@lark-apaas/openclaw-scripts-diagnose-cli 0.1.15-alpha.0 → 0.1.15-alpha.1

package/dist/index.cjs

@@ -52,7 +52,7 @@ node_assert = __toESM(node_assert);
 * it terse and parseable.
 */
 function getVersion() {
-	return "0.1.15-alpha.0";
+	return "0.1.15-alpha.1";
 }
 //#endregion
 //#region src/rule-engine/base.ts
@@ -2520,6 +2520,341 @@ function upsertResourceConstrainedToolsBlock(content) {
 	return `${content}${content.length > 0 && !content.endsWith("\n") ? "\n\n" : "\n"}${RESOURCE_CONSTRAINED_TOOLS_BLOCK}\n`;
 }
 //#endregion
+//#region src/paths.ts
+/**
+* Central directory for all ephemeral diagnose/reset artifacts: task status
+* files (`reset-<taskId>.json`) and human-readable step logs
+* (`reset-<taskId>.log`). Having everything under one dir makes debugging a
+* stuck reset much easier — `ls /tmp/openclaw-diagnose/` shows every recent
+* run, and each run's log is right next to its state.
+*/
+const DIAGNOSE_DIR = "/tmp/openclaw-diagnose";
+function resetResultFile(taskId) {
+	return `${DIAGNOSE_DIR}/reset-${taskId}.json`;
+}
+function resetLogFile(taskId) {
+	return `${DIAGNOSE_DIR}/reset-${taskId}.log`;
+}
+/** Sandbox workspace root where openclaw config + agent state lives. */
+const WORKSPACE_DIR = "/home/gem/workspace/agent";
+/** File containing the provider key used by the openclaw miaoda provider. */
+const PROVIDER_FILE_PATH = "/home/gem/workspace/.force/openclaw/miaoda-provider-key";
+/** File containing the miaoda openclaw secrets JSON. */
+const SECRETS_FILE_PATH = "/home/gem/workspace/.force/openclaw/miaoda-openclaw-secrets.json";
+/** Absolute path to the openclaw config JSON. */
+const CONFIG_PATH = `${WORKSPACE_DIR}/openclaw.json`;
+/** upgrade-lark 每次运行的日志文件路径，含时间戳便于按时间排序定位。 */
+function upgradeLarkLogFile(runId) {
+	return `${DIAGNOSE_DIR}/upgrade-lark-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace(/:/g, "-")}-${runId.slice(0, 8)}.log`;
+}
+//#endregion
+//#region src/lark-cli-init.ts
+const LARK_PLUGIN_NAMES$1 = ["openclaw-lark", "feishu-openclaw-plugin"];
+const PE_XML_TAG = "lark-cli-pe";
+const PE_PLACEHOLDER = `
+<${PE_XML_TAG}>
+**【强制要求 - 无例外】飞书所有操作必须先读 feishu-lark-cli skill。未读skill不得调用任何飞书工具，违者视为操作失误。**
+</${PE_XML_TAG}>
+`;
+function isLarkPluginInstalled(configPath) {
+	const extDir = getExtensionsDir(configPath);
+	return LARK_PLUGIN_NAMES$1.some((name) => {
+		try {
+			return node_fs.default.existsSync(node_path.default.join(extDir, name, "package.json"));
+		} catch {
+			return false;
+		}
+	});
+}
+function isLarkCliAvailable$2() {
+	try {
+		return (0, node_child_process.spawnSync)("lark-cli", ["--version"], {
+			encoding: "utf-8",
+			timeout: 5e3,
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).status === 0;
+	} catch {
+		return false;
+	}
+}
+function readConfig(configPath) {
+	try {
+		const raw = node_fs.default.readFileSync(configPath, "utf-8");
+		const parsed = loadJSON5().parse(raw);
+		return parsed != null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Resolve the feishu app secret for the given appId.
+*
+* Lookup order:
+*   1. channels.feishu.appSecret  (single-agent: feishu.appId === appId)
+*   2. channels.feishu.accounts[key].appSecret  (multi-agent: account.appId === appId)
+*
+* Value interpretation:
+*   - string  → use directly
+*   - object  → secret is managed by a provider; use `feishuAppSecret` param instead
+*
+* Returns null when the secret cannot be determined.
+*/
+function resolveAppSecret(appId, config, feishuAppSecret) {
+	const feishu = getNestedMap(config, "channels", "feishu");
+	if (!feishu) return null;
+	let rawSecret;
+	if (typeof feishu.appId === "string" && feishu.appId === appId) rawSecret = feishu.appSecret;
+	else {
+		const accounts = asRecord(feishu.accounts);
+		if (accounts) for (const [, val] of Object.entries(accounts)) {
+			const account = asRecord(val);
+			if (account?.appId === appId) {
+				rawSecret = account.appSecret ?? feishu.appSecret;
+				break;
+			}
+		}
+	}
+	if (typeof rawSecret === "string" && rawSecret) return rawSecret;
+	if (rawSecret != null && typeof rawSecret === "object") return feishuAppSecret ?? null;
+	return null;
+}
+/**
+* Resolve the agents.md path for the given appId from the openclaw config.
+*
+* Case 1: appId matches channels.feishu.appId (single-agent path)
+*   → WORKSPACE_DIR/AGENTS.md
+*
+* Case 2: appId found in channels.feishu.accounts (multi-agent path)
+*   → find account key where account.appId === appId
+*   → find binding where match.channel=feishu && match.accountId=that key
+*   → if agentId === 'main'  → WORKSPACE_DIR/agents.md
+*   → else find agent in agents.list by id → agent.workspace/agents.md
+*
+* Returns null when the path cannot be determined.
+*/
+function resolveAgentsMdPath(appId, config) {
+	const feishu = getNestedMap(config, "channels", "feishu");
+	if (!feishu) {
+		console.error("resolveAgentsMdPath: channels.feishu not found");
+		return null;
+	}
+	if (typeof feishu.appId === "string" && feishu.appId === appId) {
+		console.error(`resolveAgentsMdPath: case=single-agent feishu.appId=${feishu.appId}`);
+		return node_path.default.join(WORKSPACE_DIR, "workspace", "AGENTS.md");
+	}
+	const accounts = asRecord(feishu.accounts);
+	if (!accounts) {
+		console.error("resolveAgentsMdPath: feishu.accounts not found");
+		return null;
+	}
+	let accountId;
+	for (const [key, val] of Object.entries(accounts)) if (asRecord(val)?.appId === appId) {
+		accountId = key;
+		break;
+	}
+	if (!accountId) {
+		console.error(`resolveAgentsMdPath: no account found with appId=${appId} in feishu.accounts keys=[${Object.keys(accounts).join(",")}]`);
+		return null;
+	}
+	console.error(`resolveAgentsMdPath: found accountId=${accountId}`);
+	const bindings = Array.isArray(config.bindings) ? config.bindings : [];
+	let agentId;
+	for (const b of bindings) {
+		const binding = asRecord(b);
+		if (!binding) continue;
+		const match = asRecord(binding.match);
+		if (match?.channel === "feishu" && match?.accountId === accountId) {
+			if (typeof binding.agentId === "string") {
+				agentId = binding.agentId;
+				break;
+			}
+		}
+	}
+	if (!agentId) {
+		console.error(`resolveAgentsMdPath: no binding found for accountId=${accountId} in bindings(count=${bindings.length})`);
+		return null;
+	}
+	console.error(`resolveAgentsMdPath: found agentId=${agentId}`);
+	if (agentId === "main") {
+		console.error("resolveAgentsMdPath: case=multi-agent-main");
+		return node_path.default.join(WORKSPACE_DIR, "workspace", "AGENTS.md");
+	}
+	const agentsObj = asRecord(config.agents);
+	const list = Array.isArray(agentsObj?.list) ? agentsObj.list : [];
+	for (const a of list) {
+		const agent = asRecord(a);
+		if (agent?.id === agentId) {
+			const ws = typeof agent.workspace === "string" ? agent.workspace : node_path.default.join(WORKSPACE_DIR, "workspace");
+			console.error(`resolveAgentsMdPath: case=multi-agent-custom agentId=${agentId} workspace=${ws}`);
+			return node_path.default.join(ws, "AGENTS.md");
+		}
+	}
+	console.error(`resolveAgentsMdPath: agentId=${agentId} not found in agents.list(count=${list.length})`);
+	return null;
+}
+function appendPeToAgentsMd(agentsMdPath) {
+	const dir = node_path.default.dirname(agentsMdPath);
+	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
+	const existing = node_fs.default.existsSync(agentsMdPath) ? node_fs.default.readFileSync(agentsMdPath, "utf-8") : "";
+	if (existing.includes(`<lark-cli-pe>`)) {
+		console.error(`lark-cli-init: <${PE_XML_TAG}> already present in ${agentsMdPath}, skipping`);
+		return;
+	}
+	const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+	node_fs.default.appendFileSync(agentsMdPath, `${sep}${PE_PLACEHOLDER}`, "utf-8");
+	console.error(`lark-cli-init: appended PE placeholder to ${agentsMdPath}`);
+}
+/**
+* Collect every Feishu bot appId declared in the openclaw config.
+* Covers both single-agent (channels.feishu.appId) and multi-agent
+* (channels.feishu.accounts[*].appId) layouts. Returns a deduplicated list.
+*/
+function collectFeishuAppIds(configPath) {
+	const config = readConfig(configPath ?? CONFIG_PATH);
+	if (!config) return [];
+	const feishu = getNestedMap(config, "channels", "feishu");
+	if (!feishu) return [];
+	const appIds = /* @__PURE__ */ new Set();
+	const topAppId = feishu.appId;
+	if (typeof topAppId === "string" && topAppId.trim()) appIds.add(topAppId.trim());
+	const accounts = asRecord(feishu.accounts);
+	if (accounts) for (const val of Object.values(accounts)) {
+		const appId = asRecord(val)?.appId;
+		if (typeof appId === "string" && appId.trim()) appIds.add(appId.trim());
+	}
+	return [...appIds];
+}
+function runLarkCliInit(opts) {
+	const configPath = opts.configPath ?? CONFIG_PATH;
+	if (!isLarkPluginInstalled(configPath)) {
+		console.error("lark-cli-init: skipping — openclaw-lark plugin not installed");
+		return {
+			ok: true,
+			skipped: true,
+			skipReason: "openclaw-lark plugin not installed"
+		};
+	}
+	if (!isLarkCliAvailable$2()) {
+		console.error("lark-cli-init: skipping — lark-cli command not found");
+		return {
+			ok: true,
+			skipped: true,
+			skipReason: "lark-cli command not found"
+		};
+	}
+	const config = readConfig(configPath);
+	if (!config) return {
+		ok: false,
+		error: `could not read config at ${configPath}`
+	};
+	const agentsMdPath = resolveAgentsMdPath(opts.appId, config);
+	console.error(`lark-cli-init: resolved agents.md path=${agentsMdPath ?? "(null)"}`);
+	if (!agentsMdPath) return {
+		ok: false,
+		error: `could not resolve agents.md path for appId=${opts.appId}`
+	};
+	const appSecret = resolveAppSecret(opts.appId, config, opts.feishuAppSecret);
+	if (!appSecret) return {
+		ok: false,
+		error: `could not resolve appSecret for appId=${opts.appId}`
+	};
+	console.error(`lark-cli-init: running lark-cli config init --name ${opts.appId} --app-id ${opts.appId} --brand feishu --app-secret-stdin --force-init`);
+	const initRes = (0, node_child_process.spawnSync)("lark-cli", [
+		"config",
+		"init",
+		"--name",
+		opts.appId,
+		"--app-id",
+		opts.appId,
+		"--brand",
+		"feishu",
+		"--app-secret-stdin",
+		"--force-init"
+	], {
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		encoding: "utf-8",
+		input: appSecret
+	});
+	const configInitStdout = initRes.stdout?.trim() || void 0;
+	const configInitStderr = initRes.stderr?.trim() || void 0;
+	if (configInitStdout) console.error(`lark-cli config init stdout: ${configInitStdout}`);
+	if (configInitStderr) console.error(`lark-cli config init stderr: ${configInitStderr}`);
+	if (initRes.error) return {
+		ok: false,
+		configInitStdout,
+		configInitStderr,
+		error: `lark-cli config init spawn error: ${initRes.error.message}`
+	};
+	if (initRes.status !== 0) return {
+		ok: false,
+		configInitExitCode: initRes.status ?? void 0,
+		configInitStdout,
+		configInitStderr,
+		error: `lark-cli config init exited with code ${initRes.status}`
+	};
+	appendPeToAgentsMd(agentsMdPath);
+	return {
+		ok: true,
+		configInitExitCode: 0,
+		agentsMdPath
+	};
+}
+//#endregion
+//#region src/rules/agents-md-lark-cli-pe.ts
+function isLarkCliAvailable$1() {
+	try {
+		return (0, node_child_process.spawnSync)("lark-cli", ["--version"], {
+			encoding: "utf-8",
+			timeout: 5e3,
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).status === 0;
+	} catch {
+		return false;
+	}
+}
+let AgentsMdLarkCliPeRule = class AgentsMdLarkCliPeRule extends DiagnoseRule {
+	validate(ctx) {
+		if (!isLarkCliAvailable$1()) return { pass: true };
+		const missingPath = collectExistingAgentsMdPaths(ctx).find((filePath) => {
+			return !node_fs.default.readFileSync(filePath, "utf-8").includes(`<${PE_XML_TAG}>`);
+		});
+		if (!missingPath) return { pass: true };
+		return {
+			pass: false,
+			message: `${missingPath} 中缺少 lark-cli-pe PE 内容，需要追加`
+		};
+	}
+	repair(ctx) {
+		if (!isLarkCliAvailable$1()) return;
+		for (const filePath of collectExistingAgentsMdPaths(ctx)) {
+			const content = node_fs.default.readFileSync(filePath, "utf-8");
+			if (content.includes(`<lark-cli-pe>`)) continue;
+			const sep = content.length > 0 && !content.endsWith("\n") ? "\n" : "";
+			node_fs.default.appendFileSync(filePath, `${sep}${PE_PLACEHOLDER}`, "utf-8");
+			console.error(`agents-md-lark-cli-pe: appended PE to ${filePath}`);
+		}
+	}
+};
+AgentsMdLarkCliPeRule = __decorate([Rule({
+	key: "agents_md_lark_cli_pe",
+	description: "检测各智能体 AGENTS.md 中是否缺失 lark-cli-pe PE 内容，lark-cli 存在时自动追加",
+	dependsOn: ["config_syntax_check"],
+	repairMode: "standard",
+	level: "silent"
+})], AgentsMdLarkCliPeRule);
+//#endregion
 //#region src/rules/miaoda-official-plugins-install-spec-unlock.ts
 /**
 * Official miaoda-side plugins that must track manifest — version-locked specs
@@ -2623,11 +2958,11 @@ function getAllow$1(config) {
 //#region src/rules/lark-plugin-allow.ts
 const LARK_PLUGIN = "openclaw-lark";
 const LEGACY_LARK_PLUGIN = "feishu-openclaw-plugin";
-const LARK_PLUGIN_NAMES$1 = [LARK_PLUGIN, LEGACY_LARK_PLUGIN];
+const LARK_PLUGIN_NAMES = [LARK_PLUGIN, LEGACY_LARK_PLUGIN];
 let LarkPluginAllowRule = class LarkPluginAllowRule extends DiagnoseRule {
 	validate(ctx) {
 		const allow = getAllow(ctx.config);
-		if (LARK_PLUGIN_NAMES$1.some((name) => allow.includes(name))) return { pass: true };
+		if (LARK_PLUGIN_NAMES.some((name) => allow.includes(name))) return { pass: true };
 		const installed = detectInstalledLarkPlugin(getExtensionsDir(ctx.configPath));
 		if (installed == null) return { pass: true };
 		return {
@@ -2646,7 +2981,7 @@ let LarkPluginAllowRule = class LarkPluginAllowRule extends DiagnoseRule {
 		const rawAllow = pluginsMap.allow;
 		const original = Array.isArray(rawAllow) ? rawAllow : [];
 		const stringAllow = original.filter((e) => typeof e === "string");
-		if (LARK_PLUGIN_NAMES$1.some((name) => stringAllow.includes(name))) return;
+		if (LARK_PLUGIN_NAMES.some((name) => stringAllow.includes(name))) return;
 		original.push(installed);
 		pluginsMap.allow = original;
 	}
@@ -3420,11 +3755,14 @@ FeishuPluginLarkUpgradeRule = __decorate([Rule({
 	usesVars: ["recommendedOpenclawTag"]
 })], FeishuPluginLarkUpgradeRule);
 /**
-* Core predicate: returns true when the lark plugin needs upgrading for a
-* non-fork plugin, based on version compatibility with the current openclaw.
+* 核心判断：非 fork 插件是否需要升级 lark，基于当前 openclaw 版本的兼容性。
+*
+* 被 FeishuPluginLarkUpgradeRule.validate 和 needsLarkUpgrade 共用。
+* 调用方需在调用前自行处理 fork 插件的情况（fork 插件不走本函数）。
 *
-* Shared by FeishuPluginLarkUpgradeRule.validate and needsLarkUpgrade.
-* Callers must handle fork plugin cases before invoking this function.
+* - 有 recommendedOc：走 resolveUpgradeDirection 判断方向是否为 'lark'
+* - 无 recommendedOc（doctor 无推荐版本）：legacy 插件直接需要升级；
+*   非 legacy 则检查当前版本是否在兼容表内
 */
 function isLarkUpgradeNeededFromCC(cc) {
 	const { ocCur, recommendedOc, installed, isLegacy } = cc;
@@ -3526,9 +3864,8 @@ function extractScopedNameFromSpec$1(spec) {
 	return at === -1 ? spec : spec.slice(0, at);
 }
 /**
-* Returns true if the installed feishu plugin is version-incompatible with
-* the current openclaw (or is a legacy plugin that must be replaced).
-* Used by the upgrade_lark_needed rule and the upgrade-lark pre-check gate.
+* 判断已安装的飞书插件是否与当前 openclaw 版本不兼容（或为需要替换的 legacy 插件）。
+* 被 upgrade-lark 前置检测门控（--check-only 和正式安装模式）调用。
 */
 function needsLarkUpgrade(ctx) {
 	const cc = resolveCompatContext({
@@ -3547,177 +3884,6 @@ function needsLarkUpgrade(ctx) {
 	return isLarkUpgradeNeededFromCC(cc);
 }
 //#endregion
-//#region src/channels-probe.ts
-const FEISHU_INVALID_CONFIG_MSG = "channels.feishu: invalid config: must NOT have additional properties";
-const CHANNEL_LINE_RE = /^-\s+Feishu\s+([^:]+):\s+(.+)$/;
-/**
-* Port of Python `_account_is_working` from the feishu-channel-success-rate skill.
-*
-* Strips colon-prefixed key:value bits (dm:, bot:, in:, out:, token:, allow:,
-* intents:, groups:, health:) and evaluates the canonical health formula.
-*
-* @param ignoreProbeFailed  When true, "probe failed" is not treated as a failure condition.
-* @param gatewayReachable   When false, only enabled+configured is required — the service
-*   is not started yet so "running" cannot be present, but config presence is sufficient.
-*/
-function accountIsWorking(bits, ignoreProbeFailed = true, gatewayReachable = true) {
-	const bitTokens = /* @__PURE__ */ new Set();
-	let hasError = false;
-	let hasProbeFailed = false;
-	for (const raw of bits) {
-		const b = raw.trim();
-		if (!b) continue;
-		if (b.startsWith("error:")) {
-			hasError = true;
-			continue;
-		}
-		if (b === "probe failed") {
-			hasProbeFailed = true;
-			continue;
-		}
-		bitTokens.add(b.split(":")[0]);
-	}
-	if (!bitTokens.has("enabled") || !bitTokens.has("configured")) return false;
-	if (!gatewayReachable) return true;
-	if (bitTokens.has("works")) return true;
-	if (bitTokens.has("running") && !hasError && (ignoreProbeFailed || !hasProbeFailed)) return true;
-	return false;
-}
-/**
-* Parse the raw stdout of `openclaw channels status --probe`.
-* Port of Python `extract_channels_probe` from the feishu-channel-success-rate skill.
-*/
-function parseChannelsProbeOutput(text, { ignoreProbeFailed = true } = {}) {
-	const gatewayReachable = text.includes("Gateway reachable");
-	const feishuConfigInvalid = text.includes(FEISHU_INVALID_CONFIG_MSG);
-	const accounts = [];
-	let anyAccountWorking = false;
-	for (const line of text.split("\n")) {
-		const m = CHANNEL_LINE_RE.exec(line.trim());
-		if (!m) continue;
-		const [, acct, rest] = m;
-		const bits = rest.split(",").map((b) => b.trim());
-		const isWorking = accountIsWorking(bits, ignoreProbeFailed, gatewayReachable);
-		if (isWorking) anyAccountWorking = true;
-		accounts.push({
-			id: acct.trim(),
-			bits,
-			isWorking,
-			raw: line.trim()
-		});
-	}
-	return {
-		gatewayReachable,
-		feishuConfigInvalid,
-		accounts,
-		anyAccountWorking
-	};
-}
-/**
-* Run `openclaw channels status --probe` and return a structured result.
-*
-* The command may exit non-zero when some bot accounts fail their probe — that
-* is still useful output.  We therefore try to parse stdout even when the
-* process exits with a non-zero code, falling back to an unavailable result
-* only when there is genuinely no output to parse.
-*
-* @param timeoutMs         Maximum wait time.  Default is 60 s because v2026.4.x
-*   lacks a per-request HTTP timeout and can block indefinitely.
-* @param ignoreProbeFailed When true, accounts with "probe failed" are still
-*   counted as working.  Pass true for upgrade-gate checks where probe failures
-*   reflect network conditions rather than plugin misconfiguration.
-*/
-function runChannelsProbe(timeoutMs = 6e4, { ignoreProbeFailed = true } = {}) {
-	let stdout = "";
-	let stderrText = "";
-	let execError;
-	try {
-		stdout = (0, node_child_process.execSync)("openclaw channels status --probe", {
-			encoding: "utf-8",
-			timeout: timeoutMs,
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			]
-		});
-	} catch (e) {
-		const err = e;
-		const stdoutRaw = err.stdout;
-		stdout = typeof stdoutRaw === "string" ? stdoutRaw : stdoutRaw?.toString("utf-8") ?? "";
-		execError = err.message;
-		const stderrRaw = err.stderr;
-		stderrText = (typeof stderrRaw === "string" ? stderrRaw : stderrRaw?.toString("utf-8") ?? "").trim();
-		if (stderrText) console.error(`channels-probe: stderr from CLI: ${stderrText}`);
-	}
-	if (stdout.trim()) return {
-		available: true,
-		...parseChannelsProbeOutput(stdout, { ignoreProbeFailed })
-	};
-	return {
-		available: false,
-		gatewayReachable: false,
-		feishuConfigInvalid: stderrText.includes(FEISHU_INVALID_CONFIG_MSG),
-		accounts: [],
-		anyAccountWorking: false,
-		error: execError ?? "no output from openclaw channels status --probe"
-	};
-}
-//#endregion
-//#region src/rules/upgrade-lark-needed.ts
-/**
-* Detects the condition that warrants running `upgrade-lark`:
-*   - feishu plugin version incompatible with current openclaw, OR
-*   - openclaw channels status --probe reports feishu channel config invalid; AND
-*   - channels are not working.
-*
-* Both conditions must be true simultaneously. If version is compatible and
-* feishu config is valid, or channels are working, the rule passes (no action needed).
-*
-* feishuConfigInvalid is read from the channels probe output rather than running a
-* separate `openclaw status` call, since only `openclaw channels status --probe`
-* reliably surfaces the schema validation error.
-*
-* profile: experimental — runs only in full sweep mode, not in standard doctor.
-* level: silent — telemetry/sweep-only, does not trigger page-level repair UI.
-*/
-let UpgradeLarkNeededRule = class UpgradeLarkNeededRule extends DiagnoseRule {
-	validate(ctx) {
-		let versionIncompatible = false;
-		try {
-			versionIncompatible = needsLarkUpgrade(ctx);
-		} catch {}
-		let probeResult;
-		try {
-			probeResult = runChannelsProbe(6e4);
-		} catch {
-			probeResult = {
-				available: false,
-				gatewayReachable: false,
-				feishuConfigInvalid: false,
-				accounts: [],
-				anyAccountWorking: false
-			};
-		}
-		const feishuConfigInvalid = probeResult.feishuConfigInvalid;
-		if (!(versionIncompatible || feishuConfigInvalid)) return { pass: true };
-		if (probeResult.anyAccountWorking) return { pass: true };
-		return {
-			pass: false,
-			action: "upgrade_lark",
-			message: `飞书插件需要升级且 channels 不可用（版本不兼容=${versionIncompatible}, feishu配置无效=${feishuConfigInvalid}），建议执行 upgrade-lark 命令升级飞书插件`
-		};
-	}
-};
-UpgradeLarkNeededRule = __decorate([Rule({
-	key: "upgrade_lark_needed",
-	description: "检测飞书插件版本不兼容且 channels 不可用，判断是否需要执行 upgrade-lark 升级",
-	dependsOn: ["config_syntax_check"],
-	repairMode: "check-only",
-	level: "silent",
-	profile: "experimental"
-})], UpgradeLarkNeededRule);
-//#endregion
 //#region src/rules/cleanup-install-backup-dirs.ts
 const DIR_PREFIX = ".openclaw-install-";
 function resolveExtensionsDir(configPath) {
@@ -3800,7 +3966,7 @@ function extractScopedNameFromSpec(spec) {
 	const at = spec.indexOf("@", 1);
 	return at === -1 ? spec : spec.slice(0, at);
 }
-function isLarkCliAvailable$1() {
+function isLarkCliAvailable() {
 	try {
 		return (0, node_child_process.spawnSync)(LARK_CLI_NAME$1, ["--version"], {
 			encoding: "utf-8",
@@ -3841,7 +4007,7 @@ function installLarkCliOnce(tag) {
 let LarkCliMissingForInstalledLarkPluginRule = class LarkCliMissingForInstalledLarkPluginRule extends DiagnoseRule {
 	validate(ctx) {
 		if (!isTargetForkPlugin(readInstalledLarkPlugin(ctx))) return { pass: true };
-		if (isLarkCliAvailable$1()) return { pass: true };
+		if (isLarkCliAvailable()) return { pass: true };
 		return {
 			pass: false,
 			message: `${FORK_PACKAGE_NAME}@${TARGET_VERSION} 已安装，但 lark-cli 不可用；将执行一次 lark-cli 安装`
@@ -3849,7 +4015,7 @@ let LarkCliMissingForInstalledLarkPluginRule = class LarkCliMissingForInstalledL
 	}
 	repair(ctx) {
 		if (!isTargetForkPlugin(readInstalledLarkPlugin(ctx))) return;
-		if (isLarkCliAvailable$1()) return;
+		if (isLarkCliAvailable()) return;
 		installLarkCliOnce(ctx.vars.recommendedOpenclawTag ?? TARGET_VERSION);
 	}
 };
@@ -3862,6 +4028,117 @@ LarkCliMissingForInstalledLarkPluginRule = __decorate([Rule({
 	usesVars: ["recommendedOpenclawTag"]
 })], LarkCliMissingForInstalledLarkPluginRule);
 //#endregion
+//#region src/rules/feishu-bot-channel-config.ts
+/**
+* Ensures each bot account's channel config is correct:
+*   1. `allowFrom` contains its own `creatorOpenID` from larkApps
+*   2. `appSecret` is either the canonical provider-ref or matches larkApps plaintext
+*
+* Covers both multi-account (channels.feishu.accounts) and single-account
+* (channels.feishu.appId + allowFrom at top level) layouts.
+*/
+let FeishuBotChannelConfigRule = class FeishuBotChannelConfigRule extends DiagnoseRule {
+	validate(ctx) {
+		const larkApps = ctx.vars.larkApps;
+		if (!larkApps || larkApps.length === 0) return { pass: true };
+		const feishu = asRecord(getNestedMap(ctx.config, "channels", "feishu"));
+		if (!feishu) return { pass: true };
+		const issues = [];
+		const accounts = asRecord(feishu.accounts);
+		if (accounts) for (const [accountId, account] of Object.entries(accounts)) {
+			const bot = asRecord(account);
+			if (!bot) continue;
+			const appId = bot.appId;
+			if (typeof appId !== "string" || !appId.startsWith("cli_")) continue;
+			const larkApp = larkApps.find((e) => e.larkAppID === appId);
+			if (!larkApp) continue;
+			this.checkBot(accountId, bot, larkApp, issues);
+		}
+		const singleAppId = feishu.appId;
+		if (typeof singleAppId === "string" && singleAppId.startsWith("cli_") && !accounts) {
+			const larkApp = larkApps.find((e) => e.larkAppID === singleAppId);
+			if (larkApp) this.checkBot("feishu", feishu, larkApp, issues);
+		}
+		if (issues.length === 0) return { pass: true };
+		return {
+			pass: false,
+			message: issues.join("; ")
+		};
+	}
+	/** Check a single bot entry (either an account object or the feishu channel itself).
+	*  appSecret is validated based on its current type:
+	*  - object → must match canonical provider-ref
+	*  - string → must match larkApps plaintext
+	*/
+	checkBot(label, bot, larkApp, issues) {
+		const creatorOpenID = larkApp.creatorOpenID;
+		const allowFrom = Array.isArray(bot.allowFrom) ? bot.allowFrom : [];
+		if (typeof creatorOpenID === "string" && creatorOpenID !== "") {
+			if (!allowFrom.includes(creatorOpenID)) issues.push(`${label} allowFrom missing creatorOpenID ${creatorOpenID.length > 8 ? creatorOpenID.slice(0, 4) + "***" + creatorOpenID.slice(-4) : "***"}`);
+		} else if (allowFrom.length === 0) issues.push(`${label} allowFrom is empty (creatorOpenID unavailable, cannot auto-fix)`);
+		const secret = bot.appSecret;
+		if (typeof secret === "object" && secret !== null && !Array.isArray(secret)) {
+			if (!matchMap(secret, DEFAULT_FEISHU_APP_SECRET)) issues.push(`${label} appSecret is a provider-ref but not the canonical one`);
+		} else if (typeof secret === "string") {
+			if (secret !== larkApp.appSecret) issues.push(`${label} appSecret plaintext mismatch`);
+		} else issues.push(`${label} appSecret has unexpected type ${typeof secret}`);
+	}
+	repair(ctx) {
+		const larkApps = ctx.vars.larkApps;
+		if (!larkApps || larkApps.length === 0) return;
+		const feishu = asRecord(getNestedMap(ctx.config, "channels", "feishu"));
+		if (!feishu) return;
+		const accounts = asRecord(feishu.accounts);
+		if (accounts) for (const [, account] of Object.entries(accounts)) {
+			const bot = asRecord(account);
+			if (!bot) continue;
+			const appId = bot.appId;
+			if (typeof appId !== "string" || !appId.startsWith("cli_")) continue;
+			const larkApp = larkApps.find((e) => e.larkAppID === appId);
+			if (!larkApp) continue;
+			this.fixBot(bot, larkApp);
+		}
+		const singleAppId = feishu.appId;
+		if (typeof singleAppId === "string" && singleAppId.startsWith("cli_") && !accounts) {
+			const larkApp = larkApps.find((e) => e.larkAppID === singleAppId);
+			if (larkApp) this.fixBot(feishu, larkApp);
+		}
+	}
+	/** Fix a single bot entry in-place.
+	*  appSecret is repaired based on its current type:
+	*  - object → fix to canonical provider-ref
+	*  - string → fix to larkApps plaintext
+	*/
+	fixBot(bot, larkApp) {
+		const creatorOpenID = larkApp.creatorOpenID;
+		if (typeof creatorOpenID === "string" && creatorOpenID !== "") {
+			const allowFrom = Array.isArray(bot.allowFrom) ? [...bot.allowFrom] : [];
+			if (!allowFrom.includes(creatorOpenID)) {
+				allowFrom.push(creatorOpenID);
+				bot.allowFrom = allowFrom;
+			}
+		}
+		const secret = bot.appSecret;
+		if (typeof secret === "object" && secret !== null && !Array.isArray(secret)) {
+			if (!matchMap(secret, DEFAULT_FEISHU_APP_SECRET)) bot.appSecret = { ...DEFAULT_FEISHU_APP_SECRET };
+		} else if (typeof secret === "string") {
+			if (secret !== larkApp.appSecret) bot.appSecret = larkApp.appSecret;
+		}
+	}
+};
+FeishuBotChannelConfigRule = __decorate([Rule({
+	key: "feishu_bot_channel_config",
+	description: "确保飞书配置中 bot 账号的 allowFrom 包含其创建者 openID 且 appSecret 值正确",
+	dependsOn: [
+		"config_syntax_check",
+		"feishu_default_account",
+		"feishu_bot_id"
+	],
+	repairMode: "standard",
+	usesVars: ["larkApps"],
+	level: "critical"
+})], FeishuBotChannelConfigRule);
+//#endregion
 //#region src/check.ts
 /** Telemetry-aware entry: returns both the legacy CheckResult (for stdout)
 *  AND a DoctorReport-shape payload (for `openclaw.report_cli_run`). The
@@ -4274,59 +4551,32 @@ function finalize$1(results, aborted) {
 	};
 	for (const r of results) switch (r.status) {
 		case "pass":
-			summary.pass++;
-			break;
-		case "failed":
-			summary.failed++;
-			break;
-		case "fixed":
-			summary.fixed++;
-			break;
-		case "still-broken":
-			summary.stillBroken++;
-			break;
-		case "skipped":
-			summary.skipped++;
-			break;
-		case "error":
-			summary.error++;
-			break;
-		case "unknown":
-			summary.unknown++;
-			break;
-	}
-	return {
-		results,
-		summary,
-		aborted
-	};
-}
-//#endregion
-//#region src/paths.ts
-/**
-* Central directory for all ephemeral diagnose/reset artifacts: task status
-* files (`reset-<taskId>.json`) and human-readable step logs
-* (`reset-<taskId>.log`). Having everything under one dir makes debugging a
-* stuck reset much easier — `ls /tmp/openclaw-diagnose/` shows every recent
-* run, and each run's log is right next to its state.
-*/
-const DIAGNOSE_DIR = "/tmp/openclaw-diagnose";
-function resetResultFile(taskId) {
-	return `${DIAGNOSE_DIR}/reset-${taskId}.json`;
-}
-function resetLogFile(taskId) {
-	return `${DIAGNOSE_DIR}/reset-${taskId}.log`;
-}
-/** Sandbox workspace root where openclaw config + agent state lives. */
-const WORKSPACE_DIR = "/home/gem/workspace/agent";
-/** File containing the provider key used by the openclaw miaoda provider. */
-const PROVIDER_FILE_PATH = "/home/gem/workspace/.force/openclaw/miaoda-provider-key";
-/** File containing the miaoda openclaw secrets JSON. */
-const SECRETS_FILE_PATH = "/home/gem/workspace/.force/openclaw/miaoda-openclaw-secrets.json";
-/** Absolute path to the openclaw config JSON. */
-const CONFIG_PATH = `${WORKSPACE_DIR}/openclaw.json`;
-function upgradeLarkLogFile(runId) {
-	return `${DIAGNOSE_DIR}/upgrade-lark-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace(/:/g, "-")}-${runId.slice(0, 8)}.log`;
+			summary.pass++;
+			break;
+		case "failed":
+			summary.failed++;
+			break;
+		case "fixed":
+			summary.fixed++;
+			break;
+		case "still-broken":
+			summary.stillBroken++;
+			break;
+		case "skipped":
+			summary.skipped++;
+			break;
+		case "error":
+			summary.error++;
+			break;
+		case "unknown":
+			summary.unknown++;
+			break;
+	}
+	return {
+		results,
+		summary,
+		aborted
+	};
 }
 //#endregion
 //#region src/run-log.ts
@@ -4464,9 +4714,10 @@ function makeLogger(logFile) {
 /**
 * Start an async reset task: spawn a detached child process and return the taskId.
 *
-* The child process runs: node cli.js reset --worker --task-id=xxx --ctx=base64
+* The child process runs: node cli.js reset --worker --task-id=xxx
+* The worker fetches ctx from innerApi itself — no --ctx passthrough.
 */
-function startAsyncReset(ctxBase64) {
+function startAsyncReset() {
 	const taskId = (0, node_crypto.randomUUID)();
 	const resultFile = resetResultFile(taskId);
 	const log = makeLogger(resetLogFile(taskId));
@@ -4490,8 +4741,7 @@ function startAsyncReset(ctxBase64) {
 		process.argv[1],
 		"reset",
 		"--worker",
-		`--task-id=${taskId}`,
-		`--ctx=${ctxBase64}`
+		`--task-id=${taskId}`
 	], {
 		detached: true,
 		stdio: "ignore",
@@ -4857,309 +5107,49 @@ function updatePluginInstalls(configPath, installedPkgs) {
 	for (const pkg of installedPkgs) {
 		if (!PLUGINS_TO_AUTO_ENABLE.includes(pkg.name)) continue;
 		if (!Array.isArray(plugins.allow)) plugins.allow = [];
-		const allow = plugins.allow;
-		if (!allow.includes(pkg.name)) allow.push(pkg.name);
-		if (!plugins.entries || typeof plugins.entries !== "object" || Array.isArray(plugins.entries)) plugins.entries = {};
-		const entries = plugins.entries;
-		entries[pkg.name] = {
-			...asRecord(entries[pkg.name]) ?? {},
-			enabled: true
-		};
-	}
-	const tmpPath = configPath + ".installs-tmp";
-	node_fs.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2), "utf-8");
-	moveSafe(tmpPath, configPath);
-	console.error(`[install-extension] plugins.installs updated: ${updated} entry(ies) in ${configPath}` + (skipped > 0 ? ` (${skipped} package(s) without installMetadata skipped)` : ""));
-}
-function installOne$1(pkg, tarball, homeBase) {
-	const destDir = node_path.default.join(homeBase, pkg.installPath);
-	const stagingDir = destDir + ".new";
-	const oldDir = destDir + ".old";
-	node_fs.default.mkdirSync(node_path.default.dirname(destDir), { recursive: true });
-	if (node_fs.default.existsSync(stagingDir)) node_fs.default.rmSync(stagingDir, {
-		recursive: true,
-		force: true
-	});
-	node_fs.default.mkdirSync(stagingDir);
-	try {
-		extractTarballTolerant(tarball, stagingDir, { stripComponents: 1 });
-		if (!node_fs.default.existsSync(node_path.default.join(stagingDir, "package.json"))) throw new Error(`extension tarball missing package.json: ${pkg.name}`);
-	} catch (e) {
-		try {
-			node_fs.default.rmSync(stagingDir, {
-				recursive: true,
-				force: true
-			});
-		} catch {}
-		throw e;
-	}
-	const hadOld = node_fs.default.existsSync(destDir);
-	if (hadOld) moveSafe(destDir, oldDir);
-	moveSafe(stagingDir, destDir);
-	if (hadOld && node_fs.default.existsSync(oldDir)) node_fs.default.rmSync(oldDir, {
-		recursive: true,
-		force: true
-	});
-}
-//#endregion
-//#region src/lark-cli-init.ts
-const LARK_PLUGIN_NAMES = ["openclaw-lark", "feishu-openclaw-plugin"];
-const PE_XML_TAG = "lark-cli-pe";
-const PE_PLACEHOLDER = `
-<${PE_XML_TAG}>
-**【强制要求 - 无例外】飞书所有操作必须先读 feishu-lark-cli skill。未读skill不得调用任何飞书工具，违者视为操作失误。**
-</${PE_XML_TAG}>
-`;
-function isLarkPluginInstalled(configPath) {
-	const extDir = getExtensionsDir(configPath);
-	return LARK_PLUGIN_NAMES.some((name) => {
-		try {
-			return node_fs.default.existsSync(node_path.default.join(extDir, name, "package.json"));
-		} catch {
-			return false;
-		}
-	});
-}
-function isLarkCliAvailable() {
-	try {
-		return (0, node_child_process.spawnSync)("lark-cli", ["--version"], {
-			encoding: "utf-8",
-			timeout: 5e3,
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).status === 0;
-	} catch {
-		return false;
-	}
-}
-function readConfig(configPath) {
-	try {
-		const raw = node_fs.default.readFileSync(configPath, "utf-8");
-		const parsed = loadJSON5().parse(raw);
-		return parsed != null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Resolve the feishu app secret for the given appId.
-*
-* Lookup order:
-*   1. channels.feishu.appSecret  (single-agent: feishu.appId === appId)
-*   2. channels.feishu.accounts[key].appSecret  (multi-agent: account.appId === appId)
-*
-* Value interpretation:
-*   - string  → use directly
-*   - object  → secret is managed by a provider; use `feishuAppSecret` param instead
-*
-* Returns null when the secret cannot be determined.
-*/
-function resolveAppSecret(appId, config, feishuAppSecret) {
-	const feishu = getNestedMap(config, "channels", "feishu");
-	if (!feishu) return null;
-	let rawSecret;
-	if (typeof feishu.appId === "string" && feishu.appId === appId) rawSecret = feishu.appSecret;
-	else {
-		const accounts = asRecord(feishu.accounts);
-		if (accounts) for (const [, val] of Object.entries(accounts)) {
-			const account = asRecord(val);
-			if (account?.appId === appId) {
-				rawSecret = account.appSecret ?? feishu.appSecret;
-				break;
-			}
-		}
-	}
-	if (typeof rawSecret === "string" && rawSecret) return rawSecret;
-	if (rawSecret != null && typeof rawSecret === "object") return feishuAppSecret ?? null;
-	return null;
-}
-/**
-* Resolve the agents.md path for the given appId from the openclaw config.
-*
-* Case 1: appId matches channels.feishu.appId (single-agent path)
-*   → WORKSPACE_DIR/AGENTS.md
-*
-* Case 2: appId found in channels.feishu.accounts (multi-agent path)
-*   → find account key where account.appId === appId
-*   → find binding where match.channel=feishu && match.accountId=that key
-*   → if agentId === 'main'  → WORKSPACE_DIR/agents.md
-*   → else find agent in agents.list by id → agent.workspace/agents.md
-*
-* Returns null when the path cannot be determined.
-*/
-function resolveAgentsMdPath(appId, config) {
-	const feishu = getNestedMap(config, "channels", "feishu");
-	if (!feishu) {
-		console.error("resolveAgentsMdPath: channels.feishu not found");
-		return null;
-	}
-	if (typeof feishu.appId === "string" && feishu.appId === appId) {
-		console.error(`resolveAgentsMdPath: case=single-agent feishu.appId=${feishu.appId}`);
-		return node_path.default.join(WORKSPACE_DIR, "workspace", "AGENTS.md");
-	}
-	const accounts = asRecord(feishu.accounts);
-	if (!accounts) {
-		console.error("resolveAgentsMdPath: feishu.accounts not found");
-		return null;
-	}
-	let accountId;
-	for (const [key, val] of Object.entries(accounts)) if (asRecord(val)?.appId === appId) {
-		accountId = key;
-		break;
-	}
-	if (!accountId) {
-		console.error(`resolveAgentsMdPath: no account found with appId=${appId} in feishu.accounts keys=[${Object.keys(accounts).join(",")}]`);
-		return null;
-	}
-	console.error(`resolveAgentsMdPath: found accountId=${accountId}`);
-	const bindings = Array.isArray(config.bindings) ? config.bindings : [];
-	let agentId;
-	for (const b of bindings) {
-		const binding = asRecord(b);
-		if (!binding) continue;
-		const match = asRecord(binding.match);
-		if (match?.channel === "feishu" && match?.accountId === accountId) {
-			if (typeof binding.agentId === "string") {
-				agentId = binding.agentId;
-				break;
-			}
-		}
-	}
-	if (!agentId) {
-		console.error(`resolveAgentsMdPath: no binding found for accountId=${accountId} in bindings(count=${bindings.length})`);
-		return null;
-	}
-	console.error(`resolveAgentsMdPath: found agentId=${agentId}`);
-	if (agentId === "main") {
-		console.error("resolveAgentsMdPath: case=multi-agent-main");
-		return node_path.default.join(WORKSPACE_DIR, "workspace", "AGENTS.md");
-	}
-	const agentsObj = asRecord(config.agents);
-	const list = Array.isArray(agentsObj?.list) ? agentsObj.list : [];
-	for (const a of list) {
-		const agent = asRecord(a);
-		if (agent?.id === agentId) {
-			const ws = typeof agent.workspace === "string" ? agent.workspace : node_path.default.join(WORKSPACE_DIR, "workspace");
-			console.error(`resolveAgentsMdPath: case=multi-agent-custom agentId=${agentId} workspace=${ws}`);
-			return node_path.default.join(ws, "AGENTS.md");
-		}
-	}
-	console.error(`resolveAgentsMdPath: agentId=${agentId} not found in agents.list(count=${list.length})`);
-	return null;
-}
-function appendPeToAgentsMd(agentsMdPath) {
-	const dir = node_path.default.dirname(agentsMdPath);
-	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
-	const existing = node_fs.default.existsSync(agentsMdPath) ? node_fs.default.readFileSync(agentsMdPath, "utf-8") : "";
-	if (existing.includes(`<${PE_XML_TAG}>`)) {
-		console.error(`lark-cli-init: <${PE_XML_TAG}> already present in ${agentsMdPath}, skipping`);
-		return;
-	}
-	const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-	node_fs.default.appendFileSync(agentsMdPath, `${sep}${PE_PLACEHOLDER}`, "utf-8");
-	console.error(`lark-cli-init: appended PE placeholder to ${agentsMdPath}`);
-}
-/**
-* Collect every Feishu bot appId declared in the openclaw config.
-* Covers both single-agent (channels.feishu.appId) and multi-agent
-* (channels.feishu.accounts[*].appId) layouts. Returns a deduplicated list.
-*/
-function collectFeishuAppIds(configPath) {
-	const config = readConfig(configPath ?? CONFIG_PATH);
-	if (!config) return [];
-	const feishu = getNestedMap(config, "channels", "feishu");
-	if (!feishu) return [];
-	const appIds = /* @__PURE__ */ new Set();
-	const topAppId = feishu.appId;
-	if (typeof topAppId === "string" && topAppId.trim()) appIds.add(topAppId.trim());
-	const accounts = asRecord(feishu.accounts);
-	if (accounts) for (const val of Object.values(accounts)) {
-		const appId = asRecord(val)?.appId;
-		if (typeof appId === "string" && appId.trim()) appIds.add(appId.trim());
-	}
-	return [...appIds];
-}
-function runLarkCliInit(opts) {
-	const configPath = opts.configPath ?? CONFIG_PATH;
-	if (!isLarkPluginInstalled(configPath)) {
-		console.error("lark-cli-init: skipping — openclaw-lark plugin not installed");
-		return {
-			ok: true,
-			skipped: true,
-			skipReason: "openclaw-lark plugin not installed"
+		const allow = plugins.allow;
+		if (!allow.includes(pkg.name)) allow.push(pkg.name);
+		if (!plugins.entries || typeof plugins.entries !== "object" || Array.isArray(plugins.entries)) plugins.entries = {};
+		const entries = plugins.entries;
+		entries[pkg.name] = {
+			...asRecord(entries[pkg.name]) ?? {},
+			enabled: true
 		};
 	}
-	if (!isLarkCliAvailable()) {
-		console.error("lark-cli-init: skipping — lark-cli command not found");
-		return {
-			ok: true,
-			skipped: true,
-			skipReason: "lark-cli command not found"
-		};
+	const tmpPath = configPath + ".installs-tmp";
+	node_fs.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2), "utf-8");
+	moveSafe(tmpPath, configPath);
+	console.error(`[install-extension] plugins.installs updated: ${updated} entry(ies) in ${configPath}` + (skipped > 0 ? ` (${skipped} package(s) without installMetadata skipped)` : ""));
+}
+function installOne$1(pkg, tarball, homeBase) {
+	const destDir = node_path.default.join(homeBase, pkg.installPath);
+	const stagingDir = destDir + ".new";
+	const oldDir = destDir + ".old";
+	node_fs.default.mkdirSync(node_path.default.dirname(destDir), { recursive: true });
+	if (node_fs.default.existsSync(stagingDir)) node_fs.default.rmSync(stagingDir, {
+		recursive: true,
+		force: true
+	});
+	node_fs.default.mkdirSync(stagingDir);
+	try {
+		extractTarballTolerant(tarball, stagingDir, { stripComponents: 1 });
+		if (!node_fs.default.existsSync(node_path.default.join(stagingDir, "package.json"))) throw new Error(`extension tarball missing package.json: ${pkg.name}`);
+	} catch (e) {
+		try {
+			node_fs.default.rmSync(stagingDir, {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+		throw e;
 	}
-	const config = readConfig(configPath);
-	if (!config) return {
-		ok: false,
-		error: `could not read config at ${configPath}`
-	};
-	const agentsMdPath = resolveAgentsMdPath(opts.appId, config);
-	console.error(`lark-cli-init: resolved agents.md path=${agentsMdPath ?? "(null)"}`);
-	if (!agentsMdPath) return {
-		ok: false,
-		error: `could not resolve agents.md path for appId=${opts.appId}`
-	};
-	const appSecret = resolveAppSecret(opts.appId, config, opts.feishuAppSecret);
-	if (!appSecret) return {
-		ok: false,
-		error: `could not resolve appSecret for appId=${opts.appId}`
-	};
-	console.error(`lark-cli-init: running lark-cli config init --name ${opts.appId} --app-id ${opts.appId} --brand feishu --app-secret-stdin --force-init`);
-	const initRes = (0, node_child_process.spawnSync)("lark-cli", [
-		"config",
-		"init",
-		"--name",
-		opts.appId,
-		"--app-id",
-		opts.appId,
-		"--brand",
-		"feishu",
-		"--app-secret-stdin",
-		"--force-init"
-	], {
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		],
-		encoding: "utf-8",
-		input: appSecret
+	const hadOld = node_fs.default.existsSync(destDir);
+	if (hadOld) moveSafe(destDir, oldDir);
+	moveSafe(stagingDir, destDir);
+	if (hadOld && node_fs.default.existsSync(oldDir)) node_fs.default.rmSync(oldDir, {
+		recursive: true,
+		force: true
 	});
-	const configInitStdout = initRes.stdout?.trim() || void 0;
-	const configInitStderr = initRes.stderr?.trim() || void 0;
-	if (configInitStdout) console.error(`lark-cli config init stdout: ${configInitStdout}`);
-	if (configInitStderr) console.error(`lark-cli config init stderr: ${configInitStderr}`);
-	if (initRes.error) return {
-		ok: false,
-		configInitStdout,
-		configInitStderr,
-		error: `lark-cli config init spawn error: ${initRes.error.message}`
-	};
-	if (initRes.status !== 0) return {
-		ok: false,
-		configInitExitCode: initRes.status ?? void 0,
-		configInitStdout,
-		configInitStderr,
-		error: `lark-cli config init exited with code ${initRes.status}`
-	};
-	appendPeToAgentsMd(agentsMdPath);
-	return {
-		ok: true,
-		configInitExitCode: 0,
-		agentsMdPath
-	};
 }
 //#endregion
 //#region ../../openclaw-slardar/lib/client.js
@@ -7005,6 +6995,60 @@ function mergeCoreBackupAndOrigins(configPath, vars, resetData, log) {
 	log(`allowedOrigins: added ${added.length} (${JSON.stringify(added)}), total now ${mergedOrigins.length}`);
 }
 /**
+* Fix bot account allowFrom and appSecret using larkApps from innerApi.
+*
+* For each bot account (key starts with `bot-cli_`):
+*   - allowFrom must contain the bot's own creatorOpenID from larkApps
+*   - appSecret must be either the canonical provider-ref or match larkApps plaintext
+*
+* Runs after mergeCoreBackupAndOrigins so it operates on the final config state.
+*/
+function fixBotChannelConfig(configPath, larkApps, log) {
+	if (!larkApps || larkApps.length === 0) {
+		log("no larkApps data, skip bot channel config fix");
+		return;
+	}
+	const config = loadJSON5().parse(node_fs.default.readFileSync(configPath, "utf-8"));
+	const accounts = asRecord(getNestedMap(config, "channels", "feishu")?.accounts);
+	if (!accounts) {
+		log("no feishu accounts in config, skip bot channel config fix");
+		return;
+	}
+	let fixCount = 0;
+	for (const [, account] of Object.entries(accounts)) {
+		const bot = asRecord(account);
+		if (!bot) continue;
+		const appId = bot.appId;
+		if (typeof appId !== "string" || !appId.startsWith("cli_")) continue;
+		const larkApp = larkApps.find((e) => e.larkAppID === appId);
+		if (!larkApp) continue;
+		const creatorOpenID = larkApp.creatorOpenID;
+		if (typeof creatorOpenID === "string" && creatorOpenID !== "") {
+			const allowFrom = Array.isArray(bot.allowFrom) ? [...bot.allowFrom] : [];
+			if (!allowFrom.includes(creatorOpenID)) {
+				allowFrom.push(creatorOpenID);
+				bot.allowFrom = allowFrom;
+				fixCount++;
+			}
+		}
+		const secret = bot.appSecret;
+		let needsFix = false;
+		if (typeof secret === "object" && secret !== null && !Array.isArray(secret)) {
+			if (!matchMap(secret, DEFAULT_FEISHU_APP_SECRET)) needsFix = true;
+		} else if (typeof secret === "string") {
+			if (secret !== larkApp.appSecret) needsFix = true;
+		} else needsFix = true;
+		if (needsFix) {
+			bot.appSecret = { ...DEFAULT_FEISHU_APP_SECRET };
+			fixCount++;
+		}
+	}
+	if (fixCount > 0) {
+		node_fs.default.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+		log(`fixed ${fixCount} bot channel config issue(s) (allowFrom/appSecret)`);
+	} else log("bot channel config ok, no fixes needed");
+}
+/**
 * Step 7: Verify startup scripts landed in configDir/scripts/.
 *
 * Scripts are extracted directly to configDir/scripts/ during stageTemplate —
@@ -7149,6 +7193,7 @@ async function runReset(input, taskId, resultFile) {
 		await step5InstallOpenclaw(openclawTag, ossFileMap, log);
 		step(6);
 		mergeCoreBackupAndOrigins(configPath, vars, resetData, log);
+		fixBotChannelConfig(configPath, vars.larkApps, log);
 		step(7);
 		verifyStartupScripts(configDir, log);
 		step(8);
@@ -7947,7 +7992,8 @@ function normalizeCtx(raw) {
 			reset: {
 				templateVars: r.reset.templateVars ?? {},
 				coreBackup: r.reset.coreBackup
-			}
+			},
+			larkApps: Array.isArray(r.larkApps) ? r.larkApps : []
 		};
 	}
 	const vars = r.vars ?? {};
@@ -7972,7 +8018,8 @@ function normalizeCtx(raw) {
 		reset: {
 			templateVars: resetData.templateVars ?? {},
 			coreBackup: resetData.coreBackup
-		}
+		},
+		larkApps: Array.isArray(r.larkApps) ? r.larkApps : []
 	};
 }
 function fillApp(src) {
@@ -8037,7 +8084,8 @@ function buildCheckInput(raw, configPathOverride) {
 			providerFilePath: PROVIDER_FILE_PATH,
 			secretsFilePath: SECRETS_FILE_PATH,
 			templateVars: ctx.app.templateVars,
-			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag
+			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag,
+			larkApps: ctx.larkApps
 		},
 		templateVars: ctx.app.templateVars
 	};
@@ -8069,7 +8117,8 @@ function buildRepairInput(raw, configPathOverride) {
 			providerFilePath: PROVIDER_FILE_PATH,
 			secretsFilePath: SECRETS_FILE_PATH,
 			templateVars: ctx.app.templateVars,
-			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag
+			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag,
+			larkApps: ctx.larkApps
 		},
 		repairData: {
 			secretsContent: ctx.secrets.secretsContent,
@@ -8105,7 +8154,8 @@ function buildResetInput(raw, configPathOverride) {
 			providerFilePath: PROVIDER_FILE_PATH,
 			secretsFilePath: SECRETS_FILE_PATH,
 			templateVars: ctx.app.templateVars,
-			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag
+			recommendedOpenclawTag: ctx.app.recommendedOpenclawTag,
+			larkApps: ctx.larkApps
 		},
 		resetData: {
 			templateVars: ctx.reset.templateVars,
@@ -10336,6 +10386,122 @@ function finalize(results, aborted) {
 	};
 }
 //#endregion
+//#region src/channels-probe.ts
+const FEISHU_INVALID_CONFIG_MSG = "channels.feishu: invalid config: must NOT have additional properties";
+const CHANNEL_LINE_RE = /^-\s+Feishu\s+([^:]+):\s+(.+)$/;
+/**
+* 判断单个飞书账号是否处于"可用"状态。
+* 移植自 feishu-channel-success-rate skill 的 Python `_account_is_working`。
+*
+* 会先剥离 "key:value" 形式的 bit（dm:、bot:、in:、out:、token:、allow:、
+* intents:、groups:、health: 等），再按以下公式判断：
+*
+* @param ignoreProbeFailed  为 true 时忽略 "probe failed" bit，不视为失败。
+*   升级前置检测中传 true，因为 probe 失败通常反映网络状况而非配置问题。
+* @param gatewayReachable   为 false 时（gateway 尚未启动），只要 enabled+configured
+*   即视为可用；为 true 时还需要 running/works 且无 error: bit。
+*/
+function accountIsWorking(bits, ignoreProbeFailed = true, gatewayReachable = true) {
+	const bitTokens = /* @__PURE__ */ new Set();
+	let hasError = false;
+	let hasProbeFailed = false;
+	for (const raw of bits) {
+		const b = raw.trim();
+		if (!b) continue;
+		if (b.startsWith("error:")) {
+			hasError = true;
+			continue;
+		}
+		if (b === "probe failed") {
+			hasProbeFailed = true;
+			continue;
+		}
+		bitTokens.add(b.split(":")[0]);
+	}
+	if (!bitTokens.has("enabled") || !bitTokens.has("configured")) return false;
+	if (!gatewayReachable) return true;
+	if (bitTokens.has("works")) return true;
+	if (bitTokens.has("running") && !hasError && (ignoreProbeFailed || !hasProbeFailed)) return true;
+	return false;
+}
+/**
+* 解析 `openclaw channels status --probe` 的原始 stdout。
+* 移植自 feishu-channel-success-rate skill 的 Python `extract_channels_probe`。
+*/
+function parseChannelsProbeOutput(text, { ignoreProbeFailed = true } = {}) {
+	const gatewayReachable = text.includes("Gateway reachable");
+	const feishuConfigInvalid = text.includes(FEISHU_INVALID_CONFIG_MSG);
+	const accounts = [];
+	let anyAccountWorking = false;
+	for (const line of text.split("\n")) {
+		const m = CHANNEL_LINE_RE.exec(line.trim());
+		if (!m) continue;
+		const [, acct, rest] = m;
+		const bits = rest.split(",").map((b) => b.trim());
+		const isWorking = accountIsWorking(bits, ignoreProbeFailed, gatewayReachable);
+		if (isWorking) anyAccountWorking = true;
+		accounts.push({
+			id: acct.trim(),
+			bits,
+			isWorking,
+			raw: line.trim()
+		});
+	}
+	return {
+		gatewayReachable,
+		feishuConfigInvalid,
+		accounts,
+		anyAccountWorking
+	};
+}
+/**
+* 执行 `openclaw channels status --probe`，返回结构化结果。
+*
+* 部分 bot 账号 probe 失败时命令会以非零退出码退出，但 stdout 仍有可用内容。
+* 因此即使退出码非零，也尝试解析 stdout；只有真正没有任何输出时才返回 unavailable。
+*
+* @param timeoutMs         最长等待时长，默认 60 s。v2026.4.x 缺少单请求 HTTP 超时，
+*   可能无限阻塞，此超时是唯一保护。
+* @param ignoreProbeFailed 为 true 时，"probe failed" 账号仍计入"可用"。
+*   升级前置检测中应传 true，避免网络抖动导致误判为不可用。
+*/
+function runChannelsProbe(timeoutMs = 6e4, { ignoreProbeFailed = true } = {}) {
+	let stdout = "";
+	let stderrText = "";
+	let execError;
+	try {
+		stdout = (0, node_child_process.execSync)("openclaw channels status --probe", {
+			encoding: "utf-8",
+			timeout: timeoutMs,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (e) {
+		const err = e;
+		const stdoutRaw = err.stdout;
+		stdout = typeof stdoutRaw === "string" ? stdoutRaw : stdoutRaw?.toString("utf-8") ?? "";
+		execError = err.message;
+		const stderrRaw = err.stderr;
+		stderrText = (typeof stderrRaw === "string" ? stderrRaw : stderrRaw?.toString("utf-8") ?? "").trim();
+		if (stderrText) console.error(`channels-probe: stderr from CLI: ${stderrText}`);
+	}
+	if (stdout.trim()) return {
+		available: true,
+		...parseChannelsProbeOutput(stdout, { ignoreProbeFailed })
+	};
+	return {
+		available: false,
+		gatewayReachable: false,
+		feishuConfigInvalid: stderrText.includes(FEISHU_INVALID_CONFIG_MSG),
+		accounts: [],
+		anyAccountWorking: false,
+		error: execError ?? "no output from openclaw channels status --probe"
+	};
+}
+//#endregion
 //#region src/innerapi/reportCliRun.ts
 /**
 * CLI-side client for studio_server's `openclaw.report_cli_run` inner
@@ -10415,7 +10581,7 @@ async function reportCliRun(opts) {
 //#region src/help.ts
 const BIN = "mclaw-diagnose";
 function versionBanner() {
-	return `v0.1.15-alpha.0`;
+	return `v0.1.15-alpha.1`;
 }
 const COMMANDS = [
 	{
@@ -10519,16 +10685,12 @@ EXIT CODES
 		hidden: true,
 		summary: "Run rule-engine check only",
 		help: `USAGE
-  ${BIN} check [--ctx=<base64>]
+  ${BIN} check
 
 DESCRIPTION
   Runs the rule engine against the sandbox's current openclaw config and
-  returns { failedRules }. Used by sandbox_console's push-style callers
-  that already own the ctx — end-users should prefer \`doctor\`.
-
-OPTIONS
-  --ctx=<base64>   Opaque ctx JSON (base64). When absent, fetched from
-                   innerapi (same path as doctor).
+  returns { failedRules }. Ctx is fetched from innerapi automatically.
+  End-users should prefer \`doctor\`.
 `
 	},
 	{
@@ -10536,16 +10698,11 @@ OPTIONS
 		hidden: true,
 		summary: "Apply standard-mode repairs",
 		help: `USAGE
-  ${BIN} repair [--ctx=<base64>]
+  ${BIN} repair
 
 DESCRIPTION
-  Runs repair for the failing rules listed inside the ctx's repairData.
-  Intended for sandbox_console's push path — end-users should use
-  \`doctor --fix\` instead.
-
-OPTIONS
-  --ctx=<base64>   Opaque ctx JSON (base64). When absent, fetched from
-                   innerapi.
+  Runs repair for the failing rules. Ctx is fetched from innerapi
+  automatically. End-users should use \`doctor --fix\` instead.
 `
 	},
 	{
@@ -10553,14 +10710,15 @@ OPTIONS
 		hidden: true,
 		summary: "Re-initialize sandbox via the 9-step reset pipeline",
 		help: `USAGE
-  ${BIN} reset --async  [--ctx=<base64>]
-  ${BIN} reset --worker --task-id=<id> [--ctx=<base64>]
+  ${BIN} reset --async
+  ${BIN} reset --worker --task-id=<id>
 
 DESCRIPTION
   Two-phase pipeline driven asynchronously: the --async invocation spawns
   a detached worker and returns { taskId } immediately; the --worker
   invocation (spawned by --async) runs the actual 9 steps and writes
   progress to /tmp/openclaw-diagnose/reset-<taskId>.json.
+  Ctx is fetched from innerapi automatically.
 
   Poll progress with \`${BIN} get_reset_task --task-id=<id>\`.
 
@@ -10568,7 +10726,6 @@ OPTIONS
   --async           Start a detached worker and return taskId on stdout.
   --worker          Internal — run the 9-step pipeline (launched by --async).
   --task-id=<id>    Required with --worker; identifies the progress file.
-  --ctx=<base64>    Opaque ctx JSON; fetched from innerapi when absent.
 `
 	},
 	{
@@ -10591,7 +10748,7 @@ OPTIONS
 		hidden: true,
 		summary: "Download + install the openclaw tarball",
 		help: `USAGE
-  ${BIN} install-openclaw <tag> [--ctx=<base64> | --oss_file_map=<base64>]
+  ${BIN} install-openclaw <tag> [--oss_file_map=<base64>]
 
 DESCRIPTION
   Downloads the openclaw@<tag> tgz via the signed OSS URL found in the
@@ -10603,9 +10760,9 @@ ARGUMENTS
   <tag>                Openclaw version tag, e.g. 2026.4.11.
 
 OPTIONS
-  --ctx=<base64>       Opaque ctx; ossFileMap is extracted from it.
   --oss_file_map=...   Pre-built OSS URL map (base64 JSON); skips innerapi
-                       entirely. Wins over --ctx when both provided.
+                       entirely. When absent, ossFileMap is fetched from
+                       innerapi automatically.
 `
 	},
 	{
@@ -10631,8 +10788,7 @@ OPTIONS
   --home_base=<dir>    Override the /home/gem base (tests).
   --config_path=<p>    Override the openclaw.json path (tests).
   --skip-config-update Leave plugins.installs in openclaw.json untouched.
-  --ctx=<base64>       Opaque ctx; see install-openclaw for semantics.
-  --oss_file_map=...   Pre-built OSS URL map (base64 JSON).
+  --oss_file_map=...   Pre-built OSS URL map (base64 JSON); skips innerapi.
 `
 	},
 	{
@@ -10659,7 +10815,6 @@ OPTIONS
   --cli=<name>         CLI package to install by short name or scoped
                        packageName (repeatable, at least one required).
   --home_base=<dir>    Override the /home/gem base (tests).
-  --ctx=<base64>       Opaque ctx; ossFileMap is extracted from it.
   --oss_file_map=...   Pre-built OSS URL map (base64 JSON); skips innerapi.
 
 EXAMPLES
@@ -10720,12 +10875,17 @@ EXIT CODES
 		hidden: false,
 		summary: "Upgrade the Feishu/Lark plugin via @larksuite/openclaw-lark-tools",
 		help: `USAGE
-  ${BIN} upgrade-lark [--scene=<scene>] [--caller=<n>] [--trace-id=<id>]
+  ${BIN} upgrade-lark [--check-only] [--scene=<scene>] [--caller=<n>] [--trace-id=<id>]
 
 DESCRIPTION
   Upgrades the Feishu/Lark plugin by running:
     npx -y @larksuite/openclaw-lark-tools update --use-existing
 
+  Before the upgrade, a pre-check gate runs to verify the upgrade is needed:
+    - version incompatible OR feishu channel config invalid, AND
+    - no feishu account is currently working
+  If the gate is not triggered, the command skips with exit code 0.
+
   Before the upgrade, the following files are backed up:
     - openclaw.json
     - extensions/openclaw-lark/  (if present)
@@ -10743,16 +10903,23 @@ DESCRIPTION
     { "ok": false, "error": "...", "stderr": "...", "exitCode": 1,
       "rollbackOk": true, "validationError": "...", "logFile": "..." }
 
+  With --check-only:
+    { "ok": true, "skipped": true, "upgradeNeeded": false, "logFile": "..." }
+    { "ok": true, "skipped": true, "upgradeNeeded": true,  "logFile": "..." }  ← exit 1
+
 OPTIONS
+  --check-only       Diagnose only: run the pre-check gate and report whether
+                     upgrade is needed without installing. Exit 1 if needed.
   --scene=<scene>    Telemetry label forwarded to Slardar only.
                      Known values: PageUpgradeLark, etc. Custom strings accepted.
   --caller=<name>    Optional metadata passed to innerapi.
   --trace-id=<id>    Optional log-correlation id.
 
 EXIT CODES
-  0    Success: upgrade ran and all validations passed.
+  0    Success: upgrade ran and all validations passed; or gate skipped upgrade.
   1    Failure: npx error, validation failed, or git commit failed.
        File rollback was attempted (see rollbackOk in the JSON output).
+       With --check-only: exit 1 means upgrade IS needed.
 `
 	},
 	{
@@ -10841,8 +11008,7 @@ OPTIONS
   --role=<role>        Package role (e.g. template, config).
   --name=<name>        Package name within the role.
   --dir=<dir>          Target dir (defaults to dirname(pkg.installPath)).
-  --ctx=<base64>       Opaque ctx; ossFileMap is extracted from it.
-  --oss_file_map=...   Pre-built OSS URL map (base64 JSON).
+  --oss_file_map=...   Pre-built OSS URL map (base64 JSON); skips innerapi.
 `
 	}
 ];
@@ -10918,31 +11084,31 @@ function planVarsFields(opts = {}) {
 *
 * Per-command group needs:
 *
-*   doctor / check    app (rule-driven)
-*   repair            app + secrets   (writes secretsContent / providerKeyContent)
-*   reset             app + secrets + install + reset (the works)
+*   doctor / check    app + larkApps
+*   repair            app + secrets + larkApps
+*   reset             app + secrets + install + reset + larkApps
 *   install-*         install only
 *
 * Empty result (`{}`) means "no group needed" — the CLI can skip the
 * `fetchCtxViaInnerApi` call entirely and run with a synthetic empty ctx.
-* Happens e.g. when the user pinned `--rule=<key>` to a vars-free rule on
-* `doctor`.
 */
 function planCtxPopulate(opts) {
 	if (opts.command === "install") return { install: true };
 	const populate = {};
-	const appFields = planVarsFields({
+	if (planVarsFields({
 		disabled: opts.disabled,
 		onlyRules: opts.onlyRules,
 		profile: opts.profile
-	});
-	if (appFields.length > 0) populate.app = appFields;
-	if (opts.command === "repair") populate.secrets = true;
-	else if (opts.command === "reset") {
+	}).length > 0) populate.app = true;
+	if (opts.command === "repair") {
+		populate.secrets = true;
+		populate.larkApps = true;
+	} else if (opts.command === "reset") {
 		populate.secrets = true;
 		populate.install = true;
 		populate.reset = true;
-	}
+		populate.larkApps = true;
+	} else if (opts.command === "doctor" || opts.command === "check") populate.larkApps = true;
 	return populate;
 }
 //#endregion
@@ -10996,6 +11162,7 @@ function reportDoctorRunToSlardar(opts) {
 		}
 	});
 }
+/** 读取日志文件全文；文件不存在或读取失败时返回空字符串。 */
 function readLogFile(filePath) {
 	try {
 		return node_fs.default.readFileSync(filePath, "utf-8");
@@ -11003,8 +11170,18 @@ function readLogFile(filePath) {
 		return "";
 	}
 }
+/**
+* 向 Slardar 上报 upgrade-lark 运行结果（upgrade_lark_run 事件）。
+*
+* extraCategories 记录字符串维度：scene、exit_code、rollback_ok、
+* validation_error、error_msg、log_content（日志文件全文）。
+*
+* extraMetrics 记录各阶段耗时（毫秒）；未执行的阶段上报 -1 作为哨兵值，
+* 便于在 Slardar 查询时区分"未运行"和"运行了 0ms"。
+*/
 function reportUpgradeLarkToSlardar(opts) {
 	console.error(`[slardar] upgrade_lark_run scene=${opts.scene ?? ""} success=${opts.success} exitCode=${opts.exitCode ?? ""} rollbackOk=${opts.rollbackOk ?? ""}`);
+	const t = opts.timing ?? {};
 	const logContent = readLogFile(opts.logFile);
 	reportTask({
 		eventName: "upgrade_lark_run",
@@ -11017,12 +11194,20 @@ function reportUpgradeLarkToSlardar(opts) {
 			validation_error: opts.validationError ?? "",
 			error_msg: opts.error ?? "",
 			log_content: logContent
+		},
+		extraMetrics: {
+			pre_probe_ms: t.preProbeMs ?? -1,
+			version_check_ms: t.versionCheckMs ?? -1,
+			backup_ms: t.backupMs ?? -1,
+			npx_install_ms: t.npxInstallMs ?? -1,
+			post_probe_ms: t.postProbeMs ?? -1,
+			doctor_fix_ms: t.doctorFixMs ?? -1
 		}
 	});
 }
 //#endregion
 //#region src/upgrade-lark.ts
-/** Plugin directories under extensions/ that are backed up before upgrade */
+/** 升级前需备份的 extensions/ 下的插件目录 */
 const FEISHU_PLUGIN_DIRS = ["openclaw-lark", "feishu-openclaw-plugin"];
 function backupFiles(opts) {
 	const { workspaceDir, configPath, backupDir, log } = opts;
@@ -11125,7 +11310,7 @@ function countFeishuBots(configPath) {
 		return 0;
 	}
 }
-/** Run channels probe, log results, and return the result. Never throws. */
+/** 执行 channels probe 并将结果写入日志，从不抛出异常（异常时返回全零结果）。 */
 function probeChannels(label, log, timeoutMs) {
 	try {
 		const r = runChannelsProbe(timeoutMs);
@@ -11163,12 +11348,16 @@ function runUpgradeLark(opts) {
 	log(`  cwd        : ${cwd}`);
 	log(`  configPath : ${configPath}`);
 	log(`${"=".repeat(60)}`);
+	const timing = {};
 	log("");
 	log("── [Pre-check A] channels probe（升级前）────────────────");
+	const t_preProbeStart = Date.now();
 	const beforeChannels = probeChannels("before", log, 6e4);
+	timing.preProbeMs = Date.now() - t_preProbeStart;
 	log("");
 	log("── [Pre-check B] 版本兼容预检 ───────────────────────────");
 	let versionIncompatible = false;
+	const t_versionCheckStart = Date.now();
 	try {
 		const rawConfig = node_fs.default.readFileSync(configPath, "utf-8");
 		versionIncompatible = needsLarkUpgrade({
@@ -11184,6 +11373,7 @@ function runUpgradeLark(opts) {
 	} catch (e) {
 		log(`  version-compat pre-check error: ${e.message} — version signal unavailable`);
 	}
+	timing.versionCheckMs = Date.now() - t_versionCheckStart;
 	const feishuConfigInvalid = beforeChannels.feishuConfigInvalid;
 	log(`  feishu config invalid  : ${feishuConfigInvalid}`);
 	log("");
@@ -11201,6 +11391,8 @@ function runUpgradeLark(opts) {
 			ok: true,
 			skipped: true,
 			skipReason: reason,
+			upgradeNeeded: false,
+			timing,
 			logFile
 		};
 	}
@@ -11214,19 +11406,38 @@ function runUpgradeLark(opts) {
 			ok: true,
 			skipped: true,
 			skipReason: reason,
+			upgradeNeeded: false,
+			timing,
 			logFile
 		};
 	}
 	log(`  PROCEED: requiresLarkUpgrade=true (version=${versionIncompatible}, feishuConfig=${feishuConfigInvalid}) AND channels not working → running upgrade`);
+	if (opts.checkOnly) {
+		log(`  check-only: upgrade IS needed — returning without installing`);
+		log(`${"=".repeat(60)}`);
+		log("upgrade-lark check-only complete");
+		log(`${"=".repeat(60)}`);
+		return {
+			ok: true,
+			skipped: true,
+			skipReason: "check-only",
+			upgradeNeeded: true,
+			timing,
+			logFile
+		};
+	}
 	log("");
 	log("── [1/6] 文件备份 ────────────────────────────────────────");
 	log(`before-state: botCount=${countFeishuBots(configPath)}`);
+	const t_backupStart = Date.now();
 	const backup = backupFiles(fsOpts);
+	timing.backupMs = Date.now() - t_backupStart;
 	if (!backup.ok) {
 		log(`ERROR: ${backup.error}`);
 		return {
 			ok: false,
 			error: backup.error,
+			timing,
 			logFile
 		};
 	}
@@ -11244,6 +11455,7 @@ function runUpgradeLark(opts) {
 	else log(`  skipped: ${localOpenclawBin} (not found)`);
 	log("");
 	log("── [3/6] npx install (@larksuite/openclaw-lark-tools update) ──");
+	const t_npxStart = Date.now();
 	const npxResult = (0, node_child_process.spawnSync)("npx", [
 		"-y",
 		"@larksuite/openclaw-lark-tools",
@@ -11258,6 +11470,7 @@ function runUpgradeLark(opts) {
 		],
 		timeout: 12e4
 	});
+	timing.npxInstallMs = Date.now() - t_npxStart;
 	const npxStdout = npxResult.stdout?.trim() ?? "";
 	const npxStderr = npxResult.stderr?.trim() ?? "";
 	const npxExitCode = npxResult.status ?? 1;
@@ -11282,6 +11495,7 @@ function runUpgradeLark(opts) {
 			stderr: npxStderr,
 			exitCode: npxExitCode,
 			rollbackOk,
+			timing,
 			logFile
 		};
 	};
@@ -11304,7 +11518,9 @@ function runUpgradeLark(opts) {
 	} catch (e) {
 		log(`  version-compat post-check error: ${e.message} — version signal unavailable`);
 	}
+	const t_postProbeStart = Date.now();
 	const afterChannels = probeChannels("after", log, 6e4);
+	timing.postProbeMs = Date.now() - t_postProbeStart;
 	log(`  feishu config invalid after: ${afterChannels.feishuConfigInvalid}`);
 	const stillNeedsUpgrade = (afterVersionIncompatible || afterChannels.feishuConfigInvalid) && !afterChannels.anyAccountWorking;
 	log(`  post-check: stillNeedsUpgrade=${stillNeedsUpgrade} (version=${afterVersionIncompatible}, feishuConfig=${afterChannels.feishuConfigInvalid}, channelsWorking=${afterChannels.anyAccountWorking})`);
@@ -11314,6 +11530,7 @@ function runUpgradeLark(opts) {
 	log("── [6/6] doctor --fix ────────────────────────────────────");
 	const fixArgs = ["doctor", "--fix"];
 	if (opts.scene) fixArgs.push(`--scene=${opts.scene}`);
+	const t_doctorFixStart = Date.now();
 	const fixResult = (0, node_child_process.spawnSync)(process.execPath, [cliScript, ...fixArgs], {
 		cwd,
 		encoding: "utf-8",
@@ -11325,6 +11542,7 @@ function runUpgradeLark(opts) {
 		timeout: 6e4,
 		env: process.env
 	});
+	timing.doctorFixMs = Date.now() - t_doctorFixStart;
 	if (fixResult.stdout?.trim()) log(`doctor(fix) stdout:\n${fixResult.stdout.trim()}`);
 	if (fixResult.stderr?.trim()) log(`doctor(fix) stderr:\n${fixResult.stderr.trim()}`);
 	log(`doctor(fix) exit: ${fixResult.status ?? "null"}${fixResult.error ? ` error: ${fixResult.error.message}` : ""}`);
@@ -11337,6 +11555,7 @@ function runUpgradeLark(opts) {
 		stdout: npxStdout,
 		stderr: npxStderr,
 		exitCode: npxExitCode,
+		timing,
 		logFile
 	};
 }
@@ -11345,21 +11564,6 @@ function runUpgradeLark(opts) {
 const args = node_process.default.argv.slice(2);
 const mode = args.find((a) => !a.startsWith("-"));
 /**
-* Decode `--ctx=<base64>` into an opaque JSON object. Returns undefined when
-* the flag isn't present — the caller decides whether to fall back to the
-* innerapi or to error out.
-*
-* The object's shape is not enforced here; downstream code consumes it via
-* either `normalizeCtx()` (new path) or direct field access for the legacy
-* check/repair/reset contract still used by sandbox_console push.
-*/
-function parseCtxFlag(args) {
-	const ctxArg = args.find((a) => a.startsWith("--ctx="));
-	if (!ctxArg) return void 0;
-	const b64 = ctxArg.slice(6);
-	return JSON.parse(Buffer.from(b64, "base64").toString("utf-8"));
-}
-/**
 * Pull the first non-flag positional after the mode name.
 * (The mode itself is args[0] in the filtered set, so we skip index 0.)
 */
@@ -11387,8 +11591,8 @@ function getMultiFlag(args, name) {
 * case but is no longer consulted.
 */
 async function reportRun(command, rc, _raw, invocation, durationMs, outcome, slardar = {
-	scene,
-	profile,
+	scene: void 0,
+	profile: "standard",
 	fix: false
 }) {
 	console.error(`${command}: telemetry calling report_cli_run`);
@@ -11452,7 +11656,7 @@ async function main() {
 	console.error(`${mode}: begin argv=[${args.join(" ")}] version=${getVersion()} traceId=${traceId ?? "-"} caller=${caller ?? "-"} runIdGenerated=${rc.generated}`);
 	switch (mode) {
 		case "check": {
-			const raw = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+			const raw = await fetchCtxViaInnerApi({
 				populate: planCtxPopulate({
 					command: "check",
 					profile
@@ -11477,7 +11681,7 @@ async function main() {
 			break;
 		}
 		case "repair": {
-			const raw = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+			const raw = await fetchCtxViaInnerApi({
 				populate: planCtxPopulate({
 					command: "repair",
 					profile
@@ -11548,27 +11752,15 @@ async function main() {
 			break;
 		}
 		case "reset":
-			if (args.includes("--async")) {
-				const ctxArg = args.find((a) => a.startsWith("--ctx="));
-				let ctxBase64;
-				if (ctxArg) ctxBase64 = ctxArg.slice(6);
-				else {
-					const fetched = await fetchCtxViaInnerApi({
-						populate: planCtxPopulate({ command: "reset" }),
-						caller,
-						traceId
-					});
-					ctxBase64 = Buffer.from(JSON.stringify(fetched), "utf-8").toString("base64");
-				}
-				console.log(JSON.stringify(startAsyncReset(ctxBase64)));
-			} else if (args.includes("--worker")) {
+			if (args.includes("--async")) console.log(JSON.stringify(startAsyncReset()));
+			else if (args.includes("--worker")) {
 				const taskId = args.find((a) => a.startsWith("--task-id="))?.slice(10);
 				if (!taskId) {
 					console.error("Error: --task-id=<id> is required for worker");
 					node_process.default.exit(1);
 				}
 				const resultFile = resetResultFile(taskId);
-				const raw = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				const raw = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "reset" }),
 					caller,
 					traceId
@@ -11592,7 +11784,7 @@ async function main() {
 					return;
 				}
 			} else {
-				console.error("Usage: reset --async [--ctx=<base64>] | reset --worker --task-id=<id> [--ctx=<base64>]");
+				console.error("Usage: reset --async | reset --worker --task-id=<id>");
 				node_process.default.exit(1);
 			}
 			break;
@@ -11608,14 +11800,14 @@ async function main() {
 		case "install-openclaw": {
 			const tag = getPositionalTag(args, "install-openclaw");
 			if (!tag) {
-				console.error("Usage: install-openclaw <tag> [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: install-openclaw <tag> [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const ossFileMapFlag = getFlag(args, "oss_file_map");
 			let installOssFileMap;
 			let rawForTelemetry;
 			if (!ossFileMapFlag) {
-				rawForTelemetry = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				rawForTelemetry = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "install" }),
 					caller,
 					traceId
@@ -11650,7 +11842,7 @@ async function main() {
 		case "install-extension": {
 			const tag = getPositionalTag(args, "install-extension");
 			if (!tag) {
-				console.error("Usage: install-extension <tag> (--all | --extension=<name>...) [--home_base=<dir>] [--config_path=<path>] [--skip-config-update] [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: install-extension <tag> (--all | --extension=<name>...) [--home_base=<dir>] [--config_path=<path>] [--skip-config-update] [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const all = args.includes("--all");
@@ -11662,7 +11854,7 @@ async function main() {
 			let installOssFileMap;
 			let rawForTelemetry;
 			if (!ossFileMapFlag) {
-				rawForTelemetry = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				rawForTelemetry = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "install" }),
 					caller,
 					traceId
@@ -11708,12 +11900,12 @@ async function main() {
 		case "install-cli": {
 			const tag = getPositionalTag(args, "install-cli");
 			if (!tag) {
-				console.error("Usage: install-cli <tag> --cli=<name>... [--home_base=<dir>] [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: install-cli <tag> --cli=<name>... [--home_base=<dir>] [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const names = getMultiFlag(args, "cli");
 			if (names.length === 0) {
-				console.error("Usage: install-cli <tag> --cli=<name>... [--home_base=<dir>] [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: install-cli <tag> --cli=<name>... [--home_base=<dir>] [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const homeBase = getFlag(args, "home_base");
@@ -11721,7 +11913,7 @@ async function main() {
 			let installOssFileMap;
 			let rawForTelemetry;
 			if (!ossFileMapFlag) {
-				rawForTelemetry = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				rawForTelemetry = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "install" }),
 					caller,
 					traceId
@@ -11769,7 +11961,7 @@ async function main() {
 		case "download-resource": {
 			const tag = getPositionalTag(args, "download-resource");
 			if (!tag) {
-				console.error("Usage: download-resource <tag> --role=<role> --name=<name> [--dir=<dir>] [--ctx=<base64> | --oss_file_map=<base64>]");
+				console.error("Usage: download-resource <tag> --role=<role> --name=<name> [--dir=<dir>] [--oss_file_map=<base64>]");
 				node_process.default.exit(1);
 			}
 			const role = getFlag(args, "role");
@@ -11783,7 +11975,7 @@ async function main() {
 			let installOssFileMap;
 			let rawForTelemetry;
 			if (!ossFileMapFlag) {
-				rawForTelemetry = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+				rawForTelemetry = await fetchCtxViaInnerApi({
 					populate: planCtxPopulate({ command: "install" }),
 					caller,
 					traceId
@@ -11858,9 +12050,11 @@ async function main() {
 			break;
 		}
 		case "upgrade-lark": {
+			const checkOnly = args.includes("--check-only");
 			const result = runUpgradeLark({
 				runId: rc.runId,
-				scene
+				scene,
+				checkOnly
 			});
 			const upgradeDurationMs = Date.now() - t0;
 			console.log(JSON.stringify(result));
@@ -11872,7 +12066,8 @@ async function main() {
 				exitCode: result.exitCode,
 				rollbackOk: result.rollbackOk,
 				validationError: result.validationError,
-				error: result.error
+				error: result.error,
+				timing: result.timing
 			});
 			try {
 				await reportCliRun({
@@ -11890,7 +12085,7 @@ async function main() {
 			} catch (e) {
 				console.error(`[telemetry] reportCliRun failed: ${e.message}`);
 			}
-			if (!result.ok) {
+			if (!result.ok || checkOnly && result.upgradeNeeded) {
 				node_process.default.exitCode = 1;
 				return;
 			}