@dsh-enhanced/lark-channel 0.1.23 → 0.1.30

package/lib/setup.js

@@ -32,6 +32,7 @@ export function parseLarkSetupArgs(argv) {
         accountProvided: false,
         tenant: 'personal',
         createApp: false,
+        calendarReadonly: false,
         appName: 'DSH Personal Assistant',
         timeoutMs: 300_000,
         installServiceOnly: false,
@@ -63,6 +64,8 @@ export function parseLarkSetupArgs(argv) {
             result.appId = argumentValue(argv, index++, option);
         else if (option === '--create-app')
             result.createApp = true;
+        else if (option === '--calendar-readonly')
+            result.calendarReadonly = true;
         else if (option === '--install-service')
             result.installServiceOnly = true;
         else if (option === '--refresh-agent-policy')
@@ -109,6 +112,9 @@ export function parseLarkSetupArgs(argv) {
     if (result.installServiceOnly && !result.manageService) {
         throw new Error('lark-channel setup: --install-service and --no-service cannot be used together');
     }
+    if (result.calendarReadonly && !result.createApp) {
+        throw new Error('lark-channel setup: --calendar-readonly requires --create-app so the application scope can be updated');
+    }
     if (result.installServiceOnly && (result.createApp || result.appId !== undefined)) {
         throw new Error('lark-channel setup: --install-service cannot be combined with application setup options');
     }
@@ -153,6 +159,7 @@ export function createLarkRegistrationOptions(input) {
                     'im:message.reactions:write_only',
                     'im:message:send_as_bot',
                     'im:resource',
+                    ...(input.calendarReadonly ? ['calendar:calendar:readonly'] : []),
                 ] },
             events: { items: { tenant: ['im.message.receive_v1'] } },
             callbacks: { items: ['card.action.trigger'] },
@@ -276,6 +283,7 @@ Options:
   --account <id>         Local channel account id (default: primary)
   --tenant <id>          Local tenant namespace (default: personal)
   --create-app            Select, create, or officially update an app
+  --calendar-readonly      With --create-app, add Calendar read-only permission for exact calendar triggers
   --app-name <name>       New app name (default: DSH Personal Assistant)
   --app-id <cli_...>      Existing app id; combine with --create-app to update it
   --install-service       Only install/restart the profile's resident service
@@ -1137,6 +1145,7 @@ async function registerLarkApplication(args) {
             domain: args.domain,
             appName: args.appName,
             ...(args.appId === undefined ? {} : { appId: args.appId }),
+            ...(args.calendarReadonly ? { calendarReadonly: true } : {}),
             signal: abortController.signal,
             onQRCodeReady(info) {
                 process.stdout.write(`\n请在飞书中打开以下链接，选择已有应用或创建新应用（${info.expireIn} 秒内有效）：\n${info.url}\n\n`);
@@ -1197,6 +1206,65 @@ async function discoverOwner(transport, phrase, account, tenant, timeoutMs) {
         await transport.disconnect().catch(() => { });
     }
 }
+export function dshHomeLifecycleRendezvousPath(dshHome, uid = process.getuid?.()) {
+    if (!isAbsolute(dshHome))
+        throw new Error('lark-channel setup: DSH_HOME must be absolute');
+    if (!Number.isSafeInteger(uid) || uid === undefined || uid < 0) {
+        throw new Error('lark-channel setup: cannot determine the Linux user id for lifecycle locking');
+    }
+    const canonicalHome = normalizeSetupResourcePath(dshHome);
+    return `/tmp/.dsh-enhanced-lifecycle-${uid}-${textSha256(canonicalHome)}.lock`;
+}
+async function assertDshHomeLifecycleLockIdentity(descriptor, lockPath, uid) {
+    const [opened, linked] = await Promise.all([descriptor.stat(), lstat(lockPath)]);
+    if (!opened.isFile() || !linked.isFile() || linked.isSymbolicLink()
+        || opened.uid !== uid || linked.uid !== uid
+        || opened.nlink !== 1 || linked.nlink !== 1
+        || (opened.mode & 0o777) !== 0o600 || (linked.mode & 0o777) !== 0o600
+        || opened.dev !== linked.dev || opened.ino !== linked.ino) {
+        throw new Error(`lark-channel setup: lifecycle rendezvous lock is unsafe: ${lockPath}`);
+    }
+}
+export async function withDshHomeLifecycleLock(dshHome, operation) {
+    if (process.platform !== 'linux')
+        return operation();
+    const uid = process.getuid?.();
+    if (!Number.isSafeInteger(uid) || uid === undefined || uid < 0) {
+        throw new Error('lark-channel setup: cannot determine the Linux user id for lifecycle locking');
+    }
+    const temporaryDirectory = await lstat('/tmp');
+    if (!temporaryDirectory.isDirectory() || temporaryDirectory.isSymbolicLink()
+        || temporaryDirectory.uid !== 0 || (temporaryDirectory.mode & 0o7777) !== 0o1777) {
+        throw new Error('lark-channel setup: lifecycle rendezvous lock requires a safe root-owned sticky /tmp');
+    }
+    const lockPath = dshHomeLifecycleRendezvousPath(dshHome, uid);
+    let descriptor;
+    try {
+        descriptor = await open(lockPath, constants.O_RDWR | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+        await assertDshHomeLifecycleLockIdentity(descriptor, lockPath, uid);
+        const acquired = spawnSync('/usr/bin/flock', ['-n', '-E', '75', '3'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'ignore', 'pipe', descriptor.fd],
+        });
+        if (acquired.status === 75)
+            throw new Error(`lark-channel setup: DSH_HOME lifecycle is busy: ${lockPath}`);
+        if (acquired.status !== 0) {
+            const detail = typeof acquired.stderr === 'string' ? acquired.stderr.trim().slice(0, 1_000) : '';
+            throw new Error(`lark-channel setup: cannot acquire DSH_HOME lifecycle lock${detail === '' ? '' : `: ${detail}`}`);
+        }
+        await assertDshHomeLifecycleLockIdentity(descriptor, lockPath, uid);
+        return await operation();
+    }
+    catch (error) {
+        if (fileSystemErrorCode(error) === 'ELOOP') {
+            throw new Error(`lark-channel setup: lifecycle rendezvous lock is unsafe: ${lockPath}`);
+        }
+        throw error;
+    }
+    finally {
+        await descriptor?.close();
+    }
+}
 const defaultProfileSetupLockOptions = {
     timeoutMs: 30_000,
     pollMs: 100,
@@ -2733,285 +2801,288 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
     const dshHome = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
     if (!isAbsolute(dshHome))
         throw new Error('lark-channel setup: DSH_HOME must be absolute');
-    const patchPath = join(dshHome, 'profiles', args.profile, 'cordis.patch.yml');
-    const validate = runtime.validateProfile ?? validateProfile;
-    const readEffectiveProfile = runtime.readEffectiveProfile ?? dumpProfile;
-    const installResidentService = runtime.installResidentService ?? installDshResidentService;
-    const prepareResidentService = runtime.prepareResidentService ?? prepareDshSystemdUserService;
-    const recoveryOperations = {
-        ...runtime.journalOperations,
-        readEffectiveProfile: runtime.journalOperations?.readEffectiveProfile ?? readEffectiveProfile,
-        installService: runtime.journalOperations?.installService
-            ?? (async () => { await installResidentService({ dshHome, profile: args.profile }); }),
-    };
-    if (args.refreshAgentPolicy) {
-        await withProfileSetupLock(patchPath, async () => {
-            await recoverLarkSetupJournalUnlocked({
-                patchPath,
-                dshHome,
-                profile: args.profile,
-                operations: recoveryOperations,
-            });
-            const effectiveProfile = await readEffectiveProfile(args.profile);
-            const databasePath = deliveryDatabasePathFromEffectiveProfile(effectiveProfile, dshHome);
-            await withDeliveryOwnerSetupLock(databasePath, async () => {
-                await assertNoOtherLarkProfileSharesDelivery({
+    return withDshHomeLifecycleLock(dshHome, async () => {
+        const patchPath = join(dshHome, 'profiles', args.profile, 'cordis.patch.yml');
+        const validate = runtime.validateProfile ?? validateProfile;
+        const readEffectiveProfile = runtime.readEffectiveProfile ?? dumpProfile;
+        const installResidentService = runtime.installResidentService ?? installDshResidentService;
+        const prepareResidentService = runtime.prepareResidentService ?? prepareDshSystemdUserService;
+        const recoveryOperations = {
+            ...runtime.journalOperations,
+            readEffectiveProfile: runtime.journalOperations?.readEffectiveProfile ?? readEffectiveProfile,
+            installService: runtime.journalOperations?.installService
+                ?? (async () => { await installResidentService({ dshHome, profile: args.profile }); }),
+        };
+        if (args.refreshAgentPolicy) {
+            await withProfileSetupLock(patchPath, async () => {
+                await recoverLarkSetupJournalUnlocked({
+                    patchPath,
                     dshHome,
                     profile: args.profile,
-                    databasePath,
-                    readEffectiveProfile,
-                });
-                const originalPatch = await readFile(patchPath, 'utf8');
-                const materializedPatch = materializeManagedProfileOverride({
-                    profilePatch: originalPatch,
-                    effectiveProfile,
+                    operations: recoveryOperations,
                 });
-                const refreshInput = {
-                    profilePatch: materializedPatch,
-                    effectiveProfile,
-                    dshHome,
-                    agentTools: args.agentTools === 'enable' ? 'enable' : 'disable',
-                    ...(args.accountProvided ? { account: args.account } : {}),
-                };
-                const updatedPatch = refreshLarkAgentPolicyFromEffective(refreshInput);
-                const journal = {
+                const effectiveProfile = await readEffectiveProfile(args.profile);
+                const databasePath = deliveryDatabasePathFromEffectiveProfile(effectiveProfile, dshHome);
+                await withDeliveryOwnerSetupLock(databasePath, async () => {
+                    await assertNoOtherLarkProfileSharesDelivery({
+                        dshHome,
+                        profile: args.profile,
+                        databasePath,
+                        readEffectiveProfile,
+                    });
+                    const originalPatch = await readFile(patchPath, 'utf8');
+                    const materializedPatch = materializeManagedProfileOverride({
+                        profilePatch: originalPatch,
+                        effectiveProfile,
+                    });
+                    const refreshInput = {
+                        profilePatch: materializedPatch,
+                        effectiveProfile,
+                        dshHome,
+                        agentTools: args.agentTools === 'enable' ? 'enable' : 'disable',
+                        ...(args.accountProvided ? { account: args.account } : {}),
+                    };
+                    const updatedPatch = refreshLarkAgentPolicyFromEffective(refreshInput);
+                    const journal = {
+                        patchPath,
+                        dshHome,
+                        profile: args.profile,
+                        operation: 'refresh',
+                        phase: 'candidate',
+                        originalPatch,
+                        updatedPatch,
+                        installService: false,
+                        transactionId: randomBytes(16).toString('hex'),
+                    };
+                    await persistLarkSetupJournal(journal);
+                    try {
+                        await atomicWrite(patchPath, updatedPatch);
+                        await validate(args.profile);
+                        const validatedEffectiveProfile = await readEffectiveProfile(args.profile);
+                        const validatedDatabasePath = deliveryDatabasePathFromEffectiveProfile(validatedEffectiveProfile, dshHome);
+                        if (normalizeSetupResourcePath(validatedDatabasePath) !== normalizeSetupResourcePath(databasePath)) {
+                            throw new Error('lark-channel setup: effective assistant-delivery database changed during refresh validation');
+                        }
+                        const validatedSemanticPatch = refreshLarkAgentPolicyFromEffective({
+                            ...refreshInput,
+                            effectiveProfile: validatedEffectiveProfile,
+                        });
+                        assertEffectiveManagedPolicyMatchesCandidate({
+                            candidatePatch: validatedSemanticPatch,
+                            effectiveProfile: validatedEffectiveProfile,
+                        });
+                        assertEffectiveManagedPolicyMatchesCandidate({
+                            candidatePatch: updatedPatch,
+                            effectiveProfile: validatedEffectiveProfile,
+                        });
+                        if (await readFile(patchPath, 'utf8') !== updatedPatch) {
+                            throw new Error('lark-channel setup: refreshed profile changed during validation');
+                        }
+                    }
+                    catch (error) {
+                        if (await rollbackCandidatePatch({ patchPath, originalPatch, updatedPatch }) === 'conflict') {
+                            throw new Error('lark-channel setup: rollback refused because the profile changed concurrently', { cause: error });
+                        }
+                        await clearLarkSetupJournal(patchPath);
+                        throw error;
+                    }
+                    // If this durable phase transition or journal removal reports an error,
+                    // leave recovery to inspect the on-disk phase. Rolling back here could
+                    // contradict a validated record already renamed into place.
+                    await persistLarkSetupJournal({ ...journal, phase: 'validated' });
+                    await clearLarkSetupJournal(patchPath);
+                }, runtime.profileLockOptions);
+            }, runtime.profileLockOptions);
+            process.stdout.write(`DSH profile ${args.profile} 的 Agent capability policy 已刷新；飞书应用、凭据和 owner 绑定未改动。\n`);
+            return;
+        }
+        if (args.installServiceOnly) {
+            if (process.platform === 'linux') {
+                const prepared = await prepareResidentService({ dshHome, profile: args.profile });
+                if (prepared?.enabledLinger)
+                    process.stdout.write('已为当前 Linux 用户启用 linger，注销 SSH 后服务仍会保持。\n');
+            }
+            const service = await withProfileSetupLock(patchPath, async () => {
+                await recoverLarkSetupJournalUnlocked({
                     patchPath,
                     dshHome,
                     profile: args.profile,
-                    operation: 'refresh',
-                    phase: 'candidate',
-                    originalPatch,
-                    updatedPatch,
-                    installService: false,
-                    transactionId: randomBytes(16).toString('hex'),
-                };
-                await persistLarkSetupJournal(journal);
-                try {
-                    await atomicWrite(patchPath, updatedPatch);
+                    operations: recoveryOperations,
+                });
+                const databasePath = deliveryDatabasePathFromEffectiveProfile(await readEffectiveProfile(args.profile), dshHome);
+                return withDeliveryOwnerSetupLock(databasePath, async () => {
+                    await assertNoOtherLarkProfileSharesDelivery({
+                        dshHome,
+                        profile: args.profile,
+                        databasePath,
+                        readEffectiveProfile,
+                    });
+                    const profileSnapshot = await readFile(patchPath, 'utf8');
                     await validate(args.profile);
-                    const validatedEffectiveProfile = await readEffectiveProfile(args.profile);
-                    const validatedDatabasePath = deliveryDatabasePathFromEffectiveProfile(validatedEffectiveProfile, dshHome);
+                    const validatedDatabasePath = deliveryDatabasePathFromEffectiveProfile(await readEffectiveProfile(args.profile), dshHome);
                     if (normalizeSetupResourcePath(validatedDatabasePath) !== normalizeSetupResourcePath(databasePath)) {
-                        throw new Error('lark-channel setup: effective assistant-delivery database changed during refresh validation');
-                    }
-                    const validatedSemanticPatch = refreshLarkAgentPolicyFromEffective({
-                        ...refreshInput,
-                        effectiveProfile: validatedEffectiveProfile,
-                    });
-                    assertEffectiveManagedPolicyMatchesCandidate({
-                        candidatePatch: validatedSemanticPatch,
-                        effectiveProfile: validatedEffectiveProfile,
-                    });
-                    assertEffectiveManagedPolicyMatchesCandidate({
-                        candidatePatch: updatedPatch,
-                        effectiveProfile: validatedEffectiveProfile,
-                    });
-                    if (await readFile(patchPath, 'utf8') !== updatedPatch) {
-                        throw new Error('lark-channel setup: refreshed profile changed during validation');
+                        throw new Error('lark-channel setup: effective assistant-delivery database changed during service validation');
                     }
-                }
-                catch (error) {
-                    if (await rollbackCandidatePatch({ patchPath, originalPatch, updatedPatch }) === 'conflict') {
-                        throw new Error('lark-channel setup: rollback refused because the profile changed concurrently', { cause: error });
+                    if (await readFile(patchPath, 'utf8') !== profileSnapshot) {
+                        throw new Error('lark-channel setup: profile changed during resident service validation');
                     }
-                    await clearLarkSetupJournal(patchPath);
-                    throw error;
-                }
-                // If this durable phase transition or journal removal reports an error,
-                // leave recovery to inspect the on-disk phase. Rolling back here could
-                // contradict a validated record already renamed into place.
-                await persistLarkSetupJournal({ ...journal, phase: 'validated' });
-                await clearLarkSetupJournal(patchPath);
+                    return installResidentService({ dshHome, profile: args.profile });
+                }, runtime.profileLockOptions);
             }, runtime.profileLockOptions);
-        }, runtime.profileLockOptions);
-        process.stdout.write(`DSH profile ${args.profile} 的 Agent capability policy 已刷新；飞书应用、凭据和 owner 绑定未改动。\n`);
-        return;
-    }
-    if (args.installServiceOnly) {
-        if (process.platform === 'linux') {
+            process.stdout.write(`DSH profile ${args.profile} 已由 ${service.kind} 启动并保持常驻。\n`
+                + `状态：${service.statusCommand}\n日志：${service.logCommand}\n`);
+            return;
+        }
+        const preferredCredentialProvider = credentialProviderForPlatform(process.platform);
+        if (process.platform === 'linux' && args.manageService) {
             const prepared = await prepareResidentService({ dshHome, profile: args.profile });
             if (prepared?.enabledLinger)
                 process.stdout.write('已为当前 Linux 用户启用 linger，注销 SSH 后服务仍会保持。\n');
         }
-        const service = await withProfileSetupLock(patchPath, async () => {
+        let credentialProvider;
+        if (runtime.preflightCredentialProvider === undefined) {
+            const selection = await selectLarkCredentialProvider(preferredCredentialProvider, {
+                dshHome,
+                mode: args.linuxCredentialProvider,
+            });
+            credentialProvider = selection.provider;
+            if (selection.fallbackReason !== undefined) {
+                process.stdout.write('Linux Secret Service 当前不可用；向导已自动切换到当前用户 0600 私有凭据文件。'
+                    + '该文件未额外加密，同一 UID 与 root 可读取，但不会进入 profile、命令参数、环境变量或日志。\n');
+            }
+        }
+        else {
+            if (args.linuxCredentialProvider !== 'auto') {
+                throw new Error('lark-channel setup: an injected credential preflight cannot be combined with an explicit Linux provider');
+            }
+            credentialProvider = await runtime.preflightCredentialProvider(preferredCredentialProvider)
+                ?? preferredCredentialProvider;
+        }
+        // Resolve a prior crash before prompting the user or mutating a cloud app.
+        // The mutation transaction repeats this check after registration to close
+        // the gap against a different setup process that completed in the meantime.
+        await withProfileSetupLock(patchPath, async () => {
             await recoverLarkSetupJournalUnlocked({
                 patchPath,
                 dshHome,
                 profile: args.profile,
                 operations: recoveryOperations,
+                allowDeferredSecretServiceCleanup: credentialProvider === 'linux-protected-file',
             });
             const databasePath = deliveryDatabasePathFromEffectiveProfile(await readEffectiveProfile(args.profile), dshHome);
-            return withDeliveryOwnerSetupLock(databasePath, async () => {
+            await withDeliveryOwnerSetupLock(databasePath, async () => {
                 await assertNoOtherLarkProfileSharesDelivery({
                     dshHome,
                     profile: args.profile,
                     databasePath,
                     readEffectiveProfile,
                 });
-                const profileSnapshot = await readFile(patchPath, 'utf8');
-                await validate(args.profile);
-                const validatedDatabasePath = deliveryDatabasePathFromEffectiveProfile(await readEffectiveProfile(args.profile), dshHome);
-                if (normalizeSetupResourcePath(validatedDatabasePath) !== normalizeSetupResourcePath(databasePath)) {
-                    throw new Error('lark-channel setup: effective assistant-delivery database changed during service validation');
-                }
-                if (await readFile(patchPath, 'utf8') !== profileSnapshot) {
-                    throw new Error('lark-channel setup: profile changed during resident service validation');
-                }
-                return installResidentService({ dshHome, profile: args.profile });
             }, runtime.profileLockOptions);
         }, runtime.profileLockOptions);
-        process.stdout.write(`DSH profile ${args.profile} 已由 ${service.kind} 启动并保持常驻。\n`
-            + `状态：${service.statusCommand}\n日志：${service.logCommand}\n`);
-        return;
-    }
-    const preferredCredentialProvider = credentialProviderForPlatform(process.platform);
-    if (process.platform === 'linux' && args.manageService) {
-        const prepared = await prepareResidentService({ dshHome, profile: args.profile });
-        if (prepared?.enabledLinger)
-            process.stdout.write('已为当前 Linux 用户启用 linger，注销 SSH 后服务仍会保持。\n');
-    }
-    let credentialProvider;
-    if (runtime.preflightCredentialProvider === undefined) {
-        const selection = await selectLarkCredentialProvider(preferredCredentialProvider, {
-            dshHome,
-            mode: args.linuxCredentialProvider,
-        });
-        credentialProvider = selection.provider;
-        if (selection.fallbackReason !== undefined) {
-            process.stdout.write('Linux Secret Service 当前不可用；向导已自动切换到当前用户 0600 私有凭据文件。'
-                + '该文件未额外加密，同一 UID 与 root 可读取，但不会进入 profile、命令参数、环境变量或日志。\n');
+        let appId = args.appId;
+        let createApp = args.createApp;
+        if (appId === undefined && !createApp) {
+            const prompts = createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                appId = (await prompts.question('已有飞书 App ID（cli_...；直接回车则打开一键选择/创建）：')).trim();
+                createApp = appId.length === 0;
+            }
+            finally {
+                prompts.close();
+            }
         }
-    }
-    else {
-        if (args.linuxCredentialProvider !== 'auto') {
-            throw new Error('lark-channel setup: an injected credential preflight cannot be combined with an explicit Linux provider');
+        let resolvedDomain = args.domain;
+        let generatedSecret;
+        if (createApp) {
+            process.stdout.write(args.appId === undefined
+                ? '\n将通过飞书官方设备授权选择已有应用或创建新应用，并增量申请最小权限。App Secret 不会显示或写入 profile。\n'
+                : `\n将通过飞书官方设备授权更新已有应用 ${args.appId}，并增量申请最小权限。App Secret 不会显示或写入 profile。\n`);
+            const registration = await registerLarkApplication(args);
+            appId = registration.client_id;
+            resolvedDomain = registration.user_info?.tenant_brand ?? resolvedDomain;
+            generatedSecret = registration.client_secret;
+            process.stdout.write(`应用 ${appId} 已完成授权；凭据将在 profile 事务中暂存并激活。\n`);
         }
-        credentialProvider = await runtime.preflightCredentialProvider(preferredCredentialProvider)
-            ?? preferredCredentialProvider;
-    }
-    // Resolve a prior crash before prompting the user or mutating a cloud app.
-    // The mutation transaction repeats this check after registration to close
-    // the gap against a different setup process that completed in the meantime.
-    await withProfileSetupLock(patchPath, async () => {
-        await recoverLarkSetupJournalUnlocked({
-            patchPath,
+        else {
+            if (appId === undefined || !/^cli_[0-9a-fA-F]{16}$/u.test(appId)) {
+                throw new Error('lark-channel setup: invalid App ID');
+            }
+            process.stdout.write(`请确认已有应用已开启机器人、im:message 与 im:resource 权限、长连接事件 im.message.receive_v1，且版本已发布。\n`
+                + `控制台：https://open.feishu.cn/app\n`);
+        }
+        if (appId === undefined)
+            throw new Error('lark-channel setup: Feishu did not return an App ID');
+        const configuredAppId = appId;
+        let installedService;
+        await executeLarkSetupProfileTransaction({
+            args,
             dshHome,
-            profile: args.profile,
-            operations: recoveryOperations,
-            allowDeferredSecretServiceCleanup: credentialProvider === 'linux-protected-file',
-        });
-        const databasePath = deliveryDatabasePathFromEffectiveProfile(await readEffectiveProfile(args.profile), dshHome);
-        await withDeliveryOwnerSetupLock(databasePath, async () => {
-            await assertNoOtherLarkProfileSharesDelivery({
-                dshHome,
-                profile: args.profile,
-                databasePath,
+            patchPath,
+            application: { appId: configuredAppId, domain: resolvedDomain },
+            credentialProvider,
+            ...(runtime.profileLockOptions === undefined ? {} : { profileLockOptions: runtime.profileLockOptions }),
+            operations: {
+                async storeCredential(locator) {
+                    const service = locator.provider === 'windows-dpapi'
+                        ? `dsh/lark/${args.profile}/${args.account}/versions/windows-dpapi`
+                        : locator.provider === 'linux-protected-file'
+                            ? `dsh/lark/${args.profile}/${args.account}/versions/linux-protected-file`
+                            : locator.service;
+                    const credentialPath = locator.provider === 'windows-dpapi'
+                        || locator.provider === 'linux-protected-file' ? locator.path : undefined;
+                    if (generatedSecret === undefined) {
+                        await storeSecret(credentialProvider, service, args.account, credentialPath);
+                    }
+                    else {
+                        await storeGeneratedSecret(credentialProvider, service, args.account, generatedSecret, credentialPath);
+                    }
+                    process.stdout.write(`候选凭据已暂存到 ${credentialProvider}；旧凭据仍保持有效。\n`);
+                },
+                readCredential(locator) {
+                    const service = locator.provider === 'windows-dpapi'
+                        ? `dsh/lark/${args.profile}/${args.account}/versions/windows-dpapi`
+                        : locator.provider === 'linux-protected-file'
+                            ? `dsh/lark/${args.profile}/${args.account}/versions/linux-protected-file`
+                            : locator.service;
+                    return readSecret(credentialProvider, service, args.account, locator.provider === 'windows-dpapi' || locator.provider === 'linux-protected-file'
+                        ? locator.path
+                        : undefined);
+                },
                 readEffectiveProfile,
-            });
-        }, runtime.profileLockOptions);
-    }, runtime.profileLockOptions);
-    let appId = args.appId;
-    let createApp = args.createApp;
-    if (appId === undefined && !createApp) {
-        const prompts = createInterface({ input: process.stdin, output: process.stdout });
-        try {
-            appId = (await prompts.question('已有飞书 App ID（cli_...；直接回车则打开一键选择/创建）：')).trim();
-            createApp = appId.length === 0;
+                async discoverOwner(ownerInput) {
+                    const phrase = `DSH-CONNECT-${randomBytes(4).toString('hex').toUpperCase()}`;
+                    const transport = createOfficialLarkTransport({
+                        appId: ownerInput.appId,
+                        appSecret: ownerInput.appSecret,
+                        domain: ownerInput.domain,
+                        handshakeTimeoutMs: 15_000,
+                        requestTimeoutMs: 30_000,
+                        imageDownloadTimeoutMs: 30_000,
+                    });
+                    return discoverOwner(transport, phrase, ownerInput.account, ownerInput.tenant, ownerInput.timeoutMs);
+                },
+                ...(args.manageService ? {
+                    async afterCommit() {
+                        installedService = await installResidentService({ dshHome, profile: args.profile });
+                    },
+                } : {}),
+            },
+        });
+        if (args.manageService) {
+            const service = installedService;
+            if (service === undefined)
+                throw new Error('lark-channel setup: resident service installation did not complete');
+            process.stdout.write(`\n飞书 channel 已写入 profile ${args.profile}，owner 已精确绑定。\n`
+                + `DSH Host 已由 ${service.kind} 启动并保持常驻，无需再手动运行 dsh web。\n`
+                + `状态：${service.statusCommand}\n日志：${service.logCommand}\n`
+                + `健康检查：在 Web 会话中调用 assistant_health。\n`);
         }
-        finally {
-            prompts.close();
+        else {
+            process.stdout.write(`\n飞书 channel 已写入 profile ${args.profile}，owner 已精确绑定。\n`
+                + `本次跳过常驻服务；手动启动：dsh --profile ${args.profile} --no-open\n`
+                + `健康检查：在 Web 会话中调用 assistant_health。\n`);
         }
-    }
-    let resolvedDomain = args.domain;
-    let generatedSecret;
-    if (createApp) {
-        process.stdout.write(args.appId === undefined
-            ? '\n将通过飞书官方设备授权选择已有应用或创建新应用，并增量申请最小权限。App Secret 不会显示或写入 profile。\n'
-            : `\n将通过飞书官方设备授权更新已有应用 ${args.appId}，并增量申请最小权限。App Secret 不会显示或写入 profile。\n`);
-        const registration = await registerLarkApplication(args);
-        appId = registration.client_id;
-        resolvedDomain = registration.user_info?.tenant_brand ?? resolvedDomain;
-        generatedSecret = registration.client_secret;
-        process.stdout.write(`应用 ${appId} 已完成授权；凭据将在 profile 事务中暂存并激活。\n`);
-    }
-    else {
-        if (appId === undefined || !/^cli_[0-9a-fA-F]{16}$/u.test(appId)) {
-            throw new Error('lark-channel setup: invalid App ID');
-        }
-        process.stdout.write(`请确认已有应用已开启机器人、im:message 与 im:resource 权限、长连接事件 im.message.receive_v1，且版本已发布。\n`
-            + `控制台：https://open.feishu.cn/app\n`);
-    }
-    if (appId === undefined)
-        throw new Error('lark-channel setup: Feishu did not return an App ID');
-    const configuredAppId = appId;
-    let installedService;
-    await executeLarkSetupProfileTransaction({
-        args,
-        dshHome,
-        patchPath,
-        application: { appId: configuredAppId, domain: resolvedDomain },
-        credentialProvider,
-        ...(runtime.profileLockOptions === undefined ? {} : { profileLockOptions: runtime.profileLockOptions }),
-        operations: {
-            async storeCredential(locator) {
-                const service = locator.provider === 'windows-dpapi'
-                    ? `dsh/lark/${args.profile}/${args.account}/versions/windows-dpapi`
-                    : locator.provider === 'linux-protected-file'
-                        ? `dsh/lark/${args.profile}/${args.account}/versions/linux-protected-file`
-                        : locator.service;
-                const credentialPath = locator.provider === 'windows-dpapi'
-                    || locator.provider === 'linux-protected-file' ? locator.path : undefined;
-                if (generatedSecret === undefined) {
-                    await storeSecret(credentialProvider, service, args.account, credentialPath);
-                }
-                else {
-                    await storeGeneratedSecret(credentialProvider, service, args.account, generatedSecret, credentialPath);
-                }
-                process.stdout.write(`候选凭据已暂存到 ${credentialProvider}；旧凭据仍保持有效。\n`);
-            },
-            readCredential(locator) {
-                const service = locator.provider === 'windows-dpapi'
-                    ? `dsh/lark/${args.profile}/${args.account}/versions/windows-dpapi`
-                    : locator.provider === 'linux-protected-file'
-                        ? `dsh/lark/${args.profile}/${args.account}/versions/linux-protected-file`
-                        : locator.service;
-                return readSecret(credentialProvider, service, args.account, locator.provider === 'windows-dpapi' || locator.provider === 'linux-protected-file'
-                    ? locator.path
-                    : undefined);
-            },
-            readEffectiveProfile,
-            async discoverOwner(ownerInput) {
-                const phrase = `DSH-CONNECT-${randomBytes(4).toString('hex').toUpperCase()}`;
-                const transport = createOfficialLarkTransport({
-                    appId: ownerInput.appId,
-                    appSecret: ownerInput.appSecret,
-                    domain: ownerInput.domain,
-                    handshakeTimeoutMs: 15_000,
-                    imageDownloadTimeoutMs: 30_000,
-                });
-                return discoverOwner(transport, phrase, ownerInput.account, ownerInput.tenant, ownerInput.timeoutMs);
-            },
-            ...(args.manageService ? {
-                async afterCommit() {
-                    installedService = await installResidentService({ dshHome, profile: args.profile });
-                },
-            } : {}),
-        },
     });
-    if (args.manageService) {
-        const service = installedService;
-        if (service === undefined)
-            throw new Error('lark-channel setup: resident service installation did not complete');
-        process.stdout.write(`\n飞书 channel 已写入 profile ${args.profile}，owner 已精确绑定。\n`
-            + `DSH Host 已由 ${service.kind} 启动并保持常驻，无需再手动运行 dsh web。\n`
-            + `状态：${service.statusCommand}\n日志：${service.logCommand}\n`
-            + `健康检查：在 Web 会话中调用 assistant_health。\n`);
-    }
-    else {
-        process.stdout.write(`\n飞书 channel 已写入 profile ${args.profile}，owner 已精确绑定。\n`
-            + `本次跳过常驻服务；手动启动：dsh --profile ${args.profile} --no-open\n`
-            + `健康检查：在 Web 会话中调用 assistant_health。\n`);
-    }
 }
 if (process.argv[1] !== undefined && isMainEntry(import.meta.url, process.argv[1])) {
     void runLarkSetup().catch(error => {