@lark-apaas/openclaw-scripts-diagnose-cli 0.1.1-alpha.30 → 0.1.1-alpha.32

package/dist/index.cjs

@@ -89,6 +89,17 @@ function topoSort(rules) {
 //#endregion
 //#region src/utils.ts
 /**
+* Canonical provider-ref for the feishu app secret. Both
+* `feishu_default_account` (multi-agent path) and `feishu_channel`
+* (single-agent path) use this as the source-of-truth `appSecret`
+* value when repairing.
+*/
+const DEFAULT_FEISHU_APP_SECRET = {
+	source: "file",
+	provider: "miaoda-secret-provider",
+	id: "/channels_feishu_app_secret"
+};
+/**
 * Navigate nested object by keys, returning the value if it's a non-array object,
 * or undefined otherwise.
 */
@@ -153,6 +164,25 @@ function setNestedValue(obj, keys, value) {
 	}
 	current[keys[keys.length - 1]] = value;
 }
+/**
+* Locate the "main" agent in `agents.list`. Preference order:
+*   1. Explicit `default: true` entry.
+*   2. Entry with `id === 'main'` (project naming convention).
+*   3. First entry in the list (positional fallback).
+* Returns `undefined` when `agents.list` is missing or empty.
+*/
+function findMainAgent(config) {
+	const agents = getNestedMap(config, "agents");
+	if (!agents) return void 0;
+	const list = agents.list;
+	if (!Array.isArray(list) || list.length === 0) return void 0;
+	const isObj = (a) => a != null && typeof a === "object" && !Array.isArray(a);
+	const explicit = list.find((a) => isObj(a) && a.default === true);
+	if (explicit) return explicit;
+	const namedMain = list.find((a) => isObj(a) && a.id === "main");
+	if (namedMain) return namedMain;
+	return isObj(list[0]) ? list[0] : void 0;
+}
 /** Analyze which miaoda providers the config references. */
 function analyzeProviderDeps(config) {
 	const deps = {
@@ -618,16 +648,11 @@ SecretProviderRule = _SecretProviderRule = __decorate([Rule({
 })], SecretProviderRule);
 //#endregion
 //#region src/rules/feishu-channel.ts
-var _FeishuChannelRule;
+/**
+* Owns `channels.feishu.enabled` + single-agent top-level appId/appSecret.
+* Multi-agent shape (`accounts` present) belongs to `feishu_default_account`.
+*/
 let FeishuChannelRule = class FeishuChannelRule extends DiagnoseRule {
-	static {
-		_FeishuChannelRule = this;
-	}
-	static DEFAULT_APP_SECRET = {
-		source: "file",
-		provider: "miaoda-secret-provider",
-		id: "/channels_feishu_app_secret"
-	};
 	validate(ctx) {
 		const feishu = getNestedMap(ctx.config, "channels", "feishu");
 		if (!feishu) return {
@@ -638,16 +663,16 @@ let FeishuChannelRule = class FeishuChannelRule extends DiagnoseRule {
 			pass: false,
 			message: "channels.feishu.enabled mismatch: got " + feishu.enabled + ", expected true"
 		};
+		if (asRecord(feishu.accounts)) return { pass: true };
 		if (feishu.appId !== ctx.vars.feishuAppID) return {
 			pass: false,
-			message: "channels.feishu.appId mismatch: got " + feishu.appId + ", expected " + ctx.vars.feishuAppID
+			message: `channels.feishu.appId mismatch: got ${feishu.appId}, expected ${ctx.vars.feishuAppID}`
 		};
-		const expectedSecret = _FeishuChannelRule.DEFAULT_APP_SECRET;
 		const secret = feishu.appSecret;
 		if (typeof secret === "object" && secret !== null && !Array.isArray(secret)) {
-			if (!matchMap(secret, expectedSecret)) return {
+			if (!matchMap(secret, DEFAULT_FEISHU_APP_SECRET)) return {
 				pass: false,
-				message: "channels.feishu.appSecret object mismatch: got " + JSON.stringify(secret)
+				message: `channels.feishu.appSecret object mismatch: got ${JSON.stringify(secret)}`
 			};
 		} else if (typeof secret === "string") {
 			if (secret !== ctx.vars.feishuAppSecret) return {
@@ -666,6 +691,7 @@ let FeishuChannelRule = class FeishuChannelRule extends DiagnoseRule {
 			"feishu",
 			"enabled"
 		], true);
+		if (asRecord(getNestedMap(ctx.config, "channels", "feishu").accounts)) return;
 		setNestedValue(ctx.config, [
 			"channels",
 			"feishu",
@@ -675,27 +701,166 @@ let FeishuChannelRule = class FeishuChannelRule extends DiagnoseRule {
 			"channels",
 			"feishu",
 			"appSecret"
-		], _FeishuChannelRule.DEFAULT_APP_SECRET);
+		], DEFAULT_FEISHU_APP_SECRET);
 	}
 };
-FeishuChannelRule = _FeishuChannelRule = __decorate([Rule({
+FeishuChannelRule = __decorate([Rule({
 	key: "feishu_channel",
-	dependsOn: ["config_syntax_check"],
+	dependsOn: ["config_syntax_check", "feishu_default_account"],
 	repairMode: "standard"
 })], FeishuChannelRule);
 //#endregion
 //#region src/rules/feishu-default-account.ts
+/**
+* Owner of the multi-agent feishu channel shape: migrates legacy v1/v2
+* (top-level appId + defaultAccount/default) into v3 (`bot-<appId>` account),
+* detects + fixes drift on the main bot's appId/appSecret. Single-agent
+* configs (no `accounts`) are out of scope — handled by `feishu_channel`.
+*/
 let FeishuDefaultAccountRule = class FeishuDefaultAccountRule extends DiagnoseRule {
-	validate(_ctx) {
+	validate(ctx) {
+		const feishu = getNestedMap(ctx.config, "channels", "feishu");
+		if (!feishu) return { pass: true };
+		const accounts = asRecord(feishu.accounts);
+		if (!accounts) return { pass: true };
+		const topAppId = feishu.appId;
+		if (typeof topAppId === "string" && topAppId !== "") return {
+			pass: false,
+			message: "channels.feishu has legacy shape; needs migration to accounts.bot-<appId>"
+		};
+		const mainBot = findMainBotAccount(ctx.config, accounts);
+		if (mainBot) {
+			const expectedAppId = ctx.vars?.feishuAppID;
+			if (typeof expectedAppId === "string" && expectedAppId !== "" && mainBot.acc.appId !== expectedAppId) return {
+				pass: false,
+				message: `accounts.${mainBot.accountId}.appId mismatch: got ${mainBot.acc.appId}, expected ${expectedAppId}`
+			};
+			if (!secretMatchesCanonical(mainBot.acc.appSecret)) return {
+				pass: false,
+				message: `accounts.${mainBot.accountId}.appSecret drift`
+			};
+		}
 		return { pass: true };
 	}
-	repair(_ctx) {}
+	repair(ctx) {
+		const feishu = getNestedMap(ctx.config, "channels", "feishu");
+		if (!feishu) return;
+		const accounts = asRecord(feishu.accounts);
+		if (!accounts) return;
+		const topAppId = feishu.appId;
+		if (typeof topAppId === "string" && topAppId !== "") {
+			this.migrate(ctx, feishu, accounts, topAppId);
+			return;
+		}
+		this.enforceMainBotValues(ctx, accounts);
+	}
+	migrate(ctx, feishu, accounts, topAppId) {
+		const effectiveAppId = nonEmpty(ctx.vars?.feishuAppID) ?? topAppId;
+		const expectedKey = `bot-${effectiveAppId}`;
+		const existingBot = asRecord(accounts[expectedKey]) ?? {};
+		const defaultAccount = asRecord(accounts.defaultAccount) ?? {};
+		const defaultAcc = asRecord(accounts.default) ?? {};
+		const merged = {
+			...existingBot,
+			...defaultAccount,
+			...defaultAcc,
+			appId: effectiveAppId,
+			appSecret: DEFAULT_FEISHU_APP_SECRET
+		};
+		const chatID = ctx.vars?.teamChatID;
+		if (typeof chatID === "string" && chatID !== "") {
+			const existingGroups = asRecord(merged.groups) ?? {};
+			if (!(chatID in existingGroups)) merged.groups = {
+				...existingGroups,
+				[chatID]: { requireMention: false }
+			};
+		}
+		accounts[expectedKey] = merged;
+		delete accounts.defaultAccount;
+		delete accounts.default;
+		delete feishu.appId;
+		delete feishu.appSecret;
+		this.rewireBindings(ctx.config, expectedKey);
+	}
+	enforceMainBotValues(ctx, accounts) {
+		const mainBot = findMainBotAccount(ctx.config, accounts);
+		if (!mainBot) return;
+		const acc = accounts[mainBot.accountId];
+		const expectedAppId = nonEmpty(ctx.vars?.feishuAppID);
+		if (expectedAppId !== void 0 && acc.appId !== expectedAppId) acc.appId = expectedAppId;
+		if (!secretMatchesCanonical(acc.appSecret)) acc.appSecret = DEFAULT_FEISHU_APP_SECRET;
+	}
+	rewireBindings(config, expectedKey) {
+		if (!Array.isArray(config.bindings)) return;
+		const bindings = config.bindings;
+		for (const b of bindings) {
+			const match = asRecord(asRecord(b)?.match);
+			if (match && match.channel === "feishu" && (match.accountId === "defaultAccount" || match.accountId === "default")) match.accountId = expectedKey;
+		}
+		const seen = /* @__PURE__ */ new Set();
+		const deduped = [];
+		for (const b of bindings) {
+			const rec = asRecord(b);
+			if (!rec) continue;
+			const match = asRecord(rec.match);
+			const key = JSON.stringify([
+				rec.agentId,
+				match?.channel,
+				match?.accountId
+			]);
+			if (seen.has(key)) continue;
+			seen.add(key);
+			deduped.push(rec);
+		}
+		const mainId = findMainAgent(config)?.id;
+		if (typeof mainId === "string" && mainId !== "") {
+			if (!deduped.some((b) => {
+				const m = asRecord(b.match);
+				return b.agentId === mainId && m?.channel === "feishu" && m?.accountId === expectedKey;
+			})) deduped.push({
+				type: "route",
+				agentId: mainId,
+				match: {
+					channel: "feishu",
+					accountId: expectedKey
+				}
+			});
+		}
+		config.bindings = deduped;
+	}
 };
 FeishuDefaultAccountRule = __decorate([Rule({
 	key: "feishu_default_account",
 	dependsOn: ["config_syntax_check"],
 	repairMode: "standard"
 })], FeishuDefaultAccountRule);
+function nonEmpty(v) {
+	return typeof v === "string" && v !== "" ? v : void 0;
+}
+function findMainBotAccount(config, accounts) {
+	const mainId = findMainAgent(config)?.id;
+	if (typeof mainId !== "string" || mainId === "") return void 0;
+	const bindings = Array.isArray(config.bindings) ? config.bindings : [];
+	for (const b of bindings) {
+		const rec = asRecord(b);
+		const match = asRecord(rec?.match);
+		if (rec && match && rec.agentId === mainId && match.channel === "feishu") {
+			const accountId = match.accountId;
+			if (typeof accountId === "string") {
+				const acc = asRecord(accounts[accountId]);
+				if (acc) return {
+					accountId,
+					acc
+				};
+			}
+		}
+	}
+}
+/** Bot accounts must carry the canonical provider-ref `appSecret`. */
+function secretMatchesCanonical(secret) {
+	if (typeof secret !== "object" || secret === null || Array.isArray(secret)) return false;
+	return matchMap(secret, DEFAULT_FEISHU_APP_SECRET);
+}
 //#endregion
 //#region src/rules/gateway.ts
 var _GatewayRule;
@@ -704,12 +869,17 @@ let GatewayRule = class GatewayRule extends DiagnoseRule {
 		_GatewayRule = this;
 	}
 	static DEFAULT_PORT = 18789;
+	static DEFAULT_MODE = "local";
+	static DEFAULT_BIND = "loopback";
 	static DEFAULT_AUTH_MODE = "token";
 	static DEFAULT_AUTH_TOKEN = {
 		source: "file",
 		provider: "miaoda-secret-provider",
 		id: "/gateway_auth_token"
 	};
+	/** Required entries in gateway.trustedProxies. Repair appends any missing
+	*  entries while preserving caller-added extras (no overwrite). */
+	static DEFAULT_TRUSTED_PROXIES = ["::1", "127.0.0.1"];
 	validate(ctx) {
 		const gateway = ctx.config.gateway;
 		if (!gateway || typeof gateway !== "object") return {
@@ -721,6 +891,14 @@ let GatewayRule = class GatewayRule extends DiagnoseRule {
 			pass: false,
 			message: "gateway.port mismatch: got " + gw.port + ", expected " + _GatewayRule.DEFAULT_PORT
 		};
+		if (gw.mode !== _GatewayRule.DEFAULT_MODE) return {
+			pass: false,
+			message: "gateway.mode mismatch: got " + gw.mode + ", expected " + _GatewayRule.DEFAULT_MODE
+		};
+		if (gw.bind !== _GatewayRule.DEFAULT_BIND) return {
+			pass: false,
+			message: "gateway.bind mismatch: got " + gw.bind + ", expected " + _GatewayRule.DEFAULT_BIND
+		};
 		const auth = gw.auth;
 		if (!auth || typeof auth !== "object") return {
 			pass: false,
@@ -755,10 +933,22 @@ let GatewayRule = class GatewayRule extends DiagnoseRule {
 			pass: false,
 			message: "gateway.controlUi.dangerouslyDisableDeviceAuth must be true, got " + controlUi.dangerouslyDisableDeviceAuth
 		};
+		const proxies = gw.trustedProxies;
+		if (!Array.isArray(proxies)) return {
+			pass: false,
+			message: "gateway.trustedProxies missing or not an array"
+		};
+		const missing = _GatewayRule.DEFAULT_TRUSTED_PROXIES.filter((p) => !proxies.includes(p));
+		if (missing.length > 0) return {
+			pass: false,
+			message: "gateway.trustedProxies missing: " + JSON.stringify(missing)
+		};
 		return { pass: true };
 	}
 	repair(ctx) {
 		setNestedValue(ctx.config, ["gateway", "port"], _GatewayRule.DEFAULT_PORT);
+		setNestedValue(ctx.config, ["gateway", "mode"], _GatewayRule.DEFAULT_MODE);
+		setNestedValue(ctx.config, ["gateway", "bind"], _GatewayRule.DEFAULT_BIND);
 		setNestedValue(ctx.config, [
 			"gateway",
 			"auth",
@@ -774,6 +964,14 @@ let GatewayRule = class GatewayRule extends DiagnoseRule {
 			"controlUi",
 			"dangerouslyDisableDeviceAuth"
 		], true);
+		const gw = ctx.config.gateway ?? {};
+		const current = Array.isArray(gw.trustedProxies) ? gw.trustedProxies.slice() : [];
+		const seen = new Set(current.map((v) => String(v)));
+		for (const p of _GatewayRule.DEFAULT_TRUSTED_PROXIES) if (!seen.has(p)) {
+			current.push(p);
+			seen.add(p);
+		}
+		setNestedValue(ctx.config, ["gateway", "trustedProxies"], current);
 	}
 };
 GatewayRule = _GatewayRule = __decorate([Rule({
@@ -2452,6 +2650,7 @@ function fillApp(src) {
 	return {
 		feishuAppID: src.feishuAppID ?? "",
 		feishuAppSecret: src.feishuAppSecret ?? "",
+		teamChatID: typeof src.teamChatID === "string" && src.teamChatID !== "" ? src.teamChatID : void 0,
 		feishuOpenID: src.feishuOpenID ?? "",
 		openClawName: src.openClawName ?? "",
 		gatewayToken: src.gatewayToken ?? "",
@@ -2497,6 +2696,7 @@ function buildCheckInput(raw, configPathOverride) {
 		vars: {
 			feishuAppID: ctx.app.feishuAppID,
 			feishuAppSecret: ctx.app.feishuAppSecret,
+			teamChatID: ctx.app.teamChatID,
 			innerAPIKey: ctx.app.innerAPIKey,
 			gatewayToken: ctx.app.gatewayToken,
 			baseURL: ctx.app.baseURL,
@@ -2522,6 +2722,7 @@ function buildRepairInput(raw, configPathOverride) {
 		vars: {
 			feishuAppID: ctx.app.feishuAppID,
 			feishuAppSecret: ctx.app.feishuAppSecret,
+			teamChatID: ctx.app.teamChatID,
 			innerAPIKey: ctx.app.innerAPIKey,
 			gatewayToken: ctx.app.gatewayToken,
 			baseURL: ctx.app.baseURL,
@@ -2551,6 +2752,7 @@ function buildResetInput(raw, configPathOverride) {
 		vars: {
 			feishuAppID: ctx.app.feishuAppID,
 			feishuAppSecret: ctx.app.feishuAppSecret,
+			teamChatID: ctx.app.teamChatID,
 			innerAPIKey: ctx.app.innerAPIKey,
 			gatewayToken: ctx.app.gatewayToken,
 			baseURL: ctx.app.baseURL,
@@ -2593,7 +2795,7 @@ async function runDoctor(rawCtx, opts) {
 //#region src/help.ts
 const BIN = "mclaw-diagnose";
 function versionBanner() {
-	return `v0.1.1-alpha.30`;
+	return `v0.1.1-alpha.32`;
 }
 const COMMANDS = [
 	{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/openclaw-scripts-diagnose-cli",
-  "version": "0.1.1-alpha.30",
+  "version": "0.1.1-alpha.32",
   "description": "CLI for OpenClaw config diagnose and repair with JSON5 support",
   "main": "dist/index.cjs",
   "bin": {