@lark-apaas/openclaw-scripts-diagnose-cli 0.1.6 → 0.1.7-alpha.1

package/dist/index.cjs

@@ -50,7 +50,7 @@ node_assert = __toESM(node_assert);
 * it terse and parseable.
 */
 function getVersion() {
-	return "0.1.6";
+	return "0.1.7-alpha.1";
 }
 //#endregion
 //#region src/rule-engine/base.ts
@@ -4134,7 +4134,7 @@ async function installExtension(tag, ossFileMap, opts = {}) {
 		};
 	}));
 	for (const { pkg, tarball } of tarballs) {
-		installOne(pkg, tarball, homeBase);
+		installOne$1(pkg, tarball, homeBase);
 		console.error(`[install-extension]   ${pkg.name}: installed`);
 	}
 	if (!opts.skipConfigUpdate) updatePluginInstalls(opts.configPath ?? node_path.default.join(homeBase, "workspace/agent/openclaw.json"), targets);
@@ -4187,7 +4187,7 @@ function updatePluginInstalls(configPath, installedPkgs) {
 	moveSafe(tmpPath, configPath);
 	console.error(`[install-extension] plugins.installs updated: ${updated} entry(ies) in ${configPath}` + (skipped > 0 ? ` (${skipped} package(s) without installMetadata skipped)` : ""));
 }
-function installOne(pkg, tarball, homeBase) {
+function installOne$1(pkg, tarball, homeBase) {
 	const destDir = node_path.default.join(homeBase, pkg.installPath);
 	const stagingDir = destDir + ".new";
 	const oldDir = destDir + ".old";
@@ -4729,6 +4729,356 @@ function sleepSync(ms) {
 	Atomics.wait(arr, 0, 0, ms);
 }
 //#endregion
+//#region src/lark-cli-init.ts
+const LARK_PLUGIN_NAMES = ["openclaw-lark", "feishu-openclaw-plugin"];
+const PE_XML_TAG = "lark-cli-pe";
+const PE_PLACEHOLDER = `
+<${PE_XML_TAG}>
+**【强制要求 - 无例外】飞书所有操作必须先读 feishu-lark-cli skill。未读skill不得调用任何飞书工具，违者视为操作失误。**
+</${PE_XML_TAG}>
+`;
+function isLarkPluginInstalled(configPath) {
+	const extDir = getExtensionsDir(configPath);
+	return LARK_PLUGIN_NAMES.some((name) => {
+		try {
+			return node_fs.default.existsSync(node_path.default.join(extDir, name, "package.json"));
+		} catch {
+			return false;
+		}
+	});
+}
+function isLarkCliAvailable() {
+	try {
+		return (0, node_child_process.spawnSync)("lark-cli", ["--version"], {
+			encoding: "utf-8",
+			timeout: 5e3,
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).status === 0;
+	} catch {
+		return false;
+	}
+}
+function readConfig(configPath) {
+	try {
+		const raw = node_fs.default.readFileSync(configPath, "utf-8");
+		const parsed = loadJSON5().parse(raw);
+		return parsed != null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Resolve the feishu app secret for the given appId.
+*
+* Lookup order:
+*   1. channels.feishu.appSecret  (single-agent: feishu.appId === appId)
+*   2. channels.feishu.accounts[key].appSecret  (multi-agent: account.appId === appId)
+*
+* Value interpretation:
+*   - string  → use directly
+*   - object  → secret is managed by a provider; use `feishuAppSecret` param instead
+*
+* Returns null when the secret cannot be determined.
+*/
+function resolveAppSecret(appId, config, feishuAppSecret) {
+	const feishu = getNestedMap(config, "channels", "feishu");
+	if (!feishu) return null;
+	let rawSecret;
+	if (typeof feishu.appId === "string" && feishu.appId === appId) rawSecret = feishu.appSecret;
+	else {
+		const accounts = asRecord(feishu.accounts);
+		if (accounts) for (const [, val] of Object.entries(accounts)) {
+			const account = asRecord(val);
+			if (account?.appId === appId) {
+				rawSecret = account.appSecret ?? feishu.appSecret;
+				break;
+			}
+		}
+	}
+	if (typeof rawSecret === "string" && rawSecret) return rawSecret;
+	if (rawSecret != null && typeof rawSecret === "object") return feishuAppSecret ?? null;
+	return null;
+}
+/**
+* Resolve the agents.md path for the given appId from the openclaw config.
+*
+* Case 1: appId matches channels.feishu.appId (single-agent path)
+*   → WORKSPACE_DIR/AGENTS.md
+*
+* Case 2: appId found in channels.feishu.accounts (multi-agent path)
+*   → find account key where account.appId === appId
+*   → find binding where match.channel=feishu && match.accountId=that key
+*   → if agentId === 'main'  → WORKSPACE_DIR/agents.md
+*   → else find agent in agents.list by id → agent.workspace/agents.md
+*
+* Returns null when the path cannot be determined.
+*/
+function resolveAgentsMdPath(appId, config) {
+	const feishu = getNestedMap(config, "channels", "feishu");
+	if (!feishu) {
+		console.error("resolveAgentsMdPath: channels.feishu not found");
+		return null;
+	}
+	if (typeof feishu.appId === "string" && feishu.appId === appId) {
+		console.error(`resolveAgentsMdPath: case=single-agent feishu.appId=${feishu.appId}`);
+		return node_path.default.join(WORKSPACE_DIR, "workspace", "AGENTS.md");
+	}
+	const accounts = asRecord(feishu.accounts);
+	if (!accounts) {
+		console.error("resolveAgentsMdPath: feishu.accounts not found");
+		return null;
+	}
+	let accountId;
+	for (const [key, val] of Object.entries(accounts)) if (asRecord(val)?.appId === appId) {
+		accountId = key;
+		break;
+	}
+	if (!accountId) {
+		console.error(`resolveAgentsMdPath: no account found with appId=${appId} in feishu.accounts keys=[${Object.keys(accounts).join(",")}]`);
+		return null;
+	}
+	console.error(`resolveAgentsMdPath: found accountId=${accountId}`);
+	const bindings = Array.isArray(config.bindings) ? config.bindings : [];
+	let agentId;
+	for (const b of bindings) {
+		const binding = asRecord(b);
+		if (!binding) continue;
+		const match = asRecord(binding.match);
+		if (match?.channel === "feishu" && match?.accountId === accountId) {
+			if (typeof binding.agentId === "string") {
+				agentId = binding.agentId;
+				break;
+			}
+		}
+	}
+	if (!agentId) {
+		console.error(`resolveAgentsMdPath: no binding found for accountId=${accountId} in bindings(count=${bindings.length})`);
+		return null;
+	}
+	console.error(`resolveAgentsMdPath: found agentId=${agentId}`);
+	if (agentId === "main") {
+		console.error("resolveAgentsMdPath: case=multi-agent-main");
+		return node_path.default.join(WORKSPACE_DIR, "workspace", "AGENTS.md");
+	}
+	const agentsObj = asRecord(config.agents);
+	const list = Array.isArray(agentsObj?.list) ? agentsObj.list : [];
+	for (const a of list) {
+		const agent = asRecord(a);
+		if (agent?.id === agentId) {
+			const ws = typeof agent.workspace === "string" ? agent.workspace : node_path.default.join(WORKSPACE_DIR, "workspace");
+			console.error(`resolveAgentsMdPath: case=multi-agent-custom agentId=${agentId} workspace=${ws}`);
+			return node_path.default.join(ws, "AGENTS.md");
+		}
+	}
+	console.error(`resolveAgentsMdPath: agentId=${agentId} not found in agents.list(count=${list.length})`);
+	return null;
+}
+function appendPeToAgentsMd(agentsMdPath) {
+	const dir = node_path.default.dirname(agentsMdPath);
+	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
+	const existing = node_fs.default.existsSync(agentsMdPath) ? node_fs.default.readFileSync(agentsMdPath, "utf-8") : "";
+	if (existing.includes(`<${PE_XML_TAG}>`)) {
+		console.error(`lark-cli-init: <${PE_XML_TAG}> already present in ${agentsMdPath}, skipping`);
+		return;
+	}
+	const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+	node_fs.default.appendFileSync(agentsMdPath, `${sep}${PE_PLACEHOLDER}`, "utf-8");
+	console.error(`lark-cli-init: appended PE placeholder to ${agentsMdPath}`);
+}
+/**
+* Collect every Feishu bot appId declared in the openclaw config.
+* Covers both single-agent (channels.feishu.appId) and multi-agent
+* (channels.feishu.accounts[*].appId) layouts. Returns a deduplicated list.
+*/
+function collectFeishuAppIds(configPath) {
+	const config = readConfig(configPath ?? CONFIG_PATH);
+	if (!config) return [];
+	const feishu = getNestedMap(config, "channels", "feishu");
+	if (!feishu) return [];
+	const appIds = /* @__PURE__ */ new Set();
+	if (typeof feishu.appId === "string" && feishu.appId) appIds.add(feishu.appId);
+	const accounts = asRecord(feishu.accounts);
+	if (accounts) for (const val of Object.values(accounts)) {
+		const account = asRecord(val);
+		if (typeof account?.appId === "string" && account.appId) appIds.add(account.appId);
+	}
+	return [...appIds];
+}
+function runLarkCliInit(opts) {
+	const configPath = opts.configPath ?? CONFIG_PATH;
+	if (!isLarkPluginInstalled(configPath)) {
+		console.error("lark-cli-init: skipping — openclaw-lark plugin not installed");
+		return {
+			ok: true,
+			skipped: true,
+			skipReason: "openclaw-lark plugin not installed"
+		};
+	}
+	if (!isLarkCliAvailable()) {
+		console.error("lark-cli-init: skipping — lark-cli command not found");
+		return {
+			ok: true,
+			skipped: true,
+			skipReason: "lark-cli command not found"
+		};
+	}
+	const config = readConfig(configPath);
+	if (!config) return {
+		ok: false,
+		error: `could not read config at ${configPath}`
+	};
+	const agentsMdPath = resolveAgentsMdPath(opts.appId, config);
+	console.error(`lark-cli-init: resolved agents.md path=${agentsMdPath ?? "(null)"}`);
+	if (!agentsMdPath) return {
+		ok: false,
+		error: `could not resolve agents.md path for appId=${opts.appId}`
+	};
+	const appSecret = resolveAppSecret(opts.appId, config, opts.feishuAppSecret);
+	if (!appSecret) return {
+		ok: false,
+		error: `could not resolve appSecret for appId=${opts.appId}`
+	};
+	console.error(`lark-cli-init: running lark-cli config init --name ${opts.appId} --app-id ${opts.appId} --brand feishu --app-secret-stdin --force-init`);
+	const initRes = (0, node_child_process.spawnSync)("lark-cli", [
+		"config",
+		"init",
+		"--name",
+		opts.appId,
+		"--app-id",
+		opts.appId,
+		"--brand",
+		"feishu",
+		"--app-secret-stdin",
+		"--force-init"
+	], {
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		encoding: "utf-8",
+		input: appSecret
+	});
+	const configInitStdout = initRes.stdout?.trim() || void 0;
+	const configInitStderr = initRes.stderr?.trim() || void 0;
+	if (configInitStdout) console.error(`lark-cli config init stdout: ${configInitStdout}`);
+	if (configInitStderr) console.error(`lark-cli config init stderr: ${configInitStderr}`);
+	if (initRes.error) return {
+		ok: false,
+		configInitStdout,
+		configInitStderr,
+		error: `lark-cli config init spawn error: ${initRes.error.message}`
+	};
+	if (initRes.status !== 0) return {
+		ok: false,
+		configInitExitCode: initRes.status ?? void 0,
+		configInitStdout,
+		configInitStderr,
+		error: `lark-cli config init exited with code ${initRes.status}`
+	};
+	appendPeToAgentsMd(agentsMdPath);
+	return {
+		ok: true,
+		configInitExitCode: 0,
+		agentsMdPath
+	};
+}
+const LARK_CLI_NAME = "lark-cli";
+async function installClis(tag, ossFileMap, opts) {
+	const homeBase = opts.homeBase ?? "/home/gem";
+	if (opts.names.length === 0) throw new Error("install-clis: must provide at least one --cli=<name>");
+	const manifest = await fetchManifest(ossFileMap, tag);
+	console.error(`[install-clis] manifest=${JSON.stringify(manifest)}`);
+	const allClis = manifest.packages.filter((p) => p.role === "cli" && p.name !== "openclaw");
+	const wanted = new Set(opts.names);
+	const targets = allClis.filter((p) => wanted.has(p.name) || p.packageName != null && wanted.has(p.packageName));
+	const foundKeys = /* @__PURE__ */ new Set();
+	for (const t of targets) {
+		foundKeys.add(t.name);
+		if (t.packageName) foundKeys.add(t.packageName);
+	}
+	const missing = opts.names.filter((n) => !foundKeys.has(n));
+	if (missing.length > 0) throw new Error(`install-clis: not found in manifest: ${missing.join(", ")}`);
+	console.error(`[install-clis] tag=${tag} targets=${targets.length}`);
+	const t0 = Date.now();
+	const tarballs = await Promise.all(targets.map(async (p) => {
+		const tb = await downloadWithCache(p, ossFileMap, opts);
+		console.error(`[install-clis]   ${p.name}: downloaded`);
+		return {
+			pkg: p,
+			tarball: tb
+		};
+	}));
+	for (const { pkg, tarball } of tarballs) {
+		installOne(pkg, tarball, homeBase, opts.tmpRoot);
+		console.error(`[install-clis]   ${pkg.name}: installed`);
+	}
+	if (targets.some((p) => p.name === LARK_CLI_NAME)) {
+		const appIds = collectFeishuAppIds();
+		console.error(`[install-clis] lark-cli installed — running lark-cli-init for ${appIds.length} appId(s): [${appIds.join(", ")}]`);
+		for (const appId of appIds) {
+			console.error(`[install-clis] lark-cli-init: appId=${appId}`);
+			const result = runLarkCliInit({
+				appId,
+				feishuAppSecret: opts.feishuAppSecret
+			});
+			console.error(`[install-clis] lark-cli-init: appId=${appId} ok=${result.ok}` + (result.skipped ? ` skipped=true reason=${result.skipReason}` : "") + (result.error ? ` error=${result.error}` : ""));
+		}
+	}
+	console.error(`[install-clis] done ${targets.length}/${targets.length} in ${Date.now() - t0}ms`);
+}
+function installOne(pkg, tarball, homeBase, tmpRoot) {
+	const targetDir = node_path.default.join(homeBase, pkg.installPath);
+	const bakDir = targetDir + ".bak";
+	const newDir = targetDir + ".new";
+	node_fs.default.mkdirSync(node_path.default.dirname(targetDir), { recursive: true });
+	if (node_fs.default.existsSync(newDir)) node_fs.default.rmSync(newDir, {
+		recursive: true,
+		force: true
+	});
+	if (node_fs.default.existsSync(bakDir)) node_fs.default.rmSync(bakDir, {
+		recursive: true,
+		force: true
+	});
+	const tmpStage = node_fs.default.mkdtempSync(node_path.default.join(tmpRoot ?? node_os.default.tmpdir(), "cli-install-"));
+	try {
+		extractTarballTolerant(tarball, tmpStage, { stripComponents: 1 });
+		if (!node_fs.default.existsSync(node_path.default.join(tmpStage, "package.json"))) throw new Error(`cli tarball missing package.json: ${pkg.name}`);
+		moveSafe(tmpStage, newDir);
+		const hadExisting = node_fs.default.existsSync(targetDir);
+		try {
+			if (hadExisting) moveSafe(targetDir, bakDir);
+			moveSafe(newDir, targetDir);
+		} catch (e) {
+			if (hadExisting && !node_fs.default.existsSync(targetDir) && node_fs.default.existsSync(bakDir)) try {
+				moveSafe(bakDir, targetDir);
+			} catch {}
+			try {
+				node_fs.default.rmSync(newDir, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+			throw e;
+		}
+		if (hadExisting && node_fs.default.existsSync(bakDir)) node_fs.default.rmSync(bakDir, {
+			recursive: true,
+			force: true
+		});
+	} finally {
+		if (node_fs.default.existsSync(tmpStage)) try {
+			node_fs.default.rmSync(tmpStage, {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+	}
+}
+//#endregion
 //#region src/oss/resolveOssFileMap.ts
 /**
 * Pick an OssFileMap in the order of decreasing specificity:
@@ -7731,342 +8081,102 @@ async function runDoctor(rawCtx, opts) {
 			aborted = true;
 			break outer;
 		}
-		if (v2.pass) {
-			console.error(`rule ${key}: revalidate -> pass (fixed) durationMs=${Date.now() - tRevalidate}`);
-			results.push({
-				rule: key,
-				status: "fixed",
-				before: v1.message
-			});
-		} else {
-			console.error(`rule ${key}: revalidate -> still-broken durationMs=${Date.now() - tRevalidate} after=${v2.message ?? ""}`);
-			results.push({
-				rule: key,
-				status: "still-broken",
-				before: v1.message,
-				after: v2.message
-			});
-			failedKeys.add(key);
-		}
-	}
-	let backupPath = null;
-	if (configDirty && !aborted) {
-		backupPath = backupConfigSync(ctx.configPath);
-		const serialized = JSON.stringify(ctx.config, null, 2);
-		try {
-			writeFile(ctx.configPath, serialized);
-			console.error(`runDoctor: writeback ok path=${ctx.configPath} bytes=${serialized.length}`);
-		} catch (e) {
-			const msg = e.message;
-			console.error(`runDoctor: writeback failed path=${ctx.configPath} message=${msg}`);
-			results.push({
-				rule: "*config-writeback*",
-				status: "error",
-				message: "config write failed: " + msg
-			});
-			aborted = true;
-		}
-	} else if (configDirty && aborted) console.error("runDoctor: writeback skipped (aborted, leaving on-disk config untouched)");
-	else console.error("runDoctor: writeback skipped (no rule transitioned to fixed)");
-	console.error(`runDoctor: end aborted=${aborted} results=${results.length}`);
-	if (originalConfig !== null) {
-		const d = (0, import_lib.diffString)(originalConfig, ctx.config, { color: false });
-		console.error(`runDoctor: diff backupPath=${backupPath ?? "(none)"} changed=${!!d}`);
-		if (d) {
-			process.stdout.write(`original:    ${backupPath ?? "(none)"}\n`);
-			process.stdout.write(`after fixed: ${ctx.configPath}\n`);
-			process.stdout.write("diff:\n");
-			process.stdout.write(d);
-			if (!d.endsWith("\n")) process.stdout.write("\n");
-		} else process.stdout.write("(no openclaw.json changes)\n");
-	}
-	return finalize(results, aborted);
-}
-/** Deep-clone a JSON-shaped value. Uses structuredClone where available
-*  (Node 17+); falls back to JSON round-trip otherwise. The config we
-*  clone here is JSON5-parsed so it's strictly tree-shaped — no
-*  references, no functions — making both paths equivalent. */
-function deepClone(v) {
-	if (typeof structuredClone === "function") return structuredClone(v);
-	return JSON.parse(JSON.stringify(v));
-}
-function finalize(results, aborted) {
-	const summary = {
-		pass: 0,
-		failed: 0,
-		fixed: 0,
-		stillBroken: 0,
-		skipped: 0,
-		error: 0,
-		unknown: 0
-	};
-	for (const r of results) switch (r.status) {
-		case "pass":
-			summary.pass++;
-			break;
-		case "failed":
-			summary.failed++;
-			break;
-		case "fixed":
-			summary.fixed++;
-			break;
-		case "still-broken":
-			summary.stillBroken++;
-			break;
-		case "skipped":
-			summary.skipped++;
-			break;
-		case "error":
-			summary.error++;
-			break;
-		case "unknown":
-			summary.unknown++;
-			break;
-	}
-	return {
-		results,
-		summary,
-		aborted
-	};
-}
-//#endregion
-//#region src/lark-cli-init.ts
-const LARK_PLUGIN_NAMES = ["openclaw-lark", "feishu-openclaw-plugin"];
-const PE_XML_TAG = "lark-cli-pe";
-const PE_PLACEHOLDER = `
-<${PE_XML_TAG}>
-**【强制要求 - 无例外】飞书所有操作必须先读 feishu-lark-cli skill。未读skill不得调用任何飞书工具，违者视为操作失误。**
-</${PE_XML_TAG}>
-`;
-function isLarkPluginInstalled(configPath) {
-	const extDir = getExtensionsDir(configPath);
-	return LARK_PLUGIN_NAMES.some((name) => {
-		try {
-			return node_fs.default.existsSync(node_path.default.join(extDir, name, "package.json"));
-		} catch {
-			return false;
-		}
-	});
-}
-function isLarkCliAvailable() {
-	try {
-		return (0, node_child_process.spawnSync)("lark-cli", ["--version"], {
-			encoding: "utf-8",
-			timeout: 5e3,
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).status === 0;
-	} catch {
-		return false;
-	}
-}
-function readConfig(configPath) {
-	try {
-		const raw = node_fs.default.readFileSync(configPath, "utf-8");
-		const parsed = loadJSON5().parse(raw);
-		return parsed != null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Resolve the feishu app secret for the given appId.
-*
-* Lookup order:
-*   1. channels.feishu.appSecret  (single-agent: feishu.appId === appId)
-*   2. channels.feishu.accounts[key].appSecret  (multi-agent: account.appId === appId)
-*
-* Value interpretation:
-*   - string  → use directly
-*   - object  → secret is managed by a provider; use `feishuAppSecret` param instead
-*
-* Returns null when the secret cannot be determined.
-*/
-function resolveAppSecret(appId, config, feishuAppSecret) {
-	const feishu = getNestedMap(config, "channels", "feishu");
-	if (!feishu) return null;
-	let rawSecret;
-	if (typeof feishu.appId === "string" && feishu.appId === appId) rawSecret = feishu.appSecret;
-	else {
-		const accounts = asRecord(feishu.accounts);
-		if (accounts) for (const [, val] of Object.entries(accounts)) {
-			const account = asRecord(val);
-			if (account?.appId === appId) {
-				rawSecret = account.appSecret ?? feishu.appSecret;
-				break;
-			}
-		}
-	}
-	if (typeof rawSecret === "string" && rawSecret) return rawSecret;
-	if (rawSecret != null && typeof rawSecret === "object") return feishuAppSecret ?? null;
-	return null;
-}
-/**
-* Resolve the agents.md path for the given appId from the openclaw config.
-*
-* Case 1: appId matches channels.feishu.appId (single-agent path)
-*   → WORKSPACE_DIR/AGENTS.md
-*
-* Case 2: appId found in channels.feishu.accounts (multi-agent path)
-*   → find account key where account.appId === appId
-*   → find binding where match.channel=feishu && match.accountId=that key
-*   → if agentId === 'main'  → WORKSPACE_DIR/agents.md
-*   → else find agent in agents.list by id → agent.workspace/agents.md
-*
-* Returns null when the path cannot be determined.
-*/
-function resolveAgentsMdPath(appId, config) {
-	const feishu = getNestedMap(config, "channels", "feishu");
-	if (!feishu) {
-		console.error("resolveAgentsMdPath: channels.feishu not found");
-		return null;
-	}
-	if (typeof feishu.appId === "string" && feishu.appId === appId) {
-		console.error(`resolveAgentsMdPath: case=single-agent feishu.appId=${feishu.appId}`);
-		return node_path.default.join(WORKSPACE_DIR, "workspace", "AGENTS.md");
-	}
-	const accounts = asRecord(feishu.accounts);
-	if (!accounts) {
-		console.error("resolveAgentsMdPath: feishu.accounts not found");
-		return null;
-	}
-	let accountId;
-	for (const [key, val] of Object.entries(accounts)) if (asRecord(val)?.appId === appId) {
-		accountId = key;
-		break;
-	}
-	if (!accountId) {
-		console.error(`resolveAgentsMdPath: no account found with appId=${appId} in feishu.accounts keys=[${Object.keys(accounts).join(",")}]`);
-		return null;
-	}
-	console.error(`resolveAgentsMdPath: found accountId=${accountId}`);
-	const bindings = Array.isArray(config.bindings) ? config.bindings : [];
-	let agentId;
-	for (const b of bindings) {
-		const binding = asRecord(b);
-		if (!binding) continue;
-		const match = asRecord(binding.match);
-		if (match?.channel === "feishu" && match?.accountId === accountId) {
-			if (typeof binding.agentId === "string") {
-				agentId = binding.agentId;
-				break;
-			}
-		}
-	}
-	if (!agentId) {
-		console.error(`resolveAgentsMdPath: no binding found for accountId=${accountId} in bindings(count=${bindings.length})`);
-		return null;
-	}
-	console.error(`resolveAgentsMdPath: found agentId=${agentId}`);
-	if (agentId === "main") {
-		console.error("resolveAgentsMdPath: case=multi-agent-main");
-		return node_path.default.join(WORKSPACE_DIR, "workspace", "AGENTS.md");
+		if (v2.pass) {
+			console.error(`rule ${key}: revalidate -> pass (fixed) durationMs=${Date.now() - tRevalidate}`);
+			results.push({
+				rule: key,
+				status: "fixed",
+				before: v1.message
+			});
+		} else {
+			console.error(`rule ${key}: revalidate -> still-broken durationMs=${Date.now() - tRevalidate} after=${v2.message ?? ""}`);
+			results.push({
+				rule: key,
+				status: "still-broken",
+				before: v1.message,
+				after: v2.message
+			});
+			failedKeys.add(key);
+		}
 	}
-	const agentsObj = asRecord(config.agents);
-	const list = Array.isArray(agentsObj?.list) ? agentsObj.list : [];
-	for (const a of list) {
-		const agent = asRecord(a);
-		if (agent?.id === agentId) {
-			const ws = typeof agent.workspace === "string" ? agent.workspace : node_path.default.join(WORKSPACE_DIR, "workspace");
-			console.error(`resolveAgentsMdPath: case=multi-agent-custom agentId=${agentId} workspace=${ws}`);
-			return node_path.default.join(ws, "AGENTS.md");
+	let backupPath = null;
+	if (configDirty && !aborted) {
+		backupPath = backupConfigSync(ctx.configPath);
+		const serialized = JSON.stringify(ctx.config, null, 2);
+		try {
+			writeFile(ctx.configPath, serialized);
+			console.error(`runDoctor: writeback ok path=${ctx.configPath} bytes=${serialized.length}`);
+		} catch (e) {
+			const msg = e.message;
+			console.error(`runDoctor: writeback failed path=${ctx.configPath} message=${msg}`);
+			results.push({
+				rule: "*config-writeback*",
+				status: "error",
+				message: "config write failed: " + msg
+			});
+			aborted = true;
 		}
+	} else if (configDirty && aborted) console.error("runDoctor: writeback skipped (aborted, leaving on-disk config untouched)");
+	else console.error("runDoctor: writeback skipped (no rule transitioned to fixed)");
+	console.error(`runDoctor: end aborted=${aborted} results=${results.length}`);
+	if (originalConfig !== null) {
+		const d = (0, import_lib.diffString)(originalConfig, ctx.config, { color: false });
+		console.error(`runDoctor: diff backupPath=${backupPath ?? "(none)"} changed=${!!d}`);
+		if (d) {
+			process.stdout.write(`original:    ${backupPath ?? "(none)"}\n`);
+			process.stdout.write(`after fixed: ${ctx.configPath}\n`);
+			process.stdout.write("diff:\n");
+			process.stdout.write(d);
+			if (!d.endsWith("\n")) process.stdout.write("\n");
+		} else process.stdout.write("(no openclaw.json changes)\n");
 	}
-	console.error(`resolveAgentsMdPath: agentId=${agentId} not found in agents.list(count=${list.length})`);
-	return null;
+	return finalize(results, aborted);
 }
-function appendPeToAgentsMd(agentsMdPath) {
-	const dir = node_path.default.dirname(agentsMdPath);
-	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
-	const existing = node_fs.default.existsSync(agentsMdPath) ? node_fs.default.readFileSync(agentsMdPath, "utf-8") : "";
-	if (existing.includes(`<${PE_XML_TAG}>`)) {
-		console.error(`lark-cli-init: <${PE_XML_TAG}> already present in ${agentsMdPath}, skipping`);
-		return;
-	}
-	const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-	node_fs.default.appendFileSync(agentsMdPath, `${sep}${PE_PLACEHOLDER}`, "utf-8");
-	console.error(`lark-cli-init: appended PE placeholder to ${agentsMdPath}`);
+/** Deep-clone a JSON-shaped value. Uses structuredClone where available
+*  (Node 17+); falls back to JSON round-trip otherwise. The config we
+*  clone here is JSON5-parsed so it's strictly tree-shaped — no
+*  references, no functions — making both paths equivalent. */
+function deepClone(v) {
+	if (typeof structuredClone === "function") return structuredClone(v);
+	return JSON.parse(JSON.stringify(v));
 }
-function runLarkCliInit(opts) {
-	const configPath = opts.configPath ?? CONFIG_PATH;
-	if (!isLarkPluginInstalled(configPath)) {
-		console.error("lark-cli-init: skipping — openclaw-lark plugin not installed");
-		return {
-			ok: true,
-			skipped: true,
-			skipReason: "openclaw-lark plugin not installed"
-		};
-	}
-	if (!isLarkCliAvailable()) {
-		console.error("lark-cli-init: skipping — lark-cli command not found");
-		return {
-			ok: true,
-			skipped: true,
-			skipReason: "lark-cli command not found"
-		};
-	}
-	const config = readConfig(configPath);
-	if (!config) return {
-		ok: false,
-		error: `could not read config at ${configPath}`
-	};
-	const agentsMdPath = resolveAgentsMdPath(opts.appId, config);
-	console.error(`lark-cli-init: resolved agents.md path=${agentsMdPath ?? "(null)"}`);
-	if (!agentsMdPath) return {
-		ok: false,
-		error: `could not resolve agents.md path for appId=${opts.appId}`
-	};
-	const appSecret = resolveAppSecret(opts.appId, config, opts.feishuAppSecret);
-	if (!appSecret) return {
-		ok: false,
-		error: `could not resolve appSecret for appId=${opts.appId}`
-	};
-	console.error(`lark-cli-init: running lark-cli config init --name ${opts.appId} --app-id ${opts.appId} --brand feishu --app-secret-stdin --force-init`);
-	const initRes = (0, node_child_process.spawnSync)("lark-cli", [
-		"config",
-		"init",
-		"--name",
-		opts.appId,
-		"--app-id",
-		opts.appId,
-		"--brand",
-		"feishu",
-		"--app-secret-stdin",
-		"--force-init"
-	], {
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		],
-		encoding: "utf-8",
-		input: appSecret
-	});
-	const configInitStdout = initRes.stdout?.trim() || void 0;
-	const configInitStderr = initRes.stderr?.trim() || void 0;
-	if (configInitStdout) console.error(`lark-cli config init stdout: ${configInitStdout}`);
-	if (configInitStderr) console.error(`lark-cli config init stderr: ${configInitStderr}`);
-	if (initRes.error) return {
-		ok: false,
-		configInitStdout,
-		configInitStderr,
-		error: `lark-cli config init spawn error: ${initRes.error.message}`
-	};
-	if (initRes.status !== 0) return {
-		ok: false,
-		configInitExitCode: initRes.status ?? void 0,
-		configInitStdout,
-		configInitStderr,
-		error: `lark-cli config init exited with code ${initRes.status}`
+function finalize(results, aborted) {
+	const summary = {
+		pass: 0,
+		failed: 0,
+		fixed: 0,
+		stillBroken: 0,
+		skipped: 0,
+		error: 0,
+		unknown: 0
 	};
-	appendPeToAgentsMd(agentsMdPath);
+	for (const r of results) switch (r.status) {
+		case "pass":
+			summary.pass++;
+			break;
+		case "failed":
+			summary.failed++;
+			break;
+		case "fixed":
+			summary.fixed++;
+			break;
+		case "still-broken":
+			summary.stillBroken++;
+			break;
+		case "skipped":
+			summary.skipped++;
+			break;
+		case "error":
+			summary.error++;
+			break;
+		case "unknown":
+			summary.unknown++;
+			break;
+	}
 	return {
-		ok: true,
-		configInitExitCode: 0,
-		agentsMdPath
+		results,
+		summary,
+		aborted
 	};
 }
 //#endregion
@@ -8149,7 +8259,7 @@ async function reportCliRun(opts) {
 //#region src/help.ts
 const BIN = "mclaw-diagnose";
 function versionBanner() {
-	return `v0.1.6`;
+	return `v0.1.7-alpha.1`;
 }
 const COMMANDS = [
 	{
@@ -8367,6 +8477,37 @@ OPTIONS
   --skip-config-update Leave plugins.installs in openclaw.json untouched.
   --ctx=<base64>       Opaque ctx; see install-openclaw for semantics.
   --oss_file_map=...   Pre-built OSS URL map (base64 JSON).
+`
+	},
+	{
+		name: "install-clis",
+		hidden: true,
+		summary: "Install CLI package(s) (role=cli) from the manifest",
+		help: `USAGE
+  ${BIN} install-clis <tag> --cli=<name>... [options]
+
+DESCRIPTION
+  Downloads + installs one or more CLI tarballs (role=cli in the manifest)
+  into <home_base>/<pkg.installPath>. Currently the only CLI in this
+  category is lark-cli (@larksuite/cli); openclaw itself is handled by the
+  dedicated install-openclaw command.
+
+  Each package is first extracted into a temporary directory (os.tmpdir(),
+  typically tmpfs) to avoid overlayfs race conditions, then ferried to a
+  sibling .new directory and atomically swapped into the final target path.
+
+ARGUMENTS
+  <tag>                Openclaw version tag, e.g. 2026.4.11.
+
+OPTIONS
+  --cli=<name>         CLI package to install by short name or scoped
+                       packageName (repeatable, at least one required).
+  --home_base=<dir>    Override the /home/gem base (tests).
+  --ctx=<base64>       Opaque ctx; ossFileMap is extracted from it.
+  --oss_file_map=...   Pre-built OSS URL map (base64 JSON); skips innerapi.
+
+EXAMPLES
+  ${BIN} install-clis 2026.4.11 --cli=lark-cli
 `
 	},
 	{
@@ -9862,7 +10003,7 @@ function parseCtxFlag(args) {
 * (The mode itself is args[0] in the filtered set, so we skip index 0.)
 */
 function getPositionalTag(args, modeName) {
-	return args.find((a, i) => i > 0 && !a.startsWith("--") && a !== modeName);
+	return args.find((a, i) => i > 0 && !a.startsWith("-") && a !== modeName);
 }
 function getFlag(args, name) {
 	const prefix = `--${name}=`;
@@ -10203,6 +10344,64 @@ async function main() {
 			if (error) throw error;
 			break;
 		}
+		case "install-clis": {
+			const tag = getPositionalTag(args, "install-clis");
+			if (!tag) {
+				console.error("Usage: install-clis <tag> --cli=<name>... [--home_base=<dir>] [--ctx=<base64> | --oss_file_map=<base64>]");
+				node_process.default.exit(1);
+			}
+			const names = getMultiFlag(args, "cli");
+			const homeBase = getFlag(args, "home_base");
+			const ossFileMapFlag = getFlag(args, "oss_file_map");
+			let installOssFileMap;
+			let rawForTelemetry;
+			if (!ossFileMapFlag) {
+				rawForTelemetry = parseCtxFlag(args) ?? await fetchCtxViaInnerApi({
+					populate: planCtxPopulate({ command: "install" }),
+					caller,
+					traceId
+				});
+				installOssFileMap = normalizeCtx(rawForTelemetry).install.ossFileMap;
+			}
+			const ossFileMap = resolveOssFileMap({
+				ossFileMapFlag,
+				installOssFileMap
+			});
+			console.error(`[install-clis] ossFileMap=${JSON.stringify(ossFileMap)}`);
+			let feishuAppSecret;
+			if (names.includes("lark-cli")) feishuAppSecret = normalizeCtx(await fetchCtxViaInnerApi({
+				populate: { app: ["feishuAppSecret"] },
+				caller,
+				traceId
+			})).app.feishuAppSecret || void 0;
+			let success = true;
+			let error;
+			try {
+				await installClis(tag, ossFileMap, {
+					names,
+					homeBase,
+					feishuAppSecret
+				});
+			} catch (e) {
+				success = false;
+				error = e;
+			}
+			if (success) console.log(JSON.stringify({ ok: true }));
+			await reportRun("install-clis", rc, rawForTelemetry, args.join(" "), Date.now() - t0, {
+				success,
+				result: {
+					tag,
+					names
+				},
+				error
+			}, {
+				scene,
+				profile,
+				fix: false
+			});
+			if (error) throw error;
+			break;
+		}
 		case "download-resource": {
 			const tag = getPositionalTag(args, "download-resource");
 			if (!tag) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/openclaw-scripts-diagnose-cli",
-  "version": "0.1.6",
+  "version": "0.1.7-alpha.1",
   "description": "CLI for OpenClaw config diagnose and repair with JSON5 support",
   "main": "dist/index.cjs",
   "bin": {