npm - @larktask/aamp-feishu-task-agent - Versions diffs - 0.1.0-dev.173 → 0.1.1-dev.2 - Mend

@larktask/aamp-feishu-task-agent 0.1.0-dev.173 → 0.1.1-dev.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/README.md +114 -18
package/bin/agent-metadata.mjs +54 -0
package/bin/feishu-task-agent-controller.mjs +1903 -340
package/bin/runtime-concurrency.mjs +71 -0
package/bin/runtime-network.mjs +13 -0
package/bin/runtime-package-executable.mjs +254 -0
package/bin/traecode-readiness.mjs +173 -0
package/bootstrap/aamp-feishu-task-agent-bootstrap.sh +1433 -48
package/package.json +1 -1

package/bootstrap/aamp-feishu-task-agent-bootstrap.sh CHANGED Viewed

@@ -7,6 +7,9 @@ APP_ID=""
 APP_SECRET=""
 BOT_NAME=""
 LARK_CLI_PROFILE=""
+AGENT_EXECUTION_LOCATION=""
+AGENT_ATTACHMENT_POLICY=""
+AGENT_TASK_DISPATCH_CONCURRENCY=""
 AAMP_HOST="https://meshmail.ai"
 DEBUG_MODE="false"
 AAMP_TASK_START_MODE="install"
@@ -15,6 +18,7 @@ AAMP_TASK_ENTRY="${AAMP_TASK_ENTRY:-}"
 AAMP_TASK_INTERNAL="${AAMP_TASK_INTERNAL:-false}"
 AAMP_TASK_INTERNAL_RESULT_FD="${AAMP_TASK_INTERNAL_RESULT_FD:-3}"
 AAMP_TASK_INTERNAL_INPUT_FD="${AAMP_TASK_INTERNAL_INPUT_FD:-4}"
+AAMP_TASK_INTERNAL_EXECUTION_LOCATION="${AAMP_TASK_INTERNAL_EXECUTION_LOCATION:-}"
 NPM_REGISTRY="${NPM_REGISTRY:-https://registry.npmjs.org/}"
 NPM_CACHE_DIR="${NPM_CONFIG_CACHE:-${npm_config_cache:-${TMPDIR:-/tmp}/aamp-one-click-npm-cache}}"
 NPM_GLOBAL_PREFIX="${NPM_GLOBAL_PREFIX:-$HOME/.aamp/npm-global}"
@@ -47,25 +51,67 @@ CODEM_INSTALLER_URL="${CODEM_INSTALLER_URL:-https://sf-unpkg-src.bytedance.net/@
 CODEM_INSTALLER_CONFIRM="${CODEM_INSTALLER_CONFIRM:-}"
 CODEM_PROVIDER_PREFLIGHT="${CODEM_PROVIDER_PREFLIGHT:-true}"
 CODEM_PROVIDER_PREFLIGHT_TIMEOUT_SECONDS="${CODEM_PROVIDER_PREFLIGHT_TIMEOUT_SECONDS:-60}"
+CODEX_CHATGPT_APP_CLI="/Applications/ChatGPT.app/Contents/Resources/codex"
 CODEX_APP_CLI="/Applications/Codex.app/Contents/Resources/codex"
 CODEX_AUTO_UPDATE="${CODEX_AUTO_UPDATE:-true}"
 CODEX_NPM_PACKAGE="${CODEX_NPM_PACKAGE:-@openai/codex}"
+CODEX_UPDATE_CACHE_FILE="${CODEX_UPDATE_CACHE_FILE:-$HOME/.aamp/feishu-task-agent/codex-update-cache.json}"
+CODEX_UPDATE_CACHE_TTL_SECONDS="${CODEX_UPDATE_CACHE_TTL_SECONDS:-86400}"
 CODEX_ACP_PKG="${CODEX_ACP_PKG:-@agentclientprotocol/codex-acp@1.0.2}"
+AAMP_TRAE_CLI_BIN="${AAMP_TRAE_CLI_BIN:-}"
+AAMP_TRAE_LOGIN_STATUS_TIMEOUT_SECONDS="${AAMP_TRAE_LOGIN_STATUS_TIMEOUT_SECONDS:-10}"
+AAMP_TRAECODE_CLI_BIN="${AAMP_TRAECODE_CLI_BIN:-}"
+AAMP_TRAECODE_CHECK_TIMEOUT_SECONDS="${AAMP_TRAECODE_CHECK_TIMEOUT_SECONDS:-10}"
+AAMP_TRAECODE_READINESS_HELPER="${AAMP_TRAECODE_READINESS_HELPER:-}"
+AAMP_TRAECODE_UPDATE_TTY="${AAMP_TRAECODE_UPDATE_TTY:-/dev/tty}"
+TRAEX_INSTALLER_URL="${TRAEX_INSTALLER_URL:-https://code.byted.org/api/tos-proxy/download/traex_install.sh}"
+WORKBUDDY_APP_CLI="/Applications/WorkBuddy.app/Contents/Resources/app.asar.unpacked/cli/bin/codebuddy"
+WORKBUDDY_AI_APP_CLI="/Applications/WorkBuddy AI.app/Contents/Resources/app.asar.unpacked/cli/bin/codebuddy"
 LARK_REGISTER_APP_SDK="${LARK_REGISTER_APP_SDK:-@larksuiteoapi/node-sdk@1.68.0}"
 LARK_CLI_MIN_VERSION="${LARK_CLI_MIN_VERSION:-1.0.64}"
-FEISHU_APP_SCOPES_TENANT="${FEISHU_APP_SCOPES_TENANT:-im:message,im:message:send_as_bot,im:message:readonly,im:resource,cardkit:card:write,task:task,task:comment,task:task:readonly,task:comment:readonly,task:attachment:delete,task:attachment:file:download,task:attachment:read,task:attachment:upload,task:attachment:write,task:comment:delete,task:comment:read,task:comment:write,task:comment:writeonly,task:task:delete,task:task:read,task:task:write,task:task:writeonly,task:tasklist:delete,task:tasklist:read,task:tasklist:write,task:tasklist:writeonly,search:docs:read,base:app:copy,base:app:create,base:app:read,base:app:update,base:block:create,base:block:delete,base:block:read,base:block:update,base:dashboard:create,base:dashboard:delete,base:dashboard:read,base:dashboard:update,base:field:create,base:field:delete,base:field:read,base:field:update,base:form:create,base:form:delete,base:form:read,base:form:update,base:history:read,base:record:create,base:record:delete,base:record:read,base:record:update,base:role:create,base:role:delete,base:role:read,base:role:update,base:table:create,base:table:delete,base:table:read,base:table:update,base:view:read,base:view:write_only,base:workflow:create,base:workflow:read,base:workflow:update,board:whiteboard:node:create,board:whiteboard:node:read,calendar:calendar.event:create,calendar:calendar.event:delete,calendar:calendar.event:read,calendar:calendar.event:reply,calendar:calendar.event:update,calendar:calendar.free_busy:read,calendar:calendar:create,calendar:calendar:delete,calendar:calendar:read,calendar:calendar:update,contact:user.base:readonly,contact:user.basic_profile:readonly,docs:document.media:download,docs:document.media:upload,docs:document:export,docs:document:import,docx:document:create,docx:document:readonly,docx:document:write_only,drive:drive.metadata:readonly,drive:file:download,drive:file:upload,im:chat.managers:write_only,im:chat.members:read,im:chat.members:write_only,im:chat.moderation:read,im:chat:moderation:write_only,im:message.pins:read,im:message.pins:write_only,im:message.reactions:read,im:message.reactions:write_only,im:message:recall,mail:user_mailbox.event.mail_address:read,mail:user_mailbox.mail_contact:read,mail:user_mailbox.message.address:read,mail:user_mailbox.message.body:read,mail:user_mailbox.message.subject:read,mindnote:node:create,mindnote:node:read,minutes:minutes.basic:read,minutes:minutes.media:export,minutes:minutes:readonly,sheets:spreadsheet.meta:read,sheets:spreadsheet.meta:write_only,sheets:spreadsheet:create,sheets:spreadsheet:read,sheets:spreadsheet:write_only,slides:presentation:create,slides:presentation:read,slides:presentation:update,slides:presentation:write_only,task:custom_field:read,task:custom_field:write,task:section:read,task:section:write,vc:meeting.bot.join:write,vc:meeting.meetingevent:read,vc:meeting.message:write,vc:record:readonly,wiki:member:create,wiki:member:retrieve,wiki:member:update,wiki:node:copy,wiki:node:create,wiki:node:move,wiki:node:read,wiki:node:retrieve,wiki:space:read,wiki:space:retrieve,wiki:space:write_only}"
-FEISHU_APP_SCOPES_USER="${FEISHU_APP_SCOPES_USER:-im:message,im:message:readonly,im:resource,cardkit:card:write,task:task,task:comment,task:task:readonly,task:comment:readonly,task:attachment:delete,task:attachment:file:download,task:attachment:read,task:attachment:upload,task:attachment:write,task:comment:delete,task:comment:read,task:comment:write,task:comment:writeonly,task:task:delete,task:task:read,task:task:write,task:task:writeonly,task:tasklist:delete,task:tasklist:read,task:tasklist:write,task:tasklist:writeonly,search:docs:read,search:message,base:app:copy,base:app:create,base:app:read,base:app:update,base:block:create,base:block:delete,base:block:read,base:block:update,base:dashboard:create,base:dashboard:delete,base:dashboard:read,base:dashboard:update,base:field:create,base:field:delete,base:field:read,base:field:update,base:form:create,base:form:delete,base:form:read,base:form:update,base:history:read,base:record:create,base:record:delete,base:record:read,base:record:update,base:role:create,base:role:delete,base:role:read,base:role:update,base:table:create,base:table:delete,base:table:read,base:table:update,base:view:read,base:view:write_only,base:workflow:create,base:workflow:read,base:workflow:update,board:whiteboard:node:create,board:whiteboard:node:read,calendar:calendar.event:create,calendar:calendar.event:delete,calendar:calendar.event:read,calendar:calendar.event:reply,calendar:calendar.event:update,calendar:calendar.free_busy:read,calendar:calendar:create,calendar:calendar:delete,calendar:calendar:read,calendar:calendar:update,contact:user.base:readonly,contact:user.basic_profile:readonly,contact:user:search,docs:document.media:download,docs:document.media:upload,docs:document:export,docs:document:import,docx:document:create,docx:document:readonly,docx:document:write_only,drive:drive.metadata:readonly,drive:file:download,drive:file:upload,im:chat.managers:write_only,im:chat.members:read,im:chat.members:write_only,im:chat.moderation:read,im:chat.nickname:read,im:chat.nickname:write,im:chat.user_setting:read,im:chat.user_setting:write,im:chat:read,im:chat:update,im:chat:create_by_user,im:chat:moderation:write_only,im:feed.flag:read,im:feed.flag:write,im:feed.shortcut:read,im:feed.shortcut:write,im:feed_group_v1:read,im:feed_group_v1:write,im:message.group_msg:get_as_user,im:message.p2p_msg:get_as_user,im:message.pins:read,im:message.pins:write_only,im:message.reactions:read,im:message.reactions:write_only,im:message:recall,mail:event,mail:user_mailbox.event.mail_address:read,mail:user_mailbox.mail_contact:read,mail:user_mailbox.message.address:read,mail:user_mailbox.message.body:read,mail:user_mailbox.message.subject:read,mindnote:node:create,mindnote:node:read,minutes:minutes.artifacts:read,minutes:minutes.basic:read,minutes:minutes.media:export,minutes:minutes.search:read,minutes:minutes.upload:write,minutes:minutes:readonly,minutes:minutes:update,profile:user_profile:read,sheets:spreadsheet.meta:read,sheets:spreadsheet.meta:write_only,sheets:spreadsheet:create,sheets:spreadsheet:read,sheets:spreadsheet:write_only,slides:presentation:create,slides:presentation:read,slides:presentation:update,slides:presentation:write_only,task:custom_field:read,task:custom_field:write,task:section:read,task:section:write,vc:meeting.bot.join:write,vc:meeting.meetingevent:read,vc:meeting.message:write,vc:meeting.search:read,vc:note:read,vc:record:readonly,wiki:member:create,wiki:member:retrieve,wiki:member:update,wiki:node:copy,wiki:node:create,wiki:node:move,wiki:node:read,wiki:node:retrieve,wiki:space:read,wiki:space:retrieve,wiki:space:write_only}"
+AAMP_FEISHU_APP_SCOPES_TENANT_OVERRIDE="${FEISHU_APP_SCOPES_TENANT-}"
+AAMP_FEISHU_APP_SCOPES_USER_OVERRIDE="${FEISHU_APP_SCOPES_USER-}"
+AAMP_FEISHU_USER_AUTH_REQUIRED_SCOPES_OVERRIDE="${FEISHU_USER_AUTH_REQUIRED_SCOPES-}"
+AAMP_FEISHU_USER_AUTH_REQUESTED_SCOPES_OVERRIDE="${FEISHU_USER_AUTH_REQUESTED_SCOPES-}"
+AAMP_FEISHU_USER_AUTH_EXCLUDES_OVERRIDE="${FEISHU_USER_AUTH_EXCLUDES-}"
+FEISHU_APP_SCOPES_TENANT="$AAMP_FEISHU_APP_SCOPES_TENANT_OVERRIDE"
+FEISHU_APP_SCOPES_USER="$AAMP_FEISHU_APP_SCOPES_USER_OVERRIDE"
 FEISHU_APP_EVENTS_TENANT="${FEISHU_APP_EVENTS_TENANT:-task.task.update_user_access_v2}"
 FEISHU_APP_EVENTS_USER="${FEISHU_APP_EVENTS_USER:-task.task.update_user_access_v2}"
-FEISHU_USER_AUTH_DOMAINS="${FEISHU_USER_AUTH_DOMAINS:-base,calendar,contact,docs,im,mail,mindnotes,minutes,note,sheets,slides,task,vc,wiki}"
-FEISHU_USER_AUTH_EXCLUDES="${FEISHU_USER_AUTH_EXCLUDES:-im:message.send_as_user,mail:user_mailbox.message:send,mail:user_mailbox.rule:read,mail:user_mailbox.folder:write,mail:user_mailbox.rule:write,mail:user_mailbox.message:modify,mail:user_mailbox.message:readonly,mail:user_mailbox.folder:read,mail:user_mailbox.mail_contact:write,mail:user_mailbox:readonly}"
-FEISHU_USER_AUTH_REQUIRED_SCOPES="${FEISHU_USER_AUTH_REQUIRED_SCOPES:-im:message im:message:readonly im:resource cardkit:card:write task:task task:comment task:task:readonly task:comment:readonly task:attachment:delete task:attachment:file:download task:attachment:read task:attachment:upload task:attachment:write task:comment:delete task:comment:read task:comment:write task:comment:writeonly task:task:delete task:task:read task:task:write task:task:writeonly task:tasklist:delete task:tasklist:read task:tasklist:write task:tasklist:writeonly search:docs:read search:message base:app:copy base:app:create base:app:read base:app:update base:block:create base:block:delete base:block:read base:block:update base:dashboard:create base:dashboard:delete base:dashboard:read base:dashboard:update base:field:create base:field:delete base:field:read base:field:update base:form:create base:form:delete base:form:read base:form:update base:history:read base:record:create base:record:delete base:record:read base:record:update base:role:create base:role:delete base:role:read base:role:update base:table:create base:table:delete base:table:read base:table:update base:view:read base:view:write_only base:workflow:create base:workflow:read base:workflow:update board:whiteboard:node:create board:whiteboard:node:read calendar:calendar.event:create calendar:calendar.event:delete calendar:calendar.event:read calendar:calendar.event:reply calendar:calendar.event:update calendar:calendar.free_busy:read calendar:calendar:create calendar:calendar:delete calendar:calendar:read calendar:calendar:update contact:user.base:readonly contact:user.basic_profile:readonly contact:user:search docs:document.media:download docs:document.media:upload docs:document:export docs:document:import docx:document:create docx:document:readonly docx:document:write_only drive:drive.metadata:readonly drive:file:download drive:file:upload im:chat.managers:write_only im:chat.members:read im:chat.members:write_only im:chat.moderation:read im:chat.nickname:read im:chat.nickname:write im:chat.user_setting:read im:chat.user_setting:write im:chat:read im:chat:update im:chat:create_by_user im:chat:moderation:write_only im:feed.flag:read im:feed.flag:write im:feed.shortcut:read im:feed.shortcut:write im:feed_group_v1:read im:feed_group_v1:write im:message.group_msg:get_as_user im:message.p2p_msg:get_as_user im:message.pins:read im:message.pins:write_only im:message.reactions:read im:message.reactions:write_only im:message:recall mail:event mail:user_mailbox.event.mail_address:read mail:user_mailbox.mail_contact:read mail:user_mailbox.message.address:read mail:user_mailbox.message.body:read mail:user_mailbox.message.subject:read mindnote:node:create mindnote:node:read minutes:minutes.artifacts:read minutes:minutes.basic:read minutes:minutes.media:export minutes:minutes.search:read minutes:minutes.upload:write minutes:minutes:readonly minutes:minutes:update profile:user_profile:read sheets:spreadsheet.meta:read sheets:spreadsheet.meta:write_only sheets:spreadsheet:create sheets:spreadsheet:read sheets:spreadsheet:write_only slides:presentation:create slides:presentation:read slides:presentation:update slides:presentation:write_only task:custom_field:read task:custom_field:write task:section:read task:section:write vc:meeting.bot.join:write vc:meeting.meetingevent:read vc:meeting.message:write vc:meeting.search:read vc:note:read vc:record:readonly wiki:member:create wiki:member:retrieve wiki:member:update wiki:node:copy wiki:node:create wiki:node:move wiki:node:read wiki:node:retrieve wiki:space:read wiki:space:retrieve wiki:space:write_only}"
-ACP_BRIDGE_PKG="${ACP_BRIDGE_PKG:-@zengxingyuan/aamp-acp-bridge@0.1.28-dev.20}"
+FEISHU_USER_AUTH_EXCLUDES="$AAMP_FEISHU_USER_AUTH_EXCLUDES_OVERRIDE"
+FEISHU_USER_AUTH_REQUIRED_SCOPES="$AAMP_FEISHU_USER_AUTH_REQUIRED_SCOPES_OVERRIDE"
+FEISHU_USER_AUTH_REQUESTED_SCOPES="$AAMP_FEISHU_USER_AUTH_REQUESTED_SCOPES_OVERRIDE"
+FEISHU_USER_AUTH_CORE_SCOPES="${FEISHU_USER_AUTH_CORE_SCOPES:-}"
+FEISHU_USER_AUTH_OPTIONAL_SCOPES="${FEISHU_USER_AUTH_OPTIONAL_SCOPES:-}"
+FEISHU_USER_AUTH_MODE="${FEISHU_USER_AUTH_MODE:-optional}"
+FEISHU_TASK_PROFILE_DOMAINS="${FEISHU_TASK_PROFILE_DOMAINS:-task}"
+AAMP_FEISHU_AUTH_STATE_DIR="${AAMP_FEISHU_AUTH_STATE_DIR:-$HOME/.aamp/feishu-bridge/auth-capabilities}"
+AAMP_TASK_ALLOW_PACKAGE_OVERRIDES="${AAMP_TASK_ALLOW_PACKAGE_OVERRIDES:-false}"
+if [ "$AAMP_TASK_INTERNAL" = "true" ] \
+  && [ "${AAMP_TASK_PACKAGE_OVERRIDES_RESOLVED:-false}" = "true" ]; then
+  AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG="${AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG:-}"
+  AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG="${AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG:-}"
+  AAMP_TASK_REQUESTED_AIME_ACP_PKG="${AAMP_TASK_REQUESTED_AIME_ACP_PKG:-}"
+else
+  AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG="${ACP_BRIDGE_PKG:-${AAMP_TASK_ACP_BRIDGE_PKG:-}}"
+  AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG="${FEISHU_BRIDGE_PKG:-${AAMP_TASK_FEISHU_BRIDGE_PKG:-}}"
+  AAMP_TASK_REQUESTED_AIME_ACP_PKG="${AIME_ACP_PKG:-${AAMP_TASK_AIME_ACP_PKG:-}}"
+fi
+unset AAMP_TASK_PACKAGE_OVERRIDES_RESOLVED
+unset ACP_BRIDGE_PKG AAMP_TASK_ACP_BRIDGE_PKG
+unset FEISHU_BRIDGE_PKG AAMP_TASK_FEISHU_BRIDGE_PKG
+unset AIME_ACP_PKG AIME_ACP_REGISTRY AAMP_TASK_AIME_ACP_PKG
+ACP_BRIDGE_PKG="${ACP_BRIDGE_PKG:-@luckyterry/aamp-acp-bridge@0.1.29-dev.0}"
+AIME_ACP_PKG="${AIME_ACP_PKG:-@tengchengwei/aime-acp@0.1.1-dev.1}"
+AIME_ACP_REGISTRY="${AIME_ACP_REGISTRY:-https://bnpm.byted.org}"
 CLI_BRIDGE_PKG="${CLI_BRIDGE_PKG:-@zengxingyuan/aamp-cli-bridge@0.1.7-dev.14}"
-FEISHU_BRIDGE_PKG="${FEISHU_BRIDGE_PKG:-@zengxingyuan/aamp-feishu-bridge@0.1.51}"
+FEISHU_BRIDGE_PKG="${FEISHU_BRIDGE_PKG:-@iluolyx/aamp-feishu-bridge@0.1.52-dev.5}"
+AAMP_TASK_DEFAULT_ACP_BRIDGE_PKG="$ACP_BRIDGE_PKG"
+AAMP_TASK_DEFAULT_FEISHU_BRIDGE_PKG="$FEISHU_BRIDGE_PKG"
+AAMP_TASK_DEFAULT_AIME_ACP_PKG="$AIME_ACP_PKG"
 AAMP_TASK_AGENT_NAME="${AAMP_TASK_AGENT_NAME:-@larktask/aamp-feishu-task-agent}"
 AAMP_TASK_AGENT_LEGACY_NAME="${AAMP_TASK_AGENT_LEGACY_NAME:-@zengxingyuan/aamp-feishu-task-agent}"
-AAMP_TASK_AGENT_VERSION="0.1.0-dev.173"
+AAMP_TASK_AGENT_VERSION="0.1.1-dev.2"
 AAMP_TASK_AGENT_CHANNEL="${AAMP_TASK_AGENT_CHANNEL:-dev}"
 AAMP_STALE_PROCESS_CLEANUP="${AAMP_STALE_PROCESS_CLEANUP:-false}"
 AAMP_STALE_PROCESS_SECONDS="${AAMP_STALE_PROCESS_SECONDS:-86400}"
@@ -85,8 +131,12 @@ CODEM_SERVICE_START_OUTPUT=""
 CODEM_AUTO_UPDATE_DONE="false"
 CODEM_FORCE_LOGIN_DONE="false"
 CODEM_PROVIDER_RECOVERY_DONE="false"
+TRAE_CLI_BIN=""
+TRAECODE_CLI_BIN=""
 PAIRING_URL=""
 ACP_AGENT_COMMAND=""
+AGENT_PREPARE_CANCELLED="false"
+AGENT_PREPARE_CANCEL_REASON=""
 STARTED_BRIDGE_PID=""
 ONE_CLICK_RUN_ID="$(date +%s)-$$"
 BOT_RESERVED="false"
@@ -115,6 +165,13 @@ sanitize_inherited_npm_exec_env() {
   done < <(env)
 }
+remote_internal_helper() {
+  [ "$AAMP_TASK_INTERNAL" = "true" ] && {
+    [ "$AAMP_TASK_INTERNAL_EXECUTION_LOCATION" = "remote" ] \
+      || [ "$AGENT_EXECUTION_LOCATION" = "remote" ]
+  }
+}
 usage() {
   cat <<'USAGE'
 Usage:
@@ -131,7 +188,8 @@ Running the standalone one-click script without a subcommand is the same as
 "feishu-task-agent install".
 Options:
-  --agent codex|cursor        Use this Agent for every new binding in the command.
+  --agent codex|cursor|coco|traex|traecli|workbuddy|workbuddy_ai|aime
+                               Use this Agent for every new binding in the command.
   --aamp-host URL            AAMP service URL. Default: https://meshmail.ai
   --debug                    Enable debug mode for bridge processes
   -h, --help                 Show this help
@@ -791,6 +849,7 @@ task_agent_global_install_is_complete() {
   [ -x "$NPM_GLOBAL_PREFIX/bin/aamp-logs" ] || return 1
   [ -r "$package_dir/bootstrap/aamp-feishu-task-agent-bootstrap.sh" ] || return 1
   [ -r "$package_dir/bin/feishu-task-agent-controller.mjs" ] || return 1
+  [ -r "$package_dir/bin/traecode-readiness.mjs" ] || return 1
 }
 task_agent_global_install_is_current() {
@@ -815,7 +874,7 @@ ensure_task_agent_global_install_locked() {
   fi
   remove_legacy_task_agent_global_install || return 1
   agent_detail "synchronizing task-agent npm package: current=${installed_version:-missing} expected=$expected_version"
-  npm_install_global "$AAMP_TASK_AGENT_NAME@$expected_version" >>"$ONE_CLICK_LOG" 2>&1 || return 1
+  npm_install_global "$AAMP_TASK_AGENT_NAME@$expected_version" --force >>"$ONE_CLICK_LOG" 2>&1 || return 1
   task_agent_global_install_is_current "$expected_version"
 }
@@ -829,12 +888,16 @@ ensure_task_agent_global_install() {
 short_command_is_current() {
   local target="$1"
+  local source_file="${2:-}"
   local installed_name installed_version
   [ -x "$target" ] || return 1
   installed_name="$(script_file_task_agent_name "$target" || true)"
   installed_version="$(script_file_task_agent_version "$target" || true)"
   [ "$installed_name" = "$AAMP_TASK_AGENT_NAME" ] || return 1
-  [ "$installed_version" = "$AAMP_TASK_AGENT_VERSION" ]
+  [ "$installed_version" = "$AAMP_TASK_AGENT_VERSION" ] || return 1
+  if [ -n "$source_file" ] && [ -r "$source_file" ]; then
+    cmp -s "$source_file" "$target"
+  fi
 }
 write_task_update_cache() {
@@ -912,13 +975,13 @@ install_short_command_current() {
   local target="$1"
   local source_file="${BASH_SOURCE[0]:-}"
   local tmp="${target}.tmp.$$"
-  if short_command_is_current "$target"; then
-    agent_detail "short command already current: $target"
-    return 0
-  fi
   case "$source_file" in
     ""|/dev/fd/*|/private/dev/fd/*|/proc/*) source_file="" ;;
   esac
+  if short_command_is_current "$target" "$source_file"; then
+    agent_detail "short command already current: $target"
+    return 0
+  fi
   if [ -n "$source_file" ] && [ -f "$source_file" ] && [ -r "$source_file" ]; then
     mkdir -p "$(dirname "$target")"
     cp "$source_file" "$tmp" 2>>"$ONE_CLICK_LOG" || return 1
@@ -949,6 +1012,7 @@ ensure_selected_agent_for_start() {
     select_agent_interactively
   fi
   validate_agent_name "$AGENT"
+  ensure_agent_selection_available "$AGENT"
 }
 resolve_latest_task_agent_version() {
@@ -1033,12 +1097,109 @@ run_task_agent_update_command() {
   install_aamp_logs_bin "$installed_version" || agent_fail "failed to synchronize aamp-logs $installed_version"
   printf '当前版本：%s\n' "$installed_version"
 }
-npm_install_global() {
+classify_remote_npm_cache_error() {
+  node -e '
+let carry = "";
+let lineSawEnoent = false;
+let lineSawTarballData = false;
+let matched = false;
+const scan = (part, endOfLine) => {
+  const text = (carry + part).toLowerCase();
+  const sawEnoent = lineSawEnoent || text.includes("enoent");
+  const sawTarballData = lineSawTarballData || text.includes("tarball data");
+  if (text.includes("invalid response body")
+    || text.includes("_cacache")
+    || (sawEnoent && text.includes("content-v2"))
+    || (sawTarballData && text.includes("corrupted"))
+    || text.includes("tar_bad_archive")
+    || text.includes("zlib: unexpected end of file")) matched = true;
+  lineSawEnoent = sawEnoent;
+  lineSawTarballData = sawTarballData;
+  carry = text.slice(-64);
+  if (endOfLine) {
+    carry = "";
+    lineSawEnoent = false;
+    lineSawTarballData = false;
+  }
+};
+process.stdin.on("data", (chunk) => {
+  const parts = chunk.toString("latin1").split(/\r?\n/);
+  parts.forEach((part, index) => scan(part, index < parts.length - 1));
+});
+process.stdin.on("end", () => { process.exitCode = matched ? 0 : 1; });
+process.stdin.on("error", () => { process.exitCode = 2; });
+'
+}
+REMOTE_NPM_INSTALL_STATUS=1
+REMOTE_NPM_CACHE_ERROR=false
+run_remote_npm_install_attempt() {
+  local registry="$1"
+  shift
+  local pipeline_status=()
+  sanitize_inherited_npm_exec_env
+  set +e
+  "$NPM_BIN" install -g \
+    --registry "$registry" \
+    --cache "$NPM_CACHE_DIR" \
+    --prefix "$NPM_GLOBAL_PREFIX" \
+    "$@" 2>&1 | classify_remote_npm_cache_error
+  pipeline_status=("${PIPESTATUS[@]}")
+  set -e
+  REMOTE_NPM_INSTALL_STATUS="${pipeline_status[0]:-1}"
+  REMOTE_NPM_CACHE_ERROR=false
+  if [ "${pipeline_status[1]:-2}" -eq 0 ]; then
+    REMOTE_NPM_CACHE_ERROR=true
+  fi
+  return 0
+}
+npm_install_global_from_registry_remote() {
+  local registry="$1"
+  shift
+  finish_remote_npm_install() {
+    trap - EXIT HUP INT TERM
+    unset -f finish_remote_npm_install
+  }
+  trap finish_remote_npm_install EXIT
+  trap 'exit 129' HUP
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  run_remote_npm_install_attempt "$registry" "$@"
+  if [ "$REMOTE_NPM_INSTALL_STATUS" -eq 0 ]; then
+    hash -r 2>/dev/null || true
+    finish_remote_npm_install
+    return 0
+  fi
+  if [ "$REMOTE_NPM_CACHE_ERROR" != "true" ]; then
+    finish_remote_npm_install
+    return 1
+  fi
+  reset_npm_cache_for_retry
+  run_remote_npm_install_attempt "$registry" "$@"
+  if [ "$REMOTE_NPM_INSTALL_STATUS" -ne 0 ]; then
+    finish_remote_npm_install
+    return 1
+  fi
+  hash -r 2>/dev/null || true
+  finish_remote_npm_install
+}
+npm_install_global_from_registry() {
+  if remote_internal_helper; then
+    npm_install_global_from_registry_remote "$@"
+    return $?
+  fi
+  local registry="$1"
+  shift
   local npm_log
   npm_log="$(mktemp "${TMPDIR:-/tmp}/aamp-npm-install.XXXXXX")"
   sanitize_inherited_npm_exec_env
   if "$NPM_BIN" install -g \
-    --registry "$NPM_REGISTRY" \
+    --registry "$registry" \
     --cache "$NPM_CACHE_DIR" \
     --prefix "$NPM_GLOBAL_PREFIX" \
     "$@" >"$npm_log" 2>&1; then
@@ -1056,7 +1217,7 @@ npm_install_global() {
   npm_log="$(mktemp "${TMPDIR:-/tmp}/aamp-npm-install-retry.XXXXXX")"
   sanitize_inherited_npm_exec_env
   "$NPM_BIN" install -g \
-    --registry "$NPM_REGISTRY" \
+    --registry "$registry" \
     --cache "$NPM_CACHE_DIR" \
     --prefix "$NPM_GLOBAL_PREFIX" \
     "$@" >"$npm_log" 2>&1 || {
@@ -1067,6 +1228,10 @@ npm_install_global() {
   hash -r 2>/dev/null || true
 }
+npm_install_global() {
+  npm_install_global_from_registry "$NPM_REGISTRY" "$@"
+}
 npx_package() {
   local npm_log
   local status
@@ -1176,13 +1341,32 @@ npm_install_register_helper() {
     }
 }
+aime_internal_network_reachable() {
+  command -v ping >/dev/null 2>&1 || return 1
+  if is_macos; then
+    ping -c 1 -W 1000 aime.bytedance.net >/dev/null 2>&1
+  else
+    ping -c 1 -W 1 aime.bytedance.net >/dev/null 2>&1
+  fi
+}
 validate_agent_name() {
   case "$1" in
-    codex|cursor) ;;
-    *) agent_fail "--agent must be codex or cursor" ;;
+    codex|cursor|coco|traex|traecli|workbuddy|workbuddy_ai|aime) ;;
+    *) agent_fail "--agent must be codex, cursor, coco, traex, traecli, workbuddy, workbuddy_ai, or aime" ;;
   esac
 }
+ensure_agent_selection_available() {
+  [ "$1" = "aime" ] || return 0
+  aime_internal_network_reachable \
+    || agent_fail "AIME 仅在公司内网可用；当前无法 ping 通 aime.bytedance.net。"
+}
+agent_display_name() {
+  printf '%s' "$1"
+}
 read_tty_line() {
   local prompt="$1"
   local value
@@ -1202,6 +1386,24 @@ agent_cli_detected() {
     cursor)
       find_cursor_agent_cli >/dev/null 2>&1
       ;;
+    traex)
+      find_traex_cli >/dev/null 2>&1
+      ;;
+    coco)
+      find_legacy_trae_cli >/dev/null 2>&1
+      ;;
+    traecli)
+      find_traecode_cli >/dev/null 2>&1
+      ;;
+    workbuddy)
+      find_workbuddy_cli >/dev/null 2>&1
+      ;;
+    workbuddy_ai)
+      find_workbuddy_ai_cli >/dev/null 2>&1
+      ;;
+    aime)
+      aime_internal_network_reachable
+      ;;
     *)
       return 1
       ;;
@@ -1216,9 +1418,25 @@ discover_interactive_agents() {
   if agent_cli_detected cursor; then
     DETECTED_AGENTS+=("cursor")
   fi
+  if agent_cli_detected traex; then
+    DETECTED_AGENTS+=("traex")
+  elif agent_cli_detected coco; then
+    DETECTED_AGENTS+=("coco")
+  elif agent_cli_detected traecli; then
+    DETECTED_AGENTS+=("traecli")
+  fi
+  if agent_cli_detected workbuddy; then
+    DETECTED_AGENTS+=("workbuddy")
+  fi
+  if agent_cli_detected workbuddy_ai; then
+    DETECTED_AGENTS+=("workbuddy_ai")
+  fi
+  if agent_cli_detected aime; then
+    DETECTED_AGENTS+=("aime")
+  fi
   if [ "${#DETECTED_AGENTS[@]}" -eq 0 ]; then
-    agent_fail "暂未检测到本地智能体。请先安装并登录 Codex 或 Cursor CLI 后重试。"
+    agent_fail "暂未检测到本地智能体。请先安装 Codex、Cursor、Trae CLI、WorkBuddy 或 WorkBuddy AI 后重试。"
   fi
 }
@@ -1237,9 +1455,9 @@ render_agent_menu() {
   for index in "${!DETECTED_AGENTS[@]}"; do
     printf '\033[2K\r' >&3
     if [ "$index" -eq "$selected" ]; then
-      printf '  > %s\n' "${DETECTED_AGENTS[$index]}" >&3
+      printf '  > %s\n' "$(agent_display_name "${DETECTED_AGENTS[$index]}")" >&3
     else
-      printf '    %s\n' "${DETECTED_AGENTS[$index]}" >&3
+      printf '    %s\n' "$(agent_display_name "${DETECTED_AGENTS[$index]}")" >&3
     fi
   done
   printf '\033[2K\r使用 ↑/↓ 选择，回车确认。也可按数字键或 j/k。\n' >&3
@@ -1253,7 +1471,7 @@ select_agent_interactively() {
   discover_interactive_agents
   if ! exec 3<>/dev/tty; then
-    agent_fail "missing --agent and no interactive terminal is available; pass --agent codex|cursor"
+    agent_fail "missing --agent and no interactive terminal is available; pass --agent codex|cursor|coco|traex|traecli|workbuddy|workbuddy_ai|aime"
   fi
   tty_state="$(stty -g <&3)"
@@ -1439,7 +1657,7 @@ parse_args() {
   fi
   case "${1:-}" in
-    install|start|list|add|remove|update|help|__discover-agents|__register-binding|__prepare-agent|__ensure-profile)
+    install|start|list|add|remove|update|help|__discover-agents|__register-binding|__prepare-agent|__probe-profile|__ensure-profile)
       AAMP_TASK_ACTION="$1"
       shift
       ;;
@@ -1794,7 +2012,7 @@ save_bot_config() {
   local profile="$3"
   local app_secret="${4:-}"
   mkdir -p "$(dirname "$BOT_CONFIG_FILE")"
-  BOT_CONFIG_FILE="$BOT_CONFIG_FILE" BOT_NAME="$bot_name" BOT_APP_ID="$app_id" BOT_PROFILE="$profile" BOT_APP_SECRET="$app_secret" FEISHU_USER_AUTH_DOMAINS="$FEISHU_USER_AUTH_DOMAINS" node -e '
+  BOT_CONFIG_FILE="$BOT_CONFIG_FILE" BOT_NAME="$bot_name" BOT_APP_ID="$app_id" BOT_PROFILE="$profile" BOT_APP_SECRET="$app_secret" FEISHU_TASK_PROFILE_DOMAINS="$FEISHU_TASK_PROFILE_DOMAINS" FEISHU_SCOPE_MANIFEST_VERSION="$FEISHU_SCOPE_MANIFEST_VERSION" FEISHU_USER_AUTH_MODE="$FEISHU_USER_AUTH_MODE" node -e '
 const fs = require("fs");
 const file = process.env.BOT_CONFIG_FILE;
 const appSecret = String(process.env.BOT_APP_SECRET || "").trim();
@@ -1805,7 +2023,9 @@ const next = {
   profile: process.env.BOT_PROFILE,
   auth_mode: "lark-cli",
   capabilities: ["im", "task"],
-  domains: String(process.env.FEISHU_USER_AUTH_DOMAINS || "").split(",").map((item) => item.trim()).filter(Boolean),
+  domains: String(process.env.FEISHU_TASK_PROFILE_DOMAINS || "task").split(",").map((item) => item.trim()).filter(Boolean),
+  scope_manifest_version: Number(process.env.FEISHU_SCOPE_MANIFEST_VERSION || 0),
+  user_auth_mode: process.env.FEISHU_USER_AUTH_MODE || "optional",
   updated_at: new Date().toISOString(),
 };
 let parsed = { version: 1, profiles: [] };
@@ -2038,15 +2258,65 @@ ensure_lark_cli_min_version() {
   select_lark_cli_bin
 }
+feishu_scope_manifest_json() {
+  cat <<'JSON'
+{"version":2,"app":{"tenant":["im:message","im:message:send_as_bot","im:message:readonly","im:resource","cardkit:card:write","task:task","task:comment","task:task:readonly","task:comment:readonly","task:attachment:read","task:attachment:write","task:comment:read","task:comment:write","task:task:read","task:task:write","task:tasklist:read","task:tasklist:write","task:custom_field:read","task:custom_field:write","task:section:read","task:section:write"],"user":["im:message","im:message:readonly","im:resource","cardkit:card:write","task:task","task:comment","task:task:readonly","task:comment:readonly","task:attachment:read","task:attachment:write","task:comment:read","task:comment:write","task:task:read","task:task:write","task:tasklist:read","task:tasklist:write","task:custom_field:read","task:custom_field:write","task:section:read","task:section:write"]},"userAuth":{"core":[],"optional":["task:task","task:comment","task:task:readonly","task:comment:readonly","task:attachment:read","task:attachment:write","task:comment:read","task:comment:write","task:task:read","task:task:write","task:tasklist:read","task:tasklist:write","task:custom_field:read","task:custom_field:write","task:section:read","task:section:write"]}}
+JSON
+}
+initialize_feishu_scope_manifest() {
+  local manifest_values=()
+  local value
+  while IFS= read -r value; do
+    manifest_values+=("$value")
+  done < <(feishu_scope_manifest_json | node -e '
+const fs = require("fs");
+const manifest = JSON.parse(fs.readFileSync(0, "utf8"));
+console.log(String(manifest.version));
+console.log(manifest.app.tenant.join(","));
+console.log(manifest.app.user.join(","));
+console.log(manifest.userAuth.core.join(" "));
+console.log(manifest.userAuth.optional.join(" "));
+')
+  [ "${#manifest_values[@]}" -eq 5 ] || agent_fail "invalid embedded Feishu scope manifest"
+  FEISHU_SCOPE_MANIFEST_VERSION="${FEISHU_SCOPE_MANIFEST_VERSION:-${manifest_values[0]}}"
+  FEISHU_APP_SCOPES_TENANT="${FEISHU_APP_SCOPES_TENANT:-${manifest_values[1]}}"
+  FEISHU_APP_SCOPES_USER="${FEISHU_APP_SCOPES_USER:-${manifest_values[2]}}"
+  FEISHU_USER_AUTH_CORE_SCOPES="${FEISHU_USER_AUTH_CORE_SCOPES:-${manifest_values[3]}}"
+  FEISHU_USER_AUTH_OPTIONAL_SCOPES="${FEISHU_USER_AUTH_OPTIONAL_SCOPES:-${manifest_values[4]}}"
+  if [ -n "${FEISHU_USER_AUTH_REQUIRED_SCOPES:-}" ]; then
+    FEISHU_USER_AUTH_CORE_SCOPES="$FEISHU_USER_AUTH_REQUIRED_SCOPES"
+  else
+    FEISHU_USER_AUTH_REQUIRED_SCOPES="$FEISHU_USER_AUTH_CORE_SCOPES"
+  fi
+  if [ -z "${FEISHU_USER_AUTH_REQUESTED_SCOPES:-}" ]; then
+    if [ -n "${AAMP_FEISHU_USER_AUTH_REQUIRED_SCOPES_OVERRIDE:-}" ]; then
+      FEISHU_USER_AUTH_REQUESTED_SCOPES="$FEISHU_USER_AUTH_REQUIRED_SCOPES"
+    else
+      FEISHU_USER_AUTH_REQUESTED_SCOPES="${FEISHU_USER_AUTH_CORE_SCOPES} ${FEISHU_USER_AUTH_OPTIONAL_SCOPES}"
+    fi
+  fi
+  export FEISHU_SCOPE_MANIFEST_VERSION
+  export FEISHU_APP_SCOPES_TENANT FEISHU_APP_SCOPES_USER
+  export FEISHU_USER_AUTH_CORE_SCOPES FEISHU_USER_AUTH_OPTIONAL_SCOPES
+  export FEISHU_USER_AUTH_REQUIRED_SCOPES FEISHU_USER_AUTH_REQUESTED_SCOPES
+}
 lark_cli_user_auth_satisfied() {
   local profile="$1"
+  local required_scopes="${2:-${FEISHU_USER_AUTH_REQUIRED_SCOPES:-${FEISHU_USER_AUTH_CORE_SCOPES:-}}}"
   local status_json auth_check
   LARK_CLI_CMD="${LARK_CLI_CMD:-lark-cli}"
+  if [ -z "${required_scopes//[[:space:],]/}" ]; then
+    return 0
+  fi
   status_json="$("$LARK_CLI_CMD" --profile "$profile" auth status --json 2>/dev/null)" || return 1
   set +e
-  auth_check="$(AUTH_STATUS_JSON="$status_json" FEISHU_USER_AUTH_REQUIRED_SCOPES="$FEISHU_USER_AUTH_REQUIRED_SCOPES" FEISHU_USER_AUTH_EXCLUDES="$FEISHU_USER_AUTH_EXCLUDES" node -e '
+  auth_check="$(AUTH_STATUS_JSON="$status_json" FEISHU_USER_AUTH_REQUIRED_SCOPES="$required_scopes" FEISHU_USER_AUTH_EXCLUDES="$FEISHU_USER_AUTH_EXCLUDES" node -e '
 function parseJsonOutput(value, label) {
   const raw = String(value || "");
   const start = raw.indexOf("{");
@@ -2087,10 +2357,76 @@ console.log("ok");
   return 1
 }
+write_lark_cli_auth_capability_snapshot() {
+  local profile="$1"
+  local status_json="{}"
+  local state_dir="$AAMP_FEISHU_AUTH_STATE_DIR"
+  local safe_profile state_file temp_file
+  set +e
+  status_json="$("$LARK_CLI_CMD" --profile "$profile" auth status --json 2>/dev/null)"
+  local status_code=$?
+  set -e
+  if [ "$status_code" -ne 0 ] || [ -z "$status_json" ]; then
+    status_json="{}"
+  fi
+  mkdir -p "$state_dir" || return 1
+  safe_profile="$(PROFILE="$profile" node -e 'process.stdout.write(String(process.env.PROFILE || "profile").replace(/[^A-Za-z0-9._-]/g, "_"))')" || return 1
+  state_file="$state_dir/$safe_profile.json"
+  temp_file="$(mktemp "$state_dir/.auth-capabilities.XXXXXX")" || return 1
+  if ! AUTH_STATUS_JSON="$status_json" \
+    AUTH_PROFILE="$profile" \
+    FEISHU_SCOPE_MANIFEST_VERSION="$FEISHU_SCOPE_MANIFEST_VERSION" \
+    FEISHU_USER_AUTH_CORE_SCOPES="$FEISHU_USER_AUTH_CORE_SCOPES" \
+    FEISHU_USER_AUTH_OPTIONAL_SCOPES="$FEISHU_USER_AUTH_OPTIONAL_SCOPES" \
+    node -e '
+const raw = String(process.env.AUTH_STATUS_JSON || "{}");
+const start = raw.indexOf("{");
+let status = {};
+try { status = JSON.parse(start >= 0 ? raw.slice(start) : "{}"); } catch {}
+const user = status?.identities?.user;
+const usable = Boolean(user?.available) && new Set(["valid", "needs_refresh"]).has(user?.tokenStatus);
+const split = (value) => [...new Set(String(value || "").split(/[\s,]+/).map((item) => item.trim()).filter(Boolean))];
+const granted = new Set(split(user?.scope));
+const core = split(process.env.FEISHU_USER_AUTH_CORE_SCOPES);
+const optional = split(process.env.FEISHU_USER_AUTH_OPTIONAL_SCOPES);
+const missingCoreScopes = core.filter((scope) => !granted.has(scope));
+const missingOptionalScopes = optional.filter((scope) => !granted.has(scope));
+process.stdout.write(JSON.stringify({
+  schemaVersion: 1,
+  manifestVersion: Number(process.env.FEISHU_SCOPE_MANIFEST_VERSION || 0),
+  profile: process.env.AUTH_PROFILE,
+  tokenStatus: user?.tokenStatus || "missing",
+  grantedScopes: [...granted],
+  missingCoreScopes,
+  missingOptionalScopes,
+  capabilities: { task_user: usable && missingOptionalScopes.length === 0 },
+  checkedAt: new Date().toISOString(),
+}, null, 2));
+' >"$temp_file"; then
+    rm -f "$temp_file"
+    return 1
+  fi
+  if ! mv "$temp_file" "$state_file"; then
+    rm -f "$temp_file"
+    return 1
+  fi
+  chmod 600 "$state_file" 2>/dev/null || true
+}
+persist_lark_cli_auth_capability_snapshot() {
+  local profile="$1"
+  if ! write_lark_cli_auth_capability_snapshot "$profile"; then
+    agent_log "warning: unable to persist optional user capability snapshot for profile: $profile"
+  fi
+}
 normalize_lark_cli_auth_excludes() {
-  EXCLUDES="$1" node -e '
+  EXCLUDES="$1" REQUESTED_SCOPES="${2:-${FEISHU_USER_AUTH_REQUESTED_SCOPES:-}}" node -e '
 const excludes = String(process.env.EXCLUDES || "").split(",").map((item) => item.trim()).filter(Boolean);
-console.log([...new Set(excludes)].join(","));
+const requested = new Set(String(process.env.REQUESTED_SCOPES || "").split(/[\s,]+/).map((item) => item.trim()).filter(Boolean));
+console.log([...new Set(excludes)].filter((scope) => requested.has(scope)).join(","));
 '
 }
@@ -2237,12 +2573,14 @@ run_lark_cli_auth_login_with_browser_open() {
 run_lark_cli_auth_login() {
   local profile="$1"
   local auth_excludes="$2"
+  local requested_scopes="${FEISHU_USER_AUTH_REQUESTED_SCOPES:-}"
-  auth_excludes="$(normalize_lark_cli_auth_excludes "$auth_excludes")"
+  [ -n "${requested_scopes//[[:space:],]/}" ] || return 0
+  auth_excludes="$(normalize_lark_cli_auth_excludes "$auth_excludes" "$requested_scopes")"
   if [ -z "$auth_excludes" ]; then
-    run_lark_cli_auth_login_with_browser_open "$LARK_CLI_CMD" --profile "$profile" auth login --domain "$FEISHU_USER_AUTH_DOMAINS" --scope "$FEISHU_USER_AUTH_REQUIRED_SCOPES"
+    run_lark_cli_auth_login_with_browser_open "$LARK_CLI_CMD" --profile "$profile" auth login --scope "$requested_scopes"
   else
-    run_lark_cli_auth_login_with_browser_open "$LARK_CLI_CMD" --profile "$profile" auth login --domain "$FEISHU_USER_AUTH_DOMAINS" --scope "$FEISHU_USER_AUTH_REQUIRED_SCOPES" --exclude "$auth_excludes"
+    run_lark_cli_auth_login_with_browser_open "$LARK_CLI_CMD" --profile "$profile" auth login --scope "$requested_scopes" --exclude "$auth_excludes"
   fi
 }
@@ -2251,11 +2589,43 @@ ensure_lark_cli_profile() {
   with_lark_cli_config_lock ensure_lark_cli_profile_locked "$@"
 }
+validate_feishu_user_auth_mode() {
+  case "$FEISHU_USER_AUTH_MODE" in
+    optional|required|disabled) ;;
+    *) agent_fail "FEISHU_USER_AUTH_MODE must be optional, required, or disabled" ;;
+  esac
+}
+probe_lark_cli_profile_locked() {
+  local profile="$1"
+  local required_scopes
+  initialize_feishu_scope_manifest
+  validate_feishu_user_auth_mode
+  "$LARK_CLI_CMD" profile list 2>/dev/null | grep -F "\"$profile\"" >/dev/null 2>&1 \
+    || return 1
+  if [ "$FEISHU_USER_AUTH_MODE" = "disabled" ]; then
+    persist_lark_cli_auth_capability_snapshot "$profile"
+    return 0
+  fi
+  if [ "$FEISHU_USER_AUTH_MODE" = "required" ]; then
+    required_scopes="$FEISHU_USER_AUTH_REQUESTED_SCOPES"
+  else
+    required_scopes="$FEISHU_USER_AUTH_CORE_SCOPES"
+  fi
+  lark_cli_user_auth_satisfied "$profile" "$required_scopes" || return 1
+  persist_lark_cli_auth_capability_snapshot "$profile"
+}
 ensure_lark_cli_profile_locked() {
   local app_id="$1"
   local app_secret="$2"
   local profile="$3"
   local auth_excludes
+  local required_scopes
+  initialize_feishu_scope_manifest
+  validate_feishu_user_auth_mode
   if "$LARK_CLI_CMD" profile list 2>/dev/null | grep -F "\"$profile\"" >/dev/null 2>&1; then
     agent_detail "lark-cli profile already exists: $profile"
@@ -2268,13 +2638,38 @@ ensure_lark_cli_profile_locked() {
       --app-secret-stdin
   fi
-  agent_detail "ensuring lark-cli user auth domains for profile: $profile"
+  if [ "$FEISHU_USER_AUTH_MODE" = "disabled" ]; then
+    persist_lark_cli_auth_capability_snapshot "$profile"
+    agent_log "Task bridge ready; optional user capabilities disabled for profile: $profile"
+    return 0
+  fi
   auth_excludes="$FEISHU_USER_AUTH_EXCLUDES"
-  if lark_cli_user_auth_satisfied "$profile"; then
-    agent_detail "lark-cli user auth already has required scopes for profile: $profile"
-  else
+  if [ "$FEISHU_USER_AUTH_MODE" = "required" ]; then
+    required_scopes="$FEISHU_USER_AUTH_REQUESTED_SCOPES"
+    agent_detail "ensuring explicit lark-cli user auth scopes for profile: $profile"
+    if ! lark_cli_user_auth_satisfied "$profile" "$required_scopes"; then
+      run_lark_cli_auth_login "$profile" "$auth_excludes"
+      lark_cli_user_auth_satisfied "$profile" "$required_scopes" \
+        || agent_fail "lark-cli user authorization did not grant the required explicit scopes"
+    fi
+    persist_lark_cli_auth_capability_snapshot "$profile"
+    agent_detail "lark-cli user auth has the requested scopes for profile: $profile"
+    return 0
+  fi
+  if ! lark_cli_user_auth_satisfied "$profile" "$FEISHU_USER_AUTH_CORE_SCOPES"; then
+    agent_detail "ensuring explicitly configured lark-cli core scopes for profile: $profile"
     run_lark_cli_auth_login "$profile" "$auth_excludes"
+    lark_cli_user_auth_satisfied "$profile" "$FEISHU_USER_AUTH_CORE_SCOPES" \
+      || agent_fail "lark-cli user authorization did not grant the configured core scopes"
+  fi
+  if lark_cli_user_auth_satisfied "$profile" "$FEISHU_USER_AUTH_OPTIONAL_SCOPES"; then
+    agent_detail "lark-cli optional user capabilities are available for profile: $profile"
+  else
+    agent_log "Task bridge ready; optional user capabilities unavailable for profile: $profile"
   fi
+  persist_lark_cli_auth_capability_snapshot "$profile"
 }
 forget_current_bot_after_feishu_start_failure() {
@@ -2375,6 +2770,8 @@ register_feishu_app() {
   local default_name
   local bot_name
+  initialize_feishu_scope_manifest
   workdir="$(mktemp -d "${TMPDIR:-/tmp}/aamp-register-feishu-app.XXXXXX")"
   register_script="$workdir/register-app.mjs"
   if [ -n "$AAMP_RUN_LOG_DIR" ]; then
@@ -2522,8 +2919,13 @@ NODE
   bot_name="${bot_name:-$default_name}"
   BOT_NAME="$bot_name"
-  LARK_CLI_PROFILE="$(task_profile_name_for_app_id "$APP_ID")"
-  ensure_lark_cli_profile "$APP_ID" "$APP_SECRET" "$LARK_CLI_PROFILE"
+  if [ "$AGENT_EXECUTION_LOCATION" = "remote" ]; then
+    LARK_CLI_PROFILE=""
+  else
+    LARK_CLI_PROFILE="$(task_profile_name_for_app_id "$APP_ID")"
+    source_lark_env
+    ensure_lark_cli_profile "$APP_ID" "$APP_SECRET" "$LARK_CLI_PROFILE"
+  fi
   if [ "$AAMP_TASK_INTERNAL" = "true" ]; then
     agent_detail "Feishu Bot 已授权：$BOT_NAME ($APP_ID)"
     return 0
@@ -2677,6 +3079,338 @@ find_cursor_agent_cli() {
   return 1
 }
+resolve_trae_cli_candidate() {
+  local candidate
+  candidate="$1"
+  [ -n "$candidate" ] || return 1
+  if command -v "$candidate" >/dev/null 2>&1; then
+    command -v "$candidate"
+    return 0
+  fi
+  if [ -x "$candidate" ]; then
+    printf '%s\n' "$candidate"
+    return 0
+  fi
+  return 1
+}
+find_traex_cli_candidates() {
+  local candidate resolved emitted=""
+  local candidates=()
+  if [ -n "$TRAE_CLI_BIN" ] && [ "$(basename "$TRAE_CLI_BIN")" = "traex" ]; then candidates+=("$TRAE_CLI_BIN"); fi
+  if [ -n "$AAMP_TRAE_CLI_BIN" ] && [ "$(basename "$AAMP_TRAE_CLI_BIN")" = "traex" ]; then candidates+=("$AAMP_TRAE_CLI_BIN"); fi
+  candidates+=("traex")
+  for candidate in "${candidates[@]}"; do
+    resolved="$(resolve_trae_cli_candidate "$candidate" || true)"
+    [ -n "$resolved" ] || continue
+    case "$emitted" in
+      *"|$resolved|"*) continue ;;
+    esac
+    emitted="${emitted}|$resolved|"
+    printf '%s\n' "$resolved"
+  done
+}
+find_coco_cli_candidates() {
+  local candidate resolved emitted=""
+  local candidates=()
+  if [ -n "$TRAE_CLI_BIN" ] && [ "$(basename "$TRAE_CLI_BIN")" = "coco" ]; then candidates+=("$TRAE_CLI_BIN"); fi
+  if [ -n "$AAMP_TRAE_CLI_BIN" ] && [ "$(basename "$AAMP_TRAE_CLI_BIN")" = "coco" ]; then candidates+=("$AAMP_TRAE_CLI_BIN"); fi
+  candidates+=("coco")
+  for candidate in "${candidates[@]}"; do
+    resolved="$(resolve_trae_cli_candidate "$candidate" || true)"
+    [ -n "$resolved" ] || continue
+    case "$emitted" in *"|$resolved|"*) continue ;; esac
+    emitted="${emitted}|$resolved|"
+    printf '%s\n' "$resolved"
+  done
+}
+find_traecode_cli_candidates() {
+  local candidate resolved emitted=""
+  local candidates=()
+  [ -n "$TRAECODE_CLI_BIN" ] && candidates+=("$TRAECODE_CLI_BIN")
+  [ -n "$AAMP_TRAECODE_CLI_BIN" ] && candidates+=("$AAMP_TRAECODE_CLI_BIN")
+  candidates+=("traecli")
+  for candidate in "${candidates[@]}"; do
+    resolved="$(resolve_trae_cli_candidate "$candidate" || true)"
+    [ -n "$resolved" ] || continue
+    case "$emitted" in *"|$resolved|"*) continue ;; esac
+    emitted="${emitted}|$resolved|"
+    printf '%s\n' "$resolved"
+  done
+}
+real_executable_path() {
+  node -e 'const fs=require("fs"); try { process.stdout.write(fs.realpathSync(process.argv[1])); } catch { process.exit(1); }' "$1" 2>/dev/null
+}
+find_traex_cli() {
+  local candidate
+  candidate="$(find_traex_cli_candidates | head -n 1)"
+  if [ -n "$candidate" ]; then
+    TRAE_CLI_BIN="$candidate"
+    printf '%s\n' "$candidate"
+    return 0
+  fi
+  return 1
+}
+find_coco_cli() {
+  local candidate
+  candidate="$(find_coco_cli_candidates | head -n 1)"
+  [ -n "$candidate" ] || return 1
+  TRAE_CLI_BIN="$candidate"
+  printf '%s\n' "$candidate"
+}
+traecode_cli_conflicts_with_coco() {
+  local traecli_bin="$1" coco_bin traecli_real coco_real
+  coco_bin="$(find_coco_cli || true)"
+  [ -n "$coco_bin" ] || return 1
+  traecli_real="$(real_executable_path "$traecli_bin" || true)"
+  coco_real="$(real_executable_path "$coco_bin" || true)"
+  [ -n "$traecli_real" ] && [ "$traecli_real" = "$coco_real" ]
+}
+find_traecode_cli() {
+  local candidate explicit_candidate="" conflict_found="false"
+  if [ -n "$TRAECODE_CLI_BIN" ]; then explicit_candidate="$TRAECODE_CLI_BIN"; fi
+  if [ -n "$AAMP_TRAECODE_CLI_BIN" ]; then explicit_candidate="$AAMP_TRAECODE_CLI_BIN"; fi
+  if [ -n "$explicit_candidate" ]; then
+    case "$(basename "$explicit_candidate")" in coco|traex) return 2 ;; esac
+    candidate="$(resolve_trae_cli_candidate "$explicit_candidate" || true)"
+    [ -n "$candidate" ] || return 1
+    if traecode_cli_conflicts_with_coco "$candidate"; then return 2; fi
+    TRAECODE_CLI_BIN="$candidate"
+    printf '%s\n' "$candidate"
+    return 0
+  fi
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    if traecode_cli_conflicts_with_coco "$candidate"; then
+      if [ -n "$explicit_candidate" ] && [ "$candidate" = "$explicit_candidate" ]; then return 2; fi
+      conflict_found="true"
+      continue
+    fi
+    TRAECODE_CLI_BIN="$candidate"
+    printf '%s\n' "$candidate"
+    return 0
+  done < <(find_traecode_cli_candidates)
+  [ "$conflict_found" != "true" ] || return 2
+  return 1
+}
+find_legacy_trae_cli() {
+  find_coco_cli
+}
+resolve_trae_cli() {
+  case "${AGENT:-}" in
+    traex) find_traex_cli ;;
+    coco) find_coco_cli ;;
+    traecli) find_traecode_cli ;;
+    *) return 1 ;;
+  esac
+}
+find_workbuddy_cli() {
+  is_macos || return 1
+  [ -x "$WORKBUDDY_APP_CLI" ] || return 1
+  printf '%s\n' "$WORKBUDDY_APP_CLI"
+}
+find_workbuddy_ai_cli() {
+  is_macos || return 1
+  [ -x "$WORKBUDDY_AI_APP_CLI" ] || return 1
+  printf '%s\n' "$WORKBUDDY_AI_APP_CLI"
+}
+aime_acp_package_spec() {
+  local default_spec registry spec
+  spec="${AIME_ACP_PKG:-}"
+  default_spec="$(aime_acp_default_package_spec)"
+  registry="${AIME_ACP_REGISTRY:-https://bnpm.byted.org}"
+  case "$spec" in
+    @*/aime-acp@?*)
+      if [ "${registry%/}" = 'https://bnpm.byted.org' ]; then
+        printf '%s\n' "$spec"
+      else
+        printf '%s\n' "$default_spec"
+      fi
+      ;;
+    *.tgz)
+      if [ -f "$spec" ]; then
+        printf '%s\n' "$spec"
+      else
+        printf '%s\n' "$default_spec"
+      fi
+      ;;
+    *) printf '%s\n' "$default_spec" ;;
+  esac
+}
+aime_acp_default_package_spec() {
+  printf '%s\n' "${AAMP_TASK_DEFAULT_AIME_ACP_PKG:-@tengchengwei/aime-acp@0.1.1-dev.1}"
+}
+aime_acp_local_package_name() {
+  local spec="$1"
+  tar -xOzf "$spec" package/package.json 2>/dev/null | node -e '
+let raw = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { raw += chunk; });
+process.stdin.on("end", () => {
+  try {
+    const value = JSON.parse(raw);
+    if (typeof value.name !== "string" || !/^@[^/]+\/aime-acp$/.test(value.name)) process.exit(1);
+    process.stdout.write(value.name);
+  } catch {
+    process.exit(1);
+  }
+});
+'
+}
+aime_acp_package_name() {
+  local local_name spec
+  spec="$(aime_acp_package_spec)"
+  case "$spec" in
+    *.tgz)
+      local_name="$(aime_acp_local_package_name "$spec" || true)"
+      if [ -n "$local_name" ]; then
+        printf '%s\n' "$local_name"
+        return 0
+      fi
+      spec="$(aime_acp_default_package_spec)"
+      ;;
+  esac
+  case "$spec" in
+    @*/aime-acp@?*) printf '%s\n' "${spec%@*}" ;;
+    *) return 1 ;;
+  esac
+}
+aime_acp_package_version() {
+  local spec
+  spec="$(aime_acp_package_spec)"
+  case "$spec" in
+    *.tgz) return 1 ;;
+    *@?*) printf '%s\n' "${spec##*@}" ;;
+    *) return 1 ;;
+  esac
+}
+aime_acp_package_spec_is_supported() {
+  case "$(aime_acp_package_spec)" in
+    *.tgz) return 0 ;;
+    @*/aime-acp@?*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+aime_acp_registry() {
+  printf '%s\n' 'https://bnpm.byted.org'
+}
+aime_acp_site() {
+  printf '%s\n' 'cn'
+}
+aime_acp_cli_path() {
+  printf '%s/dist/bin.js\n' "$(aime_acp_package_dir)"
+}
+remove_legacy_aime_acp() {
+  local legacy_dir legacy_bin canonical_dir resolved_bin
+  legacy_dir="$NPM_GLOBAL_PREFIX/lib/node_modules/aime-acp"
+  legacy_bin="$NPM_GLOBAL_PREFIX/bin/aime-acp"
+  canonical_dir="$(aime_acp_package_dir)"
+  canonical_dir="$(node -e '
+const fs = require("node:fs");
+try { process.stdout.write(fs.realpathSync(process.argv[1])); } catch {}
+' "$canonical_dir")"
+  if [ -e "$legacy_dir" ] || [ -L "$legacy_dir" ]; then
+    rm -rf -- "$legacy_dir"
+  fi
+  if [ -e "$legacy_bin" ] || [ -L "$legacy_bin" ]; then
+    resolved_bin="$(node -e '
+const fs = require("node:fs");
+const path = require("node:path");
+try { process.stdout.write(fs.realpathSync(process.argv[1])); } catch {}
+' "$legacy_bin")"
+    if [ -n "$canonical_dir" ] && [ -n "$resolved_bin" ]; then
+      case "$resolved_bin" in
+        "$canonical_dir"/*) return 0 ;;
+      esac
+    fi
+    rm -f -- "$legacy_bin"
+  fi
+}
+aime_acp_package_dir() {
+  printf '%s/lib/node_modules/%s\n' "$NPM_GLOBAL_PREFIX" "$(aime_acp_package_name)"
+}
+aime_acp_installed_version() {
+  local package_json
+  package_json="$(aime_acp_package_dir)/package.json"
+  [ -r "$package_json" ] || return 1
+  node -e '
+const fs = require("node:fs");
+const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+if (typeof value.version !== "string") process.exit(1);
+process.stdout.write(value.version);
+' "$package_json"
+}
+aime_acp_installed_name() {
+  local package_json
+  package_json="$(aime_acp_package_dir)/package.json"
+  [ -r "$package_json" ] || return 1
+  node -e '
+const fs = require("node:fs");
+const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+if (typeof value.name !== "string") process.exit(1);
+process.stdout.write(value.name);
+' "$package_json"
+}
+aime_acp_install_is_valid() {
+  local installed_version installed_name
+  [ -x "$(aime_acp_cli_path)" ] || return 1
+  installed_name="$(aime_acp_installed_name || true)"
+  [ "$installed_name" = "$(aime_acp_package_name)" ] || return 1
+  installed_version="$(aime_acp_installed_version || true)"
+  [ -n "$installed_version" ] || return 1
+  case "$(aime_acp_package_spec)" in
+    *.tgz) return 0 ;;
+    *) [ "$installed_version" = "$(aime_acp_package_version)" ] ;;
+  esac
+}
+aime_acp_install_is_current() {
+  case "$(aime_acp_package_spec)" in
+    *.tgz) return 1 ;;
+    *) aime_acp_install_is_valid ;;
+  esac
+}
+ensure_aime_acp_cli() {
+  aime_acp_package_spec_is_supported \
+    || agent_fail "AIME_ACP_PACKAGE_INVALID: AIME ACP must use a scoped BNPM package or a local tgz."
+  remove_legacy_aime_acp
+  if aime_acp_install_is_current; then
+    return 0
+  fi
+  agent_log "正在安装固定版本 AIME ACP 到隔离运行环境。"
+  npm_install_global_from_registry "$(aime_acp_registry)" "$(aime_acp_package_spec)" \
+    || agent_fail "AIME_ACP_INSTALL_FAILED: AIME ACP installation failed. Confirm company network access and retry."
+  aime_acp_install_is_valid \
+    || agent_fail "AIME_ACP_INSTALL_INVALID: AIME ACP installation validation failed."
+}
 resolve_cursor_cli_for_acp() {
   command -v cursor
 }
@@ -2719,6 +3453,50 @@ ensure_agent_cli() {
     return 0
   fi
+  if [ "$AGENT" = "traex" ]; then
+    find_traex_cli >/dev/null 2>&1 || agent_fail "未检测到 traex CLI。请先安装 Trae CLI Next（内部版）后重新运行脚本。"
+    return 0
+  fi
+  if [ "$AGENT" = "traecli" ]; then
+    local traecode_status
+    set +e
+    find_traecode_cli >/dev/null 2>&1
+    traecode_status=$?
+    set -e
+    [ "$traecode_status" -ne 2 ] || agent_fail "检测到的 traecli 属于 Trae CLI（内部版），不能作为 TraeCode CLI 启动。"
+    [ "$traecode_status" -eq 0 ] || agent_fail "未检测到 TraeCode CLI。请先安装 traecli 后重新运行脚本。"
+    return 0
+  fi
+  if [ "$AGENT" = "coco" ]; then
+    if find_traex_cli >/dev/null 2>&1; then return 0; fi
+    if find_coco_cli >/dev/null 2>&1; then return 0; fi
+    if find_traecode_cli >/dev/null 2>&1; then return 0; fi
+    agent_fail "未检测到 Trae CLI（内部版）、Trae CLI Next（内部版）或 TraeCode CLI。"
+  fi
+  if [ "$AGENT" = "workbuddy" ]; then
+    is_macos || agent_fail "WorkBuddy 一键探测仅支持 macOS。"
+    find_workbuddy_cli >/dev/null 2>&1 \
+      || agent_fail "未检测到 WorkBuddy。请确认已安装到 /Applications/WorkBuddy.app 后重新运行脚本。"
+    return 0
+  fi
+  if [ "$AGENT" = "workbuddy_ai" ]; then
+    is_macos || agent_fail "WorkBuddy AI 一键探测仅支持 macOS。"
+    find_workbuddy_ai_cli >/dev/null 2>&1 \
+      || agent_fail "未检测到 WorkBuddy AI CLI：${WORKBUDDY_AI_APP_CLI}。请确认该文件存在且可执行后重新运行脚本。"
+    return 0
+  fi
+  if [ "$AGENT" = "aime" ]; then
+    aime_internal_network_reachable \
+      || agent_fail "AIME 仅在公司内网可用；当前无法 ping 通 aime.bytedance.net。"
+    ensure_aime_acp_cli
+    return 0
+  fi
   command -v "$AGENT" >/dev/null 2>&1 || agent_fail "未检测到 $AGENT CLI。请先安装后重新运行脚本。"
 }
@@ -2866,6 +3644,68 @@ resolve_latest_codex_cli_version() {
     --prefix "$NPM_GLOBAL_PREFIX" 2>>"$ONE_CLICK_LOG" | tail -n 1 | tr -d '[:space:]'
 }
+codex_update_cache_latest() {
+  local current_version="$1"
+  [ -n "${CODEX_UPDATE_CACHE_FILE:-}" ] || return 1
+  [ -n "$current_version" ] || return 1
+  [ -f "$CODEX_UPDATE_CACHE_FILE" ] || return 1
+  CACHE_FILE="$CODEX_UPDATE_CACHE_FILE" \
+    TTL="${CODEX_UPDATE_CACHE_TTL_SECONDS:-86400}" \
+    CURRENT_VERSION="$current_version" \
+    NPM_PACKAGE="${CODEX_NPM_PACKAGE:-@openai/codex}" \
+    NPM_REGISTRY_VALUE="${NPM_REGISTRY:-https://registry.npmjs.org/}" \
+    node -e '
+const fs = require("fs");
+let data;
+try { data = JSON.parse(fs.readFileSync(process.env.CACHE_FILE, "utf8")); } catch { process.exit(1); }
+const checkedAt = Number(data.checked_at || 0);
+const ttl = Number(process.env.TTL || 86400);
+const age = Math.floor(Date.now() / 1000) - checkedAt;
+if (data.version !== 1 || typeof data.checked_at !== "number" || !Number.isFinite(checkedAt) || checkedAt <= 0) process.exit(1);
+if (!Number.isFinite(ttl) || ttl <= 0 || age < 0 || age >= ttl) process.exit(1);
+if (typeof data.current_version !== "string" || typeof data.latest_version !== "string") process.exit(1);
+if (typeof data.package !== "string" || typeof data.registry !== "string") process.exit(1);
+if (String(data.current_version || "") !== String(process.env.CURRENT_VERSION || "")) process.exit(1);
+if (String(data.package || "") !== String(process.env.NPM_PACKAGE || "")) process.exit(1);
+if (String(data.registry || "") !== String(process.env.NPM_REGISTRY_VALUE || "")) process.exit(1);
+const latest = String(data.latest_version || "").trim();
+if (!/^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(latest)) process.exit(1);
+process.stdout.write(latest);
+' 2>>"${ONE_CLICK_LOG:-/dev/null}"
+}
+write_codex_update_cache() {
+  local current_version="$1"
+  local latest_version="$2"
+  [ -n "${CODEX_UPDATE_CACHE_FILE:-}" ] || return 0
+  [ -n "$current_version" ] && [ -n "$latest_version" ] || return 0
+  mkdir -p "$(dirname "$CODEX_UPDATE_CACHE_FILE")"
+  CACHE_FILE="$CODEX_UPDATE_CACHE_FILE" \
+    CURRENT_VERSION="$current_version" \
+    LATEST_VERSION="$latest_version" \
+    NPM_PACKAGE="${CODEX_NPM_PACKAGE:-@openai/codex}" \
+    NPM_REGISTRY_VALUE="${NPM_REGISTRY:-https://registry.npmjs.org/}" \
+    node -e '
+const fs = require("fs");
+const file = process.env.CACHE_FILE;
+const temporary = `${file}.tmp.${process.pid}`;
+const payload = {
+  version: 1,
+  checked_at: Math.floor(Date.now() / 1000),
+  current_version: process.env.CURRENT_VERSION || "",
+  latest_version: process.env.LATEST_VERSION || "",
+  package: process.env.NPM_PACKAGE || "",
+  registry: process.env.NPM_REGISTRY_VALUE || "",
+};
+try {
+  fs.writeFileSync(temporary, JSON.stringify(payload, null, 2) + "\n", { mode: 0o600 });
+  fs.renameSync(temporary, file);
+} finally {
+  try { fs.unlinkSync(temporary); } catch {}
+}
+' 2>>"${ONE_CLICK_LOG:-/dev/null}" || true
+}
 codex_cli_update_available() {
   CODEX_CURRENT_VERSION="$1" CODEX_LATEST_VERSION="$2" node -e '
 function parse(value) {
@@ -3004,7 +3844,13 @@ ensure_codex_cli_updated() {
   codex_bin="$(resolve_codex_cli_for_acp || true)"
   [ -n "$codex_bin" ] || return 0
   version_before="$(codex_cli_version_number "$codex_bin" || true)"
-  latest_version="$(resolve_latest_codex_cli_version || true)"
+  latest_version="$(codex_update_cache_latest "$version_before" || true)"
+  if [ -n "$latest_version" ]; then
+    agent_detail "Codex CLI update check cache is fresh: current=${version_before:-unknown} latest=$latest_version"
+  else
+    latest_version="$(resolve_latest_codex_cli_version || true)"
+    write_codex_update_cache "$version_before" "$latest_version"
+  fi
   version_line="当前 Codex CLI 版本是：${version_before:-未知}，最新版本是：${latest_version:-获取失败}"
   write_one_click_log "[aamp-one-click] $version_line"
   agent_detail "checking Codex CLI update: path=$codex_bin version=${version_before:-unknown}"
@@ -3015,7 +3861,6 @@ ensure_codex_cli_updated() {
     comparison_status=$?
   fi
   if [ "$comparison_status" -eq 1 ]; then
-    printf '%s\n' "$version_line"
     agent_detail "Codex CLI is already current: current=${version_before:-unknown} latest=${latest_version:-unknown}"
     return 0
   fi
@@ -3104,6 +3949,142 @@ run_codex_login() {
   return "$status"
 }
+run_quiet_command_with_timeout() {
+  local timeout_seconds="$1"
+  shift
+  node - "$timeout_seconds" "$@" <<'NODE'
+const { spawn } = require('node:child_process');
+const timeoutSeconds = Number(process.argv[2] || '10');
+const timeoutMs = Math.max(1, Number.isFinite(timeoutSeconds) ? timeoutSeconds : 10) * 1000;
+const [command, ...args] = process.argv.slice(3);
+if (!command) process.exit(127);
+let finished = false;
+let timedOut = false;
+const child = spawn(command, args, { stdio: ['ignore', 'ignore', 'ignore'] });
+const timer = setTimeout(() => {
+  timedOut = true;
+  child.kill('SIGTERM');
+  setTimeout(() => child.kill('SIGKILL'), 1000).unref();
+}, timeoutMs);
+child.once('error', (error) => {
+  if (finished) return;
+  finished = true;
+  clearTimeout(timer);
+  process.exit(error && error.code === 'ENOENT' ? 127 : 1);
+});
+child.once('exit', (code, signal) => {
+  if (finished) return;
+  finished = true;
+  clearTimeout(timer);
+  if (timedOut) process.exit(124);
+  if (typeof code === 'number') process.exit(code);
+  process.exit(signal ? 1 : 0);
+});
+NODE
+}
+run_trae_login_status_for_bin() {
+  local trae_bin="$1"
+  run_quiet_command_with_timeout "$AAMP_TRAE_LOGIN_STATUS_TIMEOUT_SECONDS" "$trae_bin" login status
+}
+trae_login_status_timeout_message() {
+  printf '%s' "traex login status 超时。请手动执行 'traex login status' 检查登录状态后重新运行脚本。"
+}
+run_traex_login_status() {
+  local trae_bin status
+  trae_bin="$(find_traex_cli || true)"
+  [ -n "$trae_bin" ] || return 127
+  TRAE_CLI_BIN="$trae_bin"
+  agent_detail "checking Trae CLI login status: $trae_bin"
+  if run_trae_login_status_for_bin "$trae_bin"; then
+    return 0
+  else
+    status=$?
+  fi
+  if [ "$status" -eq 124 ]; then
+    agent_log "Trae CLI login status timed out after ${AAMP_TRAE_LOGIN_STATUS_TIMEOUT_SECONDS}s: $trae_bin"
+  fi
+  return "$status"
+}
+run_traex_login() {
+  local trae_bin
+  trae_bin="$(resolve_trae_cli || true)"
+  [ -n "$trae_bin" ] || return 127
+  "$trae_bin" login
+}
+trae_cli_is_traex() {
+  [ -n "$TRAE_CLI_BIN" ] && [ "${TRAE_CLI_BIN##*/}" = "traex" ]
+}
+confirm_trae_upgrade() {
+  local answer
+  printf '\n检测到 Trae CLI（内部版），飞书任务 Agent 暂不支持使用该版本建立连接。\n' >&2
+  printf '建议升级到 Trae CLI Next（内部版）（traex）后继续。\n' >&2
+  printf '升级过程中可自行选择是否保留 Trae CLI（内部版）。\n' >&2
+  answer="$(read_tty_line "是否现在升级到 traex？[y/N] ")"
+  case "$answer" in
+    y|Y|yes|YES|Yes) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+run_traex_installer() {
+  agent_log "正在安装/升级 traex..."
+  curl -fsSL "$TRAEX_INSTALLER_URL" | sh
+}
+maybe_upgrade_legacy_trae_cli() {
+  if trae_cli_is_traex; then
+    AGENT="traex"
+    return 0
+  fi
+  if confirm_trae_upgrade; then
+    run_traex_installer || agent_fail "traex 安装失败。请手动执行：curl -fsSL $TRAEX_INSTALLER_URL | sh"
+    hash -r 2>/dev/null || true
+    TRAE_CLI_BIN=""
+    find_traex_cli >/dev/null 2>&1 || agent_fail "traex 安装后仍未检测到。请确认 traex 在 PATH 中，然后重新运行脚本。"
+    AGENT="traex"
+    agent_log "已切换为 traex，继续启动。"
+    return 0
+  fi
+  AGENT_PREPARE_CANCELLED="true"
+  AGENT_PREPARE_CANCEL_REASON="用户取消升级。飞书任务 Agent 暂不支持使用 Trae CLI（内部版）建立连接，本次未启动飞书任务连接。如需继续，请先安装 Trae CLI Next（内部版）：curl -fsSL $TRAEX_INSTALLER_URL | sh"
+  agent_log "已取消升级，本次未启动飞书任务连接。"
+}
+ensure_traex_login() {
+  local trae_login_status
+  set +e
+  run_traex_login_status
+  trae_login_status=$?
+  set -e
+  if [ "$trae_login_status" -eq 124 ]; then
+    agent_fail "$(trae_login_status_timeout_message)"
+  fi
+  if [ "$trae_login_status" -ne 0 ]; then
+    agent_log "Trae CLI Next（内部版）未登录，正在启动登录流程。"
+    run_traex_login || agent_fail "Trae CLI Next（内部版）登录失败。请先执行 'traex login' 完成登录后重新运行脚本。"
+    set +e
+    run_traex_login_status
+    trae_login_status=$?
+    set -e
+    if [ "$trae_login_status" -eq 124 ]; then
+      agent_fail "$(trae_login_status_timeout_message)"
+    fi
+    [ "$trae_login_status" -eq 0 ] || agent_fail "Trae CLI Next（内部版）仍未登录。请先执行 'traex login' 完成登录后重新运行脚本。"
+  fi
+}
 print_cursor_gatekeeper_help() {
   local cursor_bin
   local cursor_real
@@ -3365,6 +4346,144 @@ ensure_codem_provider_ready() {
   return "$status"
 }
+traecode_readiness_helper_path() {
+  if [ -n "$AAMP_TRAECODE_READINESS_HELPER" ]; then printf '%s\n' "$AAMP_TRAECODE_READINESS_HELPER"; return 0; fi
+  local helper
+  helper="$(task_agent_global_package_dir)/bin/traecode-readiness.mjs"
+  [ -r "$helper" ] || return 1
+  printf '%s\n' "$helper"
+}
+run_traecode_check() {
+  local action="$1" helper traecode_bin
+  helper="$(traecode_readiness_helper_path)" || return 127
+  traecode_bin="$(find_traecode_cli)" || return $?
+  node "$helper" "$action" "$traecode_bin" "$AAMP_TRAECODE_CHECK_TIMEOUT_SECONDS"
+}
+confirm_traecode_update() {
+  local answer tty_path
+  tty_path="${AAMP_TRAECODE_UPDATE_TTY:-/dev/tty}"
+  if ! exec 6<>"$tty_path"; then return 2; fi
+  printf '%s' '当前 TraeCode CLI 版本较旧，不支持 ACP。是否执行 `traecli update` 升级？[y/N] ' >&6
+  if ! IFS= read -r answer <&6; then exec 6>&-; return 2; fi
+  exec 6>&-
+  case "$answer" in y|Y|yes|YES|Yes) return 0 ;; *) return 1 ;; esac
+}
+run_traecode_update() {
+  local traecode_bin="$1"
+  [ -n "$traecode_bin" ] || return 127
+  "$traecode_bin" update
+}
+ensure_traecode_acp() {
+  local probe_status confirm_status update_bin
+  set +e; run_traecode_check probe-acp >/dev/null; probe_status=$?; set -e
+  [ "$probe_status" -eq 0 ] && return 0
+  [ "$probe_status" -ne 124 ] || agent_fail "TraeCode CLI ACP 能力检查超时，请稍后重试。"
+  [ "$probe_status" -eq 3 ] || agent_fail "无法检查 TraeCode CLI 的 ACP 能力。"
+  set +e; confirm_traecode_update; confirm_status=$?; set -e
+  if [ "$confirm_status" -eq 2 ]; then
+    agent_fail "当前 TraeCode CLI 需要升级。请在交互式终端执行 'traecli update' 后重试。"
+  fi
+  if [ "$confirm_status" -ne 0 ]; then
+    AGENT_PREPARE_CANCELLED="true"
+    AGENT_PREPARE_CANCEL_REASON="用户取消升级 TraeCode CLI，本次未启动飞书任务连接。"
+    return 0
+  fi
+  update_bin="$(find_traecode_cli)" || agent_fail "升级前无法重新定位 TraeCode CLI，请手动执行 'traecli update' 后重试。"
+  run_traecode_update "$update_bin" || agent_fail "TraeCode CLI 升级失败，请查看上方升级输出，或手动执行 'traecli update' 后重试。"
+  hash -r 2>/dev/null || true
+  TRAECODE_CLI_BIN=""
+  find_traecode_cli >/dev/null 2>&1 || agent_fail "升级后仍未检测到 TraeCode CLI，请检查 PATH 后重试。"
+  set +e; run_traecode_check probe-acp >/dev/null; probe_status=$?; set -e
+  [ "$probe_status" -eq 0 ] || agent_fail "TraeCode CLI 升级后仍不支持 ACP，请确认升级结果后重试。"
+}
+ensure_traecode_doctor() {
+  local output doctor_status
+  set +e; output="$(run_traecode_check doctor 2>&1)"; doctor_status=$?; set -e
+  case "$doctor_status" in
+    0) [ -z "$output" ] || printf 'TraeCode CLI 诊断警告：%s\n' "$output" ;;
+    10) agent_fail "TraeCode CLI 尚未准备好。请打开 TraeCode CLI，按提示完成登录，并使用 /model 选择模型后重试。" ;;
+    11) agent_fail "TraeCode CLI 诊断未通过：${output:-未知错误}" ;;
+    65) agent_fail "TraeCode CLI 诊断结果无法解析，请执行 'traecli doctor --json' 检查后重试。" ;;
+    124) agent_fail "TraeCode CLI 诊断超时，请稍后重试。" ;;
+    *) agent_fail "TraeCode CLI 诊断执行失败：${output:-请执行 'traecli doctor --json' 检查。}" ;;
+  esac
+}
+ensure_traecode_ready() {
+  ensure_traecode_acp
+  [ "$AGENT_PREPARE_CANCELLED" = "true" ] && return 0
+  ensure_traecode_doctor
+}
+run_aime_auth_status() {
+  "$(aime_acp_cli_path)" auth status --site "$(aime_acp_site)" --json
+}
+run_aime_auth_login() {
+  "$(aime_acp_cli_path)" auth login --site "$(aime_acp_site)"
+}
+run_aime_doctor() {
+  "$(aime_acp_cli_path)" doctor --site "$(aime_acp_site)" --json
+}
+ensure_aime_ready() {
+  local auth_output auth_status auth_kind login_status doctor_status
+  set +e
+  auth_output="$(run_aime_auth_status)"
+  auth_status=$?
+  set -e
+  auth_kind="$(printf '%s' "$auth_output" | node -e '
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { input += chunk; });
+process.stdin.on("end", () => {
+  try {
+    const value = JSON.parse(input.trim());
+    if (value?.ok === true && value?.status === "authenticated") process.stdout.write("authenticated");
+    else if (value?.ok === true && value?.status === "unauthenticated") process.stdout.write("unauthenticated");
+    else process.stdout.write("error");
+  } catch {
+    process.stdout.write("error");
+  }
+});
+')"
+  if [ "$auth_status" -eq 0 ] && [ "$auth_kind" = "authenticated" ]; then
+    agent_detail "AIME managed-user authentication is ready"
+  elif [ "$auth_status" -eq 1 ] && [ "$auth_kind" = "unauthenticated" ]; then
+    agent_log "AIME 尚未登录，正在启动独立登录流程。"
+    set +e
+    run_aime_auth_login
+    login_status=$?
+    set -e
+    case "$login_status" in
+      0) ;;
+      2)
+        agent_fail "AIME 登录仍在等待完成。请继续完成浏览器授权，或重新执行 'aime-acp auth login --site cn' 后重试。"
+        ;;
+      *)
+        agent_fail "AIME 登录失败。请执行 'aime-acp auth login --site cn' 后重试。"
+        ;;
+    esac
+  else
+    agent_fail "AIME 认证状态检查失败。请执行 'aime-acp auth status --site cn --json' 查看安全诊断。"
+  fi
+  set +e
+  run_aime_doctor >/dev/null
+  doctor_status=$?
+  set -e
+  [ "$doctor_status" -eq 0 ] \
+    || agent_fail "AIME doctor 未通过。请确认公司内网与账号状态，并执行 'aime-acp doctor --site cn --json' 查看安全诊断。"
+}
 ensure_agent_login() {
   case "$AGENT" in
     codex)
@@ -3385,6 +4504,35 @@ ensure_agent_login() {
         run_cursor_login_status || agent_fail "cursor CLI 仍未登录。请先执行 'cursor login' 或 'agent login' 完成登录后重新运行脚本。"
       fi
       ;;
+    traex)
+      ensure_traex_login
+      ;;
+    traecli)
+      ensure_traecode_ready
+      ;;
+    coco)
+      if find_traex_cli >/dev/null 2>&1; then
+        AGENT="traex"
+        ensure_traex_login
+      elif find_coco_cli >/dev/null 2>&1; then
+        maybe_upgrade_legacy_trae_cli
+        if [ "$AGENT" = "traex" ]; then ensure_traex_login; fi
+      elif find_traecode_cli >/dev/null 2>&1; then
+        AGENT="traecli"
+        ensure_traecode_ready
+      else
+        agent_fail "未检测到 Trae CLI（内部版）、Trae CLI Next（内部版）或 TraeCode CLI。"
+      fi
+      ;;
+    workbuddy)
+      agent_detail "WorkBuddy authentication is managed by the desktop app"
+      ;;
+    workbuddy_ai)
+      agent_detail "WorkBuddy AI authentication is managed by the desktop app"
+      ;;
+    aime)
+      ensure_aime_ready
+      ;;
     codem)
       ensure_codem_local_bin_on_path
       codem --version >/dev/null
@@ -3453,6 +4601,11 @@ resolve_codex_cli_for_acp() {
     return 0
   fi
+  if is_macos && [ -x "$CODEX_CHATGPT_APP_CLI" ]; then
+    printf '%s\n' "$CODEX_CHATGPT_APP_CLI"
+    return 0
+  fi
   if is_macos && [ -x "$CODEX_APP_CLI" ]; then
     printf '%s\n' "$CODEX_APP_CLI"
     return 0
@@ -3461,8 +4614,69 @@ resolve_codex_cli_for_acp() {
   return 1
 }
+acp_command_word() {
+  local value="$1" single_quote_escape
+  case "$value" in *$'\n'*|*$'\r'*) return 1 ;; esac
+  single_quote_escape="'\"'\"'"
+  value="${value//\'/$single_quote_escape}"
+  printf "'%s'" "$value"
+}
 build_acp_agent_command() {
   ACP_AGENT_COMMAND="$AGENT"
+  if [ "$AGENT" = "workbuddy" ]; then
+    local workbuddy_bin workbuddy_config_dir_word
+    workbuddy_bin="$(find_workbuddy_cli)" \
+      || agent_fail "WorkBuddy 不可用。请确认已安装到 /Applications/WorkBuddy.app。"
+    workbuddy_config_dir_word="$(acp_command_word "$HOME/.workbuddy")" \
+      || agent_fail "WorkBuddy 配置目录包含不受支持的换行符。"
+    ACP_AGENT_COMMAND="env CODEBUDDY_CONFIG_DIR=$workbuddy_config_dir_word CODEBUDDY_SKIP_BUILTIN_MARKETPLACE=1 $workbuddy_bin --acp"
+    agent_detail "using native WorkBuddy ACP command: $ACP_AGENT_COMMAND"
+    return 0
+  fi
+  if [ "$AGENT" = "workbuddy_ai" ]; then
+    local workbuddy_ai_bin workbuddy_ai_word workbuddy_ai_config_dir_word
+    workbuddy_ai_bin="$(find_workbuddy_ai_cli)" \
+      || agent_fail "WorkBuddy AI CLI 不可用：${WORKBUDDY_AI_APP_CLI}。请确认该文件存在且可执行。"
+    workbuddy_ai_word="$(acp_command_word "$workbuddy_ai_bin")" \
+      || agent_fail "WorkBuddy AI 路径包含不受支持的换行符。"
+    workbuddy_ai_config_dir_word="$(acp_command_word "$HOME/.workbuddy-ai")" \
+      || agent_fail "WorkBuddy AI 配置目录包含不受支持的换行符。"
+    ACP_AGENT_COMMAND="env CODEBUDDY_CONFIG_DIR=$workbuddy_ai_config_dir_word CODEBUDDY_SKIP_BUILTIN_MARKETPLACE=1 $workbuddy_ai_word --acp"
+    agent_detail "using native WorkBuddy AI ACP command: $ACP_AGENT_COMMAND"
+    return 0
+  fi
+  if [ "$AGENT" = "aime" ]; then
+    local aime_bin aime_word
+    aime_bin="$(aime_acp_cli_path)"
+    [ -x "$aime_bin" ] || agent_fail "AIME_ACP_UNAVAILABLE: AIME ACP executable is unavailable after preparation."
+    aime_word="$(acp_command_word "$aime_bin")" \
+      || agent_fail "AIME_ACP_PATH_INVALID: AIME ACP executable path is invalid."
+    ACP_AGENT_COMMAND="$aime_word --site $(aime_acp_site)"
+    agent_detail "AIME ACP configured for site $(aime_acp_site)"
+    return 0
+  fi
+  if [ "$AGENT" = "traecli" ]; then
+    local traecode_bin traecode_word
+    traecode_bin="$(find_traecode_cli)" || agent_fail "TraeCode CLI 不可用，无法启动 ACP 服务。"
+    traecode_word="$(acp_command_word "$traecode_bin")" \
+      || agent_fail "TraeCode CLI 路径包含不受支持的换行符。"
+    ACP_AGENT_COMMAND="$traecode_word acp serve"
+    agent_detail "using native TraeCode ACP command: $ACP_AGENT_COMMAND"
+    return 0
+  fi
+  if [ "$AGENT" = "coco" ] || [ "$AGENT" = "traex" ]; then
+    local trae_bin
+    trae_bin="$(find_traex_cli)" || agent_fail "Trae CLI Next（内部版）（traex）不可用，无法启动飞书任务所需的 ACP 服务。"
+    ACP_AGENT_COMMAND="$trae_bin acp serve"
+    agent_detail "using native Trae ACP command: $ACP_AGENT_COMMAND"
+    return 0
+  fi
   if [ "$AGENT" != "codex" ]; then
     return 0
   fi
@@ -3484,7 +4698,7 @@ validate_codex_acp_command() {
   if [ "$status" -ne 0 ]; then
     agent_log "Codex ACP command validation failed:"
     printf '%s\n' "$output" >&2
-    agent_fail "codex ACP command is unavailable; check Codex.app or reinstall codex CLI"
+    agent_fail "codex ACP command is unavailable; check ChatGPT.app, Codex.app, or reinstall codex CLI"
   fi
 }
@@ -3683,6 +4897,22 @@ run_internal_discover_agents() {
   if agent_cli_detected cursor; then
     agents+=("cursor")
   fi
+  if agent_cli_detected traex; then
+    agents+=("traex")
+  elif agent_cli_detected coco; then
+    agents+=("coco")
+  elif agent_cli_detected traecli; then
+    agents+=("traecli")
+  fi
+  if agent_cli_detected workbuddy; then
+    agents+=("workbuddy")
+  fi
+  if agent_cli_detected workbuddy_ai; then
+    agents+=("workbuddy_ai")
+  fi
+  if agent_cli_detected aime; then
+    agents+=("aime")
+  fi
   local joined=""
   if [ "${#agents[@]}" -gt 0 ]; then
     joined="$(IFS=,; printf '%s' "${agents[*]}")"
@@ -3696,32 +4926,79 @@ process.stdout.write(JSON.stringify({ agents }));
 prepare_internal_agent_environment() {
   [ -n "$AGENT" ] || agent_fail "internal Agent preparation requires --agent"
   validate_agent_name "$AGENT"
-  source_lark_env
+  ensure_agent_selection_available "$AGENT"
+  load_agent_metadata
+  if [ "$AGENT_EXECUTION_LOCATION" = "local" ]; then
+    source_lark_env
+  fi
   ensure_agent_cli
 }
 run_internal_register_binding() {
   [ -n "$AGENT" ] || agent_fail "internal Bot registration requires --agent"
   validate_agent_name "$AGENT"
-  source_lark_env
+  ensure_agent_selection_available "$AGENT"
+  load_agent_metadata
   register_feishu_app
-  emit_internal_result "{\"app_id\":\"$(json_escape "$APP_ID")\",\"app_secret\":\"$(json_escape "$APP_SECRET")\",\"display_name\":\"$(json_escape "$BOT_NAME")\",\"lark_cli_profile\":\"$(json_escape "$LARK_CLI_PROFILE")\"}"
+  if [ "$AGENT_EXECUTION_LOCATION" = "remote" ]; then
+    emit_internal_result "{\"app_id\":\"$(json_escape "$APP_ID")\",\"app_secret\":\"$(json_escape "$APP_SECRET")\",\"display_name\":\"$(json_escape "$BOT_NAME")\",\"auth_mode\":\"app-secret\"}"
+  else
+    emit_internal_result "{\"app_id\":\"$(json_escape "$APP_ID")\",\"app_secret\":\"$(json_escape "$APP_SECRET")\",\"display_name\":\"$(json_escape "$BOT_NAME")\",\"lark_cli_profile\":\"$(json_escape "$LARK_CLI_PROFILE")\",\"auth_mode\":\"lark-cli\"}"
+  fi
 }
 run_internal_prepare_agent() {
   prepare_internal_agent_environment
   ensure_codex_cli_updated
   ensure_agent_login
+  if [ "$AGENT_PREPARE_CANCELLED" = "true" ]; then
+    emit_internal_result "{\"cancelled\":true,\"agent_type\":\"$(json_escape "$AGENT")\",\"reason\":\"$(json_escape "$AGENT_PREPARE_CANCEL_REASON")\"}"
+    return 0
+  fi
   maybe_mock_fail "agent-login"
   ensure_acpx
   build_acp_agent_command
-  emit_internal_result "{\"agent_type\":\"$(json_escape "$AGENT")\",\"acp_command\":\"$(json_escape "$ACP_AGENT_COMMAND")\",\"lark_cli_config_dir\":\"$(json_escape "${LARKSUITE_CLI_CONFIG_DIR:-}")\"}"
+  if [ "$AGENT_EXECUTION_LOCATION" = "remote" ]; then
+    emit_internal_result "{\"agent_type\":\"$(json_escape "$AGENT")\",\"acp_command\":\"$(json_escape "$ACP_AGENT_COMMAND")\"}"
+  else
+    emit_internal_result "{\"agent_type\":\"$(json_escape "$AGENT")\",\"acp_command\":\"$(json_escape "$ACP_AGENT_COMMAND")\",\"lark_cli_config_dir\":\"$(json_escape "${LARKSUITE_CLI_CONFIG_DIR:-}")\"}"
+  fi
+}
+run_internal_probe_profile() {
+  AAMP_TASK_INTERNAL_BINDING_JSON=""
+  IFS= read -r AAMP_TASK_INTERNAL_BINDING_JSON <&"$AAMP_TASK_INTERNAL_INPUT_FD" || true
+  [ -n "$AAMP_TASK_INTERNAL_BINDING_JSON" ] || agent_fail "missing internal binding payload"
+  AGENT="$(binding_json_field agent_type)"
+  validate_agent_name "$AGENT"
+  load_agent_metadata
+  [ "$AGENT_EXECUTION_LOCATION" != "remote" ] || agent_fail "remote bindings do not use lark-cli profiles"
+  APP_ID="$(binding_json_field bot.app_id)"
+  LARK_CLI_PROFILE="$(binding_json_field bot.lark_cli_profile)"
+  [ -n "$APP_ID" ] && [ -n "$LARK_CLI_PROFILE" ] || agent_fail "binding is missing Feishu app or profile"
+  AAMP_TASK_INTERNAL_BINDING_JSON=""
+  unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy
+  export LARKSUITE_CLI_CONFIG_DIR="$AAMP_LARK_CLI_CONFIG_DIR"
+  unset LARK_CLI_NO_PROXY
+  if ! select_lark_cli_bin_from_candidates; then
+    emit_internal_result '{"ready":false}'
+    return 0
+  fi
+  if with_lark_cli_config_lock probe_lark_cli_profile_locked "$LARK_CLI_PROFILE"; then
+    emit_internal_result "{\"ready\":true,\"lark_cli_bin\":\"$(json_escape "$LARK_CLI_CMD")\",\"lark_cli_config_dir\":\"$(json_escape "${LARKSUITE_CLI_CONFIG_DIR:-}")\"}"
+  else
+    emit_internal_result '{"ready":false}'
+  fi
 }
 run_internal_ensure_profile() {
   AAMP_TASK_INTERNAL_BINDING_JSON=""
   IFS= read -r AAMP_TASK_INTERNAL_BINDING_JSON <&"$AAMP_TASK_INTERNAL_INPUT_FD" || true
   [ -n "$AAMP_TASK_INTERNAL_BINDING_JSON" ] || agent_fail "missing internal binding payload"
+  AGENT="$(binding_json_field agent_type)"
+  validate_agent_name "$AGENT"
+  load_agent_metadata
+  [ "$AGENT_EXECUTION_LOCATION" != "remote" ] || agent_fail "remote bindings do not use lark-cli profiles"
   APP_ID="$(binding_json_field bot.app_id)"
   APP_SECRET="$(binding_json_field bot.app_secret)"
   BOT_NAME="$(binding_json_field bot.display_name)"
@@ -3736,7 +5013,9 @@ run_internal_ensure_profile() {
 run_internal_action() {
   AAMP_TASK_INTERNAL="true"
-  ensure_node_toolchain
+  if [ "$AAMP_TASK_ACTION" != "__probe-profile" ]; then
+    ensure_node_toolchain
+  fi
   case "$AAMP_TASK_ACTION" in
     __discover-agents)
       run_internal_discover_agents
@@ -3747,6 +5026,9 @@ run_internal_action() {
     __prepare-agent)
       run_internal_prepare_agent
       ;;
+    __probe-profile)
+      run_internal_probe_profile
+      ;;
     __ensure-profile)
       run_internal_ensure_profile
       ;;
@@ -3760,6 +5042,92 @@ task_agent_controller_path() {
   printf '%s/bin/feishu-task-agent-controller.mjs\n' "$(task_agent_global_package_dir)"
 }
+task_agent_metadata_path() {
+  printf '%s/bin/agent-metadata.mjs\n' "$(task_agent_global_package_dir)"
+}
+local_package_override_is_supported() {
+  local spec local_path
+  spec="${1:-}"
+  case "$spec" in
+    file:*)
+      local_path="${spec#file:}"
+      [ -n "$local_path" ] && [ -d "$local_path" ]
+      ;;
+    *.tgz) [ -f "$spec" ] ;;
+    *) return 1 ;;
+  esac
+}
+aime_local_package_override_path() {
+  local directory filename spec
+  spec="${1:-}"
+  case "$spec" in
+    -*|file:*|*://*) return 1 ;;
+  esac
+  if [[ "$spec" =~ (^|@)[[:alpha:]][[:alnum:]+.-]*: ]]; then
+    return 1
+  fi
+  case "$spec" in
+    *.tgz) [ -f "$spec" ] || return 1 ;;
+    *) return 1 ;;
+  esac
+  case "$spec" in
+    */*)
+      directory="${spec%/*}"
+      filename="${spec##*/}"
+      [ -n "$directory" ] || directory="/"
+      ;;
+    *)
+      directory="."
+      filename="$spec"
+      ;;
+  esac
+  directory="$(cd -P -- "$directory" 2>/dev/null && pwd -P)" || return 1
+  printf '%s/%s\n' "$directory" "$filename"
+}
+apply_task_agent_package_override_policy() {
+  local aime_override_path
+  ACP_BRIDGE_PKG="$AAMP_TASK_DEFAULT_ACP_BRIDGE_PKG"
+  FEISHU_BRIDGE_PKG="$AAMP_TASK_DEFAULT_FEISHU_BRIDGE_PKG"
+  AIME_ACP_PKG="$AAMP_TASK_DEFAULT_AIME_ACP_PKG"
+  [ "$AAMP_TASK_ALLOW_PACKAGE_OVERRIDES" = "true" ] || return 0
+  if [ -n "$AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG" ]; then
+    local_package_override_is_supported "$AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG" \
+      || agent_fail "Local ACP Bridge package override is invalid."
+    ACP_BRIDGE_PKG="$AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG"
+  fi
+  if [ -n "$AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG" ]; then
+    local_package_override_is_supported "$AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG" \
+      || agent_fail "Local Feishu Bridge package override is invalid."
+    FEISHU_BRIDGE_PKG="$AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG"
+  fi
+  if [ -n "$AAMP_TASK_REQUESTED_AIME_ACP_PKG" ]; then
+    aime_override_path="$(aime_local_package_override_path "$AAMP_TASK_REQUESTED_AIME_ACP_PKG")" \
+      || agent_fail "AIME_ACP_PACKAGE_OVERRIDE_INVALID: AIME ACP package override must be an existing local .tgz file."
+    AAMP_TASK_REQUESTED_AIME_ACP_PKG="$aime_override_path"
+    AIME_ACP_PKG="$aime_override_path"
+  fi
+}
+load_agent_metadata() {
+  local metadata_path metadata_json
+  metadata_path="$(task_agent_metadata_path)"
+  [ -r "$metadata_path" ] || agent_fail "Task Agent metadata is missing: $metadata_path"
+  metadata_json="$(node "$metadata_path" --json "$AGENT")" \
+    || agent_fail "failed to resolve Task Agent metadata for $AGENT"
+  AGENT_EXECUTION_LOCATION="$(node -e 'const value=JSON.parse(process.argv[1]);process.stdout.write(value.executionLocation)' "$metadata_json")"
+  AGENT_ATTACHMENT_POLICY="$(node -e 'const value=JSON.parse(process.argv[1]);process.stdout.write(value.attachmentPolicy || "")' "$metadata_json")"
+  AGENT_TASK_DISPATCH_CONCURRENCY="$(node -e 'const value=JSON.parse(process.argv[1]);process.stdout.write(value.taskDispatchConcurrency ? String(value.taskDispatchConcurrency) : "")' "$metadata_json")"
+  if [ -n "$AAMP_TASK_INTERNAL_EXECUTION_LOCATION" ] \
+    && [ "$AAMP_TASK_INTERNAL_EXECUTION_LOCATION" != "$AGENT_EXECUTION_LOCATION" ]; then
+    agent_fail "Task Agent execution metadata mismatch"
+  fi
+  AAMP_TASK_INTERNAL_EXECUTION_LOCATION="$AGENT_EXECUTION_LOCATION"
+}
 run_task_agent_controller() {
   local controller bootstrap_path install_command
   controller="$(task_agent_controller_path)"
@@ -3772,6 +5140,17 @@ run_task_agent_controller() {
   export AAMP_TASK_NPX_BIN="$NPX_BIN"
   export AAMP_TASK_ACP_BRIDGE_PKG="$ACP_BRIDGE_PKG"
   export AAMP_TASK_FEISHU_BRIDGE_PKG="$FEISHU_BRIDGE_PKG"
+  export AAMP_TASK_AIME_ACP_PKG="$AIME_ACP_PKG"
+  export AAMP_TASK_ALLOW_PACKAGE_OVERRIDES
+  if [ "$AAMP_TASK_ALLOW_PACKAGE_OVERRIDES" != "true" ]; then
+    AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG=""
+    AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG=""
+    AAMP_TASK_REQUESTED_AIME_ACP_PKG=""
+  fi
+  export AAMP_TASK_PACKAGE_OVERRIDES_RESOLVED=true
+  export AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG
+  export AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG
+  export AAMP_TASK_REQUESTED_AIME_ACP_PKG
   export AAMP_TASK_CODEX_ACP_PKG="$CODEX_ACP_PKG"
   export AAMP_TASK_AGENT_VERSION
   export AAMP_TASK_DEFAULT_AGENT="$AGENT"
@@ -3829,13 +5208,19 @@ main() {
     return 0
   fi
+  apply_task_agent_package_override_policy
   case "$AAMP_TASK_ACTION" in
-    __discover-agents|__register-binding|__prepare-agent|__ensure-profile)
+    __discover-agents|__register-binding|__prepare-agent|__probe-profile|__ensure-profile)
       run_internal_action
       return 0
       ;;
   esac
+  if [ "$AGENT" = "aime" ]; then
+    ensure_agent_selection_available "$AGENT"
+  fi
   trap cleanup EXIT INT TERM HUP
   init_log_run
   validate_mock_fail_stage