@clawos-dev/clawd 0.2.284 → 0.2.286

package/dist/cli.cjs

@@ -450,8 +450,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path77, errorMaps, issueData } = params;
-      const fullPath = [...path77, ...issueData.path || []];
+      const { data, path: path78, errorMaps, issueData } = params;
+      const fullPath = [...path78, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -762,11 +762,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path77, key) {
+      constructor(parent, value, path78, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path77;
+        this._path = path78;
         this._key = key;
       }
       get path() {
@@ -6584,6 +6584,46 @@ var init_shift_internal = __esm({
   }
 });
 
+// ../protocol/src/lark-bot-schemas.ts
+var LarkBotProvisionArgs, LarkBotProvisionCancelArgs, LarkBotUnbindArgs, LarkBotStatusArgs, LarkBotBindManualArgs, LarkBotGroupSchema, LarkBotStatusResultSchema, LarkBotStateFrameSchema;
+var init_lark_bot_schemas = __esm({
+  "../protocol/src/lark-bot-schemas.ts"() {
+    "use strict";
+    init_zod();
+    LarkBotProvisionArgs = external_exports.object({ personaId: external_exports.string().min(1) });
+    LarkBotProvisionCancelArgs = LarkBotProvisionArgs;
+    LarkBotUnbindArgs = LarkBotProvisionArgs;
+    LarkBotStatusArgs = LarkBotProvisionArgs;
+    LarkBotBindManualArgs = external_exports.object({
+      personaId: external_exports.string().min(1),
+      appId: external_exports.string().min(1),
+      appSecret: external_exports.string().min(1),
+      botName: external_exports.string().min(1).optional()
+    });
+    LarkBotGroupSchema = external_exports.object({
+      chatId: external_exports.string().min(1),
+      chatName: external_exports.string().optional(),
+      /** epoch ms，该群 session 最近一次活跃时间 */
+      lastActiveAt: external_exports.number().int().optional()
+    });
+    LarkBotStatusResultSchema = external_exports.object({
+      state: external_exports.enum(["unbound", "provisioning", "bound", "broken"]),
+      appId: external_exports.string().optional(),
+      botName: external_exports.string().optional(),
+      /** state='provisioning' 时的当前步骤与待用户打开的授权 URL */
+      provisioning: external_exports.object({
+        step: external_exports.enum(["register", "authorize"]),
+        verificationUrl: external_exports.string().optional()
+      }).optional(),
+      brokenReason: external_exports.string().optional(),
+      groups: external_exports.array(LarkBotGroupSchema)
+    });
+    LarkBotStateFrameSchema = LarkBotStatusResultSchema.extend({
+      personaId: external_exports.string().min(1)
+    });
+  }
+});
+
 // ../protocol/src/persona-schemas.ts
 var PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema, CodexSandboxSettingsSchema;
 var init_persona_schemas = __esm({
@@ -6994,6 +7034,14 @@ var init_schemas = __esm({
        * mirror，留 strip 防御）。
        */
       shiftFiredFromSessionId: external_exports.string().min(1).optional(),
+      /**
+       * LarkBotConnector（spec 2026-08-05）：该 session 是某飞书群的专属会话。
+       * larkChatId = 飞书群 chat_id（oc_ 前缀），与 persona-guest scope 的 capId `lark-<chat_id>` 对应；
+       * 由 daemon lark-bot-connector 模块写入，UI 只读（sidebar 按此字段隐藏，Drawer 群清单按此聚合）。
+       */
+      larkChatId: external_exports.string().min(1).optional(),
+      /** 飞书群名快照（展示用，随事件里的群名更新，可能滞后于飞书侧改名） */
+      larkChatName: external_exports.string().min(1).optional(),
       createdAt: external_exports.string().min(1),
       updatedAt: external_exports.string().min(1)
     });
@@ -7801,6 +7849,7 @@ var init_methods = __esm({
     init_inbox();
     init_peer_exec();
     init_shift_internal();
+    init_lark_bot_schemas();
     init_persona_schemas();
     init_schemas();
     NO_ARGS = external_exports.object({});
@@ -7979,6 +8028,26 @@ var init_methods = __esm({
         summary: "\u67E5 shift \u7684\u6267\u884C\u5386\u53F2\uFF08\u4EC5\u521B\u5EFA\u8005\uFF09",
         args: ShiftInternalHistoryArgs
       },
+      "larkBot:provision": {
+        summary: "\u53D1\u8D77 persona \u7684\u98DE\u4E66 bot \u4E00\u952E\u88C5\u914D\uFF08\u5EFA app + \u6388 scope\uFF09\uFF0C\u8FDB\u5EA6\u4E0E\u6388\u6743 URL \u8D70 larkBot:state \u5E27\uFF1Bowner-only",
+        args: LarkBotProvisionArgs
+      },
+      "larkBot:provisionCancel": {
+        summary: "\u53D6\u6D88\u8FDB\u884C\u4E2D\u7684\u98DE\u4E66 bot \u88C5\u914D\u6D41\u7A0B\uFF1Bowner-only",
+        args: LarkBotProvisionCancelArgs
+      },
+      "larkBot:bindManual": {
+        summary: "\u624B\u586B app_id/app_secret \u76F4\u63A5\u7ED1\u5B9A\u98DE\u4E66 bot\uFF08\u88C5\u914D\u9003\u751F\u8231\uFF09\uFF1Bowner-only",
+        args: LarkBotBindManualArgs
+      },
+      "larkBot:unbind": {
+        summary: "\u89E3\u7ED1 persona \u7684\u98DE\u4E66 bot\uFF08\u5220\u4E91\u7AEF\u7ED1\u5B9A + \u65AD\u957F\u8FDE\u63A5\uFF0C\u98DE\u4E66\u4FA7 app \u4FDD\u7559\uFF09\uFF1Bowner-only",
+        args: LarkBotUnbindArgs
+      },
+      "larkBot:status": {
+        summary: "\u67E5 persona \u7684\u98DE\u4E66 bot \u72B6\u6001\uFF08unbound/provisioning/bound/broken + \u670D\u52A1\u4E2D\u7FA4\u6E05\u5355\uFF09\uFF1Bowner-only",
+        args: LarkBotStatusArgs
+      },
       "skills:list": {
         summary: "\u626B\u63CF\u5E76\u5217\u51FA\u8BE5\u76EE\u5F55\u53EF\u7528\u7684 skill",
         args: SkillsListArgs
@@ -8418,6 +8487,7 @@ var init_runtime = __esm({
     init_log();
     init_visitor_schemas();
     init_shift_internal();
+    init_lark_bot_schemas();
   }
 });
 
@@ -8692,8 +8762,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path77 = req.path;
-        _req.url = typeof path77 === "string" ? path77 : req.url ? req.url.path || req.url : void 0;
+        const path78 = req.path;
+        _req.url = typeof path78 === "string" ? path78 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -8858,14 +8928,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path77) {
+    function parsePath(path78) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path77.length; i++) {
-        const char = path77[i];
+      for (let i = 0; i < path78.length; i++) {
+        const char = path78[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -8996,10 +9066,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path77 of paths) {
-        const parts = parsePath(path77);
+      for (const path78 of paths) {
+        const parts = parsePath(path78);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path77, remove);
+          redactWildcardPath(obj, parts, censor, path78, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -9084,8 +9154,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path77) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path77];
+            const wrappedCensor = typeof censor === "function" ? (value, path78) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path78];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -9120,8 +9190,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path77 of pathsToClone) {
-        const parts = parsePath(path77);
+      for (const path78 of pathsToClone) {
+        const parts = parsePath(path78);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -9173,24 +9243,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path77) {
-      if (typeof path77 !== "string") {
+    function validatePath(path78) {
+      if (typeof path78 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path77 === "") {
+      if (path78 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path77.includes("..")) {
-        throw new Error(`Invalid redaction path (${path77})`);
+      if (path78.includes("..")) {
+        throw new Error(`Invalid redaction path (${path78})`);
       }
-      if (path77.includes(",")) {
-        throw new Error(`Invalid redaction path (${path77})`);
+      if (path78.includes(",")) {
+        throw new Error(`Invalid redaction path (${path78})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path77.length; i++) {
-        const char = path77[i];
+      for (let i = 0; i < path78.length; i++) {
+        const char = path78[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -9204,20 +9274,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path77})`);
+            throw new Error(`Invalid redaction path (${path78})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path77})`);
+        throw new Error(`Invalid redaction path (${path78})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path77 of paths) {
-        validatePath(path77);
+      for (const path78 of paths) {
+        validatePath(path78);
       }
     }
     function slowRedact(options = {}) {
@@ -9385,8 +9455,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path77) => {
-            return censor(value, [k2, ...path77]);
+          const wrappedCensor = typeof censor === "function" ? (value, path78) => {
+            return censor(value, [k2, ...path78]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -9604,10 +9674,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs67 = require("fs");
+    var fs68 = require("fs");
     var EventEmitter3 = require("events");
     var inherits = require("util").inherits;
-    var path77 = require("path");
+    var path78 = require("path");
     var sleep2 = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -9661,20 +9731,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs67.mkdirSync(path77.dirname(file), { recursive: true });
-          const fd = fs67.openSync(file, flags, mode);
+          if (sonic.mkdir) fs68.mkdirSync(path78.dirname(file), { recursive: true });
+          const fd = fs68.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs67.mkdir(path77.dirname(file), { recursive: true }, (err) => {
+        fs68.mkdir(path78.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs67.open(file, flags, mode, fileOpened);
+          fs68.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs67.open(file, flags, mode, fileOpened);
+        fs68.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -9715,8 +9785,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs67.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs67.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs68.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs68.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -9725,15 +9795,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs67.writeSync(this.fd, this._writingBuf);
+            return fs68.writeSync(this.fd, this._writingBuf);
           }
-          return fs67.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs68.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs67.write(this.fd, this._writingBuf, this.release);
+            return fs68.write(this.fd, this._writingBuf, this.release);
           }
-          return fs67.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs68.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -9790,7 +9860,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs67.fsyncSync(this.fd);
+          fs68.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -9904,7 +9974,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs67.fsync(this.fd, (err) => {
+            fs68.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -10006,7 +10076,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs67.close(fd, (err) => {
+          fs68.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -10055,7 +10125,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs67.writeSync(this.fd, buf) : fs67.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs68.writeSync(this.fd, buf) : fs68.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -10071,7 +10141,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs67.fsyncSync(this.fd);
+        fs68.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -10092,7 +10162,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs67.writeSync(this.fd, buf);
+          const n = fs68.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -10120,13 +10190,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs67.writeSync(this.fd, this._writingBuf) : fs67.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs68.writeSync(this.fd, this._writingBuf) : fs68.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs67.write(this.fd, this._writingBuf, release);
+        fs68.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -10135,7 +10205,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs67.writeSync(this.fd, this._writingBuf);
+          const written = fs68.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -10144,7 +10214,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs67.write(this.fd, this._writingBuf, release);
+        fs68.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -10160,12 +10230,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs67.fsync(sonic.fd, closeWrapped);
+        fs68.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs67.close(sonic.fd, done);
+          fs68.close(sonic.fd, done);
         } else {
           done();
         }
@@ -13300,11 +13370,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path77, added, removed, oldPosInc, options) {
-        var last = path77.lastComponent;
+      addToPath: function addToPath(path78, added, removed, oldPosInc, options) {
+        var last = path78.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path77.oldPos + oldPosInc,
+            oldPos: path78.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -13314,7 +13384,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path77.oldPos + oldPosInc,
+            oldPos: path78.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -13823,10 +13893,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec3 = m2;
-      const path77 = typeof rec3.path === "string" ? rec3.path : null;
+      const path78 = typeof rec3.path === "string" ? rec3.path : null;
       const content = typeof rec3.content === "string" ? rec3.content : null;
-      if (!path77 || content == null) return null;
-      const entry = { path: path77, content };
+      if (!path78 || content == null) return null;
+      const entry = { path: path78, content };
       if (typeof rec3.mtimeMs === "number") entry.mtimeMs = rec3.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -14629,10 +14699,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec3 = m2;
-      const path77 = typeof rec3.path === "string" ? rec3.path : null;
+      const path78 = typeof rec3.path === "string" ? rec3.path : null;
       const content = typeof rec3.content === "string" ? rec3.content : null;
-      if (!path77 || content == null) return null;
-      const out = { path: path77, content };
+      if (!path78 || content == null) return null;
+      const out = { path: path78, content };
       if (typeof rec3.mtimeMs === "number") out.mtimeMs = rec3.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -35601,8 +35671,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path77) {
-      var parts = path77.split("/");
+    exports2.resolve = function(path78) {
+      var parts = path78.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -41455,18 +41525,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path77) {
-      if (path77.slice(-1) === "/") {
-        path77 = path77.substring(0, path77.length - 1);
+    var parentFolder = function(path78) {
+      if (path78.slice(-1) === "/") {
+        path78 = path78.substring(0, path78.length - 1);
       }
-      var lastSlash = path77.lastIndexOf("/");
-      return lastSlash > 0 ? path77.substring(0, lastSlash) : "";
+      var lastSlash = path78.lastIndexOf("/");
+      return lastSlash > 0 ? path78.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path77) {
-      if (path77.slice(-1) !== "/") {
-        path77 += "/";
+    var forceTrailingSlash = function(path78) {
+      if (path78.slice(-1) !== "/") {
+        path78 += "/";
       }
-      return path77;
+      return path78;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -42468,7 +42538,7 @@ var require_lib3 = __commonJS({
 // src/run-case/recorder.ts
 function startRunCaseRecorder(opts) {
   const now = opts.now ?? Date.now;
-  const dir = import_node_path64.default.dirname(opts.recordPath);
+  const dir = import_node_path65.default.dirname(opts.recordPath);
   let stream = null;
   let closing = false;
   let closedSettled = false;
@@ -42482,8 +42552,8 @@ function startRunCaseRecorder(opts) {
   });
   const ensureStream = () => {
     if (stream) return stream;
-    import_node_fs48.default.mkdirSync(dir, { recursive: true });
-    stream = import_node_fs48.default.createWriteStream(opts.recordPath, { flags: "a" });
+    import_node_fs49.default.mkdirSync(dir, { recursive: true });
+    stream = import_node_fs49.default.createWriteStream(opts.recordPath, { flags: "a" });
     stream.on("close", () => closedResolve());
     return stream;
   };
@@ -42508,12 +42578,12 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs48, import_node_path64;
+var import_node_fs49, import_node_path65;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
-    import_node_fs48 = __toESM(require("fs"), 1);
-    import_node_path64 = __toESM(require("path"), 1);
+    import_node_fs49 = __toESM(require("fs"), 1);
+    import_node_path65 = __toESM(require("path"), 1);
   }
 });
 
@@ -42556,7 +42626,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs49.mkdtempSync)(import_node_path65.default.join(import_node_os23.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs50.mkdtempSync)(import_node_path66.default.join(import_node_os23.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -42717,19 +42787,19 @@ async function runController(opts) {
   if (sigintHandler) process.off("SIGINT", sigintHandler);
   if (ownsCwd) {
     try {
-      (0, import_node_fs49.rmSync)(cwd, { recursive: true, force: true });
+      (0, import_node_fs50.rmSync)(cwd, { recursive: true, force: true });
     } catch {
     }
   }
   return exitCode ?? 0;
 }
-var import_node_fs49, import_node_os23, import_node_path65;
+var import_node_fs50, import_node_os23, import_node_path66;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
-    import_node_fs49 = require("fs");
+    import_node_fs50 = require("fs");
     import_node_os23 = __toESM(require("os"), 1);
-    import_node_path65 = __toESM(require("path"), 1);
+    import_node_path66 = __toESM(require("path"), 1);
     init_claude();
     init_stdout_splitter();
     init_permission_stdio();
@@ -43004,8 +43074,8 @@ Env (advanced):
 `;
 
 // src/index.ts
-var import_node_path63 = __toESM(require("path"), 1);
-var import_node_fs47 = __toESM(require("fs"), 1);
+var import_node_path64 = __toESM(require("path"), 1);
+var import_node_fs48 = __toESM(require("fs"), 1);
 var import_node_os22 = __toESM(require("os"), 1);
 
 // ../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/stringify.js
@@ -43893,6 +43963,28 @@ ${r.outcome.text}${files}`;
   return ["\u4F60\u4E4B\u524D\u59D4\u6D3E\u51FA\u53BB\u7684\u4EFB\u52A1\u6709\u4E86\u7ED3\u679C\uFF1A", "", blocks.join("\n\n")].join("\n");
 }
 
+// src/session/lark-reply.ts
+function extractLarkReplyText(events) {
+  let lastUserIdx = -1;
+  for (let i = events.length - 1; i >= 0; i--) {
+    if (events[i].kind === "user_text") {
+      lastUserIdx = i;
+      break;
+    }
+  }
+  const tail = events.slice(lastUserIdx + 1);
+  const order = [];
+  const latest = /* @__PURE__ */ new Map();
+  let anon = 0;
+  for (const ev of tail) {
+    if (ev.kind !== "text") continue;
+    const key = ev.partialId ?? `__snapshot_${anon++}`;
+    if (!latest.has(key)) order.push(key);
+    latest.set(key, ev.text);
+  }
+  return order.map((k2) => latest.get(k2) ?? "").filter((t) => t.length > 0).join("\n").trim();
+}
+
 // src/session/runner.ts
 var import_node_os4 = __toESM(require("os"), 1);
 var import_node_path7 = __toESM(require("path"), 1);
@@ -47021,6 +47113,110 @@ var SessionManager = class {
     });
     return { sessionId, ended, kill: killImpl };
   }
+  /**
+   * LarkBotConnector（spec 2026-08-05 §5.3）：把一条飞书群 @ 消息作为一个 turn 驱动
+   * 该群的专属 guest session，turn-idle 后从 reducer buffer 提取回复文本。
+   *
+   * 跟 createShiftSession 的差异：
+   *   - **find-or-create**：按 capId `lark-<chatId>` 找现存 session（一群一条，D3），
+   *     没有才建；daemon `create` 的无 dedupe 语义不变——dedupe 是本方法私有实现
+   *   - guest scope + 沙箱：群成员 query 不带 owner 权限；10min guest idle-kill + resume
+   *   - turn-idle 后**不 kill**（session 常驻，记忆即价值）；延迟 settleDelayMs 等尾随
+   *     text 落盘（schemas.ts turn_end 注释：CC 写 turn_end 早于尾段正文）再读 buffer
+   *   - 回复提取：extractLarkReplyText（最后一条 user_text 之后的 text 事件拼接）
+   */
+  runLarkChatTurn(args) {
+    if (!this.deps.personaRoot) {
+      throw new Error("runLarkChatTurn: personaRoot missing in ManagerDeps");
+    }
+    const capId = `lark-${args.chatId}`;
+    const scope = {
+      kind: "persona",
+      personaId: args.personaId,
+      mode: "guest",
+      capId
+    };
+    const store = this.storeFor(scope);
+    let file = store.list().find((f) => f.larkChatId === args.chatId);
+    if (!file) {
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      file = {
+        sessionId: newSessionId(),
+        cwd: import_node_path9.default.join(this.deps.personaRoot, safeFileName(args.personaId)),
+        tool: this.deps.getPersonaTool?.(args.personaId) ?? "claude",
+        ownerPersonaId: args.personaId,
+        // guest 三件套：creatorPrincipalId=capId（scopeForFile 回落防线）、
+        // creatorDisplayName（reducer guest 分支硬性要求，缺则 spawn 抛）
+        creatorPrincipalId: capId,
+        creatorDisplayName: `\u98DE\u4E66\u7FA4\xB7${args.chatName ?? args.chatId}`,
+        larkChatId: args.chatId,
+        ...args.chatName ? { larkChatName: args.chatName } : {},
+        createdAt: now,
+        updatedAt: now
+      };
+      store.write(file);
+      this.deps.logger?.info("larkBot.runLarkChatTurn.session-created", {
+        sessionId: file.sessionId,
+        personaId: args.personaId,
+        chatId: args.chatId
+      });
+    } else if (args.chatName && file.larkChatName !== args.chatName) {
+      file = { ...file, larkChatName: args.chatName, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      store.write(file);
+    }
+    const sessionId = file.sessionId;
+    let resolveEnded = () => {
+    };
+    const ended = new Promise((r) => {
+      resolveEnded = r;
+    });
+    let unsubscribe = () => {
+    };
+    let settled = false;
+    const settle = (info) => {
+      if (settled) return;
+      settled = true;
+      unsubscribe();
+      resolveEnded(info);
+    };
+    const killImpl = () => {
+      const r = this.runners.get(sessionId);
+      if (!r) return;
+      r.input({ kind: "command", command: { kind: "stop" } });
+    };
+    const settleDelayMs = args.settleDelayMs ?? 500;
+    unsubscribe = this.subscribe(
+      sessionId,
+      scope,
+      makeEndFrameHandler(sessionId, (info) => {
+        if (info.kind === "idle") {
+          setTimeout(() => {
+            try {
+              const events = this.readHistoryEventsForScope(sessionId, scope);
+              const replyText = extractLarkReplyText(events);
+              settle(replyText ? { ok: true, replyText } : { error: "empty reply" });
+            } catch (err) {
+              settle({ error: err.message });
+            }
+          }, settleDelayMs);
+        } else if (info.kind === "stopped") {
+          settle({ error: "session stopped before reply" });
+        } else {
+          settle({ error: info.message || "session error" });
+        }
+      })
+    );
+    const runner = this.ensureRunnerForScope(file, scope);
+    runner.input({
+      kind: "command",
+      command: {
+        kind: "send",
+        text: args.text,
+        senderPrincipal: makeGuestSender(capId, args.senderName)
+      }
+    });
+    return { sessionId, ended, kill: killImpl };
+  }
   /**
    * 老板插话：把 'inject-owner-text' input 喂给对应 runner，
    * runner 不存在时按 scope 懒创建。
@@ -49024,8 +49220,8 @@ function turnStartInput(text) {
   const items = [];
   let leftover = text;
   for (const m2 of text.matchAll(SKILL_RE)) {
-    const [marker, name, path77] = m2;
-    items.push({ type: "skill", name, path: path77 });
+    const [marker, name, path78] = m2;
+    items.push({ type: "skill", name, path: path78 });
     leftover = leftover.replace(marker, "");
   }
   for (const m2 of text.matchAll(ATTACHMENT_RE2)) {
@@ -51526,6 +51722,610 @@ function buildShiftInternalHandlers(deps) {
   };
 }
 
+// src/lark-bot-connector/provisioner.ts
+var LARK_BOT_V1_SCOPES = [
+  "offline_access",
+  "im:chat:readonly",
+  "im:resource",
+  "contact:user.base:readonly"
+];
+var REGISTRATION_URL = "https://accounts.feishu.cn/oauth/v1/app/registration";
+var DEVICE_AUTHORIZE_URL = "https://accounts.feishu.cn/oauth/v1/device/authorize";
+var DEVICE_TOKEN_URL = "https://open.feishu.cn/open-apis/authen/v2/oauth/token";
+var DEFAULT_POLL_INTERVAL_MS = 6e3;
+var DEFAULT_TIMEOUT_MS2 = 10 * 60 * 1e3;
+var SLOW_DOWN_STEP_MS = 5e3;
+var FlowCtx = class {
+  fetchImpl;
+  sleep;
+  now;
+  timeoutMs;
+  intervalMs;
+  cancelled = false;
+  constructor(opts) {
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    if (!f) throw new Error("fetch is not available (Node >= 18 required)");
+    this.fetchImpl = f;
+    this.sleep = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.now = opts.nowImpl ?? Date.now;
+    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+    this.intervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  }
+  /**
+   * RFC 8628 轮询循环：pollOnce 返回 null 表示 pending 继续；'slow_down' 加间隔；
+   * 非 null 结果即完成。超时 / cancel reject。
+   */
+  async poll(pollOnce) {
+    const start = this.now();
+    for (; ; ) {
+      if (this.cancelled) throw new Error("flow cancelled");
+      if (this.now() - start >= this.timeoutMs) throw new Error("flow timeout");
+      const r = await pollOnce();
+      if (r === "slow_down") {
+        this.intervalMs += SLOW_DOWN_STEP_MS;
+      } else if (r !== "pending") {
+        return r;
+      }
+      await this.sleep(this.intervalMs);
+    }
+  }
+};
+var POST_TIMEOUT_MS = 15e3;
+async function postJson(ctx, url, body) {
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), POST_TIMEOUT_MS);
+  let res;
+  try {
+    res = await ctx.fetchImpl(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+      signal: ac.signal
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+  let parsed = {};
+  try {
+    parsed = await res.json();
+  } catch {
+    parsed = {};
+  }
+  return { status: res.status, json: parsed };
+}
+var TERMINAL_OAUTH_ERRORS = /* @__PURE__ */ new Set(["access_denied", "expired_token", "invalid_grant"]);
+function pollSignal(status, json, what) {
+  if (status >= 200 && status < 300) return "done";
+  const err = String(json.error ?? "");
+  if (TERMINAL_OAUTH_ERRORS.has(err)) {
+    throw new Error(`${what} rejected: ${err}`);
+  }
+  if (err === "authorization_pending" || status === 400) {
+    if (err === "slow_down") return "slow_down";
+    if (err === "authorization_pending") return "pending";
+    return "pending";
+  }
+  if (status === 429) return "slow_down";
+  throw new Error(`${what} failed: HTTP ${status} ${JSON.stringify(json).slice(0, 200)}`);
+}
+async function startAppRegistration(opts = {}) {
+  const ctx = new FlowCtx(opts);
+  const init = await postJson(ctx, REGISTRATION_URL, { action: "start", brand: "feishu" });
+  const verificationUrl = String(init.json.verification_url ?? init.json.verification_uri ?? "");
+  const flowId = String(init.json.flow_id ?? "");
+  if (init.status < 200 || init.status >= 300 || !verificationUrl || !flowId) {
+    throw new Error(
+      `app registration start failed: HTTP ${init.status} ${JSON.stringify(init.json).slice(0, 200)}`
+    );
+  }
+  return {
+    verificationUrl,
+    cancel: () => {
+      ctx.cancelled = true;
+    },
+    complete: () => ctx.poll(async () => {
+      const r = await postJson(ctx, REGISTRATION_URL, {
+        action: "poll",
+        brand: "feishu",
+        flow_id: flowId
+      });
+      const sig = pollSignal(r.status, r.json, "app registration");
+      if (sig !== "done") return sig;
+      const appId = String(r.json.client_id ?? "");
+      const appSecret = String(r.json.client_secret ?? "");
+      if (!appId || !appSecret) {
+        throw new Error("app registration succeeded but missing client_id or client_secret");
+      }
+      return { appId, appSecret };
+    })
+  };
+}
+async function startScopeAuthorization(args) {
+  const ctx = new FlowCtx(args);
+  const init = await postJson(ctx, DEVICE_AUTHORIZE_URL, {
+    client_id: args.appId,
+    scope: args.scopes.join(" ")
+  });
+  const verificationUrl = String(init.json.verification_url ?? init.json.verification_uri ?? "");
+  const deviceCode = String(init.json.device_code ?? "");
+  if (init.status < 200 || init.status >= 300 || !verificationUrl || !deviceCode) {
+    throw new Error(
+      `scope authorization start failed: HTTP ${init.status} ${JSON.stringify(init.json).slice(0, 200)}`
+    );
+  }
+  return {
+    verificationUrl,
+    cancel: () => {
+      ctx.cancelled = true;
+    },
+    complete: () => ctx.poll(async () => {
+      const r = await postJson(ctx, DEVICE_TOKEN_URL, {
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        client_id: args.appId,
+        device_code: deviceCode
+      });
+      const sig = pollSignal(r.status, r.json, "scope authorization");
+      if (sig !== "done") return sig;
+      const grantedSet = new Set(
+        String(r.json.scope ?? "").split(/\s+/).filter(Boolean)
+      );
+      const granted = args.scopes.filter((s) => grantedSet.has(s));
+      const denied = args.scopes.filter((s) => !grantedSet.has(s));
+      if (granted.length === 0) {
+        throw new Error(`scope authorization: no scopes granted (requested: ${args.scopes.join(" ")})`);
+      }
+      return { granted: [...granted], denied: [...denied] };
+    })
+  };
+}
+
+// src/handlers/lark-bot.ts
+init_protocol();
+function statusFrame(personaId2, status) {
+  return { type: "larkBot:state", personaId: personaId2, ...status };
+}
+function buildLarkBotHandlers(deps) {
+  const now = deps.now ?? Date.now;
+  const inFlight = /* @__PURE__ */ new Map();
+  const groupsOf = (personaId2) => {
+    const removed = new Set(deps.store.read(personaId2)?.removedChatIds ?? []);
+    return deps.listLarkSessions(personaId2).filter((g2) => !removed.has(g2.chatId));
+  };
+  const emit = (personaId2, status2) => {
+    deps.broadcast(statusFrame(personaId2, status2));
+  };
+  const runProvision = async (personaId2, flight) => {
+    const finish = () => {
+      if (inFlight.get(personaId2) === flight) inFlight.delete(personaId2);
+    };
+    const tunnelUrl = deps.getTunnelUrl();
+    const ownerId = deps.getOwnerId();
+    if (!tunnelUrl || !ownerId) {
+      finish();
+      emit(personaId2, { state: "unbound", brokenReason: "tunnel or owner identity unavailable", groups: [] });
+      return;
+    }
+    try {
+      const reg = await deps.provisioner.startAppRegistration();
+      if (flight.cancelled) return finish();
+      flight.cancelFn = reg.cancel;
+      emit(personaId2, {
+        state: "provisioning",
+        provisioning: { step: "register", verificationUrl: reg.verificationUrl },
+        groups: []
+      });
+      const { appId, appSecret } = await reg.complete();
+      if (flight.cancelled) return finish();
+      const auth = await deps.provisioner.startScopeAuthorization({
+        appId,
+        scopes: LARK_BOT_V1_SCOPES
+      });
+      if (flight.cancelled) return finish();
+      flight.cancelFn = auth.cancel;
+      emit(personaId2, {
+        state: "provisioning",
+        provisioning: { step: "authorize", verificationUrl: auth.verificationUrl },
+        groups: []
+      });
+      const { denied } = await auth.complete();
+      if (flight.cancelled) return finish();
+      if (denied.length > 0) {
+        deps.logger?.warn(`larkBot provision ${personaId2}: scopes denied (accepted): ${denied.join(" ")}`);
+      }
+      const botName = deps.getPersonaName(personaId2) ?? personaId2;
+      await deps.cloud.bind({ personaId: personaId2, appId, appSecret, botName, tunnelUrl, ownerId });
+      deps.store.write(personaId2, { appId, botName, boundAt: now() });
+      finish();
+      emit(personaId2, { state: "bound", appId, botName, groups: groupsOf(personaId2) });
+    } catch (err) {
+      finish();
+      if (flight.cancelled) return;
+      emit(personaId2, {
+        state: "unbound",
+        brokenReason: err.message,
+        groups: []
+      });
+    }
+  };
+  const provision = async (frame) => {
+    const { personaId: personaId2 } = parseArgs2(LarkBotProvisionArgs, frame, "larkBot:provision");
+    if (deps.store.read(personaId2)) throw new Error(`larkBot already bound: ${personaId2}`);
+    if (inFlight.has(personaId2)) throw new Error(`larkBot provision already in progress: ${personaId2}`);
+    if (!deps.getTunnelUrl()) throw new Error("larkBot provision requires tunnel to be up");
+    if (!deps.getOwnerId()) throw new Error("larkBot provision requires feishu login (owner identity)");
+    const flight = { cancelled: false, cancelFn: () => {
+    } };
+    inFlight.set(personaId2, flight);
+    void runProvision(personaId2, flight);
+    return { response: { type: "larkBot:provision:ok" } };
+  };
+  const provisionCancel = async (frame) => {
+    const { personaId: personaId2 } = parseArgs2(LarkBotProvisionCancelArgs, frame, "larkBot:provisionCancel");
+    const flight = inFlight.get(personaId2);
+    if (flight) {
+      flight.cancelled = true;
+      inFlight.delete(personaId2);
+      flight.cancelFn();
+    }
+    emit(personaId2, { state: "unbound", groups: [] });
+    return { response: { type: "larkBot:provisionCancel:ok" } };
+  };
+  const bindManual = async (frame) => {
+    const { personaId: personaId2, appId, appSecret, botName } = parseArgs2(
+      LarkBotBindManualArgs,
+      frame,
+      "larkBot:bindManual"
+    );
+    const tunnelUrl = deps.getTunnelUrl();
+    if (!tunnelUrl) throw new Error("larkBot bind requires tunnel to be up");
+    const ownerId = deps.getOwnerId();
+    if (!ownerId) throw new Error("larkBot bind requires feishu login (owner identity)");
+    const name = botName ?? deps.getPersonaName(personaId2) ?? personaId2;
+    await deps.cloud.bind({ personaId: personaId2, appId, appSecret, botName: name, tunnelUrl, ownerId });
+    deps.store.write(personaId2, { appId, botName: name, boundAt: now() });
+    emit(personaId2, { state: "bound", appId, botName: name, groups: groupsOf(personaId2) });
+    return { response: { type: "larkBot:bindManual:ok" } };
+  };
+  const unbind = async (frame) => {
+    const { personaId: personaId2 } = parseArgs2(LarkBotUnbindArgs, frame, "larkBot:unbind");
+    const meta = deps.store.read(personaId2);
+    if (!meta) throw new Error(`larkBot not bound: ${personaId2}`);
+    try {
+      await deps.cloud.unbind(meta.appId);
+    } catch (err) {
+      if (err.status !== 404) throw err;
+      deps.logger?.warn(`larkBot unbind: cloud binding already gone: ${meta.appId}`);
+    }
+    deps.store.remove(personaId2);
+    emit(personaId2, { state: "unbound", groups: [] });
+    return { response: { type: "larkBot:unbind:ok" } };
+  };
+  const status = async (frame) => {
+    const { personaId: personaId2 } = parseArgs2(LarkBotStatusArgs, frame, "larkBot:status");
+    const meta = deps.store.read(personaId2);
+    if (!meta) {
+      return {
+        response: { type: "larkBot:status:ok", state: "unbound", groups: [] }
+      };
+    }
+    let cloudBinding;
+    try {
+      cloudBinding = (await deps.cloud.listBindings()).find((b2) => b2.personaId === personaId2);
+    } catch (err) {
+      deps.logger?.warn(`larkBot status: cloud unreachable: ${err.message}`);
+    }
+    const broken = cloudBinding?.status === "broken";
+    const result = {
+      state: broken ? "broken" : "bound",
+      appId: meta.appId,
+      botName: meta.botName,
+      ...broken ? { brokenReason: cloudBinding?.brokenReason ?? "unknown" } : {},
+      groups: groupsOf(personaId2)
+    };
+    return { response: { type: "larkBot:status:ok", ...result } };
+  };
+  return {
+    "larkBot:provision": provision,
+    "larkBot:provisionCancel": provisionCancel,
+    "larkBot:bindManual": bindManual,
+    "larkBot:unbind": unbind,
+    "larkBot:status": status
+  };
+}
+async function refreshTunnelUrlOnStartup(deps) {
+  if (deps.listBoundPersonaIds().length === 0) return;
+  const tunnelUrl = deps.getTunnelUrl();
+  if (!tunnelUrl) return;
+  try {
+    await deps.cloud.updateTunnelUrl(tunnelUrl);
+  } catch (err) {
+    deps.logger?.warn(`larkBot tunnel refresh failed: ${err.message}`);
+  }
+}
+
+// src/lark-bot-connector/binding-store.ts
+var import_node_fs26 = __toESM(require("fs"), 1);
+var import_node_path27 = __toESM(require("path"), 1);
+function createLarkBotBindingStore(personaRoot) {
+  const filePath = (personaId2) => import_node_path27.default.join(personaRoot, safeFileName(personaId2), ".clawd", "lark-bot.json");
+  const read = (personaId2) => {
+    const file = filePath(personaId2);
+    if (!import_node_fs26.default.existsSync(file)) return null;
+    try {
+      const raw = JSON.parse(import_node_fs26.default.readFileSync(file, "utf8"));
+      if (typeof raw?.appId !== "string" || raw.appId.length === 0) return null;
+      return raw;
+    } catch {
+      return null;
+    }
+  };
+  const write = (personaId2, meta) => {
+    const file = filePath(personaId2);
+    import_node_fs26.default.mkdirSync(import_node_path27.default.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    import_node_fs26.default.writeFileSync(tmp, JSON.stringify(meta, null, 2), { mode: 384 });
+    import_node_fs26.default.renameSync(tmp, file);
+  };
+  return {
+    read,
+    write,
+    remove(personaId2) {
+      import_node_fs26.default.rmSync(filePath(personaId2), { force: true });
+    },
+    addRemovedChat(personaId2, chatId) {
+      const meta = read(personaId2);
+      if (!meta) return;
+      const set = new Set(meta.removedChatIds ?? []);
+      set.add(chatId);
+      write(personaId2, { ...meta, removedChatIds: [...set] });
+    }
+  };
+}
+
+// src/lark-bot-connector/cloud-client.ts
+var LarkBotCloudError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "LarkBotCloudError";
+  }
+  status;
+};
+function createLarkBotCloudClient(opts) {
+  const f = opts.fetchImpl ?? globalThis.fetch;
+  if (!f) throw new Error("fetch is not available (Node >= 18 required)");
+  const base = opts.api.replace(/\/+$/, "");
+  async function request(method, pathname, body) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 15e3);
+    let res;
+    try {
+      res = await f(`${base}${pathname}`, {
+        method,
+        signal: ac.signal,
+        headers: {
+          authorization: `Bearer ${opts.apiKey}`,
+          "x-did": encodeURIComponent(opts.deviceId),
+          "x-name": encodeURIComponent(opts.displayName),
+          "x-scene": "daemon",
+          "content-type": "application/json"
+        },
+        body: body ? JSON.stringify(body) : void 0
+      });
+    } catch (err) {
+      throw new LarkBotCloudError(`lark-bot cloud request failed: ${err.message}`);
+    } finally {
+      clearTimeout(timer);
+    }
+    let json = {};
+    try {
+      json = await res.json();
+    } catch {
+      json = {};
+    }
+    if (!res.ok) {
+      throw new LarkBotCloudError(
+        `lark-bot cloud ${method} ${pathname}: HTTP ${res.status} ${JSON.stringify(json).slice(0, 200)}`,
+        res.status
+      );
+    }
+    return json;
+  }
+  return {
+    async bind(args) {
+      await request("PUT", "/api/lark-bot/bind", { ...args });
+    },
+    async unbind(appId) {
+      await request("DELETE", `/api/lark-bot/bind/${encodeURIComponent(appId)}`);
+    },
+    async listBindings() {
+      const json = await request("GET", "/api/lark-bot/bindings");
+      return json.items ?? [];
+    },
+    async updateTunnelUrl(tunnelUrl) {
+      await request("PATCH", "/api/lark-bot/tunnel", { tunnelUrl });
+    },
+    async reply(args) {
+      await request("POST", "/api/lark-bot/reply", { ...args });
+    },
+    async claimEvents() {
+      const json = await request("POST", "/api/lark-bot/events/claim");
+      return json.items ?? [];
+    }
+  };
+}
+
+// src/lark-bot-connector/chat-router.ts
+var ERROR_REPLY_TEXT = "\u5904\u7406\u51FA\u9519\u4E86\uFF0C\u8BF7\u91CD\u8BD5";
+var DEFAULT_TURN_TIMEOUT_MS = 10 * 60 * 1e3;
+function createLarkChatRouter(deps) {
+  const timeoutMs = deps.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
+  const replyDelays = deps.replyRetryDelaysMs ?? [2e3, 8e3, 3e4];
+  const sleep2 = deps.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const queues = /* @__PURE__ */ new Map();
+  const activity = /* @__PURE__ */ new Map();
+  const runOne = async (env) => {
+    if (!env.messageId) {
+      deps.logger?.warn(`larkBot chat-router: message envelope missing messageId, drop ${env.eventId}`);
+      return;
+    }
+    const chatLabel = env.chatName ?? env.chatId;
+    const text = `[\u98DE\u4E66\u7FA4\xB7${chatLabel}] ${env.senderName ?? env.senderOpenId ?? "\u672A\u77E5\u6210\u5458"}: ${env.text ?? ""}`;
+    const turn = deps.manager.runLarkChatTurn({
+      personaId: env.personaId,
+      chatId: env.chatId,
+      chatName: env.chatName,
+      senderOpenId: env.senderOpenId ?? "",
+      senderName: env.senderName ?? env.senderOpenId ?? "\u672A\u77E5\u6210\u5458",
+      text
+    });
+    activity.set(env.chatId, {
+      chatId: env.chatId,
+      chatName: env.chatName,
+      lastActiveAt: Date.now(),
+      personaId: env.personaId
+    });
+    let timedOut = false;
+    let timer;
+    const timeout = new Promise((resolve6) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        turn.kill();
+        resolve6({ error: "turn timeout" });
+      }, timeoutMs);
+    });
+    let result;
+    try {
+      result = await Promise.race([turn.ended, timeout]);
+    } finally {
+      clearTimeout(timer);
+    }
+    const replyText = "ok" in result && result.ok ? result.replyText : ERROR_REPLY_TEXT;
+    if (!("ok" in result)) {
+      deps.logger?.warn(
+        `larkBot turn ${timedOut ? "timeout" : "error"} (${env.chatId}): ${result.error}`
+      );
+    }
+    for (let attempt = 0; attempt <= replyDelays.length; attempt++) {
+      if (attempt > 0) await sleep2(replyDelays[attempt - 1]);
+      try {
+        await deps.cloud.reply({
+          appId: env.appId,
+          chatId: env.chatId,
+          replyToMessageId: env.messageId,
+          text: replyText,
+          eventId: env.eventId
+        });
+        return;
+      } catch (err) {
+        deps.logger?.warn(
+          `larkBot reply attempt ${attempt + 1} failed (${env.chatId}): ${err.message}`
+        );
+      }
+    }
+  };
+  return {
+    handleEnvelope(env) {
+      if (env.type === "bot_removed") {
+        deps.store.addRemovedChat(env.personaId, env.chatId);
+        activity.delete(env.chatId);
+        queues.delete(env.chatId);
+        deps.logger?.info(`larkBot removed from chat ${env.chatId} (persona ${env.personaId})`);
+        return;
+      }
+      const prev = queues.get(env.chatId) ?? Promise.resolve();
+      const next = prev.then(
+        () => runOne(env).catch(
+          (err) => deps.logger?.warn(`larkBot chat-router runOne failed: ${err.message}`)
+        )
+      );
+      queues.set(env.chatId, next);
+      void next.finally(() => {
+        if (queues.get(env.chatId) === next) queues.delete(env.chatId);
+      });
+    },
+    listLarkSessions(personaId2) {
+      return [...activity.values()].filter((a) => a.personaId === personaId2).map((a) => ({ chatId: a.chatId, chatName: a.chatName, lastActiveAt: a.lastActiveAt }));
+    }
+  };
+}
+
+// src/lark-bot-connector/envelope.ts
+var import_node_crypto6 = require("crypto");
+var LARK_ENVELOPE_PREFIX = "clawdlbe1";
+function verifyLarkEventEnvelope(args) {
+  const { token, publicKeyPem } = args;
+  const now = args.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const parts = token.split(".");
+  if (parts.length !== 3 || parts[0] !== LARK_ENVELOPE_PREFIX) {
+    return { ok: false, reason: "BAD_FORMAT" };
+  }
+  const [prefix, payloadB64, sigB64] = parts;
+  let envelope;
+  try {
+    envelope = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+  } catch {
+    return { ok: false, reason: "BAD_FORMAT" };
+  }
+  const data = Buffer.from(`${prefix}.${payloadB64}`, "utf8");
+  let sigOk = false;
+  try {
+    sigOk = (0, import_node_crypto6.verify)(null, data, publicKeyPem, Buffer.from(sigB64, "base64url"));
+  } catch {
+    sigOk = false;
+  }
+  if (!sigOk) return { ok: false, reason: "BAD_SIGNATURE" };
+  if (typeof envelope.exp !== "number" || envelope.exp <= now) {
+    return { ok: false, reason: "EXPIRED" };
+  }
+  return { ok: true, envelope };
+}
+
+// src/lark-bot-connector/event-endpoint.ts
+var DEFAULT_DEDUPE_CAPACITY = 1024;
+function createLarkEventDedupe(capacity = DEFAULT_DEDUPE_CAPACITY) {
+  const seen = /* @__PURE__ */ new Map();
+  return {
+    has: (id) => seen.has(id),
+    add: (id) => {
+      if (seen.has(id)) return;
+      seen.set(id, true);
+      if (seen.size > capacity) {
+        const oldest = seen.keys().next().value;
+        if (oldest !== void 0) seen.delete(oldest);
+      }
+    }
+  };
+}
+function createLarkBotEventEndpoint(deps) {
+  const seen = deps.dedupe ?? createLarkEventDedupe(deps.dedupeCapacity ?? DEFAULT_DEDUPE_CAPACITY);
+  return (rawBody) => {
+    const publicKeyPem = deps.getPublicKey();
+    if (!publicKeyPem) {
+      return { status: 503, body: { code: "SERVER_KEY_UNAVAILABLE", message: "server public key not cached yet" } };
+    }
+    const r = verifyLarkEventEnvelope({
+      token: rawBody.trim(),
+      publicKeyPem,
+      nowSeconds: deps.nowSeconds?.()
+    });
+    if (!r.ok) {
+      return { status: 401, body: { code: r.reason, message: `lark event envelope rejected: ${r.reason}` } };
+    }
+    const { envelope } = r;
+    if (seen.has(envelope.eventId)) {
+      return { status: 202, body: { ok: true, deduped: true } };
+    }
+    seen.add(envelope.eventId);
+    try {
+      deps.route(envelope);
+    } catch (err) {
+      deps.logger?.warn(`larkBot event route failed: ${err.message}`);
+    }
+    return { status: 202, body: { ok: true } };
+  };
+}
+
 // src/ticket/constants.ts
 var DEFAULT_CLAWD_TICKETS_API_KEY = "cf057f047674896978ddcc813adbc4a186551a6fcf59ad9d";
 function resolveClawdTicketsApiKey() {
@@ -52137,7 +52937,7 @@ var CodexHistoryReader = class {
 };
 
 // src/tools/codex-skills.ts
-var import_node_path27 = __toESM(require("path"), 1);
+var import_node_path28 = __toESM(require("path"), 1);
 function str3(v2) {
   return typeof v2 === "string" ? v2 : void 0;
 }
@@ -52152,13 +52952,13 @@ function mapSkillsListResponse(res) {
       const r = s ?? {};
       const name = str3(r.name);
       if (!name) continue;
-      const path77 = str3(r.path);
+      const path78 = str3(r.path);
       const description = str3(r.description);
       const isPlugin = name.includes(":");
       out.push({
         name,
         source: isPlugin ? "plugin" : "project",
-        ...path77 ? { path: path77 } : {},
+        ...path78 ? { path: path78 } : {},
         ...description ? { description } : {},
         ...isPlugin ? { plugin: name.split(":")[0] } : {}
       });
@@ -52174,30 +52974,30 @@ async function listCodexSkills(cwd, deps = {}) {
     // 先写 extraRoots 再写 list（stdio 按写入顺序处理，fire-and-forget 不 await 回包；
     // codex-session.ts ready 序列同款，两处保持一致）。失败不阻塞 list。
     beforeRequest: (client) => {
-      void client.request("skills/extraRoots/set", { extraRoots: [import_node_path27.default.join(cwd, ".claude", "skills")] }).catch(() => void 0);
+      void client.request("skills/extraRoots/set", { extraRoots: [import_node_path28.default.join(cwd, ".claude", "skills")] }).catch(() => void 0);
     }
   });
   return mapSkillsListResponse(res);
 }
 
 // src/workspace/browser.ts
-var import_node_fs26 = __toESM(require("fs"), 1);
+var import_node_fs27 = __toESM(require("fs"), 1);
 var import_node_os8 = __toESM(require("os"), 1);
-var import_node_path28 = __toESM(require("path"), 1);
+var import_node_path29 = __toESM(require("path"), 1);
 init_protocol();
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
 function resolveInsideCwd(cwd, subpath) {
-  const absCwd = import_node_path28.default.resolve(cwd);
-  const joined = import_node_path28.default.resolve(absCwd, subpath ?? ".");
-  const rel = import_node_path28.default.relative(absCwd, joined);
-  if (rel.startsWith("..") || import_node_path28.default.isAbsolute(rel)) {
+  const absCwd = import_node_path29.default.resolve(cwd);
+  const joined = import_node_path29.default.resolve(absCwd, subpath ?? ".");
+  const rel = import_node_path29.default.relative(absCwd, joined);
+  if (rel.startsWith("..") || import_node_path29.default.isAbsolute(rel)) {
     throw new ClawdError(ERROR_CODES.INVALID_PATH, `path escapes cwd: ${subpath}`);
   }
   return joined;
 }
 function ensureCwd(cwd) {
   try {
-    const stat = import_node_fs26.default.statSync(cwd);
+    const stat = import_node_fs27.default.statSync(cwd);
     if (!stat.isDirectory()) {
       throw new ClawdError(ERROR_CODES.INVALID_CWD, `not a directory: ${cwd}`);
     }
@@ -52211,7 +53011,7 @@ var WorkspaceBrowser = class {
     const cwd = args.cwd && args.cwd.length > 0 ? args.cwd : import_node_os8.default.homedir();
     ensureCwd(cwd);
     const full = resolveInsideCwd(cwd, args.path);
-    const dirents = import_node_fs26.default.readdirSync(full, { withFileTypes: true });
+    const dirents = import_node_fs27.default.readdirSync(full, { withFileTypes: true });
     const entries = [];
     for (const d of dirents) {
       if (!args.showHidden && d.name.startsWith(".")) continue;
@@ -52221,7 +53021,7 @@ var WorkspaceBrowser = class {
         mtime: ""
       };
       try {
-        const st = import_node_fs26.default.statSync(import_node_path28.default.join(full, d.name));
+        const st = import_node_fs27.default.statSync(import_node_path29.default.join(full, d.name));
         entry.mtime = new Date(st.mtimeMs).toISOString();
         if (d.isFile()) entry.size = st.size;
       } catch {
@@ -52237,14 +53037,14 @@ var WorkspaceBrowser = class {
   read(args) {
     ensureCwd(args.cwd);
     const full = resolveInsideCwd(args.cwd, args.path);
-    const st = import_node_fs26.default.statSync(full);
+    const st = import_node_fs27.default.statSync(full);
     if (!st.isFile()) {
       throw new ClawdError(ERROR_CODES.INVALID_PATH, `not a file: ${args.path}`);
     }
     if (st.size > MAX_FILE_BYTES) {
       throw new ClawdError(ERROR_CODES.FILE_TOO_LARGE, `file > ${MAX_FILE_BYTES} bytes`);
     }
-    const buf = import_node_fs26.default.readFileSync(full);
+    const buf = import_node_fs27.default.readFileSync(full);
     const isBinary = buf.includes(0);
     if (isBinary) {
       return {
@@ -52266,20 +53066,20 @@ var WorkspaceBrowser = class {
 };
 
 // src/skills/agents-scanner.ts
-var import_node_fs27 = __toESM(require("fs"), 1);
+var import_node_fs28 = __toESM(require("fs"), 1);
 var import_node_os9 = __toESM(require("os"), 1);
-var import_node_path29 = __toESM(require("path"), 1);
+var import_node_path30 = __toESM(require("path"), 1);
 var DEFAULT_POLICY_DIR_DARWIN = "/Library/Application Support/ClaudeCode/.claude/agents";
 function isDirLikeSync2(p2) {
   try {
-    return import_node_fs27.default.statSync(p2).isDirectory();
+    return import_node_fs28.default.statSync(p2).isDirectory();
   } catch {
     return false;
   }
 }
 function fileExistsSync(p2) {
   try {
-    return import_node_fs27.default.statSync(p2).isFile();
+    return import_node_fs28.default.statSync(p2).isFile();
   } catch {
     return false;
   }
@@ -52287,7 +53087,7 @@ function fileExistsSync(p2) {
 function parseAgentFile(filePath) {
   let content;
   try {
-    content = import_node_fs27.default.readFileSync(filePath, "utf8");
+    content = import_node_fs28.default.readFileSync(filePath, "utf8");
   } catch {
     return {};
   }
@@ -52300,16 +53100,16 @@ function parseAgentFile(filePath) {
 function scanAgentsDir(dir, source, seen, out) {
   let entries;
   try {
-    entries = import_node_fs27.default.readdirSync(dir, { withFileTypes: true });
+    entries = import_node_fs28.default.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const ent of entries) {
     if (!ent.name.endsWith(".md")) continue;
-    if (!ent.isFile() && !(ent.isSymbolicLink() && fileExistsSync(import_node_path29.default.join(dir, ent.name)))) {
+    if (!ent.isFile() && !(ent.isSymbolicLink() && fileExistsSync(import_node_path30.default.join(dir, ent.name)))) {
       continue;
     }
-    const filePath = import_node_path29.default.join(dir, ent.name);
+    const filePath = import_node_path30.default.join(dir, ent.name);
     const baseName = ent.name.replace(/\.md$/, "");
     if (seen.has(baseName)) continue;
     seen.add(baseName);
@@ -52327,12 +53127,12 @@ function scanPluginAgentsTree(root, pluginName, seen, out) {
   function walk2(dir, namespaces) {
     let entries;
     try {
-      entries = import_node_fs27.default.readdirSync(dir, { withFileTypes: true });
+      entries = import_node_fs28.default.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of entries) {
-      const childPath = import_node_path29.default.join(dir, ent.name);
+      const childPath = import_node_path30.default.join(dir, ent.name);
       if (ent.isDirectory() || ent.isSymbolicLink() && isDirLikeSync2(childPath)) {
         walk2(childPath, [...namespaces, ent.name]);
         continue;
@@ -52357,13 +53157,13 @@ function scanPluginAgentsTree(root, pluginName, seen, out) {
   walk2(root, []);
 }
 function readInstalledPlugins2(home) {
-  const pluginsDir = import_node_path29.default.join(home, ".claude", "plugins");
-  const v2 = import_node_path29.default.join(pluginsDir, "installed_plugins_v2.json");
-  const v1 = import_node_path29.default.join(pluginsDir, "installed_plugins.json");
+  const pluginsDir = import_node_path30.default.join(home, ".claude", "plugins");
+  const v2 = import_node_path30.default.join(pluginsDir, "installed_plugins_v2.json");
+  const v1 = import_node_path30.default.join(pluginsDir, "installed_plugins.json");
   let raw = null;
   for (const candidate of [v2, v1]) {
     try {
-      raw = import_node_fs27.default.readFileSync(candidate, "utf8");
+      raw = import_node_fs28.default.readFileSync(candidate, "utf8");
       break;
     } catch {
     }
@@ -52388,19 +53188,19 @@ function readInstalledPlugins2(home) {
   return out;
 }
 function walkUpProjectAgentsDirs(startCwd, home, seen, out) {
-  let cur = import_node_path29.default.resolve(startCwd);
-  const fsRoot = import_node_path29.default.parse(cur).root;
+  let cur = import_node_path30.default.resolve(startCwd);
+  const fsRoot = import_node_path30.default.parse(cur).root;
   while (true) {
-    scanAgentsDir(import_node_path29.default.join(cur, ".claude", "agents"), "project", seen, out);
+    scanAgentsDir(import_node_path30.default.join(cur, ".claude", "agents"), "project", seen, out);
     let hasGit = false;
     try {
-      hasGit = import_node_fs27.default.existsSync(import_node_path29.default.join(cur, ".git"));
+      hasGit = import_node_fs28.default.existsSync(import_node_path30.default.join(cur, ".git"));
     } catch {
     }
     if (hasGit) return;
     if (cur === home) return;
     if (cur === fsRoot) return;
-    const parent = import_node_path29.default.dirname(cur);
+    const parent = import_node_path30.default.dirname(cur);
     if (parent === cur) return;
     cur = parent;
   }
@@ -52435,7 +53235,7 @@ var AgentsScanner = class {
     }
     const fsBlock = [];
     scanAgentsDir(
-      import_node_path29.default.join(this.home, ".claude", "agents"),
+      import_node_path30.default.join(this.home, ".claude", "agents"),
       "global",
       seen,
       fsBlock
@@ -52449,7 +53249,7 @@ var AgentsScanner = class {
       ...this.extraPluginRoots
     ];
     for (const { name, root } of plugins) {
-      const agentsRoot = import_node_path29.default.join(root, "agents");
+      const agentsRoot = import_node_path30.default.join(root, "agents");
       scanPluginAgentsTree(agentsRoot, name, seen, fsBlock);
     }
     return [...builtinBlock, ...fsBlock];
@@ -52457,15 +53257,15 @@ var AgentsScanner = class {
 };
 
 // src/observer/session-observer.ts
-var import_node_fs29 = __toESM(require("fs"), 1);
+var import_node_fs30 = __toESM(require("fs"), 1);
 var import_node_os11 = __toESM(require("os"), 1);
-var import_node_path31 = __toESM(require("path"), 1);
+var import_node_path32 = __toESM(require("path"), 1);
 init_claude_history();
 
 // src/observer/subagent-meta-observer.ts
-var import_node_fs28 = __toESM(require("fs"), 1);
+var import_node_fs29 = __toESM(require("fs"), 1);
 var import_node_os10 = __toESM(require("os"), 1);
-var import_node_path30 = __toESM(require("path"), 1);
+var import_node_path31 = __toESM(require("path"), 1);
 init_claude_history();
 var META_RE = /^agent-([A-Za-z0-9_-]+)\.meta\.json$/;
 var SubagentMetaObserver = class {
@@ -52478,7 +53278,7 @@ var SubagentMetaObserver = class {
   watches = /* @__PURE__ */ new Map();
   // public for spec only：测试直接拼路径写假 meta.json；生产 start() 内部自己解析
   resolveSubagentDir(cwd, toolSessionId) {
-    return import_node_path30.default.join(
+    return import_node_path31.default.join(
       this.home,
       ".claude",
       "projects",
@@ -52508,7 +53308,7 @@ var SubagentMetaObserver = class {
   attachWatcher(w2) {
     if (w2.watcher) return;
     try {
-      w2.watcher = import_node_fs28.default.watch(w2.dirPath, { persistent: false }, (_evt, name) => {
+      w2.watcher = import_node_fs29.default.watch(w2.dirPath, { persistent: false }, (_evt, name) => {
         if (!name) return;
         const m2 = META_RE.exec(String(name));
         if (!m2) return;
@@ -52520,7 +53320,7 @@ var SubagentMetaObserver = class {
   scan(w2) {
     let entries;
     try {
-      entries = import_node_fs28.default.readdirSync(w2.dirPath);
+      entries = import_node_fs29.default.readdirSync(w2.dirPath);
     } catch {
       return;
     }
@@ -52534,10 +53334,10 @@ var SubagentMetaObserver = class {
     if (!m2) return;
     const agentId = m2[1];
     if (w2.emitted.has(agentId)) return;
-    const file = import_node_path30.default.join(w2.dirPath, name);
+    const file = import_node_path31.default.join(w2.dirPath, name);
     let raw;
     try {
-      raw = import_node_fs28.default.readFileSync(file, "utf8");
+      raw = import_node_fs29.default.readFileSync(file, "utf8");
     } catch {
       return;
     }
@@ -52594,14 +53394,14 @@ var SessionObserver = class {
   metaObserver;
   resolveJsonlPath(cwd, toolSessionId, override) {
     if (override) return override;
-    return import_node_path31.default.join(this.home, ".claude", "projects", cwdToHashDir(cwd), `${toolSessionId}.jsonl`);
+    return import_node_path32.default.join(this.home, ".claude", "projects", cwdToHashDir(cwd), `${toolSessionId}.jsonl`);
   }
   start(args) {
     this.stop(args.sessionId);
     const filePath = this.resolveJsonlPath(args.cwd, args.toolSessionId, args.jsonlPath);
     let size = 0;
     try {
-      size = import_node_fs29.default.statSync(filePath).size;
+      size = import_node_fs30.default.statSync(filePath).size;
     } catch {
     }
     const w2 = {
@@ -52614,16 +53414,16 @@ var SessionObserver = class {
       adapter: args.adapter,
       prevIsRejectSentinel: false,
       toolSessionId: args.toolSessionId,
-      sawFile: import_node_fs29.default.existsSync(filePath),
+      sawFile: import_node_fs30.default.existsSync(filePath),
       lastRelocateScanMs: 0,
       pendingCwdDerive: false,
       lastDeriveMs: 0
     };
     try {
-      import_node_fs29.default.mkdirSync(import_node_path31.default.dirname(filePath), { recursive: true });
+      import_node_fs30.default.mkdirSync(import_node_path32.default.dirname(filePath), { recursive: true });
     } catch {
     }
-    w2.watcher = import_node_fs29.default.watch(import_node_path31.default.dirname(filePath), { persistent: false }, (_event, changedName) => {
+    w2.watcher = import_node_fs30.default.watch(import_node_path32.default.dirname(filePath), { persistent: false }, (_event, changedName) => {
       if (!changedName || !w2.filePath.endsWith(changedName)) return;
       this.poll(w2);
     });
@@ -52646,7 +53446,7 @@ var SessionObserver = class {
   // 异常静默吞，不阻塞 watcher 启动
   hydrateMetaTail(w2, maxLines = 200) {
     try {
-      const raw = import_node_fs29.default.readFileSync(w2.filePath, "utf8");
+      const raw = import_node_fs30.default.readFileSync(w2.filePath, "utf8");
       if (!raw) return;
       const allLines = raw.split("\n").filter((l) => l.trim().length > 0);
       if (allLines.length === 0) return;
@@ -52670,7 +53470,7 @@ var SessionObserver = class {
   poll(w2) {
     let size = 0;
     try {
-      size = import_node_fs29.default.statSync(w2.filePath).size;
+      size = import_node_fs30.default.statSync(w2.filePath).size;
     } catch {
       if (w2.sawFile) this.maybeRelocate(w2);
       return;
@@ -52681,11 +53481,11 @@ var SessionObserver = class {
       w2.buf = "";
     }
     if (size === w2.lastSize) return;
-    const fd = import_node_fs29.default.openSync(w2.filePath, "r");
+    const fd = import_node_fs30.default.openSync(w2.filePath, "r");
     try {
       const len = size - w2.lastSize;
       const buf = Buffer.alloc(len);
-      import_node_fs29.default.readSync(fd, buf, 0, len, w2.lastSize);
+      import_node_fs30.default.readSync(fd, buf, 0, len, w2.lastSize);
       w2.lastSize = size;
       w2.buf += buf.toString("utf8");
       let newlineIndex;
@@ -52708,7 +53508,7 @@ var SessionObserver = class {
         }
       }
     } finally {
-      import_node_fs29.default.closeSync(fd);
+      import_node_fs30.default.closeSync(fd);
     }
     if (w2.pendingCwdDerive) this.maybeDeriveCwd(w2);
   }
@@ -52720,7 +53520,7 @@ var SessionObserver = class {
     const now = Date.now();
     if (now - w2.lastRelocateScanMs < 1e3) return;
     w2.lastRelocateScanMs = now;
-    const projectsRoot = import_node_path31.default.join(this.home, ".claude", "projects");
+    const projectsRoot = import_node_path32.default.join(this.home, ".claude", "projects");
     const found = findTranscriptByToolSessionId(projectsRoot, w2.toolSessionId);
     if (!found || found === w2.filePath) return;
     try {
@@ -52729,7 +53529,7 @@ var SessionObserver = class {
     }
     w2.filePath = found;
     try {
-      w2.watcher = import_node_fs29.default.watch(import_node_path31.default.dirname(found), { persistent: false }, (_event, changedName) => {
+      w2.watcher = import_node_fs30.default.watch(import_node_path32.default.dirname(found), { persistent: false }, (_event, changedName) => {
         if (!changedName || !w2.filePath.endsWith(changedName)) return;
         this.poll(w2);
       });
@@ -53524,8 +54324,8 @@ async function authenticate(token, deps) {
 }
 
 // src/legacy-cleanup.ts
-var fs34 = __toESM(require("fs/promises"), 1);
-var path36 = __toESM(require("path"), 1);
+var fs35 = __toESM(require("fs/promises"), 1);
+var path37 = __toESM(require("path"), 1);
 var LEGACY_FILES = [
   "personal-capability.json",
   "received-capabilities.json",
@@ -53534,9 +54334,9 @@ var LEGACY_FILES = [
 async function cleanupLegacyCapabilityFiles(dataDir, logger) {
   const removed = [];
   for (const name of LEGACY_FILES) {
-    const p2 = path36.join(dataDir, name);
+    const p2 = path37.join(dataDir, name);
     try {
-      await fs34.unlink(p2);
+      await fs35.unlink(p2);
       removed.push(name);
       logger.debug("legacy capability file removed", { file: name });
     } catch (err) {
@@ -53548,13 +54348,13 @@ async function cleanupLegacyCapabilityFiles(dataDir, logger) {
 }
 
 // src/inbox/inbox-store.ts
-var fs35 = __toESM(require("fs"), 1);
-var path37 = __toESM(require("path"), 1);
+var fs36 = __toESM(require("fs"), 1);
+var path38 = __toESM(require("path"), 1);
 var INBOX_SUBDIR = "inbox";
 var InboxStore = class {
   constructor(dataDir) {
     this.dataDir = dataDir;
-    fs35.mkdirSync(this.dirPath(), { recursive: true });
+    fs36.mkdirSync(this.dirPath(), { recursive: true });
   }
   dataDir;
   /**
@@ -53566,7 +54366,7 @@ var InboxStore = class {
     const file = this.filePath(peerDeviceId);
     let raw;
     try {
-      raw = fs35.readFileSync(file, "utf8");
+      raw = fs36.readFileSync(file, "utf8");
     } catch (err) {
       if (err?.code === "ENOENT") return [];
       return [];
@@ -53582,7 +54382,7 @@ var InboxStore = class {
     const dir = this.dirPath();
     let entries;
     try {
-      entries = fs35.readdirSync(dir);
+      entries = fs36.readdirSync(dir);
     } catch (err) {
       if (err?.code === "ENOENT") return [];
       return [];
@@ -53598,9 +54398,9 @@ var InboxStore = class {
     if (existing.some((m2) => m2.id === message.id)) return;
     const file = this.filePath(message.peerDeviceId);
     const line = JSON.stringify(message) + "\n";
-    fs35.appendFileSync(file, line, { mode: 384 });
+    fs36.appendFileSync(file, line, { mode: 384 });
     try {
-      fs35.chmodSync(file, 384);
+      fs36.chmodSync(file, 384);
     } catch {
     }
   }
@@ -53630,7 +54430,7 @@ var InboxStore = class {
   removeByPeerDeviceId(peerDeviceId) {
     const file = this.filePath(peerDeviceId);
     try {
-      fs35.unlinkSync(file);
+      fs36.unlinkSync(file);
     } catch (err) {
       if (err?.code === "ENOENT") return;
     }
@@ -53639,18 +54439,18 @@ var InboxStore = class {
     const file = this.filePath(peerDeviceId);
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
     const content = messages.map((m2) => JSON.stringify(m2)).join("\n") + (messages.length > 0 ? "\n" : "");
-    fs35.writeFileSync(tmp, content, { mode: 384 });
-    fs35.renameSync(tmp, file);
+    fs36.writeFileSync(tmp, content, { mode: 384 });
+    fs36.renameSync(tmp, file);
     try {
-      fs35.chmodSync(file, 384);
+      fs36.chmodSync(file, 384);
     } catch {
     }
   }
   dirPath() {
-    return path37.join(this.dataDir, INBOX_SUBDIR);
+    return path38.join(this.dataDir, INBOX_SUBDIR);
   }
   filePath(peerDeviceId) {
-    return path37.join(this.dirPath(), `${peerDeviceId}.jsonl`);
+    return path38.join(this.dirPath(), `${peerDeviceId}.jsonl`);
   }
 };
 function parseAllLines(raw) {
@@ -53738,8 +54538,8 @@ var InboxManager = class {
 };
 
 // src/state/contact-store.ts
-var fs36 = __toESM(require("fs"), 1);
-var path38 = __toESM(require("path"), 1);
+var fs37 = __toESM(require("fs"), 1);
+var path39 = __toESM(require("path"), 1);
 var FILE_NAME = "contacts.json";
 var ContactStore = class {
   constructor(dataDir) {
@@ -53749,10 +54549,10 @@ var ContactStore = class {
   contacts = /* @__PURE__ */ new Map();
   load() {
     this.contacts.clear();
-    const file = path38.join(this.dataDir, FILE_NAME);
+    const file = path39.join(this.dataDir, FILE_NAME);
     let raw;
     try {
-      raw = fs36.readFileSync(file, "utf8");
+      raw = fs37.readFileSync(file, "utf8");
     } catch (err) {
       if (err?.code !== "ENOENT") this.renameBak(file);
       return;
@@ -53821,20 +54621,20 @@ var ContactStore = class {
     return true;
   }
   flush() {
-    const file = path38.join(this.dataDir, FILE_NAME);
+    const file = path39.join(this.dataDir, FILE_NAME);
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
     const content = JSON.stringify(
       { contacts: Array.from(this.contacts.values()) },
       null,
       2
     );
-    fs36.mkdirSync(this.dataDir, { recursive: true });
-    fs36.writeFileSync(tmp, content, { mode: 384 });
-    fs36.renameSync(tmp, file);
+    fs37.mkdirSync(this.dataDir, { recursive: true });
+    fs37.writeFileSync(tmp, content, { mode: 384 });
+    fs37.renameSync(tmp, file);
   }
   renameBak(file) {
     try {
-      fs36.renameSync(file, `${file}.bak`);
+      fs37.renameSync(file, `${file}.bak`);
     } catch {
     }
   }
@@ -53942,61 +54742,61 @@ async function connectRemote(args) {
 }
 
 // src/migrations/2026-05-20-flatten-sessions.ts
-var fs37 = __toESM(require("fs"), 1);
-var path39 = __toESM(require("path"), 1);
+var fs38 = __toESM(require("fs"), 1);
+var path40 = __toESM(require("path"), 1);
 var MIGRATION_FLAG_NAME = ".migration.v1.done";
 function migrateFlattenSessions(opts) {
   const dataDir = opts.dataDir;
   const now = opts.now ?? Date.now;
-  const sessionsDir = path39.join(dataDir, "sessions");
-  const flagPath = path39.join(sessionsDir, MIGRATION_FLAG_NAME);
+  const sessionsDir = path40.join(dataDir, "sessions");
+  const flagPath = path40.join(sessionsDir, MIGRATION_FLAG_NAME);
   if (existsSync3(flagPath)) {
     return { skipped: true, flagWritten: false, movedBare: 0, movedVmOwner: 0, archivedListener: 0 };
   }
   let movedBare = 0;
   let movedVmOwner = 0;
   let archivedListener = 0;
-  const defaultDir = path39.join(sessionsDir, "default");
+  const defaultDir = path40.join(sessionsDir, "default");
   if (existsSync3(defaultDir)) {
     for (const entry of readdirSafe(defaultDir)) {
       if (!entry.endsWith(".json")) continue;
-      const src = path39.join(defaultDir, entry);
-      const dst = path39.join(sessionsDir, entry);
-      fs37.renameSync(src, dst);
+      const src = path40.join(defaultDir, entry);
+      const dst = path40.join(sessionsDir, entry);
+      fs38.renameSync(src, dst);
       movedBare += 1;
     }
     rmdirIfEmpty(defaultDir);
   }
   for (const pid of readdirSafe(sessionsDir)) {
-    const personaDir = path39.join(sessionsDir, pid);
+    const personaDir = path40.join(sessionsDir, pid);
     if (!isDir(personaDir)) continue;
     if (pid === "default") continue;
-    const ownerSrc = path39.join(personaDir, "owner");
+    const ownerSrc = path40.join(personaDir, "owner");
     if (existsSync3(ownerSrc) && isDir(ownerSrc)) {
-      const ownerDst = path39.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
-      fs37.mkdirSync(ownerDst, { recursive: true });
+      const ownerDst = path40.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
+      fs38.mkdirSync(ownerDst, { recursive: true });
       for (const file of readdirSafe(ownerSrc)) {
         if (!file.endsWith(".json")) continue;
-        fs37.renameSync(path39.join(ownerSrc, file), path39.join(ownerDst, file));
+        fs38.renameSync(path40.join(ownerSrc, file), path40.join(ownerDst, file));
         movedVmOwner += 1;
       }
       rmdirIfEmpty(ownerSrc);
     }
-    const listenerSrc = path39.join(personaDir, "listener");
+    const listenerSrc = path40.join(personaDir, "listener");
     if (existsSync3(listenerSrc) && isDir(listenerSrc)) {
-      const archiveDst = path39.join(dataDir, ".legacy", `listener-${pid}`);
-      fs37.mkdirSync(archiveDst, { recursive: true });
+      const archiveDst = path40.join(dataDir, ".legacy", `listener-${pid}`);
+      fs38.mkdirSync(archiveDst, { recursive: true });
       for (const file of readdirSafe(listenerSrc)) {
         if (!file.endsWith(".json")) continue;
-        fs37.renameSync(path39.join(listenerSrc, file), path39.join(archiveDst, file));
+        fs38.renameSync(path40.join(listenerSrc, file), path40.join(archiveDst, file));
         archivedListener += 1;
       }
       rmdirIfEmpty(listenerSrc);
     }
     rmdirIfEmpty(personaDir);
   }
-  fs37.mkdirSync(sessionsDir, { recursive: true });
-  fs37.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
+  fs38.mkdirSync(sessionsDir, { recursive: true });
+  fs38.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
   return {
     skipped: false,
     flagWritten: true,
@@ -54007,7 +54807,7 @@ function migrateFlattenSessions(opts) {
 }
 function existsSync3(p2) {
   try {
-    fs37.statSync(p2);
+    fs38.statSync(p2);
     return true;
   } catch {
     return false;
@@ -54015,31 +54815,31 @@ function existsSync3(p2) {
 }
 function isDir(p2) {
   try {
-    return fs37.statSync(p2).isDirectory();
+    return fs38.statSync(p2).isDirectory();
   } catch {
     return false;
   }
 }
 function readdirSafe(p2) {
   try {
-    return fs37.readdirSync(p2);
+    return fs38.readdirSync(p2);
   } catch {
     return [];
   }
 }
 function rmdirIfEmpty(p2) {
   try {
-    fs37.rmdirSync(p2);
+    fs38.rmdirSync(p2);
   } catch {
   }
 }
 
 // src/transport/http-router.ts
-var import_node_fs31 = __toESM(require("fs"), 1);
-var import_node_path35 = __toESM(require("path"), 1);
+var import_node_fs32 = __toESM(require("fs"), 1);
+var import_node_path36 = __toESM(require("path"), 1);
 
 // src/attachment/mime.ts
-var import_node_path32 = __toESM(require("path"), 1);
+var import_node_path33 = __toESM(require("path"), 1);
 var TEXT_PLAIN = "text/plain; charset=utf-8";
 var EXT_TO_NATIVE_MIME = {
   // 图片
@@ -54146,14 +54946,14 @@ var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mk"
 ]);
 function lookupMime(filePathOrName) {
-  const ext = import_node_path32.default.extname(filePathOrName).toLowerCase();
+  const ext = import_node_path33.default.extname(filePathOrName).toLowerCase();
   if (EXT_TO_NATIVE_MIME[ext]) return EXT_TO_NATIVE_MIME[ext];
   if (TEXT_EXTENSIONS.has(ext)) return TEXT_PLAIN;
   return "application/octet-stream";
 }
 
 // src/attachment/sign-url.ts
-var import_node_crypto6 = __toESM(require("crypto"), 1);
+var import_node_crypto7 = __toESM(require("crypto"), 1);
 var HMAC_ALGO = "sha256";
 function base64urlEncode(buf) {
   const b2 = typeof buf === "string" ? Buffer.from(buf, "utf8") : buf;
@@ -54171,7 +54971,7 @@ function decodeAbsPathFromUrl(encoded) {
 var DOMAIN_PREFIX2 = "clawd-attach-v1|";
 function computeSig(secret, absPath, e) {
   const msg = e === null ? `${DOMAIN_PREFIX2}${absPath}` : `${DOMAIN_PREFIX2}${absPath}|${e}`;
-  return import_node_crypto6.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
+  return import_node_crypto7.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
 }
 function signUrlParts(secret, absPath, ttlSeconds, now = Date.now) {
   const e = ttlSeconds === null ? null : Math.floor(now() / 1e3) + ttlSeconds;
@@ -54206,7 +55006,7 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
   if (provided.length !== expected.length) {
     return { ok: false, code: "BAD_SIG" };
   }
-  if (!import_node_crypto6.default.timingSafeEqual(provided, expected)) {
+  if (!import_node_crypto7.default.timingSafeEqual(provided, expected)) {
     return { ok: false, code: "BAD_SIG" };
   }
   if (e !== null && now() / 1e3 > e) {
@@ -54216,9 +55016,9 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
 }
 
 // src/attachment/upload.ts
-var import_node_fs30 = __toESM(require("fs"), 1);
-var import_node_path33 = __toESM(require("path"), 1);
-var import_node_crypto7 = __toESM(require("crypto"), 1);
+var import_node_fs31 = __toESM(require("fs"), 1);
+var import_node_path34 = __toESM(require("path"), 1);
+var import_node_crypto8 = __toESM(require("crypto"), 1);
 var import_promises3 = require("stream/promises");
 var UploadError = class extends Error {
   constructor(code, message) {
@@ -54229,24 +55029,24 @@ var UploadError = class extends Error {
   code;
 };
 function assertValidFileName(fileName) {
-  if (fileName.length === 0 || fileName === "." || fileName === ".." || fileName.startsWith(".") || fileName.includes("/") || fileName.includes("\\") || fileName !== import_node_path33.default.basename(fileName)) {
+  if (fileName.length === 0 || fileName === "." || fileName === ".." || fileName.startsWith(".") || fileName.includes("/") || fileName.includes("\\") || fileName !== import_node_path34.default.basename(fileName)) {
     throw new UploadError("INVALID_FILENAME", `fileName must be a plain basename, got: ${fileName}`);
   }
 }
 var HASH_PREFIX_LEN = 16;
 async function writeUploadedAttachment(args) {
   assertValidFileName(args.fileName);
-  const attachmentsRoot = import_node_path33.default.join(args.sessionDir, ".attachments");
+  const attachmentsRoot = import_node_path34.default.join(args.sessionDir, ".attachments");
   try {
-    import_node_fs30.default.mkdirSync(attachmentsRoot, { recursive: true });
+    import_node_fs31.default.mkdirSync(attachmentsRoot, { recursive: true });
   } catch (err) {
     throw new UploadError("STORAGE_ERROR", `mkdir failed: ${err.message}`);
   }
-  const hasher = import_node_crypto7.default.createHash("sha256");
+  const hasher = import_node_crypto8.default.createHash("sha256");
   let actualSize = 0;
-  const tmpPath = import_node_path33.default.join(
+  const tmpPath = import_node_path34.default.join(
     attachmentsRoot,
-    `.upload-${process.pid}-${Date.now()}-${import_node_crypto7.default.randomBytes(4).toString("hex")}`
+    `.upload-${process.pid}-${Date.now()}-${import_node_crypto8.default.randomBytes(4).toString("hex")}`
   );
   try {
     await (0, import_promises3.pipeline)(
@@ -54259,18 +55059,18 @@ async function writeUploadedAttachment(args) {
           yield buf;
         }
       },
-      import_node_fs30.default.createWriteStream(tmpPath, { mode: 384 })
+      import_node_fs31.default.createWriteStream(tmpPath, { mode: 384 })
     );
   } catch (err) {
     try {
-      import_node_fs30.default.unlinkSync(tmpPath);
+      import_node_fs31.default.unlinkSync(tmpPath);
     } catch {
     }
     throw new UploadError("STORAGE_ERROR", `write failed: ${err.message}`);
   }
   if (actualSize !== args.contentLength) {
     try {
-      import_node_fs30.default.unlinkSync(tmpPath);
+      import_node_fs31.default.unlinkSync(tmpPath);
     } catch {
     }
     throw new UploadError(
@@ -54279,35 +55079,35 @@ async function writeUploadedAttachment(args) {
     );
   }
   const attachmentId = hasher.digest("hex").slice(0, HASH_PREFIX_LEN);
-  const hashDir = import_node_path33.default.join(attachmentsRoot, attachmentId);
+  const hashDir = import_node_path34.default.join(attachmentsRoot, attachmentId);
   let finalFileName;
   let hashDirExists = false;
   try {
-    hashDirExists = import_node_fs30.default.statSync(hashDir).isDirectory();
+    hashDirExists = import_node_fs31.default.statSync(hashDir).isDirectory();
   } catch {
   }
   if (hashDirExists) {
-    const existing = import_node_fs30.default.readdirSync(hashDir).filter((n) => !n.startsWith("."));
+    const existing = import_node_fs31.default.readdirSync(hashDir).filter((n) => !n.startsWith("."));
     finalFileName = existing[0] ?? args.fileName;
     try {
-      import_node_fs30.default.unlinkSync(tmpPath);
+      import_node_fs31.default.unlinkSync(tmpPath);
     } catch {
     }
   } else {
     try {
-      import_node_fs30.default.mkdirSync(hashDir, { recursive: true });
+      import_node_fs31.default.mkdirSync(hashDir, { recursive: true });
       finalFileName = args.fileName;
-      import_node_fs30.default.renameSync(tmpPath, import_node_path33.default.join(hashDir, finalFileName));
+      import_node_fs31.default.renameSync(tmpPath, import_node_path34.default.join(hashDir, finalFileName));
     } catch (err) {
       try {
-        import_node_fs30.default.unlinkSync(tmpPath);
+        import_node_fs31.default.unlinkSync(tmpPath);
       } catch {
       }
       throw new UploadError("STORAGE_ERROR", `rename failed: ${err.message}`);
     }
   }
-  const absPath = import_node_path33.default.join(hashDir, finalFileName);
-  const relPath = import_node_path33.default.relative(args.sessionDir, absPath);
+  const absPath = import_node_path34.default.join(hashDir, finalFileName);
+  const relPath = import_node_path34.default.relative(args.sessionDir, absPath);
   args.groupFileStore.upsert(args.scope, args.sessionId, {
     relPath: absPath,
     // 存绝对路径，与现有 agent 入清单的形态一致（attachment.ts:144 双形态兼容）
@@ -54321,7 +55121,7 @@ async function writeUploadedAttachment(args) {
 
 // src/extension/import.ts
 var import_promises4 = __toESM(require("fs/promises"), 1);
-var import_node_path34 = __toESM(require("path"), 1);
+var import_node_path35 = __toESM(require("path"), 1);
 var import_node_os12 = __toESM(require("os"), 1);
 var import_jszip = __toESM(require_lib3(), 1);
 var ImportError = class extends Error {
@@ -54339,7 +55139,7 @@ async function importZip(buf, root) {
     throw new ImportError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path34.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path35.default.isAbsolute(name)) {
       throw new ImportError("ZIP_INVALID", `unsafe zip entry path: ${name}`);
     }
   }
@@ -54372,7 +55172,7 @@ async function importZip(buf, root) {
       );
     }
   }
-  const destDir = import_node_path34.default.join(root, manifest.id);
+  const destDir = import_node_path35.default.join(root, manifest.id);
   let destExists = false;
   try {
     await import_promises4.default.access(destDir);
@@ -54382,15 +55182,15 @@ async function importZip(buf, root) {
   if (destExists) {
     throw new ImportError("ALREADY_EXISTS", `extension ${manifest.id} already installed`);
   }
-  const stage = await import_promises4.default.mkdtemp(import_node_path34.default.join(import_node_os12.default.tmpdir(), `clawd-ext-stage-${manifest.id}-`));
+  const stage = await import_promises4.default.mkdtemp(import_node_path35.default.join(import_node_os12.default.tmpdir(), `clawd-ext-stage-${manifest.id}-`));
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path34.default.join(stage, name);
+      const dest = import_node_path35.default.join(stage, name);
       if (entry.dir) {
         await import_promises4.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises4.default.mkdir(import_node_path34.default.dirname(dest), { recursive: true });
+      await import_promises4.default.mkdir(import_node_path35.default.dirname(dest), { recursive: true });
       const content = await entry.async("nodebuffer");
       await import_promises4.default.writeFile(dest, content);
     }
@@ -54420,7 +55220,7 @@ var SHARE_UI_ASSET_MIME = {
   ".wasm": "application/wasm"
 };
 function shareUiAssetMime(filePath) {
-  const ext = import_node_path35.default.extname(filePath).toLowerCase();
+  const ext = import_node_path36.default.extname(filePath).toLowerCase();
   return SHARE_UI_ASSET_MIME[ext] ?? lookupMime(filePath);
 }
 var AUTHED_RPC_ROUTE_PREFIX = "/rpc/";
@@ -54445,6 +55245,24 @@ function authedRpcErrorStatus(code) {
       return 400;
   }
 }
+var LARK_BOT_EVENT_MAX_BYTES = 64 * 1024;
+async function readRawBody(req, max) {
+  return await new Promise((resolve6, reject) => {
+    let size = 0;
+    const chunks = [];
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > max) {
+        reject(new Error(`body too large (> ${max} bytes)`));
+        req.destroy();
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => resolve6(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
 async function readJsonBody(req, max) {
   return await new Promise((resolve6, reject) => {
     let size = 0;
@@ -54501,7 +55319,7 @@ function isValidUploadFileName(fileName) {
   if (fileName === "." || fileName === "..") return false;
   if (fileName.startsWith(".")) return false;
   if (fileName.includes("/") || fileName.includes("\\")) return false;
-  return fileName === import_node_path35.default.basename(fileName);
+  return fileName === import_node_path36.default.basename(fileName);
 }
 function createHttpRouter(deps) {
   return async (req, res) => {
@@ -54557,6 +55375,22 @@ function createHttpRouter(deps) {
       else sendJson(res, 403, { code: r.reason }, AUTHED_RPC_CORS_HEADERS);
       return true;
     }
+    if (url.pathname === "/lark-bot-connector/event" && req.method === "POST") {
+      if (!deps.larkBotEvent) {
+        sendJson(res, 501, { code: "NOT_IMPLEMENTED", message: "lark bot event not wired" });
+        return true;
+      }
+      let raw;
+      try {
+        raw = await readRawBody(req, LARK_BOT_EVENT_MAX_BYTES);
+      } catch (err) {
+        sendJson(res, 400, { code: "INVALID_BODY", message: err instanceof Error ? err.message : String(err) });
+        return true;
+      }
+      const r = deps.larkBotEvent(raw);
+      sendJson(res, r.status, r.body);
+      return true;
+    }
     if ((url.pathname === "/s" || url.pathname.startsWith("/s/")) && req.method === "GET") {
       if (!deps.shareUiAssetLoader) {
         sendJson(res, 501, { code: "NOT_IMPLEMENTED", message: "share-ui assets not loaded" });
@@ -54573,7 +55407,7 @@ function createHttpRouter(deps) {
       }
       let buf;
       try {
-        buf = await import_node_fs31.default.promises.readFile(abs);
+        buf = await import_node_fs32.default.promises.readFile(abs);
       } catch {
         sendJson(res, 404, { code: "NOT_FOUND", message: "asset not found" });
         return true;
@@ -54721,7 +55555,7 @@ function createHttpRouter(deps) {
         sendHtml(res, statusByCode[r.code], loader.renderErrorHtml(r.code, msgByCode[r.code]));
         return true;
       }
-      sendHtml(res, 200, loader.renderViewerHtml(import_node_path35.default.basename(r.absPath)));
+      sendHtml(res, 200, loader.renderViewerHtml(import_node_path36.default.basename(r.absPath)));
       return true;
     }
     const ctx = deps.authResolver.resolveFromHeader(
@@ -54842,7 +55676,7 @@ function createHttpRouter(deps) {
         return true;
       }
       let absPath;
-      if (import_node_path35.default.isAbsolute(pathParam)) {
+      if (import_node_path36.default.isAbsolute(pathParam)) {
         absPath = pathParam;
       } else if (deps.sessionStore) {
         const file = deps.sessionStore.read(sid);
@@ -54850,7 +55684,7 @@ function createHttpRouter(deps) {
           sendJson(res, 404, { code: "NOT_FOUND", message: `session ${sid} not found` });
           return true;
         }
-        absPath = import_node_path35.default.join(file.cwd, pathParam);
+        absPath = import_node_path36.default.join(file.cwd, pathParam);
       } else {
         sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "sessionStore not wired" }));
         return true;
@@ -54937,7 +55771,7 @@ function withCtx(ctx, body) {
 function streamFile(res, absPath, logger) {
   let stat;
   try {
-    stat = import_node_fs31.default.statSync(absPath);
+    stat = import_node_fs32.default.statSync(absPath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
@@ -54952,7 +55786,7 @@ function streamFile(res, absPath, logger) {
     return;
   }
   const mime = lookupMime(absPath);
-  const basename = import_node_path35.default.basename(absPath);
+  const basename = import_node_path36.default.basename(absPath);
   res.writeHead(200, {
     "Content-Type": mime,
     "Content-Length": String(stat.size),
@@ -54960,7 +55794,7 @@ function streamFile(res, absPath, logger) {
     // 防止浏览器把任意 mime 当 html 渲染
     "X-Content-Type-Options": "nosniff"
   });
-  const stream = import_node_fs31.default.createReadStream(absPath);
+  const stream = import_node_fs32.default.createReadStream(absPath);
   stream.on("error", (err) => {
     logger?.warn("streamFile read error", { absPath, err: err.message });
     res.destroy();
@@ -54969,8 +55803,8 @@ function streamFile(res, absPath, logger) {
 }
 
 // src/attachment/gc.ts
-var import_node_fs32 = __toESM(require("fs"), 1);
-var import_node_path36 = __toESM(require("path"), 1);
+var import_node_fs33 = __toESM(require("fs"), 1);
+var import_node_path37 = __toESM(require("path"), 1);
 var DEFAULT_TTL_MS = 30 * 24 * 3600 * 1e3;
 function runAttachmentGc(args) {
   const now = (args.now ?? Date.now)();
@@ -54979,38 +55813,38 @@ function runAttachmentGc(args) {
   for (const { scope, sessionId } of args.sessionScopes) {
     for (const entry of args.groupFileStore.list(scope, sessionId)) {
       if (entry.stale) continue;
-      if (import_node_path36.default.isAbsolute(entry.relPath)) liveAbs.add(entry.relPath);
+      if (import_node_path37.default.isAbsolute(entry.relPath)) liveAbs.add(entry.relPath);
     }
   }
   for (const { scope, sessionId } of args.sessionScopes) {
-    const sessionDir = args.getSessionCwd?.(sessionId) ?? import_node_path36.default.join(
+    const sessionDir = args.getSessionCwd?.(sessionId) ?? import_node_path37.default.join(
       args.dataDir,
       "sessions",
       ...scopeSubPath(scope).map(safeFileName),
       safeFileName(sessionId)
     );
-    const attRoot = import_node_path36.default.join(sessionDir, ".attachments");
+    const attRoot = import_node_path37.default.join(sessionDir, ".attachments");
     let hashDirs;
     try {
-      hashDirs = import_node_fs32.default.readdirSync(attRoot);
+      hashDirs = import_node_fs33.default.readdirSync(attRoot);
     } catch (err) {
       if (err.code === "ENOENT") continue;
       args.logger?.warn("attachment gc: readdir failed", { attRoot, err: err.message });
       continue;
     }
     for (const hashDir of hashDirs) {
-      const hashDirAbs = import_node_path36.default.join(attRoot, hashDir);
+      const hashDirAbs = import_node_path37.default.join(attRoot, hashDir);
       let files;
       try {
-        files = import_node_fs32.default.readdirSync(hashDirAbs);
+        files = import_node_fs33.default.readdirSync(hashDirAbs);
       } catch {
         continue;
       }
       for (const name of files) {
-        const file = import_node_path36.default.join(hashDirAbs, name);
+        const file = import_node_path37.default.join(hashDirAbs, name);
         let stat;
         try {
-          stat = import_node_fs32.default.statSync(file);
+          stat = import_node_fs33.default.statSync(file);
         } catch {
           continue;
         }
@@ -55019,27 +55853,27 @@ function runAttachmentGc(args) {
         if (age < ttlMs) continue;
         if (liveAbs.has(file)) continue;
         try {
-          import_node_fs32.default.unlinkSync(file);
+          import_node_fs33.default.unlinkSync(file);
         } catch (err) {
           args.logger?.warn("attachment gc: unlink failed", { file, err: err.message });
         }
       }
       try {
-        if (import_node_fs32.default.readdirSync(hashDirAbs).length === 0) import_node_fs32.default.rmdirSync(hashDirAbs);
+        if (import_node_fs33.default.readdirSync(hashDirAbs).length === 0) import_node_fs33.default.rmdirSync(hashDirAbs);
       } catch {
       }
     }
     try {
-      if (import_node_fs32.default.readdirSync(attRoot).length === 0) import_node_fs32.default.rmdirSync(attRoot);
+      if (import_node_fs33.default.readdirSync(attRoot).length === 0) import_node_fs33.default.rmdirSync(attRoot);
     } catch {
     }
   }
 }
 
 // src/attachment/group.ts
-var import_node_fs33 = __toESM(require("fs"), 1);
-var import_node_path37 = __toESM(require("path"), 1);
-var import_node_crypto8 = __toESM(require("crypto"), 1);
+var import_node_fs34 = __toESM(require("fs"), 1);
+var import_node_path38 = __toESM(require("path"), 1);
+var import_node_crypto9 = __toESM(require("crypto"), 1);
 init_protocol();
 var GroupFileStore = class {
   dataDir;
@@ -55050,11 +55884,11 @@ var GroupFileStore = class {
     this.logger = opts.logger;
   }
   rootForScope(scope) {
-    return import_node_path37.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
+    return import_node_path38.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
   }
   /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
   filePath(scope, sessionId) {
-    return import_node_path37.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
+    return import_node_path38.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
   }
   cacheKey(scope, sessionId) {
     return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
@@ -55063,7 +55897,7 @@ var GroupFileStore = class {
   readFile(scope, sessionId) {
     const file = this.filePath(scope, sessionId);
     try {
-      const raw = import_node_fs33.default.readFileSync(file, "utf8");
+      const raw = import_node_fs34.default.readFileSync(file, "utf8");
       const parsed = JSON.parse(raw);
       if (!Array.isArray(parsed)) {
         this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
@@ -55089,10 +55923,10 @@ var GroupFileStore = class {
   }
   writeFile(scope, sessionId, entries) {
     const file = this.filePath(scope, sessionId);
-    import_node_fs33.default.mkdirSync(import_node_path37.default.dirname(file), { recursive: true });
+    import_node_fs34.default.mkdirSync(import_node_path38.default.dirname(file), { recursive: true });
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
-    import_node_fs33.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
-    import_node_fs33.default.renameSync(tmp, file);
+    import_node_fs34.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
+    import_node_fs34.default.renameSync(tmp, file);
   }
   /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
   list(scope, sessionId) {
@@ -55128,7 +55962,7 @@ var GroupFileStore = class {
       entries[idx] = next;
     } else {
       next = {
-        id: `gf-${import_node_crypto8.default.randomBytes(6).toString("base64url")}`,
+        id: `gf-${import_node_crypto9.default.randomBytes(6).toString("base64url")}`,
         relPath: input.relPath,
         from: input.from,
         label: input.label,
@@ -55178,10 +56012,10 @@ var GroupFileStore = class {
 };
 
 // src/discovery/state-file.ts
-var import_node_fs34 = __toESM(require("fs"), 1);
-var import_node_path38 = __toESM(require("path"), 1);
+var import_node_fs35 = __toESM(require("fs"), 1);
+var import_node_path39 = __toESM(require("path"), 1);
 function defaultStateFilePath(dataDir) {
-  return import_node_path38.default.join(dataDir, "state.json");
+  return import_node_path39.default.join(dataDir, "state.json");
 }
 function isPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
@@ -55203,7 +56037,7 @@ var StateFileManager = class {
   }
   read() {
     try {
-      const raw = import_node_fs34.default.readFileSync(this.file, "utf8");
+      const raw = import_node_fs35.default.readFileSync(this.file, "utf8");
       const parsed = JSON.parse(raw);
       return parsed;
     } catch {
@@ -55217,20 +56051,20 @@ var StateFileManager = class {
     return { status: "stale", existing };
   }
   write(state) {
-    import_node_fs34.default.mkdirSync(import_node_path38.default.dirname(this.file), { recursive: true });
+    import_node_fs35.default.mkdirSync(import_node_path39.default.dirname(this.file), { recursive: true });
     const tmp = `${this.file}.tmp.${process.pid}.${Date.now()}`;
-    import_node_fs34.default.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 384 });
-    import_node_fs34.default.renameSync(tmp, this.file);
+    import_node_fs35.default.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 384 });
+    import_node_fs35.default.renameSync(tmp, this.file);
     if (process.platform !== "win32") {
       try {
-        import_node_fs34.default.chmodSync(this.file, 384);
+        import_node_fs35.default.chmodSync(this.file, 384);
       } catch {
       }
     }
   }
   delete() {
     try {
-      import_node_fs34.default.unlinkSync(this.file);
+      import_node_fs35.default.unlinkSync(this.file);
     } catch {
     }
   }
@@ -55244,14 +56078,14 @@ function readSpawnedByDesktopFromEnv(env = process.env) {
 }
 
 // src/tunnel/tunnel-manager.ts
-var import_node_fs38 = __toESM(require("fs"), 1);
-var import_node_path42 = __toESM(require("path"), 1);
-var import_node_crypto9 = __toESM(require("crypto"), 1);
+var import_node_fs39 = __toESM(require("fs"), 1);
+var import_node_path43 = __toESM(require("path"), 1);
+var import_node_crypto10 = __toESM(require("crypto"), 1);
 var import_node_child_process9 = require("child_process");
 
 // src/tunnel/tunnel-store.ts
-var import_node_fs35 = __toESM(require("fs"), 1);
-var import_node_path39 = __toESM(require("path"), 1);
+var import_node_fs36 = __toESM(require("fs"), 1);
+var import_node_path40 = __toESM(require("path"), 1);
 var TunnelStore = class {
   constructor(filePath) {
     this.filePath = filePath;
@@ -55259,7 +56093,7 @@ var TunnelStore = class {
   filePath;
   async get() {
     try {
-      const raw = await import_node_fs35.default.promises.readFile(this.filePath, "utf8");
+      const raw = await import_node_fs36.default.promises.readFile(this.filePath, "utf8");
       const obj = JSON.parse(raw);
       if (!isPersistedTunnel(obj)) return null;
       return obj;
@@ -55270,22 +56104,22 @@ var TunnelStore = class {
     }
   }
   async set(v2) {
-    const dir = import_node_path39.default.dirname(this.filePath);
-    await import_node_fs35.default.promises.mkdir(dir, { recursive: true });
+    const dir = import_node_path40.default.dirname(this.filePath);
+    await import_node_fs36.default.promises.mkdir(dir, { recursive: true });
     const data = JSON.stringify(v2, null, 2);
     const tmp = `${this.filePath}.tmp.${process.pid}.${Date.now()}`;
-    await import_node_fs35.default.promises.writeFile(tmp, data, { mode: 384 });
+    await import_node_fs36.default.promises.writeFile(tmp, data, { mode: 384 });
     if (process.platform !== "win32") {
       try {
-        await import_node_fs35.default.promises.chmod(tmp, 384);
+        await import_node_fs36.default.promises.chmod(tmp, 384);
       } catch {
       }
     }
-    await import_node_fs35.default.promises.rename(tmp, this.filePath);
+    await import_node_fs36.default.promises.rename(tmp, this.filePath);
   }
   async clear() {
     try {
-      await import_node_fs35.default.promises.unlink(this.filePath);
+      await import_node_fs36.default.promises.unlink(this.filePath);
     } catch (err) {
       const code = err?.code;
       if (code !== "ENOENT") throw err;
@@ -55380,9 +56214,9 @@ function escape(v2) {
 }
 
 // src/tunnel/frpc-binary.ts
-var import_node_fs36 = __toESM(require("fs"), 1);
+var import_node_fs37 = __toESM(require("fs"), 1);
 var import_node_os13 = __toESM(require("os"), 1);
-var import_node_path40 = __toESM(require("path"), 1);
+var import_node_path41 = __toESM(require("path"), 1);
 var import_node_child_process7 = require("child_process");
 var import_node_stream3 = require("stream");
 var import_promises5 = require("stream/promises");
@@ -55414,20 +56248,20 @@ function frpcDownloadUrl(version2, p2) {
 }
 async function ensureFrpcBinary(opts) {
   if (opts.override) {
-    if (!import_node_fs36.default.existsSync(opts.override)) {
+    if (!import_node_fs37.default.existsSync(opts.override)) {
       throw new Error(`frpc binary not found at override path: ${opts.override}`);
     }
     return opts.override;
   }
   const version2 = opts.version ?? FRPC_VERSION;
   const platform = opts.platform ?? detectPlatform();
-  const binDir = import_node_path40.default.join(opts.dataDir, "bin");
-  import_node_fs36.default.mkdirSync(binDir, { recursive: true });
+  const binDir = import_node_path41.default.join(opts.dataDir, "bin");
+  import_node_fs37.default.mkdirSync(binDir, { recursive: true });
   cleanupStaleArtifacts(binDir);
-  const stableBin = import_node_path40.default.join(binDir, "frpc");
-  if (import_node_fs36.default.existsSync(stableBin)) return stableBin;
+  const stableBin = import_node_path41.default.join(binDir, "frpc");
+  if (import_node_fs37.default.existsSync(stableBin)) return stableBin;
   const partialBin = `${stableBin}.partial`;
-  const tarballPath = import_node_path40.default.join(binDir, `frp_${version2}_${platform.os}_${platform.arch}.tar.gz.partial`);
+  const tarballPath = import_node_path41.default.join(binDir, `frp_${version2}_${platform.os}_${platform.arch}.tar.gz.partial`);
   try {
     const url = frpcDownloadUrl(version2, platform);
     await downloadToFile(url, tarballPath, opts.fetchImpl);
@@ -55436,8 +56270,8 @@ async function ensureFrpcBinary(opts) {
     } else {
       await extractFrpcFromTarball(tarballPath, binDir, version2, platform, partialBin);
     }
-    import_node_fs36.default.chmodSync(partialBin, 493);
-    import_node_fs36.default.renameSync(partialBin, stableBin);
+    import_node_fs37.default.chmodSync(partialBin, 493);
+    import_node_fs37.default.renameSync(partialBin, stableBin);
   } finally {
     safeUnlink(tarballPath);
     safeUnlink(partialBin);
@@ -55447,15 +56281,15 @@ async function ensureFrpcBinary(opts) {
 function cleanupStaleArtifacts(binDir) {
   let entries;
   try {
-    entries = import_node_fs36.default.readdirSync(binDir);
+    entries = import_node_fs37.default.readdirSync(binDir);
   } catch {
     return;
   }
   for (const name of entries) {
     if (name.endsWith(".partial") || name.startsWith("extract-")) {
-      const full = import_node_path40.default.join(binDir, name);
+      const full = import_node_path41.default.join(binDir, name);
       try {
-        import_node_fs36.default.rmSync(full, { recursive: true, force: true });
+        import_node_fs37.default.rmSync(full, { recursive: true, force: true });
       } catch {
       }
     }
@@ -55463,7 +56297,7 @@ function cleanupStaleArtifacts(binDir) {
 }
 function safeUnlink(p2) {
   try {
-    import_node_fs36.default.unlinkSync(p2);
+    import_node_fs37.default.unlinkSync(p2);
   } catch {
   }
 }
@@ -55474,13 +56308,13 @@ async function downloadToFile(url, dest, fetchImpl) {
   if (!res.ok || !res.body) {
     throw new Error(`download failed: ${res.status} ${res.statusText}`);
   }
-  const out = import_node_fs36.default.createWriteStream(dest);
+  const out = import_node_fs37.default.createWriteStream(dest);
   const nodeStream = import_node_stream3.Readable.fromWeb(res.body);
   await (0, import_promises5.pipeline)(nodeStream, out);
 }
 async function extractFrpcFromTarball(tarball, binDir, version2, platform, destBin) {
-  const work = import_node_path40.default.join(binDir, `extract-${process.pid}-${Date.now()}`);
-  import_node_fs36.default.mkdirSync(work, { recursive: true });
+  const work = import_node_path41.default.join(binDir, `extract-${process.pid}-${Date.now()}`);
+  import_node_fs37.default.mkdirSync(work, { recursive: true });
   try {
     await new Promise((resolve6, reject) => {
       const proc = (0, import_node_child_process7.spawn)("tar", ["xzf", tarball, "-C", work], { stdio: "pipe" });
@@ -55488,32 +56322,32 @@ async function extractFrpcFromTarball(tarball, binDir, version2, platform, destB
       proc.on("exit", (code) => code === 0 ? resolve6() : reject(new Error(`tar exited ${code}`)));
     });
     const dirName = `frp_${version2}_${platform.os}_${platform.arch}`;
-    const src = import_node_path40.default.join(work, dirName, "frpc");
-    if (!import_node_fs36.default.existsSync(src)) {
+    const src = import_node_path41.default.join(work, dirName, "frpc");
+    if (!import_node_fs37.default.existsSync(src)) {
       throw new Error(`frpc not found inside tarball at ${src}`);
     }
-    import_node_fs36.default.copyFileSync(src, destBin);
+    import_node_fs37.default.copyFileSync(src, destBin);
   } finally {
-    import_node_fs36.default.rmSync(work, { recursive: true, force: true });
+    import_node_fs37.default.rmSync(work, { recursive: true, force: true });
   }
 }
 
 // src/tunnel/frpc-process.ts
-var import_node_fs37 = __toESM(require("fs"), 1);
-var import_node_path41 = __toESM(require("path"), 1);
+var import_node_fs38 = __toESM(require("fs"), 1);
+var import_node_path42 = __toESM(require("path"), 1);
 var import_node_child_process8 = require("child_process");
 function frpcPidFilePath(dataDir) {
-  return import_node_path41.default.join(dataDir, "frpc.pid");
+  return import_node_path42.default.join(dataDir, "frpc.pid");
 }
 function writeFrpcPid(dataDir, pid) {
   try {
-    import_node_fs37.default.writeFileSync(frpcPidFilePath(dataDir), String(pid), { mode: 384 });
+    import_node_fs38.default.writeFileSync(frpcPidFilePath(dataDir), String(pid), { mode: 384 });
   } catch {
   }
 }
 function clearFrpcPid(dataDir) {
   try {
-    import_node_fs37.default.unlinkSync(frpcPidFilePath(dataDir));
+    import_node_fs38.default.unlinkSync(frpcPidFilePath(dataDir));
   } catch {
   }
 }
@@ -55529,7 +56363,7 @@ function defaultIsPidAlive(pid) {
 }
 function defaultReadPidFile(file) {
   try {
-    return import_node_fs37.default.readFileSync(file, "utf8");
+    return import_node_fs38.default.readFileSync(file, "utf8");
   } catch {
     return null;
   }
@@ -55545,7 +56379,7 @@ function defaultSleep2(ms) {
 }
 async function killStaleFrpc(deps) {
   const pidFile = frpcPidFilePath(deps.dataDir);
-  const tomlPath = import_node_path41.default.join(deps.dataDir, "frpc.toml");
+  const tomlPath = import_node_path42.default.join(deps.dataDir, "frpc.toml");
   const readPidFile = deps.readPidFileImpl ?? defaultReadPidFile;
   const isAlive = deps.isPidAliveImpl ?? defaultIsPidAlive;
   const killPid = deps.killPidImpl ?? defaultKillPid;
@@ -55569,7 +56403,7 @@ async function killStaleFrpc(deps) {
   }
   if (victims.size === 0) {
     try {
-      import_node_fs37.default.unlinkSync(pidFile);
+      import_node_fs38.default.unlinkSync(pidFile);
     } catch {
     }
     return;
@@ -55580,7 +56414,7 @@ async function killStaleFrpc(deps) {
   }
   await sleep2(deps.reapWaitMs ?? 300);
   try {
-    import_node_fs37.default.unlinkSync(pidFile);
+    import_node_fs38.default.unlinkSync(pidFile);
   } catch {
   }
 }
@@ -55617,7 +56451,7 @@ var DEFAULT_TUNNEL_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var TunnelManager = class {
   constructor(deps) {
     this.deps = deps;
-    this.store = deps.store ?? new TunnelStore(import_node_path42.default.join(deps.dataDir, "tunnel.json"));
+    this.store = deps.store ?? new TunnelStore(import_node_path43.default.join(deps.dataDir, "tunnel.json"));
     this.ttlMs = deps.ttlMs ?? DEFAULT_TUNNEL_TTL_MS;
     this.startupTimeoutMs = deps.startupTimeoutMs ?? 15e3;
   }
@@ -55744,8 +56578,8 @@ var TunnelManager = class {
         dataDir: this.deps.dataDir,
         override: this.deps.frpcBinaryOverride ?? void 0
       });
-      const tomlPath = import_node_path42.default.join(this.deps.dataDir, "frpc.toml");
-      const proxyName = `clawd-${t.subdomain}-${localPort}-${import_node_crypto9.default.randomBytes(3).toString("hex")}`;
+      const tomlPath = import_node_path43.default.join(this.deps.dataDir, "frpc.toml");
+      const proxyName = `clawd-${t.subdomain}-${localPort}-${import_node_crypto10.default.randomBytes(3).toString("hex")}`;
       const toml = buildFrpcToml({
         serverAddr: t.frpsHost,
         serverPort: t.frpsPort,
@@ -55755,14 +56589,14 @@ var TunnelManager = class {
         localPort,
         logLevel: "info"
       });
-      await import_node_fs38.default.promises.writeFile(tomlPath, toml, { mode: 384 });
+      await import_node_fs39.default.promises.writeFile(tomlPath, toml, { mode: 384 });
       const proc = (this.deps.spawnImpl ?? import_node_child_process9.spawn)(frpcBin, ["-c", tomlPath], {
         stdio: ["ignore", "pipe", "pipe"]
       });
-      const logDir = import_node_path42.default.join(this.deps.dataDir, "log");
-      import_node_fs38.default.mkdirSync(logDir, { recursive: true });
-      const logFilePath = import_node_path42.default.join(logDir, "frpc.log");
-      const logStream = import_node_fs38.default.createWriteStream(logFilePath, { flags: "a", mode: 384 });
+      const logDir = import_node_path43.default.join(this.deps.dataDir, "log");
+      import_node_fs39.default.mkdirSync(logDir, { recursive: true });
+      const logFilePath = import_node_path43.default.join(logDir, "frpc.log");
+      const logStream = import_node_fs39.default.createWriteStream(logFilePath, { flags: "a", mode: 384 });
       logStream.on("error", () => {
       });
       const tee = (chunk) => {
@@ -55845,27 +56679,27 @@ async function waitForFrpcReady(proc, timeoutMs) {
 
 // src/tunnel/device-key.ts
 var import_node_os14 = __toESM(require("os"), 1);
-var import_node_path43 = __toESM(require("path"), 1);
-var import_node_crypto10 = __toESM(require("crypto"), 1);
+var import_node_path44 = __toESM(require("path"), 1);
+var import_node_crypto11 = __toESM(require("crypto"), 1);
 var DERIVE_SALT = "clawd-tunnel-device-v1";
 function deriveStableDeviceKey(opts = {}) {
   const hostname = opts.hostname ?? import_node_os14.default.hostname();
   const uid = opts.uid ?? (typeof import_node_os14.default.userInfo === "function" ? import_node_os14.default.userInfo().uid : 0);
   const home = opts.home ?? import_node_os14.default.homedir();
-  const defaultDataDir = import_node_path43.default.resolve(import_node_path43.default.join(home, ".clawd"));
-  const normalizedDataDir = opts.dataDir ? import_node_path43.default.resolve(opts.dataDir) : null;
+  const defaultDataDir = import_node_path44.default.resolve(import_node_path44.default.join(home, ".clawd"));
+  const normalizedDataDir = opts.dataDir ? import_node_path44.default.resolve(opts.dataDir) : null;
   const isDefaultDir = normalizedDataDir == null || normalizedDataDir === defaultDataDir;
   const input = isDefaultDir ? `${hostname}::${uid}` : `${hostname}::${uid}::${normalizedDataDir}`;
-  return import_node_crypto10.default.createHmac("sha256", DERIVE_SALT).update(input).digest("hex").slice(0, 32);
+  return import_node_crypto11.default.createHmac("sha256", DERIVE_SALT).update(input).digest("hex").slice(0, 32);
 }
 
 // src/auth-store.ts
-var import_node_fs39 = __toESM(require("fs"), 1);
-var import_node_path44 = __toESM(require("path"), 1);
-var import_node_crypto11 = __toESM(require("crypto"), 1);
+var import_node_fs40 = __toESM(require("fs"), 1);
+var import_node_path45 = __toESM(require("path"), 1);
+var import_node_crypto12 = __toESM(require("crypto"), 1);
 var AUTH_FILE_NAME = "auth.json";
 function authFilePath(dataDir) {
-  return import_node_path44.default.join(dataDir, AUTH_FILE_NAME);
+  return import_node_path45.default.join(dataDir, AUTH_FILE_NAME);
 }
 function loadOrCreateAuthFile(opts) {
   const file = authFilePath(opts.dataDir);
@@ -55890,14 +56724,14 @@ function loadOrCreateAuthFile(opts) {
   return next;
 }
 function defaultGenerateToken() {
-  return import_node_crypto11.default.randomBytes(32).toString("base64url");
+  return import_node_crypto12.default.randomBytes(32).toString("base64url");
 }
 function defaultGenerateOwnerPrincipalId() {
-  return `owner-${import_node_crypto11.default.randomUUID()}`;
+  return `owner-${import_node_crypto12.default.randomUUID()}`;
 }
 function readAuthFile(file) {
   try {
-    const raw = import_node_fs39.default.readFileSync(file, "utf8");
+    const raw = import_node_fs40.default.readFileSync(file, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.token !== "string" || parsed.token.length === 0) {
       return null;
@@ -55917,25 +56751,25 @@ function readAuthFile(file) {
   }
 }
 function writeAuthFile(file, content) {
-  import_node_fs39.default.mkdirSync(import_node_path44.default.dirname(file), { recursive: true });
-  import_node_fs39.default.writeFileSync(file, JSON.stringify(content, null, 2), { mode: 384 });
+  import_node_fs40.default.mkdirSync(import_node_path45.default.dirname(file), { recursive: true });
+  import_node_fs40.default.writeFileSync(file, JSON.stringify(content, null, 2), { mode: 384 });
   try {
-    import_node_fs39.default.chmodSync(file, 384);
+    import_node_fs40.default.chmodSync(file, 384);
   } catch {
   }
 }
 
 // src/owner-profile.ts
-var import_node_fs40 = __toESM(require("fs"), 1);
+var import_node_fs41 = __toESM(require("fs"), 1);
 var import_node_os15 = __toESM(require("os"), 1);
-var import_node_path45 = __toESM(require("path"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
 var PROFILE_FILENAME = "profile.json";
 function loadOwnerDisplayName(dataDir) {
   const fallback = import_node_os15.default.userInfo().username;
-  const profilePath = import_node_path45.default.join(dataDir, PROFILE_FILENAME);
+  const profilePath = import_node_path46.default.join(dataDir, PROFILE_FILENAME);
   let raw;
   try {
-    raw = import_node_fs40.default.readFileSync(profilePath, "utf8");
+    raw = import_node_fs41.default.readFileSync(profilePath, "utf8");
   } catch {
     return fallback;
   }
@@ -55958,18 +56792,18 @@ function loadOwnerDisplayName(dataDir) {
 }
 
 // src/feishu-auth/owner-identity-store.ts
-var import_node_fs41 = __toESM(require("fs"), 1);
-var import_node_path46 = __toESM(require("path"), 1);
+var import_node_fs42 = __toESM(require("fs"), 1);
+var import_node_path47 = __toESM(require("path"), 1);
 var OWNER_IDENTITY_FILE_NAME = "owner-identity.json";
 var OwnerIdentityStore = class {
   file;
   constructor(dataDir) {
-    this.file = import_node_path46.default.join(dataDir, OWNER_IDENTITY_FILE_NAME);
+    this.file = import_node_path47.default.join(dataDir, OWNER_IDENTITY_FILE_NAME);
   }
   read() {
     let raw;
     try {
-      raw = import_node_fs41.default.readFileSync(this.file, "utf8");
+      raw = import_node_fs42.default.readFileSync(this.file, "utf8");
     } catch {
       return null;
     }
@@ -55997,16 +56831,16 @@ var OwnerIdentityStore = class {
     };
   }
   write(record) {
-    import_node_fs41.default.mkdirSync(import_node_path46.default.dirname(this.file), { recursive: true });
-    import_node_fs41.default.writeFileSync(this.file, JSON.stringify(record, null, 2), { mode: 384 });
+    import_node_fs42.default.mkdirSync(import_node_path47.default.dirname(this.file), { recursive: true });
+    import_node_fs42.default.writeFileSync(this.file, JSON.stringify(record, null, 2), { mode: 384 });
     try {
-      import_node_fs41.default.chmodSync(this.file, 384);
+      import_node_fs42.default.chmodSync(this.file, 384);
     } catch {
     }
   }
   clear() {
     try {
-      import_node_fs41.default.unlinkSync(this.file);
+      import_node_fs42.default.unlinkSync(this.file);
     } catch (err) {
       const code = err?.code;
       if (code !== "ENOENT") throw err;
@@ -56015,7 +56849,7 @@ var OwnerIdentityStore = class {
 };
 
 // src/feishu-auth/login-flow.ts
-var import_node_crypto12 = __toESM(require("crypto"), 1);
+var import_node_crypto13 = __toESM(require("crypto"), 1);
 var STATE_TTL_MS = 5 * 60 * 1e3;
 var LoginFlow = class {
   constructor(deps) {
@@ -56024,7 +56858,7 @@ var LoginFlow = class {
   deps;
   pendingStates = /* @__PURE__ */ new Map();
   start() {
-    const state = import_node_crypto12.default.randomBytes(16).toString("base64url");
+    const state = import_node_crypto13.default.randomBytes(16).toString("base64url");
     const now = (this.deps.now ?? Date.now)();
     this.pendingStates.set(state, now);
     this.gcExpired(now);
@@ -56143,9 +56977,9 @@ var CentralClientError = class extends Error {
   code;
   cause;
 };
-async function centralRequest(opts, path77, init) {
+async function centralRequest(opts, path78, init) {
   const f = opts.fetchImpl ?? globalThis.fetch;
-  const url = `${opts.api.replace(/\/+$/, "")}${path77}`;
+  const url = `${opts.api.replace(/\/+$/, "")}${path78}`;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 15e3);
   let res;
@@ -56248,11 +57082,11 @@ var DeviceBindingClientError = class extends Error {
   code;
   cause;
 };
-var DEFAULT_TIMEOUT_MS2 = 8e3;
+var DEFAULT_TIMEOUT_MS3 = 8e3;
 async function upsertDeviceBinding(opts) {
   const doFetch = opts.fetchImpl ?? fetch;
   const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2);
+  const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS3);
   const body = { unionId: opts.unionId };
   if (opts.avatarUrl != null) body.avatarUrl = opts.avatarUrl;
   let res;
@@ -56339,8 +57173,8 @@ function verifyConnectToken(args) {
 }
 
 // src/feishu-auth/server-key.ts
-var fs51 = __toESM(require("fs"), 1);
-var path55 = __toESM(require("path"), 1);
+var fs52 = __toESM(require("fs"), 1);
+var path56 = __toESM(require("path"), 1);
 var FILE_NAME2 = "server-signing-key.json";
 var ServerKeyStore = class {
   constructor(dataDir) {
@@ -56348,12 +57182,12 @@ var ServerKeyStore = class {
   }
   dataDir;
   filePath() {
-    return path55.join(this.dataDir, FILE_NAME2);
+    return path56.join(this.dataDir, FILE_NAME2);
   }
   /** 读缓存的公钥；无缓存 / 损坏 → null（调用方决定是否触发拉取） */
   read() {
     try {
-      const raw = fs51.readFileSync(this.filePath(), "utf8");
+      const raw = fs52.readFileSync(this.filePath(), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.publicKeyPem === "string" && parsed.publicKeyPem.includes("PUBLIC KEY")) {
         return parsed.publicKeyPem;
@@ -56368,12 +57202,12 @@ var ServerKeyStore = class {
       publicKeyPem,
       fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    fs51.mkdirSync(this.dataDir, { recursive: true });
-    fs51.writeFileSync(this.filePath(), JSON.stringify(content, null, 2), { mode: 384 });
+    fs52.mkdirSync(this.dataDir, { recursive: true });
+    fs52.writeFileSync(this.filePath(), JSON.stringify(content, null, 2), { mode: 384 });
   }
   clear() {
     try {
-      fs51.unlinkSync(this.filePath());
+      fs52.unlinkSync(this.filePath());
     } catch {
     }
   }
@@ -56386,12 +57220,12 @@ init_protocol();
 init_protocol();
 
 // src/session/fork.ts
-var import_node_fs42 = __toESM(require("fs"), 1);
+var import_node_fs43 = __toESM(require("fs"), 1);
 var import_node_os16 = __toESM(require("os"), 1);
-var import_node_path47 = __toESM(require("path"), 1);
+var import_node_path48 = __toESM(require("path"), 1);
 init_claude_history();
 function readJsonlEntries(file) {
-  const raw = import_node_fs42.default.readFileSync(file, "utf8");
+  const raw = import_node_fs43.default.readFileSync(file, "utf8");
   const out = [];
   for (const line of raw.split("\n")) {
     const t = line.trim();
@@ -56404,19 +57238,19 @@ function readJsonlEntries(file) {
   return out;
 }
 function forkSession(input) {
-  const baseDir = input.baseDir ?? import_node_path47.default.join(import_node_os16.default.homedir(), ".claude");
-  let projectDir = import_node_path47.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
-  let sourceFile = import_node_path47.default.join(projectDir, `${input.toolSessionId}.jsonl`);
-  if (!import_node_fs42.default.existsSync(sourceFile)) {
+  const baseDir = input.baseDir ?? import_node_path48.default.join(import_node_os16.default.homedir(), ".claude");
+  let projectDir = import_node_path48.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
+  let sourceFile = import_node_path48.default.join(projectDir, `${input.toolSessionId}.jsonl`);
+  if (!import_node_fs43.default.existsSync(sourceFile)) {
     const found = findTranscriptByToolSessionId(
-      import_node_path47.default.join(baseDir, "projects"),
+      import_node_path48.default.join(baseDir, "projects"),
       input.toolSessionId
     );
     if (!found) {
       throw new Error(`fork: source transcript not found: ${sourceFile}`);
     }
     sourceFile = found;
-    projectDir = import_node_path47.default.dirname(found);
+    projectDir = import_node_path48.default.dirname(found);
   }
   const entries = readJsonlEntries(sourceFile);
   const mainEntries = entries.filter((e) => e.isSidechain !== true);
@@ -56445,9 +57279,9 @@ function forkSession(input) {
     }
     forkedLines.push(JSON.stringify(forked));
   }
-  const forkedFilePath = import_node_path47.default.join(projectDir, `${forkedToolSessionId}.jsonl`);
-  import_node_fs42.default.mkdirSync(projectDir, { recursive: true });
-  import_node_fs42.default.writeFileSync(forkedFilePath, forkedLines.join("\n") + "\n", { mode: 384 });
+  const forkedFilePath = import_node_path48.default.join(projectDir, `${forkedToolSessionId}.jsonl`);
+  import_node_fs43.default.mkdirSync(projectDir, { recursive: true });
+  import_node_fs43.default.writeFileSync(forkedFilePath, forkedLines.join("\n") + "\n", { mode: 384 });
   return { forkedToolSessionId, forkedFilePath };
 }
 
@@ -56890,7 +57724,7 @@ function buildPermissionHandlers(deps) {
 }
 
 // src/handlers/history.ts
-var path58 = __toESM(require("path"), 1);
+var path59 = __toESM(require("path"), 1);
 init_protocol();
 
 // src/session/recent-dirs.ts
@@ -56908,7 +57742,7 @@ function listRecentDirs(store, limit = 50) {
 }
 
 // src/permission/persona-paths.ts
-var path57 = __toESM(require("path"), 1);
+var path58 = __toESM(require("path"), 1);
 function getAllowedPersonaIds(grants, action) {
   const ids = /* @__PURE__ */ new Set();
   for (const g2 of grants) {
@@ -56921,42 +57755,42 @@ function getAllowedPersonaIds(grants, action) {
   return ids;
 }
 function isGuestPathAllowed(grants, absPath, personaRoot, action = "read", userWorkDir) {
-  const target = path57.resolve(absPath);
+  const target = path58.resolve(absPath);
   if (userWorkDir) {
-    const u = path57.resolve(userWorkDir);
-    const usep = u.endsWith(path57.sep) ? "" : path57.sep;
+    const u = path58.resolve(userWorkDir);
+    const usep = u.endsWith(path58.sep) ? "" : path58.sep;
     if (target === u || target.startsWith(u + usep)) return true;
   }
-  const root = path57.resolve(personaRoot);
-  const sep3 = root.endsWith(path57.sep) ? "" : path57.sep;
+  const root = path58.resolve(personaRoot);
+  const sep3 = root.endsWith(path58.sep) ? "" : path58.sep;
   if (!target.startsWith(root + sep3)) return false;
-  const rel = path57.relative(root, target);
+  const rel = path58.relative(root, target);
   if (!rel || rel.startsWith("..")) return false;
-  const personaId2 = rel.split(path57.sep)[0];
+  const personaId2 = rel.split(path58.sep)[0];
   if (!personaId2) return false;
   const allowed = getAllowedPersonaIds(grants, action);
   if (allowed === "*") return true;
   return allowed.has(personaId2);
 }
 function personaIdFromPath(absPath, personaRoot) {
-  const root = path57.resolve(personaRoot);
-  const target = path57.resolve(absPath);
-  const sep3 = root.endsWith(path57.sep) ? "" : path57.sep;
+  const root = path58.resolve(personaRoot);
+  const target = path58.resolve(absPath);
+  const sep3 = root.endsWith(path58.sep) ? "" : path58.sep;
   if (!target.startsWith(root + sep3)) return null;
-  const rel = path57.relative(root, target);
+  const rel = path58.relative(root, target);
   if (!rel || rel.startsWith("..")) return null;
-  const id = rel.split(path57.sep)[0];
+  const id = rel.split(path58.sep)[0];
   return id || null;
 }
 function isPathWithin(dir, absPath) {
-  const d = path57.resolve(dir);
-  const t = path57.resolve(absPath);
-  const sep3 = d.endsWith(path57.sep) ? "" : path57.sep;
+  const d = path58.resolve(dir);
+  const t = path58.resolve(absPath);
+  const sep3 = d.endsWith(path58.sep) ? "" : path58.sep;
   return t === d || t.startsWith(d + sep3);
 }
 function isPathInGuestBoundary(personaRoot, personaId2, userWorkDir, absPath) {
   if (userWorkDir && isPathWithin(userWorkDir, absPath)) return true;
-  return personaIdFromPath(path57.resolve(absPath), personaRoot) === personaId2;
+  return personaIdFromPath(path58.resolve(absPath), personaRoot) === personaId2;
 }
 
 // src/handlers/history.ts
@@ -57008,7 +57842,7 @@ function buildHistoryHandlers(deps) {
         if (!pid) return false;
         return isGuestPathAllowed(
           ctx.grants,
-          path58.join(personaRoot, pid),
+          path59.join(personaRoot, pid),
           personaRoot,
           "read",
           userWorkDir
@@ -57020,7 +57854,7 @@ function buildHistoryHandlers(deps) {
   };
   const list = async (frame, _client, ctx) => {
     const args = HistoryListArgs.parse(frame);
-    assertGuestPath(ctx, path58.resolve(args.projectPath), personaRoot, "history:list", usersRoot);
+    assertGuestPath(ctx, path59.resolve(args.projectPath), personaRoot, "history:list", usersRoot);
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
@@ -57053,13 +57887,13 @@ function buildHistoryHandlers(deps) {
   };
   const subagents = async (frame, _client, ctx) => {
     const args = HistorySubagentsArgs.parse(frame);
-    assertGuestPath(ctx, path58.resolve(args.cwd), personaRoot, "history:subagents", usersRoot);
+    assertGuestPath(ctx, path59.resolve(args.cwd), personaRoot, "history:subagents", usersRoot);
     const subs = await history.listSubagents(args);
     return { response: { type: "history:subagents", subagents: subs } };
   };
   const subagentRead = async (frame, _client, ctx) => {
     const args = HistorySubagentReadArgs.parse(frame);
-    assertGuestPath(ctx, path58.resolve(args.cwd), personaRoot, "history:subagent-read", usersRoot);
+    assertGuestPath(ctx, path59.resolve(args.cwd), personaRoot, "history:subagent-read", usersRoot);
     const res = await history.readSubagent(args);
     return { response: { type: "history:subagent-read", ...res } };
   };
@@ -57068,7 +57902,7 @@ function buildHistoryHandlers(deps) {
     if (ctx?.principal.kind === "guest" && personaRoot) {
       const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
       const filtered = dirs.filter(
-        (d) => isGuestPathAllowed(ctx.grants, path58.resolve(d.cwd), personaRoot, "read", userWorkDir)
+        (d) => isGuestPathAllowed(ctx.grants, path59.resolve(d.cwd), personaRoot, "read", userWorkDir)
       );
       return { response: { type: "history:recentDirs", dirs: filtered } };
     }
@@ -57085,7 +57919,7 @@ function buildHistoryHandlers(deps) {
 }
 
 // src/handlers/workspace.ts
-var path59 = __toESM(require("path"), 1);
+var path60 = __toESM(require("path"), 1);
 var os16 = __toESM(require("os"), 1);
 init_protocol();
 init_protocol();
@@ -57127,22 +57961,22 @@ function buildWorkspaceHandlers(deps) {
     const args = WorkspaceListArgs.parse(frame);
     const isGuest = ctx?.principal.kind === "guest";
     const fallbackCwd = isGuest && personaRoot ? personaRoot : os16.homedir();
-    const resolvedCwd = path59.resolve(args.cwd ?? fallbackCwd);
-    const target = args.path ? path59.resolve(resolvedCwd, args.path) : resolvedCwd;
+    const resolvedCwd = path60.resolve(args.cwd ?? fallbackCwd);
+    const target = args.path ? path60.resolve(resolvedCwd, args.path) : resolvedCwd;
     assertGuestPath2(ctx, target, personaRoot, "workspace:list", usersRoot);
     const res = workspace.list({ ...args, cwd: resolvedCwd });
     return { response: { type: "workspace:list", ...res } };
   };
   const read = async (frame, _client, ctx) => {
     const args = WorkspaceReadArgs.parse(frame);
-    const target = path59.isAbsolute(args.path) ? path59.resolve(args.path) : path59.resolve(args.cwd, args.path);
+    const target = path60.isAbsolute(args.path) ? path60.resolve(args.path) : path60.resolve(args.cwd, args.path);
     assertGuestPath2(ctx, target, personaRoot, "workspace:read", usersRoot);
     const res = workspace.read(args);
     return { response: { type: "workspace:read", ...res } };
   };
   const skillsList = async (frame, _client, ctx) => {
     const args = SkillsListArgs.parse(frame);
-    const cwdAbs = path59.resolve(args.cwd);
+    const cwdAbs = path60.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "skills:list", usersRoot);
     const list2 = await getSkillsForTool(args.tool ?? "claude", cwdAbs);
     if (ctx?.principal.kind === "guest" && personaRoot) {
@@ -57154,7 +57988,7 @@ function buildWorkspaceHandlers(deps) {
   };
   const agentsList = async (frame, _client, ctx) => {
     const args = AgentsListArgs.parse(frame);
-    const cwdAbs = path59.resolve(args.cwd);
+    const cwdAbs = path60.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "agents:list", usersRoot);
     if (args.tool === "codex") {
       return { response: { type: "agents:list", agents: [] } };
@@ -57176,20 +58010,20 @@ function buildWorkspaceHandlers(deps) {
 }
 
 // src/handlers/git.ts
-var path61 = __toESM(require("path"), 1);
+var path62 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 
 // src/workspace/git.ts
 var import_node_child_process10 = require("child_process");
-var import_node_fs43 = __toESM(require("fs"), 1);
-var import_node_path48 = __toESM(require("path"), 1);
+var import_node_fs44 = __toESM(require("fs"), 1);
+var import_node_path49 = __toESM(require("path"), 1);
 var import_node_util = require("util");
 var pexec = (0, import_node_util.promisify)(import_node_child_process10.execFile);
 function normalizePath(p2) {
-  const resolved = import_node_path48.default.resolve(p2);
+  const resolved = import_node_path49.default.resolve(p2);
   try {
-    return import_node_fs43.default.realpathSync(resolved);
+    return import_node_fs44.default.realpathSync(resolved);
   } catch {
     return resolved;
   }
@@ -57263,7 +58097,7 @@ async function listGitBranches(cwd) {
 function assertGuestCwd(ctx, cwd, personaRoot, method, usersRoot) {
   if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
   const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
-  if (!isGuestPathAllowed(ctx.grants, path61.resolve(cwd), personaRoot, "read", userWorkDir)) {
+  if (!isGuestPathAllowed(ctx.grants, path62.resolve(cwd), personaRoot, "read", userWorkDir)) {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
       `guest ${ctx.principal.id} cannot ${method} cwd ${cwd}`
@@ -57993,6 +58827,12 @@ var METHOD_GRANT_MAP = {
   "shift-internal:cancel": ADMIN_ANY,
   "shift-internal:update": ADMIN_ANY,
   "shift-internal:history": ADMIN_ANY,
+  // ---- larkBot:* (LarkBotConnector 装配/状态，owner-only) ----
+  "larkBot:provision": ADMIN_ANY,
+  "larkBot:provisionCancel": ADMIN_ANY,
+  "larkBot:bindManual": ADMIN_ANY,
+  "larkBot:unbind": ADMIN_ANY,
+  "larkBot:status": ADMIN_ANY,
   "inbox:sendDm": ADMIN_ANY,
   "personaDispatch:complete": ADMIN_ANY,
   "personaDispatch:list": ADMIN_ANY,
@@ -58124,21 +58964,21 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.284".length > 0 ? "0.2.284" : "dev";
+var version = "0.2.286".length > 0 ? "0.2.286" : "dev";
 
 // src/cli-probe/probe.ts
-var fs54 = __toESM(require("fs"), 1);
-var path62 = __toESM(require("path"), 1);
+var fs55 = __toESM(require("fs"), 1);
+var path63 = __toESM(require("path"), 1);
 var PKG_NAME = "@clawos-dev/clawd";
 var BIN_NAME = "clawd";
 var MAX_PARENT_HOPS = 5;
 function probeGlobalCli(pathEnv) {
   if (!pathEnv) return null;
-  for (const dir of pathEnv.split(path62.delimiter)) {
+  for (const dir of pathEnv.split(path63.delimiter)) {
     if (!dir) continue;
     let real;
     try {
-      real = fs54.realpathSync(path62.join(dir, BIN_NAME));
+      real = fs55.realpathSync(path63.join(dir, BIN_NAME));
     } catch {
       continue;
     }
@@ -58148,15 +58988,15 @@ function probeGlobalCli(pathEnv) {
   return null;
 }
 function readOwnPackageVersion(entryPath) {
-  let dir = path62.dirname(entryPath);
+  let dir = path63.dirname(entryPath);
   for (let i = 0; i < MAX_PARENT_HOPS; i++) {
     try {
-      const raw = fs54.readFileSync(path62.join(dir, "package.json"), "utf8");
+      const raw = fs55.readFileSync(path63.join(dir, "package.json"), "utf8");
       const pkg = JSON.parse(raw);
       if (pkg.name !== PKG_NAME) return null;
       return typeof pkg.version === "string" && pkg.version ? pkg.version : null;
     } catch {
-      const parent = path62.dirname(dir);
+      const parent = path63.dirname(dir);
       if (parent === dir) return null;
       dir = parent;
     }
@@ -58314,7 +59154,7 @@ function buildPersonaHandlers(deps) {
 }
 
 // src/handlers/attachment.ts
-var import_node_path49 = __toESM(require("path"), 1);
+var import_node_path50 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -58394,12 +59234,12 @@ function buildAttachmentHandlers(deps) {
         `session ${args.sessionId} scope unresolved`
       );
     }
-    const cwdAbs = import_node_path49.default.resolve(sessionFile.cwd);
-    const candidateAbs = import_node_path49.default.isAbsolute(args.relPath) ? import_node_path49.default.resolve(args.relPath) : import_node_path49.default.resolve(cwdAbs, args.relPath);
+    const cwdAbs = import_node_path50.default.resolve(sessionFile.cwd);
+    const candidateAbs = import_node_path50.default.isAbsolute(args.relPath) ? import_node_path50.default.resolve(args.relPath) : import_node_path50.default.resolve(cwdAbs, args.relPath);
     guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.signUrl", "group-acl");
     const entries = deps.groupFileStore.list(scope, args.sessionId);
     const entry = entries.find((e) => {
-      const storedAbs = import_node_path49.default.isAbsolute(e.relPath) ? import_node_path49.default.resolve(e.relPath) : import_node_path49.default.resolve(cwdAbs, e.relPath);
+      const storedAbs = import_node_path50.default.isAbsolute(e.relPath) ? import_node_path50.default.resolve(e.relPath) : import_node_path50.default.resolve(cwdAbs, e.relPath);
       return storedAbs === candidateAbs && !e.stale;
     });
     if (!entry) {
@@ -58424,7 +59264,7 @@ function buildAttachmentHandlers(deps) {
     if (!ctx || ctx.principal.kind !== "guest" || !deps.personaRoot || !deps.sessionStore) return;
     const f = deps.sessionStore.read(sessionId);
     if (!f) return;
-    assertGuestAttachmentPath(ctx, import_node_path49.default.resolve(f.cwd), deps.personaRoot, method, deps.usersRoot);
+    assertGuestAttachmentPath(ctx, import_node_path50.default.resolve(f.cwd), deps.personaRoot, method, deps.usersRoot);
   }
   const groupAdd = async (frame, _client, ctx) => {
     if (!deps.groupFileStore || !deps.getSessionScope) {
@@ -58439,8 +59279,8 @@ function buildAttachmentHandlers(deps) {
     if (!scope) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `session ${args.sessionId} not found`);
     }
-    const cwdAbs = import_node_path49.default.resolve(deps.sessionStore?.read(args.sessionId)?.cwd ?? ".");
-    const candidateAbs = import_node_path49.default.isAbsolute(args.relPath) ? import_node_path49.default.resolve(args.relPath) : import_node_path49.default.resolve(cwdAbs, args.relPath);
+    const cwdAbs = import_node_path50.default.resolve(deps.sessionStore?.read(args.sessionId)?.cwd ?? ".");
+    const candidateAbs = import_node_path50.default.isAbsolute(args.relPath) ? import_node_path50.default.resolve(args.relPath) : import_node_path50.default.resolve(cwdAbs, args.relPath);
     guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.groupAdd", "cwd-subtree");
     const from = args.origin === "agent" ? "agent" : ctx?.principal.kind === "owner" ? "owner" : "agent";
     const size = 0;
@@ -58499,19 +59339,19 @@ function buildAttachmentHandlers(deps) {
 
 // src/handlers/extension.ts
 var import_promises9 = __toESM(require("fs/promises"), 1);
-var import_node_path54 = __toESM(require("path"), 1);
+var import_node_path55 = __toESM(require("path"), 1);
 init_protocol();
 
 // src/extension/bundle-zip.ts
 var import_promises6 = __toESM(require("fs/promises"), 1);
-var import_node_path50 = __toESM(require("path"), 1);
-var import_node_crypto13 = __toESM(require("crypto"), 1);
+var import_node_path51 = __toESM(require("path"), 1);
+var import_node_crypto14 = __toESM(require("crypto"), 1);
 var import_jszip2 = __toESM(require_lib3(), 1);
 async function bundleExtensionDir(dir) {
   const entries = await listFilesSorted(dir);
   const zip = new import_jszip2.default();
   for (const rel of entries) {
-    const abs = import_node_path50.default.join(dir, rel);
+    const abs = import_node_path51.default.join(dir, rel);
     const content = await import_promises6.default.readFile(abs);
     zip.file(rel, content, { date: FIXED_DATE });
   }
@@ -58520,7 +59360,7 @@ async function bundleExtensionDir(dir) {
     compression: "DEFLATE",
     compressionOptions: { level: 6 }
   });
-  const sha256 = import_node_crypto13.default.createHash("sha256").update(buffer).digest("hex");
+  const sha256 = import_node_crypto14.default.createHash("sha256").update(buffer).digest("hex");
   return { buffer, sha256 };
 }
 var FIXED_DATE = /* @__PURE__ */ new Date("2020-01-01T00:00:00.000Z");
@@ -58532,7 +59372,7 @@ async function listFilesSorted(rootDir) {
   return out;
 }
 async function walk(absRoot, relPrefix, out) {
-  const dirAbs = import_node_path50.default.join(absRoot, relPrefix);
+  const dirAbs = import_node_path51.default.join(absRoot, relPrefix);
   const entries = await import_promises6.default.readdir(dirAbs, { withFileTypes: true });
   for (const e of entries) {
     if (IGNORE_BASENAMES.has(e.name)) continue;
@@ -58586,25 +59426,25 @@ function computePublishCheck(args) {
 
 // src/extension/install-flow.ts
 var import_promises7 = __toESM(require("fs/promises"), 1);
-var import_node_path52 = __toESM(require("path"), 1);
+var import_node_path53 = __toESM(require("path"), 1);
 var import_node_os19 = __toESM(require("os"), 1);
-var import_node_crypto14 = __toESM(require("crypto"), 1);
+var import_node_crypto15 = __toESM(require("crypto"), 1);
 var import_jszip3 = __toESM(require_lib3(), 1);
 
 // src/extension/paths.ts
 var import_node_os18 = __toESM(require("os"), 1);
-var import_node_path51 = __toESM(require("path"), 1);
+var import_node_path52 = __toESM(require("path"), 1);
 function clawdHomeRoot(override) {
-  return override ?? process.env.CLAWD_HOME ?? import_node_path51.default.join(import_node_os18.default.homedir(), ".clawd");
+  return override ?? process.env.CLAWD_HOME ?? import_node_path52.default.join(import_node_os18.default.homedir(), ".clawd");
 }
 function extensionsRoot(override) {
-  return import_node_path51.default.join(clawdHomeRoot(override), "extensions");
+  return import_node_path52.default.join(clawdHomeRoot(override), "extensions");
 }
 function publishedChannelsFile(override) {
-  return import_node_path51.default.join(clawdHomeRoot(override), "extensions-published.json");
+  return import_node_path52.default.join(clawdHomeRoot(override), "extensions-published.json");
 }
 function bundleCacheRoot(override) {
-  return import_node_path51.default.join(clawdHomeRoot(override), "extension-bundles");
+  return import_node_path52.default.join(clawdHomeRoot(override), "extension-bundles");
 }
 
 // src/extension/install-flow.ts
@@ -58617,7 +59457,7 @@ var InstallError = class extends Error {
 };
 async function installFromChannel(args, deps) {
   const { channelRef, snapshotHash, bundleZip } = args;
-  const computed = import_node_crypto14.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto15.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new InstallError(
       "HASH_MISMATCH",
@@ -58631,7 +59471,7 @@ async function installFromChannel(args, deps) {
     throw new InstallError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path52.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path53.default.isAbsolute(name)) {
       throw new InstallError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -58663,7 +59503,7 @@ async function installFromChannel(args, deps) {
     );
   }
   const localExtId = namespacedExtId(ownerSlug, channelRef.ownerPrincipalId);
-  const destDir = import_node_path52.default.join(deps.extensionsRoot, localExtId);
+  const destDir = import_node_path53.default.join(deps.extensionsRoot, localExtId);
   let destExists = false;
   try {
     await import_promises7.default.access(destDir);
@@ -58677,16 +59517,16 @@ async function installFromChannel(args, deps) {
     );
   }
   const stage = await import_promises7.default.mkdtemp(
-    import_node_path52.default.join(import_node_os19.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
+    import_node_path53.default.join(import_node_os19.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path52.default.join(stage, name);
+      const dest = import_node_path53.default.join(stage, name);
       if (entry.dir) {
         await import_promises7.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises7.default.mkdir(import_node_path52.default.dirname(dest), { recursive: true });
+      await import_promises7.default.mkdir(import_node_path53.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises7.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -58707,9 +59547,9 @@ async function installFromChannel(args, deps) {
 
 // src/extension/update-flow.ts
 var import_promises8 = __toESM(require("fs/promises"), 1);
-var import_node_path53 = __toESM(require("path"), 1);
+var import_node_path54 = __toESM(require("path"), 1);
 var import_node_os20 = __toESM(require("os"), 1);
-var import_node_crypto15 = __toESM(require("crypto"), 1);
+var import_node_crypto16 = __toESM(require("crypto"), 1);
 var import_jszip4 = __toESM(require_lib3(), 1);
 var UpdateError = class extends Error {
   constructor(code, message) {
@@ -58724,11 +59564,11 @@ async function updateFromChannel(args, deps) {
     channelRef.extId,
     channelRef.ownerPrincipalId
   );
-  const liveDir = import_node_path53.default.join(deps.extensionsRoot, localExtId);
+  const liveDir = import_node_path54.default.join(deps.extensionsRoot, localExtId);
   const prevDir = `${liveDir}.prev`;
   let existingVersion;
   try {
-    const raw = await import_promises8.default.readFile(import_node_path53.default.join(liveDir, "manifest.json"), "utf8");
+    const raw = await import_promises8.default.readFile(import_node_path54.default.join(liveDir, "manifest.json"), "utf8");
     const parsed2 = ExtensionManifestSchema.safeParse(JSON.parse(raw));
     if (!parsed2.success) {
       throw new UpdateError(
@@ -58747,7 +59587,7 @@ async function updateFromChannel(args, deps) {
     if (e instanceof UpdateError) throw e;
     throw e;
   }
-  const computed = import_node_crypto15.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto16.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new UpdateError(
       "HASH_MISMATCH",
@@ -58761,7 +59601,7 @@ async function updateFromChannel(args, deps) {
     throw new UpdateError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path53.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path54.default.isAbsolute(name)) {
       throw new UpdateError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -58796,16 +59636,16 @@ async function updateFromChannel(args, deps) {
   await import_promises8.default.rm(prevDir, { recursive: true, force: true });
   await import_promises8.default.rename(liveDir, prevDir);
   const stage = await import_promises8.default.mkdtemp(
-    import_node_path53.default.join(import_node_os20.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
+    import_node_path54.default.join(import_node_os20.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path53.default.join(stage, name);
+      const dest = import_node_path54.default.join(stage, name);
       if (entry.dir) {
         await import_promises8.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises8.default.mkdir(import_node_path53.default.dirname(dest), { recursive: true });
+      await import_promises8.default.mkdir(import_node_path54.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises8.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -58872,7 +59712,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
       );
     }
   }
-  const manifestPath = import_node_path54.default.join(root, extId, "manifest.json");
+  const manifestPath = import_node_path55.default.join(root, extId, "manifest.json");
   const manifest = await readManifest(root, extId);
   const next = { ...manifest, version: newVersion };
   const tmp = `${manifestPath}.tmp`;
@@ -58880,7 +59720,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
   await import_promises9.default.rename(tmp, manifestPath);
 }
 async function readManifest(root, extId) {
-  const file = import_node_path54.default.join(root, extId, "manifest.json");
+  const file = import_node_path55.default.join(root, extId, "manifest.json");
   let raw;
   try {
     raw = await import_promises9.default.readFile(file, "utf8");
@@ -58964,7 +59804,7 @@ function buildExtensionHandlers(deps) {
   };
   async function buildSnapshotMeta(extId) {
     const manifest = await readManifest(deps.root, extId);
-    const { sha256, buffer } = await bundleExtensionDir(import_node_path54.default.join(deps.root, extId));
+    const { sha256, buffer } = await bundleExtensionDir(import_node_path55.default.join(deps.root, extId));
     return { manifest, contentHash: sha256, buffer };
   }
   const publish = async (frame, _client, ctx) => {
@@ -59139,9 +59979,9 @@ function buildExtensionHandlers(deps) {
 }
 
 // src/app-builder/project-store.ts
-var import_node_fs44 = require("fs");
+var import_node_fs45 = require("fs");
 var import_node_child_process11 = require("child_process");
-var import_node_path55 = require("path");
+var import_node_path56 = require("path");
 init_protocol();
 var PROJECTS_DIR = "projects";
 var META_FILE = ".clawd-project.json";
@@ -59155,19 +59995,19 @@ var ProjectStore = class {
   root;
   /** projects/<name>/.clawd-project.json 路径 */
   metaPath(name) {
-    return (0, import_node_path55.join)(this.projectsRoot(), name, META_FILE);
+    return (0, import_node_path56.join)(this.projectsRoot(), name, META_FILE);
   }
   /** projects/<name>/ 目录路径（cwd 用） */
   projectDir(name) {
-    return (0, import_node_path55.join)(this.projectsRoot(), name);
+    return (0, import_node_path56.join)(this.projectsRoot(), name);
   }
   projectsRoot() {
-    return (0, import_node_path55.join)(this.root, PROJECTS_DIR);
+    return (0, import_node_path56.join)(this.root, PROJECTS_DIR);
   }
   async list() {
     let entries;
     try {
-      entries = await import_node_fs44.promises.readdir(this.projectsRoot());
+      entries = await import_node_fs45.promises.readdir(this.projectsRoot());
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw err;
@@ -59175,7 +60015,7 @@ var ProjectStore = class {
     const out = [];
     for (const name of entries) {
       try {
-        const raw = await import_node_fs44.promises.readFile(this.metaPath(name), "utf8");
+        const raw = await import_node_fs45.promises.readFile(this.metaPath(name), "utf8");
         const json = JSON.parse(raw);
         let migrated = false;
         if (typeof json.devCommand !== "string" || json.devCommand.length === 0) {
@@ -59186,7 +60026,7 @@ var ProjectStore = class {
         if (parsed.success) {
           out.push(parsed.data);
           if (migrated) {
-            void import_node_fs44.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
+            void import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
             });
           }
         }
@@ -59230,8 +60070,8 @@ var ProjectStore = class {
       throw new Error(`invalid name "${name}": ${validated.error.message}`);
     }
     const dir = this.projectDir(name);
-    await import_node_fs44.promises.mkdir(dir, { recursive: true });
-    await import_node_fs44.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
+    await import_node_fs45.promises.mkdir(dir, { recursive: true });
+    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
     return meta;
   }
   /**
@@ -59274,7 +60114,7 @@ var ProjectStore = class {
   }
   async delete(name) {
     const dir = this.projectDir(name);
-    await import_node_fs44.promises.rm(dir, { recursive: true, force: true });
+    await import_node_fs45.promises.rm(dir, { recursive: true, force: true });
   }
   async updatePort(name, newPort) {
     if (newPort < PROJECT_PORT_MIN || newPort > PROJECT_PORT_MAX) {
@@ -59290,7 +60130,7 @@ var ProjectStore = class {
       throw new Error(`port ${newPort} already used / \u5DF2\u88AB project "${conflict.name}" \u5360\u7528`);
     }
     const updated = { ...target, port: newPort };
-    await import_node_fs44.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
+    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
     return updated;
   }
   /**
@@ -59307,7 +60147,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`invalid prodUrl "${url}": ${validated.error.message}`);
     }
-    await import_node_fs44.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
   /**
@@ -59328,7 +60168,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`invalid publishJob: ${validated.error.message}`);
     }
-    await import_node_fs44.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
   /** 清掉 .clawd-project.json.publishJob 字段。其他字段保持原样。 */
@@ -59343,7 +60183,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`failed to clear publishJob: ${validated.error.message}`);
     }
-    await import_node_fs44.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
 };
@@ -59413,7 +60253,7 @@ function listPidsOnPort(port) {
 }
 
 // src/app-builder/publish-registry.ts
-var import_node_crypto16 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var PublishJobRegistry = class {
   jobs = /* @__PURE__ */ new Map();
   has(name) {
@@ -59430,7 +60270,7 @@ var PublishJobRegistry = class {
     if (this.jobs.has(args.name)) {
       throw new Error(`already publishing: ${args.name}`);
     }
-    const jobId = args.jobId ?? `job-${(0, import_node_crypto16.randomUUID)()}`;
+    const jobId = args.jobId ?? `job-${(0, import_node_crypto17.randomUUID)()}`;
     this.jobs.set(args.name, {
       jobId,
       name: args.name,
@@ -59464,8 +60304,8 @@ var PublishJobRegistry = class {
 
 // src/app-builder/publish-job-runner.ts
 var import_node_child_process13 = require("child_process");
-var import_node_fs45 = require("fs");
-var import_node_path56 = require("path");
+var import_node_fs46 = require("fs");
+var import_node_path57 = require("path");
 
 // src/app-builder/publish-stage-parser.ts
 var STAGE_RE = /^\s*::stage::(build|deploy|verify)\s*$/;
@@ -59497,10 +60337,10 @@ async function startPublishJob(deps, args) {
     return { jobId: registry2.get(args.name).jobId, status: "already-publishing" };
   }
   const projDir = projectDir(args.name);
-  const logPath = (0, import_node_path56.join)(projDir, ".publish.log");
+  const logPath = (0, import_node_path57.join)(projDir, ".publish.log");
   let logStream = null;
   try {
-    logStream = (0, import_node_fs45.createWriteStream)(logPath, { flags: "w" });
+    logStream = (0, import_node_fs46.createWriteStream)(logPath, { flags: "w" });
   } catch {
     logStream = null;
   }
@@ -59757,8 +60597,8 @@ async function recoverInterruptedJobs(deps) {
 
 // src/handlers/app-builder.ts
 init_protocol();
-var import_node_path57 = require("path");
-var import_node_fs46 = require("fs");
+var import_node_path58 = require("path");
+var import_node_fs47 = require("fs");
 var APP_BUILDER_PERSONAS = ["persona-app-builder", "persona-dataclaw-builder"];
 var DEV_SERVER_READY_TIMEOUT_MS = 3e4;
 async function recoverInterruptedPublishJobs(store, logger) {
@@ -59839,7 +60679,7 @@ function buildAppBuilderHandlers(deps) {
   async function listAllUsersProjects() {
     if (!deps.usersRoot || !deps.getStore) return [];
     const getStore = deps.getStore;
-    const userIds = await import_node_fs46.promises.readdir(deps.usersRoot).catch(() => []);
+    const userIds = await import_node_fs47.promises.readdir(deps.usersRoot).catch(() => []);
     const perUser = await Promise.all(
       userIds.map((uid) => getStore(uid).list().catch(() => []))
     );
@@ -59908,8 +60748,8 @@ function buildAppBuilderHandlers(deps) {
     const project = await userStore.create(f.name, reservedPorts);
     try {
       const personaRoot = deps.resolvePersonaRoot ? deps.resolvePersonaRoot(session.ownerPersonaId ?? "") : deps.personaRoot;
-      const templateSrcDir = (0, import_node_path57.join)(personaRoot, "extension-kit", "examples", DEFAULT_TEMPLATE);
-      const scaffoldScript = (0, import_node_path57.join)(deps.deployKitRoot, "scripts", "new-extension.sh");
+      const templateSrcDir = (0, import_node_path58.join)(personaRoot, "extension-kit", "examples", DEFAULT_TEMPLATE);
+      const scaffoldScript = (0, import_node_path58.join)(deps.deployKitRoot, "scripts", "new-extension.sh");
       const scaffoldResult = await userStore.scaffold(project.name, templateSrcDir, scaffoldScript);
       deps.logger?.info("app-builder.scaffold.done", {
         name: project.name,
@@ -60113,7 +60953,7 @@ function buildAppBuilderHandlers(deps) {
       await userStore.clearPublishJob(args.name);
     }
     const personaRoot = deps.resolvePersonaRoot ? deps.resolvePersonaRoot(boundSession.ownerPersonaId ?? "") : deps.personaRoot;
-    const scriptPath = (0, import_node_path57.join)(deps.deployKitRoot, "scripts", "publish.sh");
+    const scriptPath = (0, import_node_path58.join)(deps.deployKitRoot, "scripts", "publish.sh");
     deps.logger?.info("app-builder.publish.start", {
       name: args.name,
       sessionId: boundSession.sessionId,
@@ -60289,7 +61129,7 @@ function buildVisitorHandlers(deps) {
 
 // src/extension/registry.ts
 var import_promises10 = __toESM(require("fs/promises"), 1);
-var import_node_path58 = __toESM(require("path"), 1);
+var import_node_path59 = __toESM(require("path"), 1);
 async function loadAll(root) {
   let entries;
   try {
@@ -60302,13 +61142,13 @@ async function loadAll(root) {
   for (const ent of entries) {
     if (!ent.isDirectory()) continue;
     if (ent.name.startsWith(".")) continue;
-    records.push(await loadOne(import_node_path58.default.join(root, ent.name), ent.name));
+    records.push(await loadOne(import_node_path59.default.join(root, ent.name), ent.name));
   }
   records.sort((a, b2) => a.extId < b2.extId ? -1 : a.extId > b2.extId ? 1 : 0);
   return records;
 }
 async function loadOne(dir, dirName) {
-  const manifestPath = import_node_path58.default.join(dir, "manifest.json");
+  const manifestPath = import_node_path59.default.join(dir, "manifest.json");
   let raw;
   try {
     raw = await import_promises10.default.readFile(manifestPath, "utf8");
@@ -60353,7 +61193,7 @@ async function loadOne(dir, dirName) {
 
 // src/extension/uninstall.ts
 var import_promises11 = __toESM(require("fs/promises"), 1);
-var import_node_path59 = __toESM(require("path"), 1);
+var import_node_path60 = __toESM(require("path"), 1);
 var UninstallError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -60362,7 +61202,7 @@ var UninstallError = class extends Error {
   code;
 };
 async function uninstall(deps) {
-  const dir = import_node_path59.default.join(deps.root, deps.extId);
+  const dir = import_node_path60.default.join(deps.root, deps.extId);
   try {
     await import_promises11.default.access(dir);
   } catch {
@@ -60373,7 +61213,7 @@ async function uninstall(deps) {
 }
 
 // src/handlers/index.ts
-var import_node_crypto17 = require("crypto");
+var import_node_crypto18 = require("crypto");
 
 // src/handlers/peer-exec.ts
 init_protocol();
@@ -60381,11 +61221,11 @@ init_protocol();
 // src/peer-ops/run-command.ts
 var import_node_child_process14 = require("child_process");
 var import_node_os21 = __toESM(require("os"), 1);
-var DEFAULT_TIMEOUT_MS3 = 3e4;
+var DEFAULT_TIMEOUT_MS4 = 3e4;
 var MAX_TIMEOUT_MS = 3e5;
 var MAX_OUTPUT_BYTES = 1048576;
 function runCommand(command, opts = {}) {
-  const timeoutMs = Math.min(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS3, MAX_TIMEOUT_MS);
+  const timeoutMs = Math.min(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS4, MAX_TIMEOUT_MS);
   return new Promise((resolve6) => {
     const child = (0, import_node_child_process14.spawn)("bash", ["-c", command], { cwd: import_node_os21.default.homedir() });
     const out = [];
@@ -60528,7 +61368,7 @@ function buildMethodHandlers(deps) {
           const c = deps.contactStore.get(deviceId);
           return c ? { deviceId: c.deviceId, remoteUrl: c.remoteUrl, connectToken: c.connectToken } : null;
         },
-        genId: () => (0, import_node_crypto17.randomUUID)(),
+        genId: () => (0, import_node_crypto18.randomUUID)(),
         now: () => Date.now(),
         forwardInboxPostToPeer,
         logger: deps.logger
@@ -60892,7 +61732,7 @@ async function dispatchRpc(method, frame, client, ctx, deps) {
 
 // src/extension/runtime.ts
 var import_node_child_process16 = require("child_process");
-var import_node_path60 = __toESM(require("path"), 1);
+var import_node_path61 = __toESM(require("path"), 1);
 var import_promises12 = require("timers/promises");
 
 // src/extension/port-allocator.ts
@@ -60993,7 +61833,7 @@ var Runtime = class {
       /\$CLAWOS_EXT_PORT/g,
       String(port)
     );
-    const dir = import_node_path60.default.join(this.root, extId);
+    const dir = import_node_path61.default.join(this.root, extId);
     const env = {
       ...process.env,
       CLAWOS_EXT_PORT: String(port),
@@ -61105,7 +61945,7 @@ ${handle.stderrTail}`
 
 // src/extension/published-channels.ts
 var import_promises13 = __toESM(require("fs/promises"), 1);
-var import_node_path61 = __toESM(require("path"), 1);
+var import_node_path62 = __toESM(require("path"), 1);
 init_zod();
 var PublishedChannelsError = class extends Error {
   constructor(code, message) {
@@ -61204,7 +62044,7 @@ var PublishedChannelStore = class {
       )
     };
     const tmp = `${this.filePath}.tmp`;
-    await import_promises13.default.mkdir(import_node_path61.default.dirname(this.filePath), { recursive: true });
+    await import_promises13.default.mkdir(import_node_path62.default.dirname(this.filePath), { recursive: true });
     await import_promises13.default.writeFile(tmp, JSON.stringify(data, null, 2), { mode: 384 });
     await import_promises13.default.rename(tmp, this.filePath);
   }
@@ -61212,7 +62052,7 @@ var PublishedChannelStore = class {
 
 // src/extension/bundle-cache.ts
 var import_promises14 = __toESM(require("fs/promises"), 1);
-var import_node_path62 = __toESM(require("path"), 1);
+var import_node_path63 = __toESM(require("path"), 1);
 var BundleCache = class {
   constructor(rootDir) {
     this.rootDir = rootDir;
@@ -61221,14 +62061,14 @@ var BundleCache = class {
   /** Atomic write: stage tmp → rename. Caller passes the hex sha256. */
   async write(snapshotHash, buffer) {
     await import_promises14.default.mkdir(this.rootDir, { recursive: true });
-    const file = import_node_path62.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path63.default.join(this.rootDir, `${snapshotHash}.zip`);
     const tmp = `${file}.tmp`;
     await import_promises14.default.writeFile(tmp, buffer, { mode: 384 });
     await import_promises14.default.rename(tmp, file);
   }
   /** Returns the bundle bytes, or null when the file doesn't exist. */
   async read(snapshotHash) {
-    const file = import_node_path62.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path63.default.join(this.rootDir, `${snapshotHash}.zip`);
     try {
       return await import_promises14.default.readFile(file);
     } catch (e) {
@@ -61238,7 +62078,7 @@ var BundleCache = class {
   }
   /** Idempotent — missing file is not an error. */
   async delete(snapshotHash) {
-    const file = import_node_path62.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path63.default.join(this.rootDir, `${snapshotHash}.zip`);
     await import_promises14.default.rm(file, { force: true });
   }
 };
@@ -61261,24 +62101,24 @@ async function startDaemon(config) {
     sampling: logShippingCfg.sampling,
     homeDir: import_node_os22.default.homedir()
   });
-  const logDir = import_node_path63.default.join(config.dataDir, "log");
-  import_node_fs47.default.mkdirSync(logDir, { recursive: true });
+  const logDir = import_node_path64.default.join(config.dataDir, "log");
+  import_node_fs48.default.mkdirSync(logDir, { recursive: true });
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path63.default.join(logDir, "clawd.log"),
+    file: import_node_path64.default.join(logDir, "clawd.log"),
     logClient
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
   const screenIdleProbeLogger = createFileOnlyLogger({
-    file: import_node_path63.default.join(logDir, "screen-idle-probe.log"),
+    file: import_node_path64.default.join(logDir, "screen-idle-probe.log"),
     level: "debug"
   });
   logger.info("screen-idle probe logger enabled", {
-    file: import_node_path63.default.join(logDir, "screen-idle-probe.log")
+    file: import_node_path64.default.join(logDir, "screen-idle-probe.log")
   });
   const CAP_TARGETS = [
-    import_node_path63.default.join(logDir, "clawd.log"),
-    import_node_path63.default.join(logDir, "screen-idle-probe.log")
+    import_node_path64.default.join(logDir, "clawd.log"),
+    import_node_path64.default.join(logDir, "screen-idle-probe.log")
   ];
   const LOG_CAP_MAX_BYTES = 10 * 1024 * 1024;
   const LOG_CAP_KEEP_BYTES = 5 * 1024 * 1024;
@@ -61374,8 +62214,8 @@ async function startDaemon(config) {
   const agents = new AgentsScanner();
   const history = new ClaudeHistoryReader();
   let transport = null;
-  const personaStore = new PersonaStore(import_node_path63.default.join(config.dataDir, "personas"));
-  const usersRoot = import_node_path63.default.join(config.dataDir, "users");
+  const personaStore = new PersonaStore(import_node_path64.default.join(config.dataDir, "personas"));
+  const usersRoot = import_node_path64.default.join(config.dataDir, "users");
   const defaultsRoot = findDefaultsRoot(logger);
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
@@ -61396,7 +62236,7 @@ async function startDaemon(config) {
   retirePersonaBuilder({ store: personaStore, logger });
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
   const dispatchStore = createDispatchStore({
-    filePath: import_node_path63.default.join(config.dataDir, "dispatch.json"),
+    filePath: import_node_path64.default.join(config.dataDir, "dispatch.json"),
     now: () => Date.now(),
     onFlushError: (err) => logger.error("dispatch store flush failed", {
       reason: err instanceof Error ? err.message : String(err)
@@ -61411,18 +62251,18 @@ async function startDaemon(config) {
     now: () => Date.now(),
     onCompleted: (sid) => deliverPendingRef?.(sid)
   });
-  const here = typeof __dirname === "string" ? __dirname : import_node_path63.default.dirname((0, import_node_url4.fileURLToPath)(import_meta6.url));
+  const here = typeof __dirname === "string" ? __dirname : import_node_path64.default.dirname((0, import_node_url4.fileURLToPath)(import_meta6.url));
   const mcpConfigs = [];
   const mcpDaemonUrl = `http://127.0.0.1:${config.port}`;
   const dispatchServerCandidates = [
-    import_node_path63.default.join(here, "dispatch", "mcp-server.cjs"),
+    import_node_path64.default.join(here, "dispatch", "mcp-server.cjs"),
     // 生产 dist/index → dist/dispatch/mcp-server.cjs
-    import_node_path63.default.join(here, "..", "dist", "dispatch", "mcp-server.cjs")
+    import_node_path64.default.join(here, "..", "dist", "dispatch", "mcp-server.cjs")
     // dev tsx src/index → ../dist/dispatch/mcp-server.cjs
   ];
-  const dispatchServerScriptPath = dispatchServerCandidates.find((p2) => import_node_fs47.default.existsSync(p2));
+  const dispatchServerScriptPath = dispatchServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
   if (dispatchServerScriptPath) {
-    const dispatchLogPath = import_node_path63.default.join(logDir, "dispatch-mcp-server.log");
+    const dispatchLogPath = import_node_path64.default.join(logDir, "dispatch-mcp-server.log");
     const dispatchCfgPath = writeDispatchMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: dispatchServerScriptPath,
@@ -61442,12 +62282,12 @@ async function startDaemon(config) {
     });
   }
   const ticketServerCandidates = [
-    import_node_path63.default.join(here, "ticket", "mcp-server.cjs"),
-    import_node_path63.default.join(here, "..", "dist", "ticket", "mcp-server.cjs")
+    import_node_path64.default.join(here, "ticket", "mcp-server.cjs"),
+    import_node_path64.default.join(here, "..", "dist", "ticket", "mcp-server.cjs")
   ];
-  const ticketServerScriptPath = ticketServerCandidates.find((p2) => import_node_fs47.default.existsSync(p2));
+  const ticketServerScriptPath = ticketServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
   if (ticketServerScriptPath) {
-    const ticketLogPath = import_node_path63.default.join(logDir, "ticket-mcp-server.log");
+    const ticketLogPath = import_node_path64.default.join(logDir, "ticket-mcp-server.log");
     const ticketCfgPath = writeTicketMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: ticketServerScriptPath,
@@ -61469,12 +62309,12 @@ async function startDaemon(config) {
     });
   }
   const shiftServerCandidates = [
-    import_node_path63.default.join(here, "shift", "mcp-server.cjs"),
-    import_node_path63.default.join(here, "..", "dist", "shift", "mcp-server.cjs")
+    import_node_path64.default.join(here, "shift", "mcp-server.cjs"),
+    import_node_path64.default.join(here, "..", "dist", "shift", "mcp-server.cjs")
   ];
-  const shiftServerScriptPath = shiftServerCandidates.find((p2) => import_node_fs47.default.existsSync(p2));
+  const shiftServerScriptPath = shiftServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
   if (shiftServerScriptPath) {
-    const shiftLogPath = import_node_path63.default.join(logDir, "shift-mcp-server.log");
+    const shiftLogPath = import_node_path64.default.join(logDir, "shift-mcp-server.log");
     const shiftCfgPath = await writeShiftMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: shiftServerScriptPath,
@@ -61495,12 +62335,12 @@ async function startDaemon(config) {
     );
   }
   const inboxServerCandidates = [
-    import_node_path63.default.join(here, "inbox", "mcp-server.cjs"),
-    import_node_path63.default.join(here, "..", "dist", "inbox", "mcp-server.cjs")
+    import_node_path64.default.join(here, "inbox", "mcp-server.cjs"),
+    import_node_path64.default.join(here, "..", "dist", "inbox", "mcp-server.cjs")
   ];
-  const inboxServerScriptPath = inboxServerCandidates.find((p2) => import_node_fs47.default.existsSync(p2));
+  const inboxServerScriptPath = inboxServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
   if (inboxServerScriptPath) {
-    const inboxLogPath = import_node_path63.default.join(logDir, "inbox-mcp-server.log");
+    const inboxLogPath = import_node_path64.default.join(logDir, "inbox-mcp-server.log");
     const inboxCfgPath = await writeInboxMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: inboxServerScriptPath,
@@ -61521,10 +62361,10 @@ async function startDaemon(config) {
     );
   }
   const peerOpsServerCandidates = [
-    import_node_path63.default.join(here, "peer-ops", "mcp-server.cjs"),
-    import_node_path63.default.join(here, "..", "dist", "peer-ops", "mcp-server.cjs")
+    import_node_path64.default.join(here, "peer-ops", "mcp-server.cjs"),
+    import_node_path64.default.join(here, "..", "dist", "peer-ops", "mcp-server.cjs")
   ];
-  const peerOpsServerScriptPath = peerOpsServerCandidates.find((p2) => import_node_fs47.default.existsSync(p2));
+  const peerOpsServerScriptPath = peerOpsServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
   if (peerOpsServerScriptPath) {
     const peerOpsCfgPath = writePeerOpsMcpConfig({
       dataDir: config.dataDir,
@@ -61544,12 +62384,12 @@ async function startDaemon(config) {
     );
   }
   const rpcToolServerCandidates = [
-    import_node_path63.default.join(here, "rpc-tool", "mcp-server.cjs"),
-    import_node_path63.default.join(here, "..", "dist", "rpc-tool", "mcp-server.cjs")
+    import_node_path64.default.join(here, "rpc-tool", "mcp-server.cjs"),
+    import_node_path64.default.join(here, "..", "dist", "rpc-tool", "mcp-server.cjs")
   ];
-  const rpcToolServerScriptPath = rpcToolServerCandidates.find((p2) => import_node_fs47.default.existsSync(p2));
+  const rpcToolServerScriptPath = rpcToolServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
   if (rpcToolServerScriptPath) {
-    const rpcToolLogPath = import_node_path63.default.join(logDir, "rpc-tool-mcp-server.log");
+    const rpcToolLogPath = import_node_path64.default.join(logDir, "rpc-tool-mcp-server.log");
     const rpcToolCfgPath = writeRpcToolMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: rpcToolServerScriptPath,
@@ -61570,7 +62410,7 @@ async function startDaemon(config) {
     );
   }
   const shiftStore = createShiftStore({
-    filePath: import_node_path63.default.join(config.dataDir, "shift.json"),
+    filePath: import_node_path64.default.join(config.dataDir, "shift.json"),
     ownerIdProvider: () => ownerPrincipalId,
     now: () => Date.now()
   });
@@ -61592,7 +62432,7 @@ async function startDaemon(config) {
     getAdapter,
     historyReader: history,
     dataDir: config.dataDir,
-    personaRoot: import_node_path63.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path64.default.join(config.dataDir, "personas"),
     // dispatch / shift 自动化 spawn 按 persona 绑定 tool 起 B session（codex persona 用 codex）。
     // personaRegistry 声明在 manager 之后（同作用域 const，调用时机在启动完成后，无 TDZ 风险）。
     getPersonaTool: (personaId2) => personaRegistry.get(personaId2)?.tool,
@@ -61643,10 +62483,10 @@ async function startDaemon(config) {
     // 文件可能 agent 写完又被自己删（罕见），用 size=0 / fallback mime 兜底。
     attachmentGroup: {
       onFileEdit: (input) => {
-        const absPath = import_node_path63.default.isAbsolute(input.relPath) ? input.relPath : import_node_path63.default.join(input.cwd, input.relPath);
+        const absPath = import_node_path64.default.isAbsolute(input.relPath) ? input.relPath : import_node_path64.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
-          size = import_node_fs47.default.statSync(absPath).size;
+          size = import_node_fs48.default.statSync(absPath).size;
         } catch (err) {
           logger.warn("attachment.onFileEdit stat failed", {
             sessionId: input.sessionId,
@@ -61887,11 +62727,11 @@ async function startDaemon(config) {
         // 'persona/<pid>/owner'，default 走 'default'。
         getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
         // guest path guard：candidate 必须在 personaRoot 子树或调用者自己的 user-dir 下
-        personaRoot: import_node_path63.default.join(config.dataDir, "personas"),
+        personaRoot: import_node_path64.default.join(config.dataDir, "personas"),
         usersRoot
       },
       // workspace/git/history/skills/agents handler 共用的 guest path guard 锚点
-      personaRoot: import_node_path63.default.join(config.dataDir, "personas"),
+      personaRoot: import_node_path64.default.join(config.dataDir, "personas"),
       // v2 多人 persona 隔离：handler 派生 guest user-dir 放行
       usersRoot,
       // v2 Phase 6: whoami handler 装在 owner principal.displayName + persona 解析
@@ -62017,11 +62857,11 @@ async function startDaemon(config) {
       // 发布上线脚手架化 (spec 2026-06-03 §5.2):
       // appBuilderPersonaRoot 用于拼 publish.sh 绝对路径（persona-app-builder 安装在
       // dataDir/personas/persona-app-builder 之下，extension-kit/scripts/publish.sh 是相对路径）。
-      appBuilderPersonaRoot: import_node_path63.default.join(config.dataDir, "personas", "persona-app-builder"),
+      appBuilderPersonaRoot: import_node_path64.default.join(config.dataDir, "personas", "persona-app-builder"),
       // 共享 deploy-kit 根：scaffold/publish 脚本骨架 + 阿里云凭证单一真源。
-      deployKitRoot: import_node_path63.default.join(config.dataDir, "deploy-kit"),
+      deployKitRoot: import_node_path64.default.join(config.dataDir, "deploy-kit"),
       // scaffold/publish 按当前 session 的 persona 解析其安装根，让每个 persona 用自己的模板/注入配置。
-      resolvePersonaRoot: (personaId2) => import_node_path63.default.join(config.dataDir, "personas", personaId2),
+      resolvePersonaRoot: (personaId2) => import_node_path64.default.join(config.dataDir, "personas", personaId2),
       // 发布上线脚手架化 (spec 2026-06-03 §5.2.2):
       // 复用 SessionManagerDeps.broadcastFrame 同款 dispatch 逻辑 —— runner 调 manager.send
       // 取回 broadcast 帧后逐帧 push 到 transport，跟 manager 自身的 deps 一致。
@@ -62124,6 +62964,42 @@ async function startDaemon(config) {
   });
   shiftScheduler.start();
   logger.info("shift scheduler started", { shiftCount: shiftStore.list().length });
+  const larkBotStore = createLarkBotBindingStore(import_node_path64.default.join(config.dataDir, "personas"));
+  const larkBotCloud = createLarkBotCloudClient({
+    api: config.clawosApi ?? DEFAULT_CLAWOS_API,
+    apiKey: resolveClawdTicketsApiKey(),
+    deviceId: authFile.deviceId,
+    displayName: ownerDisplayName
+  });
+  const larkChatRouter = createLarkChatRouter({
+    manager,
+    cloud: larkBotCloud,
+    store: larkBotStore,
+    logger: {
+      warn: (msg) => logger.warn(msg),
+      info: (msg) => logger.info(msg)
+    }
+  });
+  const larkEventDedupe = createLarkEventDedupe();
+  const larkBotEventEndpoint = createLarkBotEventEndpoint({
+    getPublicKey: () => serverKeyStore.read(),
+    route: larkChatRouter.handleEnvelope,
+    dedupe: larkEventDedupe,
+    logger: { warn: (msg) => logger.warn(msg) }
+  });
+  const larkBotDeps = {
+    provisioner: { startAppRegistration, startScopeAuthorization },
+    cloud: larkBotCloud,
+    store: larkBotStore,
+    broadcast: (frame) => wsServer?.broadcastToOwners(frame),
+    getTunnelUrl: () => currentTunnelUrl,
+    getOwnerId: () => ownerIdentityStore.read()?.identity.ownerId ?? null,
+    getPersonaName: (personaId2) => personaRegistry.get(personaId2)?.label ?? null,
+    listLarkSessions: larkChatRouter.listLarkSessions,
+    listBoundPersonaIds: () => personaStore.list().filter((pid) => larkBotStore.read(pid) != null),
+    logger: { warn: (msg) => logger.warn(msg) }
+  };
+  Object.assign(handlers, buildLarkBotHandlers(larkBotDeps));
   const authResolver = new AuthContextResolver({
     ownerToken: resolvedAuthToken
   });
@@ -62175,6 +63051,8 @@ async function startDaemon(config) {
     // persona web 分享：访客换 token（POST /share/exchange）+ guest SPA serve（GET /s）
     visitorExchange: exchangeVisitorToken,
     ...shareUiAssetLoader ? { shareUiAssetLoader } : {},
+    // LarkBotConnector 事件入口（云端签名即凭证，无 Bearer）
+    larkBotEvent: larkBotEventEndpoint,
     // /files HMAC verify 用 auth.json token（与 attachment.signUrl 同源）。
     getSignSecret: () => authFile.token,
     // chatinput 附件上传（POST /attachments/upload，spec §6.1）。upload pipeline
@@ -62359,12 +63237,27 @@ async function startDaemon(config) {
       stateMgr.write(stateSnapshot);
       currentTunnelUrl = r.url;
       wss.broadcastAll({ type: "tunnel:ready", url: r.url, subdomain: r.subdomain });
+      void refreshTunnelUrlOnStartup(larkBotDeps);
+      void (async () => {
+        if (larkBotDeps.listBoundPersonaIds().length === 0) return;
+        try {
+          const items = await larkBotCloud.claimEvents();
+          const nowSec = Math.floor(Date.now() / 1e3);
+          for (const it of items) {
+            larkEventDedupe.add(it.eventId);
+            larkChatRouter.handleEnvelope({ ...it, iat: nowSec, exp: nowSec + 300 });
+          }
+          if (items.length > 0) logger.info("larkBot pending events claimed", { count: items.length });
+        } catch (err) {
+          logger.warn("larkBot pending events claim failed", { err: err.message });
+        }
+      })();
       const connectUrl = resolvedAuthToken ? `${r.url}#token=${resolvedAuthToken}` : r.url;
       const lines = [
         `Tunnel:      ${r.url}`,
         ...resolvedAuthToken ? [`Connect:     ${connectUrl}`] : [],
-        `Frpc config: ${import_node_path63.default.join(config.dataDir, "frpc.toml")}`,
-        `Frpc log:    ${import_node_path63.default.join(logDir, "frpc.log")}`
+        `Frpc config: ${import_node_path64.default.join(config.dataDir, "frpc.toml")}`,
+        `Frpc log:    ${import_node_path64.default.join(logDir, "frpc.log")}`
       ];
       const width = Math.max(...lines.map((l) => l.length));
       const bar = "\u2550".repeat(width + 4);
@@ -62377,8 +63270,8 @@ ${bar}
 
 `);
       try {
-        const connectPath = import_node_path63.default.join(config.dataDir, "connect.txt");
-        import_node_fs47.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
+        const connectPath = import_node_path64.default.join(config.dataDir, "connect.txt");
+        import_node_fs48.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }
     } catch (err) {
@@ -62450,9 +63343,9 @@ ${bar}
   };
 }
 function migrateDropPersonsDir(dataDir) {
-  const dir = import_node_path63.default.join(dataDir, "persons");
+  const dir = import_node_path64.default.join(dataDir, "persons");
   try {
-    import_node_fs47.default.rmSync(dir, { recursive: true, force: true });
+    import_node_fs48.default.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }