@dsh-cove/dsh-web-all 0.0.0-stage → 0.4.4

package/lib/types/host/services/index.js

@@ -0,0 +1,80 @@
+import * as accessTrust from "./access-trust/index.js";
+import * as remoteAccess from "./remote-access/index.js";
+import * as ssh from "./ssh/index.js";
+import * as memoir from "./memoir/index.js";
+import * as worktree from "./worktree/index.js";
+import * as gitGraph from "./git-graph/index.js";
+import * as rightPane from "./right-pane/index.js";
+import * as larkInbox from "./lark-inbox/index.js";
+import * as notify from "./notify/index.js";
+import * as playwrightSessions from "./playwright-sessions/index.js";
+import * as remoteWebUi from "./remote-web-ui/index.js";
+import * as codexBridge from "./codex-bridge/index.js";
+import * as noBrowserAuth from "./no-browser-auth/index.js";
+import * as webRender from "./web-render/index.js";
+import * as webSearchAnthropic from "./web-search-anthropic/index.js";
+import * as scheduleMode from "./schedule-mode/index.js";
+import { createServiceLifecycleOwner } from "./lifecycle.js";
+function warn(ctx, diagnostic) {
+    const text = `[web-all:services] ${diagnostic.service} ${diagnostic.phase} failed: ${diagnostic.message}`;
+    try {
+        ctx.logger('web-all:services').warn(text);
+    }
+    catch {
+        console.warn(text, diagnostic.error);
+    }
+}
+/**
+ * Mount every service domain beneath one owner. Synchronous failures remain
+ * tolerant and observable; asynchronous registration is tracked, aborted and
+ * awaited during unload so no disposer can arrive after the owner disappeared.
+ */
+export function assembleServices(ctx, deps = {}) {
+    const owner = createServiceLifecycleOwner({
+        onDiagnostic: diagnostic => {
+            warn(ctx, diagnostic);
+            deps.onDiagnostic?.(diagnostic);
+        },
+    });
+    const mount = (name, register) => owner.mount(name, register);
+    // The admission decision every privileged host route family consults. Mount
+    // it first: the families resolve it lazily, but an earlier mount keeps the
+    // service present for the whole lifetime of the assembly.
+    mount('access-trust', () => accessTrust.register(ctx));
+    // Host ownership + plain-HTTP boot shims for the reverse-proxied entry.
+    // Mounted right after the fence it consults, before any route family.
+    mount('remote-access', () => remoteAccess.register(ctx));
+    mount('ssh', () => ssh.register(ctx));
+    mount('memoir', () => memoir.register(ctx));
+    mount('worktree', () => worktree.register(ctx, deps.worktree));
+    mount('git-graph', () => gitGraph.register(ctx));
+    mount('right-pane', () => rightPane.register(ctx));
+    mount('lark-inbox', () => larkInbox.register(ctx));
+    // Mounted straight after the inbox because it is the same integration's
+    // outbound half and borrows its credentials when it has none of its own.
+    // It only subscribes and serves one read route, so it consults the fence
+    // rather than depending on any other family.
+    mount('notify', () => notify.register(ctx));
+    mount('codex-bridge', () => codexBridge.register(ctx, {
+        proxyDir: deps.codexProxyDir ?? process.env.DSH_CODEX_PROXY_DIR,
+        logger: { warn: error => console.warn('[web-all:codex-bridge]', error) },
+    }));
+    // The legacy bypass and integrated WebAuth both patch the private BrowserAuth
+    // object. Never stack them: an explicit bypass is the legacy compatibility
+    // mode, otherwise remote-web-ui owns the composed account session.
+    if (deps.noBrowserAuth === true) {
+        mount('no-browser-auth', () => noBrowserAuth.register(ctx, { enabled: true }));
+    }
+    else {
+        mount('remote-web-ui', () => remoteWebUi.register(ctx));
+    }
+    mount('web-render', () => webRender.register(ctx, { dshHome: deps.dshHome }));
+    // Mounted next to web-render: both register providers into `ctx.web` and are
+    // pinned by the using profile's cordis.patch.yml, under the same
+    // MISSING/UNAVAILABLE selection rules.
+    mount('web-search-anthropic', () => webSearchAnthropic.register(ctx));
+    mount('schedule-mode', () => scheduleMode.register(ctx));
+    owner.track('playwright-sessions', playwrightSessions.register(ctx, deps.playwright ?? {}, owner.signal));
+    return owner.dispose;
+}
+export { createServiceLifecycleOwner } from "./lifecycle.js";

package/lib/types/host/services/lark-inbox/config.d.ts

@@ -0,0 +1,24 @@
+/** Lark inbox settings schema and host-side credential/path resolution. */
+import z from 'schemastery';
+export declare const LARK_INBOX_SETTINGS_NAMESPACE = "lark-inbox";
+export declare const DEFAULT_QUEUE_DIR = "";
+export declare const LARK_APP_SECRET_ENV = "LARK_APP_SECRET";
+export declare const LARK_DOMAINS: readonly ["feishu", "lark"];
+export interface LarkInboxConfig {
+    enabled?: boolean;
+    announceToAgent?: boolean;
+    appId?: string;
+    appSecret?: string;
+    domain?: 'feishu' | 'lark';
+    requireMentionInGroup?: boolean;
+    allowedOpenIds?: string[];
+    dropAppMessages?: boolean;
+    queueDir?: string;
+    maxAttempts?: number;
+    staleTimeoutMs?: number;
+}
+export declare const Config: z<LarkInboxConfig>;
+export declare function resolveAppSecret(config: LarkInboxConfig | undefined, env?: NodeJS.ProcessEnv): string;
+export declare function resolveQueueDir(config: LarkInboxConfig | undefined, dshHomeDir: string): string;
+export declare function effectiveConfig(config: LarkInboxConfig | undefined): Required<LarkInboxConfig>;
+//# sourceMappingURL=config.d.ts.map

package/lib/types/host/services/lark-inbox/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/lark-inbox/config.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAI3E,OAAO,CAAC,MAAM,aAAa,CAAA;AAE3B,eAAO,MAAM,6BAA6B,eAAe,CAAA;AACzD,eAAO,MAAM,iBAAiB,KAAK,CAAA;AACnC,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,YAAY,6BAA8B,CAAA;AAEvD,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,MAAM,EAYF,CAAC,CAAC,eAAe,CAAC,CAAA;AAInC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAelH;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG/F;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,CAE9F"}

package/lib/types/host/services/lark-inbox/config.js

@@ -0,0 +1,48 @@
+/** Lark inbox settings schema and host-side credential/path resolution. */
+import { join } from 'node:path';
+import { registerFamilyNamespace } from "../family-config.js";
+import z from 'schemastery';
+export const LARK_INBOX_SETTINGS_NAMESPACE = 'lark-inbox';
+export const DEFAULT_QUEUE_DIR = '';
+export const LARK_APP_SECRET_ENV = 'LARK_APP_SECRET';
+export const LARK_DOMAINS = ['feishu', 'lark'];
+export const Config = z.object({
+    enabled: z.boolean().default(true),
+    announceToAgent: z.boolean().default(false),
+    appId: z.string().default(''),
+    appSecret: z.string().role('secret').default(''),
+    domain: z.union(LARK_DOMAINS).default('feishu'),
+    requireMentionInGroup: z.boolean().default(true),
+    allowedOpenIds: z.array(z.string()).default([]),
+    dropAppMessages: z.boolean().default(true),
+    queueDir: z.string().default(DEFAULT_QUEUE_DIR),
+    maxAttempts: z.number().step(1).min(1).default(5),
+    staleTimeoutMs: z.number().step(1).min(1).default(300_000),
+});
+registerFamilyNamespace(LARK_INBOX_SETTINGS_NAMESPACE, Config);
+export function resolveAppSecret(config, env = process.env) {
+    const raw = config?.appSecret ?? '';
+    if (raw.startsWith('env:')) {
+        const name = raw.slice('env:'.length).trim();
+        if (name === '')
+            throw new Error('dsh-lark-inbox: appSecret 的 env: 引用缺少变量名（例如 env:LARK_APP_SECRET）');
+        const value = env[name];
+        if (value === undefined || value === '') {
+            throw new Error(`dsh-lark-inbox: appSecret 引用的环境变量 ${name} 未设置或为空；请在设置里填写 appSecret、或使用 env:VARNAME 引用、或导出 ${name}`);
+        }
+        return value;
+    }
+    if (raw.trim() !== '')
+        return raw;
+    const ambient = env[LARK_APP_SECRET_ENV];
+    if (ambient !== undefined && ambient !== '')
+        return ambient;
+    throw new Error('dsh-lark-inbox: 未配置 appSecret；需要在设置里填写 appSecret、或填写 env:VARNAME 引用环境变量、或导出 LARK_APP_SECRET 环境变量');
+}
+export function resolveQueueDir(config, dshHomeDir) {
+    const raw = config?.queueDir ?? DEFAULT_QUEUE_DIR;
+    return raw.trim() === '' ? join(dshHomeDir, 'lark-inbox') : raw;
+}
+export function effectiveConfig(config) {
+    return Config(config ?? {});
+}

package/lib/types/host/services/lark-inbox/gateway.d.ts

@@ -0,0 +1,53 @@
+/** Official Lark SDK WebSocket long-connection gateway. */
+export type LarkDomain = 'feishu' | 'lark';
+type EventHandler = (data: unknown) => void;
+export interface GatewaySdk {
+    domain: {
+        Feishu: unknown;
+        Lark: unknown;
+    };
+    createDispatcher(): {
+        register(handlers: Record<string, EventHandler>): unknown;
+    };
+    createClient(options: {
+        appId: string;
+        appSecret: string;
+        domain: unknown;
+        wsConfig: {
+            pingTimeout: number;
+        };
+    }): {
+        start(options: {
+            eventDispatcher: unknown;
+        }): Promise<unknown>;
+        close(): unknown;
+    };
+}
+export interface GatewayOptions {
+    appId: string;
+    appSecret: string;
+    domain?: LarkDomain;
+    onEvent(event: unknown, meta: {
+        mentionBot: boolean;
+    }): void;
+    log?: (level: 'info' | 'warn' | 'error', message: string) => void;
+    sdk?: GatewaySdk;
+}
+export declare function extractMentionIds(event: unknown): string[];
+/** Old-fleet degraded behavior: any mention counts while bot open-id is unavailable. */
+export declare function isBotMentioned(event: unknown): boolean;
+export declare class LarkGateway {
+    private readonly options;
+    private readonly sdk;
+    private readonly log;
+    private client;
+    private running;
+    private generation;
+    constructor(options: GatewayOptions);
+    isRunning(): boolean;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private dispatch;
+}
+export {};
+//# sourceMappingURL=gateway.d.ts.map

package/lib/types/host/services/lark-inbox/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/lark-inbox/gateway.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAI3D,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAA;AAC1C,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;AAE3C,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAA;IAC1C,gBAAgB,IAAI;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,OAAO,CAAA;KAAE,CAAA;IACjF,YAAY,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE;YAAE,WAAW,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG;QAC/G,KAAK,CAAC,OAAO,EAAE;YAAE,eAAe,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QAC9D,KAAK,IAAI,OAAO,CAAA;KACjB,CAAA;CACF;AAQD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,UAAU,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACjE,GAAG,CAAC,EAAE,UAAU,CAAA;CACjB;AAyCD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAa1D;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoC;IACxD,OAAO,CAAC,MAAM,CAAoD;IAClE,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,UAAU,CAAI;gBAEV,OAAO,EAAE,cAAc;IAMnC,SAAS,IAAI,OAAO;IAId,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAwCtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB3B,OAAO,CAAC,QAAQ;CAajB"}

package/lib/types/host/services/lark-inbox/gateway.js

@@ -0,0 +1,171 @@
+/** Official Lark SDK WebSocket long-connection gateway. */
+import { Domain, EventDispatcher, WSClient } from '@larksuiteoapi/node-sdk';
+const officialSdk = {
+    domain: Domain,
+    createDispatcher: () => new EventDispatcher({}),
+    createClient: options => new WSClient(options),
+};
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function nonEmpty(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+function mentionEntryToId(entry) {
+    if (!isRecord(entry))
+        return '';
+    const id = entry.id;
+    if (typeof id === 'string')
+        return nonEmpty(id);
+    if (isRecord(id)) {
+        for (const key of ['open_id', 'user_id', 'union_id', 'id']) {
+            const value = nonEmpty(id[key]);
+            if (value)
+                return value;
+        }
+    }
+    const userId = entry.user_id;
+    if (typeof userId === 'string')
+        return nonEmpty(userId);
+    if (isRecord(userId)) {
+        for (const key of ['open_id', 'user_id', 'union_id']) {
+            const value = nonEmpty(userId[key]);
+            if (value)
+                return value;
+        }
+    }
+    return nonEmpty(entry.key);
+}
+function locateMentions(event) {
+    if (!isRecord(event))
+        return undefined;
+    if (isRecord(event.message) && Array.isArray(event.message.mentions))
+        return event.message.mentions;
+    if (isRecord(event.event)) {
+        if (isRecord(event.event.message) && Array.isArray(event.event.message.mentions))
+            return event.event.message.mentions;
+        if (Array.isArray(event.event.mentions))
+            return event.event.mentions;
+    }
+    return Array.isArray(event.mentions) ? event.mentions : undefined;
+}
+export function extractMentionIds(event) {
+    const mentions = locateMentions(event);
+    if (!Array.isArray(mentions))
+        return [];
+    const seen = new Set();
+    const ids = [];
+    for (const entry of mentions) {
+        const id = mentionEntryToId(entry);
+        if (id && !seen.has(id)) {
+            seen.add(id);
+            ids.push(id);
+        }
+    }
+    return ids;
+}
+/** Old-fleet degraded behavior: any mention counts while bot open-id is unavailable. */
+export function isBotMentioned(event) {
+    return extractMentionIds(event).length > 0;
+}
+export class LarkGateway {
+    options;
+    sdk;
+    log;
+    client;
+    running = false;
+    generation = 0;
+    constructor(options) {
+        this.options = options;
+        this.sdk = options.sdk ?? officialSdk;
+        this.log = options.log ?? (() => undefined);
+    }
+    isRunning() {
+        return this.running;
+    }
+    async start() {
+        if (this.running)
+            return;
+        this.running = true;
+        const generation = ++this.generation;
+        let acquired;
+        try {
+            const domain = this.options.domain ?? 'feishu';
+            const sdkDomain = domain === 'feishu' ? this.sdk.domain.Feishu
+                : domain === 'lark' ? this.sdk.domain.Lark
+                    : undefined;
+            if (sdkDomain === undefined)
+                throw new Error(`lark-inbox: unsupported domain '${domain}' — the installed @larksuiteoapi/node-sdk only maps 'feishu' and 'lark'`);
+            const client = this.sdk.createClient({
+                appId: this.options.appId,
+                appSecret: this.options.appSecret,
+                domain: sdkDomain,
+                wsConfig: { pingTimeout: 3 },
+            });
+            acquired = client;
+            const eventDispatcher = this.sdk.createDispatcher().register({
+                'im.message.receive_v1': data => {
+                    if (generation === this.generation && this.running)
+                        this.dispatch(data);
+                },
+            });
+            await client.start({ eventDispatcher });
+            // stop() may have run while the SDK was connecting. Do not publish a
+            // late client after rollback, or let an old start overwrite a newer one.
+            if (generation !== this.generation || !this.running) {
+                client.close();
+                return;
+            }
+            this.client = client;
+            this.log('info', 'lark-inbox gateway started (subscribed: im.message.receive_v1)');
+        }
+        catch (error) {
+            try {
+                acquired?.close();
+            }
+            catch (closeError) {
+                this.log('error', `lark-inbox gateway cleanup failed: ${describeError(closeError)}`);
+            }
+            if (generation === this.generation)
+                this.running = false;
+            this.log('error', `lark-inbox gateway start failed: ${describeError(error)}`);
+            throw error;
+        }
+    }
+    async stop() {
+        ++this.generation;
+        const client = this.client;
+        if (!client) {
+            this.running = false;
+            return;
+        }
+        try {
+            client.close();
+        }
+        catch (error) {
+            this.log('error', `lark-inbox gateway stop failed: ${describeError(error)}`);
+            throw error;
+        }
+        this.client = undefined;
+        this.running = false;
+        this.log('info', 'lark-inbox gateway stopped');
+    }
+    dispatch(data) {
+        let mentionBot = false;
+        try {
+            mentionBot = isBotMentioned(data);
+        }
+        catch (error) {
+            this.log('error', `lark-inbox mention detection failed: ${describeError(error)}`);
+        }
+        try {
+            this.options.onEvent(data, { mentionBot });
+        }
+        catch (error) {
+            this.log('error', `lark-inbox onEvent handler failed: ${describeError(error)}`);
+        }
+    }
+}
+function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/lib/types/host/services/lark-inbox/host-routes.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Same-origin host routes for the credential wizard.
+ *
+ * The wizard drives a host-side Lark login (it opens a verification URL and
+ * accepts the app secret), so it admits exactly what every other privileged
+ * web-all host surface admits: the deployment's declared browser entry with an
+ * authenticated session, or a loopback page. The strict loopback rule stays the
+ * default so a partially mounted plugin can never widen access.
+ */
+import type { IncomingMessage } from 'node:http';
+import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
+import { type LarkWizard } from './wizard.ts';
+export declare const LARK_WIZARD_PREFIX = "/lark-inbox/wizard";
+/**
+ * Build the wizard routes.
+ * @param wizard - the credential wizard driving the host-side login.
+ * @param isTrusted - host access fence; defaults to the shared strict loopback rule.
+ * @param enabled - whether the feature is enabled right now (read per request).
+ * @returns the routes to register on the web server.
+ */
+export declare function makeLarkWizardRoutes(wizard: LarkWizard, isTrusted?: (request: IncomingMessage) => boolean, enabled?: () => boolean): WebRoute[];
+//# sourceMappingURL=host-routes.d.ts.map

package/lib/types/host/services/lark-inbox/host-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-routes.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/lark-inbox/host-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAkC,KAAK,UAAU,EAAoB,MAAM,aAAa,CAAA;AAG/F,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAmCtD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAA2B,EACpE,OAAO,GAAE,MAAM,OAAoB,GAClC,QAAQ,EAAE,CAkDZ"}

package/lib/types/host/services/lark-inbox/host-routes.js

@@ -0,0 +1,146 @@
+/**
+ * Same-origin host routes for the credential wizard.
+ *
+ * The wizard drives a host-side Lark login (it opens a verification URL and
+ * accepts the app secret), so it admits exactly what every other privileged
+ * web-all host surface admits: the deployment's declared browser entry with an
+ * authenticated session, or a loopback page. The strict loopback rule stays the
+ * default so a partially mounted plugin can never widen access.
+ */
+import { readFile } from 'node:fs/promises';
+import { WizardSettingsUnavailableError } from "./wizard.js";
+import { isLoopbackRequest } from "../access-trust/trust.js";
+export const LARK_WIZARD_PREFIX = '/lark-inbox/wizard';
+const BODY_LIMIT = 16 * 1024;
+function writeJson(response, status, body) {
+    response.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+    response.end(JSON.stringify(body));
+}
+async function readJson(request) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.length;
+        if (size > BODY_LIMIT) {
+            request.destroy();
+            return null;
+        }
+        chunks.push(buffer);
+    }
+    const text = Buffer.concat(chunks).toString('utf8');
+    if (text === '')
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function statusPayload(state) {
+    switch (state.phase) {
+        case 'idle': return { phase: 'idle' };
+        case 'awaiting-browser': return { phase: 'awaiting-browser', mode: 'new' };
+        case 'awaiting-secret': return { phase: 'awaiting-secret', mode: 'bind', consoleUrl: state.consoleUrl };
+        case 'done': return { phase: 'done', appId: state.appId, needsSecretPaste: state.needsSecretPaste };
+        case 'failed': return { phase: 'failed', error: state.error };
+    }
+}
+/**
+ * Build the wizard routes.
+ * @param wizard - the credential wizard driving the host-side login.
+ * @param isTrusted - host access fence; defaults to the shared strict loopback rule.
+ * @param enabled - whether the feature is enabled right now (read per request).
+ * @returns the routes to register on the web server.
+ */
+export function makeLarkWizardRoutes(wizard, isTrusted = isLoopbackRequest, enabled = () => true) {
+    const guard = (request, response, method) => {
+        if (!isTrusted(request)) {
+            writeJson(response, 403, { error: 'forbidden: loopback-only' });
+            return false;
+        }
+        // 路由随服务域一起挂载（开关只影响运行时），禁用状态仍然要拒绝写凭据：
+        // 否则关闭的功能保留一条能写入 appSecret 的活口。
+        if (!enabled()) {
+            writeJson(response, 409, { error: 'lark-inbox-disabled' });
+            return false;
+        }
+        if (request.method !== method) {
+            writeJson(response, 405, { error: 'method-not-allowed' });
+            return false;
+        }
+        return true;
+    };
+    return [
+        { kind: 'exact', path: `${LARK_WIZARD_PREFIX}/start-new`, handler: async (request, response) => {
+                if (!guard(request, response, 'POST'))
+                    return;
+                try {
+                    const { verificationUrl, qrFilePath } = await wizard.startNew();
+                    writeJson(response, 200, { verificationUrl, qr: qrFilePath === null ? null : `${LARK_WIZARD_PREFIX}/qr.png` });
+                }
+                catch (error) {
+                    writeJson(response, error instanceof WizardSettingsUnavailableError ? 503 : 500, { error: error instanceof Error ? error.message : String(error) });
+                }
+            } },
+        { kind: 'exact', path: `${LARK_WIZARD_PREFIX}/start-bind`, handler: async (request, response) => {
+                if (!guard(request, response, 'POST'))
+                    return;
+                const body = await readJson(request);
+                if (body === null || typeof body.appId !== 'string' || !body.appId.startsWith('cli_')) {
+                    writeJson(response, 400, { error: 'appId 必须以 cli_ 开头' });
+                    return;
+                }
+                writeJson(response, 200, wizard.startBind(body.appId));
+            } },
+        { kind: 'exact', path: `${LARK_WIZARD_PREFIX}/finish-bind`, handler: async (request, response) => {
+                if (!guard(request, response, 'POST'))
+                    return;
+                const body = await readJson(request);
+                if (body === null || typeof body.appSecret !== 'string' || body.appSecret.trim() === '') {
+                    writeJson(response, 400, { error: 'appSecret 不能为空' });
+                    return;
+                }
+                try {
+                    await wizard.finishBind(body.appSecret);
+                    writeJson(response, 200, { ok: true });
+                }
+                catch (error) {
+                    writeJson(response, error instanceof WizardSettingsUnavailableError ? 503 : 400, { error: error instanceof Error ? error.message : String(error) });
+                }
+            } },
+        { kind: 'exact', path: `${LARK_WIZARD_PREFIX}/status`, handler: (request, response) => {
+                if (!guard(request, response, 'GET'))
+                    return;
+                writeJson(response, 200, statusPayload(wizard.state()));
+            } },
+        { kind: 'exact', path: `${LARK_WIZARD_PREFIX}/qr.png`, handler: async (request, response) => {
+                if (!guard(request, response, 'GET'))
+                    return;
+                const state = wizard.state();
+                const path = state.phase === 'awaiting-browser' ? state.qrFilePath : null;
+                if (path === null) {
+                    response.writeHead(404, { 'cache-control': 'no-store' });
+                    response.end();
+                    return;
+                }
+                try {
+                    const data = await readFile(path);
+                    response.writeHead(200, { 'content-type': 'image/png', 'cache-control': 'no-store' });
+                    response.end(data);
+                }
+                catch {
+                    response.writeHead(404, { 'cache-control': 'no-store' });
+                    response.end();
+                }
+            } },
+        { kind: 'exact', path: `${LARK_WIZARD_PREFIX}/cancel`, handler: async (request, response) => {
+                if (!guard(request, response, 'POST'))
+                    return;
+                await wizard.cancel();
+                writeJson(response, 200, { ok: true });
+            } },
+    ];
+}

package/lib/types/host/services/lark-inbox/inbox-store.d.ts

@@ -0,0 +1,39 @@
+/** SQLite cursor/dedup index over the durable daily JSONL queue. */
+import { type LarkInboxEnvelope } from '../../../core/lark-inbox/queue.ts';
+export interface InboxStoreOptions {
+    rootDir: string;
+    maxAttempts?: number;
+    staleTimeoutMs?: number;
+}
+export interface InboxItem {
+    envelope: LarkInboxEnvelope;
+    status: 'pending' | 'processing';
+    attempts: number;
+    file: string;
+}
+export interface InboxStoreStats {
+    pending: number;
+    processing: number;
+    done: number;
+    dead: number;
+    total: number;
+}
+export declare class InboxStore {
+    private readonly db;
+    private readonly rootDir;
+    private readonly maxAttempts;
+    private readonly staleTimeoutMs;
+    private closed;
+    private constructor();
+    static open(options: InboxStoreOptions): InboxStore;
+    append(envelope: LarkInboxEnvelope): 'appended' | 'duplicate';
+    peek(limit?: number): InboxItem[];
+    pop(): InboxItem | null;
+    ack(eventId: string): void;
+    nack(eventId: string): void;
+    recoverStale(): number;
+    stats(): InboxStoreStats;
+    close(): void;
+    private rowToItem;
+}
+//# sourceMappingURL=inbox-store.d.ts.map

package/lib/types/host/services/lark-inbox/inbox-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox-store.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/lark-inbox/inbox-store.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAKpE,OAAO,EAAiC,KAAK,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAKzG,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,MAAM,EAAE,SAAS,GAAG,YAAY,CAAA;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAUD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,MAAM,CAAQ;IAEtB,OAAO;IAOP,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU;IAsBnD,MAAM,CAAC,QAAQ,EAAE,iBAAiB,GAAG,UAAU,GAAG,WAAW;IAmB7D,IAAI,CAAC,KAAK,SAAI,GAAG,SAAS,EAAE;IAO5B,GAAG,IAAI,SAAS,GAAG,IAAI;IAYvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAK1B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAS3B,YAAY,IAAI,MAAM;IAOtB,KAAK,IAAI,eAAe;IAWxB,KAAK,IAAI,IAAI;IAMb,OAAO,CAAC,SAAS;CAQlB"}