@dsh-enhanced/lark-channel 0.1.48 → 0.1.53

package/lib/setup.js

@@ -1,11 +1,20 @@
 #!/usr/bin/env node
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
 import { createHash, randomBytes } from 'node:crypto';
 import { accessSync, constants, realpathSync } from 'node:fs';
 import { chmod, lstat, mkdir, open, readFile, readdir, rename, rm, unlink } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { basename, dirname, isAbsolute, join, normalize, win32 } from 'node:path';
+import { createRequire } from 'node:module';
+import { basename, delimiter, dirname, isAbsolute, join, normalize, win32 } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { createInterface } from 'node:readline/promises';
 import { spawnSync } from 'node:child_process';
 import { registerApp } from '@larksuiteoapi/node-sdk';
@@ -15,6 +24,9 @@ import { createOfficialLarkTransport } from './sdk.js';
 import { installDshResidentService } from './resident.js';
 import { prepareDshSystemdUserService } from './systemd.js';
 import { configureLarkProfilePatch, refreshLarkAgentPolicyPatch } from './setup-profile.js';
+import { ensureLarkBusinessCli } from './business-cli-install.js';
+import { setupLarkBusinessTools } from './setup-business.js';
+import { reconcileLarkBusinessSkill } from './business-skill.js';
 import { assertRawManagedProfileIntegrity, materializeManagedProfileOverride, } from './setup-materialization.js';
 const setupKeyPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
 const keychainLocatorPattern = /^[A-Za-z0-9][A-Za-z0-9/._-]{0,255}$/u;
@@ -33,13 +45,14 @@ export function parseLarkSetupArgs(argv) {
         tenant: 'personal',
         createApp: false,
         calendarReadonly: false,
+        businessTools: true,
         appName: 'DSH Personal Assistant',
         timeoutMs: 300_000,
         installServiceOnly: false,
         refreshAgentPolicy: false,
         manageService: true,
         linuxCredentialProvider: 'auto',
-        agentTools: 'preserve',
+        agentTools: 'auto',
         help: false,
     };
     for (let index = 0; index < argv.length; index += 1) {
@@ -66,6 +79,8 @@ export function parseLarkSetupArgs(argv) {
             result.createApp = true;
         else if (option === '--calendar-readonly')
             result.calendarReadonly = true;
+        else if (option === '--no-business-tools')
+            result.businessTools = false;
         else if (option === '--install-service')
             result.installServiceOnly = true;
         else if (option === '--refresh-agent-policy')
@@ -75,11 +90,11 @@ export function parseLarkSetupArgs(argv) {
         else if (option === '--linux-credential-provider') {
             result.linuxCredentialProvider = argumentValue(argv, index++, option);
         }
-        else if (option === '--allow-agent-tools' || option === '--disable-agent-tools') {
-            if (result.agentTools !== 'preserve') {
-                throw new Error('lark-channel setup: --allow-agent-tools and --disable-agent-tools are mutually exclusive');
+        else if (option === '--allow-agent-tools' || option === '--disable-agent-tools' || option === '--preserve-agent-tools') {
+            if (result.agentTools !== 'auto') {
+                throw new Error('lark-channel setup: --allow-agent-tools, --disable-agent-tools and --preserve-agent-tools are mutually exclusive');
             }
-            result.agentTools = option === '--allow-agent-tools' ? 'enable' : 'disable';
+            result.agentTools = option === '--allow-agent-tools' ? 'enable' : option === '--disable-agent-tools' ? 'disable' : 'preserve';
         }
         else if (option === '--app-name')
             result.appName = argumentValue(argv, index++, option);
@@ -100,12 +115,12 @@ export function parseLarkSetupArgs(argv) {
     if (!result.help && result.refreshAgentPolicy) {
         const incompatible = [
             '--domain', '--tenant', '--app-id', '--create-app', '--install-service',
-            '--no-service', '--linux-credential-provider', '--app-name', '--timeout-ms',
+            '--no-service', '--linux-credential-provider', '--app-name', '--timeout-ms', '--no-business-tools',
         ].find(option => argv.includes(option));
         if (incompatible !== undefined) {
             throw new Error(`lark-channel setup: --refresh-agent-policy cannot be combined with ${incompatible}`);
         }
-        if (result.agentTools === 'preserve') {
+        if (result.agentTools !== 'enable' && result.agentTools !== 'disable') {
             throw new Error('lark-channel setup: --refresh-agent-policy requires --allow-agent-tools or --disable-agent-tools');
         }
     }
@@ -118,10 +133,13 @@ export function parseLarkSetupArgs(argv) {
     if (result.installServiceOnly && (result.createApp || result.appId !== undefined)) {
         throw new Error('lark-channel setup: --install-service cannot be combined with application setup options');
     }
+    if (result.installServiceOnly && !result.businessTools) {
+        throw new Error('lark-channel setup: --install-service cannot be combined with --no-business-tools');
+    }
     if (result.installServiceOnly && argv.includes('--linux-credential-provider')) {
         throw new Error('lark-channel setup: --install-service cannot be combined with --linux-credential-provider');
     }
-    if (result.installServiceOnly && result.agentTools !== 'preserve') {
+    if (result.installServiceOnly && result.agentTools !== 'auto') {
         throw new Error('lark-channel setup: --install-service cannot be combined with agent-tools options');
     }
     const appNameHasControlCharacter = [...result.appName]
@@ -151,7 +169,7 @@ export function createLarkRegistrationOptions(input) {
             desc: '由 DeepSeek Harness 驱动的个人助理',
         },
         addons: {
-            preset: false,
+            preset: input.businessTools !== false,
             scopes: { tenant: [
                     'application:bot.basic_info:read',
                     'im:message.group_at_msg:readonly',
@@ -289,10 +307,13 @@ Options:
   --install-service       Only install/restart the profile's resident service
   --refresh-agent-policy  Only refresh policy from the existing channel binding
   --no-service            Configure Lark without installing a resident service
+  --no-business-tools     Only configure the message channel; skip business CLI and user authorization
   --linux-credential-provider <mode>
                           auto, protected-file, or secret-service (default: auto)
   --allow-agent-tools     Allow mounted foreground/external Agent capabilities
   --disable-agent-tools   Remove setup-managed Agent capability rules
+  --preserve-agent-tools  Preserve existing rules, including on first setup
+                          Default: allow for a new owner, preserve on reconfiguration
   --timeout-ms <ms>      Owner DM wait, 30000..900000 (default: 300000)
   -h, --help             Show this help
 
@@ -1146,6 +1167,7 @@ async function registerLarkApplication(args) {
             appName: args.appName,
             ...(args.appId === undefined ? {} : { appId: args.appId }),
             ...(args.calendarReadonly ? { calendarReadonly: true } : {}),
+            businessTools: args.businessTools,
             signal: abortController.signal,
             onQRCodeReady(info) {
                 process.stdout.write(`\n请在飞书中打开以下链接，选择已有应用或创建新应用（${info.expireIn} 秒内有效）：\n${info.url}\n\n`);
@@ -1210,7 +1232,7 @@ export function dshHomeLifecycleRendezvousPath(dshHome, uid = process.getuid?.()
     if (!isAbsolute(dshHome))
         throw new Error('lark-channel setup: DSH_HOME must be absolute');
     if (!Number.isSafeInteger(uid) || uid === undefined || uid < 0) {
-        throw new Error('lark-channel setup: cannot determine the Linux user id for lifecycle locking');
+        throw new Error('lark-channel setup: cannot determine the user id for lifecycle locking');
     }
     const canonicalHome = normalizeSetupResourcePath(dshHome);
     return `/tmp/.dsh-enhanced-lifecycle-${uid}-${textSha256(canonicalHome)}.lock`;
@@ -1226,13 +1248,15 @@ async function assertDshHomeLifecycleLockIdentity(descriptor, lockPath, uid) {
     }
 }
 export async function withDshHomeLifecycleLock(dshHome, operation) {
-    if (process.platform !== 'linux')
+    if (process.platform !== 'linux' && process.platform !== 'darwin')
         return operation();
     const uid = process.getuid?.();
     if (!Number.isSafeInteger(uid) || uid === undefined || uid < 0) {
-        throw new Error('lark-channel setup: cannot determine the Linux user id for lifecycle locking');
+        throw new Error('lark-channel setup: cannot determine the user id for lifecycle locking');
     }
-    const temporaryDirectory = await lstat('/tmp');
+    // macOS /tmp is a system symlink to /private/tmp. Validate the physical
+    // sticky directory while retaining the shared rendezvous pathname.
+    const temporaryDirectory = await lstat(process.platform === 'darwin' ? realpathSync('/tmp') : '/tmp');
     if (!temporaryDirectory.isDirectory() || temporaryDirectory.isSymbolicLink()
         || temporaryDirectory.uid !== 0 || (temporaryDirectory.mode & 0o7777) !== 0o1777) {
         throw new Error('lark-channel setup: lifecycle rendezvous lock requires a safe root-owned sticky /tmp');
@@ -1242,9 +1266,16 @@ export async function withDshHomeLifecycleLock(dshHome, operation) {
     try {
         descriptor = await open(lockPath, constants.O_RDWR | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
         await assertDshHomeLifecycleLockIdentity(descriptor, lockPath, uid);
-        const acquired = spawnSync('/usr/bin/flock', ['-n', '-E', '75', '3'], {
+        // Both helpers lock the inherited open file description. The kernel keeps
+        // it locked until this process closes the descriptor, including on crash.
+        const mac = process.platform === 'darwin';
+        const acquired = spawnSync(mac ? '/usr/bin/perl' : '/usr/bin/flock', mac
+            ? ['-MFcntl=:flock', '-MErrno=EAGAIN,EWOULDBLOCK', '-e',
+                'open(F, "<&", 3) or exit 74; flock(F, LOCK_EX|LOCK_NB) or exit(($! == EAGAIN || $! == EWOULDBLOCK) ? 75 : 74);']
+            : ['-n', '-E', '75', '3'], {
             encoding: 'utf8',
             stdio: ['ignore', 'ignore', 'pipe', descriptor.fd],
+            env: { PATH: '/usr/bin:/bin', LANG: 'C' }, timeout: 10_000,
         });
         if (acquired.status === 75)
             throw new Error(`lark-channel setup: DSH_HOME lifecycle is busy: ${lockPath}`);
@@ -1881,6 +1912,40 @@ function effectiveProfileHasEnabledLarkChannel(effectiveProfile, profile) {
         throw new Error(`lark-channel setup: profile ${profile} has an invalid Lark config`);
     return config.get('enabled') !== false;
 }
+function effectiveDeliveryConsumerDatabasePaths(effectiveProfile, dshHome, profile) {
+    const document = parseDocument(effectiveProfile, { uniqueKeys: true });
+    if (document.errors.length > 0 || !isSeq(document.contents)) {
+        throw new Error(`lark-channel setup: cannot verify effective Delivery consumers in profile ${profile}`);
+    }
+    const paths = [];
+    for (const row of document.contents.items) {
+        if (!isMap(row))
+            continue;
+        const id = row.get('id');
+        const name = row.get('name');
+        if (id !== 'dsh-enhanced-assistant-delivery' && name !== '@dsh-enhanced/assistant-delivery')
+            continue;
+        if (!setupRowIsEnabled(row))
+            continue;
+        if (name !== '@dsh-enhanced/assistant-delivery') {
+            throw new Error(`lark-channel setup: profile ${profile} has an invalid effective Delivery package row`);
+        }
+        const config = row.get('config', true);
+        if (!isMap(config))
+            throw new Error(`lark-channel setup: profile ${profile} has an invalid Delivery config`);
+        const schedulerEnabled = config.get('schedulerEnabled');
+        if (schedulerEnabled !== undefined && typeof schedulerEnabled !== 'boolean') {
+            throw new Error(`lark-channel setup: profile ${profile} has a non-boolean Delivery schedulerEnabled value`);
+        }
+        // Delivery defaults to starting its scheduler independently of the Lark
+        // adapter. A stopped service may restart later; configuration alone only
+        // proves that it cannot consume when the scheduler is explicitly disabled.
+        if (schedulerEnabled === false)
+            continue;
+        paths.push(dshEffectiveDataPath(config.get('databasePath'), dshHome, 'assistant-delivery databasePath'));
+    }
+    return paths;
+}
 function externalPrincipalKeyId(principal) {
     return [principal.channel, principal.account, principal.tenant, principal.user]
         .map(component => encodeURIComponent(component))
@@ -2181,7 +2246,7 @@ function assertEffectiveLarkOwnerBinding(input) {
         throw new Error(`lark-channel setup: effective Lark binding no longer represents the ${suffix}`);
     }
 }
-async function assertNoOtherLarkProfileSharesDelivery(input) {
+async function assertNoOtherProfileSharesDelivery(input) {
     let entries;
     try {
         entries = await readdir(platformJoin(input.dshHome, 'profiles'), { withFileTypes: true });
@@ -2198,38 +2263,136 @@ async function assertNoOtherLarkProfileSharesDelivery(input) {
             || !setupKeyPattern.test(entry.name))
             continue;
         const patchPath = platformJoin(input.dshHome, 'profiles', entry.name, 'cordis.patch.yml');
-        // A profile can inherit Lark entirely from a lower bundle while its raw
+        // A profile can inherit Delivery or Lark from a lower bundle while its raw
         // override contains no channel row. Activation and database identity must
         // therefore come from effective config whenever that profile composes.
         try {
             await readFile(patchPath, 'utf8');
         }
         catch (error) {
-            if (fileSystemErrorCode(error) === 'ENOENT')
+            // Electron can have a bundle-backed desktop profile before its optional
+            // user patch exists. Its bundles may still own Lark or consume Delivery.
+            if (fileSystemErrorCode(error) === 'ENOENT' && entry.name !== 'desktop')
                 continue;
-            throw error;
+            if (fileSystemErrorCode(error) === 'ENOENT') {
+                // Continue into the read-only Desktop composition below.
+            }
+            else {
+                throw error;
+            }
         }
         let effective;
         try {
             effective = await input.readEffectiveProfile(entry.name);
         }
         catch (error) {
-            // Raw absence cannot prove absence: Lark may be inherited from a lower
-            // bundle and a resident using the last valid composition may still run.
-            // Without a durable ownership registry, an unverifiable real profile is
-            // therefore a fail-closed handoff boundary.
-            throw new Error(`lark-channel setup: cannot verify effective Lark ownership in profile ${entry.name}`, {
-                cause: error,
-            });
+            if (entry.name === 'desktop'
+                && error instanceof Error
+                && error.message.includes('profile "desktop" is managed exclusively by the Electron application')) {
+                try {
+                    effective = await readElectronDesktopEffectiveProfile(input.dshHome);
+                }
+                catch (compositionError) {
+                    throw new Error(`lark-channel setup: cannot verify effective Lark ownership in profile desktop or its Delivery consumers`, {
+                        cause: compositionError,
+                    });
+                }
+            }
+            else {
+                // Raw absence cannot prove absence: consumers may be inherited from a lower
+                // bundle and a resident using the last valid composition may still run.
+                // Without a durable ownership registry, an unverifiable real profile is
+                // therefore a fail-closed handoff boundary.
+                throw new Error(`lark-channel setup: cannot verify effective Lark ownership in profile ${entry.name} or its Delivery consumers`, {
+                    cause: error,
+                });
+            }
         }
-        if (!effectiveProfileHasEnabledLarkChannel(effective, entry.name))
-            continue;
-        const otherDatabasePath = deliveryDatabasePathFromEffectiveProfile(effective, input.dshHome);
-        if (normalizeSetupResourcePath(otherDatabasePath) === databasePath) {
+        if (effectiveProfileHasEnabledLarkChannel(effective, entry.name)
+            && normalizeSetupResourcePath(deliveryDatabasePathFromEffectiveProfile(effective, input.dshHome)) === databasePath) {
             throw new Error(`lark-channel setup: profile ${entry.name} already owns Lark for the same assistant-delivery database; `
                 + 'refusing to revoke its owner from another profile');
         }
+        if (effectiveDeliveryConsumerDatabasePaths(effective, input.dshHome, entry.name)
+            .some(path => normalizeSetupResourcePath(path) === databasePath)) {
+            throw new Error(`lark-channel setup: profile ${entry.name} has an enabled assistant-delivery scheduler for the same database; `
+                + 'disable its scheduler or configure a separate database before continuing');
+        }
+    }
+}
+/** Electron owns `desktop`, so the DSH CLI refuses even a config dump. Compose
+ * its existing project with the same app-boot reader as Electron, without
+ * running the CLI or preparing (and writing to) that profile. */
+async function readElectronDesktopEffectiveProfile(dshHome) {
+    const profileDir = platformJoin(dshHome, 'profiles', 'desktop');
+    // The Electron Host resolves core bundles from its private runtime, not the
+    // plugin project. The setup process already uses `dsh` on PATH for ordinary
+    // config dumps, so anchor this exceptional read to that same installation.
+    const dshManifest = await resolveSetupDshManifest();
+    const bootEntry = createRequire(dshManifest).resolve('@deepseek-ai/dsh-app-boot');
+    const boot = await import(__rewriteRelativeImportExtension(pathToFileURL(bootEntry).href));
+    const loaded = boot.loadProfileDirectory('dsh desktop', profileDir, dshManifest);
+    if (loaded.skippedBundles.length > 0) {
+        throw new Error(`desktop profile has unreadable bundles: ${loaded.skippedBundles.map(item => item.packageName).join(', ')}`);
+    }
+    const layers = loaded.layers.map(layer => ({ label: layer.packageName, patches: layer.patches }));
+    layers.push({ label: loaded.patchPath, patches: loaded.patches });
+    const homePatchPath = platformJoin(dshHome, 'cordis.patch.yml');
+    const homePatches = boot.loadOptionalPatches('dsh desktop', homePatchPath);
+    if (homePatches !== undefined)
+        layers.push({ label: homePatchPath, patches: homePatches });
+    return boot.renderConfigDump('dsh desktop', platformJoin(profileDir, 'cordis.yml'), layers);
+}
+async function resolveSetupDshManifest() {
+    const selectedVersion = spawnSync('dsh', ['--version'], {
+        encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+    });
+    if (selectedVersion.status !== 0 || typeof selectedVersion.stdout !== 'string') {
+        throw new Error('cannot verify the selected dsh CLI version');
+    }
+    const version = selectedVersion.stdout.trim();
+    if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(version)) {
+        throw new Error('selected dsh CLI returned an invalid version');
     }
+    for (const directory of (process.env.PATH ?? '').split(delimiter)) {
+        if (directory === '')
+            continue;
+        const executable = platformJoin(directory, 'dsh');
+        try {
+            accessSync(executable, constants.X_OK);
+        }
+        catch {
+            continue;
+        }
+        const canonical = realpathSync(executable);
+        const candidates = [];
+        try {
+            candidates.push(createRequire(canonical).resolve('@deepseek-ai/dsh/package.json'));
+        }
+        catch {
+            // Electron's public `dsh` command is a shell launcher; it has no Node
+            // package at this path. Search later PATH entries for a matching npm CLI.
+        }
+        for (let ancestor = dirname(canonical);;) {
+            candidates.push(platformJoin(ancestor, 'package.json'));
+            const parent = dirname(ancestor);
+            if (parent === ancestor)
+                break;
+            ancestor = parent;
+        }
+        for (const manifest of candidates) {
+            let packageJson;
+            try {
+                packageJson = JSON.parse(await readFile(manifest, 'utf8'));
+            }
+            catch {
+                continue;
+            }
+            if (packageJson.name === '@deepseek-ai/dsh' && packageJson.version === version)
+                return manifest;
+        }
+    }
+    throw new Error('no npm dsh installation on PATH matches the selected CLI version');
 }
 async function withDeliveryOwnerSetupLock(databasePath, operation, options = {}) {
     const resourcePath = normalizeSetupResourcePath(databasePath);
@@ -2406,7 +2569,7 @@ async function recoverLarkSetupJournalUnlocked(input) {
             stagedCredential: journal.stagedCredential,
             context: 'journal',
         });
-        await assertNoOtherLarkProfileSharesDelivery({
+        await assertNoOtherProfileSharesDelivery({
             dshHome: input.dshHome,
             profile: input.profile,
             databasePath,
@@ -2588,7 +2751,7 @@ export async function executeLarkSetupProfileTransaction(input) {
             effectiveProfile,
         });
         await withDeliveryOwnerSetupLock(databasePath, async () => {
-            await assertNoOtherLarkProfileSharesDelivery({
+            await assertNoOtherProfileSharesDelivery({
                 dshHome: input.dshHome,
                 profile: input.args.profile,
                 databasePath,
@@ -2824,7 +2987,7 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                 const effectiveProfile = await readEffectiveProfile(args.profile);
                 const databasePath = deliveryDatabasePathFromEffectiveProfile(effectiveProfile, dshHome);
                 await withDeliveryOwnerSetupLock(databasePath, async () => {
-                    await assertNoOtherLarkProfileSharesDelivery({
+                    await assertNoOtherProfileSharesDelivery({
                         dshHome,
                         profile: args.profile,
                         databasePath,
@@ -2911,7 +3074,7 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                 });
                 const databasePath = deliveryDatabasePathFromEffectiveProfile(await readEffectiveProfile(args.profile), dshHome);
                 return withDeliveryOwnerSetupLock(databasePath, async () => {
-                    await assertNoOtherLarkProfileSharesDelivery({
+                    await assertNoOtherProfileSharesDelivery({
                         dshHome,
                         profile: args.profile,
                         databasePath,
@@ -2971,7 +3134,7 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
             });
             const databasePath = deliveryDatabasePathFromEffectiveProfile(await readEffectiveProfile(args.profile), dshHome);
             await withDeliveryOwnerSetupLock(databasePath, async () => {
-                await assertNoOtherLarkProfileSharesDelivery({
+                await assertNoOtherProfileSharesDelivery({
                     dshHome,
                     profile: args.profile,
                     databasePath,
@@ -2979,6 +3142,9 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                 });
             }, runtime.profileLockOptions);
         }, runtime.profileLockOptions);
+        const businessCli = args.businessTools
+            ? await (runtime.ensureBusinessCli ?? ensureLarkBusinessCli)({ dshHome })
+            : undefined;
         let appId = args.appId;
         let createApp = args.createApp;
         if (appId === undefined && !createApp) {
@@ -2995,9 +3161,9 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
         let generatedSecret;
         if (createApp) {
             process.stdout.write(args.appId === undefined
-                ? '\n将通过飞书官方设备授权选择已有应用或创建新应用，并增量申请最小权限。App Secret 不会显示或写入 profile。\n'
-                : `\n将通过飞书官方设备授权更新已有应用 ${args.appId}，并增量申请最小权限。App Secret 不会显示或写入 profile。\n`);
-            const registration = await registerLarkApplication(args);
+                ? '\n将通过飞书官方设备授权选择已有应用或创建新应用，并增量申请应用权限。App Secret 不会显示或写入 profile。\n'
+                : `\n将通过飞书官方设备授权更新已有应用 ${args.appId}，并增量申请应用权限。App Secret 不会显示或写入 profile。\n`);
+            const registration = await (runtime.registerApplication ?? registerLarkApplication)(args);
             appId = registration.client_id;
             resolvedDomain = registration.user_info?.tenant_brand ?? resolvedDomain;
             generatedSecret = registration.client_secret;
@@ -3014,6 +3180,7 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
             throw new Error('lark-channel setup: Feishu did not return an App ID');
         const configuredAppId = appId;
         let installedService;
+        let businessBinding;
         await executeLarkSetupProfileTransaction({
             args,
             dshHome,
@@ -3049,17 +3216,38 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                         : undefined);
                 },
                 readEffectiveProfile,
+                validateProfile: validate,
+                ...runtime.ownerSetupOperations,
                 async discoverOwner(ownerInput) {
-                    const phrase = `DSH-CONNECT-${randomBytes(4).toString('hex').toUpperCase()}`;
-                    const transport = createOfficialLarkTransport({
-                        appId: ownerInput.appId,
-                        appSecret: ownerInput.appSecret,
-                        domain: ownerInput.domain,
-                        handshakeTimeoutMs: 15_000,
-                        requestTimeoutMs: 30_000,
-                        imageDownloadTimeoutMs: 30_000,
+                    let owner;
+                    if (runtime.discoverOwner !== undefined)
+                        owner = await runtime.discoverOwner(ownerInput);
+                    else {
+                        const phrase = `DSH-CONNECT-${randomBytes(4).toString('hex').toUpperCase()}`;
+                        const transport = createOfficialLarkTransport({
+                            appId: ownerInput.appId,
+                            appSecret: ownerInput.appSecret,
+                            domain: ownerInput.domain,
+                            handshakeTimeoutMs: 15_000,
+                            requestTimeoutMs: 30_000,
+                            imageDownloadTimeoutMs: 30_000,
+                        });
+                        owner = await discoverOwner(transport, phrase, ownerInput.account, ownerInput.tenant, ownerInput.timeoutMs);
+                    }
+                    if (args.businessTools)
+                        businessBinding = { appSecret: ownerInput.appSecret, owner };
+                    const previousDocument = parseDocument(await readEffectiveProfile(args.profile), { uniqueKeys: true });
+                    const previousRow = isSeq(previousDocument.contents)
+                        ? previousDocument.contents.items.find(item => isMap(item) && item.get('id') === 'dsh-enhanced-lark-channel')
+                        : undefined;
+                    const previousConfig = isMap(previousRow) ? previousRow.get('config', true) : undefined;
+                    const previousAccount = isMap(previousConfig) ? previousConfig.get('account') : undefined;
+                    await reconcileLarkBusinessSkill({
+                        dshHome, profile: args.profile, account: args.account, appId: ownerInput.appId,
+                        ownerUserId: owner.user, enabled: args.businessTools,
+                        ...(typeof previousAccount === 'string' ? { previousAccount } : {}),
                     });
-                    return discoverOwner(transport, phrase, ownerInput.account, ownerInput.tenant, ownerInput.timeoutMs);
+                    return owner;
                 },
                 ...(args.manageService ? {
                     async afterCommit() {
@@ -3068,6 +3256,35 @@ export async function runLarkSetup(argv = process.argv.slice(2), runtime = {}) {
                 } : {}),
             },
         });
+        if (businessCli !== undefined) {
+            const binding = businessBinding;
+            if (binding === undefined)
+                throw new Error('lark-channel setup: business tools require the completed owner binding');
+            process.stdout.write('\n消息通道已配置；正在接入飞书业务工具并检查 owner 用户授权。\n');
+            const business = await (runtime.setupBusinessTools ?? setupLarkBusinessTools)({
+                dshHome, profile: args.profile, account: args.account, appId: configuredAppId,
+                appSecret: binding.appSecret, domain: resolvedDomain, ownerUserId: binding.owner.user,
+                cli: businessCli, timeoutMs: args.timeoutMs,
+                async onAuthorization(url) {
+                    process.stdout.write(`\n请用刚才绑定的飞书账号完成业务权限授权：\n${url}\n\n`);
+                    try {
+                        process.stdout.write(`${await QRCode.toString(url, { type: 'terminal', small: true })}\n`);
+                    }
+                    catch {
+                        process.stdout.write('终端二维码生成失败，请打开上面的链接。\n');
+                    }
+                },
+            });
+            businessBinding = undefined;
+            process.stdout.write(`飞书业务工具已接入${business.reusedAuthorization ? '，复用已有 owner 授权' : ''}。技能：${business.skillPath}\n`);
+            if (business.permissionCompletion === 'partial') {
+                process.stdout.write(`用户登录已完成；本次申请仍有 ${business.missingScopes.length} 项权限未获批，业务工具仅使用实际已授予的权限。\n`
+                    + `未获批权限：${business.missingScopes.join(', ')}\n`);
+            }
+            else if (business.permissionCompletion === 'unknown') {
+                process.stdout.write('已验证 owner 登录；当前授权证据不足以确认完整权限清单，具体操作仍以平台当前授权为准。\n');
+            }
+        }
         if (args.manageService) {
             const service = installedService;
             if (service === undefined)