@lark-apaas/openclaw-scripts-diagnose-cli 0.1.13-alpha.9 → 0.1.14-alpha.0

package/dist/index.cjs

@@ -52,7 +52,7 @@ node_assert = __toESM(node_assert);
 * it terse and parseable.
 */
 function getVersion() {
-	return "0.1.13-alpha.9";
+	return "0.1.14-alpha.0";
 }
 //#endregion
 //#region src/rule-engine/base.ts
@@ -3038,7 +3038,7 @@ function extractTarballTolerant(tarball, destDir, opts = {}) {
 }
 //#endregion
 //#region src/rules/feishu-plugin-state-normalize.ts
-const PLUGIN_NAME$2 = "openclaw-lark";
+const PLUGIN_NAME$1 = "openclaw-lark";
 const BUILTIN_FEISHU = "feishu";
 const LEGACY_PLUGIN_NAME = "feishu-openclaw-plugin";
 const LEGACY_DIRS_TO_REMOVE = [LEGACY_PLUGIN_NAME, BUILTIN_FEISHU];
@@ -3087,7 +3087,7 @@ let FeishuPluginStateNormalizeRule = class FeishuPluginStateNormalizeRule extend
 	validate(ctx) {
 		if (!isPluginInstalled(ctx)) return { pass: true };
 		const fails = [];
-		if (!isNewPluginEnabled(ctx.config)) fails.push(`plugins.entries["${PLUGIN_NAME$2}"].enabled !== true（应启用）`);
+		if (!isNewPluginEnabled(ctx.config)) fails.push(`plugins.entries["${PLUGIN_NAME$1}"].enabled !== true（应启用）`);
 		if (isBuiltinFeishuEnabled(ctx.config)) fails.push("plugins.entries.feishu.enabled === true（应禁用）");
 		if (isTopLevelMissingFeishuTools(ctx.config)) fails.push("tools.alsoAllow 缺 feishu_* tools");
 		const legacyResiduals = findLegacyResiduals(ctx);
@@ -3099,7 +3099,7 @@ let FeishuPluginStateNormalizeRule = class FeishuPluginStateNormalizeRule extend
 		};
 	}
 	repair(ctx) {
-		setEntryEnabled(ctx.config, PLUGIN_NAME$2, true);
+		setEntryEnabled(ctx.config, PLUGIN_NAME$1, true);
 		setEntryEnabled(ctx.config, BUILTIN_FEISHU, false);
 		ensureFeishuTools(ctx.config);
 		cleanupLegacyResiduals(ctx);
@@ -3113,10 +3113,10 @@ FeishuPluginStateNormalizeRule = __decorate([Rule({
 	level: "critical"
 })], FeishuPluginStateNormalizeRule);
 function isPluginInstalled(ctx) {
-	return node_fs.default.existsSync(node_path.default.join(getExtensionsDir(ctx.configPath), PLUGIN_NAME$2));
+	return node_fs.default.existsSync(node_path.default.join(getExtensionsDir(ctx.configPath), PLUGIN_NAME$1));
 }
 function isNewPluginEnabled(config) {
-	return asRecord(getNestedMap(config, "plugins", "entries")?.[PLUGIN_NAME$2])?.enabled === true;
+	return asRecord(getNestedMap(config, "plugins", "entries")?.[PLUGIN_NAME$1])?.enabled === true;
 }
 function isBuiltinFeishuEnabled(config) {
 	return asRecord(getNestedMap(config, "plugins", "entries")?.[BUILTIN_FEISHU])?.enabled === true;
@@ -3169,7 +3169,7 @@ function cleanupLegacyResiduals(ctx) {
 		const allow = plugins.allow;
 		if (Array.isArray(allow)) {
 			for (let i = allow.length - 1; i >= 0; i--) if (allow[i] === LEGACY_PLUGIN_NAME) allow.splice(i, 1);
-			if (!allow.includes(PLUGIN_NAME$2)) allow.push(PLUGIN_NAME$2);
+			if (!allow.includes(PLUGIN_NAME$1)) allow.push(PLUGIN_NAME$1);
 		}
 	}
 	const extDir = getExtensionsDir(ctx.configPath);
@@ -3314,7 +3314,7 @@ function findClosestEntry(pluginVersion) {
 }
 //#endregion
 //#region src/rules/feishu-plugin-version-compat.ts
-const PLUGIN_NAME$1 = "openclaw-lark";
+const PLUGIN_NAME = "openclaw-lark";
 const LEGACY_SHORT_NAMES = ["feishu-openclaw-plugin"];
 const FORK_SCOPES = ["@lark-apaas"];
 /** 特化 fork 版全名：虽免于 VERSION_COMPAT_MAP 检查，仍需 openclaw ≥ 此版本 */
@@ -3483,13 +3483,13 @@ function detectInstalledPlugin(ctx) {
 	const allow = Array.isArray(allowRaw) ? allowRaw.filter((e) => typeof e === "string") : [];
 	const extDir = getExtensionsDir(ctx.configPath);
 	const installs = getNestedMap(ctx.config, "plugins", "installs");
-	for (const name of [PLUGIN_NAME$1, ...LEGACY_SHORT_NAMES]) {
+	for (const name of [PLUGIN_NAME, ...LEGACY_SHORT_NAMES]) {
 		if (!allow.includes(name)) continue;
 		const pkgPath = node_path.default.join(extDir, name, "package.json");
 		if (!node_fs.default.existsSync(pkgPath)) continue;
 		const pkg = readPluginPackageJson(pkgPath) ?? {};
 		const installEntry = installs && asRecord(installs[name]);
-		const fullName = pkg.name ?? extractScopedNameFromSpec$1(installEntry?.spec);
+		const fullName = pkg.name ?? extractScopedNameFromSpec(installEntry?.spec);
 		return {
 			allowName: name,
 			fullName,
@@ -3500,7 +3500,7 @@ function detectInstalledPlugin(ctx) {
 	return null;
 }
 /** "@scope/name@1.2.3" / "name@1.2.3" / "@scope/name" / "name" → 去掉 @version 后缀 */
-function extractScopedNameFromSpec$1(spec) {
+function extractScopedNameFromSpec(spec) {
 	if (typeof spec !== "string") return void 0;
 	const at = spec.indexOf("@", 1);
 	return at === -1 ? spec : spec.slice(0, at);
@@ -3555,100 +3555,110 @@ CleanupInstallBackupDirsRule = __decorate([Rule({
 	level: "critical"
 })], CleanupInstallBackupDirsRule);
 //#endregion
-//#region src/rules/lark-cli-missing-for-installed-lark-plugin.ts
-const PLUGIN_NAME = "openclaw-lark";
-const FORK_PACKAGE_NAME = "@lark-apaas/openclaw-lark";
-const TARGET_VERSION = "2026.4.4";
-const LARK_CLI_NAME$1 = "lark-cli";
-function readInstalledLarkPlugin(ctx) {
-	const pkgPath = node_path.default.join(getExtensionsDir(ctx.configPath), PLUGIN_NAME, "package.json");
-	if (!node_fs.default.existsSync(pkgPath)) return null;
-	let pkg = {};
-	try {
-		const parsed = JSON.parse(node_fs.default.readFileSync(pkgPath, "utf-8"));
-		pkg = {
-			name: typeof parsed.name === "string" ? parsed.name : void 0,
-			version: typeof parsed.version === "string" ? parsed.version : void 0
-		};
-	} catch {
-		pkg = {};
-	}
-	const installs = getNestedMap(ctx.config, "plugins", "installs");
-	const installEntry = installs ? asRecord(installs[PLUGIN_NAME]) : void 0;
-	return {
-		name: pkg.name ?? extractScopedNameFromSpec(installEntry?.spec),
-		version: pkg.version ?? (typeof installEntry?.version === "string" ? installEntry.version : void 0)
-	};
-}
-function isTargetForkPlugin(plugin) {
-	return plugin?.name === FORK_PACKAGE_NAME && plugin.version === TARGET_VERSION;
-}
-function extractScopedNameFromSpec(spec) {
-	if (typeof spec !== "string") return void 0;
-	const at = spec.indexOf("@", 1);
-	return at === -1 ? spec : spec.slice(0, at);
-}
-function isLarkCliAvailable$1() {
-	try {
-		return (0, node_child_process.spawnSync)(LARK_CLI_NAME$1, ["--version"], {
-			encoding: "utf-8",
-			timeout: 5e3,
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).status === 0;
-	} catch {
-		return false;
-	}
-}
-function installLarkCliOnce(tag) {
-	const entry = process.argv[1];
-	if (!entry) throw new Error("cannot resolve diagnose-cli entrypoint for lark-cli install");
-	const res = (0, node_child_process.spawnSync)(process.execPath, [
-		entry,
-		"install-cli",
-		tag,
-		"--cli=lark-cli"
-	], {
-		encoding: "utf-8",
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-	const stdout = res.stdout?.trim();
-	const stderr = res.stderr?.trim();
-	if (stdout) console.error(`[lark-cli-missing] install-cli stdout: ${stdout}`);
-	if (stderr) console.error(`[lark-cli-missing] install-cli stderr: ${stderr}`);
-	if (res.error) throw new Error(`install-cli spawn error: ${res.error.message}`);
-	if (res.status !== 0) throw new Error(`install-cli exited with code ${res.status ?? "unknown"}`);
-}
-let LarkCliMissingForInstalledLarkPluginRule = class LarkCliMissingForInstalledLarkPluginRule extends DiagnoseRule {
+//#region src/rules/feishu-bot-channel-config.ts
+/**
+* Ensures each bot account's channel config is correct:
+*   1. `allowFrom` contains its own `creatorOpenID` from larkApps
+*   2. `appSecret` is either the canonical provider-ref or matches larkApps plaintext
+*
+* Covers both multi-account (channels.feishu.accounts) and single-account
+* (channels.feishu.appId + allowFrom at top level) layouts.
+*/
+let FeishuBotChannelConfigRule = class FeishuBotChannelConfigRule extends DiagnoseRule {
 	validate(ctx) {
-		if (!isTargetForkPlugin(readInstalledLarkPlugin(ctx))) return { pass: true };
-		if (isLarkCliAvailable$1()) return { pass: true };
+		const larkApps = ctx.vars.larkApps;
+		if (!larkApps || larkApps.length === 0) return { pass: true };
+		const feishu = asRecord(getNestedMap(ctx.config, "channels", "feishu"));
+		if (!feishu) return { pass: true };
+		const issues = [];
+		const accounts = asRecord(feishu.accounts);
+		if (accounts) for (const [accountId, account] of Object.entries(accounts)) {
+			const bot = asRecord(account);
+			if (!bot) continue;
+			const appId = bot.appId;
+			if (typeof appId !== "string" || !appId.startsWith("cli_")) continue;
+			const larkApp = larkApps.find((e) => e.larkAppID === appId);
+			if (!larkApp) continue;
+			this.checkBot(accountId, bot, larkApp, issues);
+		}
+		const singleAppId = feishu.appId;
+		if (typeof singleAppId === "string" && singleAppId.startsWith("cli_") && !accounts) {
+			const larkApp = larkApps.find((e) => e.larkAppID === singleAppId);
+			if (larkApp) this.checkBot("feishu", feishu, larkApp, issues);
+		}
+		if (issues.length === 0) return { pass: true };
 		return {
 			pass: false,
-			message: `${FORK_PACKAGE_NAME}@${TARGET_VERSION} 已安装，但 lark-cli 不可用；将执行一次 lark-cli 安装`
+			message: issues.join("; ")
 		};
 	}
+	/** Check a single bot entry (either an account object or the feishu channel itself). */
+	checkBot(label, bot, larkApp, issues) {
+		const creatorOpenID = larkApp.creatorOpenID;
+		const allowFrom = Array.isArray(bot.allowFrom) ? bot.allowFrom : [];
+		if (typeof creatorOpenID === "string" && creatorOpenID !== "") {
+			if (!allowFrom.includes(creatorOpenID)) issues.push(`${label} allowFrom missing creatorOpenID ${creatorOpenID.length > 8 ? creatorOpenID.slice(0, 4) + "***" + creatorOpenID.slice(-4) : "***"}`);
+		} else if (allowFrom.length === 0) issues.push(`${label} allowFrom is empty (creatorOpenID unavailable, cannot auto-fix)`);
+		const secret = bot.appSecret;
+		if (typeof secret === "object" && secret !== null && !Array.isArray(secret)) {
+			if (!matchMap(secret, DEFAULT_FEISHU_APP_SECRET)) issues.push(`${label} appSecret is a provider-ref but not the canonical one`);
+		} else if (typeof secret === "string") {
+			if (secret !== larkApp.appSecret) issues.push(`${label} appSecret plaintext mismatch`);
+		} else issues.push(`${label} appSecret has unexpected type`);
+	}
 	repair(ctx) {
-		if (!isTargetForkPlugin(readInstalledLarkPlugin(ctx))) return;
-		if (isLarkCliAvailable$1()) return;
-		installLarkCliOnce(ctx.vars.recommendedOpenclawTag ?? TARGET_VERSION);
+		const larkApps = ctx.vars.larkApps;
+		if (!larkApps || larkApps.length === 0) return;
+		const feishu = asRecord(getNestedMap(ctx.config, "channels", "feishu"));
+		if (!feishu) return;
+		const accounts = asRecord(feishu.accounts);
+		if (accounts) for (const [, account] of Object.entries(accounts)) {
+			const bot = asRecord(account);
+			if (!bot) continue;
+			const appId = bot.appId;
+			if (typeof appId !== "string" || !appId.startsWith("cli_")) continue;
+			const larkApp = larkApps.find((e) => e.larkAppID === appId);
+			if (!larkApp) continue;
+			this.fixBot(bot, larkApp);
+		}
+		const singleAppId = feishu.appId;
+		if (typeof singleAppId === "string" && singleAppId.startsWith("cli_") && !accounts) {
+			const larkApp = larkApps.find((e) => e.larkAppID === singleAppId);
+			if (larkApp) this.fixBot(feishu, larkApp);
+		}
+	}
+	/** Fix a single bot entry in-place. */
+	fixBot(bot, larkApp) {
+		const creatorOpenID = larkApp.creatorOpenID;
+		if (typeof creatorOpenID === "string" && creatorOpenID !== "") {
+			const allowFrom = Array.isArray(bot.allowFrom) ? [...bot.allowFrom] : [];
+			if (!allowFrom.includes(creatorOpenID)) {
+				allowFrom.push(creatorOpenID);
+				bot.allowFrom = allowFrom;
+			}
+		}
+		const secret = bot.appSecret;
+		let needsFix = false;
+		if (typeof secret === "object" && secret !== null && !Array.isArray(secret)) {
+			if (!matchMap(secret, DEFAULT_FEISHU_APP_SECRET)) needsFix = true;
+		} else if (typeof secret === "string") {
+			if (secret !== larkApp.appSecret) needsFix = true;
+		} else needsFix = true;
+		if (needsFix) bot.appSecret = { ...DEFAULT_FEISHU_APP_SECRET };
 	}
 };
-LarkCliMissingForInstalledLarkPluginRule = __decorate([Rule({
-	key: "lark_cli_missing_for_installed_lark_plugin",
-	description: "检测特定飞书插件版本已安装但 lark-cli 缺失的环境，并自动安装 lark-cli 一次",
-	dependsOn: ["config_syntax_check"],
+FeishuBotChannelConfigRule = __decorate([Rule({
+	key: "feishu_bot_channel_config",
+	description: "确保飞书配置中 bot 账号的 allowFrom 包含其创建者 openID 且 appSecret 值正确",
+	dependsOn: [
+		"config_syntax_check",
+		"feishu_default_account",
+		"feishu_bot_id"
+	],
 	repairMode: "standard",
-	level: "critical",
-	usesVars: ["recommendedOpenclawTag"]
-})], LarkCliMissingForInstalledLarkPluginRule);
+	usesVars: ["larkApps"],
+	level: "critical"
+})], FeishuBotChannelConfigRule);
 //#endregion
 //#region src/check.ts
 /** Telemetry-aware entry: returns both the legacy CheckResult (for stdout)
@@ -4249,9 +4259,10 @@ function makeLogger(logFile) {
 /**
 * Start an async reset task: spawn a detached child process and return the taskId.
 *
-* The child process runs: node cli.js reset --worker --task-id=xxx --ctx=base64
+* The child process runs: node cli.js reset --worker --task-id=xxx
+* The worker fetches ctx from innerApi itself — no --ctx passthrough.
 */
-function startAsyncReset(ctxBase64) {
+function startAsyncReset() {
 	const taskId = (0, node_crypto.randomUUID)();
 	const resultFile = resetResultFile(taskId);
 	const log = makeLogger(resetLogFile(taskId));
@@ -4275,8 +4286,7 @@ function startAsyncReset(ctxBase64) {
 		process.argv[1],
 		"reset",
 		"--worker",
-		`--task-id=${taskId}`,
-		`--ctx=${ctxBase64}`
+		`--task-id=${taskId}`
 	], {
 		detached: true,
 		stdio: "ignore",
@@ -6790,6 +6800,60 @@ function mergeCoreBackupAndOrigins(configPath, vars, resetData, log) {
 	log(`allowedOrigins: added ${added.length} (${JSON.stringify(added)}), total now ${mergedOrigins.length}`);
 }
 /**
+* Fix bot account allowFrom and appSecret using larkApps from innerApi.
+*
+* For each bot account (key starts with `bot-cli_`):
+*   - allowFrom must contain the bot's own creatorOpenID from larkApps
+*   - appSecret must be either the canonical provider-ref or match larkApps plaintext
+*
+* Runs after mergeCoreBackupAndOrigins so it operates on the final config state.
+*/
+function fixBotChannelConfig(configPath, larkApps, log) {
+	if (!larkApps || larkApps.length === 0) {
+		log("no larkApps data, skip bot channel config fix");
+		return;
+	}
+	const config = loadJSON5().parse(node_fs.default.readFileSync(configPath, "utf-8"));
+	const accounts = asRecord(getNestedMap(config, "channels", "feishu")?.accounts);
+	if (!accounts) {
+		log("no feishu accounts in config, skip bot channel config fix");
+		return;
+	}
+	let fixCount = 0;
+	for (const [, account] of Object.entries(accounts)) {
+		const bot = asRecord(account);
+		if (!bot) continue;
+		const appId = bot.appId;
+		if (typeof appId !== "string" || !appId.startsWith("cli_")) continue;
+		const larkApp = larkApps.find((e) => e.larkAppID === appId);
+		if (!larkApp) continue;
+		const creatorOpenID = larkApp.creatorOpenID;
+		if (typeof creatorOpenID === "string" && creatorOpenID !== "") {
+			const allowFrom = Array.isArray(bot.allowFrom) ? [...bot.allowFrom] : [];
+			if (!allowFrom.includes(creatorOpenID)) {
+				allowFrom.push(creatorOpenID);
+				bot.allowFrom = allowFrom;
+				fixCount++;
+			}
+		}
+		const secret = bot.appSecret;
+		let needsFix = false;
+		if (typeof secret === "object" && secret !== null && !Array.isArray(secret)) {
+			if (!matchMap(secret, DEFAULT_FEISHU_APP_SECRET)) needsFix = true;
+		} else if (typeof secret === "string") {
+			if (secret !== larkApp.appSecret) needsFix = true;
+		} else needsFix = true;
+		if (needsFix) {
+			bot.appSecret = { ...DEFAULT_FEISHU_APP_SECRET };
+			fixCount++;
+		}
+	}
+	if (fixCount > 0) {
+		node_fs.default.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+		log(`fixed ${fixCount} bot channel config issue(s) (allowFrom/appSecret)`);
+	} else log("bot channel config ok, no fixes needed");
+}
+/**
 * Step 7: Verify startup scripts landed in configDir/scripts/.
 *
 * Scripts are extracted directly to configDir/scripts/ during stageTemplate —
@@ -6934,6 +6998,7 @@ async function runReset(input, taskId, resultFile) {
 		await step5InstallOpenclaw(openclawTag, ossFileMap, log);
 		step(6);
 		mergeCoreBackupAndOrigins(configPath, vars, resetData, log);
+		fixBotChannelConfig(configPath, vars.larkApps, log);
 		step(7);
 		verifyStartupScripts(configDir, log);
 		step(8);
@@ -7732,7 +7797,8 @@ function normalizeCtx(raw) {
 			reset: {
 				templateVars: r.reset.templateVars ?? {},
 				coreBackup: r.reset.coreBackup
-			}
+			},
+			larkApps: Array.isArray(r.larkApps) ? r.larkApps : []
 		};
 	}
 	const vars = r.vars ?? {};
@@ -7757,7 +7823,8 @@ function normalizeCtx(raw) {
 		reset: {
 			templateVars: resetData.templateVars ?? {},
 			coreBackup: resetData.coreBackup
-		}
+		},
+		larkApps: Array.isArray(r.larkApps) ? r.larkApps : []
 	};
 }
 function fillApp(src) {
@@ -7822,7 +7889,8 @@ function buildCheckInput(raw, configPathOverride) {
 			providerFilePath: PROVIDER_FILE_PATH,
 			secretsFilePath: SECRETS_FILE_PATH,
 			templateVars: ctx.app.templateVars,
-			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag
+			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag,
+			larkApps: ctx.larkApps
 		},
 		templateVars: ctx.app.templateVars
 	};
@@ -7854,7 +7922,8 @@ function buildRepairInput(raw, configPathOverride) {
 			providerFilePath: PROVIDER_FILE_PATH,
 			secretsFilePath: SECRETS_FILE_PATH,
 			templateVars: ctx.app.templateVars,
-			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag
+			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag,
+			larkApps: ctx.larkApps
 		},
 		repairData: {
 			secretsContent: ctx.secrets.secretsContent,
@@ -7890,7 +7959,8 @@ function buildResetInput(raw, configPathOverride) {
 			providerFilePath: PROVIDER_FILE_PATH,
 			secretsFilePath: SECRETS_FILE_PATH,
 			templateVars: ctx.app.templateVars,
-			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag
+			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag,
+			larkApps: ctx.larkApps
 		},
 		resetData: {
 			templateVars: ctx.reset.templateVars,
@@ -10200,7 +10270,7 @@ async function reportCliRun(opts) {
 //#region src/help.ts
 const BIN = "mclaw-diagnose";
 function versionBanner() {
-	return `v0.1.13-alpha.9`;
+	return `v0.1.14-alpha.0`;
 }
 const COMMANDS = [
 	{
@@ -10304,16 +10374,12 @@ EXIT CODES
 		hidden: true,
 		summary: "Run rule-engine check only",
 		help: `USAGE
-  ${BIN} check [--ctx=<base64>]
+  ${BIN} check
 
 DESCRIPTION
   Runs the rule engine against the sandbox's current openclaw config and
-  returns { failedRules }. Used by sandbox_console's push-style callers
-  that already own the ctx — end-users should prefer \`doctor\`.
-
-OPTIONS
-  --ctx=<base64>   Opaque ctx JSON (base64). When absent, fetched from
-                   innerapi (same path as doctor).
+  returns { failedRules }. Ctx is fetched from innerapi automatically.
+  End-users should prefer \`doctor\`.
 `
 	},
 	{
@@ -10321,16 +10387,11 @@ OPTIONS
 		hidden: true,
 		summary: "Apply standard-mode repairs",
 		help: `USAGE
-  ${BIN} repair [--ctx=<base64>]
+  ${BIN} repair
 
 DESCRIPTION
-  Runs repair for the failing rules listed inside the ctx's repairData.
-  Intended for sandbox_console's push path — end-users should use
-  \`doctor --fix\` instead.
-
-OPTIONS
-  --ctx=<base64>   Opaque ctx JSON (base64). When absent, fetched from
-                   innerapi.
+  Runs repair for the failing rules. Ctx is fetched from innerapi
+  automatically. End-users should use \`doctor --fix\` instead.
 `
 	},
 	{
@@ -10338,14 +10399,15 @@ OPTIONS
 		hidden: true,
 		summary: "Re-initialize sandbox via the 9-step reset pipeline",
 		help: `USAGE
-  ${BIN} reset --async  [--ctx=<base64>]
-  ${BIN} reset --worker --task-id=<id> [--ctx=<base64>]
+  ${BIN} reset --async
+  ${BIN} reset --worker --task-id=<id>
 
 DESCRIPTION
   Two-phase pipeline driven asynchronously: the --async invocation spawns
   a detached worker and returns { taskId } immediately; the --worker
   invocation (spawned by --async) runs the actual 9 steps and writes
   progress to /tmp/openclaw-diagnose/reset-<taskId>.json.
+  Ctx is fetched from innerapi automatically.
 
   Poll progress with \`${BIN} get_reset_task --task-id=<id>\`.
 
@@ -10353,7 +10415,6 @@ OPTIONS
   --async           Start a detached worker and return taskId on stdout.
   --worker          Internal — run the 9-step pipeline (launched by --async).
   --task-id=<id>    Required with --worker; identifies the progress file.
-  --ctx=<base64>    Opaque ctx JSON; fetched from innerapi when absent.
 `
 	},
 	{
@@ -10376,7 +10437,7 @@ OPTIONS
 		hidden: true,
 		summary: "Download + install the openclaw tarball",
 		help: `USAGE
-  ${BIN} install-openclaw <tag> [--ctx=<base64> | --oss_file_map=<base64>]
+  ${BIN} install-openclaw <tag> [--oss_file_map=<base64>]
 
 DESCRIPTION
   Downloads the openclaw@<tag> tgz via the signed OSS URL found in the
@@ -10388,9 +10449,9 @@ ARGUMENTS
   <tag>                Openclaw version tag, e.g. 2026.4.11.
 
 OPTIONS
-  --ctx=<base64>       Opaque ctx; ossFileMap is extracted from it.
   --oss_file_map=...   Pre-built OSS URL map (base64 JSON); skips innerapi
-                       entirely. Wins over --ctx when both provided.
+                       entirely. When absent, ossFileMap is fetched from
+                       innerapi automatically.
 `
 	},
 	{
@@ -10416,8 +10477,7 @@ OPTIONS
   --home_base=<dir>    Override the /home/gem base (tests).
   --config_path=<p>    Override the openclaw.json path (tests).
   --skip-config-update Leave plugins.installs in openclaw.json untouched.
-  --ctx=<base64>       Opaque ctx; see install-openclaw for semantics.
-  --oss_file_map=...   Pre-built OSS URL map (base64 JSON).
+  --oss_file_map=...   Pre-built OSS URL map (base64 JSON); skips innerapi.
 `
 	},
 	{
@@ -10444,7 +10504,6 @@ OPTIONS
   --cli=<name>         CLI package to install by short name or scoped
                        packageName (repeatable, at least one required).
   --home_base=<dir>    Override the /home/gem base (tests).
-  --ctx=<base64>       Opaque ctx; ossFileMap is extracted from it.
   --oss_file_map=...   Pre-built OSS URL map (base64 JSON); skips innerapi.
 
 EXAMPLES
@@ -10551,8 +10610,7 @@ OPTIONS
   --role=<role>        Package role (e.g. template, config).
   --name=<name>        Package name within the role.
   --dir=<dir>          Target dir (defaults to dirname(pkg.installPath)).
-  --ctx=<base64>       Opaque ctx; ossFileMap is extracted from it.
-  --oss_file_map=...   Pre-built OSS URL map (base64 JSON).
+  --oss_file_map=...   Pre-built OSS URL map (base64 JSON); skips innerapi.
 `
 	}
 ];
@@ -10628,31 +10686,31 @@ function planVarsFields(opts = {}) {
 *
 * Per-command group needs:
 *
-*   doctor / check    app (rule-driven)
-*   repair            app + secrets   (writes secretsContent / providerKeyContent)
-*   reset             app + secrets + install + reset (the works)
+*   doctor / check    app + larkApps
+*   repair            app + secrets + larkApps
+*   reset             app + secrets + install + reset + larkApps
 *   install-*         install only
 *
 * Empty result (`{}`) means "no group needed" — the CLI can skip the
 * `fetchCtxViaInnerApi` call entirely and run with a synthetic empty ctx.
-* Happens e.g. when the user pinned `--rule=<key>` to a vars-free rule on
-* `doctor`.
 */
 function planCtxPopulate(opts) {
 	if (opts.command === "install") return { install: true };
 	const populate = {};
-	const appFields = planVarsFields({
+	if (planVarsFields({
 		disabled: opts.disabled,
 		onlyRules: opts.onlyRules,
 		profile: opts.profile
-	});
-	if (appFields.length > 0) populate.app = appFields;
-	if (opts.command === "repair") populate.secrets = true;
-	else if (opts.command === "reset") {
+	}).length > 0) populate.app = true;
+	if (opts.command === "repair") {
+		populate.secrets = true;
+		populate.larkApps = true;
+	} else if (opts.command === "reset") {
 		populate.secrets = true;
 		populate.install = true;
 		populate.reset = true;
-	}
+		populate.larkApps = true;
+	} else if (opts.command === "doctor" || opts.command === "check") populate.larkApps = true;
 	return populate;
 }
 //#endregion
@@ -10711,21 +10769,6 @@ function reportDoctorRunToSlardar(opts) {
 const args = node_process.default.argv.slice(2);
 const mode = args.find((a) => !a.startsWith("-"));
 /**
-* Decode `--ctx=<base64>` into an opaque JSON object. Returns undefined when
-* the flag isn't present — the caller decides whether to fall back to the
-* innerapi or to error out.
-*
-* The object's shape is not enforced here; downstream code consumes it via
-* either `normalizeCtx()` (new path) or direct field access for the legacy
-* check/repair/reset contract still used by sandbox_console push.
-*/
-function parseCtxFlag(args) {
-	const ctxArg = args.find((a) => a.startsWith("--ctx="));
-	if (!ctxArg) return void 0;
-	const b64 = ctxArg.slice(6);
-	return JSON.parse(Buffer.from(b64, "base64").toString("utf-8"));
-}
-/**
 * Pull the first non-flag positional after the mode name.
 * (The mode itself is args[0] in the filtered set, so we skip index 0.)
 */
@@ -10753,8 +10796,8 @@ function getMultiFlag(args, name) {
 * case but is no longer consulted.
 */
 async function reportRun(command, rc, _raw, invocation, durationMs, outcome, slardar = {
-	scene,
-	profile,
+	scene: void 0,
+	profile: "standard",
 	fix: false
 }) {
 	console.error(`${command}: telemetry calling report_cli_run`);
@@ -10818,7 +10861,7 @@ async function main() {
 	console.error(`${mode}: begin argv=[${args.join(" ")}] version=${getVersion()} traceId=${traceId ?? "-"} caller=${caller ?? "-"} runIdGenerated=${rc.generated}`);
 	switch (mode) {
 		case "check": {
-			const raw = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+			const raw = await fetchCtxViaInnerApi({
 				populate: planCtxPopulate({
 					command: "check",
 					profile
@@ -10843,7 +10886,7 @@ async function main() {
 			break;
 		}
 		case "repair": {
-			const raw = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+			const raw = await fetchCtxViaInnerApi({
 				populate: planCtxPopulate({
 					command: "repair",
 					profile
@@ -10914,27 +10957,15 @@ async function main() {
 			break;
 		}
 		case "reset":
-			if (args.includes("--async")) {
-				const ctxArg = args.find((a) => a.startsWith("--ctx="));
-				let ctxBase64;
-				if (ctxArg) ctxBase64 = ctxArg.slice(6);
-				else {
-					const fetched = await fetchCtxViaInnerApi({
-						populate: planCtxPopulate({ command: "reset" }),
-						caller,
-						traceId
-					});
-					ctxBase64 = Buffer.from(JSON.stringify(fetched), "utf-8").toString("base64");
-				}
-				console.log(JSON.stringify(startAsyncReset(ctxBase64)));
-			} else if (args.includes("--worker")) {
+			if (args.includes("--async")) console.log(JSON.stringify(startAsyncReset()));
+			else if (args.includes("--worker")) {
 				const taskId = args.find((a) => a.startsWith("--task-id="))?.slice(10);
 				if (!taskId) {
 					console.error("Error: --task-id=<id> is required for worker");
 					node_process.default.exit(1);
 				}
 				const resultFile = resetResultFile(taskId);
-				const raw = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				const raw = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "reset" }),
 					caller,
 					traceId
@@ -10958,7 +10989,7 @@ async function main() {
 					return;
 				}
 			} else {
-				console.error("Usage: reset --async [--ctx=<base64>] | reset --worker --task-id=<id> [--ctx=<base64>]");
+				console.error("Usage: reset --async | reset --worker --task-id=<id>");
 				node_process.default.exit(1);
 			}
 			break;
@@ -10974,14 +11005,14 @@ async function main() {
 		case "install-openclaw": {
 			const tag = getPositionalTag(args, "install-openclaw");
 			if (!tag) {
-				console.error("Usage: install-openclaw <tag> [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: install-openclaw <tag> [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const ossFileMapFlag = getFlag(args, "oss_file_map");
 			let installOssFileMap;
 			let rawForTelemetry;
 			if (!ossFileMapFlag) {
-				rawForTelemetry = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				rawForTelemetry = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "install" }),
 					caller,
 					traceId
@@ -11016,7 +11047,7 @@ async function main() {
 		case "install-extension": {
 			const tag = getPositionalTag(args, "install-extension");
 			if (!tag) {
-				console.error("Usage: install-extension <tag> (--all | --extension=<name>...) [--home_base=<dir>] [--config_path=<path>] [--skip-config-update] [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: install-extension <tag> (--all | --extension=<name>...) [--home_base=<dir>] [--config_path=<path>] [--skip-config-update] [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const all = args.includes("--all");
@@ -11028,7 +11059,7 @@ async function main() {
 			let installOssFileMap;
 			let rawForTelemetry;
 			if (!ossFileMapFlag) {
-				rawForTelemetry = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				rawForTelemetry = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "install" }),
 					caller,
 					traceId
@@ -11074,12 +11105,12 @@ async function main() {
 		case "install-cli": {
 			const tag = getPositionalTag(args, "install-cli");
 			if (!tag) {
-				console.error("Usage: install-cli <tag> --cli=<name>... [--home_base=<dir>] [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: install-cli <tag> --cli=<name>... [--home_base=<dir>] [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const names = getMultiFlag(args, "cli");
 			if (names.length === 0) {
-				console.error("Usage: install-cli <tag> --cli=<name>... [--home_base=<dir>] [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: install-cli <tag> --cli=<name>... [--home_base=<dir>] [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const homeBase = getFlag(args, "home_base");
@@ -11087,7 +11118,7 @@ async function main() {
 			let installOssFileMap;
 			let rawForTelemetry;
 			if (!ossFileMapFlag) {
-				rawForTelemetry = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				rawForTelemetry = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "install" }),
 					caller,
 					traceId
@@ -11135,7 +11166,7 @@ async function main() {
 		case "download-resource": {
 			const tag = getPositionalTag(args, "download-resource");
 			if (!tag) {
-				console.error("Usage: download-resource <tag> --role=<role> --name=<name> [--dir=<dir>] [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: download-resource <tag> --role=<role> --name=<name> [--dir=<dir>] [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const role = getFlag(args, "role");
@@ -11149,7 +11180,7 @@ async function main() {
 			let installOssFileMap;
 			let rawForTelemetry;
 			if (!ossFileMapFlag) {
-				rawForTelemetry = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				rawForTelemetry = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "install" }),
 					caller,
 					traceId

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/openclaw-scripts-diagnose-cli",
-  "version": "0.1.13-alpha.9",
+  "version": "0.1.14-alpha.0",
   "description": "CLI for OpenClaw config diagnose and repair with JSON5 support",
   "main": "dist/index.cjs",
   "bin": {