@controlflow-ai/daemon 0.1.0 → 0.1.2

package/src/console.ts

@@ -4,7 +4,10 @@ import { boolFlag, parseArgs, flag, numberFlag } from './args.js';
 import { LockClient } from './client.js';
 import { defaultServerUrl } from './config.js';
 import { formatMessages } from './format.js';
-import type { Computer } from './types.js';
+import { defaultLarkConfigPath, findCredentialByAgent, loadLarkCredentials, saveLarkCredentials, unbindCredentialAgent, upsertCredential } from './lark/credentials.js';
+import { registerLarkAppFromDeviceFlow, resolveLarkBotInfo, type LarkBotInfoResult } from './lark/setup.js';
+import type { LarkRegistrationComplete } from './lark/app-registration.js';
+import type { Computer, ProvisionedComputer } from './types.js';
 
 interface Prompt {
   askLine(label: string): Promise<string>;
@@ -21,17 +24,107 @@ Usage:
   bun run src/console.ts inbox --agent neeko [--after 0] [--limit 50] [--json]
   bun run src/console.ts runs [--json]
   bun run src/console.ts run-action <run-id> kill|restart
+  bun run src/console.ts computers list [--json]
+  bun run src/console.ts computer onboard [--interactive] [--name <display-name>] [--server-url <url>] [--package-name <npm-package>]
   bun run src/console.ts agents list [--json]
   bun run src/console.ts agents onboard [--interactive] [--key <agent-key>] [--name <display-name>] [--runtime codex] [--computer-id <machine>]
   bun run src/console.ts agents create --key <agent-key> --name <display-name> [--runtime neeko|coco|coco-stream-json|codex] [--desc <description>]
-  bun run src/console.ts agents update --key <agent-key> --runtime neeko|coco|coco-stream-json|codex
-  bun run src/console.ts lark <setup|list|daemon|events|send> [flags]
+  bun run src/console.ts agents update [--interactive] --key <agent-key> [--runtime neeko|coco|coco-stream-json|codex]
+      [--lark-app-id <id> --lark-app-secret <secret>] [--lark-label <name>] [--lark-config <path>] [--rebind-lark] [--unbind-lark] [--no-reload]
+  bun run src/console.ts lark-users list [--json]
+  bun run src/console.ts lark-users add [--interactive] --user-id <union-id> [--name <display-name>]
+  bun run src/console.ts lark-users delete --user-id <union-id>
+  bun run src/console.ts lark <list|daemon|events|send> [flags]
 
 Environment:
   PAL_SERVER=${defaultServerUrl()}
 `;
 }
 
+async function requestJson<T>(url: string, init?: RequestInit): Promise<T> {
+  const response = await fetch(url, init);
+  const payload = await response.json() as { data?: T; message?: string; code?: string };
+  if (!response.ok) throw new Error(payload.message ?? payload.code ?? `request failed: ${response.status}`);
+  return payload.data as T;
+}
+
+async function reloadLarkIntegration(serverUrl: string): Promise<void> {
+  const response = await fetch(`${serverUrl.replace(/\/$/, '')}/api/lark/reload`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({}),
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    console.warn(`Lark bot config saved, but server reload failed (${response.status}): ${text}`);
+    return;
+  }
+  console.log('Lark integration reloaded.');
+}
+
+async function resolveBotInfoForConsole(appId: string, appSecret: string): Promise<LarkBotInfoResult> {
+  if (process.env.NODE_ENV === 'test' && process.env.PAL_TEST_LARK_BOT_OPEN_ID) {
+    return { ok: true, openId: process.env.PAL_TEST_LARK_BOT_OPEN_ID };
+  }
+  return resolveLarkBotInfo(appId, appSecret);
+}
+
+async function registerLarkAppForConsole(): Promise<LarkRegistrationComplete | null> {
+  if (process.env.NODE_ENV === 'test' && process.env.PAL_TEST_LARK_REGISTRATION_APP_ID && process.env.PAL_TEST_LARK_REGISTRATION_APP_SECRET) {
+    console.log('Create a Feishu app by scanning this QR code or opening the link:');
+    console.log('https://example.test/lark-registration');
+    return {
+      appId: process.env.PAL_TEST_LARK_REGISTRATION_APP_ID,
+      appSecret: process.env.PAL_TEST_LARK_REGISTRATION_APP_SECRET,
+      tenantBrand: 'feishu',
+      userOpenId: process.env.PAL_TEST_LARK_REGISTRATION_USER_OPEN_ID,
+    };
+  }
+  return registerLarkAppFromDeviceFlow({ log: console });
+}
+
+function larkConfigPath(flags: Record<string, string | boolean>): string {
+  return flag(flags, 'lark-config') ?? flag(flags, 'config') ?? defaultLarkConfigPath();
+}
+
+async function unbindLarkBotFromAgent(serverClient: LockClient, flags: Record<string, string | boolean>, agentKey: string): Promise<void> {
+  const configPath = larkConfigPath(flags);
+  const store = loadLarkCredentials(configPath);
+  const result = unbindCredentialAgent(store, agentKey);
+  if (!result.changed) {
+    console.log(`Agent ${agentKey} has no Lark bot binding.`);
+    return;
+  }
+  saveLarkCredentials(result.store, configPath);
+  console.log(`Lark bot ${result.unbound!.appId} unbound from agent ${agentKey}.`);
+  if (!boolFlag(flags, 'no-reload')) await reloadLarkIntegration(serverClient.baseUrl);
+}
+
+async function bindLarkBotToAgent(serverClient: LockClient, flags: Record<string, string | boolean>, agentKey: string): Promise<void> {
+  const appId = flag(flags, 'lark-app-id') ?? flag(flags, 'app-id');
+  const appSecret = flag(flags, 'lark-app-secret') ?? flag(flags, 'app-secret');
+  if (!appId && !appSecret) return;
+  if (!appId || !appSecret) throw new Error('--lark-app-id and --lark-app-secret are required together');
+
+  const botInfo = await resolveBotInfoForConsole(appId, appSecret);
+  if (!botInfo.ok) throw new Error(`could not resolve Lark bot open_id (${botInfo.error}): ${botInfo.message}`);
+
+  const configPath = larkConfigPath(flags);
+  const store = loadLarkCredentials(configPath);
+  const result = upsertCredential(store, {
+    appId,
+    appSecret,
+    label: flag(flags, 'lark-label') ?? flag(flags, 'label'),
+    agent: agentKey,
+    botOpenId: botInfo.openId,
+  }, { rebind: boolFlag(flags, 'rebind-lark') });
+  saveLarkCredentials(result.store, configPath);
+
+  const moved = result.unbound.length > 0 ? `; moved from ${result.unbound.map((bot) => bot.appId).join(', ')}` : '';
+  console.log(`Lark bot ${appId} bound to agent ${agentKey}${moved}.`);
+  if (!boolFlag(flags, 'no-reload')) await reloadLarkIntegration(serverClient.baseUrl);
+}
+
 function printJson(value: unknown): void {
   console.log(JSON.stringify(value, null, 2));
 }
@@ -120,7 +213,123 @@ async function askComputerId(prompt: Prompt, computers: Computer[]): Promise<str
   }
 }
 
-async function collectOnboardInput(serverClient: LockClient, flags: Record<string, string | boolean>): Promise<{ agentKey: string; displayName: string; runtime: string; desc: string | null; computerId: string | undefined }> {
+async function listAgentRecords(serverClient: LockClient): Promise<Array<Record<string, unknown>>> {
+  const response = await fetch(`${serverClient.baseUrl}/api/agents`);
+  const payload = await response.json() as { data?: { agents: Array<Record<string, unknown>> }; message?: string };
+  if (!response.ok) throw new Error(payload.message ?? `list failed: ${response.status}`);
+  return payload.data?.agents ?? [];
+}
+
+async function askAgentKey(prompt: Prompt, agents: Array<Record<string, unknown>>, defaultValue = ''): Promise<string> {
+  if (agents.length === 0) throw new Error('No agents found. Set up an agent first with "bun run console -- agents onboard".');
+
+  console.log('Agents:');
+  agents.forEach((agent, index) => {
+    console.log(`  ${index + 1}. ${agent.display_name} (${agent.agent_key}) runtime=${agent.runtime ?? '-'}`);
+  });
+
+  while (true) {
+    const answer = await ask(prompt, 'Choose agent', defaultValue);
+    const selected = agents[Number(answer) - 1] ?? agents.find((agent) => agent.agent_key === answer);
+    if (selected?.agent_key) return String(selected.agent_key);
+    console.log('Choose a listed number or agent key.');
+  }
+}
+
+async function collectComputerOnboardInput(serverClient: LockClient, flags: Record<string, string | boolean>): Promise<{ name: string; serverUrl: string; packageName: string }> {
+  const hasAnyProvisionFlag = Boolean(flag(flags, 'name') || flag(flags, 'server-url') || flag(flags, 'package-name'));
+  const interactive = boolFlag(flags, 'interactive') || (!hasAnyProvisionFlag && process.stdin.isTTY === true);
+  const defaultName = flag(flags, 'name') ?? 'Local computer';
+  const defaultServerUrl = flag(flags, 'server-url') ?? serverClient.baseUrl;
+  const defaultPackageName = flag(flags, 'package-name') ?? '@controlflow-ai/daemon@latest';
+
+  if (!interactive) {
+    return {
+      name: defaultName,
+      serverUrl: defaultServerUrl,
+      packageName: defaultPackageName,
+    };
+  }
+
+  const prompt = await createPrompt();
+  try {
+    console.log('Computer onboarding');
+    console.log('Provision a computer credential and daemon start command.');
+    const name = await askRequired(prompt, 'Computer display name', defaultName);
+    const serverUrl = await askRequired(prompt, 'Server URL', defaultServerUrl);
+    const packageName = await askRequired(prompt, 'Daemon package', defaultPackageName);
+    console.log('');
+    console.log('Summary:');
+    console.log(`  name: ${name}`);
+    console.log(`  server_url: ${serverUrl}`);
+    console.log(`  package_name: ${packageName}`);
+    if (!await askYesNo(prompt, 'Provision this computer?', true)) throw new Error('computer onboarding cancelled');
+    return { name, serverUrl, packageName };
+  } finally {
+    prompt.close();
+  }
+}
+
+function printProvisionedComputer(provisioned: ProvisionedComputer): void {
+  console.log('Computer onboarded');
+  console.log(`  id: ${provisioned.computer.id}`);
+  console.log(`  name: ${provisioned.computer.name}`);
+  console.log(`  status: ${provisioned.computer.status}`);
+  console.log('');
+  console.log('Daemon command:');
+  console.log(provisioned.command);
+}
+
+async function collectLarkBindFlags(prompt: Prompt, flags: Record<string, string | boolean>, agentKey: string, existingAppId?: string): Promise<Record<string, string | boolean>> {
+  const configPath = larkConfigPath(flags);
+  console.log('Lark bot setup');
+  console.log('  1. Scan or open link to create app');
+  console.log('  2. Paste App ID / App Secret');
+  const method = await ask(prompt, 'Setup method', '1');
+
+  let appId = flag(flags, 'lark-app-id') ?? flag(flags, 'app-id');
+  let appSecret = flag(flags, 'lark-app-secret') ?? flag(flags, 'app-secret');
+  let scannedUserOpenId: string | undefined;
+  if (method !== '2' && (!appId || !appSecret)) {
+    const registration = await registerLarkAppForConsole().catch((error) => {
+      console.warn(`App registration failed: ${error instanceof Error ? error.message : String(error)}`);
+      return null;
+    });
+    if (registration?.tenantBrand === 'lark') {
+      throw new Error('Lark international tenants are not supported yet; use a Feishu tenant');
+    }
+    if (registration) {
+      appId = registration.appId;
+      appSecret = registration.appSecret;
+      scannedUserOpenId = registration.userOpenId;
+      console.log(`App created: ${appId}`);
+    } else {
+      console.warn('Falling back to manual App ID / App Secret entry.');
+    }
+  }
+
+  appId = appId || await askRequired(prompt, 'Lark App ID', existingAppId ?? '');
+  appSecret = appSecret || await askRequired(prompt, 'Lark App Secret');
+  const label = await ask(prompt, 'Bot label (optional)', flag(flags, 'lark-label') ?? flag(flags, 'label') ?? '');
+  if (scannedUserOpenId) {
+    console.log(`Scanner open_id ${scannedUserOpenId} was detected; add it under Lark authorized users if this user should operate Pal.`);
+  }
+
+  const isChangingBot = Boolean(existingAppId && existingAppId !== appId);
+  const rebind = boolFlag(flags, 'rebind-lark') || (isChangingBot && await askYesNo(prompt, `Move ${agentKey} from ${existingAppId} to ${appId}?`, false));
+  if (isChangingBot && !rebind) throw new Error('Lark bot rebind cancelled');
+
+  return {
+    ...flags,
+    'lark-app-id': appId,
+    'lark-app-secret': appSecret,
+    'lark-config': configPath,
+    ...(label ? { 'lark-label': label } : {}),
+    ...(rebind ? { 'rebind-lark': true } : {}),
+  };
+}
+
+async function collectOnboardInput(serverClient: LockClient, flags: Record<string, string | boolean>): Promise<{ agentKey: string; displayName: string; runtime: string; desc: string | null; computerId: string | undefined; larkFlags?: Record<string, string | boolean> }> {
   const hasRequiredFlags = Boolean(flag(flags, 'key') && flag(flags, 'name'));
   const interactive = boolFlag(flags, 'interactive') || (!hasRequiredFlags && process.stdin.isTTY === true);
   if (!interactive) {
@@ -131,6 +340,7 @@ async function collectOnboardInput(serverClient: LockClient, flags: Record<strin
       runtime: flag(flags, 'runtime') ?? 'codex',
       desc: flag(flags, 'desc') ?? null,
       computerId: flag(flags, 'computer-id'),
+      larkFlags: flag(flags, 'lark-app-id') || flag(flags, 'app-id') ? flags : undefined,
     };
   }
 
@@ -154,18 +364,99 @@ async function collectOnboardInput(serverClient: LockClient, flags: Record<strin
     console.log(`  description: ${desc || '-'}`);
     console.log(`  computer_id: ${computerId || '-'}`);
     if (!await askYesNo(prompt, 'Create/update this agent?', true)) throw new Error('onboarding cancelled');
+    const shouldSetupLark = await askYesNo(prompt, 'Set up a Lark bot for this agent?', false);
+    const larkFlags = shouldSetupLark ? await collectLarkBindFlags(prompt, flags, agentKey) : undefined;
     return {
       agentKey,
       displayName,
       runtime,
       desc: desc || null,
       computerId: computerId || undefined,
+      larkFlags,
+    };
+  } finally {
+    prompt.close();
+  }
+}
+
+async function collectAgentUpdateInput(serverClient: LockClient, flags: Record<string, string | boolean>): Promise<{ agentKey: string; flags: Record<string, string | boolean> }> {
+  if (flag(flags, 'runtime')) throw new Error('agents update --interactive currently supports only Lark bot binding or unbinding');
+
+  const prompt = await createPrompt();
+  try {
+    console.log('Agent Lark settings');
+    const agents = await listAgentRecords(serverClient);
+    const agentKey = await askAgentKey(prompt, agents, flag(flags, 'key') ?? (agents.length === 1 ? '1' : ''));
+    const configPath = larkConfigPath(flags);
+    const store = loadLarkCredentials(configPath);
+    const existing = findCredentialByAgent(store, agentKey);
+    if (existing) {
+      console.log(`Current Lark bot: ${existing.label ?? existing.appId} (${existing.appId})`);
+    } else {
+      console.log('Current Lark bot: -');
+    }
+
+    const defaultAction = existing ? '1' : '1';
+    console.log('Lark action:');
+    console.log(`  1. ${existing ? 'Bind/rebind bot' : 'Bind bot'}`);
+    if (existing) console.log('  2. Unbind bot');
+    const action = await ask(prompt, 'Choose action', defaultAction);
+    if (existing && (action === '2' || action.toLowerCase() === 'unbind')) {
+      if (!await askYesNo(prompt, `Unbind ${existing.appId} from ${agentKey}?`, false)) throw new Error('Lark bot unbind cancelled');
+      return {
+        agentKey,
+        flags: {
+          ...flags,
+          'lark-config': configPath,
+          'unbind-lark': true,
+        },
+      };
+    }
+
+    const larkFlags = await collectLarkBindFlags(prompt, flags, agentKey, existing?.appId);
+
+    console.log('');
+    console.log('Summary:');
+    console.log(`  agent_key: ${agentKey}`);
+    console.log(`  lark_app_id: ${flag(larkFlags, 'lark-app-id')}`);
+    console.log(`  lark_label: ${flag(larkFlags, 'lark-label') || '-'}`);
+    console.log(`  rebind: ${boolFlag(larkFlags, 'rebind-lark') ? 'yes' : 'no'}`);
+    if (!await askYesNo(prompt, 'Bind this Lark bot?', true)) throw new Error('Lark bot binding cancelled');
+
+    return {
+      agentKey,
+      flags: larkFlags,
     };
   } finally {
     prompt.close();
   }
 }
 
+async function collectLarkUserInput(flags: Record<string, string | boolean>): Promise<{ userId: string; displayName: string | null }> {
+  const userIdFlag = flag(flags, 'user-id') ?? flag(flags, 'id');
+  const interactive = boolFlag(flags, 'interactive') || (!userIdFlag && process.stdin.isTTY === true);
+  if (!interactive) {
+    if (!userIdFlag) throw new Error('lark-users add requires --user-id when not running interactively');
+    return { userId: userIdFlag, displayName: flag(flags, 'name') ?? null };
+  }
+
+  const prompt = await createPrompt();
+  try {
+    console.log('Lark authorized user');
+    const userId = await askRequired(prompt, 'Lark user ID', userIdFlag ?? '');
+    const displayName = await ask(prompt, 'Display name (optional)', flag(flags, 'name') ?? '');
+    console.log('');
+    console.log('Summary:');
+    console.log(`  user_id: ${userId}`);
+    console.log(`  display_name: ${displayName || '-'}`);
+    if (!await askYesNo(prompt, 'Authorize this Lark user?', true)) throw new Error('lark user add cancelled');
+    return { userId, displayName: displayName || null };
+  } finally {
+    prompt.close();
+  }
+}
+
+
 async function main(): Promise<void> {
   const args = parseArgs();
   const serverClient = new LockClient(flag(args.flags, 'server'));
@@ -247,14 +538,45 @@ async function main(): Promise<void> {
     return;
   }
 
+  if (args.command === 'computer' || args.command === 'computers') {
+    const sub = args.values[0];
+
+    if (sub === 'list') {
+      const computers = await serverClient.listComputers();
+      if (args.flags.json) {
+        printJson(computers);
+      } else {
+        for (const computer of computers) {
+          const seen = computer.last_seen_at ? ` last_seen=${computer.last_seen_at}` : '';
+          console.log(`${computer.id} name="${computer.name}" status=${computer.status}${seen}`);
+        }
+      }
+      return;
+    }
+
+    if (sub === 'onboard') {
+      const input = await collectComputerOnboardInput(serverClient, args.flags);
+      const provisioned = await serverClient.provisionComputer({
+        name: input.name,
+        server_url: input.serverUrl,
+        package_name: input.packageName,
+      });
+      if (args.flags.json) {
+        printJson(provisioned);
+      } else {
+        printProvisionedComputer(provisioned);
+      }
+      return;
+    }
+
+    throw new Error(`unknown ${args.command} subcommand: ${sub ?? '(none)'}\n\n${usage()}`);
+  }
+
   if (args.command === 'agents') {
     const sub = args.values[0];
 
     if (sub === 'list') {
-      const response = await fetch(`${serverClient.baseUrl}/api/agents`);
-      const payload = await response.json() as { data?: { agents: Array<Record<string, unknown>> }; message?: string };
-      if (!response.ok) throw new Error(payload.message ?? `list failed: ${response.status}`);
-      const agents = payload.data?.agents ?? [];
+      const agents = await listAgentRecords(serverClient);
       if (args.flags.json) {
         printJson(agents);
       } else {
@@ -290,7 +612,7 @@ async function main(): Promise<void> {
     }
 
     if (sub === 'onboard') {
-      const { agentKey, displayName, runtime, desc, computerId } = await collectOnboardInput(serverClient, args.flags);
+      const { agentKey, displayName, runtime, desc, computerId, larkFlags } = await collectOnboardInput(serverClient, args.flags);
       if (!agentKey) throw new Error('agent key is required');
       if (!displayName) throw new Error('display name is required');
 
@@ -307,28 +629,85 @@ async function main(): Promise<void> {
       });
       const payload = await response.json() as { data?: Record<string, unknown>; message?: string };
       if (!response.ok) throw new Error(payload.message ?? `onboard failed: ${response.status}`);
+      if (larkFlags) await bindLarkBotToAgent(serverClient, larkFlags, agentKey);
       printJson(payload.data);
       return;
     }
 
     if (sub === 'update') {
-      const agentKey = flag(args.flags, 'key');
+      const updateInput = boolFlag(args.flags, 'interactive')
+        ? await collectAgentUpdateInput(serverClient, args.flags)
+        : { agentKey: flag(args.flags, 'key') ?? '', flags: args.flags };
+      const agentKey = updateInput.agentKey;
+      const updateFlags = updateInput.flags;
       const runtime = flag(args.flags, 'runtime');
       if (!agentKey) throw new Error('--key is required');
-      if (!runtime) throw new Error('--runtime is required');
+      const hasLarkBinding = Boolean(flag(updateFlags, 'lark-app-id') || flag(updateFlags, 'app-id') || flag(updateFlags, 'lark-app-secret') || flag(updateFlags, 'app-secret'));
+      const hasLarkUnbind = boolFlag(updateFlags, 'unbind-lark');
+      if (!runtime && !hasLarkBinding && !hasLarkUnbind) throw new Error('--runtime, --lark-app-id/--lark-app-secret, or --unbind-lark is required');
+
+      let agent: Record<string, unknown> | undefined;
+      if (runtime) {
+        const response = await fetch(`${serverClient.baseUrl}/api/agents/${encodeURIComponent(agentKey)}`, {
+          method: 'PATCH',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ runtime }),
+        });
+        const payload = await response.json() as { data?: { agent: Record<string, unknown> }; message?: string };
+        if (!response.ok) throw new Error(payload.message ?? `update failed: ${response.status}`);
+        agent = payload.data?.agent;
+      } else {
+        agent = (await listAgentRecords(serverClient)).find((candidate) => candidate.agent_key === agentKey);
+        if (!agent) throw new Error(`agent ${agentKey} not found`);
+      }
+
+      if (hasLarkUnbind) await unbindLarkBotFromAgent(serverClient, updateFlags, agentKey);
+      else await bindLarkBotToAgent(serverClient, updateFlags, agentKey);
+      printJson(agent);
+      return;
+    }
+
+    throw new Error(`unknown agents subcommand: ${sub ?? '(none)'}\n\n${usage()}`);
+  }
 
-      const response = await fetch(`${serverClient.baseUrl}/api/agents/${encodeURIComponent(agentKey)}`, {
-        method: 'PATCH',
+  if (args.command === 'lark-users') {
+    const sub = args.values[0];
+
+    if (sub === 'list') {
+      const data = await requestJson<{ users: Array<Record<string, unknown>> }>(`${serverClient.baseUrl}/api/lark/authorized-users`);
+      if (args.flags.json) {
+        printJson(data.users);
+      } else if (data.users.length === 0) {
+        console.log('No authorized Lark users.');
+      } else {
+        for (const user of data.users) {
+          console.log(`${user.user_id} name="${user.display_name ?? '-'}" added=${user.created_at}`);
+        }
+      }
+      return;
+    }
+
+    if (sub === 'add') {
+      const input = await collectLarkUserInput(args.flags);
+      const data = await requestJson<{ user: Record<string, unknown> }>(`${serverClient.baseUrl}/api/lark/authorized-users`, {
+        method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ runtime }),
+        body: JSON.stringify({ user_id: input.userId, display_name: input.displayName }),
       });
-      const payload = await response.json() as { data?: { agent: Record<string, unknown> }; message?: string };
-      if (!response.ok) throw new Error(payload.message ?? `update failed: ${response.status}`);
-      printJson(payload.data?.agent);
+      if (args.flags.json) printJson(data.user);
+      else console.log(`Authorized Lark user ${data.user.user_id}`);
       return;
     }
 
-    throw new Error(`unknown agents subcommand: ${sub ?? '(none)'}\n\n${usage()}`);
+    if (sub === 'delete' || sub === 'remove') {
+      const userId = flag(args.flags, 'user-id') ?? flag(args.flags, 'id') ?? args.values[1];
+      if (!userId) throw new Error('--user-id is required');
+      await requestJson<{ deleted: boolean }>(`${serverClient.baseUrl}/api/lark/authorized-users/${encodeURIComponent(userId)}`, { method: 'DELETE' });
+      console.log(`Deleted Lark user ${userId}`);
+      return;
+    }
+
+    throw new Error(`unknown lark-users subcommand: ${sub ?? '(none)'}\n\n${usage()}`);
   }
 
   if (args.command === 'lark') {

package/src/daemon.ts

@@ -153,12 +153,22 @@ async function executeRun(client: LockClient, delivery: MessageDelivery, message
   console.log(`${logPrefix} run=${run.id} status=${run.status}`);
 
   const { runAgentRuntime } = await import('./agent-runtime.js');
-  const roomParticipants = await client.listRoomMembers(message.chat_id)
-    .then((result) => result.participants)
+  const roomSnapshot = await client.listRoomMembers(message.chat_id)
+    .then((result) => result)
     .catch((error) => {
       console.warn(`${logPrefix} room participant snapshot unavailable: ${error instanceof Error ? error.message : String(error)}`);
-      return [];
+      return null;
     });
+  const roomParticipants = roomSnapshot?.participants ?? [];
+  const roomProject = roomSnapshot?.room.project_id ? {
+    id: roomSnapshot.room.project_id,
+    name: roomSnapshot.room.project_name ?? roomSnapshot.room.project_id,
+    rootPath: roomSnapshot.room.project_root_path ?? '',
+    computerId: roomSnapshot.room.project_computer_id ?? '',
+    computerName: roomSnapshot.room.project_computer_name,
+  } : null;
+  const projectAccessible = Boolean(roomProject && options.computerId && roomProject.computerId === options.computerId);
+  const effectiveProjectCwd = projectAccessible && roomProject?.rootPath ? roomProject.rootPath : options.projectCwd;
   const recentMessages = await client.getMessages(new URLSearchParams({
     chat_id: message.chat_id,
     after: String(Math.max(0, message.id - 50)),
@@ -176,7 +186,12 @@ async function executeRun(client: LockClient, delivery: MessageDelivery, message
       message,
       cwd: options.agentHome,
       agentHome: options.agentHome,
-      projectCwd: options.projectCwd,
+      projectCwd: effectiveProjectCwd,
+      projectContext: roomProject ? {
+        ...roomProject,
+        accessible: projectAccessible,
+        currentComputerId: options.computerId,
+      } : undefined,
       extraArgs: options.extraArgs,
       localDaemonUrl: options.localDaemonUrl,
       localDaemonToken: options.localDaemonToken,
@@ -377,6 +392,7 @@ async function reconcileManagedAgents(input: {
   computerId: string;
   serverUrl: string;
   defaultCwd: string;
+  localUrl?: string;
 }): Promise<void> {
   const desiredAssignedAgents = new Set(input.assignments.map((assignment) => assignment.agent));
 
@@ -403,6 +419,7 @@ async function reconcileManagedAgents(input: {
   await input.client.registerDaemon({
     id: input.daemonId,
     name: input.computerId,
+    local_url: input.localUrl,
     server_url: input.serverUrl,
     agents: daemonAgentPayload(input.managedAgents),
   });
@@ -473,6 +490,8 @@ async function main(): Promise<void> {
 
   const daemonAuth = { computer_id: connected.computer.id, connection_id: connected.connection.id, token: connected.token };
   const client = new LockClient(serverUrl, daemonAuth);
+  const localServer = startLocalApi({ host: localHost, port: localPort, serverUrl, token: localToken, controlToken: connected.local_control_token, daemonAuth });
+  const localUrl = `http://${localServer.hostname}:${localServer.port}`;
   await reconcileManagedAgents({
     assignments: connected.agents ?? [],
     explicitAgents,
@@ -483,6 +502,7 @@ async function main(): Promise<void> {
     computerId: connected.computer.id,
     serverUrl,
     defaultCwd: cwd,
+    localUrl,
   });
   if (managedAgents.size === 0) {
     console.log(`[daemon] no agents currently assigned to computer ${connected.computer.id}; waiting for assignments`);
@@ -491,8 +511,6 @@ async function main(): Promise<void> {
   let connectionRevoked = false;
   const heartbeatMs = numberFlag(args.flags, 'heartbeat-interval', 5000)!;
 
-  const localServer = startLocalApi({ host: localHost, port: localPort, serverUrl, token: localToken, daemonAuth });
-
   console.log(`pal daemon computer=${connected.computer.id} connection=${connected.connection.id} agents=${Array.from(managedAgents.values()).map((managed) => `${managed.agent}:${managed.runtimeProvider}`).join(',') || 'none'} server=${serverUrl}`);
   console.log(`local api=http://${localServer.hostname}:${localServer.port} token=${localToken ? 'set' : 'missing'}`);
   console.log(`state=${statePath} lastSeenId=${state.lastSeenId}`);
@@ -525,6 +543,7 @@ async function main(): Promise<void> {
         computerId: connected.computer.id,
         serverUrl,
         defaultCwd: cwd,
+        localUrl,
       });
       writeState(statePath, state);
     } catch (error) {