@larksuite/openclaw-lark 2025.7.15-beta.0

package/src/core/raw-request.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * raw-request.ts — 飞书 Open API 裸 HTTP 请求工具。
+ *
+ * 从 tool-client.ts 提取，提供不依赖 SDK 的直接 API 调用能力。
+ * 用于 SDK 未覆盖的 API 或需要精细控制请求的场景。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveDomainUrl = resolveDomainUrl;
+exports.rawLarkRequest = rawLarkRequest;
+const node_url_1 = require("node:url");
+const feishu_fetch_1 = require("./feishu-fetch.js");
+// ---------------------------------------------------------------------------
+// Domain URL resolution
+// ---------------------------------------------------------------------------
+/** 将 LarkBrand 映射为 API base URL。 */
+function resolveDomainUrl(brand) {
+    const map = {
+        feishu: 'https://open.feishu.cn',
+        lark: 'https://open.larksuite.com',
+    };
+    return map[brand] ?? `https://${brand}`;
+}
+function isFormDataBody(body) {
+    return (typeof body === 'object' &&
+        body !== null &&
+        typeof body.append === 'function' &&
+        typeof body.entries === 'function');
+}
+function isBinaryBody(body) {
+    return body instanceof ArrayBuffer || ArrayBuffer.isView(body);
+}
+function buildRequestBody(body) {
+    if (typeof body === 'string' || body instanceof node_url_1.URLSearchParams || isFormDataBody(body) || isBinaryBody(body)) {
+        return { body: body };
+    }
+    return {
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+    };
+}
+/**
+ * 发起 raw HTTP 请求到飞书 API，自动处理域名解析、header 注入和错误检测。
+ *
+ * 飞书 API 统一错误模式：返回 JSON 中 `code !== 0` 表示失败。
+ */
+async function rawLarkRequest(options) {
+    const baseUrl = resolveDomainUrl(options.brand);
+    const url = new URL(options.path, baseUrl);
+    if (options.query) {
+        for (const [k, v] of Object.entries(options.query)) {
+            url.searchParams.set(k, v);
+        }
+    }
+    const headers = {};
+    let requestBody;
+    if (options.accessToken) {
+        headers['Authorization'] = `Bearer ${options.accessToken}`;
+    }
+    if (options.body !== undefined) {
+        const prepared = buildRequestBody(options.body);
+        requestBody = prepared.body;
+        if (prepared.headers) {
+            Object.assign(headers, prepared.headers);
+        }
+    }
+    if (options.headers) {
+        Object.assign(headers, options.headers);
+    }
+    const resp = await (0, feishu_fetch_1.feishuFetch)(url.toString(), {
+        method: options.method ?? 'GET',
+        headers,
+        ...(requestBody !== undefined ? { body: requestBody } : {}),
+    });
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const data = (await resp.json());
+    // 飞书 API 统一错误模式：code !== 0
+    if (data.code !== undefined && data.code !== 0) {
+        const err = new Error(data.msg ?? `Lark API error: code=${data.code}`);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        err.code = data.code;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        err.msg = data.msg;
+        throw err;
+    }
+    return data;
+}

package/src/core/runtime-store.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Shared runtime store for the Feishu plugin.
+ *
+ * Allows modules such as the logger to access the plugin runtime without
+ * importing LarkClient directly, which would otherwise create static cycles.
+ */
+import type { PluginRuntime } from 'openclaw/plugin-sdk';
+export declare function setLarkRuntime(nextRuntime: PluginRuntime): void;
+export declare function tryGetLarkRuntime(): PluginRuntime | null;
+export declare function getLarkRuntime(): PluginRuntime;

package/src/core/runtime-store.js

@@ -0,0 +1,29 @@
+"use strict";
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Shared runtime store for the Feishu plugin.
+ *
+ * Allows modules such as the logger to access the plugin runtime without
+ * importing LarkClient directly, which would otherwise create static cycles.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setLarkRuntime = setLarkRuntime;
+exports.tryGetLarkRuntime = tryGetLarkRuntime;
+exports.getLarkRuntime = getLarkRuntime;
+const RUNTIME_NOT_INITIALIZED_ERROR = 'Feishu plugin runtime has not been initialised. ' +
+    'Ensure LarkClient.setRuntime() is called during plugin activation.';
+let runtime = null;
+function setLarkRuntime(nextRuntime) {
+    runtime = nextRuntime;
+}
+function tryGetLarkRuntime() {
+    return runtime;
+}
+function getLarkRuntime() {
+    if (!runtime) {
+        throw new Error(RUNTIME_NOT_INITIALIZED_ERROR);
+    }
+    return runtime;
+}

package/src/core/scope-manager.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Scope 管理模块
+ *
+ * 为所有工具动作提供类型安全的 scope 查询和检查功能。
+ *
+ * ## 三个核心概念
+ *
+ * ### 1. Required Scopes（API 需要的权限）
+ * - 定义：每个 API 调用所需的飞书权限列表
+ * - 来源：tool-scopes.ts（手动维护的类型化配置）
+ * - 示例：`["calendar:calendar.event:create", "calendar:calendar.event:update"]`
+ * - 用途：判断应用和用户是否需要申请/授权权限
+ *
+ * ### 2. App Granted Scopes（应用已开通的权限）
+ * - 定义：应用在飞书开放平台配置并获得管理员批准的权限
+ * - 来源：通过 API 查询 `/open-apis/application/v6/applications`
+ * - 作用：应用级权限前置检查，避免无效的用户授权请求
+ * - 检查时机：在请求用户授权前
+ *
+ * ### 3. User Granted Scopes（用户授权的权限）
+ * - 定义：用户通过 OAuth 流程明确授权给应用的权限
+ * - 来源：OAuth token 中的 scope 字段
+ * - 作用：用户级权限检查，确保用户已授权所需权限
+ * - 检查时机：每次 API 调用前
+ *
+ * ## 权限检查流程
+ *
+ * ```
+ * 1. 获取 Required Scopes (API 需要什么权限？)
+ *    ↓
+ * 2. 检查 App Granted Scopes (应用开通了吗？)
+ *    ↓ 是
+ * 3. 检查 User Granted Scopes (用户授权了吗？)
+ *    ↓ 是
+ * 4. 调用 API
+ * ```
+ */
+import { TOOL_SCOPES, type ToolActionKey, type ToolScopeMapping } from './tool-scopes';
+export type { ToolActionKey, ToolScopeMapping };
+export { TOOL_SCOPES };
+/**
+ * 获取单个工具动作所需的 scopes（Required Scopes）
+ *
+ * @param toolAction - 工具动作键（例如 "feishu_calendar_event.create"）
+ * @returns API 需要的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const requiredScopes = getRequiredScopes("feishu_calendar_event.create");
+ * // 返回: ["calendar:calendar.event:create", "calendar:calendar.event:update"]
+ * ```
+ */
+export declare function getRequiredScopes(toolAction: ToolActionKey): string[];
+/**
+ * 获取多个工具动作的合并 Required Scopes（去重）
+ *
+ * @param toolActions - 工具动作键数组
+ * @returns 去重并排序后的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const requiredScopes = getRequiredScopesForActions([
+ *   "feishu_calendar_event.create",
+ *   "feishu_calendar_event.list"
+ * ]);
+ * // 返回两个动作的所有唯一 scopes
+ * ```
+ */
+export declare function getRequiredScopesForActions(toolActions: ToolActionKey[]): string[];
+/**
+ * 检查工具动作是否需要任何 scope
+ *
+ * @param toolAction - 工具动作键
+ * @returns 如果动作需要至少一个 scope 则返回 true
+ *
+ * @example
+ * ```ts
+ * hasRequiredScopes("feishu_calendar_event.create"); // true
+ * hasRequiredScopes("feishu_sheets_spreadsheet.create"); // false (空数组)
+ * ```
+ */
+export declare function hasRequiredScopes(toolAction: ToolActionKey): boolean;
+/**
+ * 获取需要特定 scope 的所有工具动作
+ *
+ * @param scope - Scope 字符串（例如 "calendar:calendar.event:create"）
+ * @returns 需要此 scope 的工具动作键数组
+ *
+ * @example
+ * ```ts
+ * const actions = getActionsForScope("calendar:calendar.event:create");
+ * // 返回: ["feishu_calendar_event.create"]
+ * ```
+ */
+export declare function getActionsForScope(scope: string): ToolActionKey[];
+/**
+ * 检查应用是否开通了工具动作所需的所有权限（App Granted Scopes）
+ *
+ * @param toolAction - 工具动作键
+ * @param appGrantedScopes - 应用已开通的 scope 集合（来自开放平台）
+ * @returns 如果应用已开通所有必需的 scopes 则返回 true
+ *
+ * @example
+ * ```ts
+ * const appScopes = new Set([
+ *   "calendar:calendar.event:create",
+ *   "calendar:calendar.event:update"
+ * ]);
+ * checkAppScopes("feishu_calendar_event.create", appScopes); // true
+ *
+ * const partialAppScopes = new Set(["calendar:calendar.event:create"]);
+ * checkAppScopes("feishu_calendar_event.create", partialAppScopes); // false
+ * ```
+ */
+export declare function checkAppScopes(toolAction: ToolActionKey, appGrantedScopes: Set<string> | string[]): boolean;
+/**
+ * 获取应用未开通的 scopes
+ *
+ * @param toolAction - 工具动作键
+ * @param appGrantedScopes - 应用已开通的 scope 集合
+ * @returns 应用未开通的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const appScopes = new Set(["calendar:calendar.event:create"]);
+ * const missing = getMissingAppScopes("feishu_calendar_event.create", appScopes);
+ * // 返回: ["calendar:calendar.event:update"]
+ * ```
+ */
+export declare function getMissingAppScopes(toolAction: ToolActionKey, appGrantedScopes: Set<string> | string[]): string[];
+/**
+ * 检查用户是否授权了工具动作所需的所有权限（User Granted Scopes）
+ *
+ * @param toolAction - 工具动作键
+ * @param userGrantedScopes - 用户已授权的 scope 集合（来自 OAuth token）
+ * @returns 如果用户已授权所有必需的 scopes 则返回 true
+ *
+ * @example
+ * ```ts
+ * const userScopes = new Set([
+ *   "calendar:calendar.event:create",
+ *   "calendar:calendar.event:update"
+ * ]);
+ * checkUserScopes("feishu_calendar_event.create", userScopes); // true
+ *
+ * const partialUserScopes = new Set(["calendar:calendar.event:create"]);
+ * checkUserScopes("feishu_calendar_event.create", partialUserScopes); // false
+ * ```
+ */
+export declare function checkUserScopes(toolAction: ToolActionKey, userGrantedScopes: Set<string> | string[]): boolean;
+/**
+ * 获取用户未授权的 scopes
+ *
+ * @param toolAction - 工具动作键
+ * @param userGrantedScopes - 用户已授权的 scope 集合
+ * @returns 用户未授权的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const userScopes = new Set(["calendar:calendar.event:create"]);
+ * const missing = getMissingUserScopes("feishu_calendar_event.create", userScopes);
+ * // 返回: ["calendar:calendar.event:update"]
+ * ```
+ */
+export declare function getMissingUserScopes(toolAction: ToolActionKey, userGrantedScopes: Set<string> | string[]): string[];

package/src/core/scope-manager.js

@@ -0,0 +1,224 @@
+"use strict";
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Scope 管理模块
+ *
+ * 为所有工具动作提供类型安全的 scope 查询和检查功能。
+ *
+ * ## 三个核心概念
+ *
+ * ### 1. Required Scopes（API 需要的权限）
+ * - 定义：每个 API 调用所需的飞书权限列表
+ * - 来源：tool-scopes.ts（手动维护的类型化配置）
+ * - 示例：`["calendar:calendar.event:create", "calendar:calendar.event:update"]`
+ * - 用途：判断应用和用户是否需要申请/授权权限
+ *
+ * ### 2. App Granted Scopes（应用已开通的权限）
+ * - 定义：应用在飞书开放平台配置并获得管理员批准的权限
+ * - 来源：通过 API 查询 `/open-apis/application/v6/applications`
+ * - 作用：应用级权限前置检查，避免无效的用户授权请求
+ * - 检查时机：在请求用户授权前
+ *
+ * ### 3. User Granted Scopes（用户授权的权限）
+ * - 定义：用户通过 OAuth 流程明确授权给应用的权限
+ * - 来源：OAuth token 中的 scope 字段
+ * - 作用：用户级权限检查，确保用户已授权所需权限
+ * - 检查时机：每次 API 调用前
+ *
+ * ## 权限检查流程
+ *
+ * ```
+ * 1. 获取 Required Scopes (API 需要什么权限？)
+ *    ↓
+ * 2. 检查 App Granted Scopes (应用开通了吗？)
+ *    ↓ 是
+ * 3. 检查 User Granted Scopes (用户授权了吗？)
+ *    ↓ 是
+ * 4. 调用 API
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOOL_SCOPES = void 0;
+exports.getRequiredScopes = getRequiredScopes;
+exports.getRequiredScopesForActions = getRequiredScopesForActions;
+exports.hasRequiredScopes = hasRequiredScopes;
+exports.getActionsForScope = getActionsForScope;
+exports.checkAppScopes = checkAppScopes;
+exports.getMissingAppScopes = getMissingAppScopes;
+exports.checkUserScopes = checkUserScopes;
+exports.getMissingUserScopes = getMissingUserScopes;
+const tool_scopes_1 = require("./tool-scopes.js");
+Object.defineProperty(exports, "TOOL_SCOPES", { enumerable: true, get: function () { return tool_scopes_1.TOOL_SCOPES; } });
+// ===== 函数：Required Scopes（API 需要的权限）=====
+/**
+ * 获取单个工具动作所需的 scopes（Required Scopes）
+ *
+ * @param toolAction - 工具动作键（例如 "feishu_calendar_event.create"）
+ * @returns API 需要的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const requiredScopes = getRequiredScopes("feishu_calendar_event.create");
+ * // 返回: ["calendar:calendar.event:create", "calendar:calendar.event:update"]
+ * ```
+ */
+function getRequiredScopes(toolAction) {
+    return tool_scopes_1.TOOL_SCOPES[toolAction] ?? [];
+}
+/**
+ * 获取多个工具动作的合并 Required Scopes（去重）
+ *
+ * @param toolActions - 工具动作键数组
+ * @returns 去重并排序后的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const requiredScopes = getRequiredScopesForActions([
+ *   "feishu_calendar_event.create",
+ *   "feishu_calendar_event.list"
+ * ]);
+ * // 返回两个动作的所有唯一 scopes
+ * ```
+ */
+function getRequiredScopesForActions(toolActions) {
+    const scopesSet = new Set();
+    for (const action of toolActions) {
+        const scopes = getRequiredScopes(action);
+        scopes.forEach((scope) => scopesSet.add(scope));
+    }
+    return Array.from(scopesSet).sort();
+}
+/**
+ * 检查工具动作是否需要任何 scope
+ *
+ * @param toolAction - 工具动作键
+ * @returns 如果动作需要至少一个 scope 则返回 true
+ *
+ * @example
+ * ```ts
+ * hasRequiredScopes("feishu_calendar_event.create"); // true
+ * hasRequiredScopes("feishu_sheets_spreadsheet.create"); // false (空数组)
+ * ```
+ */
+function hasRequiredScopes(toolAction) {
+    return getRequiredScopes(toolAction).length > 0;
+}
+/**
+ * 获取需要特定 scope 的所有工具动作
+ *
+ * @param scope - Scope 字符串（例如 "calendar:calendar.event:create"）
+ * @returns 需要此 scope 的工具动作键数组
+ *
+ * @example
+ * ```ts
+ * const actions = getActionsForScope("calendar:calendar.event:create");
+ * // 返回: ["feishu_calendar_event.create"]
+ * ```
+ */
+function getActionsForScope(scope) {
+    const actions = [];
+    for (const [action, scopes] of Object.entries(tool_scopes_1.TOOL_SCOPES)) {
+        if (scopes.includes(scope)) {
+            actions.push(action);
+        }
+    }
+    return actions;
+}
+// ===== 函数：App Scope 检查 =====
+/**
+ * 检查应用是否开通了工具动作所需的所有权限（App Granted Scopes）
+ *
+ * @param toolAction - 工具动作键
+ * @param appGrantedScopes - 应用已开通的 scope 集合（来自开放平台）
+ * @returns 如果应用已开通所有必需的 scopes 则返回 true
+ *
+ * @example
+ * ```ts
+ * const appScopes = new Set([
+ *   "calendar:calendar.event:create",
+ *   "calendar:calendar.event:update"
+ * ]);
+ * checkAppScopes("feishu_calendar_event.create", appScopes); // true
+ *
+ * const partialAppScopes = new Set(["calendar:calendar.event:create"]);
+ * checkAppScopes("feishu_calendar_event.create", partialAppScopes); // false
+ * ```
+ */
+function checkAppScopes(toolAction, appGrantedScopes) {
+    const requiredScopes = getRequiredScopes(toolAction);
+    // 如果不需要任何 scope，则总是满足要求
+    if (requiredScopes.length === 0) {
+        return true;
+    }
+    const grantedSet = Array.isArray(appGrantedScopes) ? new Set(appGrantedScopes) : appGrantedScopes;
+    return requiredScopes.every((scope) => grantedSet.has(scope));
+}
+/**
+ * 获取应用未开通的 scopes
+ *
+ * @param toolAction - 工具动作键
+ * @param appGrantedScopes - 应用已开通的 scope 集合
+ * @returns 应用未开通的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const appScopes = new Set(["calendar:calendar.event:create"]);
+ * const missing = getMissingAppScopes("feishu_calendar_event.create", appScopes);
+ * // 返回: ["calendar:calendar.event:update"]
+ * ```
+ */
+function getMissingAppScopes(toolAction, appGrantedScopes) {
+    const requiredScopes = getRequiredScopes(toolAction);
+    const grantedSet = Array.isArray(appGrantedScopes) ? new Set(appGrantedScopes) : appGrantedScopes;
+    return requiredScopes.filter((scope) => !grantedSet.has(scope));
+}
+// ===== 函数：User Scope 检查 =====
+/**
+ * 检查用户是否授权了工具动作所需的所有权限（User Granted Scopes）
+ *
+ * @param toolAction - 工具动作键
+ * @param userGrantedScopes - 用户已授权的 scope 集合（来自 OAuth token）
+ * @returns 如果用户已授权所有必需的 scopes 则返回 true
+ *
+ * @example
+ * ```ts
+ * const userScopes = new Set([
+ *   "calendar:calendar.event:create",
+ *   "calendar:calendar.event:update"
+ * ]);
+ * checkUserScopes("feishu_calendar_event.create", userScopes); // true
+ *
+ * const partialUserScopes = new Set(["calendar:calendar.event:create"]);
+ * checkUserScopes("feishu_calendar_event.create", partialUserScopes); // false
+ * ```
+ */
+function checkUserScopes(toolAction, userGrantedScopes) {
+    const requiredScopes = getRequiredScopes(toolAction);
+    // 如果不需要任何 scope，则总是满足要求
+    if (requiredScopes.length === 0) {
+        return true;
+    }
+    const grantedSet = Array.isArray(userGrantedScopes) ? new Set(userGrantedScopes) : userGrantedScopes;
+    return requiredScopes.every((scope) => grantedSet.has(scope));
+}
+/**
+ * 获取用户未授权的 scopes
+ *
+ * @param toolAction - 工具动作键
+ * @param userGrantedScopes - 用户已授权的 scope 集合
+ * @returns 用户未授权的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const userScopes = new Set(["calendar:calendar.event:create"]);
+ * const missing = getMissingUserScopes("feishu_calendar_event.create", userScopes);
+ * // 返回: ["calendar:calendar.event:update"]
+ * ```
+ */
+function getMissingUserScopes(toolAction, userGrantedScopes) {
+    const requiredScopes = getRequiredScopes(toolAction);
+    const grantedSet = Array.isArray(userGrantedScopes) ? new Set(userGrantedScopes) : userGrantedScopes;
+    return requiredScopes.filter((scope) => !grantedSet.has(scope));
+}

package/src/core/sdk-compat.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Local shim for readReactionParams whose SDK signature changed in
+ * 2026.3.14 (now requires a channel-specific config object).
+ * Re-exports jsonResult from the SDK directly.
+ */
+export { jsonResult } from 'openclaw/plugin-sdk/agent-runtime';
+/**
+ * Extract reaction parameters from raw action params.
+ * Returns emoji, remove flag, and isEmpty indicator.
+ */
+export declare function readReactionParams(params: Record<string, unknown>, opts?: {
+    removeErrorMessage?: string;
+}): {
+    emoji: string;
+    remove: boolean;
+    isEmpty: boolean;
+};

package/src/core/sdk-compat.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Local shim for readReactionParams whose SDK signature changed in
+ * 2026.3.14 (now requires a channel-specific config object).
+ * Re-exports jsonResult from the SDK directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jsonResult = void 0;
+exports.readReactionParams = readReactionParams;
+var agent_runtime_1 = require("openclaw/plugin-sdk/agent-runtime");
+Object.defineProperty(exports, "jsonResult", { enumerable: true, get: function () { return agent_runtime_1.jsonResult; } });
+/**
+ * Extract reaction parameters from raw action params.
+ * Returns emoji, remove flag, and isEmpty indicator.
+ */
+function readReactionParams(params, opts) {
+    const raw = params.emoji ?? params.reaction ?? params.type;
+    const emoji = typeof raw === 'string' ? raw.trim() : '';
+    const remove = Boolean(params.remove ?? params.unreact);
+    const isEmpty = !emoji && !remove;
+    if (remove && !emoji && opts?.removeErrorMessage) {
+        throw new Error(opts.removeErrorMessage);
+    }
+    return { emoji, remove, isEmpty };
+}

package/src/core/security-check.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Multi-account isolation checks.
+ *
+ * Detects potentially unsafe configurations where multiple Feishu accounts
+ * belonging to different tenants (different appId) share the default agent
+ * without proper isolation via agents + bindings.
+ */
+import type { ClawdbotConfig } from 'openclaw/plugin-sdk';
+import type { LarkAccount } from './types';
+export type IsolationStatus = 
+/** Single account / same appId / no multi-tenant concern */
+{
+    mode: 'not-applicable';
+}
+/** All accounts have bindings pointing to different agents */
+ | {
+    mode: 'isolated';
+    accounts: LarkAccount[];
+}
+/** All accounts have bindings but share the same agent (explicit choice) */
+ | {
+    mode: 'shared-explicit';
+    accounts: LarkAccount[];
+    sharedAgentId: string;
+}
+/** Some or all accounts have no bindings — implicit sharing, risky */
+ | {
+    mode: 'shared-implicit';
+    accounts: LarkAccount[];
+    unboundAccounts: LarkAccount[];
+};
+/**
+ * Diagnose whether multiple enabled accounts from different tenants
+ * are properly isolated via agent bindings.
+ */
+export declare function checkMultiAccountIsolation(cfg: ClawdbotConfig): IsolationStatus;
+/**
+ * Check whether `session.dmScope` is set to per-account isolation.
+ *
+ * Without this setting, different bots talking to the same user share
+ * the same session — even if agent bindings are configured.
+ */
+export declare function needsDmScopeFix(cfg: ClawdbotConfig): boolean;
+/** Return the fix command string, or null if not needed. */
+export declare function getDmScopeFixCommand(cfg: ClawdbotConfig): string | null;
+/**
+ * Generate a combined warning block for doctor / start.
+ * Returns null when everything is fine.
+ */
+export declare function formatIsolationWarning(status: IsolationStatus, cfg?: ClawdbotConfig): string | null;
+/**
+ * Generate `openclaw config set` commands for per-account isolation.
+ */
+export declare function generateIsolationFixCommands(cfg: ClawdbotConfig): {
+    commands: string[];
+    preview: string;
+} | null;
+/**
+ * Generate commands for explicitly sharing the same agent across accounts.
+ */
+export declare function generateSharedAgentCommands(cfg: ClawdbotConfig): {
+    commands: string[];
+    preview: string;
+} | null;
+export declare function collectIsolationWarnings(_cfg: ClawdbotConfig): string[];
+export declare function emitSecurityWarnings(_cfg: ClawdbotConfig, _logger: {
+    warn?: (msg: string) => void;
+    info?: (msg: string) => void;
+}): void;