@lark-apaas/openclaw-scripts-diagnose-cli 0.1.15-alpha.1 → 0.1.15-alpha.11

package/dist/index.cjs

@@ -52,7 +52,7 @@ node_assert = __toESM(node_assert);
 * it terse and parseable.
 */
 function getVersion() {
-	return "0.1.15-alpha.1";
+	return "0.1.15-alpha.11";
 }
 //#endregion
 //#region src/rule-engine/base.ts
@@ -1770,6 +1770,97 @@ SessionPersistenceRule = __decorate([Rule({
 	level: "silent"
 })], SessionPersistenceRule);
 //#endregion
+//#region src/rules/tools-allow-also-allow-conflict.ts
+/**
+* 检测 tools 配置中 allow 与 alsoAllow 同时非空的冲突。
+*
+* openclaw 的 Zod schema 在配置加载时会拒绝这种组合，原因是语义互斥：
+*   - allow：完全替换式白名单，只允许列出的工具
+*   - alsoAllow：追加式，在 profile 或默认基线上叠加额外工具
+* 两者同时存在会导致 openclaw 服务启动失败。
+*
+* 修复策略：将 alsoAllow 的条目去重合并进 allow，删除 alsoAllow。
+* 这是最保守的修复：保留原 allow 的精确白名单，不扩大权限范围。
+*
+* 检测范围：
+*   - 顶层 tools
+*   - tools.byProvider.*
+*   - agents.list[].tools
+*   - agents.list[].tools.byProvider.*
+*/
+let ToolsAllowAlsoAllowConflictRule = class ToolsAllowAlsoAllowConflictRule extends DiagnoseRule {
+	validate(ctx) {
+		const conflicts = [];
+		visitAllScopes(ctx.config, (scope, label) => {
+			console.error(`[tools_allow_also_allow_conflict] scope=${label} hasConflict=${hasConflict(scope)} allow=${JSON.stringify(scope.allow)?.slice(0, 40)} alsoAllow=${JSON.stringify(scope.alsoAllow)?.slice(0, 40)}`);
+			if (hasConflict(scope)) conflicts.push(label);
+		});
+		if (conflicts.length === 0) return { pass: true };
+		return {
+			pass: false,
+			message: `tools allow 与 alsoAllow 冲突（${conflicts.length} 处）：${conflicts.join("；")}。修复方式：将 alsoAllow 合并进 allow 并删除 alsoAllow`
+		};
+	}
+	repair(ctx) {
+		visitAllScopes(ctx.config, (scope) => mergeInScope(scope));
+	}
+};
+ToolsAllowAlsoAllowConflictRule = __decorate([Rule({
+	key: "tools_allow_also_allow_conflict",
+	description: "tools 配置中 allow 与 alsoAllow 同时设置会导致 openclaw 启动失败；自动将 alsoAllow 合并进 allow（实验性）",
+	dependsOn: ["config_syntax_check"],
+	repairMode: "standard",
+	level: "critical",
+	profile: "experimental"
+})], ToolsAllowAlsoAllowConflictRule);
+/**
+* 遍历所有 tools-policy scope，对每个 scope 调用 callback。
+* validate 和 repair 共用同一套遍历逻辑，确保两者覆盖的 scope 始终一致。
+*/
+function visitAllScopes(config, cb) {
+	const topTools = asRecord(asRecord(config)?.tools);
+	if (topTools) {
+		cb(topTools, "tools");
+		const byProvider = asRecord(topTools.byProvider);
+		if (byProvider) for (const key of Object.keys(byProvider)) {
+			const scope = asRecord(byProvider[key]);
+			if (scope) cb(scope, `tools.byProvider.${key}`);
+		}
+	}
+	const agents = asRecord(asRecord(config)?.agents);
+	const list = Array.isArray(agents?.list) ? agents.list : [];
+	for (let i = 0; i < list.length; i++) {
+		const agent = asRecord(list[i]);
+		const agentId = typeof agent?.id === "string" ? agent.id : String(i);
+		const tools = asRecord(agent?.tools);
+		if (tools) {
+			cb(tools, `agents.list[${agentId}].tools`);
+			const byProvider = asRecord(tools.byProvider);
+			if (byProvider) for (const key of Object.keys(byProvider)) {
+				const scope = asRecord(byProvider[key]);
+				if (scope) cb(scope, `agents.list[${agentId}].tools.byProvider.${key}`);
+			}
+		}
+	}
+}
+/** scope 中 allow 与 alsoAllow 同时非空 */
+function hasConflict(scope) {
+	const allow = scope.allow;
+	const alsoAllow = scope.alsoAllow;
+	return Array.isArray(allow) && allow.length > 0 && Array.isArray(alsoAllow) && alsoAllow.length > 0;
+}
+/**
+* 将 alsoAllow 去重合并进 allow，删除 alsoAllow。
+* 仅保留字符串元素，过滤掉格式异常的非字符串条目，避免写入损坏配置。
+*/
+function mergeInScope(scope) {
+	if (!hasConflict(scope)) return;
+	const allow = scope.allow.filter((v) => typeof v === "string");
+	const alsoAllow = scope.alsoAllow.filter((v) => typeof v === "string");
+	scope.allow = [...new Set([...allow, ...alsoAllow])];
+	delete scope.alsoAllow;
+}
+//#endregion
 //#region src/rules/feishu-default-account.ts
 /**
 * Owns the multi-agent feishu-channel migration: turns legacy v1/v2
@@ -2543,9 +2634,13 @@ const PROVIDER_FILE_PATH = "/home/gem/workspace/.force/openclaw/miaoda-provider-
 const SECRETS_FILE_PATH = "/home/gem/workspace/.force/openclaw/miaoda-openclaw-secrets.json";
 /** Absolute path to the openclaw config JSON. */
 const CONFIG_PATH = `${WORKSPACE_DIR}/openclaw.json`;
-/** upgrade-lark 每次运行的日志文件路径，含时间戳便于按时间排序定位。 */
-function upgradeLarkLogFile(runId) {
-	return `${DIAGNOSE_DIR}/upgrade-lark-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace(/:/g, "-")}-${runId.slice(0, 8)}.log`;
+/**
+* upgrade-lark 每次运行的日志文件路径，含时间戳便于按时间排序定位。
+* checkOnly=true 时文件名含 "-check" 后缀，便于与正式安装日志区分。
+*/
+function upgradeLarkLogFile(runId, checkOnly = false) {
+	const ts = (/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace(/:/g, "-");
+	return `${DIAGNOSE_DIR}/upgrade-lark${checkOnly ? "-check" : ""}-${ts}-${runId.slice(0, 8)}.log`;
 }
 //#endregion
 //#region src/lark-cli-init.ts
@@ -10388,7 +10483,7 @@ function finalize(results, aborted) {
 //#endregion
 //#region src/channels-probe.ts
 const FEISHU_INVALID_CONFIG_MSG = "channels.feishu: invalid config: must NOT have additional properties";
-const CHANNEL_LINE_RE = /^-\s+Feishu\s+([^:]+):\s+(.+)$/;
+const CHANNEL_LINE_RE = /^-\s+(?:Feishu|openclaw-lark|@larksuite\/openclaw-lark)\s+([^:]+):\s+(.+)$/i;
 /**
 * 判断单个飞书账号是否处于"可用"状态。
 * 移植自 feishu-channel-success-rate skill 的 Python `_account_is_working`。
@@ -10490,6 +10585,7 @@ function runChannelsProbe(timeoutMs = 6e4, { ignoreProbeFailed = true } = {}) {
 	}
 	if (stdout.trim()) return {
 		available: true,
+		rawOutput: stdout.trim(),
 		...parseChannelsProbeOutput(stdout, { ignoreProbeFailed })
 	};
 	return {
@@ -10501,6 +10597,22 @@ function runChannelsProbe(timeoutMs = 6e4, { ignoreProbeFailed = true } = {}) {
 		error: execError ?? "no output from openclaw channels status --probe"
 	};
 }
+/**
+* 判断 channels probe 结果是否处于"仅一个 Feishu 默认账号、enabled 但未配置"的状态。
+*
+* 这是插件全新安装后的初始状态：npx 工具创建了一个默认账号占位，但用户尚未
+* 填写 AppID / Secret，因此账号显示为 enabled 但 not configured。
+* 此时 anyAccountWorking=false（configured 缺失），但安装本身是成功的。
+*
+* 用于安装后校验的补充分支：当安装前 channels 不可用，且安装后恰好处于此状态时，
+* 视为安装成功，不触发回滚。
+*/
+function isDefaultOnlyState(result) {
+	if (result.accounts.length !== 1) return false;
+	const acct = result.accounts[0];
+	const bitTokens = new Set(acct.bits.map((b) => b.trim().split(":")[0]));
+	return bitTokens.has("enabled") && !bitTokens.has("configured");
+}
 //#endregion
 //#region src/innerapi/reportCliRun.ts
 /**
@@ -10581,7 +10693,7 @@ async function reportCliRun(opts) {
 //#region src/help.ts
 const BIN = "mclaw-diagnose";
 function versionBanner() {
-	return `v0.1.15-alpha.1`;
+	return `v0.1.15-alpha.11`;
 }
 const COMMANDS = [
 	{
@@ -10875,7 +10987,7 @@ EXIT CODES
 		hidden: false,
 		summary: "Upgrade the Feishu/Lark plugin via @larksuite/openclaw-lark-tools",
 		help: `USAGE
-  ${BIN} upgrade-lark [--check-only] [--scene=<scene>] [--caller=<n>] [--trace-id=<id>]
+  ${BIN} upgrade-lark [--check] [--skip-restart] [--scene=<scene>] [--caller=<n>] [--trace-id=<id>]
 
 DESCRIPTION
   Upgrades the Feishu/Lark plugin by running:
@@ -10896,6 +11008,10 @@ DESCRIPTION
   If the upgrade command fails, or validation fails, the backed-up files are
   restored to roll back the changes.
 
+  After a successful upgrade, the openclaw service is restarted via
+    /opt/force/bin/openclaw_scripts/restart.sh
+  Pass --skip-restart to skip this step (e.g. when restart is handled externally).
+
   Execution is logged to /tmp/openclaw-diagnose/upgrade-lark-<runId>.log.
 
   Output is a single JSON object on stdout:
@@ -10903,13 +11019,14 @@ DESCRIPTION
     { "ok": false, "error": "...", "stderr": "...", "exitCode": 1,
       "rollbackOk": true, "validationError": "...", "logFile": "..." }
 
-  With --check-only:
+  With --check:
     { "ok": true, "skipped": true, "upgradeNeeded": false, "logFile": "..." }
     { "ok": true, "skipped": true, "upgradeNeeded": true,  "logFile": "..." }  ← exit 1
 
 OPTIONS
-  --check-only       Diagnose only: run the pre-check gate and report whether
+  --check            Diagnose only: run the pre-check gate and report whether
                      upgrade is needed without installing. Exit 1 if needed.
+  --skip-restart     Skip the post-install service restart (default: restart).
   --scene=<scene>    Telemetry label forwarded to Slardar only.
                      Known values: PageUpgradeLark, etc. Custom strings accepted.
   --caller=<name>    Optional metadata passed to innerapi.
@@ -10919,7 +11036,7 @@ EXIT CODES
   0    Success: upgrade ran and all validations passed; or gate skipped upgrade.
   1    Failure: npx error, validation failed, or git commit failed.
        File rollback was attempted (see rollbackOk in the JSON output).
-       With --check-only: exit 1 means upgrade IS needed.
+       With --check: exit 1 means upgrade IS needed.
 `
 	},
 	{
@@ -11162,38 +11279,53 @@ function reportDoctorRunToSlardar(opts) {
 		}
 	});
 }
-/** 读取日志文件全文；文件不存在或读取失败时返回空字符串。 */
-function readLogFile(filePath) {
-	try {
-		return node_fs.default.readFileSync(filePath, "utf-8");
-	} catch {
-		return "";
-	}
-}
 /**
 * 向 Slardar 上报 upgrade-lark 运行结果（upgrade_lark_run 事件）。
 *
-* extraCategories 记录字符串维度：scene、exit_code、rollback_ok、
-* validation_error、error_msg、log_content（日志文件全文）。
+* ## 标准字段
+* - durationMs：整条命令的总耗时（从 CLI 入口到 runUpgradeLark 返回），含重启阶段。
+* - status：success / failed
+*
+* ## extraCategories（字符串维度）
+* - scene：调用方标识（如 PageUpgradeLark）
+* - check_only：是否为 --check 仅诊断模式
+* - skipped："true" 表示前置门控未触发跳过安装（含 --check 模式），"false" 表示执行了安装
+* - skip_reason：跳过原因描述（skipped=true 时有值，"check" 表示 --check 模式）
+* - exit_code：npx 子进程退出码（跳过安装时为空）
+* - rollback_ok：回滚是否成功（未触发回滚时为空）
+* - validation_error：安装后校验失败的错误信息
+* - error_msg：命令级错误信息
+* - result：执行结果一行摘要（"success: ..."/"failed: ..."/"skipped: ..."/"check: ..."）
+* - log_file：日志文件绝对路径，便于在沙箱中定位完整日志
 *
-* extraMetrics 记录各阶段耗时（毫秒）；未执行的阶段上报 -1 作为哨兵值，
-* 便于在 Slardar 查询时区分"未运行"和"运行了 0ms"。
+* ## extraMetrics（数值指标，单位毫秒）
+* 未执行的阶段上报 -1 作为哨兵值，便于与"运行了 0ms"区分。
+* - pre_probe_ms：[Pre-check A] 升级前 channels probe 耗时
+* - version_check_ms：[Pre-check B] 版本兼容性检测耗时
+* - backup_ms：[1/6] 文件备份耗时
+* - npx_install_ms：[3/6] npx install 耗时（不含安装后 5s 等待）
+* - post_probe_ms：[4/5] 安装后 channels probe 耗时
+* - doctor_fix_ms：[6/6] doctor --fix 耗时
+* 注：[7/7] 重启耗时写入日志但未单独上报，包含在 durationMs 总耗时中。
 */
 function reportUpgradeLarkToSlardar(opts) {
-	console.error(`[slardar] upgrade_lark_run scene=${opts.scene ?? ""} success=${opts.success} exitCode=${opts.exitCode ?? ""} rollbackOk=${opts.rollbackOk ?? ""}`);
+	console.error(`[slardar] upgrade_lark_run scene=${opts.scene ?? ""} checkOnly=${opts.checkOnly} skipped=${opts.skipped ?? false} success=${opts.success} exitCode=${opts.exitCode ?? ""} rollbackOk=${opts.rollbackOk ?? ""}`);
 	const t = opts.timing ?? {};
-	const logContent = readLogFile(opts.logFile);
 	reportTask({
 		eventName: "upgrade_lark_run",
 		durationMs: opts.durationMs,
 		status: opts.success ? "success" : "failed",
 		extraCategories: {
 			scene: opts.scene ?? "",
+			check_only: String(opts.checkOnly),
+			skipped: String(opts.skipped ?? false),
+			skip_reason: opts.skipReason ?? "",
 			exit_code: String(opts.exitCode ?? ""),
 			rollback_ok: opts.rollbackOk != null ? String(opts.rollbackOk) : "",
 			validation_error: opts.validationError ?? "",
 			error_msg: opts.error ?? "",
-			log_content: logContent
+			result: opts.resultSummary,
+			log_file: opts.logFile
 		},
 		extraMetrics: {
 			pre_probe_ms: t.preProbeMs ?? -1,
@@ -11205,6 +11337,23 @@ function reportUpgradeLarkToSlardar(opts) {
 		}
 	});
 }
+/**
+* 将 upgrade-lark 运行结果归纳为一行摘要字符串，用于 Slardar result 字段。
+*
+* 格式：
+*   "check: upgrade needed"
+*   "check: no upgrade needed"
+*   "skipped: <skipReason>"
+*   "success: upgrade installed"
+*   "success: new default account (plugin installed, awaiting config)"
+*   "failed: <error>"
+*/
+function buildUpgradeLarkResultSummary(opts) {
+	if (opts.checkOnly && opts.skipped) return opts.upgradeNeeded ? "check: upgrade needed" : "check: no upgrade needed";
+	if (opts.skipped) return `skipped: ${opts.skipReason ?? "pre-check gate"}`;
+	if (opts.ok) return "success: upgrade installed";
+	return `failed: ${opts.error ?? opts.validationError ?? "unknown error"}${opts.rollbackOk === false ? " (rollback FAILED)" : opts.rollbackOk ? " (rolled back)" : ""}`;
+}
 //#endregion
 //#region src/upgrade-lark.ts
 /** 升级前需备份的 extensions/ 下的插件目录 */
@@ -11219,6 +11368,7 @@ function backupFiles(opts) {
 			node_fs.default.copyFileSync(configPath, node_path.default.join(backupDir, "openclaw.json"));
 			log(`  backed up: openclaw.json (${stat.size} bytes)`);
 		} else log(`  skipped: openclaw.json (not found)`);
+		node_fs.default.mkdirSync(node_path.default.join(backupDir, "extensions"), { recursive: true });
 		const extSrc = node_path.default.join(workspaceDir, "extensions");
 		for (const pluginDir of FEISHU_PLUGIN_DIRS) {
 			const src = node_path.default.join(extSrc, pluginDir);
@@ -11231,32 +11381,43 @@ function backupFiles(opts) {
 		}
 		return { ok: true };
 	} catch (e) {
+		const msg = `backup failed: ${e.message}`;
+		log(`ERROR: ${msg}`);
 		return {
 			ok: false,
-			error: `backup failed: ${e.message}`
+			error: msg
 		};
 	}
 }
 function restoreFiles(opts) {
 	const { workspaceDir, configPath, backupDir, log } = opts;
 	try {
+		if (node_fs.default.existsSync(configPath)) {
+			node_fs.default.rmSync(configPath, { force: true });
+			log(`  deleted: openclaw.json`);
+		}
+		const extDst = node_path.default.join(workspaceDir, "extensions");
+		for (const pluginDir of FEISHU_PLUGIN_DIRS) {
+			const dst = node_path.default.join(extDst, pluginDir);
+			if (node_fs.default.existsSync(dst)) {
+				node_fs.default.rmSync(dst, {
+					recursive: true,
+					force: true
+				});
+				log(`  deleted: extensions/${pluginDir}`);
+			}
+		}
 		const configBackup = node_path.default.join(backupDir, "openclaw.json");
 		if (node_fs.default.existsSync(configBackup)) {
 			node_fs.default.copyFileSync(configBackup, configPath);
 			log(`  restored: openclaw.json`);
-		}
-		const extDst = node_path.default.join(workspaceDir, "extensions");
+		} else log(`  skipped restore: openclaw.json (not in backup — was not present before upgrade)`);
 		for (const pluginDir of FEISHU_PLUGIN_DIRS) {
 			const backupSrc = node_path.default.join(backupDir, "extensions", pluginDir);
 			if (node_fs.default.existsSync(backupSrc)) {
-				const dst = node_path.default.join(extDst, pluginDir);
-				if (node_fs.default.existsSync(dst)) node_fs.default.rmSync(dst, {
-					recursive: true,
-					force: true
-				});
-				node_fs.default.cpSync(backupSrc, dst, { recursive: true });
+				node_fs.default.cpSync(backupSrc, node_path.default.join(extDst, pluginDir), { recursive: true });
 				log(`  restored: extensions/${pluginDir}`);
-			}
+			} else log(`  skipped restore: extensions/${pluginDir} (not in backup — was not present before upgrade)`);
 		}
 		return true;
 	} catch (e) {
@@ -11318,6 +11479,7 @@ function probeChannels(label, log, timeoutMs) {
 		if (r.error) log(`  ${label} error: ${r.error}`);
 		if (r.gatewayReachable != null) log(`  ${label} gatewayReachable: ${r.gatewayReachable}`);
 		for (const acct of r.accounts ?? []) log(`  ${label} account ${acct.id}: isWorking=${acct.isWorking} bits=[${acct.bits.join(",")}]`);
+		if (r.rawOutput) log(`  ${label} raw output:\n${r.rawOutput}`);
 		return r;
 	} catch (e) {
 		log(`  ${label} channels probe threw: ${e.message}`);
@@ -11333,7 +11495,7 @@ function probeChannels(label, log, timeoutMs) {
 function runUpgradeLark(opts) {
 	const cwd = opts.cwd ?? "/home/gem/workspace/agent";
 	const configPath = opts.configPath ?? CONFIG_PATH;
-	const logFile = upgradeLarkLogFile(opts.runId);
+	const logFile = upgradeLarkLogFile(opts.runId, opts.checkOnly);
 	const log = makeLogger(logFile);
 	const fsOpts = {
 		workspaceDir: cwd,
@@ -11352,7 +11514,7 @@ function runUpgradeLark(opts) {
 	log("");
 	log("── [Pre-check A] channels probe（升级前）────────────────");
 	const t_preProbeStart = Date.now();
-	const beforeChannels = probeChannels("before", log, 6e4);
+	const beforeChannels = probeChannels("before", log, 3e5);
 	timing.preProbeMs = Date.now() - t_preProbeStart;
 	log("");
 	log("── [Pre-check B] 版本兼容预检 ───────────────────────────");
@@ -11413,14 +11575,14 @@ function runUpgradeLark(opts) {
 	}
 	log(`  PROCEED: requiresLarkUpgrade=true (version=${versionIncompatible}, feishuConfig=${feishuConfigInvalid}) AND channels not working → running upgrade`);
 	if (opts.checkOnly) {
-		log(`  check-only: upgrade IS needed — returning without installing`);
+		log(`  --check 模式：需要升级 — 不执行安装，直接返回`);
 		log(`${"=".repeat(60)}`);
-		log("upgrade-lark check-only complete");
+		log("upgrade-lark check complete");
 		log(`${"=".repeat(60)}`);
 		return {
 			ok: true,
 			skipped: true,
-			skipReason: "check-only",
+			skipReason: "check",
 			upgradeNeeded: true,
 			timing,
 			logFile
@@ -11468,7 +11630,7 @@ function runUpgradeLark(opts) {
 			"pipe",
 			"pipe"
 		],
-		timeout: 12e4
+		timeout: 6e5
 	});
 	timing.npxInstallMs = Date.now() - t_npxStart;
 	const npxStdout = npxResult.stdout?.trim() ?? "";
@@ -11519,13 +11681,15 @@ function runUpgradeLark(opts) {
 		log(`  version-compat post-check error: ${e.message} — version signal unavailable`);
 	}
 	const t_postProbeStart = Date.now();
-	const afterChannels = probeChannels("after", log, 6e4);
+	const afterChannels = probeChannels("after", log, 3e5);
 	timing.postProbeMs = Date.now() - t_postProbeStart;
 	log(`  feishu config invalid after: ${afterChannels.feishuConfigInvalid}`);
 	const stillNeedsUpgrade = (afterVersionIncompatible || afterChannels.feishuConfigInvalid) && !afterChannels.anyAccountWorking;
-	log(`  post-check: stillNeedsUpgrade=${stillNeedsUpgrade} (version=${afterVersionIncompatible}, feishuConfig=${afterChannels.feishuConfigInvalid}, channelsWorking=${afterChannels.anyAccountWorking})`);
-	if (stillNeedsUpgrade) return doRollback(`post-install diagnosis still shows anomaly: versionIncompatible=${afterVersionIncompatible}, feishuConfigInvalid=${afterChannels.feishuConfigInvalid}, anyAccountWorking=${afterChannels.anyAccountWorking}`);
-	log("  post-install diagnosis: ok (upgrade conditions resolved)");
+	const isNewDefaultOnly = !afterVersionIncompatible && !afterChannels.feishuConfigInvalid && !beforeChannels.anyAccountWorking && isDefaultOnlyState(afterChannels);
+	log(`  post-check: stillNeedsUpgrade=${stillNeedsUpgrade} (version=${afterVersionIncompatible}, feishuConfig=${afterChannels.feishuConfigInvalid}, channelsWorking=${afterChannels.anyAccountWorking}) isNewDefaultOnly=${isNewDefaultOnly}`);
+	if (stillNeedsUpgrade && !isNewDefaultOnly) return doRollback(`post-install diagnosis still shows anomaly: versionIncompatible=${afterVersionIncompatible}, feishuConfigInvalid=${afterChannels.feishuConfigInvalid}, anyAccountWorking=${afterChannels.anyAccountWorking}`);
+	if (isNewDefaultOnly) log("  post-install diagnosis: ok (new default account — plugin installed, awaiting configuration)");
+	else log("  post-install diagnosis: ok (upgrade conditions resolved)");
 	log("");
 	log("── [6/6] doctor --fix ────────────────────────────────────");
 	const fixArgs = ["doctor", "--fix"];
@@ -11547,6 +11711,26 @@ function runUpgradeLark(opts) {
 	if (fixResult.stderr?.trim()) log(`doctor(fix) stderr:\n${fixResult.stderr.trim()}`);
 	log(`doctor(fix) exit: ${fixResult.status ?? "null"}${fixResult.error ? ` error: ${fixResult.error.message}` : ""}`);
 	log("");
+	log("── [7/7] 重启 openclaw 服务 ──────────────────────────────");
+	const restartScript = "/opt/force/bin/openclaw_scripts/restart.sh";
+	if (opts.skipRestart) log("  skipped: --skip-restart");
+	else if (node_fs.default.existsSync(restartScript)) {
+		const t_restart = Date.now();
+		const restartResult = (0, node_child_process.spawnSync)("bash", [restartScript], {
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			timeout: 3e4
+		});
+		const restartMs = Date.now() - t_restart;
+		if (restartResult.stdout?.trim()) log(`  restart stdout:\n${restartResult.stdout.trim()}`);
+		if (restartResult.stderr?.trim()) log(`  restart stderr:\n${restartResult.stderr.trim()}`);
+		log(`  restart.sh exit: ${restartResult.status ?? "null"} (${restartMs}ms)${restartResult.error ? ` error: ${restartResult.error.message}` : ""}`);
+	} else log(`  skipped: ${restartScript} not found`);
+	log("");
 	log(`${"=".repeat(60)}`);
 	log("upgrade-lark completed successfully");
 	log(`${"=".repeat(60)}`);
@@ -12050,19 +12234,34 @@ async function main() {
 			break;
 		}
 		case "upgrade-lark": {
-			const checkOnly = args.includes("--check-only");
+			const checkOnly = args.includes("--check");
+			const skipRestart = args.includes("--skip-restart");
 			const result = runUpgradeLark({
 				runId: rc.runId,
 				scene,
-				checkOnly
+				checkOnly,
+				skipRestart
 			});
 			const upgradeDurationMs = Date.now() - t0;
 			console.log(JSON.stringify(result));
 			reportUpgradeLarkToSlardar({
 				scene,
+				checkOnly,
 				durationMs: upgradeDurationMs,
 				success: result.ok,
+				skipped: result.skipped,
+				skipReason: result.skipReason,
 				logFile: result.logFile,
+				resultSummary: buildUpgradeLarkResultSummary({
+					ok: result.ok,
+					checkOnly,
+					skipped: result.skipped,
+					skipReason: result.skipReason,
+					upgradeNeeded: result.upgradeNeeded,
+					error: result.error,
+					validationError: result.validationError,
+					rollbackOk: result.rollbackOk
+				}),
 				exitCode: result.exitCode,
 				rollbackOk: result.rollbackOk,
 				validationError: result.validationError,
@@ -12092,7 +12291,9 @@ async function main() {
 			break;
 		}
 		case "channels-probe": {
-			const result = runChannelsProbe(getFlag(args, "timeout") ? Number(getFlag(args, "timeout")) : void 0);
+			const timeoutRaw = getFlag(args, "timeout");
+			const parsed = timeoutRaw != null ? Number(timeoutRaw) : NaN;
+			const result = runChannelsProbe(timeoutRaw != null ? Number.isNaN(parsed) ? 6e4 : Math.max(1e3, parsed) : void 0);
 			console.log(JSON.stringify(result));
 			break;
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/openclaw-scripts-diagnose-cli",
-  "version": "0.1.15-alpha.1",
+  "version": "0.1.15-alpha.11",
   "description": "CLI for OpenClaw config diagnose and repair with JSON5 support",
   "main": "dist/index.cjs",
   "bin": {