatId 是本轮唯一权威定位。`,
+    botLine,
+    ``,
+    `## 回复命令（唯一出站通道）`,
+    `用 \`wecom_respond\` 工具回复。工具内部**主路径是官方 CLI**`,
+    `（\`wecom-cli message aibot send --msg-type markdown\`，已扫码授权），`,
+    `CLI 失败时自动降级为 WS 长连接回帧（aibot_respond_msg）。`,
+    `- \`content\`：**必填**，回复正文（markdown 格式）。`,
+    `- \`chat_id\`：可选；缺省自动取本事件的 chatId/senderId（单聊=对方 userid，群聊=chatid）。`,
+    `- \`req_id\`：可选；缺省取 metadata.reqId（仅 WS fallback 用）。`,
+    `- ⚠️ 不要自己拼 \`wecom-cli\` 命令 —— 统一走 \`wecom_respond\`（chat_id 需要内部解析成真实 userid，手工拼会报 40073）。`,
+    `- ⚠️ CLI 没有 text 类型；markdown 上限 20480 UTF-8 字节，超长分段压缩，不要静默截断。`,
+    `- 工具返回 success=false 时如实告知用户，不要假装已发送。`,
+    ``,
+    `## 出站纪律`,
+    `- ❌ 不要用 \`curl\` 直连 \`qyapi.weixin.qq.com\`（绕过 CLI 丢鉴权与错误规范）。`,
+    `- ❌ 不要用 \`lark-cli\` 的任何 flag（--profile / --msg-type / --as bot 都不适用于企微）。`,
+    `- ❌ 整次回复只发**一条**消息：先想清楚再发，不要拆段循环 send 刷屏。`,
+    ``,
+    `## 文档交付规范`,
+    `- 文档类生成（报告 / 代码 / 长文）：企微消息里给**结论 + 关键内容摘要**，`,
+    `  完整文档内容直接放进 markdown 正文（企微支持 markdown 渲染），`,
+    `  **不要只给本地文件路径** —— 企微用户无法访问 roy-agent 所在机器的文件系统。`,
+    `- **调研文档 / docs / ppt 等文档类产出必须上传到企微文档，链接作为交付物**：`,
+    `  - 在线文档：\`wecom-cli doc create --doc-name <标题> --doc-type doc --content-type text --file-path <本地md>\``,
+    `    （或 --content 传纯文本；ppt 用 --doc-type ppt），取返回里的文档链接`,
+    `  - 微盘文件：\`wecom-cli disk files upload --file-path <本地文件>\`（默认传到我的空间），取返回里的文件链接`,
+    `  - 本地路径只作中转（生成 → 上传企微文档 → 回复里贴链接），**不落本地路径**交付`,
+    ``,
+    `## 图片/文件消息处理（Task #5199）`,
+    `- 用户发图片时，消息正文是 \`[image](media:downloading)\` 占位；`,
+    `  媒体文件已自动下载解密落盘，本地路径在事件 metadata.mediaFiles`,
+    `  （数组，如 \`/tmp/wecom-media/<chatId>/<msgid>_photo.png\`）。`,
+    `- ⚠️ **只用 metadata.mediaFiles 里列出的路径**（Task #5313）——`,
+    `  禁止 \`ls\`/\`find\` 扫媒体目录：同目录下的历史文件属于别的消息，`,
+    `  扫目录会把它们误当本条消息的附件。`,
+    `- **看图**：用 \`understand_image\` 工具，\`image_source\` 传`,
+    `  metadata.mediaFiles 里的本地路径，\`prompt\` 写想了解什么。`,
+    `- mediaFiles 缺失（下载失败/URL 过期）时如实告知用户，不要编造图片内容。`,
+    `- ⚠️ 截图内容边界（Task #5317）：截图/图片里可能内嵌`,
+    `  **其他群聊或其他会话的聊天记录**（如聊天记录截图、转发图）。`,
+    `  截图里的聊天记录**不是本群的对话上下文**——分析图片时如需`,
+    `  提及其中内容，必须明确标注「截图里包含的内容」，`,
+    `  禁止把截图内的聊天记录当作本群刚发生的消息来转述或回应。`,
+    ``,
+    `## 引用消息上下文 replyContext`,
+    `本条消息引用了其他消息时，user message 末尾会带 \`[引用消息] <原文>\` 行；`,
+    `同时 recommendedAction.replyContext.quotedText 也有同一份内容（非文本引用为 [image] 等占位）。`,
+    `- 回复时优先围绕被引用内容作答，不要忽略引用语境。`
+  ].join(`
+`);
+}
+function buildWecomNotifyPrompt(input) {
+  const isGroup = input.chatType === "group";
+  const target = isGroup ? `群聊 chat_id = "${input.chatId ?? "<chatid>"}"` : `单聊 chat_id = "${input.userId ?? "<userid>"}"（企微单聊用对方 userid 作 chat_id）`;
+  return [
+    `### ① 用 wecom_respond 工具回消息
+` + `本事件来自企业微信（WeCom）。回复用户请用 \`wecom_respond\` 工具（主路径 = 官方 wecom-cli 已授权，CLI 失败自动降级 WS 回帧），目标：${target}。
+` + `不要使用 lark-cli —— 那是飞书的通道，参数完全不同。`,
+    `### ② 具体参数
+` + `调用 \`wecom_respond\` 工具：
+` + `- \`content\`：**必填**，回复正文（markdown）
+` + `- \`chat_id\`：可选；缺省自动取本事件 chatId / senderId（单聊 = 对方 userid）
+` + `- \`req_id\`：可选；缺省取 metadata.reqId（仅 WS fallback 用）
+` + `- ⚠️ 不要自己拼 \`wecom-cli\` 命令 —— chat_id 需内部解析成真实 userid，手拼会报 40073`,
+    `### ③ 禁止的做法
+` + `- ❌ 不要用 \`curl\` 直连 \`qyapi.weixin.qq.com\` —— 绕过官方通道会丢鉴权与错误规范
+` + `- ❌ 不要用 \`lark-cli\` 的任何 flag（--profile / --msg-type post / --content）
+` + `- ❌ 不要自己编 chat_id / req_id —— 用工具默认值即可
+` + `- ❌ 不要在失败时假装已发送`,
+    `### ④ 怎么判断成功
+` + `- 工具返回 \`success: true\` = 回帧已发出
+` + `- 工具返回 \`success: false\` = 发送失败（读 \`error\` 字段），如实告知用户失败原因`
+  ].join(`
+
+`);
+}
+function resolveWecomBinary(binName = "wecom-cli") {
+  if (isAbsolute(binName)) {
+    return existsSync(binName) ? { found: true, path: binName } : { found: false };
+  }
+  if (binName.includes("/")) {
+    return existsSync(binName) ? { found: true, path: binName } : { found: false };
+  }
+  const pathEnv = process.env.PATH ?? "";
+  const candidates = [binName, `${binName}.exe`, `${binName}.cmd`, `${binName}.bat`];
+  for (const dir of pathEnv.split(delimiter)) {
+    if (!dir)
+      continue;
+    for (const candidate of candidates) {
+      const full = join2(dir, candidate);
+      if (existsSync(full))
+        return { found: true, path: full };
+    }
+  }
+  return { found: false };
+}
+function probeCommandBinary(command) {
+  const stripped = command.trim().replace(/^exec\s+/, "");
+  const firstToken = (stripped.match(/^"[^"]+"|^'[^']+'|^\S+/) ?? [""])[0].replace(/^["']|["']$/g, "");
+  if (!firstToken)
+    return { found: true };
+  if (!firstToken.includes("/")) {
+    return resolveWecomBinary(firstToken);
+  }
+  return resolveWecomBinary(firstToken);
+}
+async function defaultWecomWsFactory() {
+  const { WebSocket: Ws } = await import("ws");
+  return (url) => new Ws(url);
+}
+
+class WecomCliInstance {
+  config;
+  status = "created";
+  child;
+  buffer = "";
+  eventHandler;
+  lastError;
+  wsBridge;
+  pluginInstances = new Map;
+  loadedPlugins = [];
+  cardActionPorts;
+  constructor(config) {
+    this.config = config;
+  }
+  setCardActionPorts(ports) {
+    this.cardActionPorts = ports;
+  }
+  hasCardActionPorts() {
+    return this.cardActionPorts !== undefined;
+  }
+  environment;
+  setEnvironment(env) {
+    this.environment = env;
+  }
+  getBridge() {
+    return this.wsBridge;
+  }
+  async handleWsFrame(frame) {
+    const cardAction = extractWecomCardAction(frame);
+    if (cardAction) {
+      await this.handleCardActionEvent(frame, cardAction);
+      return;
+    }
+    const parsed = parseWecomFrame(frame);
+    if (!parsed)
+      return;
+    const { botId } = readWecomCliConfig(this.config);
+    const channelPrompt = buildWecomChannelSystemPrompt(botId ? { botId } : {});
+    const metadata = {
+      ...parsed.metadata,
+      systemPrompt: channelPrompt,
+      reqId: parsed.reqId,
+      plugins: this.config.handleRule?.plugins || [],
+      pluginEnabled: Object.fromEntries((this.config.handleRule?.plugins || []).map((p) => [
+        `${this.config.id}:${p}`,
+        true
+      ]))
+    };
+    const replyChannel = buildWecomReplyChannel({
+      chatId: metadata.chatId,
+      messageId: metadata.messageId,
+      chatType: metadata.chatType,
+      userId: metadata.senderId,
+      sourceId: this.config.id,
+      reqId: parsed.reqId
+    });
+    const event = {
+      id: `es-${this.config.id}-${Date.now()}`,
+      type: "event-source.event.wecom-cli",
+      timestamp: Date.now(),
+      metadata: {
+        source: "event-source",
+        sourceId: this.config.id,
+        sourceMessageType: metadata.eventType,
+        systemPrompt: channelPrompt,
+        replyChannel,
+        ...metadata
+      },
+      payload: {
+        sourceId: this.config.id,
+        sourceType: WECOM_CLI_ES_TYPE,
+        rawEvent: frame,
+        message: buildWecomUserMessage(parsed.text, metadata.replyContext),
+        metadata,
+        replyChannel,
+        timestamp: Date.now()
+      },
+      rawEvent: frame,
+      replyChannel,
+      recommendedAction: {
+        action: `处理企业微信消息并回复。回复规范见 system prompt「${WECOM_CHANNEL_PROMPT_SECTION_TITLE}」章节。` + ` 用 wecom_respond 工具回复（content=回复正文）；` + `chat_id 缺省取本事件 chatId。` + (parsed.reqId ? `（WS fallback req_id=${parsed.reqId}）` : ""),
+        replyTo: {
+          chatId: replyChannel.chatId,
+          messageId: replyChannel.messageId
+        },
+        ...metadata.replyContext ? { replyContext: metadata.replyContext } : {},
+        staticRulesInSystemPrompt: true
+      }
+    };
+    const mediaRefs = extractWecomMediaRefs(frame.body ?? {});
+    if (mediaRefs.length > 0 && parsed.metadata.messageId) {
+      const msgid = parsed.metadata.messageId;
+      const saved = await this.downloadMediaRefs(msgid, mediaRefs, parsed.metadata.chatId);
+      if (saved.length > 0) {
+        event.payload.mediaFiles = saved;
+        event.metadata.mediaFiles = saved;
+      }
+    }
+    try {
+      this.eventHandler?.(event);
+    } catch (err) {
+      console.error(`[wecom-cli] event handler threw: ${err}`);
+      notifyReactFailure({
+        error: err,
+        envEvent: event,
+        replyChannel
+      }).catch(() => {});
+    }
+  }
+  async handleCardActionEvent(frame, action) {
+    if (!this.cardActionPorts) {
+      console.warn(`[wecom-cli] handleCardActionEvent: cardActionPorts 未注入，` + `template_card_event 被跳过（event_key=${action?.eventKey}）。` + `调 instance.setCardActionPorts({markTaskDone, reopenTask, updateCard}) 注入。`);
+      return;
+    }
+    try {
+      const result = await handleWecomCardAction(frame, this.cardActionPorts);
+      if (!result.ok) {
+        console.warn(`[wecom-cli] handleCardActionEvent failed: ${result.error ?? "unknown"}`);
+      }
+    } catch (err) {
+      console.error(`[wecom-cli] handleCardActionEvent threw: ${err.message}`);
+    }
+  }
+  wireCardActionPorts() {
+    if (this.cardActionPorts)
+      return;
+    const taskComponent = this.environment?.getComponent?.("task");
+    if (!taskComponent?.updateTask || !this.wsBridge) {
+      console.warn(`[wecom-cli] cardActionPorts 未注入：taskComponent.updateTask=` + `${typeof taskComponent?.updateTask}, wsBridge=${!!this.wsBridge}。` + `卡片按钮点击会被跳过。`);
+      return;
+    }
+    this.cardActionPorts = {
+      markTaskDone: async (taskId) => {
+        await taskComponent.updateTask(taskId, {
+          status: "completed",
+          current_status: "用户在企微卡片点「标记完成」确认完成"
+        });
+      },
+      reopenTask: async (taskId) => {
+        await taskComponent.updateTask(taskId, {
+          status: "active",
+          current_status: "用户在企微卡片点「重新打开」"
+        });
+      },
+      updateCard: async (reqId, cardTaskId, statusLabel, note, timeline, action, extra) => {
+        const { cmd, body } = buildWecomCardUpdateBody({
+          cardTaskId,
+          statusLabel,
+          note,
+          timeline,
+          action,
+          taskTitle: extra?.taskTitle,
+          taskNumber: extra?.taskNumber
+        });
+        const frame = {
+          cmd,
+          headers: { req_id: reqId },
+          body
+        };
+        const err = this.wsBridge.sendFrameWithReqId(frame);
+        if (err)
+          throw err;
+      },
+      loadTimeline: (taskId) => {
+        const store = this.getWecomCardStateStore();
+        if (!store)
+          return [];
+        const rec = store.get(taskId);
+        if (!rec?.timeline)
+          return [];
+        try {
+          const arr = JSON.parse(rec.timeline);
+          return Array.isArray(arr) ? arr : [];
+        } catch {
+          return [];
+        }
+      },
+      loadTaskTitle: (taskId) => {
+        const taskComponent2 = this.environment?.getComponent?.("task");
+        const getter = taskComponent2?.getTask;
+        if (!getter)
+          return;
+        try {
+          const raw = getter.call(taskComponent2, taskId);
+          const extract = (t) => {
+            if (!t || typeof t !== "object")
+              return;
+            const rec = t;
+            if (typeof rec.title !== "string" || !rec.title)
+              return;
+            return {
+              title: rec.title,
+              number: typeof rec.id === "number" ? rec.id : taskId
+            };
+          };
+          if (raw && typeof raw.then === "function") {
+            return raw.then(extract).catch((err) => {
+              console.warn(`[wecom-cli] loadTaskTitle failed for task #${taskId}: ${err}`);
+              return;
+            });
+          }
+          return extract(raw);
+        } catch (err) {
+          console.warn(`[wecom-cli] loadTaskTitle failed for task #${taskId}: ${err}`);
+          return;
+        }
+      }
+    };
+    console.info(`[wecom-cli] cardActionPorts 已注入（task ops + bridge.respond 更新 + timeline + taskTitle）`);
+  }
+  getWecomCardStateStore() {
+    const plugin = this.pluginInstances.get("WecomTaskNotifyPlugin");
+    const store = plugin?.cardStateStore;
+    if (store && typeof store.get === "function") {
+      return store;
+    }
+    if (!this.fallbackCardStateStore) {
+      try {
+        this.fallbackCardStateStore = createWecomCardStateStore();
+      } catch (err) {
+        console.warn(`[wecom-cli] fallback card state store 创建失败: ${err}`);
+        return;
+      }
+    }
+    return this.fallbackCardStateStore;
+  }
+  fallbackCardStateStore;
+  async downloadMediaRefs(msgid, refs, chatId) {
+    const timeout = new Promise((_, reject) => setTimeout(() => reject(new Error("media download timeout (10s)")), 1e4));
+    try {
+      const paths = await Promise.race([
+        timeout,
+        Promise.all(refs.map(async (ref) => {
+          try {
+            const path = await fetchAndSaveWecomMedia({
+              msgid,
+              url: ref.url,
+              aeskey: ref.aeskey,
+              kind: ref.kind,
+              filename: ref.filename,
+              chatId
+            });
+            console.log(`[wecom-cli] media saved: ${ref.kind} chat=${chatId ?? "(none)"} ${path}`);
+            return path;
+          } catch (err) {
+            console.error(`[wecom-cli] media download failed for ${ref.kind}: ${err.message}`);
+            return;
+          }
+        }))
+      ]);
+      return paths.filter((p) => !!p);
+    } catch (err) {
+      console.error(`[wecom-cli] media download aborted: ${err.message}`);
+      return [];
+    }
+  }
+  getStatus() {
+    return this.status;
+  }
+  setStatus(status) {
+    this.status = status;
+  }
+  onEvent(handler) {
+    this.eventHandler = handler;
+  }
+  offEvent() {
+    this.eventHandler = undefined;
+  }
+  getLastError() {
+    return this.lastError;
+  }
+  buildCommand() {
+    const { command } = readWecomCliConfig(this.config);
+    if (command)
+      return command;
+    return "wecom-cli chat messages list --help";
+  }
+  loadPlugins() {
+    const plugins = this.config.handleRule?.plugins || [];
+    if (plugins.length === 0)
+      return;
+    for (const pluginName of plugins) {
+      const pluginConfig = this.config.handleRule?.pluginConfig?.[pluginName] ?? {};
+      const plugin = importPluginShared(pluginName, getWecomPluginFactories(), {
+        sourceId: this.config.id,
+        pluginName,
+        ...pluginConfig
+      });
+      if (!plugin)
+        continue;
+      this.pluginInstances.set(pluginName, plugin);
+      const hookPoints = registerPluginHooksShared(plugin, pluginName, this.config.id);
+      this.loadedPlugins.push({ name: pluginName, hooks: hookPoints });
+      console.debug(`[wecom-cli] Loaded plugin "${pluginName}" with ${hookPoints.length} hook(s): [${hookPoints.join(", ")}]`);
+    }
+  }
+  unloadPlugins() {
+    for (const p of this.loadedPlugins) {
+      unregisterPluginHooksShared(p.name, p.hooks);
+    }
+    this.loadedPlugins = [];
+    this.pluginInstances.clear();
+  }
+  async start() {
+    this.loadPlugins();
+    await this.startWithBridge(await defaultWecomWsFactory());
+  }
+  async startWithBridge(wsFactory, credentialsPath) {
+    if (this.status === "running")
+      return;
+    this.setStatus("starting");
+    const credentials = resolveWecomCredentials(this.config, credentialsPath);
+    if (credentials) {
+      this.startWsBridge(credentials, wsFactory);
+      return;
+    }
+    this.startSkeletonMode();
+  }
+  startWsBridge(credentials, wsFactory) {
+    const bridge = new WecomWsBridge({
+      botId: credentials.botId,
+      secret: credentials.secret,
+      wsFactory
+    });
+    this.wsBridge = bridge;
+    registerWecomRespondTarget(this.config.id, {
+      respond: (reqId, body) => bridge.respond(reqId, body),
+      sendCmd: (cmd, body) => bridge.sendCmd(cmd, body)
+    });
+    this.wireCardActionPorts();
+    bridge.onMessage((frame) => {
+      this.handleWsFrame(frame).catch((err) => {
+        console.error(`[wecom-cli] ws frame handling threw: ${err}`);
+        try {
+          const parsed = parseWecomFrame(frame);
+          if (!parsed) {
+            return;
+          }
+          const baseChannel = buildWecomReplyChannel({
+            chatId: parsed.metadata.chatId,
+            messageId: parsed.metadata.messageId,
+            chatType: parsed.metadata.chatType,
+            userId: parsed.metadata.senderId,
+            sourceId: this.config.id,
+            reqId: parsed.reqId
+          });
+          notifyReactFailure({
+            error: err,
+            envEvent: {
+              type: "event-source.event.wecom-cli",
+              metadata: {
+                sourceId: this.config.id,
+                replyChannel: baseChannel
+              },
+              payload: {}
+            }
+          }).catch(() => {});
+        } catch {}
+      });
+    });
+    bridge.onError((err) => {
+      this.lastError = err.message;
+      console.error(`[wecom-cli] ws error: ${err.message}`);
+    });
+    bridge.connect();
+    this.setStatus("running");
+  }
+  startSkeletonMode() {
+    console.warn(`[wecom-cli] ⚠️ 骨架模式：未找到企微凭据（config botId/secret 或 ` + `${WECOM_CREDENTIALS_DEFAULT_PATH}），**不会收到任何入站消息**。
+` + `[wecom-cli]    请在 event source 配置里提供 botId + secret，或创建凭据文件（chmod 600）。
+` + `[wecom-cli]    如需临时自定义，可在事件源配置里设置 'command' 字段。`);
+    this.startSkeletonSpawn();
+  }
+  startSkeletonSpawn() {
+    const { command: customCommand } = readWecomCliConfig(this.config);
+    if (!customCommand) {
+      console.warn(`[wecom-cli] ⚠️ 骨架模式：当前启动的是占位命令 ` + `"wecom-cli chat messages list --help"，它**不会产出任何入站事件**。
+` + `[wecom-cli]    Phase 2 长连接需要凭据（config botId/secret 或凭据文件）。
+` + `[wecom-cli]    如需临时自定义，可在事件源配置里设置 'command' 字段。`);
+    }
+    if (customCommand) {
+      const probe = probeCommandBinary(customCommand);
+      if (!probe.found) {
+        this.lastError = `wecom-cli command not found: ${customCommand}`;
+        this.setStatus("error");
+        return;
+      }
+    } else {
+      const bin = resolveWecomBinary();
+      if (!bin.found) {
+        this.lastError = "wecom-cli binary not found on PATH. Install it with: npm install -g @wecom/cli --registry=https://registry.npmmirror.com (or set 'command' in the event source config to override the launch command).";
+        this.setStatus("error");
+        return;
+      }
+    }
+    const command = this.buildCommand();
+    let child;
+    try {
+      child = spawn2(`exec ${command}`, [], {
+        shell: true,
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true
+      });
+    } catch (err) {
+      this.lastError = `failed to spawn wecom-cli: ${err.message}`;
+      this.setStatus("error");
       return;
-    this.setStatus("starting");
-    const { channel, profile, customCommand } = readBountyCliConfig(this.config);
-    if (!channel && !customCommand) {
-      throw new Error("bounty-cli event source requires 'channel' (or 'command') in config");
     }
-    const command = customCommand || buildDefaultCommand(profile, channel);
-    this.child = spawn(`exec ${command}`, [], {
-      shell: true,
-      stdio: ["pipe", "pipe", "pipe"],
-      windowsHide: true
+    this.child = child;
+    child.stdout?.on("data", (data) => {
+      this.processStdout(data.toString());
     });
-    let stdoutBuffer = "";
-    let stderrBuffer = "";
-    this.child.stdout?.on("data", (data) => {
-      const str = data.toString();
-      stdoutBuffer += str;
-      this.processStdout(stdoutBuffer, channel ?? "");
-      stdoutBuffer = "";
+    child.stderr?.on("data", (data) => {
+      const text = data.toString().trim();
+      if (text) {
+        this.lastError = text.slice(0, 500);
+        console.error(`[wecom-cli] ${text}`);
+      }
     });
-    this.child.stderr?.on("data", (data) => {
-      const output = data.toString();
-      stderrBuffer += output;
-      this.processStderr(stderrBuffer);
-      stderrBuffer = "";
+    child.on("error", (err) => {
+      this.lastError = `wecom-cli process error: ${err.message}`;
+      this.setStatus("error");
     });
-    this.child.on("exit", (code, signal) => {
+    child.on("exit", (code, signal) => {
       if (code !== 0 && signal !== "SIGINT" && signal !== "SIGTERM") {
+        this.lastError = `wecom-cli exited with code ${code}`;
         this.setStatus("error");
       } else {
         this.setStatus("stopped");
       }
     });
-    this.child.on("error", (err) => {
-      console.error(`[bounty-cli] spawn error: ${err.message}`);
-      this.setStatus("error");
-    });
     this.setStatus("running");
   }
-  processStdout(buffer, fallbackChannel) {
-    const lines = buffer.split(`
-`);
-    const tail = lines.pop() ?? "";
-    this.buffer = tail;
-    for (const line of lines) {
-      const trimmed = line.trim();
-      if (!trimmed)
-        continue;
-      this.handleEventLine(trimmed, fallbackChannel);
-    }
-  }
-  processStderr(buffer) {
-    const lines = buffer.split(`
+  processStdout(chunk) {
+    this.buffer += chunk;
+    const lines = this.buffer.split(`
 `);
-    const tail = lines.pop() ?? "";
+    this.buffer = lines.pop() ?? "";
     for (const line of lines) {
       const trimmed = line.trim();
       if (!trimmed)
         continue;
-      if (trimmed.startsWith("{") && trimmed.includes("event_id")) {
-        this.handleEventLine(trimmed, readBountyCliConfig(this.config).channel ?? "");
-      }
-    }
-    if (tail.trim().length > 0) {
-      this.buffer = tail;
-    } else {
-      this.buffer = "";
+      this.handleEventLine(trimmed);
     }
   }
-  handleEventLine(line, fallbackChannel) {
+  handleEventLine(line) {
     let raw;
     try {
       raw = JSON.parse(line);
     } catch {
-      console.error(`[bounty-cli] failed to parse event line: ${line.slice(0, 200)}`);
+      console.error(`[wecom-cli] skipping non-JSON line: ${line.slice(0, 200)}`);
       return;
     }
-    const { metadata, replyChannel } = translateEvent(raw, fallbackChannel);
+    const parsed = parseWecomFrame(raw);
+    if (!parsed) {
+      console.error(`[wecom-cli] skipping non-event frame: ${JSON.stringify(raw).slice(0, 200)}`);
+      return;
+    }
+    const replyChannel = buildWecomReplyChannel({
+      chatId: parsed.metadata.chatId,
+      messageId: parsed.metadata.messageId,
+      chatType: parsed.metadata.chatType,
+      userId: parsed.metadata.senderId,
+      sourceId: this.config.id,
+      reqId: parsed.reqId
+    });
     const event = {
-      metadata,
+      metadata: parsed.metadata,
+      payload: {
+        sourceId: this.config.id,
+        sourceType: WECOM_CLI_ES_TYPE,
+        rawEvent: raw,
+        message: buildWecomUserMessage(parsed.text, parsed.metadata.replyContext),
+        metadata: parsed.metadata,
+        replyChannel,
+        timestamp: Date.now()
+      },
       rawEvent: raw,
       replyChannel,
-      recommendedAction: buildBountyCliRecommendedAction({
-        profile: readBountyCliConfig(this.config).profile,
-        channelName: String(metadata.channelName ?? fallbackChannel)
-      })
+      recommendedAction: {
+        description: "Reply to the WeCom user via `wecom-cli message aibot send --json ...`",
+        command: `wecom-cli message aibot send --json '{"chat_id":"${parsed.metadata.chatId ?? parsed.metadata.senderId ?? ""}","msg_type":"markdown","markdown":{"content":"..."}}'`,
+        notes: [
+          "企微单聊的 chat_id 是对方 userid；群聊的 chat_id 是回调里的 chatid。",
+          "发送成功 = 退出码 0 且 stdout 无 error 字段。"
+        ]
+      }
     };
     if (this.eventHandler) {
       try {
         this.eventHandler(event);
       } catch (err) {
-        console.error(`[bounty-cli] event handler threw: ${err}`);
+        console.error(`[wecom-cli] event handler threw: ${err}`);
+        notifyReactFailure({
+          error: err,
+          envEvent: event,
+          replyChannel
+        }).catch(() => {});
       }
     }
   }
   async stop() {
     if (this.status === "stopped" || this.status === "created")
       return;
+    this.unloadPlugins();
+    if (this.wsBridge) {
+      unregisterWecomRespondTarget(this.config.id);
+      this.wsBridge.stop();
+      this.wsBridge = undefined;
+    }
+    try {
+      this.fallbackCardStateStore?.close?.();
+    } catch {}
+    this.fallbackCardStateStore = undefined;
     if (this.child && !this.child.killed) {
       this.child.kill("SIGINT");
-      await new Promise((resolve) => {
+      await new Promise((resolve2) => {
         const timer = setTimeout(() => {
-          if (this.child && !this.child.killed) {
+          if (this.child && !this.child.killed)
             this.child.kill("SIGKILL");
-          }
-          resolve();
+          resolve2();
         }, 3000);
         if (this.child) {
           this.child.on("exit", () => {
             clearTimeout(timer);
-            resolve();
+            resolve2();
           });
         } else {
           clearTimeout(timer);
-          resolve();
+          resolve2();
         }
       });
     }
     this.setStatus("stopped");
   }
 }
-var bountyCliHandler = {
-  type: "bounty-cli",
+var wecomCliHandler = {
+  type: WECOM_CLI_ES_TYPE,
   validateConfig(config) {
     const errors = [];
     if (!config.id)
       errors.push("EventSource ID is required");
     if (!config.name)
       errors.push("EventSource name is required");
-    const { channel, customCommand } = readBountyCliConfig(config);
-    if (!channel && !customCommand) {
-      errors.push("Bounty CLI 'channel' (top-level channel or options.channel) is required");
+    const { botId, secret } = readWecomCliConfig(config);
+    if (!botId) {
+      errors.push("WeCom 'botId' is required (企业微信智能机器人的 BotID；CLI 用 --bot-id 传入)");
+    }
+    if (!secret) {
+      errors.push("WeCom 'secret' is required (智能机器人 Secret；CLI 用 --secret 传入)");
     }
     return errors;
   },
   createInstance(config) {
-    return new BountyCliInstance(config);
+    return new WecomCliInstance(config);
+  },
+  getOptions() {
+    return [
+      { name: "botId", description: "企业微信智能机器人 BotID", required: true, type: "string" },
+      { name: "secret", description: "智能机器人 Secret（长连接专用密钥）", required: true, type: "string" },
+      { name: "webhook", description: "群机器人 webhook URL（可选）", required: false, type: "string" },
+      { name: "command", description: "覆盖默认启动命令（高级）", required: false, type: "string" }
+    ];
   }
 };
 
@@ -1488,7 +3067,13 @@ function writeConfigPath(configPath, dotPath, value) {
     }
   });
   const result = applyEdits(text, edits);
-  fs.writeFileSync(configPath, result, "utf-8");
+  const configDir = path.dirname(configPath);
+  const ok = guardConfigWrite(configDir, path.basename(configPath), () => {
+    fs.writeFileSync(configPath, result, "utf-8");
+  });
+  if (!ok) {
+    throw new Error(`config.jsonc 写入失败（护栏记录见 audit.log）：${configPath}`);
+  }
 }
 function readFallbackModelList(configPath) {
   const config = readConfigFile(configPath);
@@ -1728,12 +3313,12 @@ function resolveSocketPath() {
   return process.env.ROY_DAEMON_SOCKET || DEFAULT_SOCKET_PATH;
 }
 async function requestReset(socketPath, reason) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let sock;
     try {
       sock = connect(socketPath);
     } catch (e) {
-      resolve({ confirmed: false, reason: e.message });
+      resolve2({ confirmed: false, reason: e.message });
       return;
     }
     let settled = false;
@@ -1743,7 +3328,7 @@ async function requestReset(socketPath, reason) {
       settled = true;
       clearTimeout(timer);
       sock.destroy();
-      resolve({ confirmed, reason: why });
+      resolve2({ confirmed, reason: why });
     };
     const timer = setTimeout(() => finish(false, `daemon 未在 ${RESET_ACK_TIMEOUT_MS}ms 内确认`), RESET_ACK_TIMEOUT_MS);
     sock.once("connect", () => {
@@ -1799,8 +3384,229 @@ var resetCommand = {
   }
 };
 
+// src/env/event-source/es-command.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+var MOD_ALLOWED_FIELDS = [
+  "enabled",
+  "name",
+  "interval",
+  "cron",
+  "profile"
+];
+function resolveEsFilePath(configPath) {
+  const dir = configPath ? path2.dirname(configPath) : defaultRoyDir();
+  return path2.join(dir, "event-sources.json");
+}
+function defaultRoyDir() {
+  const home = process.env.HOME || process.env.USERPROFILE || "/tmp";
+  return path2.join(home, ".roy-agent");
+}
+function readEsFile(esFile) {
+  if (!fs2.existsSync(esFile)) {
+    return { version: "1.0.0", sources: [] };
+  }
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(esFile, "utf-8"));
+    if (parsed && typeof parsed === "object" && Array.isArray(parsed.sources)) {
+      return parsed;
+    }
+  } catch {}
+  throw new Error(`event-sources.json 解析失败：${esFile}`);
+}
+function writeEsFile(esFile, data) {
+  fs2.mkdirSync(path2.dirname(esFile), { recursive: true });
+  const tmp = `${esFile}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    fs2.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf-8");
+    fs2.renameSync(tmp, esFile);
+  } catch (err) {
+    try {
+      fs2.rmSync(tmp, { force: true });
+    } catch {}
+    throw new Error(`写入 ${esFile} 失败：${err.message}`);
+  }
+}
+function dualResult2(text) {
+  return {
+    ok: true,
+    output: {
+      text,
+      card: renderTextCard("⚙️ EventSource 管理", text),
+      kind: "card"
+    }
+  };
+}
+var USAGE2 = [
+  "用法：##command##: es <子命令> [参数]",
+  "",
+  "子命令：",
+  "  list                    列出所有事件源",
+  "  add <name> <type>       新增事件源（enabled=true）",
+  "  del <name|id>           删除事件源（别名 remove）",
+  "  mod <name|id> k=v       修改字段（enabled/name/interval/cron/profile；别名 update）",
+  "",
+  "  ⚠️ command/url 不可经 mod 修改（避免命令注入面）；如需改请 del 后 add。",
+  "",
+  "注意：修改的是磁盘配置，运行中的进程需「##command##: reset」重启后生效。"
+].join(`
+`);
+function findSource(sources, nameOrId) {
+  return sources.find((s) => s.name === nameOrId || s.id === nameOrId);
+}
+function parseKv(pair) {
+  const idx = pair.indexOf("=");
+  if (idx <= 0)
+    return null;
+  const key = pair.slice(0, idx).trim();
+  const rawValue = pair.slice(idx + 1).trim();
+  let value = rawValue;
+  if (rawValue === "true")
+    value = true;
+  else if (rawValue === "false")
+    value = false;
+  else if (rawValue !== "" && !Number.isNaN(Number(rawValue))) {
+    value = Number(rawValue);
+  }
+  return { key, value };
+}
+function renderList(sources) {
+  if (sources.length === 0) {
+    return `当前没有已配置的事件源。
+（可用「##command##: es add <name> <type>」新增）`;
+  }
+  const lines = sources.map((s) => {
+    const name = String(s.name ?? "?");
+    const type = String(s.type ?? "?");
+    const enabled = s.enabled === false ? "disabled" : "enabled";
+    const id = String(s.id ?? "");
+    return `- ${name}  [${type}]  ${enabled}  (${id})`;
+  });
+  return `事件源列表（${sources.length} 个）：
+${lines.join(`
+`)}`;
+}
+var esCommand = {
+  name: "es",
+  description: "管理事件源（list/add/del/mod），改磁盘配置",
+  usage: "##command##: es <list|add|del|mod> [参数]",
+  async execute(ctx) {
+    try {
+      return await executeEsCommand(ctx);
+    } catch (err) {
+      return {
+        ok: false,
+        error: `event-sources.json 读写失败：${err.message}`
+      };
+    }
+  }
+};
+async function executeEsCommand(ctx) {
+  {
+    const esFile = resolveEsFilePath(ctx.configPath);
+    const [sub, ...rest] = ctx.args;
+    switch (sub) {
+      case "list":
+      case undefined: {
+        const data = readEsFile(esFile);
+        return dualResult2(renderList(data.sources));
+      }
+      case "add": {
+        const [name, type] = rest;
+        if (!name || !type) {
+          return { ok: false, error: `用法：##command##: es add <name> <type>
+${USAGE2}` };
+        }
+        const data = readEsFile(esFile);
+        if (findSource(data.sources, name)) {
+          return {
+            ok: false,
+            error: `事件源「${name}」已存在（add 拒绝重名）。可用 es mod 修改或 es del 删除后重建。`
+          };
+        }
+        const id = `es-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const source = {
+          id,
+          name,
+          type,
+          enabled: true
+        };
+        data.sources.push(source);
+        writeEsFile(esFile, data);
+        return dualResult2(`✅ 已新增事件源「${name}」[${type}]（id=${id}，enabled）。` + `重启进程后生效（##command##: reset）。`);
+      }
+      case "del":
+      case "remove": {
+        const target = rest[0];
+        if (!target) {
+          return { ok: false, error: `用法：##command##: es del <name|id>
+${USAGE2}` };
+        }
+        const data = readEsFile(esFile);
+        const src = findSource(data.sources, target);
+        if (!src) {
+          return { ok: false, error: `未找到事件源「${target}」。` };
+        }
+        data.sources = data.sources.filter((s) => s !== src);
+        writeEsFile(esFile, data);
+        return dualResult2(`✅ 已删除事件源「${String(src.name)}」（id=${String(src.id)}）。` + `重启进程后生效（##command##: reset）。`);
+      }
+      case "mod":
+      case "update": {
+        const [target, ...pairs] = rest;
+        if (!target || pairs.length === 0) {
+          return {
+            ok: false,
+            error: `用法：##command##: es mod <name|id> k=v [k=v...]
+${USAGE2}`
+          };
+        }
+        const data = readEsFile(esFile);
+        const src = findSource(data.sources, target);
+        if (!src) {
+          return { ok: false, error: `未找到事件源「${target}」。` };
+        }
+        const applied = [];
+        for (const pair of pairs) {
+          const kv = parseKv(pair);
+          if (!kv) {
+            return { ok: false, error: `参数格式错误：「${pair}」（应为 k=v）
+${USAGE2}` };
+          }
+          if (!MOD_ALLOWED_FIELDS.includes(kv.key)) {
+            return {
+              ok: false,
+              error: `字段「${kv.key}」不允许修改（白名单：${MOD_ALLOWED_FIELDS.join("/")}；id/type 不可改）。`
+            };
+          }
+          if (kv.key === "name" && typeof kv.value === "string" && kv.value !== src.name && data.sources.some((s0) => s0 !== src && s0.name === kv.value)) {
+            return {
+              ok: false,
+              error: `名称「${String(kv.value)}」已被其它事件源占用，改 name 拒绝。`
+            };
+          }
+          let value = kv.value;
+          if (kv.key === "enabled") {
+            value = kv.value === true || kv.value === 1 || kv.value === "1" || kv.value === "true" || kv.value === "yes" || kv.value === "on";
+          }
+          src[kv.key] = value;
+          applied.push(`${kv.key}=${String(value)}`);
+        }
+        writeEsFile(esFile, data);
+        return dualResult2(`✅ 已修改事件源「${String(src.name)}」：${applied.join("，")}。` + `重启进程后生效（##command##: reset）。`);
+      }
+      default:
+        return {
+          ok: false,
+          error: `未知子命令「${sub}」。
+${USAGE2}`
+        };
+    }
+  }
+}
+
 // src/env/event-source/command-registry.ts
-var logger2 = createLogger("command-registry");
+var logger3 = createLogger("command-registry");
 var COMMAND_PREFIX = "##command##:";
 var COMMAND_PREFIX_LOWER = COMMAND_PREFIX.toLowerCase();
 function stripLeadingMentions(text) {
@@ -1873,7 +3679,7 @@ ${this.renderHelp()}`
       });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      logger2.error(`[CommandRegistry] command "${subcommand}" failed: ${msg}`);
+      logger3.error(`[CommandRegistry] command "${subcommand}" failed: ${msg}`);
       return { ok: false, error: `命令执行失败：${msg}` };
     }
   }
@@ -1892,6 +3698,7 @@ function getGlobalCommandRegistry() {
     registry.register(fallbackModelCommand);
     registry.register(listCommand);
     registry.register(resetCommand);
+    registry.register(esCommand);
     g.__royCommandRegistry = registry;
   }
   return g.__royCommandRegistry;
@@ -1903,7 +3710,7 @@ async function handleCommandMessage(text, opts = {}) {
   if (!invocation)
     return null;
   const registry = opts.registry ?? getGlobalCommandRegistry();
-  logger2.info(`[handleCommandMessage] dispatching "${invocation.subcommand}" args=${JSON.stringify(invocation.args)}`);
+  logger3.info(`[handleCommandMessage] dispatching "${invocation.subcommand}" args=${JSON.stringify(invocation.args)}`);
   return registry.dispatch(invocation.subcommand, invocation.args, {
     rawText: text,
     configPath: opts.configPath
@@ -1912,7 +3719,7 @@ async function handleCommandMessage(text, opts = {}) {
 
 // src/env/event-source/command-card-action.ts
 init_logger();
-var logger3 = createLogger("command-card-action");
+var logger4 = createLogger("command-card-action");
 function isCommandCardAction(event) {
   const av = event.actionValue;
   if (av && typeof av === "object") {
@@ -1969,7 +3776,7 @@ async function handleCommandCardAction(event, ports) {
     return { ok: false, error: "无法识别的 command 卡片动作" };
   }
   const executed = `${call.subcommand} ${call.args.join(" ")}`;
-  logger3.info(`[handleCommandCardAction] 执行 ${executed}`);
+  logger4.info(`[handleCommandCardAction] 执行 ${executed}`);
   let result;
   try {
     result = await ports.executeCommand(call.subcommand, call.args, {
@@ -1977,7 +3784,7 @@ async function handleCommandCardAction(event, ports) {
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    logger3.error(`[handleCommandCardAction] ${executed} 执行异常：${msg}`);
+    logger4.error(`[handleCommandCardAction] ${executed} 执行异常：${msg}`);
     return { ok: false, executed, error: `命令执行异常：${msg}` };
   }
   if (!result.ok) {
@@ -1990,7 +3797,7 @@ async function handleCommandCardAction(event, ports) {
       await ports.patchCard(event.token, card, event.profile);
     } catch (err) {
       patchError = err.message;
-      logger3.error(`[handleCommandCardAction] patch 卡片失败：${patchError}`);
+      logger4.error(`[handleCommandCardAction] patch 卡片失败：${patchError}`);
     }
   }
   return { ok: true, executed, card, patchError };
@@ -1999,7 +3806,7 @@ async function handleCommandCardAction(event, ports) {
 // src/env/event-source/event-source-handlers.ts
 init_logger();
 var execAsync2 = promisify2(execSync);
-var logger4 = createLogger("lark-cli:event-source");
+var logger5 = createLogger("lark-cli:event-source");
 var CHILD_READY_TIMEOUT_MS = 5000;
 var GRACEFUL_STOP_TIMEOUT_MS = 5000;
 var CARD_ACTION_EVENT_TYPE = "card.action.trigger";
@@ -2009,12 +3816,6 @@ function isChildAlive(child) {
 function isPluginDebugEnabled() {
   return process.env.ROY_TASK_NOTIFY_DEBUG === "1" || process.env.ROY_TRACE_DEBUG === "1";
 }
-var BUILT_IN_PLUGIN_FACTORIES = {
-  LarkCliTaskNotifyPlugin: (cfg) => createLarkCliTaskNotifyHook(cfg),
-  LarkCliWorkflowNotifyPlugin: (cfg) => createLarkCliWorkflowNotifyHook(cfg),
-  PerTaskGroupChatPlugin: (cfg) => createPerTaskGroupChatPlugin(cfg),
-  "task-tag": () => new TaskTagPlugin
-};
 function matchEventType(eventType, patterns) {
   for (const pattern of patterns) {
     if (pattern === "*")
@@ -2040,6 +3841,40 @@ function buildLarkRecommendedAction(opts) {
     `处理飞书 ${scopeWord}消息并以机器人身份回复${profileWarn}。`,
     `scope: ${scopeHint}。`,
     ``,
+    ...larkStaticRuleLines(profileFlag),
+    ``,
+    `## 必须使用 replyTo 里给定的值`,
+    `profile / chatId / messageId / --as bot 必须原样取自 recommendedAction.replyTo；不要凭印象自己拼接。`
+  ].join(`
+`);
+  const actionWithReplyContext = [
+    action,
+    larkReplyContextSection(profileFlag)
+  ].join(`
+`);
+  return {
+    action: actionWithReplyContext,
+    replyTo: {
+      appId,
+      profile,
+      chatId,
+      messageId
+    }
+  };
+}
+var LARK_CHANNEL_PROMPT_SECTION_TITLE = "⭐ 飞书回复规范（system prompt 注入版）";
+var LARK_PROMPT_LENGTH_BUDGET = 5300;
+function larkReplyContextSection(profileFlag) {
+  return [
+    ``,
+    `## 引用消息上下文 replyContext`,
+    `recommendedAction.replyContext 存在 = 本条是对 parentId 的回复。`,
+    `- 取原文：lark-cli ${profileFlag}im +messages-mget --message-ids <parentId> --as bot（best-effort）`
+  ].join(`
+`);
+}
+function larkStaticRuleLines(profileFlag) {
+  return [
     `## ⭐ 关键 0：整次回复只发一条结构化 post（禁分段）`,
     `> 指令优先级：本 prompt 与 lark-* skill 文档冲突时**以本 prompt 为准**`,
     `> （例：lark-im skill 建议 --markdown / ANSI-C 引号，本项目一律走下面模板）。`,
@@ -2135,20 +3970,59 @@ function buildLarkRecommendedAction(opts) {
     `  - 飞书消息正文里常含裸 \`"\`、\`|\`、Markdown 表格分隔符 → json.load 会报 \`Expecting ',' delimiter\` 假失败`,
     `  - 假失败 → 重发 → 形成 3 份相同消息`,
     `- 重试建议：固定 idempotency-key（飞书层面去重，**最长 50 字符**），不要靠内容 hash 自检`,
+    ``,
+    `## 文档交付规范：产出物存飞书云盘，云盘链接交付`,
+    `- 本渠道触发的**文档类生成**（调研文档 / PPT / doc 等）必须用**飞书云盘**存储产出物`,
+    `  （\`lark-cli docs +create --title <标题> --markdown @<本地md>\`，用完即弃）`,
+    `- 交付时只给**云盘链接**（https://my.feishu.cn/...），**不落本地路径**交付`,
+    `  - 本地路径只作中转（生成 md → 上传云盘 → 回复里贴云盘链接），不作为交付物`
+  ];
+}
+function buildLarkChannelSystemPrompt(opts) {
+  const { profile } = opts;
+  const profileFlag = profile ? `--profile ${profile} ` : "";
+  const profileWarn = profile ? `（⚠️ 必须用 profile="${profile}" 调 lark-cli；openId per-app 隔离，换 profile 会失败）` : "";
+  const header = [
+    `# ${LARK_CHANNEL_PROMPT_SECTION_TITLE}`,
+    ``,
+    `本节是飞书渠道的**回复规范**（静态规则，随 system prompt 注入）。`,
+    `每条飞书事件的 \`recommendedAction\` 只带动态定位（replyTo 四元组），`,
+    `profile / chatId / messageId 是本轮唯一权威定位，其余回复规则全部在此。`,
+    profile ? `本渠道 profile：${profile}${profileWarn}` : `本渠道未配置 profile（使用 lark-cli active profile）。`,
+    ``
+  ].join(`
+`);
+  const footer = [
     ``,
     `## 必须使用 replyTo 里给定的值`,
-    `profile / chatId / messageId / --as bot 必须原样取自 recommendedAction.replyTo；不要凭印象自己拼接。`
+    `profile / chatId / messageId / --as bot 必须原样取自 recommendedAction.replyTo；不要凭印象自己拼接。`,
+    larkReplyContextSection(profileFlag)
   ].join(`
 `);
-  return {
-    action,
-    replyTo: {
-      appId,
-      profile,
-      chatId,
-      messageId
-    }
-  };
+  return header + larkStaticRuleLines(profileFlag).join(`
+`) + footer;
+}
+function buildLarkLeanAction(chatType) {
+  const isGroup = chatType === "group";
+  const scopeHint = isGroup ? `群聊消息；回复到 replyTo.chatId。如需 @发件人，用结构化 at 节点 {"tag":"at","user_id":"<senderId>"}（不要写 <at> 文本标签）` : "p2p 私聊消息；回复到 replyTo.chatId";
+  return [
+    `处理飞书${isGroup ? "群聊" : "p2p 私聊"}消息并回复。回复规范见 system prompt「${LARK_CHANNEL_PROMPT_SECTION_TITLE}」章节。`,
+    `scope: ${scopeHint}。`,
+    `replyTo 的 profile/chatId/messageId 是本轮唯一权威定位；其余回复规则（发送命令模板、长度上限、发送纪律等）全部见 system prompt 上述章节。`
+  ].join(`
+`);
+}
+function resolveLarkChannelSystemPrompt(config) {
+  const mode = config.channelPromptMode ?? "lean";
+  if (mode === "legacy") {
+    return config.systemPrompt;
+  }
+  const channelPrompt = buildLarkChannelSystemPrompt({
+    profile: config.profile
+  });
+  return config.systemPrompt ? config.systemPrompt + `
+
+` + channelPrompt : channelPrompt;
 }
 function extractMetadata(rawEvent, eventType) {
   const event = rawEvent;
@@ -2184,6 +4058,19 @@ function extractMetadata(rawEvent, eventType) {
     metadata.chatType = messageData.chat_type;
     metadata.messageId = messageData.message_id;
     metadata.messageType = messageData.message_type;
+    const rootId = messageData.root_id ?? event.root_id;
+    const parentId = messageData.parent_id ?? event.reply_to ?? event.parent_id;
+    const threadId = messageData.thread_id ?? event.thread_id;
+    if (rootId || parentId || threadId) {
+      const replyContext = {};
+      if (rootId)
+        replyContext.rootId = rootId;
+      if (parentId)
+        replyContext.parentId = parentId;
+      if (threadId)
+        replyContext.threadId = threadId;
+      metadata.replyContext = replyContext;
+    }
   }
   if (typeof senderId === "string") {
     metadata.senderId = senderId;
@@ -2193,13 +4080,33 @@ function extractMetadata(rawEvent, eventType) {
   let recommendedAction;
   if (eventType === "im.message.receive_v1" || event.type === "im.message.receive_v1") {
     const profile2 = event.profile;
-    recommendedAction = buildLarkRecommendedAction({
-      profile: profile2,
-      chatType: metadata.chatType,
-      appId: metadata.appId,
-      chatId: metadata.chatId,
-      messageId: metadata.messageId
-    });
+    const promptMode = event.channelPromptMode ?? "lean";
+    if (promptMode === "legacy") {
+      recommendedAction = buildLarkRecommendedAction({
+        profile: profile2,
+        chatType: metadata.chatType,
+        appId: metadata.appId,
+        chatId: metadata.chatId,
+        messageId: metadata.messageId
+      });
+    } else {
+      recommendedAction = {
+        action: buildLarkLeanAction(metadata.chatType),
+        replyTo: {
+          appId: metadata.appId,
+          profile: profile2,
+          chatId: metadata.chatId,
+          messageId: metadata.messageId
+        },
+        staticRulesInSystemPrompt: true
+      };
+    }
+    if (metadata.replyContext) {
+      recommendedAction = {
+        ...recommendedAction,
+        replyContext: metadata.replyContext
+      };
+    }
   }
   const profile = event.profile;
   const senderOpenId = typeof senderId === "string" ? senderId : senderId?.open_id;
@@ -2228,8 +4135,8 @@ class LarkCliInstance {
   cardActionPorts;
   setCardActionPorts(ports) {
     this.cardActionPorts = ports;
-    if (typeof logger4 !== "undefined" && logger4?.debug) {
-      logger4.debug(`[LarkCliInstance] CardActionPorts injected: ` + `getTask=${typeof ports.getTask}, updateTaskContext=${typeof ports.updateTaskContext}, ` + `createGroupChat=${typeof ports.createGroupChat}, deleteGroupChat=${typeof ports.deleteGroupChat}, ` + `notifier=${typeof ports.notifier}`);
+    if (typeof logger5 !== "undefined" && logger5?.debug) {
+      logger5.debug(`[LarkCliInstance] CardActionPorts injected: ` + `getTask=${typeof ports.getTask}, updateTaskContext=${typeof ports.updateTaskContext}, ` + `createGroupChat=${typeof ports.createGroupChat}, deleteGroupChat=${typeof ports.deleteGroupChat}, ` + `notifier=${typeof ports.notifier}`);
     }
   }
   hasCardActionPorts() {
@@ -2244,6 +4151,15 @@ class LarkCliInstance {
   recentEventIds = new Map;
   DEDUP_WINDOW_MS = 60000;
   DEDUP_MAX_SIZE = 100;
+  cachedChannelSystemPrompt;
+  channelSystemPromptResolved = false;
+  getChannelSystemPrompt() {
+    if (!this.channelSystemPromptResolved) {
+      this.cachedChannelSystemPrompt = resolveLarkChannelSystemPrompt(this.config);
+      this.channelSystemPromptResolved = true;
+    }
+    return this.cachedChannelSystemPrompt;
+  }
   environment;
   loadedPlugins = [];
   constructor(config) {
@@ -2256,7 +4172,7 @@ class LarkCliInstance {
     if (this.status === "running")
       return;
     if (this.starting) {
-      logger4.warn(`[LarkCliInstance] start() 已在执行中，忽略重复调用`);
+      logger5.warn(`[LarkCliInstance] start() 已在执行中，忽略重复调用`);
       return;
     }
     this.starting = true;
@@ -2286,12 +4202,12 @@ class LarkCliInstance {
     if (!consumesCardAction)
       return;
     if (this.config.eventTypes?.length && !matchEventType(CARD_ACTION_EVENT_TYPE, this.config.eventTypes)) {
-      logger4.warn(`[LarkCliInstance] eventKeys 含 ${CARD_ACTION_EVENT_TYPE}，但 eventTypes=` + `${JSON.stringify(this.config.eventTypes)} 不含它 → 卡片点击会被**静默丢弃**。` + `请把 ${CARD_ACTION_EVENT_TYPE} 加进 eventTypes，或清空 eventTypes。`);
+      logger5.warn(`[LarkCliInstance] eventKeys 含 ${CARD_ACTION_EVENT_TYPE}，但 eventTypes=` + `${JSON.stringify(this.config.eventTypes)} 不含它 → 卡片点击会被**静默丢弃**。` + `请把 ${CARD_ACTION_EVENT_TYPE} 加进 eventTypes，或清空 eventTypes。`);
     }
-    logger4.info(`[LarkCliInstance] 已监听 ${CARD_ACTION_EVENT_TYPE}。` + `⚠️ 若点击卡片无反应，先确认飞书开发者后台「事件与回调 → 回调配置」已开启该事件。`);
+    logger5.info(`[LarkCliInstance] 已监听 ${CARD_ACTION_EVENT_TYPE}。` + `⚠️ 若点击卡片无反应，先确认飞书开发者后台「事件与回调 → 回调配置」已开启该事件。`);
   }
   spawnConsumeChild(command) {
-    return spawn2("exec " + command, [], {
+    return spawn3("exec " + command, [], {
       shell: true,
       stdio: ["pipe", "pipe", "pipe"],
       windowsHide: true
@@ -2328,7 +4244,7 @@ class LarkCliInstance {
     const conflicts = keys.filter((k) => busy.has(k));
     if (conflicts.length > 0) {
       const profile = this.config.profile;
-      logger4.warn(`[LarkCliInstance] eventKey 已被其它 consumer 占用（lark-cli 一个 key 只允许一个 consumer）：` + `${conflicts.join(", ")}。本 event-source 启动后可能 exit 2。` + `用 \`lark-cli${profile ? ` --profile ${profile}` : ""} event status\` 查看，必要时 \`event stop\`。`);
+      logger5.warn(`[LarkCliInstance] eventKey 已被其它 consumer 占用（lark-cli 一个 key 只允许一个 consumer）：` + `${conflicts.join(", ")}。本 event-source 启动后可能 exit 2。` + `用 \`lark-cli${profile ? ` --profile ${profile}` : ""} event status\` 查看，必要时 \`event stop\`。`);
     }
   }
   async probeBusyEventKeys() {
@@ -2379,16 +4295,16 @@ class LarkCliInstance {
     });
     const handleExit = (code, source) => {
       if (code !== 0 && code !== null) {
-        logger4.warn(`[LarkCliInstance] consume 子进程异常退出 code=${code} (${source}) cmd="${command}"`);
+        logger5.warn(`[LarkCliInstance] consume 子进程异常退出 code=${code} (${source}) cmd="${command}"`);
         this.status = "error";
       } else {
-        logger4.info(`[LarkCliInstance] consume 子进程已退出 code=${code} (${source}) cmd="${command}"`);
+        logger5.info(`[LarkCliInstance] consume 子进程已退出 code=${code} (${source}) cmd="${command}"`);
       }
       settle();
       queueMicrotask(() => {
         if (this.children.length > 0 && this.children.every((c) => !isChildAlive(c))) {
           if (this.status !== "error") {
-            logger4.warn(`[LarkCliInstance] 所有 consume 子进程都已退出，状态从 running 改为 stopped`);
+            logger5.warn(`[LarkCliInstance] 所有 consume 子进程都已退出，状态从 running 改为 stopped`);
             this.status = "stopped";
           }
         }
@@ -2397,12 +4313,12 @@ class LarkCliInstance {
     child.on("exit", (code) => handleExit(code, "exit"));
     child.on("close", (code) => handleExit(code, "close"));
     child.on("error", (error) => {
-      logger4.error(`[LarkCliInstance] consume 子进程 error: ${error.message}`);
+      logger5.error(`[LarkCliInstance] consume 子进程 error: ${error.message}`);
       this.status = "error";
       settle();
     });
     const timer = setTimeout(() => {
-      logger4.warn(`[LarkCliInstance] consume 子进程 ${CHILD_READY_TIMEOUT_MS}ms 内未见 ready marker: cmd="${command}"`);
+      logger5.warn(`[LarkCliInstance] consume 子进程 ${CHILD_READY_TIMEOUT_MS}ms 内未见 ready marker: cmd="${command}"`);
       settle();
     }, CHILD_READY_TIMEOUT_MS);
     ready.then(() => clearTimeout(timer));
@@ -2425,16 +4341,16 @@ class LarkCliInstance {
       try {
         child.kill("SIGTERM");
       } catch (error) {
-        logger4.warn(`[LarkCliInstance] Error sending SIGTERM to ${child.pid}: ${error}`);
+        logger5.warn(`[LarkCliInstance] Error sending SIGTERM to ${child.pid}: ${error}`);
       }
     }
-    const allExited = Promise.all(children.map((child) => new Promise((resolve) => {
+    const allExited = Promise.all(children.map((child) => new Promise((resolve2) => {
       if (isChildAlive(child) === false)
-        return resolve();
-      child.once("exit", () => resolve());
-      child.once("error", () => resolve());
+        return resolve2();
+      child.once("exit", () => resolve2());
+      child.once("error", () => resolve2());
     })));
-    const timeout = new Promise((resolve) => setTimeout(resolve, GRACEFUL_STOP_TIMEOUT_MS));
+    const timeout = new Promise((resolve2) => setTimeout(resolve2, GRACEFUL_STOP_TIMEOUT_MS));
     await Promise.race([allExited, timeout]);
     for (const child of children) {
       if (isChildAlive(child)) {
@@ -2480,12 +4396,12 @@ class LarkCliInstance {
   }
   wireCardActionPorts() {
     if (this.cardActionPorts) {
-      logger4.debug("[LarkCliInstance] cardActionPorts 已由外部注入，跳过默认 cross-wire");
+      logger5.debug("[LarkCliInstance] cardActionPorts 已由外部注入，跳过默认 cross-wire");
       return;
     }
     const taskComponent = this.environment?.getComponent?.("task");
     if (!taskComponent?.getTask || !taskComponent?.updateTask) {
-      logger4.debug(`[LarkCliInstance] card.action.trigger 端口未注入：taskComponent 不可用` + `（getTask=${typeof taskComponent?.getTask}, updateTask=${typeof taskComponent?.updateTask}）。` + `卡片按钮点击会被跳过。`);
+      logger5.debug(`[LarkCliInstance] card.action.trigger 端口未注入：taskComponent 不可用` + `（getTask=${typeof taskComponent?.getTask}, updateTask=${typeof taskComponent?.updateTask}）。` + `卡片按钮点击会被跳过。`);
       return;
     }
     const sharedNotifier = this.pluginInstances.get("LarkCliTaskNotifyPlugin")?.cardNotifier ?? this.pluginInstances.get("PerTaskGroupChatPlugin")?.cardNotifier;
@@ -2514,7 +4430,7 @@ class LarkCliInstance {
       deleteGroupChat: (chatId, profile) => deleteGroupChatViaLarkCli(chatId, profile),
       notifier: sharedNotifier ?? new LarkCardPatchNotifier
     });
-    logger4.info(`[LarkCliInstance] card.action.trigger 端口已注入` + `（notifier ${sharedNotifier ? "复用插件共享实例" : "新建实例"}）`);
+    logger5.info(`[LarkCliInstance] card.action.trigger 端口已注入` + `（notifier ${sharedNotifier ? "复用插件共享实例" : "新建实例"}）`);
   }
   getPluginHookPoints(plugin) {
     if (Array.isArray(plugin.hooks)) {
@@ -2712,7 +4628,7 @@ class LarkCliInstance {
       }
       return null;
     } catch (err) {
-      logger4.warn(`[LarkCliInstance] resolveChatTaskBinding failed for chatId=${chatId}: ${err}. ` + `群消息将不会注入 parentTaskId。`);
+      logger5.warn(`[LarkCliInstance] resolveChatTaskBinding failed for chatId=${chatId}: ${err}. ` + `群消息将不会注入 parentTaskId。`);
       return null;
     }
   }
@@ -2734,7 +4650,7 @@ class LarkCliInstance {
   processStreamWith(data, buffer, opts = {}) {
     buffer.value += data;
     if (buffer.value.length > 2 * 1024 * 1024) {
-      logger4.warn(`[LarkCliInstance] stream 行缓冲超过 2MB 仍无换行，丢弃（疑似非 NDJSON 输出）`);
+      logger5.warn(`[LarkCliInstance] stream 行缓冲超过 2MB 仍无换行，丢弃（疑似非 NDJSON 输出）`);
       buffer.value = "";
       return;
     }
@@ -2770,12 +4686,12 @@ class LarkCliInstance {
       const now = Date.now();
       const lastShared = LarkCliInstance.SHARED_SEEN.get(dedupKey);
       if (lastShared !== undefined && now - lastShared < LarkCliInstance.SHARED_MSG_TTL_MS) {
-        logger4.warn(`[LarkCliInstance] duplicate lark-cli event suppressed across instances (event_id=${dedupKey}, ` + `lastSeen=${now - lastShared}ms ago). ` + `Task #4137: SHARED_SEEN 跨实例去重。`);
+        logger5.warn(`[LarkCliInstance] duplicate lark-cli event suppressed across instances (event_id=${dedupKey}, ` + `lastSeen=${now - lastShared}ms ago). ` + `Task #4137: SHARED_SEEN 跨实例去重。`);
         return;
       }
       const last = this.recentEventIds.get(dedupKey);
       if (last !== undefined && now - last < this.DEDUP_WINDOW_MS) {
-        logger4.warn(`[LarkCliInstance] duplicate lark-cli event suppressed (event_id=${dedupKey}, ` + `lastSeen=${now - last}ms ago). ` + `Task #3977/3978: 防止同一飞书事件触发两次任务创建。`);
+        logger5.warn(`[LarkCliInstance] duplicate lark-cli event suppressed (event_id=${dedupKey}, ` + `lastSeen=${now - last}ms ago). ` + `Task #3977/3978: 防止同一飞书事件触发两次任务创建。`);
         return;
       }
       LarkCliInstance.SHARED_SEEN.set(dedupKey, now);
@@ -2833,9 +4749,14 @@ class LarkCliInstance {
       const enrichedEvent = {
         ...rawEvent,
         profile: this.config.profile,
-        eventSourceId: this.config.id
+        eventSourceId: this.config.id,
+        channelPromptMode: this.config.channelPromptMode ?? "lean"
       };
       const { metadata, replyChannel, recommendedAction } = extractMetadata(enrichedEvent, eventType);
+      const channelSystemPrompt = this.getChannelSystemPrompt();
+      if (channelSystemPrompt !== undefined) {
+        metadata.systemPrompt = channelSystemPrompt;
+      }
       failureReplyChannel = replyChannel;
       const commandText = isCardAction ? undefined : extractCommandText(enrichedEvent);
       const parentTaskId = isCardAction ? null : await this.resolveChatTaskBinding(metadata?.chatId);
@@ -2888,6 +4809,7 @@ class LarkCliInstance {
           pluginEnabled,
           replyChannel,
           agent,
+          ...channelSystemPrompt !== undefined ? { systemPrompt: channelSystemPrompt } : {},
           parentTaskId: parentTaskId ?? undefined,
           ...triggerEventId ? { triggerEventId } : {},
           traceContext: eventTraceContext
@@ -2964,11 +4886,11 @@ class LarkCliInstance {
       const chatId = event.chat_id || "";
       const operatorId = event.operator_id?.open_id ?? event.operator_id ?? undefined;
       if (!token || !messageId || !chatId) {
-        logger4.warn(`[LarkCliInstance] handleCardActionEvent: missing token/messageId/chatId, skip`);
+        logger5.warn(`[LarkCliInstance] handleCardActionEvent: missing token/messageId/chatId, skip`);
         return;
       }
       if (!this.cardActionPorts) {
-        logger4.warn(`[LarkCliInstance] handleCardActionEvent: cardActionPorts 未注入，` + `card.action.trigger 事件被跳过。` + `调 instance.setCardActionPorts({getTask, updateTaskContext, createGroupChat, deleteGroupChat, notifier}) 注入。`);
+        logger5.warn(`[LarkCliInstance] handleCardActionEvent: cardActionPorts 未注入，` + `card.action.trigger 事件被跳过。` + `调 instance.setCardActionPorts({getTask, updateTaskContext, createGroupChat, deleteGroupChat, notifier}) 注入。`);
         return;
       }
       const result = await handleCardAction({
@@ -2983,10 +4905,10 @@ class LarkCliInstance {
         const patch = this.cardActionPorts.patchByToken ?? patchCardByLarkCli;
         await patch(token, result.cardUpdate, profile);
       } else {
-        logger4.warn(`[LarkCliInstance] handleCardActionEvent failed: ${result.error ?? "unknown"}`);
+        logger5.warn(`[LarkCliInstance] handleCardActionEvent failed: ${result.error ?? "unknown"}`);
       }
     } catch (err) {
-      logger4.error(`[LarkCliInstance] handleCardActionEvent error: ${err.message}`);
+      logger5.error(`[LarkCliInstance] handleCardActionEvent error: ${err.message}`);
     }
   }
   isCommandCardActionEvent(event) {
@@ -3102,7 +5024,7 @@ class LarkCliInstance {
       }
       await this.sendLarkText(output.text, profile, messageId, chatId);
     } catch (err) {
-      logger4.error(`[LarkCliInstance] handleCommandMessage error: ${err.message}`);
+      logger5.error(`[LarkCliInstance] handleCommandMessage error: ${err.message}`);
       try {
         const card = renderTextCard("⚠️ 命令执行异常", `命令处理时发生异常：${err.message}`);
         await this.sendLarkCard(card, profile, messageId, chatId);
@@ -3138,8 +5060,8 @@ class LarkCliInstance {
     if (profile) {
       args.unshift("--profile", profile);
     }
-    await new Promise((resolve, reject) => {
-      const proc = spawn2("lark-cli", args, {
+    await new Promise((resolve2, reject) => {
+      const proc = spawn3("lark-cli", args, {
         shell: false,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -3149,7 +5071,7 @@ class LarkCliInstance {
       });
       proc.on("close", (code) => {
         if (code === 0)
-          resolve();
+          resolve2();
         else
           reject(new Error(`lark-cli exited with code ${code}: ${stderr}`));
       });
@@ -3223,7 +5145,7 @@ class LarkCliInstance {
     };
   }
   async sendLarkMessage(options) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const { chatId, userId, messageId, content, format = "text", profile } = options;
       const normalizedContent = normalizeLarkAtMentions(content);
       const contentFlag = format === "markdown" ? "--markdown" : "--text";
@@ -3241,7 +5163,7 @@ class LarkCliInstance {
       if (profile) {
         args.unshift("--profile", profile);
       }
-      const proc = spawn2("lark-cli", args, {
+      const proc = spawn3("lark-cli", args, {
         shell: false,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -3255,7 +5177,7 @@ class LarkCliInstance {
       });
       proc.on("close", (code) => {
         if (code === 0) {
-          resolve();
+          resolve2();
         } else {
           reject(new Error(`lark-cli exited with code ${code}: ${stderr}`));
         }
@@ -3392,7 +5314,7 @@ var larkCliHandler = {
   },
   async emitTriggerEvent(payload, store) {
     const eventId = await store.insertTriggerEvent(payload, "lark-cli");
-    logger4.info(`[larkCliHandler] emitTriggerEvent: id=${eventId}`, {
+    logger5.info(`[larkCliHandler] emitTriggerEvent: id=${eventId}`, {
       chatId: payload.metadata?.chatId,
       senderId: payload.senderId
     });
@@ -3407,7 +5329,7 @@ var larkCliHandler = {
     try {
       const result = await runner.run(command);
       if (result.code !== 0) {
-        logger4.error(`[larkCliHandler] replyMessage non-zero exit`, {
+        logger5.error(`[larkCliHandler] replyMessage non-zero exit`, {
           code: result.code,
           stderr: result.stderr
         });
@@ -3421,7 +5343,7 @@ var larkCliHandler = {
       return { success: true, messageId: replyMessageId };
     } catch (err) {
       const errMsg = err instanceof Error ? err.message : String(err);
-      logger4.error(`[larkCliHandler] replyMessage spawn error`, { error: errMsg });
+      logger5.error(`[larkCliHandler] replyMessage spawn error`, { error: errMsg });
       return { success: false, error: errMsg };
     }
   },
@@ -3526,10 +5448,10 @@ async function patchCardByLarkCli(token, card, profile) {
   const cmd = `lark-cli ${profileFlag}api POST /open-apis/interactive/v1/card/update ` + `--data '${JSON.stringify({ token, card }).replace(/'/g, "'\\''")}' --as bot`;
   try {
     const { stdout } = await execAsync2(cmd, { timeout: 30000 });
-    logger4.debug(`patchCardByLarkCli ok: ${stdout?.slice(0, 200)}`);
+    logger5.debug(`patchCardByLarkCli ok: ${stdout?.slice(0, 200)}`);
   } catch (err) {
     const msg = err.message;
-    logger4.error(`patchCardByLarkCli failed: ${msg}`);
+    logger5.error(`patchCardByLarkCli failed: ${msg}`);
     throw new Error(`卡片刷新失败：${msg}`);
   }
 }
@@ -3538,10 +5460,11 @@ var builtInHandlers = [
   timerHandler,
   bountyIMHandler,
   bountyCliHandler,
-  cliCommandHandler
+  cliCommandHandler,
+  wecomCliHandler
 ];
 function getBuiltInHandler(type) {
   return builtInHandlers.find((h) => h.type === type);
 }
 
-export { TimerInstance, timerHandler, buildDefaultBountyIMSystemPrompt, resolveBountyIMSystemPrompt, BountyIMInstance, bountyIMHandler, bountyCliHandler, FALLBACK_MODEL_ACTION_NS, FALLBACK_MODEL_ACTIONS, isFallbackModelCard, renderTextCard, renderFallbackModelCard, DEFAULT_CONFIG_PATH, readFallbackModelList, readRawFallbackModelArray, writeFallbackModelList, fallbackModelCommand, listCommand, COMMAND_PREFIX, isCommandMessage, extractCommandInvocation, CommandRegistry, getGlobalCommandRegistry, handleCommandMessage, isCommandCardAction, translateCardActionToCommand, handleCommandCardAction, buildLarkRecommendedAction, extractMetadata, LarkCliInstance, renderRuleNoticeSection, extractCommandText, larkCliHandler, patchCardByLarkCli, builtInHandlers, getBuiltInHandler };
+export { TimerInstance, timerHandler, buildDefaultBountyIMSystemPrompt, resolveBountyIMSystemPrompt, BountyIMInstance, bountyIMHandler, bountyCliHandler, sanitizeWecomFrame, WECOM_CLI_ES_TYPE, WECOM_CHAT_ID_PREFIX, WECOM_WS_DEFAULT_URL, readWecomCliConfig, WECOM_CREDENTIALS_DEFAULT_PATH, readWecomCredentialsFile, resolveWecomCredentials, buildWecomReplyChannel, parseWecomFrame, WECOM_CHANNEL_PROMPT_SECTION_TITLE, buildWecomChannelSystemPrompt, buildWecomNotifyPrompt, resolveWecomBinary, probeCommandBinary, wecomCliHandler, FALLBACK_MODEL_ACTION_NS, FALLBACK_MODEL_ACTIONS, isFallbackModelCard, renderTextCard, renderFallbackModelCard, DEFAULT_CONFIG_PATH, readFallbackModelList, readRawFallbackModelArray, writeFallbackModelList, fallbackModelCommand, listCommand, resolveEsFilePath, esCommand, COMMAND_PREFIX, isCommandMessage, extractCommandInvocation, CommandRegistry, getGlobalCommandRegistry, handleCommandMessage, isCommandCardAction, translateCardActionToCommand, handleCommandCardAction, buildLarkRecommendedAction, LARK_CHANNEL_PROMPT_SECTION_TITLE, LARK_PROMPT_LENGTH_BUDGET, buildLarkChannelSystemPrompt, resolveLarkChannelSystemPrompt, extractMetadata, LarkCliInstance, renderRuleNoticeSection, extractCommandText, larkCliHandler, patchCardByLarkCli, builtInHandlers, getBuiltInHandler };