@clawos-dev/clawd 0.2.107-beta.204.07ae519 → 0.2.108-beta.205.1e8d4c5

package/dist/cli.cjs

@@ -180,7 +180,13 @@ var init_methods = __esm({
       // guest-self: guest 在自己 daemon 上做安装与更新（ADMIN_ANY，guest 是 owner of self daemon）.
       // 无 subscription 持久化：guest 端身份完全来自文件系统 + reconciled publishedExtensions.
       "extension.install-from-channel",
-      "extension.update-from-channel"
+      "extension.update-from-channel",
+      // ---- auth:* 飞书统一身份 Phase 1 (spec 2026-06-01-feishu-identity-design) ----
+      // owner-only：daemon loopback 登录流程（auth:login:start 起 state → HTTP /auth/callback
+      // 回调落盘 → auth:login:done 事件）。中央字面量见 protocol/feishu-auth.ts FEISHU_AUTH_METHODS。
+      "auth:login:start",
+      "auth:getIdentity",
+      "auth:logout"
     ];
   }
 });
@@ -242,7 +248,11 @@ var init_errors = __esm({
       INTERNAL: "INTERNAL",
       UNAUTHORIZED: "UNAUTHORIZED",
       FORBIDDEN: "FORBIDDEN",
-      INVALID_PARAM: "INVALID_PARAM"
+      INVALID_PARAM: "INVALID_PARAM",
+      // 飞书统一身份（spec 2026-06-01 决策 #9）：People/远程体系强制飞书登录。
+      // daemon 进程身份未激活为飞书 unionId 时，FEISHU_GATED_METHODS 内的 RPC 一律返回此错误；
+      // UI 据此显示登录引导（区别于 UNAUTHORIZED 的越权语义）。
+      FEISHU_LOGIN_REQUIRED: "FEISHU_LOGIN_REQUIRED"
     };
     ClawdError = class extends Error {
       constructor(code, message) {
@@ -672,8 +682,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path59, errorMaps, issueData } = params;
-      const fullPath = [...path59, ...issueData.path || []];
+      const { data, path: path60, errorMaps, issueData } = params;
+      const fullPath = [...path60, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -984,11 +994,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path59, key) {
+      constructor(parent, value, path60, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path59;
+        this._path = path60;
         this._key = key;
       }
       get path() {
@@ -4522,7 +4532,7 @@ var init_persona_schemas = __esm({
 });
 
 // ../protocol/src/schemas.ts
-var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, PeerSessionUpsertArgs, PeerSessionUpsertResponseSchema, PeerSessionRemoveArgs, PeerSessionRemoveResponseSchema, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelReadyEventSchema, TunnelExitedEventSchema, TunnelUnavailableEventSchema, InfoRunningSessionSchema, InfoResponseSchema;
+var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, PeerSessionUpsertArgs, PeerSessionUpsertResponseSchema, PeerSessionRemoveArgs, PeerSessionRemoveResponseSchema, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelExitedEventSchema, TunnelUnavailableEventSchema, InfoRunningSessionSchema, InfoResponseSchema;
 var init_schemas = __esm({
   "../protocol/src/schemas.ts"() {
     "use strict";
@@ -5102,6 +5112,12 @@ var init_schemas = __esm({
        * 后调 capabilityManager.recordPeerHello(capId, ownerPrincipalId, displayName)
        * 把 cap.peerOwnerId / firstUsedByPeerAt 字段回写，让 owner 端 UI 在 People
        * tab 顶层 PeerOwner 视图 + Personas tab 二级分组拿到对端身份。
+       *
+       * 飞书统一身份 Phase 1 (2026-06-01)：取值升级为飞书 union_id（owner 已飞书登录时；
+       * 来自 whoami.owner.id → daemon ownerPrincipalId → owner-identity.json unionId）。
+       * 未登录 daemon 仍为 auth.json 的 owner-<uuid>。daemon 端不验证该身份真实性
+       * （Phase 1 信任模型，见 spec §9）。Phase 2 将以 connect token 替代（introspect
+       * 返回身份，删除自报字段，见 spec §10）。
        */
       selfPrincipalId: external_exports.string().min(1).optional(),
       /**
@@ -5116,11 +5132,6 @@ var init_schemas = __esm({
       version: external_exports.string().min(1).optional(),
       protocolVersion: external_exports.number().int().nonnegative().optional()
     });
-    TunnelReadyEventSchema = external_exports.object({
-      type: external_exports.literal("tunnel:ready"),
-      url: external_exports.string().min(1),
-      subdomain: external_exports.string().min(1)
-    });
     TunnelExitedEventSchema = external_exports.object({
       type: external_exports.literal("tunnel:exited"),
       code: external_exports.number().int().nullable(),
@@ -5570,6 +5581,64 @@ var init_extension = __esm({
   }
 });
 
+// ../protocol/src/feishu-auth.ts
+var FEISHU_GATED_METHODS, FeishuIdentitySchema, AuthLoginStartResponseSchema, AuthGetIdentityResponseSchema, AuthLogoutResponseSchema, AuthLoginDoneEventSchema, AuthLoginFailedEventSchema;
+var init_feishu_auth = __esm({
+  "../protocol/src/feishu-auth.ts"() {
+    "use strict";
+    init_zod();
+    FEISHU_GATED_METHODS = [
+      // capability / 邀请码（生成添加码 = 把自己的身份分享出去）
+      "capability:list",
+      "capability:delete",
+      "personal-cap:get",
+      // 联系人（添加朋友 / 联系人列表 / 自动重连）
+      "received-capability:list",
+      "received-capability:add",
+      "received-capability:remove",
+      "received-capability:autoAttach",
+      // DM / 跨用户通知
+      "inbox:list",
+      "inbox:markRead",
+      "inbox:postMessage",
+      // mirror peer sessions（远端会话镜像）
+      "peerSession:upsert",
+      "peerSession:remove"
+    ];
+    FeishuIdentitySchema = external_exports.object({
+      /** 飞书 union_id（租户维度，跨应用稳定）。TTC user_info 接口 data.union_id */
+      unionId: external_exports.string().min(1),
+      /** 飞书姓名。TTC user_info 接口 data.name */
+      displayName: external_exports.string().min(1),
+      /** TTC user_info 接口 data.avatar_url，可缺省 */
+      avatarUrl: external_exports.string().optional()
+    });
+    AuthLoginStartResponseSchema = external_exports.object({
+      type: external_exports.literal("auth:login:start:ok"),
+      /** 完整 TTC 授权页 URL（含 callback_url + state + auto=1），UI 直接 window.open */
+      authUrl: external_exports.string().min(1),
+      /** 防 CSRF 的一次性 nonce；回调时 daemon 校验 */
+      state: external_exports.string().min(1)
+    });
+    AuthGetIdentityResponseSchema = external_exports.object({
+      type: external_exports.literal("auth:getIdentity:ok"),
+      /** null = 未登录 */
+      identity: FeishuIdentitySchema.nullable()
+    });
+    AuthLogoutResponseSchema = external_exports.object({
+      type: external_exports.literal("auth:logout:ok")
+    });
+    AuthLoginDoneEventSchema = external_exports.object({
+      type: external_exports.literal("auth:login:done"),
+      identity: FeishuIdentitySchema
+    });
+    AuthLoginFailedEventSchema = external_exports.object({
+      type: external_exports.literal("auth:login:failed"),
+      reason: external_exports.string()
+    });
+  }
+});
+
 // ../protocol/src/runtime.ts
 var init_runtime = __esm({
   "../protocol/src/runtime.ts"() {
@@ -5587,6 +5656,7 @@ var init_runtime = __esm({
     init_inbox();
     init_received_capability();
     init_extension();
+    init_feishu_auth();
   }
 });
 
@@ -5861,8 +5931,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path59 = req.path;
-        _req.url = typeof path59 === "string" ? path59 : req.url ? req.url.path || req.url : void 0;
+        const path60 = req.path;
+        _req.url = typeof path60 === "string" ? path60 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -6027,14 +6097,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path59) {
+    function parsePath(path60) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path59.length; i++) {
-        const char = path59[i];
+      for (let i = 0; i < path60.length; i++) {
+        const char = path60[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -6165,10 +6235,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path59 of paths) {
-        const parts = parsePath(path59);
+      for (const path60 of paths) {
+        const parts = parsePath(path60);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path59, remove);
+          redactWildcardPath(obj, parts, censor, path60, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -6253,8 +6323,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path59) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path59];
+            const wrappedCensor = typeof censor === "function" ? (value, path60) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path60];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -6289,8 +6359,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path59 of pathsToClone) {
-        const parts = parsePath(path59);
+      for (const path60 of pathsToClone) {
+        const parts = parsePath(path60);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -6342,24 +6412,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path59) {
-      if (typeof path59 !== "string") {
+    function validatePath(path60) {
+      if (typeof path60 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path59 === "") {
+      if (path60 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path59.includes("..")) {
-        throw new Error(`Invalid redaction path (${path59})`);
+      if (path60.includes("..")) {
+        throw new Error(`Invalid redaction path (${path60})`);
       }
-      if (path59.includes(",")) {
-        throw new Error(`Invalid redaction path (${path59})`);
+      if (path60.includes(",")) {
+        throw new Error(`Invalid redaction path (${path60})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path59.length; i++) {
-        const char = path59[i];
+      for (let i = 0; i < path60.length; i++) {
+        const char = path60[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -6373,20 +6443,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path59})`);
+            throw new Error(`Invalid redaction path (${path60})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path59})`);
+        throw new Error(`Invalid redaction path (${path60})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path59 of paths) {
-        validatePath(path59);
+      for (const path60 of paths) {
+        validatePath(path60);
       }
     }
     function slowRedact(options = {}) {
@@ -6554,8 +6624,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path59) => {
-            return censor(value, [k2, ...path59]);
+          const wrappedCensor = typeof censor === "function" ? (value, path60) => {
+            return censor(value, [k2, ...path60]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -6773,10 +6843,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs47 = require("fs");
+    var fs48 = require("fs");
     var EventEmitter2 = require("events");
     var inherits = require("util").inherits;
-    var path59 = require("path");
+    var path60 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -6830,20 +6900,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs47.mkdirSync(path59.dirname(file), { recursive: true });
-          const fd = fs47.openSync(file, flags, mode);
+          if (sonic.mkdir) fs48.mkdirSync(path60.dirname(file), { recursive: true });
+          const fd = fs48.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs47.mkdir(path59.dirname(file), { recursive: true }, (err) => {
+        fs48.mkdir(path60.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs47.open(file, flags, mode, fileOpened);
+          fs48.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs47.open(file, flags, mode, fileOpened);
+        fs48.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -6884,8 +6954,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs47.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs47.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs48.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs48.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -6894,15 +6964,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs47.writeSync(this.fd, this._writingBuf);
+            return fs48.writeSync(this.fd, this._writingBuf);
           }
-          return fs47.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs48.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs47.write(this.fd, this._writingBuf, this.release);
+            return fs48.write(this.fd, this._writingBuf, this.release);
           }
-          return fs47.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs48.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -6959,7 +7029,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs47.fsyncSync(this.fd);
+          fs48.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -7073,7 +7143,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs47.fsync(this.fd, (err) => {
+            fs48.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -7175,7 +7245,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs47.close(fd, (err) => {
+          fs48.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -7224,7 +7294,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs47.writeSync(this.fd, buf) : fs47.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs48.writeSync(this.fd, buf) : fs48.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -7240,7 +7310,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs47.fsyncSync(this.fd);
+        fs48.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -7261,7 +7331,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs47.writeSync(this.fd, buf);
+          const n = fs48.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -7289,13 +7359,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs47.writeSync(this.fd, this._writingBuf) : fs47.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs48.writeSync(this.fd, this._writingBuf) : fs48.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs47.write(this.fd, this._writingBuf, release);
+        fs48.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -7304,7 +7374,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs47.writeSync(this.fd, this._writingBuf);
+          const written = fs48.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -7313,7 +7383,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs47.write(this.fd, this._writingBuf, release);
+        fs48.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -7329,12 +7399,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs47.fsync(sonic.fd, closeWrapped);
+        fs48.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs47.close(sonic.fd, done);
+          fs48.close(sonic.fd, done);
         } else {
           done();
         }
@@ -10469,11 +10539,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path59, added, removed, oldPosInc, options) {
-        var last = path59.lastComponent;
+      addToPath: function addToPath(path60, added, removed, oldPosInc, options) {
+        var last = path60.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path59.oldPos + oldPosInc,
+            oldPos: path60.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -10483,7 +10553,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path59.oldPos + oldPosInc,
+            oldPos: path60.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -10929,10 +10999,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path59 = typeof rec.path === "string" ? rec.path : null;
+      const path60 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path59 || content == null) return null;
-      const entry = { path: path59, content };
+      if (!path60 || content == null) return null;
+      const entry = { path: path60, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -11763,10 +11833,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path59 = typeof rec.path === "string" ? rec.path : null;
+      const path60 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path59 || content == null) return null;
-      const out = { path: path59, content };
+      if (!path60 || content == null) return null;
+      const out = { path: path60, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -19262,8 +19332,8 @@ var require_websocket = __commonJS({
     "use strict";
     var EventEmitter2 = require("events");
     var https = require("https");
-    var http3 = require("http");
-    var net3 = require("net");
+    var http2 = require("http");
+    var net2 = require("net");
     var tls = require("tls");
     var { randomBytes, createHash: createHash2 } = require("crypto");
     var { Duplex, Readable: Readable3 } = require("stream");
@@ -19796,7 +19866,7 @@ var require_websocket = __commonJS({
       }
       const defaultPort = isSecure ? 443 : 80;
       const key = randomBytes(16).toString("base64");
-      const request = isSecure ? https.request : http3.request;
+      const request = isSecure ? https.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
       opts.createConnection = opts.createConnection || (isSecure ? tlsConnect : netConnect);
@@ -19997,12 +20067,12 @@ var require_websocket = __commonJS({
     }
     function netConnect(options) {
       options.path = options.socketPath;
-      return net3.connect(options);
+      return net2.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net3.isIP(options.host) ? "" : options.host;
+        options.servername = net2.isIP(options.host) ? "" : options.host;
       }
       return tls.connect(options);
     }
@@ -20290,7 +20360,7 @@ var require_websocket_server = __commonJS({
   "../node_modules/.pnpm/ws@8.20.0/node_modules/ws/lib/websocket-server.js"(exports2, module2) {
     "use strict";
     var EventEmitter2 = require("events");
-    var http3 = require("http");
+    var http2 = require("http");
     var { Duplex } = require("stream");
     var { createHash: createHash2 } = require("crypto");
     var extension2 = require_extension();
@@ -20365,8 +20435,8 @@ var require_websocket_server = __commonJS({
           );
         }
         if (options.port != null) {
-          this._server = http3.createServer((req, res) => {
-            const body = http3.STATUS_CODES[426];
+          this._server = http2.createServer((req, res) => {
+            const body = http2.STATUS_CODES[426];
             res.writeHead(426, {
               "Content-Length": body.length,
               "Content-Type": "text/plain"
@@ -20653,7 +20723,7 @@ var require_websocket_server = __commonJS({
       this.destroy();
     }
     function abortHandshake(socket, code, message, headers) {
-      message = message || http3.STATUS_CODES[code];
+      message = message || http2.STATUS_CODES[code];
       headers = {
         Connection: "close",
         "Content-Type": "text/html",
@@ -20662,7 +20732,7 @@ var require_websocket_server = __commonJS({
       };
       socket.once("finish", socket.destroy);
       socket.end(
-        `HTTP/1.1 ${code} ${http3.STATUS_CODES[code]}\r
+        `HTTP/1.1 ${code} ${http2.STATUS_CODES[code]}\r
 ` + Object.keys(headers).map((h) => `${h}: ${headers[h]}`).join("\r\n") + "\r\n\r\n" + message
       );
     }
@@ -23555,8 +23625,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path59) {
-      var parts = path59.split("/");
+    exports2.resolve = function(path60) {
+      var parts = path60.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -29409,18 +29479,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path59) {
-      if (path59.slice(-1) === "/") {
-        path59 = path59.substring(0, path59.length - 1);
+    var parentFolder = function(path60) {
+      if (path60.slice(-1) === "/") {
+        path60 = path60.substring(0, path60.length - 1);
       }
-      var lastSlash = path59.lastIndexOf("/");
-      return lastSlash > 0 ? path59.substring(0, lastSlash) : "";
+      var lastSlash = path60.lastIndexOf("/");
+      return lastSlash > 0 ? path60.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path59) {
-      if (path59.slice(-1) !== "/") {
-        path59 += "/";
+    var forceTrailingSlash = function(path60) {
+      if (path60.slice(-1) !== "/") {
+        path60 += "/";
       }
-      return path59;
+      return path60;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -30422,7 +30492,7 @@ var require_lib3 = __commonJS({
 // src/run-case/recorder.ts
 function startRunCaseRecorder(opts) {
   const now = opts.now ?? Date.now;
-  const dir = import_node_path45.default.dirname(opts.recordPath);
+  const dir = import_node_path46.default.dirname(opts.recordPath);
   let stream = null;
   let closing = false;
   let closedSettled = false;
@@ -30436,8 +30506,8 @@ function startRunCaseRecorder(opts) {
   });
   const ensureStream = () => {
     if (stream) return stream;
-    import_node_fs30.default.mkdirSync(dir, { recursive: true });
-    stream = import_node_fs30.default.createWriteStream(opts.recordPath, { flags: "a" });
+    import_node_fs31.default.mkdirSync(dir, { recursive: true });
+    stream = import_node_fs31.default.createWriteStream(opts.recordPath, { flags: "a" });
     stream.on("close", () => closedResolve());
     return stream;
   };
@@ -30462,12 +30532,12 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs30, import_node_path45;
+var import_node_fs31, import_node_path46;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
-    import_node_fs30 = __toESM(require("fs"), 1);
-    import_node_path45 = __toESM(require("path"), 1);
+    import_node_fs31 = __toESM(require("fs"), 1);
+    import_node_path46 = __toESM(require("path"), 1);
   }
 });
 
@@ -30510,7 +30580,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs31.mkdtempSync)(import_node_path46.default.join(import_node_os19.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs32.mkdtempSync)(import_node_path47.default.join(import_node_os19.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -30671,19 +30741,19 @@ async function runController(opts) {
   if (sigintHandler) process.off("SIGINT", sigintHandler);
   if (ownsCwd) {
     try {
-      (0, import_node_fs31.rmSync)(cwd, { recursive: true, force: true });
+      (0, import_node_fs32.rmSync)(cwd, { recursive: true, force: true });
     } catch {
     }
   }
   return exitCode ?? 0;
 }
-var import_node_fs31, import_node_os19, import_node_path46;
+var import_node_fs32, import_node_os19, import_node_path47;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
-    import_node_fs31 = require("fs");
+    import_node_fs32 = require("fs");
     import_node_os19 = __toESM(require("os"), 1);
-    import_node_path46 = __toESM(require("path"), 1);
+    import_node_path47 = __toESM(require("path"), 1);
     init_claude();
     init_stdout_splitter();
     init_permission_stdio();
@@ -30875,8 +30945,6 @@ function resolveConfig(opts) {
   const frpcBinary = env.CLAWD_FRPC_BIN ?? null;
   const rawMode = env.CLAWD_CC_MODE;
   const mode = DAEMON_MODE_VALUES.includes(rawMode ?? "") ? rawMode : "sdk";
-  const filePreviewPorts = Array.isArray(fileCfg.previewPorts) ? fileCfg.previewPorts.map((n) => Number(n)).filter((n) => Number.isInteger(n) && n > 0) : null;
-  const previewPorts = env.CLAWD_PREVIEW_PORTS ? env.CLAWD_PREVIEW_PORTS.split(",").map((s) => Number(s.trim())).filter((n) => Number.isInteger(n) && n > 0) : filePreviewPorts && filePreviewPorts.length > 0 ? filePreviewPorts : null;
   return {
     port,
     host,
@@ -30888,8 +30956,7 @@ function resolveConfig(opts) {
     authToken,
     noTunnelPersist,
     frpcBinary,
-    mode,
-    previewPorts
+    mode
   };
 }
 var HELP_TEXT = `clawd [options]
@@ -30918,8 +30985,8 @@ Env (advanced):
 `;
 
 // src/index.ts
-var import_node_path44 = __toESM(require("path"), 1);
-var import_node_fs29 = __toESM(require("fs"), 1);
+var import_node_path45 = __toESM(require("path"), 1);
+var import_node_fs30 = __toESM(require("fs"), 1);
 
 // src/logger.ts
 var import_node_fs2 = __toESM(require("fs"), 1);
@@ -36260,63 +36327,13 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
 // src/transport/local-ws-server.ts
-var import_node_http2 = __toESM(require("http"), 1);
-
-// src/transport/preview-proxy.ts
 var import_node_http = __toESM(require("http"), 1);
-var import_node_net = __toESM(require("net"), 1);
-var PREVIEW_RE = /^\/preview\/(\d+)(?:\/.*)?$/;
-function matchPreviewPort(pathname) {
-  const m2 = pathname.match(PREVIEW_RE);
-  return m2 ? Number(m2[1]) : null;
-}
-function isPreviewPortAllowed(port, cfg) {
-  return cfg.allowedPorts.includes(port);
-}
-function proxyPreviewHttp(req, res, port) {
-  return new Promise((resolve6) => {
-    const upstream = import_node_http.default.request(
-      { host: "localhost", port, method: req.method, path: req.url, headers: req.headers },
-      (upRes) => {
-        res.writeHead(upRes.statusCode || 502, upRes.headers);
-        upRes.pipe(res);
-        upRes.on("end", () => resolve6());
-      }
-    );
-    upstream.on("error", (e) => {
-      if (!res.headersSent) {
-        res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
-      }
-      res.end(`preview upstream error: ${e.message}`);
-      resolve6();
-    });
-    req.pipe(upstream);
-  });
-}
-function proxyPreviewUpgrade(req, socket, head, port) {
-  const upstream = import_node_net.default.connect(port, "localhost", () => {
-    let raw = `${req.method} ${req.url} HTTP/1.1\r
-`;
-    for (let i = 0; i < req.rawHeaders.length; i += 2) {
-      raw += `${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}\r
-`;
-    }
-    raw += "\r\n";
-    upstream.write(raw);
-    if (head && head.length) upstream.write(head);
-    upstream.pipe(socket);
-    socket.pipe(upstream);
-  });
-  upstream.on("error", () => socket.destroy());
-  socket.on("error", () => upstream.destroy());
-}
-
-// src/transport/local-ws-server.ts
 var LocalWsServer = class {
   constructor(opts) {
     this.opts = opts;
     this.logger = opts.logger;
     this.pingIntervalMs = opts.pingIntervalMs ?? 3e4;
+    this.currentOwnerPrincipalId = opts.ownerPrincipalId;
   }
   opts;
   wss = null;
@@ -36328,28 +36345,19 @@ var LocalWsServer = class {
   capabilityIdToClients = /* @__PURE__ */ new Map();
   logger;
   pingIntervalMs;
+  // 飞书热切换（spec 决策 #9，2026-06-01 拍板）：登录后实时更新，broadcastToPrincipal
+  // 路由用最新身份；初始值来自 opts.ownerPrincipalId
+  currentOwnerPrincipalId;
+  /** 飞书热切换：登录回调成功后由 daemon wiring 调用，更新 DM 路由身份 */
+  setOwnerPrincipalId(id) {
+    this.currentOwnerPrincipalId = id;
+  }
   async start() {
     const host = this.opts.host ?? "127.0.0.1";
     await new Promise((resolve6, reject) => {
-      const httpServer = import_node_http2.default.createServer((req, res) => this.handleHttpRequest(req, res));
+      const httpServer = import_node_http.default.createServer((req, res) => this.handleHttpRequest(req, res));
       const wss = new import_websocket_server.default({ noServer: true, clientTracking: true });
       httpServer.on("upgrade", (req, socket, head) => {
-        if (req.url?.startsWith("/preview/")) {
-          const pathname = (() => {
-            try {
-              return new URL(req.url, "http://localhost").pathname;
-            } catch {
-              return "/";
-            }
-          })();
-          const port = matchPreviewPort(pathname);
-          if (port != null && (this.opts.previewPorts ?? []).includes(port)) {
-            proxyPreviewUpgrade(req, socket, head, port);
-          } else {
-            socket.destroy();
-          }
-          return;
-        }
         wss.handleUpgrade(req, socket, head, (ws) => {
           this.routeConnection(ws, req);
         });
@@ -36463,7 +36471,7 @@ var LocalWsServer = class {
   //   principalId === 'cap_xxx'         → 该 capability 的所有 guest ws (多端 / 多 tab)
   // 用于 DM inbox:event 路由: from + to 两侧各播一次, 让双方 UI 实时看到 thread 更新.
   broadcastToPrincipal(principalId, frame) {
-    if (principalId === "owner" || principalId === this.opts.ownerPrincipalId) {
+    if (principalId === "owner" || principalId === this.currentOwnerPrincipalId) {
       this.broadcastToOwners(frame);
       return;
     }
@@ -36515,6 +36523,21 @@ var LocalWsServer = class {
   getClientContext(clientId) {
     return this.clients.get(clientId)?.ctx ?? null;
   }
+  // 飞书热切换（spec 决策 #9）：身份切换后踢掉所有连接强制重连——在线连接的 ctx
+  // （attachClientContext 时绑定）持有旧身份，重连后用新身份重建。
+  // close code 4408（非 4401！4401 = token 撤销，客户端会停止重连）：
+  // 客户端按普通断连处理 → 自动重连 → 新身份 ctx。
+  closeAllClients(code = 4408, reason = "IDENTITY_SWITCHED") {
+    const ids = [...this.clients.keys()];
+    for (const id of ids) {
+      const c = this.clients.get(id);
+      if (!c) continue;
+      try {
+        c.ws.close(code, reason);
+      } catch {
+      }
+    }
+  }
   // Task 1.10 撤销级联：关闭某 capability 的所有活跃 ws 连接。close code 4401
   // 让客户端识别 'capability revoked' 而非普通断连。
   closeConnectionsByCapability(capabilityId, code = 4401, reason = "TOKEN_REVOKED") {
@@ -37997,13 +38020,23 @@ function createHttpRouter(deps) {
       });
       return true;
     }
-    if (url.pathname.startsWith("/preview/")) {
-      const port = matchPreviewPort(url.pathname);
-      if (port != null && isPreviewPortAllowed(port, { allowedPorts: deps.previewPorts ?? [] })) {
-        await proxyPreviewHttp(req, res, port);
+    if (url.pathname === "/auth/callback") {
+      if (req.method !== "GET") {
+        sendJson(res, 404, { code: "NOT_FOUND", message: `no route for ${req.method} ${url.pathname}` });
+        return true;
+      }
+      if (!deps.feishuLogin) {
+        sendJson(res, 501, { code: "NOT_IMPLEMENTED", message: "feishu login not wired" });
         return true;
       }
-      sendJson(res, 403, { code: "PREVIEW_PORT_FORBIDDEN", message: "preview port not allowed" });
+      const result = await deps.feishuLogin.handleLoginCallback({
+        token: url.searchParams.get("token") ?? "",
+        state: url.searchParams.get("state") ?? "",
+        expiresAt: url.searchParams.get("expires_at")
+      });
+      const html = result.ok ? `<!doctype html><meta charset="utf-8"><title>clawd</title><style>body{font-family:-apple-system,sans-serif;padding:48px;color:#222}</style><h2>\u767B\u5F55\u6210\u529F\uFF0C\u53EF\u5173\u95ED\u6B64\u9875\u3002</h2><p>\u8EAB\u4EFD\uFF1A${escapeHtml(result.identity.displayName)}</p><script>setTimeout(()=>window.close(),1500)</script>` : `<!doctype html><meta charset="utf-8"><title>clawd</title><style>body{font-family:-apple-system,sans-serif;padding:48px;color:#922}</style><h2>\u767B\u5F55\u5931\u8D25</h2><p>${escapeHtml(result.reason)}</p>`;
+      res.writeHead(result.ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(html);
       return true;
     }
     if (!url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/") && url.pathname !== "/attachments/upload" && url.pathname !== "/extensions/import") {
@@ -38241,6 +38274,9 @@ function parseUrl(rawUrl) {
     return null;
   }
 }
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
 function sendJson(res, status, body, extraHeaders) {
   res.writeHead(status, {
     "Content-Type": "application/json; charset=utf-8",
@@ -39263,6 +39299,160 @@ function loadOwnerDisplayName(dataDir) {
   return displayName;
 }
 
+// src/feishu-auth/owner-identity-store.ts
+var import_node_fs27 = __toESM(require("fs"), 1);
+var import_node_path31 = __toESM(require("path"), 1);
+var OWNER_IDENTITY_FILE_NAME = "owner-identity.json";
+var OwnerIdentityStore = class {
+  file;
+  constructor(dataDir) {
+    this.file = import_node_path31.default.join(dataDir, OWNER_IDENTITY_FILE_NAME);
+  }
+  read() {
+    let raw;
+    try {
+      raw = import_node_fs27.default.readFileSync(this.file, "utf8");
+    } catch {
+      return null;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    const r = parsed;
+    if (!r.identity || typeof r.identity.unionId !== "string" || r.identity.unionId.length === 0 || typeof r.identity.displayName !== "string" || r.identity.displayName.length === 0 || typeof r.ttcToken !== "string" || r.ttcToken.length === 0) {
+      return null;
+    }
+    return {
+      identity: {
+        unionId: r.identity.unionId,
+        displayName: r.identity.displayName,
+        ...typeof r.identity.avatarUrl === "string" ? { avatarUrl: r.identity.avatarUrl } : {}
+      },
+      ttcToken: r.ttcToken,
+      ttcTokenExpiresAt: typeof r.ttcTokenExpiresAt === "number" ? r.ttcTokenExpiresAt : null,
+      loginAt: typeof r.loginAt === "string" ? r.loginAt : (/* @__PURE__ */ new Date(0)).toISOString()
+    };
+  }
+  write(record) {
+    import_node_fs27.default.mkdirSync(import_node_path31.default.dirname(this.file), { recursive: true });
+    import_node_fs27.default.writeFileSync(this.file, JSON.stringify(record, null, 2), { mode: 384 });
+    try {
+      import_node_fs27.default.chmodSync(this.file, 384);
+    } catch {
+    }
+  }
+  clear() {
+    try {
+      import_node_fs27.default.unlinkSync(this.file);
+    } catch (err) {
+      const code = err?.code;
+      if (code !== "ENOENT") throw err;
+    }
+  }
+};
+
+// src/feishu-auth/login-flow.ts
+var import_node_crypto11 = __toESM(require("crypto"), 1);
+var STATE_TTL_MS = 5 * 60 * 1e3;
+var LoginFlow = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  pendingStates = /* @__PURE__ */ new Map();
+  start() {
+    const state = import_node_crypto11.default.randomBytes(16).toString("base64url");
+    const now = (this.deps.now ?? Date.now)();
+    this.pendingStates.set(state, now);
+    this.gcExpired(now);
+    const url = new URL("/auth/authorize", this.deps.ttcAuthBase);
+    url.searchParams.set("callback_url", this.deps.getCallbackUrl());
+    url.searchParams.set("state", state);
+    url.searchParams.set("auto", "1");
+    return { authUrl: url.toString(), state };
+  }
+  async handleCallback(params) {
+    const now = (this.deps.now ?? Date.now)();
+    const issuedAt = this.pendingStates.get(params.state);
+    if (issuedAt === void 0) {
+      return { ok: false, reason: "state mismatch" };
+    }
+    this.pendingStates.delete(params.state);
+    if (now - issuedAt > STATE_TTL_MS) {
+      return { ok: false, reason: "state expired" };
+    }
+    if (!params.token) {
+      return { ok: false, reason: "missing token" };
+    }
+    let identity;
+    try {
+      identity = await this.deps.fetchUserInfo(params.token);
+    } catch (err) {
+      return { ok: false, reason: `user_info failed: ${err.message}` };
+    }
+    const expiresAtNum = params.expiresAt ? Number.parseInt(params.expiresAt, 10) : NaN;
+    this.deps.store.write({
+      identity,
+      ttcToken: params.token,
+      ttcTokenExpiresAt: Number.isFinite(expiresAtNum) ? expiresAtNum : null,
+      loginAt: new Date(now).toISOString()
+    });
+    return { ok: true, identity };
+  }
+  gcExpired(now) {
+    for (const [state, issuedAt] of this.pendingStates) {
+      if (now - issuedAt > STATE_TTL_MS) this.pendingStates.delete(state);
+    }
+  }
+};
+
+// src/feishu-auth/ttc-client.ts
+var TTC_HOSTS = {
+  auth: "https://app.ttcadvisory.com",
+  api: "https://api.ttcadvisory.com"
+};
+var TtcUserInfoError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "TtcUserInfoError";
+  }
+  code;
+};
+async function fetchTtcUserInfo(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  let res;
+  try {
+    res = await doFetch(`${opts.apiBase}/api/user_service/v1/login/user`, {
+      headers: { Authorization: `Bearer ${opts.token}` }
+    });
+  } catch (err) {
+    throw new TtcUserInfoError("NETWORK", `TTC user_info request failed: ${err.message}`);
+  }
+  if (!res.ok) {
+    if (res.status === 401) {
+      throw new TtcUserInfoError("UNAUTHORIZED", "TTC token invalid or expired");
+    }
+    throw new TtcUserInfoError("API_ERROR", `TTC user_info HTTP ${res.status}`);
+  }
+  const body = await res.json();
+  if (body.code !== 0) {
+    throw new TtcUserInfoError("API_ERROR", `TTC user_info code=${body.code}: ${body.message ?? ""}`);
+  }
+  const d = body.data;
+  if (!d || typeof d.union_id !== "string" || d.union_id.length === 0 || typeof d.name !== "string" || d.name.length === 0) {
+    throw new TtcUserInfoError("BAD_RESPONSE", "TTC user_info missing union_id or name");
+  }
+  return {
+    unionId: d.union_id,
+    displayName: d.name,
+    ...typeof d.avatar_url === "string" && d.avatar_url.length > 0 ? { avatarUrl: d.avatar_url } : {}
+  };
+}
+
 // src/index.ts
 init_protocol();
 
@@ -39270,12 +39460,12 @@ init_protocol();
 init_protocol();
 
 // src/session/fork.ts
-var import_node_fs27 = __toESM(require("fs"), 1);
+var import_node_fs28 = __toESM(require("fs"), 1);
 var import_node_os14 = __toESM(require("os"), 1);
-var import_node_path31 = __toESM(require("path"), 1);
+var import_node_path32 = __toESM(require("path"), 1);
 init_claude_history();
 function readJsonlEntries(file) {
-  const raw = import_node_fs27.default.readFileSync(file, "utf8");
+  const raw = import_node_fs28.default.readFileSync(file, "utf8");
   const out = [];
   for (const line of raw.split("\n")) {
     const t = line.trim();
@@ -39288,10 +39478,10 @@ function readJsonlEntries(file) {
   return out;
 }
 function forkSession(input) {
-  const baseDir = input.baseDir ?? import_node_path31.default.join(import_node_os14.default.homedir(), ".claude");
-  const projectDir = import_node_path31.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
-  const sourceFile = import_node_path31.default.join(projectDir, `${input.toolSessionId}.jsonl`);
-  if (!import_node_fs27.default.existsSync(sourceFile)) {
+  const baseDir = input.baseDir ?? import_node_path32.default.join(import_node_os14.default.homedir(), ".claude");
+  const projectDir = import_node_path32.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
+  const sourceFile = import_node_path32.default.join(projectDir, `${input.toolSessionId}.jsonl`);
+  if (!import_node_fs28.default.existsSync(sourceFile)) {
     throw new Error(`fork: source transcript not found: ${sourceFile}`);
   }
   const entries = readJsonlEntries(sourceFile);
@@ -39321,9 +39511,9 @@ function forkSession(input) {
     }
     forkedLines.push(JSON.stringify(forked));
   }
-  const forkedFilePath = import_node_path31.default.join(projectDir, `${forkedToolSessionId}.jsonl`);
-  import_node_fs27.default.mkdirSync(projectDir, { recursive: true });
-  import_node_fs27.default.writeFileSync(forkedFilePath, forkedLines.join("\n") + "\n", { mode: 384 });
+  const forkedFilePath = import_node_path32.default.join(projectDir, `${forkedToolSessionId}.jsonl`);
+  import_node_fs28.default.mkdirSync(projectDir, { recursive: true });
+  import_node_fs28.default.writeFileSync(forkedFilePath, forkedLines.join("\n") + "\n", { mode: 384 });
   return { forkedToolSessionId, forkedFilePath };
 }
 
@@ -39675,7 +39865,7 @@ function buildPermissionHandlers(deps) {
 }
 
 // src/handlers/history.ts
-var path41 = __toESM(require("path"), 1);
+var path42 = __toESM(require("path"), 1);
 init_protocol();
 
 // src/session/recent-dirs.ts
@@ -39693,7 +39883,7 @@ function listRecentDirs(store, limit = 50) {
 }
 
 // src/permission/persona-paths.ts
-var path40 = __toESM(require("path"), 1);
+var path41 = __toESM(require("path"), 1);
 function getAllowedPersonaIds(grants, action) {
   const ids = /* @__PURE__ */ new Set();
   for (const g2 of grants) {
@@ -39706,26 +39896,26 @@ function getAllowedPersonaIds(grants, action) {
   return ids;
 }
 function isGuestPathAllowed(grants, absPath, personaRoot, action = "read") {
-  const root = path40.resolve(personaRoot);
-  const target = path40.resolve(absPath);
-  const sep3 = root.endsWith(path40.sep) ? "" : path40.sep;
+  const root = path41.resolve(personaRoot);
+  const target = path41.resolve(absPath);
+  const sep3 = root.endsWith(path41.sep) ? "" : path41.sep;
   if (!target.startsWith(root + sep3)) return false;
-  const rel = path40.relative(root, target);
+  const rel = path41.relative(root, target);
   if (!rel || rel.startsWith("..")) return false;
-  const personaId = rel.split(path40.sep)[0];
+  const personaId = rel.split(path41.sep)[0];
   if (!personaId) return false;
   const allowed = getAllowedPersonaIds(grants, action);
   if (allowed === "*") return true;
   return allowed.has(personaId);
 }
 function personaIdFromPath(absPath, personaRoot) {
-  const root = path40.resolve(personaRoot);
-  const target = path40.resolve(absPath);
-  const sep3 = root.endsWith(path40.sep) ? "" : path40.sep;
+  const root = path41.resolve(personaRoot);
+  const target = path41.resolve(absPath);
+  const sep3 = root.endsWith(path41.sep) ? "" : path41.sep;
   if (!target.startsWith(root + sep3)) return null;
-  const rel = path40.relative(root, target);
+  const rel = path41.relative(root, target);
   if (!rel || rel.startsWith("..")) return null;
-  const id = rel.split(path40.sep)[0];
+  const id = rel.split(path41.sep)[0];
   return id || null;
 }
 
@@ -39750,7 +39940,7 @@ function buildHistoryHandlers(deps) {
         if (!pid) return false;
         return isGuestPathAllowed(
           ctx.grants,
-          path41.join(personaRoot, pid),
+          path42.join(personaRoot, pid),
           personaRoot,
           "read"
         );
@@ -39761,7 +39951,7 @@ function buildHistoryHandlers(deps) {
   };
   const list = async (frame, _client, ctx) => {
     const args = HistoryListArgs.parse(frame);
-    assertGuestPath(ctx, path41.resolve(args.projectPath), personaRoot, "history:list");
+    assertGuestPath(ctx, path42.resolve(args.projectPath), personaRoot, "history:list");
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
@@ -39793,13 +39983,13 @@ function buildHistoryHandlers(deps) {
   };
   const subagents = async (frame, _client, ctx) => {
     const args = HistorySubagentsArgs.parse(frame);
-    assertGuestPath(ctx, path41.resolve(args.cwd), personaRoot, "history:subagents");
+    assertGuestPath(ctx, path42.resolve(args.cwd), personaRoot, "history:subagents");
     const subs = await history.listSubagents(args);
     return { response: { type: "history:subagents", subagents: subs } };
   };
   const subagentRead = async (frame, _client, ctx) => {
     const args = HistorySubagentReadArgs.parse(frame);
-    assertGuestPath(ctx, path41.resolve(args.cwd), personaRoot, "history:subagent-read");
+    assertGuestPath(ctx, path42.resolve(args.cwd), personaRoot, "history:subagent-read");
     const res = await history.readSubagent(args);
     return { response: { type: "history:subagent-read", ...res } };
   };
@@ -39807,7 +39997,7 @@ function buildHistoryHandlers(deps) {
     const dirs = listRecentDirs(store);
     if (ctx?.principal.kind === "guest" && personaRoot) {
       const filtered = dirs.filter(
-        (d) => isGuestPathAllowed(ctx.grants, path41.resolve(d.cwd), personaRoot, "read")
+        (d) => isGuestPathAllowed(ctx.grants, path42.resolve(d.cwd), personaRoot, "read")
       );
       return { response: { type: "history:recentDirs", dirs: filtered } };
     }
@@ -39824,7 +40014,7 @@ function buildHistoryHandlers(deps) {
 }
 
 // src/handlers/workspace.ts
-var path42 = __toESM(require("path"), 1);
+var path43 = __toESM(require("path"), 1);
 var os15 = __toESM(require("os"), 1);
 init_protocol();
 init_protocol();
@@ -39865,22 +40055,22 @@ function buildWorkspaceHandlers(deps) {
     const args = WorkspaceListArgs.parse(frame);
     const isGuest = ctx?.principal.kind === "guest";
     const fallbackCwd = isGuest && personaRoot ? personaRoot : os15.homedir();
-    const resolvedCwd = path42.resolve(args.cwd ?? fallbackCwd);
-    const target = args.path ? path42.resolve(resolvedCwd, args.path) : resolvedCwd;
+    const resolvedCwd = path43.resolve(args.cwd ?? fallbackCwd);
+    const target = args.path ? path43.resolve(resolvedCwd, args.path) : resolvedCwd;
     assertGuestPath2(ctx, target, personaRoot, "workspace:list");
     const res = workspace.list({ ...args, cwd: resolvedCwd });
     return { response: { type: "workspace:list", ...res } };
   };
   const read = async (frame, _client, ctx) => {
     const args = WorkspaceReadArgs.parse(frame);
-    const target = path42.isAbsolute(args.path) ? path42.resolve(args.path) : path42.resolve(args.cwd, args.path);
+    const target = path43.isAbsolute(args.path) ? path43.resolve(args.path) : path43.resolve(args.cwd, args.path);
     assertGuestPath2(ctx, target, personaRoot, "workspace:read");
     const res = workspace.read(args);
     return { response: { type: "workspace:read", ...res } };
   };
   const skillsList = async (frame, _client, ctx) => {
     const args = SkillsListArgs.parse(frame);
-    const cwdAbs = path42.resolve(args.cwd);
+    const cwdAbs = path43.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "skills:list");
     const list2 = skills.list(args);
     if (ctx?.principal.kind === "guest" && personaRoot) {
@@ -39892,7 +40082,7 @@ function buildWorkspaceHandlers(deps) {
   };
   const agentsList = async (frame, _client, ctx) => {
     const args = AgentsListArgs.parse(frame);
-    const cwdAbs = path42.resolve(args.cwd);
+    const cwdAbs = path43.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "agents:list");
     const list2 = agents.list(args);
     if (ctx?.principal.kind === "guest" && personaRoot) {
@@ -39911,20 +40101,20 @@ function buildWorkspaceHandlers(deps) {
 }
 
 // src/handlers/git.ts
-var path44 = __toESM(require("path"), 1);
+var path45 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 
 // src/workspace/git.ts
 var import_node_child_process6 = require("child_process");
-var import_node_fs28 = __toESM(require("fs"), 1);
-var import_node_path32 = __toESM(require("path"), 1);
+var import_node_fs29 = __toESM(require("fs"), 1);
+var import_node_path33 = __toESM(require("path"), 1);
 var import_node_util = require("util");
 var pexec = (0, import_node_util.promisify)(import_node_child_process6.execFile);
 function normalizePath(p2) {
-  const resolved = import_node_path32.default.resolve(p2);
+  const resolved = import_node_path33.default.resolve(p2);
   try {
-    return import_node_fs28.default.realpathSync(resolved);
+    return import_node_fs29.default.realpathSync(resolved);
   } catch {
     return resolved;
   }
@@ -39997,7 +40187,7 @@ async function listGitBranches(cwd) {
 // src/handlers/git.ts
 function assertGuestCwd(ctx, cwd, personaRoot, method) {
   if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
-  if (!isGuestPathAllowed(ctx.grants, path44.resolve(cwd), personaRoot, "read")) {
+  if (!isGuestPathAllowed(ctx.grants, path45.resolve(cwd), personaRoot, "read")) {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
       `guest ${ctx.principal.id} cannot ${method} cwd ${cwd}`
@@ -40359,6 +40549,36 @@ function buildWhoamiHandler(deps) {
   };
 }
 
+// src/handlers/feishu-auth.ts
+function buildFeishuAuthHandlers(deps) {
+  const loginStart = async () => {
+    const { authUrl, state } = deps.loginFlow.start();
+    return {
+      response: { type: "auth:login:start:ok", authUrl, state }
+    };
+  };
+  const getIdentity = async () => {
+    const record = deps.ownerIdentityStore.read();
+    return {
+      response: {
+        type: "auth:getIdentity:ok",
+        identity: record ? record.identity : null
+      }
+    };
+  };
+  const logout = async () => {
+    deps.ownerIdentityStore.clear();
+    return {
+      response: { type: "auth:logout:ok" }
+    };
+  };
+  return {
+    "auth:login:start": loginStart,
+    "auth:getIdentity": getIdentity,
+    "auth:logout": logout
+  };
+}
+
 // src/handlers/meta.ts
 var import_node_os15 = __toESM(require("os"), 1);
 init_protocol();
@@ -40486,7 +40706,7 @@ function buildPersonaHandlers(deps) {
 }
 
 // src/handlers/attachment.ts
-var import_node_path33 = __toESM(require("path"), 1);
+var import_node_path34 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -40540,12 +40760,12 @@ function buildAttachmentHandlers(deps) {
         `session ${args.sessionId} scope unresolved`
       );
     }
-    const cwdAbs = import_node_path33.default.resolve(sessionFile.cwd);
-    const candidateAbs = import_node_path33.default.isAbsolute(args.relPath) ? import_node_path33.default.resolve(args.relPath) : import_node_path33.default.resolve(cwdAbs, args.relPath);
+    const cwdAbs = import_node_path34.default.resolve(sessionFile.cwd);
+    const candidateAbs = import_node_path34.default.isAbsolute(args.relPath) ? import_node_path34.default.resolve(args.relPath) : import_node_path34.default.resolve(cwdAbs, args.relPath);
     assertGuestAttachmentPath(ctx, candidateAbs, deps.personaRoot, "attachment.signUrl");
     const entries = deps.groupFileStore.list(scope, args.sessionId);
     const entry = entries.find((e) => {
-      const storedAbs = import_node_path33.default.isAbsolute(e.relPath) ? import_node_path33.default.resolve(e.relPath) : import_node_path33.default.resolve(cwdAbs, e.relPath);
+      const storedAbs = import_node_path34.default.isAbsolute(e.relPath) ? import_node_path34.default.resolve(e.relPath) : import_node_path34.default.resolve(cwdAbs, e.relPath);
       return storedAbs === candidateAbs && !e.stale;
     });
     if (!entry) {
@@ -40569,7 +40789,7 @@ function buildAttachmentHandlers(deps) {
     if (!ctx || ctx.principal.kind !== "guest" || !deps.personaRoot || !deps.sessionStore) return;
     const f = deps.sessionStore.read(sessionId);
     if (!f) return;
-    assertGuestAttachmentPath(ctx, import_node_path33.default.resolve(f.cwd), deps.personaRoot, method);
+    assertGuestAttachmentPath(ctx, import_node_path34.default.resolve(f.cwd), deps.personaRoot, method);
   }
   const groupAdd = async (frame, _client, ctx) => {
     if (!deps.groupFileStore || !deps.getSessionScope) {
@@ -40641,19 +40861,19 @@ function buildAttachmentHandlers(deps) {
 
 // src/handlers/extension.ts
 var import_promises7 = __toESM(require("fs/promises"), 1);
-var import_node_path38 = __toESM(require("path"), 1);
+var import_node_path39 = __toESM(require("path"), 1);
 init_protocol();
 
 // src/extension/bundle-zip.ts
 var import_promises4 = __toESM(require("fs/promises"), 1);
-var import_node_path34 = __toESM(require("path"), 1);
-var import_node_crypto11 = __toESM(require("crypto"), 1);
+var import_node_path35 = __toESM(require("path"), 1);
+var import_node_crypto12 = __toESM(require("crypto"), 1);
 var import_jszip2 = __toESM(require_lib3(), 1);
 async function bundleExtensionDir(dir) {
   const entries = await listFilesSorted(dir);
   const zip = new import_jszip2.default();
   for (const rel of entries) {
-    const abs = import_node_path34.default.join(dir, rel);
+    const abs = import_node_path35.default.join(dir, rel);
     const content = await import_promises4.default.readFile(abs);
     zip.file(rel, content, { date: FIXED_DATE });
   }
@@ -40662,7 +40882,7 @@ async function bundleExtensionDir(dir) {
     compression: "DEFLATE",
     compressionOptions: { level: 6 }
   });
-  const sha256 = import_node_crypto11.default.createHash("sha256").update(buffer).digest("hex");
+  const sha256 = import_node_crypto12.default.createHash("sha256").update(buffer).digest("hex");
   return { buffer, sha256 };
 }
 var FIXED_DATE = /* @__PURE__ */ new Date("2020-01-01T00:00:00.000Z");
@@ -40674,7 +40894,7 @@ async function listFilesSorted(rootDir) {
   return out;
 }
 async function walk(absRoot, relPrefix, out) {
-  const dirAbs = import_node_path34.default.join(absRoot, relPrefix);
+  const dirAbs = import_node_path35.default.join(absRoot, relPrefix);
   const entries = await import_promises4.default.readdir(dirAbs, { withFileTypes: true });
   for (const e of entries) {
     if (IGNORE_BASENAMES.has(e.name)) continue;
@@ -40728,25 +40948,25 @@ function computePublishCheck(args) {
 
 // src/extension/install-flow.ts
 var import_promises5 = __toESM(require("fs/promises"), 1);
-var import_node_path36 = __toESM(require("path"), 1);
+var import_node_path37 = __toESM(require("path"), 1);
 var import_node_os17 = __toESM(require("os"), 1);
-var import_node_crypto12 = __toESM(require("crypto"), 1);
+var import_node_crypto13 = __toESM(require("crypto"), 1);
 var import_jszip3 = __toESM(require_lib3(), 1);
 
 // src/extension/paths.ts
 var import_node_os16 = __toESM(require("os"), 1);
-var import_node_path35 = __toESM(require("path"), 1);
+var import_node_path36 = __toESM(require("path"), 1);
 function clawdHomeRoot(override) {
-  return override ?? process.env.CLAWD_HOME ?? import_node_path35.default.join(import_node_os16.default.homedir(), ".clawd");
+  return override ?? process.env.CLAWD_HOME ?? import_node_path36.default.join(import_node_os16.default.homedir(), ".clawd");
 }
 function extensionsRoot(override) {
-  return import_node_path35.default.join(clawdHomeRoot(override), "extensions");
+  return import_node_path36.default.join(clawdHomeRoot(override), "extensions");
 }
 function publishedChannelsFile(override) {
-  return import_node_path35.default.join(clawdHomeRoot(override), "extensions-published.json");
+  return import_node_path36.default.join(clawdHomeRoot(override), "extensions-published.json");
 }
 function bundleCacheRoot(override) {
-  return import_node_path35.default.join(clawdHomeRoot(override), "extension-bundles");
+  return import_node_path36.default.join(clawdHomeRoot(override), "extension-bundles");
 }
 
 // src/extension/install-flow.ts
@@ -40759,7 +40979,7 @@ var InstallError = class extends Error {
 };
 async function installFromChannel(args, deps) {
   const { channelRef, snapshotHash, bundleZip } = args;
-  const computed = import_node_crypto12.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto13.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new InstallError(
       "HASH_MISMATCH",
@@ -40773,7 +40993,7 @@ async function installFromChannel(args, deps) {
     throw new InstallError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path36.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path37.default.isAbsolute(name)) {
       throw new InstallError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -40805,7 +41025,7 @@ async function installFromChannel(args, deps) {
     );
   }
   const localExtId = namespacedExtId(ownerSlug, channelRef.ownerPrincipalId);
-  const destDir = import_node_path36.default.join(deps.extensionsRoot, localExtId);
+  const destDir = import_node_path37.default.join(deps.extensionsRoot, localExtId);
   let destExists = false;
   try {
     await import_promises5.default.access(destDir);
@@ -40819,16 +41039,16 @@ async function installFromChannel(args, deps) {
     );
   }
   const stage = await import_promises5.default.mkdtemp(
-    import_node_path36.default.join(import_node_os17.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
+    import_node_path37.default.join(import_node_os17.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path36.default.join(stage, name);
+      const dest = import_node_path37.default.join(stage, name);
       if (entry.dir) {
         await import_promises5.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises5.default.mkdir(import_node_path36.default.dirname(dest), { recursive: true });
+      await import_promises5.default.mkdir(import_node_path37.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises5.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -40849,9 +41069,9 @@ async function installFromChannel(args, deps) {
 
 // src/extension/update-flow.ts
 var import_promises6 = __toESM(require("fs/promises"), 1);
-var import_node_path37 = __toESM(require("path"), 1);
+var import_node_path38 = __toESM(require("path"), 1);
 var import_node_os18 = __toESM(require("os"), 1);
-var import_node_crypto13 = __toESM(require("crypto"), 1);
+var import_node_crypto14 = __toESM(require("crypto"), 1);
 var import_jszip4 = __toESM(require_lib3(), 1);
 var UpdateError = class extends Error {
   constructor(code, message) {
@@ -40866,11 +41086,11 @@ async function updateFromChannel(args, deps) {
     channelRef.extId,
     channelRef.ownerPrincipalId
   );
-  const liveDir = import_node_path37.default.join(deps.extensionsRoot, localExtId);
+  const liveDir = import_node_path38.default.join(deps.extensionsRoot, localExtId);
   const prevDir = `${liveDir}.prev`;
   let existingVersion;
   try {
-    const raw = await import_promises6.default.readFile(import_node_path37.default.join(liveDir, "manifest.json"), "utf8");
+    const raw = await import_promises6.default.readFile(import_node_path38.default.join(liveDir, "manifest.json"), "utf8");
     const parsed2 = ExtensionManifestSchema.safeParse(JSON.parse(raw));
     if (!parsed2.success) {
       throw new UpdateError(
@@ -40889,7 +41109,7 @@ async function updateFromChannel(args, deps) {
     if (e instanceof UpdateError) throw e;
     throw e;
   }
-  const computed = import_node_crypto13.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto14.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new UpdateError(
       "HASH_MISMATCH",
@@ -40903,7 +41123,7 @@ async function updateFromChannel(args, deps) {
     throw new UpdateError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path37.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path38.default.isAbsolute(name)) {
       throw new UpdateError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -40938,16 +41158,16 @@ async function updateFromChannel(args, deps) {
   await import_promises6.default.rm(prevDir, { recursive: true, force: true });
   await import_promises6.default.rename(liveDir, prevDir);
   const stage = await import_promises6.default.mkdtemp(
-    import_node_path37.default.join(import_node_os18.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
+    import_node_path38.default.join(import_node_os18.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path37.default.join(stage, name);
+      const dest = import_node_path38.default.join(stage, name);
       if (entry.dir) {
         await import_promises6.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises6.default.mkdir(import_node_path37.default.dirname(dest), { recursive: true });
+      await import_promises6.default.mkdir(import_node_path38.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises6.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -41040,7 +41260,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
       );
     }
   }
-  const manifestPath = import_node_path38.default.join(root, extId, "manifest.json");
+  const manifestPath = import_node_path39.default.join(root, extId, "manifest.json");
   const manifest = await readManifest(root, extId);
   const next = { ...manifest, version: newVersion };
   const tmp = `${manifestPath}.tmp`;
@@ -41048,7 +41268,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
   await import_promises7.default.rename(tmp, manifestPath);
 }
 async function readManifest(root, extId) {
-  const file = import_node_path38.default.join(root, extId, "manifest.json");
+  const file = import_node_path39.default.join(root, extId, "manifest.json");
   let raw;
   try {
     raw = await import_promises7.default.readFile(file, "utf8");
@@ -41139,7 +41359,7 @@ function buildExtensionHandlers(deps) {
   };
   async function buildSnapshotMeta(extId) {
     const manifest = await readManifest(deps.root, extId);
-    const { sha256, buffer } = await bundleExtensionDir(import_node_path38.default.join(deps.root, extId));
+    const { sha256, buffer } = await bundleExtensionDir(import_node_path39.default.join(deps.root, extId));
     return { manifest, contentHash: sha256, buffer };
   }
   const publish = async (frame, _client, ctx) => {
@@ -41321,7 +41541,7 @@ function buildExtensionHandlers(deps) {
 
 // src/extension/registry.ts
 var import_promises8 = __toESM(require("fs/promises"), 1);
-var import_node_path39 = __toESM(require("path"), 1);
+var import_node_path40 = __toESM(require("path"), 1);
 async function loadAll(root) {
   let entries;
   try {
@@ -41334,13 +41554,13 @@ async function loadAll(root) {
   for (const ent of entries) {
     if (!ent.isDirectory()) continue;
     if (ent.name.startsWith(".")) continue;
-    records.push(await loadOne(import_node_path39.default.join(root, ent.name), ent.name));
+    records.push(await loadOne(import_node_path40.default.join(root, ent.name), ent.name));
   }
   records.sort((a, b2) => a.extId < b2.extId ? -1 : a.extId > b2.extId ? 1 : 0);
   return records;
 }
 async function loadOne(dir, dirName) {
-  const manifestPath = import_node_path39.default.join(dir, "manifest.json");
+  const manifestPath = import_node_path40.default.join(dir, "manifest.json");
   let raw;
   try {
     raw = await import_promises8.default.readFile(manifestPath, "utf8");
@@ -41385,7 +41605,7 @@ async function loadOne(dir, dirName) {
 
 // src/extension/uninstall.ts
 var import_promises9 = __toESM(require("fs/promises"), 1);
-var import_node_path40 = __toESM(require("path"), 1);
+var import_node_path41 = __toESM(require("path"), 1);
 var UninstallError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -41394,7 +41614,7 @@ var UninstallError = class extends Error {
   code;
 };
 async function uninstall(deps) {
-  const dir = import_node_path40.default.join(deps.root, deps.extId);
+  const dir = import_node_path41.default.join(deps.root, deps.extId);
   try {
     await import_promises9.default.access(dir);
   } catch {
@@ -41440,6 +41660,7 @@ function buildMethodHandlers(deps) {
       personaStore: deps.personaStore,
       capabilityManager: deps.capabilityManager
     }),
+    ...buildFeishuAuthHandlers(deps.feishuAuth),
     ...deps.attachment ? buildAttachmentHandlers(deps.attachment) : {},
     ...buildExtensionHandlers({
       loadAll,
@@ -41581,7 +41802,12 @@ var METHOD_GRANT_MAP = {
   "extension.fetchBundle": CAPABILITY_SCOPED,
   // guest-self：guest 在自己 daemon 上触发安装与更新（无持久化 subscription 概念）
   "extension.install-from-channel": ADMIN_ANY,
-  "extension.update-from-channel": ADMIN_ANY
+  "extension.update-from-channel": ADMIN_ANY,
+  // ---- auth:* 飞书统一身份 Phase 1（owner-only） ----
+  // 登录/登出/查身份都是 owner 本机操作，guest 不可调
+  "auth:login:start": ADMIN_ANY,
+  "auth:getIdentity": ADMIN_ANY,
+  "auth:logout": ADMIN_ANY
 };
 function computeGrantForFrame(method, frame) {
   const rule = METHOD_GRANT_MAP[method];
@@ -41598,11 +41824,11 @@ function computeGrantForFrame(method, frame) {
 
 // src/extension/runtime.ts
 var import_node_child_process7 = require("child_process");
-var import_node_path41 = __toESM(require("path"), 1);
+var import_node_path42 = __toESM(require("path"), 1);
 var import_promises10 = require("timers/promises");
 
 // src/extension/port-allocator.ts
-var import_node_net2 = __toESM(require("net"), 1);
+var import_node_net = __toESM(require("net"), 1);
 var PortExhaustedError = class extends Error {
   constructor(min, max) {
     super(`no free port in [${min},${max}]`);
@@ -41615,7 +41841,7 @@ var PortExhaustedError = class extends Error {
 };
 function probe(port) {
   return new Promise((resolve6) => {
-    const srv = import_node_net2.default.createServer();
+    const srv = import_node_net.default.createServer();
     srv.once("error", () => resolve6(false));
     srv.once("listening", () => {
       srv.close(() => resolve6(true));
@@ -41699,7 +41925,7 @@ var Runtime = class {
       /\$CLAWOS_EXT_PORT/g,
       String(port)
     );
-    const dir = import_node_path41.default.join(this.root, extId);
+    const dir = import_node_path42.default.join(this.root, extId);
     const env = {
       ...process.env,
       CLAWOS_EXT_PORT: String(port),
@@ -41811,7 +42037,7 @@ ${handle.stderrTail}`
 
 // src/extension/published-channels.ts
 var import_promises11 = __toESM(require("fs/promises"), 1);
-var import_node_path42 = __toESM(require("path"), 1);
+var import_node_path43 = __toESM(require("path"), 1);
 init_zod();
 var PublishedChannelsError = class extends Error {
   constructor(code, message) {
@@ -41910,7 +42136,7 @@ var PublishedChannelStore = class {
       )
     };
     const tmp = `${this.filePath}.tmp`;
-    await import_promises11.default.mkdir(import_node_path42.default.dirname(this.filePath), { recursive: true });
+    await import_promises11.default.mkdir(import_node_path43.default.dirname(this.filePath), { recursive: true });
     await import_promises11.default.writeFile(tmp, JSON.stringify(data, null, 2), { mode: 384 });
     await import_promises11.default.rename(tmp, this.filePath);
   }
@@ -41918,7 +42144,7 @@ var PublishedChannelStore = class {
 
 // src/extension/bundle-cache.ts
 var import_promises12 = __toESM(require("fs/promises"), 1);
-var import_node_path43 = __toESM(require("path"), 1);
+var import_node_path44 = __toESM(require("path"), 1);
 var BundleCache = class {
   constructor(rootDir) {
     this.rootDir = rootDir;
@@ -41927,14 +42153,14 @@ var BundleCache = class {
   /** Atomic write: stage tmp → rename. Caller passes the hex sha256. */
   async write(snapshotHash, buffer) {
     await import_promises12.default.mkdir(this.rootDir, { recursive: true });
-    const file = import_node_path43.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path44.default.join(this.rootDir, `${snapshotHash}.zip`);
     const tmp = `${file}.tmp`;
     await import_promises12.default.writeFile(tmp, buffer, { mode: 384 });
     await import_promises12.default.rename(tmp, file);
   }
   /** Returns the bundle bytes, or null when the file doesn't exist. */
   async read(snapshotHash) {
-    const file = import_node_path43.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path44.default.join(this.rootDir, `${snapshotHash}.zip`);
     try {
       return await import_promises12.default.readFile(file);
     } catch (e) {
@@ -41944,7 +42170,7 @@ var BundleCache = class {
   }
   /** Idempotent — missing file is not an error. */
   async delete(snapshotHash) {
-    const file = import_node_path43.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path44.default.join(this.rootDir, `${snapshotHash}.zip`);
     await import_promises12.default.rm(file, { force: true });
   }
 };
@@ -41953,7 +42179,7 @@ var BundleCache = class {
 async function startDaemon(config) {
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path44.default.join(config.dataDir, "clawd.log")
+    file: import_node_path45.default.join(config.dataDir, "clawd.log")
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
   const stateMgr = new StateFileManager({ dataDir: config.dataDir });
@@ -41971,8 +42197,11 @@ async function startDaemon(config) {
   } else if (config.tunnel) {
     resolvedAuthToken = authFile.token;
   }
-  const ownerPrincipalId = authFile.ownerPrincipalId;
-  const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
+  const ownerIdentityStore = new OwnerIdentityStore(config.dataDir);
+  const feishuIdentity = ownerIdentityStore.read();
+  let feishuActive = feishuIdentity !== null;
+  let ownerPrincipalId = feishuIdentity?.identity.unionId ?? authFile.ownerPrincipalId;
+  let ownerDisplayName = feishuIdentity?.identity.displayName ?? loadOwnerDisplayName(config.dataDir);
   const authMode = resolvedAuthToken == null ? "none" : "first-message";
   const inboxStore = new InboxStore(config.dataDir);
   const inboxManager = new InboxManager(inboxStore, (_peerOwnerId, frame) => {
@@ -42014,7 +42243,9 @@ async function startDaemon(config) {
         isOwnerToken: (x) => resolvedAuthToken != null && constantTimeEqual(x, resolvedAuthToken),
         ownerPrincipalId,
         ownerDisplayName,
-        capabilityRegistry,
+        // 飞书 gate（spec 决策 #9）：未激活飞书身份时不接受 guest（capability token）入站——
+        // 不传 registry 让 guest token 一律 BAD_TOKEN。owner 自己连接不受影响。
+        ...feishuActive ? { capabilityRegistry } : {},
         selfPrincipalId,
         selfDisplayName
       });
@@ -42040,7 +42271,7 @@ async function startDaemon(config) {
   const agents = new AgentsScanner();
   const history = new ClaudeHistoryReader();
   let transport = null;
-  const personaStore = new PersonaStore(import_node_path44.default.join(config.dataDir, "personas"));
+  const personaStore = new PersonaStore(import_node_path45.default.join(config.dataDir, "personas"));
   const defaultsRoot = findDefaultsRoot();
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
@@ -42057,7 +42288,7 @@ async function startDaemon(config) {
     getAdapter,
     historyReader: history,
     dataDir: config.dataDir,
-    personaRoot: import_node_path44.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path45.default.join(config.dataDir, "personas"),
     personaStore,
     ownerDisplayName,
     ownerPrincipalId,
@@ -42081,10 +42312,10 @@ async function startDaemon(config) {
     // 文件可能 agent 写完又被自己删（罕见），用 size=0 / fallback mime 兜底。
     attachmentGroup: {
       onFileEdit: (input) => {
-        const absPath = import_node_path44.default.isAbsolute(input.relPath) ? input.relPath : import_node_path44.default.join(input.cwd, input.relPath);
+        const absPath = import_node_path45.default.isAbsolute(input.relPath) ? input.relPath : import_node_path45.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
-          size = import_node_fs29.default.statSync(absPath).size;
+          size = import_node_fs30.default.statSync(absPath).size;
         } catch (err) {
           logger.warn("attachment.onFileEdit stat failed", {
             sessionId: input.sessionId,
@@ -42171,7 +42402,13 @@ async function startDaemon(config) {
   const publishedChannelStore = new PublishedChannelStore(publishedChannelsFile());
   await publishedChannelStore.load();
   const bundleCache = new BundleCache(bundleCacheRoot());
-  const handlers = buildMethodHandlers({
+  const loginFlow = new LoginFlow({
+    store: ownerIdentityStore,
+    fetchUserInfo: (ttcToken) => fetchTtcUserInfo({ apiBase: TTC_HOSTS.api, token: ttcToken }),
+    ttcAuthBase: TTC_HOSTS.auth,
+    getCallbackUrl: () => `http://127.0.0.1:${config.port}/auth/callback`
+  });
+  const makeHandlers = () => buildMethodHandlers({
     manager,
     workspace,
     skills,
@@ -42210,10 +42447,10 @@ async function startDaemon(config) {
       // 'persona/<pid>/owner'，default 走 'default'。
       getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
       // guest path guard：candidate 必须在 personaRoot 子树下
-      personaRoot: import_node_path44.default.join(config.dataDir, "personas")
+      personaRoot: import_node_path45.default.join(config.dataDir, "personas")
     },
     // workspace/git/history/skills/agents handler 共用的 guest path guard 锚点
-    personaRoot: import_node_path44.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path45.default.join(config.dataDir, "personas"),
     // capability:list / delete handler 依赖
     capabilityManager,
     // personal-cap:get 返回的 shareBaseUrl 用此 base URL：
@@ -42243,8 +42480,11 @@ async function startDaemon(config) {
     extensionRuntime,
     // extension sharing v1 — owner-side published-channels store.
     publishedChannelStore,
-    bundleCache
+    bundleCache,
+    // 飞书统一身份 Phase 1：登录 RPC handlers（auth:login:start / getIdentity / logout）
+    feishuAuth: { loginFlow, ownerIdentityStore }
   });
+  let handlers = makeHandlers();
   const authResolver = new AuthContextResolver({
     ownerToken: resolvedAuthToken
   });
@@ -42270,8 +42510,29 @@ async function startDaemon(config) {
     },
     // POST /extensions/import lands in ~/.clawd/extensions/<id>/
     extensionsRoot: () => extensionsRoot(),
-    // app-builder build 模式：/preview/<port>/ 反代 dev server 的端口白名单（见 spec §三.2）
-    previewPorts: config.previewPorts ?? void 0
+    // 飞书登录 loopback 回调（热切换，2026-06-01 拍板）：成功落盘后——
+    //   1. 进程内实时切换身份（let binding + 值快照持有者重建）
+    //   2. 广播 auth:login:done 给在线 owner 连接（UI 即时反馈）
+    //   3. 踢掉所有 ws 连接（在线连接的 ctx 是旧身份）→ UI 自动重连 → 新身份 ctx →
+    //      People 立即解锁，不需要重启 daemon
+    // 失败则广播 auth:login:failed。
+    feishuLogin: {
+      handleLoginCallback: async (params) => {
+        const result = await loginFlow.handleCallback(params);
+        if (result.ok) {
+          feishuActive = true;
+          ownerPrincipalId = result.identity.unionId;
+          ownerDisplayName = result.identity.displayName;
+          handlers = makeHandlers();
+          wsServer?.setOwnerPrincipalId(result.identity.unionId);
+          wsServer?.broadcastToOwners({ type: "auth:login:done", identity: result.identity });
+          setImmediate(() => wsServer?.closeAllClients());
+        } else {
+          wsServer?.broadcastToOwners({ type: "auth:login:failed", reason: result.reason });
+        }
+        return result;
+      }
+    }
   });
   wsServer = new LocalWsServer({
     host: config.host,
@@ -42310,8 +42571,6 @@ async function startDaemon(config) {
     },
     // file-sharing HTTP 路由复用 daemon 同端口（spec §5 第 3 条）；router 自己处理 auth + 404
     httpRequestHandler: httpRouter,
-    // app-builder build 模式：/preview/<port>/ HMR websocket upgrade 转发的端口白名单（同 http-router 配置）
-    previewPorts: config.previewPorts ?? void 0,
     // 订阅成功后给该 client 重放 in-flight pendingQuestions（plan: clawd-question-server-truth）。
     // daemon 是 pendingQuestions 的唯一 source of truth；新 client 接入 / 刷新页面时
     // 把当前所有未决 question 以 session:question 帧定向回放，让 UI 不再误显示 Ended。
@@ -42356,6 +42615,12 @@ async function startDaemon(config) {
     const requestId = typeof frame.requestId === "string" ? frame.requestId : void 0;
     const handler = handlers[type];
     if (!handler) throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, `not implemented: ${type}`);
+    if (!feishuActive && FEISHU_GATED_METHODS.includes(type)) {
+      throw new ClawdError(
+        ERROR_CODES.FEISHU_LOGIN_REQUIRED,
+        `${type} requires feishu login (People/remote identity)`
+      );
+    }
     const ctx = wsServer.getClientContext(client.id) ?? ownerContext(ownerPrincipalId, ownerDisplayName);
     const verdict = computeGrantForFrame(type, frame);
     if (verdict.kind === "check") {
@@ -42428,13 +42693,12 @@ async function startDaemon(config) {
       stateSnapshot = { ...stateSnapshot, tunnelUrl: r.url, tunnelError: void 0 };
       stateMgr.write(stateSnapshot);
       currentTunnelUrl = r.url;
-      wss.broadcastAll({ type: "tunnel:ready", url: r.url, subdomain: r.subdomain });
       const connectUrl = resolvedAuthToken ? `${r.url}#token=${resolvedAuthToken}` : r.url;
       const lines = [
         `Tunnel:      ${r.url}`,
         ...resolvedAuthToken ? [`Connect:     ${connectUrl}`] : [],
-        `Frpc config: ${import_node_path44.default.join(config.dataDir, "frpc.toml")}`,
-        `Frpc log:    ${import_node_path44.default.join(config.dataDir, "frpc.log")}`
+        `Frpc config: ${import_node_path45.default.join(config.dataDir, "frpc.toml")}`,
+        `Frpc log:    ${import_node_path45.default.join(config.dataDir, "frpc.log")}`
       ];
       const width = Math.max(...lines.map((l) => l.length));
       const bar = "\u2550".repeat(width + 4);
@@ -42447,8 +42711,8 @@ ${bar}
 
 `);
       try {
-        const connectPath = import_node_path44.default.join(config.dataDir, "connect.txt");
-        import_node_fs29.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
+        const connectPath = import_node_path45.default.join(config.dataDir, "connect.txt");
+        import_node_fs30.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }
     } catch (err) {
@@ -42514,9 +42778,9 @@ ${bar}
   };
 }
 function migrateDropPersonsDir(dataDir) {
-  const dir = import_node_path44.default.join(dataDir, "persons");
+  const dir = import_node_path45.default.join(dataDir, "persons");
   try {
-    import_node_fs29.default.rmSync(dir, { recursive: true, force: true });
+    import_node_fs30.default.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }