@dsh-enhanced/lark-channel 0.1.47 → 0.1.49

package/lib/setup.js

@@ -15,6 +15,9 @@ import { createOfficialLarkTransport } from './sdk.js';
 import { installDshResidentService } from './resident.js';
 import { prepareDshSystemdUserService } from './systemd.js';
 import { configureLarkProfilePatch, refreshLarkAgentPolicyPatch } from './setup-profile.js';
+import { ensureLarkBusinessCli } from './business-cli-install.js';
+import { setupLarkBusinessTools } from './setup-business.js';
+import { reconcileLarkBusinessSkill } from './business-skill.js';
 import { assertRawManagedProfileIntegrity, materializeManagedProfileOverride, } from './setup-materialization.js';
 const setupKeyPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
 const keychainLocatorPattern = /^[A-Za-z0-9][A-Za-z0-9/._-]{0,255}$/u;
@@ -33,13 +36,14 @@ export function parseLarkSetupArgs(argv) {
         tenant: 'personal',
         createApp: false,
         calendarReadonly: false,
+        businessTools: true,
         appName: 'DSH Personal Assistant',
         timeoutMs: 300_000,
         installServiceOnly: false,
         refreshAgentPolicy: false,
         manageService: true,
         linuxCredentialProvider: 'auto',
-        agentTools: 'preserve',
+        agentTools: 'auto',
         help: false,
     };
     for (let index = 0; index < argv.length; index += 1) {
@@ -66,6 +70,8 @@ export function parseLarkSetupArgs(argv) {
             result.createApp = true;
         else if (option === '--calendar-readonly')
             result.calendarReadonly = true;
+        else if (option === '--no-business-tools')
+            result.businessTools = false;
         else if (option === '--install-service')
             result.installServiceOnly = true;
         else if (option === '--refresh-agent-policy')
@@ -75,11 +81,11 @@ export function parseLarkSetupArgs(argv) {
         else if (option === '--linux-credential-provider') {
             result.linuxCredentialProvider = argumentValue(argv, index++, option);
         }
-        else if (option === '--allow-agent-tools' || option === '--disable-agent-tools') {
-            if (result.agentTools !== 'preserve') {
-                throw new Error('lark-channel setup: --allow-agent-tools and --disable-agent-tools are mutually exclusive');
+        else if (option === '--allow-agent-tools' || option === '--disable-agent-tools' || option === '--preserve-agent-tools') {
+            if (result.agentTools !== 'auto') {
+                throw new Error('lark-channel setup: --allow-agent-tools, --disable-agent-tools and --preserve-agent-tools are mutually exclusive');
             }
-            result.agentTools = option === '--allow-agent-tools' ? 'enable' : 'disable';
+            result.agentTools = option === '--allow-agent-tools' ? 'enable' : option === '--disable-agent-tools' ? 'disable' : 'preserve';
         }
         else if (option === '--app-name')
             result.appName = argumentValue(argv, index++, option);
@@ -100,12 +106,12 @@ export function parseLarkSetupArgs(argv) {
     if (!result.help && result.refreshAgentPolicy) {
         const incompatible = [
             '--domain', '--tenant', '--app-id', '--create-app', '--install-service',
-            '--no-service', '--linux-credential-provider', '--app-name', '--timeout-ms',
+            '--no-service', '--linux-credential-provider', '--app-name', '--timeout-ms', '--no-business-tools',
         ].find(option => argv.includes(option));
         if (incompatible !== undefined) {
             throw new Error(`lark-channel setup: --refresh-agent-policy cannot be combined with ${incompatible}`);
         }
-        if (result.agentTools === 'preserve') {
+        if (result.agentTools !== 'enable' && result.agentTools !== 'disable') {
             throw new Error('lark-channel setup: --refresh-agent-policy requires --allow-agent-tools or --disable-agent-tools');
         }
     }
@@ -118,10 +124,13 @@ export function parseLarkSetupArgs(argv) {
     if (result.installServiceOnly && (result.createApp || result.appId !== undefined)) {
         throw new Error('lark-channel setup: --install-service cannot be combined with application setup options');
     }
+    if (result.installServiceOnly && !result.businessTools) {
+        throw new Error('lark-channel setup: --install-service cannot be combined with --no-business-tools');
+    }
     if (result.installServiceOnly && argv.includes('--linux-credential-provider')) {
         throw new Error('lark-channel setup: --install-service cannot be combined with --linux-credential-provider');
     }
-    if (result.installServiceOnly && result.agentTools !== 'preserve') {
+    if (result.installServiceOnly && result.agentTools !== 'auto') {
         throw new Error('lark-channel setup: --install-service cannot be combined with agent-tools options');
     }
     const appNameHasControlCharacter = [...result.appName]
@@ -151,7 +160,7 @@ export function createLarkRegistrationOptions(input) {
             desc: '由 DeepSeek Harness 驱动的个人助理',
         },
         addons: {
-            preset: false,
+            preset: input.businessTools !== false,
             scopes: { tenant: [
                     'application:bot.basic_info:read',
                     'im:message.group_at_msg:readonly',
@@ -289,10 +298,13 @@ Options:
   --install-service       Only install/restart the profile's resident service
   --refresh-agent-policy  Only refresh policy from the existing channel binding
   --no-service            Configure Lark without installing a resident service
+  --no-business-tools     Only configure the message channel; skip business CLI and user authorization
   --linux-credential-provider <mode>
                           auto, protected-file, or secret-service (default: auto)
   --allow-agent-tools     Allow mounted foreground/external Agent capabilities
   --disable-agent-tools   Remove setup-managed Agent capability rules
+  --preserve-agent-tools  Preserve existing rules, including on first setup
+                          Default: allow for a new owner, preserve on reconfiguration
   --timeout-ms <ms>      Owner DM wait, 30000..900000 (default: 300000)
   -h, --help             Show this help
 
@@ -1146,6 +1158,7 @@ async function registerLarkApplication(args) {
             appName: args.appName,
             ...(args.appId === undefined ? {} : { appId: args.appId }),
             ...(args.calendarReadonly ? { calendarReadonly: true } : {}),
+            businessTools: args.businessTools,
             signal: abortController.signal,
             onQRCodeReady(info) {
                 process.stdout.write(`\n请在飞书中打开以下链接，选择已有应用或创建新应用（${info.expireIn} 秒内有效）：\n${info.url}\n\n`);
@@ -1881,6 +1894,40 @@ function effectiveProfileHasEnabledLarkChannel(effectiveProfile, profile) {
         throw new Error(`lark-channel setup: profile ${profile} has an invalid Lark config`);
     return config.get('enabled') !== false;
 }
+function effectiveDeliveryConsumerDatabasePaths(effectiveProfile, dshHome, profile) {
+    const document = parseDocument(effectiveProfile, { uniqueKeys: true });
+    if (document.errors.length > 0 || !isSeq(document.contents)) {
+        throw new Error(`lark-channel setup: cannot verify effective Delivery consumers in profile ${profile}`);
+    }
+    const paths = [];
+    for (const row of document.contents.items) {
+        if (!isMap(row))
+            continue;
+        const id = row.get('id');
+        const name = row.get('name');
+        if (id !== 'dsh-enhanced-assistant-delivery' && name !== '@dsh-enhanced/assistant-delivery')
+            continue;
+        if (!setupRowIsEnabled(row))
+            continue;
+        if (name !== '@dsh-enhanced/assistant-delivery') {
+            throw new Error(`lark-channel setup: profile ${profile} has an invalid effective Delivery package row`);
+        }
+        const config = row.get('config', true);
+        if (!isMap(config))
+            throw new Error(`lark-channel setup: profile ${profile} has an invalid Delivery config`);
+        const schedulerEnabled = config.get('schedulerEnabled');
+        if (schedulerEnabled !== undefined && typeof schedulerEnabled !== 'boolean') {
+            throw new Error(`lark-channel setup: profile ${profile} has a non-boolean Delivery schedulerEnabled value`);
+        }
+        // Delivery defaults to starting its scheduler independently of the Lark
+        // adapter. A stopped service may restart later; configuration alone only
+        // proves that it cannot consume when the scheduler is explicitly disabled.
+        if (schedulerEnabled === false)
+            continue;
+        paths.push(dshEffectiveDataPath(config.get('databasePath'), dshHome, 'assistant-delivery databasePath'));
+    }
+    return paths;
+}
 function externalPrincipalKeyId(principal) {
     return [principal.channel, principal.account, principal.tenant, principal.user]
         .map(component => encodeURIComponent(component))
@@ -2181,7 +2228,7 @@ function assertEffectiveLarkOwnerBinding(input) {
         throw new Error(`lark-channel setup: effective Lark binding no longer represents the ${suffix}`);
     }
 }
-async function assertNoOtherLarkProfileSharesDelivery(input) {
+async function assertNoOtherProfileSharesDelivery(input) {
     let entries;
     try {
         entries = await readdir(platformJoin(input.dshHome, 'profiles'), { withFileTypes: true });
@@ -2198,7 +2245,7 @@ async function assertNoOtherLarkProfileSharesDelivery(input) {
             || !setupKeyPattern.test(entry.name))
             continue;
         const patchPath = platformJoin(input.dshHome, 'profiles', entry.name, 'cordis.patch.yml');
-        // A profile can inherit Lark entirely from a lower bundle while its raw
+        // A profile can inherit Delivery or Lark from a lower bundle while its raw
         // override contains no channel row. Activation and database identity must
         // therefore come from effective config whenever that profile composes.
         try {
@@ -2214,21 +2261,24 @@ async function assertNoOtherLarkProfileSharesDelivery(input) {
             effective = await input.readEffectiveProfile(entry.name);
         }
         catch (error) {
-            // Raw absence cannot prove absence: Lark may be inherited from a lower
+            // Raw absence cannot prove absence: consumers may be inherited from a lower
             // bundle and a resident using the last valid composition may still run.
             // Without a durable ownership registry, an unverifiable real profile is
             // therefore a fail-closed handoff boundary.
-            throw new Error(`lark-channel setup: cannot verify effective Lark ownership in profile ${entry.name}`, {
+            throw new Error(`lark-channel setup: cannot verify effective Lark ownership in profile ${entry.name} or its Delivery consumers`, {
                 cause: error,
             });
         }
-        if (!effectiveProfileHasEnabledLarkChannel(effective, entry.name))
-            continue;
-        const otherDatabasePath = deliveryDatabasePathFromEffectiveProfile(effective, input.dshHome);
-        if (normalizeSetupResourcePath(otherDatabasePath) === databasePath) {
+        if (effectiveProfileHasEnabledLarkChannel(effective, entry.name)
+            && normalizeSetupResourcePath(deliveryDatabasePathFromEffectiveProfile(effective, input.dshHome)) === databasePath) {
             throw new Error(`lark-channel setup: profile ${entry.name} already owns Lark for the same assistant-delivery database; `
                 + 'refusing to revoke its owner from another profile');
         }
+        if (effectiveDeliveryConsumerDatabasePaths(effective, input.dshHome, entry.name)
+            .some(path => normalizeSetupResourcePath(path) === databasePath)) {
+            throw new Error(`lark-channel setup: profile ${entry.name} has an enabled assistant-delivery scheduler for the same database; `
+                + 'disable its scheduler or configure a separate database before continuing');
+        }
     }
 }
 async function withDeliveryOwnerSetupLock(databasePath, operation, options = {}) {
@@ -2406,7 +2456,7 @@ async function recoverLarkSetupJournalUnlocked(input) {
             stagedCredential: journal.stagedCredential,
             context: 'journal',
         });
-        await assertNoOtherLarkProfileSharesDelivery({
+        await assertNoOtherProfileSharesDelivery({
             dshHome: input.dshHome,
             profile: input.profile,
             databasePath,
@@ -2588,7 +2638,7 @@ export async function executeLarkSetupProfileTransaction(input) {
             effectiveProfile,
         });
         await withDeliveryOwnerSetupLock(databasePath, async () => {
-            await assertNoOtherLarkProfileSharesDelivery({
+            await assertNoOtherProfileSharesDelivery({
                 dshHome: input.dshHome,
                 profile: input.args.profile,
                 databasePath,
@@ -2824,7 +2874,7 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                 const effectiveProfile = await readEffectiveProfile(args.profile);
                 const databasePath = deliveryDatabasePathFromEffectiveProfile(effectiveProfile, dshHome);
                 await withDeliveryOwnerSetupLock(databasePath, async () => {
-                    await assertNoOtherLarkProfileSharesDelivery({
+                    await assertNoOtherProfileSharesDelivery({
                         dshHome,
                         profile: args.profile,
                         databasePath,
@@ -2911,7 +2961,7 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                 });
                 const databasePath = deliveryDatabasePathFromEffectiveProfile(await readEffectiveProfile(args.profile), dshHome);
                 return withDeliveryOwnerSetupLock(databasePath, async () => {
-                    await assertNoOtherLarkProfileSharesDelivery({
+                    await assertNoOtherProfileSharesDelivery({
                         dshHome,
                         profile: args.profile,
                         databasePath,
@@ -2971,7 +3021,7 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
             });
             const databasePath = deliveryDatabasePathFromEffectiveProfile(await readEffectiveProfile(args.profile), dshHome);
             await withDeliveryOwnerSetupLock(databasePath, async () => {
-                await assertNoOtherLarkProfileSharesDelivery({
+                await assertNoOtherProfileSharesDelivery({
                     dshHome,
                     profile: args.profile,
                     databasePath,
@@ -2979,6 +3029,9 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                 });
             }, runtime.profileLockOptions);
         }, runtime.profileLockOptions);
+        const businessCli = args.businessTools
+            ? await (runtime.ensureBusinessCli ?? ensureLarkBusinessCli)({ dshHome })
+            : undefined;
         let appId = args.appId;
         let createApp = args.createApp;
         if (appId === undefined && !createApp) {
@@ -2995,9 +3048,9 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
         let generatedSecret;
         if (createApp) {
             process.stdout.write(args.appId === undefined
-                ? '\n将通过飞书官方设备授权选择已有应用或创建新应用，并增量申请最小权限。App Secret 不会显示或写入 profile。\n'
-                : `\n将通过飞书官方设备授权更新已有应用 ${args.appId}，并增量申请最小权限。App Secret 不会显示或写入 profile。\n`);
-            const registration = await registerLarkApplication(args);
+                ? '\n将通过飞书官方设备授权选择已有应用或创建新应用，并增量申请应用权限。App Secret 不会显示或写入 profile。\n'
+                : `\n将通过飞书官方设备授权更新已有应用 ${args.appId}，并增量申请应用权限。App Secret 不会显示或写入 profile。\n`);
+            const registration = await (runtime.registerApplication ?? registerLarkApplication)(args);
             appId = registration.client_id;
             resolvedDomain = registration.user_info?.tenant_brand ?? resolvedDomain;
             generatedSecret = registration.client_secret;
@@ -3014,6 +3067,7 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
             throw new Error('lark-channel setup: Feishu did not return an App ID');
         const configuredAppId = appId;
         let installedService;
+        let businessBinding;
         await executeLarkSetupProfileTransaction({
             args,
             dshHome,
@@ -3049,17 +3103,38 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                         : undefined);
                 },
                 readEffectiveProfile,
+                validateProfile: validate,
+                ...runtime.ownerSetupOperations,
                 async discoverOwner(ownerInput) {
-                    const phrase = `DSH-CONNECT-${randomBytes(4).toString('hex').toUpperCase()}`;
-                    const transport = createOfficialLarkTransport({
-                        appId: ownerInput.appId,
-                        appSecret: ownerInput.appSecret,
-                        domain: ownerInput.domain,
-                        handshakeTimeoutMs: 15_000,
-                        requestTimeoutMs: 30_000,
-                        imageDownloadTimeoutMs: 30_000,
+                    let owner;
+                    if (runtime.discoverOwner !== undefined)
+                        owner = await runtime.discoverOwner(ownerInput);
+                    else {
+                        const phrase = `DSH-CONNECT-${randomBytes(4).toString('hex').toUpperCase()}`;
+                        const transport = createOfficialLarkTransport({
+                            appId: ownerInput.appId,
+                            appSecret: ownerInput.appSecret,
+                            domain: ownerInput.domain,
+                            handshakeTimeoutMs: 15_000,
+                            requestTimeoutMs: 30_000,
+                            imageDownloadTimeoutMs: 30_000,
+                        });
+                        owner = await discoverOwner(transport, phrase, ownerInput.account, ownerInput.tenant, ownerInput.timeoutMs);
+                    }
+                    if (args.businessTools)
+                        businessBinding = { appSecret: ownerInput.appSecret, owner };
+                    const previousDocument = parseDocument(await readEffectiveProfile(args.profile), { uniqueKeys: true });
+                    const previousRow = isSeq(previousDocument.contents)
+                        ? previousDocument.contents.items.find(item => isMap(item) && item.get('id') === 'dsh-enhanced-lark-channel')
+                        : undefined;
+                    const previousConfig = isMap(previousRow) ? previousRow.get('config', true) : undefined;
+                    const previousAccount = isMap(previousConfig) ? previousConfig.get('account') : undefined;
+                    await reconcileLarkBusinessSkill({
+                        dshHome, profile: args.profile, account: args.account, appId: ownerInput.appId,
+                        ownerUserId: owner.user, enabled: args.businessTools,
+                        ...(typeof previousAccount === 'string' ? { previousAccount } : {}),
                     });
-                    return discoverOwner(transport, phrase, ownerInput.account, ownerInput.tenant, ownerInput.timeoutMs);
+                    return owner;
                 },
                 ...(args.manageService ? {
                     async afterCommit() {
@@ -3068,6 +3143,35 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                 } : {}),
             },
         });
+        if (businessCli !== undefined) {
+            const binding = businessBinding;
+            if (binding === undefined)
+                throw new Error('lark-channel setup: business tools require the completed owner binding');
+            process.stdout.write('\n消息通道已配置；正在接入飞书业务工具并检查 owner 用户授权。\n');
+            const business = await (runtime.setupBusinessTools ?? setupLarkBusinessTools)({
+                dshHome, profile: args.profile, account: args.account, appId: configuredAppId,
+                appSecret: binding.appSecret, domain: resolvedDomain, ownerUserId: binding.owner.user,
+                cli: businessCli, timeoutMs: args.timeoutMs,
+                async onAuthorization(url) {
+                    process.stdout.write(`\n请用刚才绑定的飞书账号完成业务权限授权：\n${url}\n\n`);
+                    try {
+                        process.stdout.write(`${await QRCode.toString(url, { type: 'terminal', small: true })}\n`);
+                    }
+                    catch {
+                        process.stdout.write('终端二维码生成失败，请打开上面的链接。\n');
+                    }
+                },
+            });
+            businessBinding = undefined;
+            process.stdout.write(`飞书业务工具已接入${business.reusedAuthorization ? '，复用已有 owner 授权' : ''}。技能：${business.skillPath}\n`);
+            if (business.permissionCompletion === 'partial') {
+                process.stdout.write(`用户登录已完成；本次申请仍有 ${business.missingScopes.length} 项权限未获批，业务工具仅使用实际已授予的权限。\n`
+                    + `未获批权限：${business.missingScopes.join(', ')}\n`);
+            }
+            else if (business.permissionCompletion === 'unknown') {
+                process.stdout.write('已验证 owner 登录；当前授权证据不足以确认完整权限清单，具体操作仍以平台当前授权为准。\n');
+            }
+        }
         if (args.manageService) {
             const service = installedService;
             if (service === undefined)