@larktask/aamp-feishu-task-agent 0.1.0-dev.174 → 0.1.1-dev.2

package/bootstrap/aamp-feishu-task-agent-bootstrap.sh

@@ -7,6 +7,9 @@ APP_ID=""
 APP_SECRET=""
 BOT_NAME=""
 LARK_CLI_PROFILE=""
+AGENT_EXECUTION_LOCATION=""
+AGENT_ATTACHMENT_POLICY=""
+AGENT_TASK_DISPATCH_CONCURRENCY=""
 AAMP_HOST="https://meshmail.ai"
 DEBUG_MODE="false"
 AAMP_TASK_START_MODE="install"
@@ -15,6 +18,7 @@ AAMP_TASK_ENTRY="${AAMP_TASK_ENTRY:-}"
 AAMP_TASK_INTERNAL="${AAMP_TASK_INTERNAL:-false}"
 AAMP_TASK_INTERNAL_RESULT_FD="${AAMP_TASK_INTERNAL_RESULT_FD:-3}"
 AAMP_TASK_INTERNAL_INPUT_FD="${AAMP_TASK_INTERNAL_INPUT_FD:-4}"
+AAMP_TASK_INTERNAL_EXECUTION_LOCATION="${AAMP_TASK_INTERNAL_EXECUTION_LOCATION:-}"
 NPM_REGISTRY="${NPM_REGISTRY:-https://registry.npmjs.org/}"
 NPM_CACHE_DIR="${NPM_CONFIG_CACHE:-${npm_config_cache:-${TMPDIR:-/tmp}/aamp-one-click-npm-cache}}"
 NPM_GLOBAL_PREFIX="${NPM_GLOBAL_PREFIX:-$HOME/.aamp/npm-global}"
@@ -51,22 +55,63 @@ CODEX_CHATGPT_APP_CLI="/Applications/ChatGPT.app/Contents/Resources/codex"
 CODEX_APP_CLI="/Applications/Codex.app/Contents/Resources/codex"
 CODEX_AUTO_UPDATE="${CODEX_AUTO_UPDATE:-true}"
 CODEX_NPM_PACKAGE="${CODEX_NPM_PACKAGE:-@openai/codex}"
+CODEX_UPDATE_CACHE_FILE="${CODEX_UPDATE_CACHE_FILE:-$HOME/.aamp/feishu-task-agent/codex-update-cache.json}"
+CODEX_UPDATE_CACHE_TTL_SECONDS="${CODEX_UPDATE_CACHE_TTL_SECONDS:-86400}"
 CODEX_ACP_PKG="${CODEX_ACP_PKG:-@agentclientprotocol/codex-acp@1.0.2}"
+AAMP_TRAE_CLI_BIN="${AAMP_TRAE_CLI_BIN:-}"
+AAMP_TRAE_LOGIN_STATUS_TIMEOUT_SECONDS="${AAMP_TRAE_LOGIN_STATUS_TIMEOUT_SECONDS:-10}"
+AAMP_TRAECODE_CLI_BIN="${AAMP_TRAECODE_CLI_BIN:-}"
+AAMP_TRAECODE_CHECK_TIMEOUT_SECONDS="${AAMP_TRAECODE_CHECK_TIMEOUT_SECONDS:-10}"
+AAMP_TRAECODE_READINESS_HELPER="${AAMP_TRAECODE_READINESS_HELPER:-}"
+AAMP_TRAECODE_UPDATE_TTY="${AAMP_TRAECODE_UPDATE_TTY:-/dev/tty}"
+TRAEX_INSTALLER_URL="${TRAEX_INSTALLER_URL:-https://code.byted.org/api/tos-proxy/download/traex_install.sh}"
+WORKBUDDY_APP_CLI="/Applications/WorkBuddy.app/Contents/Resources/app.asar.unpacked/cli/bin/codebuddy"
+WORKBUDDY_AI_APP_CLI="/Applications/WorkBuddy AI.app/Contents/Resources/app.asar.unpacked/cli/bin/codebuddy"
 LARK_REGISTER_APP_SDK="${LARK_REGISTER_APP_SDK:-@larksuiteoapi/node-sdk@1.68.0}"
 LARK_CLI_MIN_VERSION="${LARK_CLI_MIN_VERSION:-1.0.64}"
-FEISHU_APP_SCOPES_TENANT="${FEISHU_APP_SCOPES_TENANT:-im:message,im:message:send_as_bot,im:message:readonly,im:resource,cardkit:card:write,task:task,task:comment,task:task:readonly,task:comment:readonly,task:attachment:delete,task:attachment:file:download,task:attachment:read,task:attachment:upload,task:attachment:write,task:comment:delete,task:comment:read,task:comment:write,task:comment:writeonly,task:task:delete,task:task:read,task:task:write,task:task:writeonly,task:tasklist:delete,task:tasklist:read,task:tasklist:write,task:tasklist:writeonly,search:docs:read,base:app:copy,base:app:create,base:app:read,base:app:update,base:block:create,base:block:delete,base:block:read,base:block:update,base:dashboard:create,base:dashboard:delete,base:dashboard:read,base:dashboard:update,base:field:create,base:field:delete,base:field:read,base:field:update,base:form:create,base:form:delete,base:form:read,base:form:update,base:history:read,base:record:create,base:record:delete,base:record:read,base:record:update,base:role:create,base:role:delete,base:role:read,base:role:update,base:table:create,base:table:delete,base:table:read,base:table:update,base:view:read,base:view:write_only,base:workflow:create,base:workflow:read,base:workflow:update,board:whiteboard:node:create,board:whiteboard:node:read,calendar:calendar.event:create,calendar:calendar.event:delete,calendar:calendar.event:read,calendar:calendar.event:reply,calendar:calendar.event:update,calendar:calendar.free_busy:read,calendar:calendar:create,calendar:calendar:delete,calendar:calendar:read,calendar:calendar:update,contact:user.base:readonly,contact:user.basic_profile:readonly,docs:document.media:download,docs:document.media:upload,docs:document:export,docs:document:import,docx:document:create,docx:document:readonly,docx:document:write_only,drive:drive.metadata:readonly,drive:file:download,drive:file:upload,im:chat.managers:write_only,im:chat.members:read,im:chat.members:write_only,im:chat.moderation:read,im:chat:moderation:write_only,im:message.pins:read,im:message.pins:write_only,im:message.reactions:read,im:message.reactions:write_only,im:message:recall,mail:user_mailbox.event.mail_address:read,mail:user_mailbox.mail_contact:read,mail:user_mailbox.message.address:read,mail:user_mailbox.message.body:read,mail:user_mailbox.message.subject:read,mindnote:node:create,mindnote:node:read,minutes:minutes.basic:read,minutes:minutes.media:export,minutes:minutes:readonly,sheets:spreadsheet.meta:read,sheets:spreadsheet.meta:write_only,sheets:spreadsheet:create,sheets:spreadsheet:read,sheets:spreadsheet:write_only,slides:presentation:create,slides:presentation:read,slides:presentation:update,slides:presentation:write_only,task:custom_field:read,task:custom_field:write,task:section:read,task:section:write,vc:meeting.bot.join:write,vc:meeting.meetingevent:read,vc:meeting.message:write,vc:record:readonly,wiki:member:create,wiki:member:retrieve,wiki:member:update,wiki:node:copy,wiki:node:create,wiki:node:move,wiki:node:read,wiki:node:retrieve,wiki:space:read,wiki:space:retrieve,wiki:space:write_only}"
-FEISHU_APP_SCOPES_USER="${FEISHU_APP_SCOPES_USER:-im:message,im:message:readonly,im:resource,cardkit:card:write,task:task,task:comment,task:task:readonly,task:comment:readonly,task:attachment:delete,task:attachment:file:download,task:attachment:read,task:attachment:upload,task:attachment:write,task:comment:delete,task:comment:read,task:comment:write,task:comment:writeonly,task:task:delete,task:task:read,task:task:write,task:task:writeonly,task:tasklist:delete,task:tasklist:read,task:tasklist:write,task:tasklist:writeonly,search:docs:read,search:message,base:app:copy,base:app:create,base:app:read,base:app:update,base:block:create,base:block:delete,base:block:read,base:block:update,base:dashboard:create,base:dashboard:delete,base:dashboard:read,base:dashboard:update,base:field:create,base:field:delete,base:field:read,base:field:update,base:form:create,base:form:delete,base:form:read,base:form:update,base:history:read,base:record:create,base:record:delete,base:record:read,base:record:update,base:role:create,base:role:delete,base:role:read,base:role:update,base:table:create,base:table:delete,base:table:read,base:table:update,base:view:read,base:view:write_only,base:workflow:create,base:workflow:read,base:workflow:update,board:whiteboard:node:create,board:whiteboard:node:read,calendar:calendar.event:create,calendar:calendar.event:delete,calendar:calendar.event:read,calendar:calendar.event:reply,calendar:calendar.event:update,calendar:calendar.free_busy:read,calendar:calendar:create,calendar:calendar:delete,calendar:calendar:read,calendar:calendar:update,contact:user.base:readonly,contact:user.basic_profile:readonly,contact:user:search,docs:document.media:download,docs:document.media:upload,docs:document:export,docs:document:import,docx:document:create,docx:document:readonly,docx:document:write_only,drive:drive.metadata:readonly,drive:file:download,drive:file:upload,im:chat.managers:write_only,im:chat.members:read,im:chat.members:write_only,im:chat.moderation:read,im:chat.nickname:read,im:chat.nickname:write,im:chat.user_setting:read,im:chat.user_setting:write,im:chat:read,im:chat:update,im:chat:create_by_user,im:chat:moderation:write_only,im:feed.flag:read,im:feed.flag:write,im:feed.shortcut:read,im:feed.shortcut:write,im:feed_group_v1:read,im:feed_group_v1:write,im:message.group_msg:get_as_user,im:message.p2p_msg:get_as_user,im:message.pins:read,im:message.pins:write_only,im:message.reactions:read,im:message.reactions:write_only,im:message:recall,mail:event,mail:user_mailbox.event.mail_address:read,mail:user_mailbox.mail_contact:read,mail:user_mailbox.message.address:read,mail:user_mailbox.message.body:read,mail:user_mailbox.message.subject:read,mindnote:node:create,mindnote:node:read,minutes:minutes.artifacts:read,minutes:minutes.basic:read,minutes:minutes.media:export,minutes:minutes.search:read,minutes:minutes.upload:write,minutes:minutes:readonly,minutes:minutes:update,profile:user_profile:read,sheets:spreadsheet.meta:read,sheets:spreadsheet.meta:write_only,sheets:spreadsheet:create,sheets:spreadsheet:read,sheets:spreadsheet:write_only,slides:presentation:create,slides:presentation:read,slides:presentation:update,slides:presentation:write_only,task:custom_field:read,task:custom_field:write,task:section:read,task:section:write,vc:meeting.bot.join:write,vc:meeting.meetingevent:read,vc:meeting.message:write,vc:meeting.search:read,vc:note:read,vc:record:readonly,wiki:member:create,wiki:member:retrieve,wiki:member:update,wiki:node:copy,wiki:node:create,wiki:node:move,wiki:node:read,wiki:node:retrieve,wiki:space:read,wiki:space:retrieve,wiki:space:write_only}"
+AAMP_FEISHU_APP_SCOPES_TENANT_OVERRIDE="${FEISHU_APP_SCOPES_TENANT-}"
+AAMP_FEISHU_APP_SCOPES_USER_OVERRIDE="${FEISHU_APP_SCOPES_USER-}"
+AAMP_FEISHU_USER_AUTH_REQUIRED_SCOPES_OVERRIDE="${FEISHU_USER_AUTH_REQUIRED_SCOPES-}"
+AAMP_FEISHU_USER_AUTH_REQUESTED_SCOPES_OVERRIDE="${FEISHU_USER_AUTH_REQUESTED_SCOPES-}"
+AAMP_FEISHU_USER_AUTH_EXCLUDES_OVERRIDE="${FEISHU_USER_AUTH_EXCLUDES-}"
+FEISHU_APP_SCOPES_TENANT="$AAMP_FEISHU_APP_SCOPES_TENANT_OVERRIDE"
+FEISHU_APP_SCOPES_USER="$AAMP_FEISHU_APP_SCOPES_USER_OVERRIDE"
 FEISHU_APP_EVENTS_TENANT="${FEISHU_APP_EVENTS_TENANT:-task.task.update_user_access_v2}"
 FEISHU_APP_EVENTS_USER="${FEISHU_APP_EVENTS_USER:-task.task.update_user_access_v2}"
-FEISHU_USER_AUTH_DOMAINS="${FEISHU_USER_AUTH_DOMAINS:-base,calendar,contact,docs,im,mail,mindnotes,minutes,note,sheets,slides,task,vc,wiki}"
-FEISHU_USER_AUTH_EXCLUDES="${FEISHU_USER_AUTH_EXCLUDES:-im:message.send_as_user,mail:user_mailbox.message:send,mail:user_mailbox.rule:read,mail:user_mailbox.folder:write,mail:user_mailbox.rule:write,mail:user_mailbox.message:modify,mail:user_mailbox.message:readonly,mail:user_mailbox.folder:read,mail:user_mailbox.mail_contact:write,mail:user_mailbox:readonly}"
-FEISHU_USER_AUTH_REQUIRED_SCOPES="${FEISHU_USER_AUTH_REQUIRED_SCOPES:-im:message im:message:readonly im:resource cardkit:card:write task:task task:comment task:task:readonly task:comment:readonly task:attachment:delete task:attachment:file:download task:attachment:read task:attachment:upload task:attachment:write task:comment:delete task:comment:read task:comment:write task:comment:writeonly task:task:delete task:task:read task:task:write task:task:writeonly task:tasklist:delete task:tasklist:read task:tasklist:write task:tasklist:writeonly search:docs:read search:message base:app:copy base:app:create base:app:read base:app:update base:block:create base:block:delete base:block:read base:block:update base:dashboard:create base:dashboard:delete base:dashboard:read base:dashboard:update base:field:create base:field:delete base:field:read base:field:update base:form:create base:form:delete base:form:read base:form:update base:history:read base:record:create base:record:delete base:record:read base:record:update base:role:create base:role:delete base:role:read base:role:update base:table:create base:table:delete base:table:read base:table:update base:view:read base:view:write_only base:workflow:create base:workflow:read base:workflow:update board:whiteboard:node:create board:whiteboard:node:read calendar:calendar.event:create calendar:calendar.event:delete calendar:calendar.event:read calendar:calendar.event:reply calendar:calendar.event:update calendar:calendar.free_busy:read calendar:calendar:create calendar:calendar:delete calendar:calendar:read calendar:calendar:update contact:user.base:readonly contact:user.basic_profile:readonly contact:user:search docs:document.media:download docs:document.media:upload docs:document:export docs:document:import docx:document:create docx:document:readonly docx:document:write_only drive:drive.metadata:readonly drive:file:download drive:file:upload im:chat.managers:write_only im:chat.members:read im:chat.members:write_only im:chat.moderation:read im:chat.nickname:read im:chat.nickname:write im:chat.user_setting:read im:chat.user_setting:write im:chat:read im:chat:update im:chat:create_by_user im:chat:moderation:write_only im:feed.flag:read im:feed.flag:write im:feed.shortcut:read im:feed.shortcut:write im:feed_group_v1:read im:feed_group_v1:write im:message.group_msg:get_as_user im:message.p2p_msg:get_as_user im:message.pins:read im:message.pins:write_only im:message.reactions:read im:message.reactions:write_only im:message:recall mail:event mail:user_mailbox.event.mail_address:read mail:user_mailbox.mail_contact:read mail:user_mailbox.message.address:read mail:user_mailbox.message.body:read mail:user_mailbox.message.subject:read mindnote:node:create mindnote:node:read minutes:minutes.artifacts:read minutes:minutes.basic:read minutes:minutes.media:export minutes:minutes.search:read minutes:minutes.upload:write minutes:minutes:readonly minutes:minutes:update profile:user_profile:read sheets:spreadsheet.meta:read sheets:spreadsheet.meta:write_only sheets:spreadsheet:create sheets:spreadsheet:read sheets:spreadsheet:write_only slides:presentation:create slides:presentation:read slides:presentation:update slides:presentation:write_only task:custom_field:read task:custom_field:write task:section:read task:section:write vc:meeting.bot.join:write vc:meeting.meetingevent:read vc:meeting.message:write vc:meeting.search:read vc:note:read vc:record:readonly wiki:member:create wiki:member:retrieve wiki:member:update wiki:node:copy wiki:node:create wiki:node:move wiki:node:read wiki:node:retrieve wiki:space:read wiki:space:retrieve wiki:space:write_only}"
-ACP_BRIDGE_PKG="${ACP_BRIDGE_PKG:-@zengxingyuan/aamp-acp-bridge@0.1.28-dev.20}"
+FEISHU_USER_AUTH_EXCLUDES="$AAMP_FEISHU_USER_AUTH_EXCLUDES_OVERRIDE"
+FEISHU_USER_AUTH_REQUIRED_SCOPES="$AAMP_FEISHU_USER_AUTH_REQUIRED_SCOPES_OVERRIDE"
+FEISHU_USER_AUTH_REQUESTED_SCOPES="$AAMP_FEISHU_USER_AUTH_REQUESTED_SCOPES_OVERRIDE"
+FEISHU_USER_AUTH_CORE_SCOPES="${FEISHU_USER_AUTH_CORE_SCOPES:-}"
+FEISHU_USER_AUTH_OPTIONAL_SCOPES="${FEISHU_USER_AUTH_OPTIONAL_SCOPES:-}"
+FEISHU_USER_AUTH_MODE="${FEISHU_USER_AUTH_MODE:-optional}"
+FEISHU_TASK_PROFILE_DOMAINS="${FEISHU_TASK_PROFILE_DOMAINS:-task}"
+AAMP_FEISHU_AUTH_STATE_DIR="${AAMP_FEISHU_AUTH_STATE_DIR:-$HOME/.aamp/feishu-bridge/auth-capabilities}"
+AAMP_TASK_ALLOW_PACKAGE_OVERRIDES="${AAMP_TASK_ALLOW_PACKAGE_OVERRIDES:-false}"
+if [ "$AAMP_TASK_INTERNAL" = "true" ] \
+  && [ "${AAMP_TASK_PACKAGE_OVERRIDES_RESOLVED:-false}" = "true" ]; then
+  AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG="${AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG:-}"
+  AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG="${AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG:-}"
+  AAMP_TASK_REQUESTED_AIME_ACP_PKG="${AAMP_TASK_REQUESTED_AIME_ACP_PKG:-}"
+else
+  AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG="${ACP_BRIDGE_PKG:-${AAMP_TASK_ACP_BRIDGE_PKG:-}}"
+  AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG="${FEISHU_BRIDGE_PKG:-${AAMP_TASK_FEISHU_BRIDGE_PKG:-}}"
+  AAMP_TASK_REQUESTED_AIME_ACP_PKG="${AIME_ACP_PKG:-${AAMP_TASK_AIME_ACP_PKG:-}}"
+fi
+unset AAMP_TASK_PACKAGE_OVERRIDES_RESOLVED
+unset ACP_BRIDGE_PKG AAMP_TASK_ACP_BRIDGE_PKG
+unset FEISHU_BRIDGE_PKG AAMP_TASK_FEISHU_BRIDGE_PKG
+unset AIME_ACP_PKG AIME_ACP_REGISTRY AAMP_TASK_AIME_ACP_PKG
+ACP_BRIDGE_PKG="${ACP_BRIDGE_PKG:-@luckyterry/aamp-acp-bridge@0.1.29-dev.0}"
+AIME_ACP_PKG="${AIME_ACP_PKG:-@tengchengwei/aime-acp@0.1.1-dev.1}"
+AIME_ACP_REGISTRY="${AIME_ACP_REGISTRY:-https://bnpm.byted.org}"
 CLI_BRIDGE_PKG="${CLI_BRIDGE_PKG:-@zengxingyuan/aamp-cli-bridge@0.1.7-dev.14}"
-FEISHU_BRIDGE_PKG="${FEISHU_BRIDGE_PKG:-@zengxingyuan/aamp-feishu-bridge@0.1.51}"
+FEISHU_BRIDGE_PKG="${FEISHU_BRIDGE_PKG:-@iluolyx/aamp-feishu-bridge@0.1.52-dev.5}"
+AAMP_TASK_DEFAULT_ACP_BRIDGE_PKG="$ACP_BRIDGE_PKG"
+AAMP_TASK_DEFAULT_FEISHU_BRIDGE_PKG="$FEISHU_BRIDGE_PKG"
+AAMP_TASK_DEFAULT_AIME_ACP_PKG="$AIME_ACP_PKG"
 AAMP_TASK_AGENT_NAME="${AAMP_TASK_AGENT_NAME:-@larktask/aamp-feishu-task-agent}"
 AAMP_TASK_AGENT_LEGACY_NAME="${AAMP_TASK_AGENT_LEGACY_NAME:-@zengxingyuan/aamp-feishu-task-agent}"
-AAMP_TASK_AGENT_VERSION="0.1.0-dev.174"
+AAMP_TASK_AGENT_VERSION="0.1.1-dev.2"
 AAMP_TASK_AGENT_CHANNEL="${AAMP_TASK_AGENT_CHANNEL:-dev}"
 AAMP_STALE_PROCESS_CLEANUP="${AAMP_STALE_PROCESS_CLEANUP:-false}"
 AAMP_STALE_PROCESS_SECONDS="${AAMP_STALE_PROCESS_SECONDS:-86400}"
@@ -86,8 +131,12 @@ CODEM_SERVICE_START_OUTPUT=""
 CODEM_AUTO_UPDATE_DONE="false"
 CODEM_FORCE_LOGIN_DONE="false"
 CODEM_PROVIDER_RECOVERY_DONE="false"
+TRAE_CLI_BIN=""
+TRAECODE_CLI_BIN=""
 PAIRING_URL=""
 ACP_AGENT_COMMAND=""
+AGENT_PREPARE_CANCELLED="false"
+AGENT_PREPARE_CANCEL_REASON=""
 STARTED_BRIDGE_PID=""
 ONE_CLICK_RUN_ID="$(date +%s)-$$"
 BOT_RESERVED="false"
@@ -116,6 +165,13 @@ sanitize_inherited_npm_exec_env() {
   done < <(env)
 }
 
+remote_internal_helper() {
+  [ "$AAMP_TASK_INTERNAL" = "true" ] && {
+    [ "$AAMP_TASK_INTERNAL_EXECUTION_LOCATION" = "remote" ] \
+      || [ "$AGENT_EXECUTION_LOCATION" = "remote" ]
+  }
+}
+
 usage() {
   cat <<'USAGE'
 Usage:
@@ -132,7 +188,8 @@ Running the standalone one-click script without a subcommand is the same as
 "feishu-task-agent install".
 
 Options:
-  --agent codex|cursor        Use this Agent for every new binding in the command.
+  --agent codex|cursor|coco|traex|traecli|workbuddy|workbuddy_ai|aime
+                               Use this Agent for every new binding in the command.
   --aamp-host URL            AAMP service URL. Default: https://meshmail.ai
   --debug                    Enable debug mode for bridge processes
   -h, --help                 Show this help
@@ -792,6 +849,7 @@ task_agent_global_install_is_complete() {
   [ -x "$NPM_GLOBAL_PREFIX/bin/aamp-logs" ] || return 1
   [ -r "$package_dir/bootstrap/aamp-feishu-task-agent-bootstrap.sh" ] || return 1
   [ -r "$package_dir/bin/feishu-task-agent-controller.mjs" ] || return 1
+  [ -r "$package_dir/bin/traecode-readiness.mjs" ] || return 1
 }
 
 task_agent_global_install_is_current() {
@@ -816,7 +874,7 @@ ensure_task_agent_global_install_locked() {
   fi
   remove_legacy_task_agent_global_install || return 1
   agent_detail "synchronizing task-agent npm package: current=${installed_version:-missing} expected=$expected_version"
-  npm_install_global "$AAMP_TASK_AGENT_NAME@$expected_version" >>"$ONE_CLICK_LOG" 2>&1 || return 1
+  npm_install_global "$AAMP_TASK_AGENT_NAME@$expected_version" --force >>"$ONE_CLICK_LOG" 2>&1 || return 1
   task_agent_global_install_is_current "$expected_version"
 }
 
@@ -830,12 +888,16 @@ ensure_task_agent_global_install() {
 
 short_command_is_current() {
   local target="$1"
+  local source_file="${2:-}"
   local installed_name installed_version
   [ -x "$target" ] || return 1
   installed_name="$(script_file_task_agent_name "$target" || true)"
   installed_version="$(script_file_task_agent_version "$target" || true)"
   [ "$installed_name" = "$AAMP_TASK_AGENT_NAME" ] || return 1
-  [ "$installed_version" = "$AAMP_TASK_AGENT_VERSION" ]
+  [ "$installed_version" = "$AAMP_TASK_AGENT_VERSION" ] || return 1
+  if [ -n "$source_file" ] && [ -r "$source_file" ]; then
+    cmp -s "$source_file" "$target"
+  fi
 }
 
 write_task_update_cache() {
@@ -913,13 +975,13 @@ install_short_command_current() {
   local target="$1"
   local source_file="${BASH_SOURCE[0]:-}"
   local tmp="${target}.tmp.$$"
-  if short_command_is_current "$target"; then
-    agent_detail "short command already current: $target"
-    return 0
-  fi
   case "$source_file" in
     ""|/dev/fd/*|/private/dev/fd/*|/proc/*) source_file="" ;;
   esac
+  if short_command_is_current "$target" "$source_file"; then
+    agent_detail "short command already current: $target"
+    return 0
+  fi
   if [ -n "$source_file" ] && [ -f "$source_file" ] && [ -r "$source_file" ]; then
     mkdir -p "$(dirname "$target")"
     cp "$source_file" "$tmp" 2>>"$ONE_CLICK_LOG" || return 1
@@ -950,6 +1012,7 @@ ensure_selected_agent_for_start() {
     select_agent_interactively
   fi
   validate_agent_name "$AGENT"
+  ensure_agent_selection_available "$AGENT"
 }
 
 resolve_latest_task_agent_version() {
@@ -1034,12 +1097,109 @@ run_task_agent_update_command() {
   install_aamp_logs_bin "$installed_version" || agent_fail "failed to synchronize aamp-logs $installed_version"
   printf '当前版本：%s\n' "$installed_version"
 }
-npm_install_global() {
+classify_remote_npm_cache_error() {
+  node -e '
+let carry = "";
+let lineSawEnoent = false;
+let lineSawTarballData = false;
+let matched = false;
+const scan = (part, endOfLine) => {
+  const text = (carry + part).toLowerCase();
+  const sawEnoent = lineSawEnoent || text.includes("enoent");
+  const sawTarballData = lineSawTarballData || text.includes("tarball data");
+  if (text.includes("invalid response body")
+    || text.includes("_cacache")
+    || (sawEnoent && text.includes("content-v2"))
+    || (sawTarballData && text.includes("corrupted"))
+    || text.includes("tar_bad_archive")
+    || text.includes("zlib: unexpected end of file")) matched = true;
+  lineSawEnoent = sawEnoent;
+  lineSawTarballData = sawTarballData;
+  carry = text.slice(-64);
+  if (endOfLine) {
+    carry = "";
+    lineSawEnoent = false;
+    lineSawTarballData = false;
+  }
+};
+process.stdin.on("data", (chunk) => {
+  const parts = chunk.toString("latin1").split(/\r?\n/);
+  parts.forEach((part, index) => scan(part, index < parts.length - 1));
+});
+process.stdin.on("end", () => { process.exitCode = matched ? 0 : 1; });
+process.stdin.on("error", () => { process.exitCode = 2; });
+'
+}
+
+REMOTE_NPM_INSTALL_STATUS=1
+REMOTE_NPM_CACHE_ERROR=false
+run_remote_npm_install_attempt() {
+  local registry="$1"
+  shift
+  local pipeline_status=()
+  sanitize_inherited_npm_exec_env
+  set +e
+  "$NPM_BIN" install -g \
+    --registry "$registry" \
+    --cache "$NPM_CACHE_DIR" \
+    --prefix "$NPM_GLOBAL_PREFIX" \
+    "$@" 2>&1 | classify_remote_npm_cache_error
+  pipeline_status=("${PIPESTATUS[@]}")
+  set -e
+  REMOTE_NPM_INSTALL_STATUS="${pipeline_status[0]:-1}"
+  REMOTE_NPM_CACHE_ERROR=false
+  if [ "${pipeline_status[1]:-2}" -eq 0 ]; then
+    REMOTE_NPM_CACHE_ERROR=true
+  fi
+  return 0
+}
+
+npm_install_global_from_registry_remote() {
+  local registry="$1"
+  shift
+  finish_remote_npm_install() {
+    trap - EXIT HUP INT TERM
+    unset -f finish_remote_npm_install
+  }
+  trap finish_remote_npm_install EXIT
+  trap 'exit 129' HUP
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  run_remote_npm_install_attempt "$registry" "$@"
+  if [ "$REMOTE_NPM_INSTALL_STATUS" -eq 0 ]; then
+    hash -r 2>/dev/null || true
+    finish_remote_npm_install
+    return 0
+  fi
+
+  if [ "$REMOTE_NPM_CACHE_ERROR" != "true" ]; then
+    finish_remote_npm_install
+    return 1
+  fi
+
+  reset_npm_cache_for_retry
+  run_remote_npm_install_attempt "$registry" "$@"
+  if [ "$REMOTE_NPM_INSTALL_STATUS" -ne 0 ]; then
+    finish_remote_npm_install
+    return 1
+  fi
+  hash -r 2>/dev/null || true
+  finish_remote_npm_install
+}
+
+npm_install_global_from_registry() {
+  if remote_internal_helper; then
+    npm_install_global_from_registry_remote "$@"
+    return $?
+  fi
+
+  local registry="$1"
+  shift
   local npm_log
   npm_log="$(mktemp "${TMPDIR:-/tmp}/aamp-npm-install.XXXXXX")"
   sanitize_inherited_npm_exec_env
   if "$NPM_BIN" install -g \
-    --registry "$NPM_REGISTRY" \
+    --registry "$registry" \
     --cache "$NPM_CACHE_DIR" \
     --prefix "$NPM_GLOBAL_PREFIX" \
     "$@" >"$npm_log" 2>&1; then
@@ -1057,7 +1217,7 @@ npm_install_global() {
   npm_log="$(mktemp "${TMPDIR:-/tmp}/aamp-npm-install-retry.XXXXXX")"
   sanitize_inherited_npm_exec_env
   "$NPM_BIN" install -g \
-    --registry "$NPM_REGISTRY" \
+    --registry "$registry" \
     --cache "$NPM_CACHE_DIR" \
     --prefix "$NPM_GLOBAL_PREFIX" \
     "$@" >"$npm_log" 2>&1 || {
@@ -1068,6 +1228,10 @@ npm_install_global() {
   hash -r 2>/dev/null || true
 }
 
+npm_install_global() {
+  npm_install_global_from_registry "$NPM_REGISTRY" "$@"
+}
+
 npx_package() {
   local npm_log
   local status
@@ -1177,13 +1341,32 @@ npm_install_register_helper() {
     }
 }
 
+aime_internal_network_reachable() {
+  command -v ping >/dev/null 2>&1 || return 1
+  if is_macos; then
+    ping -c 1 -W 1000 aime.bytedance.net >/dev/null 2>&1
+  else
+    ping -c 1 -W 1 aime.bytedance.net >/dev/null 2>&1
+  fi
+}
+
 validate_agent_name() {
   case "$1" in
-    codex|cursor) ;;
-    *) agent_fail "--agent must be codex or cursor" ;;
+    codex|cursor|coco|traex|traecli|workbuddy|workbuddy_ai|aime) ;;
+    *) agent_fail "--agent must be codex, cursor, coco, traex, traecli, workbuddy, workbuddy_ai, or aime" ;;
   esac
 }
 
+ensure_agent_selection_available() {
+  [ "$1" = "aime" ] || return 0
+  aime_internal_network_reachable \
+    || agent_fail "AIME 仅在公司内网可用；当前无法 ping 通 aime.bytedance.net。"
+}
+
+agent_display_name() {
+  printf '%s' "$1"
+}
+
 read_tty_line() {
   local prompt="$1"
   local value
@@ -1203,6 +1386,24 @@ agent_cli_detected() {
     cursor)
       find_cursor_agent_cli >/dev/null 2>&1
       ;;
+    traex)
+      find_traex_cli >/dev/null 2>&1
+      ;;
+    coco)
+      find_legacy_trae_cli >/dev/null 2>&1
+      ;;
+    traecli)
+      find_traecode_cli >/dev/null 2>&1
+      ;;
+    workbuddy)
+      find_workbuddy_cli >/dev/null 2>&1
+      ;;
+    workbuddy_ai)
+      find_workbuddy_ai_cli >/dev/null 2>&1
+      ;;
+    aime)
+      aime_internal_network_reachable
+      ;;
     *)
       return 1
       ;;
@@ -1217,9 +1418,25 @@ discover_interactive_agents() {
   if agent_cli_detected cursor; then
     DETECTED_AGENTS+=("cursor")
   fi
+  if agent_cli_detected traex; then
+    DETECTED_AGENTS+=("traex")
+  elif agent_cli_detected coco; then
+    DETECTED_AGENTS+=("coco")
+  elif agent_cli_detected traecli; then
+    DETECTED_AGENTS+=("traecli")
+  fi
+  if agent_cli_detected workbuddy; then
+    DETECTED_AGENTS+=("workbuddy")
+  fi
+  if agent_cli_detected workbuddy_ai; then
+    DETECTED_AGENTS+=("workbuddy_ai")
+  fi
+  if agent_cli_detected aime; then
+    DETECTED_AGENTS+=("aime")
+  fi
 
   if [ "${#DETECTED_AGENTS[@]}" -eq 0 ]; then
-    agent_fail "暂未检测到本地智能体。请先安装并登录 Codex 或 Cursor CLI 后重试。"
+    agent_fail "暂未检测到本地智能体。请先安装 Codex、Cursor、Trae CLI、WorkBuddy 或 WorkBuddy AI 后重试。"
   fi
 }
 
@@ -1238,9 +1455,9 @@ render_agent_menu() {
   for index in "${!DETECTED_AGENTS[@]}"; do
     printf '\033[2K\r' >&3
     if [ "$index" -eq "$selected" ]; then
-      printf '  > %s\n' "${DETECTED_AGENTS[$index]}" >&3
+      printf '  > %s\n' "$(agent_display_name "${DETECTED_AGENTS[$index]}")" >&3
     else
-      printf '    %s\n' "${DETECTED_AGENTS[$index]}" >&3
+      printf '    %s\n' "$(agent_display_name "${DETECTED_AGENTS[$index]}")" >&3
     fi
   done
   printf '\033[2K\r使用 ↑/↓ 选择，回车确认。也可按数字键或 j/k。\n' >&3
@@ -1254,7 +1471,7 @@ select_agent_interactively() {
   discover_interactive_agents
 
   if ! exec 3<>/dev/tty; then
-    agent_fail "missing --agent and no interactive terminal is available; pass --agent codex|cursor"
+    agent_fail "missing --agent and no interactive terminal is available; pass --agent codex|cursor|coco|traex|traecli|workbuddy|workbuddy_ai|aime"
   fi
 
   tty_state="$(stty -g <&3)"
@@ -1440,7 +1657,7 @@ parse_args() {
   fi
 
   case "${1:-}" in
-    install|start|list|add|remove|update|help|__discover-agents|__register-binding|__prepare-agent|__ensure-profile)
+    install|start|list|add|remove|update|help|__discover-agents|__register-binding|__prepare-agent|__probe-profile|__ensure-profile)
       AAMP_TASK_ACTION="$1"
       shift
       ;;
@@ -1795,7 +2012,7 @@ save_bot_config() {
   local profile="$3"
   local app_secret="${4:-}"
   mkdir -p "$(dirname "$BOT_CONFIG_FILE")"
-  BOT_CONFIG_FILE="$BOT_CONFIG_FILE" BOT_NAME="$bot_name" BOT_APP_ID="$app_id" BOT_PROFILE="$profile" BOT_APP_SECRET="$app_secret" FEISHU_USER_AUTH_DOMAINS="$FEISHU_USER_AUTH_DOMAINS" node -e '
+  BOT_CONFIG_FILE="$BOT_CONFIG_FILE" BOT_NAME="$bot_name" BOT_APP_ID="$app_id" BOT_PROFILE="$profile" BOT_APP_SECRET="$app_secret" FEISHU_TASK_PROFILE_DOMAINS="$FEISHU_TASK_PROFILE_DOMAINS" FEISHU_SCOPE_MANIFEST_VERSION="$FEISHU_SCOPE_MANIFEST_VERSION" FEISHU_USER_AUTH_MODE="$FEISHU_USER_AUTH_MODE" node -e '
 const fs = require("fs");
 const file = process.env.BOT_CONFIG_FILE;
 const appSecret = String(process.env.BOT_APP_SECRET || "").trim();
@@ -1806,7 +2023,9 @@ const next = {
   profile: process.env.BOT_PROFILE,
   auth_mode: "lark-cli",
   capabilities: ["im", "task"],
-  domains: String(process.env.FEISHU_USER_AUTH_DOMAINS || "").split(",").map((item) => item.trim()).filter(Boolean),
+  domains: String(process.env.FEISHU_TASK_PROFILE_DOMAINS || "task").split(",").map((item) => item.trim()).filter(Boolean),
+  scope_manifest_version: Number(process.env.FEISHU_SCOPE_MANIFEST_VERSION || 0),
+  user_auth_mode: process.env.FEISHU_USER_AUTH_MODE || "optional",
   updated_at: new Date().toISOString(),
 };
 let parsed = { version: 1, profiles: [] };
@@ -2039,15 +2258,65 @@ ensure_lark_cli_min_version() {
   select_lark_cli_bin
 }
 
+feishu_scope_manifest_json() {
+  cat <<'JSON'
+{"version":2,"app":{"tenant":["im:message","im:message:send_as_bot","im:message:readonly","im:resource","cardkit:card:write","task:task","task:comment","task:task:readonly","task:comment:readonly","task:attachment:read","task:attachment:write","task:comment:read","task:comment:write","task:task:read","task:task:write","task:tasklist:read","task:tasklist:write","task:custom_field:read","task:custom_field:write","task:section:read","task:section:write"],"user":["im:message","im:message:readonly","im:resource","cardkit:card:write","task:task","task:comment","task:task:readonly","task:comment:readonly","task:attachment:read","task:attachment:write","task:comment:read","task:comment:write","task:task:read","task:task:write","task:tasklist:read","task:tasklist:write","task:custom_field:read","task:custom_field:write","task:section:read","task:section:write"]},"userAuth":{"core":[],"optional":["task:task","task:comment","task:task:readonly","task:comment:readonly","task:attachment:read","task:attachment:write","task:comment:read","task:comment:write","task:task:read","task:task:write","task:tasklist:read","task:tasklist:write","task:custom_field:read","task:custom_field:write","task:section:read","task:section:write"]}}
+JSON
+}
+
+initialize_feishu_scope_manifest() {
+  local manifest_values=()
+  local value
+
+  while IFS= read -r value; do
+    manifest_values+=("$value")
+  done < <(feishu_scope_manifest_json | node -e '
+const fs = require("fs");
+const manifest = JSON.parse(fs.readFileSync(0, "utf8"));
+console.log(String(manifest.version));
+console.log(manifest.app.tenant.join(","));
+console.log(manifest.app.user.join(","));
+console.log(manifest.userAuth.core.join(" "));
+console.log(manifest.userAuth.optional.join(" "));
+')
+
+  [ "${#manifest_values[@]}" -eq 5 ] || agent_fail "invalid embedded Feishu scope manifest"
+  FEISHU_SCOPE_MANIFEST_VERSION="${FEISHU_SCOPE_MANIFEST_VERSION:-${manifest_values[0]}}"
+  FEISHU_APP_SCOPES_TENANT="${FEISHU_APP_SCOPES_TENANT:-${manifest_values[1]}}"
+  FEISHU_APP_SCOPES_USER="${FEISHU_APP_SCOPES_USER:-${manifest_values[2]}}"
+  FEISHU_USER_AUTH_CORE_SCOPES="${FEISHU_USER_AUTH_CORE_SCOPES:-${manifest_values[3]}}"
+  FEISHU_USER_AUTH_OPTIONAL_SCOPES="${FEISHU_USER_AUTH_OPTIONAL_SCOPES:-${manifest_values[4]}}"
+  if [ -n "${FEISHU_USER_AUTH_REQUIRED_SCOPES:-}" ]; then
+    FEISHU_USER_AUTH_CORE_SCOPES="$FEISHU_USER_AUTH_REQUIRED_SCOPES"
+  else
+    FEISHU_USER_AUTH_REQUIRED_SCOPES="$FEISHU_USER_AUTH_CORE_SCOPES"
+  fi
+  if [ -z "${FEISHU_USER_AUTH_REQUESTED_SCOPES:-}" ]; then
+    if [ -n "${AAMP_FEISHU_USER_AUTH_REQUIRED_SCOPES_OVERRIDE:-}" ]; then
+      FEISHU_USER_AUTH_REQUESTED_SCOPES="$FEISHU_USER_AUTH_REQUIRED_SCOPES"
+    else
+      FEISHU_USER_AUTH_REQUESTED_SCOPES="${FEISHU_USER_AUTH_CORE_SCOPES} ${FEISHU_USER_AUTH_OPTIONAL_SCOPES}"
+    fi
+  fi
+  export FEISHU_SCOPE_MANIFEST_VERSION
+  export FEISHU_APP_SCOPES_TENANT FEISHU_APP_SCOPES_USER
+  export FEISHU_USER_AUTH_CORE_SCOPES FEISHU_USER_AUTH_OPTIONAL_SCOPES
+  export FEISHU_USER_AUTH_REQUIRED_SCOPES FEISHU_USER_AUTH_REQUESTED_SCOPES
+}
+
 lark_cli_user_auth_satisfied() {
   local profile="$1"
+  local required_scopes="${2:-${FEISHU_USER_AUTH_REQUIRED_SCOPES:-${FEISHU_USER_AUTH_CORE_SCOPES:-}}}"
   local status_json auth_check
   LARK_CLI_CMD="${LARK_CLI_CMD:-lark-cli}"
 
+  if [ -z "${required_scopes//[[:space:],]/}" ]; then
+    return 0
+  fi
   status_json="$("$LARK_CLI_CMD" --profile "$profile" auth status --json 2>/dev/null)" || return 1
 
   set +e
-  auth_check="$(AUTH_STATUS_JSON="$status_json" FEISHU_USER_AUTH_REQUIRED_SCOPES="$FEISHU_USER_AUTH_REQUIRED_SCOPES" FEISHU_USER_AUTH_EXCLUDES="$FEISHU_USER_AUTH_EXCLUDES" node -e '
+  auth_check="$(AUTH_STATUS_JSON="$status_json" FEISHU_USER_AUTH_REQUIRED_SCOPES="$required_scopes" FEISHU_USER_AUTH_EXCLUDES="$FEISHU_USER_AUTH_EXCLUDES" node -e '
 function parseJsonOutput(value, label) {
   const raw = String(value || "");
   const start = raw.indexOf("{");
@@ -2088,10 +2357,76 @@ console.log("ok");
   return 1
 }
 
+write_lark_cli_auth_capability_snapshot() {
+  local profile="$1"
+  local status_json="{}"
+  local state_dir="$AAMP_FEISHU_AUTH_STATE_DIR"
+  local safe_profile state_file temp_file
+
+  set +e
+  status_json="$("$LARK_CLI_CMD" --profile "$profile" auth status --json 2>/dev/null)"
+  local status_code=$?
+  set -e
+  if [ "$status_code" -ne 0 ] || [ -z "$status_json" ]; then
+    status_json="{}"
+  fi
+
+  mkdir -p "$state_dir" || return 1
+  safe_profile="$(PROFILE="$profile" node -e 'process.stdout.write(String(process.env.PROFILE || "profile").replace(/[^A-Za-z0-9._-]/g, "_"))')" || return 1
+  state_file="$state_dir/$safe_profile.json"
+  temp_file="$(mktemp "$state_dir/.auth-capabilities.XXXXXX")" || return 1
+  if ! AUTH_STATUS_JSON="$status_json" \
+    AUTH_PROFILE="$profile" \
+    FEISHU_SCOPE_MANIFEST_VERSION="$FEISHU_SCOPE_MANIFEST_VERSION" \
+    FEISHU_USER_AUTH_CORE_SCOPES="$FEISHU_USER_AUTH_CORE_SCOPES" \
+    FEISHU_USER_AUTH_OPTIONAL_SCOPES="$FEISHU_USER_AUTH_OPTIONAL_SCOPES" \
+    node -e '
+const raw = String(process.env.AUTH_STATUS_JSON || "{}");
+const start = raw.indexOf("{");
+let status = {};
+try { status = JSON.parse(start >= 0 ? raw.slice(start) : "{}"); } catch {}
+const user = status?.identities?.user;
+const usable = Boolean(user?.available) && new Set(["valid", "needs_refresh"]).has(user?.tokenStatus);
+const split = (value) => [...new Set(String(value || "").split(/[\s,]+/).map((item) => item.trim()).filter(Boolean))];
+const granted = new Set(split(user?.scope));
+const core = split(process.env.FEISHU_USER_AUTH_CORE_SCOPES);
+const optional = split(process.env.FEISHU_USER_AUTH_OPTIONAL_SCOPES);
+const missingCoreScopes = core.filter((scope) => !granted.has(scope));
+const missingOptionalScopes = optional.filter((scope) => !granted.has(scope));
+process.stdout.write(JSON.stringify({
+  schemaVersion: 1,
+  manifestVersion: Number(process.env.FEISHU_SCOPE_MANIFEST_VERSION || 0),
+  profile: process.env.AUTH_PROFILE,
+  tokenStatus: user?.tokenStatus || "missing",
+  grantedScopes: [...granted],
+  missingCoreScopes,
+  missingOptionalScopes,
+  capabilities: { task_user: usable && missingOptionalScopes.length === 0 },
+  checkedAt: new Date().toISOString(),
+}, null, 2));
+' >"$temp_file"; then
+    rm -f "$temp_file"
+    return 1
+  fi
+  if ! mv "$temp_file" "$state_file"; then
+    rm -f "$temp_file"
+    return 1
+  fi
+  chmod 600 "$state_file" 2>/dev/null || true
+}
+
+persist_lark_cli_auth_capability_snapshot() {
+  local profile="$1"
+  if ! write_lark_cli_auth_capability_snapshot "$profile"; then
+    agent_log "warning: unable to persist optional user capability snapshot for profile: $profile"
+  fi
+}
+
 normalize_lark_cli_auth_excludes() {
-  EXCLUDES="$1" node -e '
+  EXCLUDES="$1" REQUESTED_SCOPES="${2:-${FEISHU_USER_AUTH_REQUESTED_SCOPES:-}}" node -e '
 const excludes = String(process.env.EXCLUDES || "").split(",").map((item) => item.trim()).filter(Boolean);
-console.log([...new Set(excludes)].join(","));
+const requested = new Set(String(process.env.REQUESTED_SCOPES || "").split(/[\s,]+/).map((item) => item.trim()).filter(Boolean));
+console.log([...new Set(excludes)].filter((scope) => requested.has(scope)).join(","));
 '
 }
 
@@ -2238,12 +2573,14 @@ run_lark_cli_auth_login_with_browser_open() {
 run_lark_cli_auth_login() {
   local profile="$1"
   local auth_excludes="$2"
+  local requested_scopes="${FEISHU_USER_AUTH_REQUESTED_SCOPES:-}"
 
-  auth_excludes="$(normalize_lark_cli_auth_excludes "$auth_excludes")"
+  [ -n "${requested_scopes//[[:space:],]/}" ] || return 0
+  auth_excludes="$(normalize_lark_cli_auth_excludes "$auth_excludes" "$requested_scopes")"
   if [ -z "$auth_excludes" ]; then
-    run_lark_cli_auth_login_with_browser_open "$LARK_CLI_CMD" --profile "$profile" auth login --domain "$FEISHU_USER_AUTH_DOMAINS" --scope "$FEISHU_USER_AUTH_REQUIRED_SCOPES"
+    run_lark_cli_auth_login_with_browser_open "$LARK_CLI_CMD" --profile "$profile" auth login --scope "$requested_scopes"
   else
-    run_lark_cli_auth_login_with_browser_open "$LARK_CLI_CMD" --profile "$profile" auth login --domain "$FEISHU_USER_AUTH_DOMAINS" --scope "$FEISHU_USER_AUTH_REQUIRED_SCOPES" --exclude "$auth_excludes"
+    run_lark_cli_auth_login_with_browser_open "$LARK_CLI_CMD" --profile "$profile" auth login --scope "$requested_scopes" --exclude "$auth_excludes"
   fi
 }
 
@@ -2252,11 +2589,43 @@ ensure_lark_cli_profile() {
   with_lark_cli_config_lock ensure_lark_cli_profile_locked "$@"
 }
 
+validate_feishu_user_auth_mode() {
+  case "$FEISHU_USER_AUTH_MODE" in
+    optional|required|disabled) ;;
+    *) agent_fail "FEISHU_USER_AUTH_MODE must be optional, required, or disabled" ;;
+  esac
+}
+
+probe_lark_cli_profile_locked() {
+  local profile="$1"
+  local required_scopes
+
+  initialize_feishu_scope_manifest
+  validate_feishu_user_auth_mode
+  "$LARK_CLI_CMD" profile list 2>/dev/null | grep -F "\"$profile\"" >/dev/null 2>&1 \
+    || return 1
+  if [ "$FEISHU_USER_AUTH_MODE" = "disabled" ]; then
+    persist_lark_cli_auth_capability_snapshot "$profile"
+    return 0
+  fi
+  if [ "$FEISHU_USER_AUTH_MODE" = "required" ]; then
+    required_scopes="$FEISHU_USER_AUTH_REQUESTED_SCOPES"
+  else
+    required_scopes="$FEISHU_USER_AUTH_CORE_SCOPES"
+  fi
+  lark_cli_user_auth_satisfied "$profile" "$required_scopes" || return 1
+  persist_lark_cli_auth_capability_snapshot "$profile"
+}
+
 ensure_lark_cli_profile_locked() {
   local app_id="$1"
   local app_secret="$2"
   local profile="$3"
   local auth_excludes
+  local required_scopes
+
+  initialize_feishu_scope_manifest
+  validate_feishu_user_auth_mode
 
   if "$LARK_CLI_CMD" profile list 2>/dev/null | grep -F "\"$profile\"" >/dev/null 2>&1; then
     agent_detail "lark-cli profile already exists: $profile"
@@ -2269,13 +2638,38 @@ ensure_lark_cli_profile_locked() {
       --app-secret-stdin
   fi
 
-  agent_detail "ensuring lark-cli user auth domains for profile: $profile"
+  if [ "$FEISHU_USER_AUTH_MODE" = "disabled" ]; then
+    persist_lark_cli_auth_capability_snapshot "$profile"
+    agent_log "Task bridge ready; optional user capabilities disabled for profile: $profile"
+    return 0
+  fi
+
   auth_excludes="$FEISHU_USER_AUTH_EXCLUDES"
-  if lark_cli_user_auth_satisfied "$profile"; then
-    agent_detail "lark-cli user auth already has required scopes for profile: $profile"
-  else
+  if [ "$FEISHU_USER_AUTH_MODE" = "required" ]; then
+    required_scopes="$FEISHU_USER_AUTH_REQUESTED_SCOPES"
+    agent_detail "ensuring explicit lark-cli user auth scopes for profile: $profile"
+    if ! lark_cli_user_auth_satisfied "$profile" "$required_scopes"; then
+      run_lark_cli_auth_login "$profile" "$auth_excludes"
+      lark_cli_user_auth_satisfied "$profile" "$required_scopes" \
+        || agent_fail "lark-cli user authorization did not grant the required explicit scopes"
+    fi
+    persist_lark_cli_auth_capability_snapshot "$profile"
+    agent_detail "lark-cli user auth has the requested scopes for profile: $profile"
+    return 0
+  fi
+
+  if ! lark_cli_user_auth_satisfied "$profile" "$FEISHU_USER_AUTH_CORE_SCOPES"; then
+    agent_detail "ensuring explicitly configured lark-cli core scopes for profile: $profile"
     run_lark_cli_auth_login "$profile" "$auth_excludes"
+    lark_cli_user_auth_satisfied "$profile" "$FEISHU_USER_AUTH_CORE_SCOPES" \
+      || agent_fail "lark-cli user authorization did not grant the configured core scopes"
   fi
+  if lark_cli_user_auth_satisfied "$profile" "$FEISHU_USER_AUTH_OPTIONAL_SCOPES"; then
+    agent_detail "lark-cli optional user capabilities are available for profile: $profile"
+  else
+    agent_log "Task bridge ready; optional user capabilities unavailable for profile: $profile"
+  fi
+  persist_lark_cli_auth_capability_snapshot "$profile"
 }
 
 forget_current_bot_after_feishu_start_failure() {
@@ -2376,6 +2770,8 @@ register_feishu_app() {
   local default_name
   local bot_name
 
+  initialize_feishu_scope_manifest
+
   workdir="$(mktemp -d "${TMPDIR:-/tmp}/aamp-register-feishu-app.XXXXXX")"
   register_script="$workdir/register-app.mjs"
   if [ -n "$AAMP_RUN_LOG_DIR" ]; then
@@ -2523,8 +2919,13 @@ NODE
 
   bot_name="${bot_name:-$default_name}"
   BOT_NAME="$bot_name"
-  LARK_CLI_PROFILE="$(task_profile_name_for_app_id "$APP_ID")"
-  ensure_lark_cli_profile "$APP_ID" "$APP_SECRET" "$LARK_CLI_PROFILE"
+  if [ "$AGENT_EXECUTION_LOCATION" = "remote" ]; then
+    LARK_CLI_PROFILE=""
+  else
+    LARK_CLI_PROFILE="$(task_profile_name_for_app_id "$APP_ID")"
+    source_lark_env
+    ensure_lark_cli_profile "$APP_ID" "$APP_SECRET" "$LARK_CLI_PROFILE"
+  fi
   if [ "$AAMP_TASK_INTERNAL" = "true" ]; then
     agent_detail "Feishu Bot 已授权：$BOT_NAME ($APP_ID)"
     return 0
@@ -2678,6 +3079,338 @@ find_cursor_agent_cli() {
   return 1
 }
 
+resolve_trae_cli_candidate() {
+  local candidate
+  candidate="$1"
+  [ -n "$candidate" ] || return 1
+  if command -v "$candidate" >/dev/null 2>&1; then
+    command -v "$candidate"
+    return 0
+  fi
+  if [ -x "$candidate" ]; then
+    printf '%s\n' "$candidate"
+    return 0
+  fi
+  return 1
+}
+
+find_traex_cli_candidates() {
+  local candidate resolved emitted=""
+  local candidates=()
+  if [ -n "$TRAE_CLI_BIN" ] && [ "$(basename "$TRAE_CLI_BIN")" = "traex" ]; then candidates+=("$TRAE_CLI_BIN"); fi
+  if [ -n "$AAMP_TRAE_CLI_BIN" ] && [ "$(basename "$AAMP_TRAE_CLI_BIN")" = "traex" ]; then candidates+=("$AAMP_TRAE_CLI_BIN"); fi
+  candidates+=("traex")
+
+  for candidate in "${candidates[@]}"; do
+    resolved="$(resolve_trae_cli_candidate "$candidate" || true)"
+    [ -n "$resolved" ] || continue
+    case "$emitted" in
+      *"|$resolved|"*) continue ;;
+    esac
+    emitted="${emitted}|$resolved|"
+    printf '%s\n' "$resolved"
+  done
+}
+
+find_coco_cli_candidates() {
+  local candidate resolved emitted=""
+  local candidates=()
+  if [ -n "$TRAE_CLI_BIN" ] && [ "$(basename "$TRAE_CLI_BIN")" = "coco" ]; then candidates+=("$TRAE_CLI_BIN"); fi
+  if [ -n "$AAMP_TRAE_CLI_BIN" ] && [ "$(basename "$AAMP_TRAE_CLI_BIN")" = "coco" ]; then candidates+=("$AAMP_TRAE_CLI_BIN"); fi
+  candidates+=("coco")
+  for candidate in "${candidates[@]}"; do
+    resolved="$(resolve_trae_cli_candidate "$candidate" || true)"
+    [ -n "$resolved" ] || continue
+    case "$emitted" in *"|$resolved|"*) continue ;; esac
+    emitted="${emitted}|$resolved|"
+    printf '%s\n' "$resolved"
+  done
+}
+
+find_traecode_cli_candidates() {
+  local candidate resolved emitted=""
+  local candidates=()
+  [ -n "$TRAECODE_CLI_BIN" ] && candidates+=("$TRAECODE_CLI_BIN")
+  [ -n "$AAMP_TRAECODE_CLI_BIN" ] && candidates+=("$AAMP_TRAECODE_CLI_BIN")
+  candidates+=("traecli")
+  for candidate in "${candidates[@]}"; do
+    resolved="$(resolve_trae_cli_candidate "$candidate" || true)"
+    [ -n "$resolved" ] || continue
+    case "$emitted" in *"|$resolved|"*) continue ;; esac
+    emitted="${emitted}|$resolved|"
+    printf '%s\n' "$resolved"
+  done
+}
+
+real_executable_path() {
+  node -e 'const fs=require("fs"); try { process.stdout.write(fs.realpathSync(process.argv[1])); } catch { process.exit(1); }' "$1" 2>/dev/null
+}
+
+find_traex_cli() {
+  local candidate
+  candidate="$(find_traex_cli_candidates | head -n 1)"
+  if [ -n "$candidate" ]; then
+    TRAE_CLI_BIN="$candidate"
+    printf '%s\n' "$candidate"
+    return 0
+  fi
+  return 1
+}
+
+find_coco_cli() {
+  local candidate
+  candidate="$(find_coco_cli_candidates | head -n 1)"
+  [ -n "$candidate" ] || return 1
+  TRAE_CLI_BIN="$candidate"
+  printf '%s\n' "$candidate"
+}
+
+traecode_cli_conflicts_with_coco() {
+  local traecli_bin="$1" coco_bin traecli_real coco_real
+  coco_bin="$(find_coco_cli || true)"
+  [ -n "$coco_bin" ] || return 1
+  traecli_real="$(real_executable_path "$traecli_bin" || true)"
+  coco_real="$(real_executable_path "$coco_bin" || true)"
+  [ -n "$traecli_real" ] && [ "$traecli_real" = "$coco_real" ]
+}
+
+find_traecode_cli() {
+  local candidate explicit_candidate="" conflict_found="false"
+  if [ -n "$TRAECODE_CLI_BIN" ]; then explicit_candidate="$TRAECODE_CLI_BIN"; fi
+  if [ -n "$AAMP_TRAECODE_CLI_BIN" ]; then explicit_candidate="$AAMP_TRAECODE_CLI_BIN"; fi
+  if [ -n "$explicit_candidate" ]; then
+    case "$(basename "$explicit_candidate")" in coco|traex) return 2 ;; esac
+    candidate="$(resolve_trae_cli_candidate "$explicit_candidate" || true)"
+    [ -n "$candidate" ] || return 1
+    if traecode_cli_conflicts_with_coco "$candidate"; then return 2; fi
+    TRAECODE_CLI_BIN="$candidate"
+    printf '%s\n' "$candidate"
+    return 0
+  fi
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    if traecode_cli_conflicts_with_coco "$candidate"; then
+      if [ -n "$explicit_candidate" ] && [ "$candidate" = "$explicit_candidate" ]; then return 2; fi
+      conflict_found="true"
+      continue
+    fi
+    TRAECODE_CLI_BIN="$candidate"
+    printf '%s\n' "$candidate"
+    return 0
+  done < <(find_traecode_cli_candidates)
+  [ "$conflict_found" != "true" ] || return 2
+  return 1
+}
+
+find_legacy_trae_cli() {
+  find_coco_cli
+}
+
+resolve_trae_cli() {
+  case "${AGENT:-}" in
+    traex) find_traex_cli ;;
+    coco) find_coco_cli ;;
+    traecli) find_traecode_cli ;;
+    *) return 1 ;;
+  esac
+}
+
+find_workbuddy_cli() {
+  is_macos || return 1
+  [ -x "$WORKBUDDY_APP_CLI" ] || return 1
+  printf '%s\n' "$WORKBUDDY_APP_CLI"
+}
+
+find_workbuddy_ai_cli() {
+  is_macos || return 1
+  [ -x "$WORKBUDDY_AI_APP_CLI" ] || return 1
+  printf '%s\n' "$WORKBUDDY_AI_APP_CLI"
+}
+
+aime_acp_package_spec() {
+  local default_spec registry spec
+  spec="${AIME_ACP_PKG:-}"
+  default_spec="$(aime_acp_default_package_spec)"
+  registry="${AIME_ACP_REGISTRY:-https://bnpm.byted.org}"
+  case "$spec" in
+    @*/aime-acp@?*)
+      if [ "${registry%/}" = 'https://bnpm.byted.org' ]; then
+        printf '%s\n' "$spec"
+      else
+        printf '%s\n' "$default_spec"
+      fi
+      ;;
+    *.tgz)
+      if [ -f "$spec" ]; then
+        printf '%s\n' "$spec"
+      else
+        printf '%s\n' "$default_spec"
+      fi
+      ;;
+    *) printf '%s\n' "$default_spec" ;;
+  esac
+}
+
+aime_acp_default_package_spec() {
+  printf '%s\n' "${AAMP_TASK_DEFAULT_AIME_ACP_PKG:-@tengchengwei/aime-acp@0.1.1-dev.1}"
+}
+
+aime_acp_local_package_name() {
+  local spec="$1"
+  tar -xOzf "$spec" package/package.json 2>/dev/null | node -e '
+let raw = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { raw += chunk; });
+process.stdin.on("end", () => {
+  try {
+    const value = JSON.parse(raw);
+    if (typeof value.name !== "string" || !/^@[^/]+\/aime-acp$/.test(value.name)) process.exit(1);
+    process.stdout.write(value.name);
+  } catch {
+    process.exit(1);
+  }
+});
+'
+}
+
+aime_acp_package_name() {
+  local local_name spec
+  spec="$(aime_acp_package_spec)"
+  case "$spec" in
+    *.tgz)
+      local_name="$(aime_acp_local_package_name "$spec" || true)"
+      if [ -n "$local_name" ]; then
+        printf '%s\n' "$local_name"
+        return 0
+      fi
+      spec="$(aime_acp_default_package_spec)"
+      ;;
+  esac
+  case "$spec" in
+    @*/aime-acp@?*) printf '%s\n' "${spec%@*}" ;;
+    *) return 1 ;;
+  esac
+}
+
+aime_acp_package_version() {
+  local spec
+  spec="$(aime_acp_package_spec)"
+  case "$spec" in
+    *.tgz) return 1 ;;
+    *@?*) printf '%s\n' "${spec##*@}" ;;
+    *) return 1 ;;
+  esac
+}
+
+aime_acp_package_spec_is_supported() {
+  case "$(aime_acp_package_spec)" in
+    *.tgz) return 0 ;;
+    @*/aime-acp@?*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+aime_acp_registry() {
+  printf '%s\n' 'https://bnpm.byted.org'
+}
+
+aime_acp_site() {
+  printf '%s\n' 'cn'
+}
+
+aime_acp_cli_path() {
+  printf '%s/dist/bin.js\n' "$(aime_acp_package_dir)"
+}
+
+remove_legacy_aime_acp() {
+  local legacy_dir legacy_bin canonical_dir resolved_bin
+  legacy_dir="$NPM_GLOBAL_PREFIX/lib/node_modules/aime-acp"
+  legacy_bin="$NPM_GLOBAL_PREFIX/bin/aime-acp"
+  canonical_dir="$(aime_acp_package_dir)"
+  canonical_dir="$(node -e '
+const fs = require("node:fs");
+try { process.stdout.write(fs.realpathSync(process.argv[1])); } catch {}
+' "$canonical_dir")"
+  if [ -e "$legacy_dir" ] || [ -L "$legacy_dir" ]; then
+    rm -rf -- "$legacy_dir"
+  fi
+  if [ -e "$legacy_bin" ] || [ -L "$legacy_bin" ]; then
+    resolved_bin="$(node -e '
+const fs = require("node:fs");
+const path = require("node:path");
+try { process.stdout.write(fs.realpathSync(process.argv[1])); } catch {}
+' "$legacy_bin")"
+    if [ -n "$canonical_dir" ] && [ -n "$resolved_bin" ]; then
+      case "$resolved_bin" in
+        "$canonical_dir"/*) return 0 ;;
+      esac
+    fi
+    rm -f -- "$legacy_bin"
+  fi
+}
+
+aime_acp_package_dir() {
+  printf '%s/lib/node_modules/%s\n' "$NPM_GLOBAL_PREFIX" "$(aime_acp_package_name)"
+}
+
+aime_acp_installed_version() {
+  local package_json
+  package_json="$(aime_acp_package_dir)/package.json"
+  [ -r "$package_json" ] || return 1
+  node -e '
+const fs = require("node:fs");
+const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+if (typeof value.version !== "string") process.exit(1);
+process.stdout.write(value.version);
+' "$package_json"
+}
+
+aime_acp_installed_name() {
+  local package_json
+  package_json="$(aime_acp_package_dir)/package.json"
+  [ -r "$package_json" ] || return 1
+  node -e '
+const fs = require("node:fs");
+const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+if (typeof value.name !== "string") process.exit(1);
+process.stdout.write(value.name);
+' "$package_json"
+}
+
+aime_acp_install_is_valid() {
+  local installed_version installed_name
+  [ -x "$(aime_acp_cli_path)" ] || return 1
+  installed_name="$(aime_acp_installed_name || true)"
+  [ "$installed_name" = "$(aime_acp_package_name)" ] || return 1
+  installed_version="$(aime_acp_installed_version || true)"
+  [ -n "$installed_version" ] || return 1
+  case "$(aime_acp_package_spec)" in
+    *.tgz) return 0 ;;
+    *) [ "$installed_version" = "$(aime_acp_package_version)" ] ;;
+  esac
+}
+
+aime_acp_install_is_current() {
+  case "$(aime_acp_package_spec)" in
+    *.tgz) return 1 ;;
+    *) aime_acp_install_is_valid ;;
+  esac
+}
+
+ensure_aime_acp_cli() {
+  aime_acp_package_spec_is_supported \
+    || agent_fail "AIME_ACP_PACKAGE_INVALID: AIME ACP must use a scoped BNPM package or a local tgz."
+  remove_legacy_aime_acp
+  if aime_acp_install_is_current; then
+    return 0
+  fi
+  agent_log "正在安装固定版本 AIME ACP 到隔离运行环境。"
+  npm_install_global_from_registry "$(aime_acp_registry)" "$(aime_acp_package_spec)" \
+    || agent_fail "AIME_ACP_INSTALL_FAILED: AIME ACP installation failed. Confirm company network access and retry."
+  aime_acp_install_is_valid \
+    || agent_fail "AIME_ACP_INSTALL_INVALID: AIME ACP installation validation failed."
+}
+
 resolve_cursor_cli_for_acp() {
   command -v cursor
 }
@@ -2720,6 +3453,50 @@ ensure_agent_cli() {
     return 0
   fi
 
+  if [ "$AGENT" = "traex" ]; then
+    find_traex_cli >/dev/null 2>&1 || agent_fail "未检测到 traex CLI。请先安装 Trae CLI Next（内部版）后重新运行脚本。"
+    return 0
+  fi
+
+  if [ "$AGENT" = "traecli" ]; then
+    local traecode_status
+    set +e
+    find_traecode_cli >/dev/null 2>&1
+    traecode_status=$?
+    set -e
+    [ "$traecode_status" -ne 2 ] || agent_fail "检测到的 traecli 属于 Trae CLI（内部版），不能作为 TraeCode CLI 启动。"
+    [ "$traecode_status" -eq 0 ] || agent_fail "未检测到 TraeCode CLI。请先安装 traecli 后重新运行脚本。"
+    return 0
+  fi
+
+  if [ "$AGENT" = "coco" ]; then
+    if find_traex_cli >/dev/null 2>&1; then return 0; fi
+    if find_coco_cli >/dev/null 2>&1; then return 0; fi
+    if find_traecode_cli >/dev/null 2>&1; then return 0; fi
+    agent_fail "未检测到 Trae CLI（内部版）、Trae CLI Next（内部版）或 TraeCode CLI。"
+  fi
+
+  if [ "$AGENT" = "workbuddy" ]; then
+    is_macos || agent_fail "WorkBuddy 一键探测仅支持 macOS。"
+    find_workbuddy_cli >/dev/null 2>&1 \
+      || agent_fail "未检测到 WorkBuddy。请确认已安装到 /Applications/WorkBuddy.app 后重新运行脚本。"
+    return 0
+  fi
+
+  if [ "$AGENT" = "workbuddy_ai" ]; then
+    is_macos || agent_fail "WorkBuddy AI 一键探测仅支持 macOS。"
+    find_workbuddy_ai_cli >/dev/null 2>&1 \
+      || agent_fail "未检测到 WorkBuddy AI CLI：${WORKBUDDY_AI_APP_CLI}。请确认该文件存在且可执行后重新运行脚本。"
+    return 0
+  fi
+
+  if [ "$AGENT" = "aime" ]; then
+    aime_internal_network_reachable \
+      || agent_fail "AIME 仅在公司内网可用；当前无法 ping 通 aime.bytedance.net。"
+    ensure_aime_acp_cli
+    return 0
+  fi
+
   command -v "$AGENT" >/dev/null 2>&1 || agent_fail "未检测到 $AGENT CLI。请先安装后重新运行脚本。"
 }
 
@@ -2867,6 +3644,68 @@ resolve_latest_codex_cli_version() {
     --prefix "$NPM_GLOBAL_PREFIX" 2>>"$ONE_CLICK_LOG" | tail -n 1 | tr -d '[:space:]'
 }
 
+codex_update_cache_latest() {
+  local current_version="$1"
+  [ -n "${CODEX_UPDATE_CACHE_FILE:-}" ] || return 1
+  [ -n "$current_version" ] || return 1
+  [ -f "$CODEX_UPDATE_CACHE_FILE" ] || return 1
+  CACHE_FILE="$CODEX_UPDATE_CACHE_FILE" \
+    TTL="${CODEX_UPDATE_CACHE_TTL_SECONDS:-86400}" \
+    CURRENT_VERSION="$current_version" \
+    NPM_PACKAGE="${CODEX_NPM_PACKAGE:-@openai/codex}" \
+    NPM_REGISTRY_VALUE="${NPM_REGISTRY:-https://registry.npmjs.org/}" \
+    node -e '
+const fs = require("fs");
+let data;
+try { data = JSON.parse(fs.readFileSync(process.env.CACHE_FILE, "utf8")); } catch { process.exit(1); }
+const checkedAt = Number(data.checked_at || 0);
+const ttl = Number(process.env.TTL || 86400);
+const age = Math.floor(Date.now() / 1000) - checkedAt;
+if (data.version !== 1 || typeof data.checked_at !== "number" || !Number.isFinite(checkedAt) || checkedAt <= 0) process.exit(1);
+if (!Number.isFinite(ttl) || ttl <= 0 || age < 0 || age >= ttl) process.exit(1);
+if (typeof data.current_version !== "string" || typeof data.latest_version !== "string") process.exit(1);
+if (typeof data.package !== "string" || typeof data.registry !== "string") process.exit(1);
+if (String(data.current_version || "") !== String(process.env.CURRENT_VERSION || "")) process.exit(1);
+if (String(data.package || "") !== String(process.env.NPM_PACKAGE || "")) process.exit(1);
+if (String(data.registry || "") !== String(process.env.NPM_REGISTRY_VALUE || "")) process.exit(1);
+const latest = String(data.latest_version || "").trim();
+if (!/^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(latest)) process.exit(1);
+process.stdout.write(latest);
+' 2>>"${ONE_CLICK_LOG:-/dev/null}"
+}
+
+write_codex_update_cache() {
+  local current_version="$1"
+  local latest_version="$2"
+  [ -n "${CODEX_UPDATE_CACHE_FILE:-}" ] || return 0
+  [ -n "$current_version" ] && [ -n "$latest_version" ] || return 0
+  mkdir -p "$(dirname "$CODEX_UPDATE_CACHE_FILE")"
+  CACHE_FILE="$CODEX_UPDATE_CACHE_FILE" \
+    CURRENT_VERSION="$current_version" \
+    LATEST_VERSION="$latest_version" \
+    NPM_PACKAGE="${CODEX_NPM_PACKAGE:-@openai/codex}" \
+    NPM_REGISTRY_VALUE="${NPM_REGISTRY:-https://registry.npmjs.org/}" \
+    node -e '
+const fs = require("fs");
+const file = process.env.CACHE_FILE;
+const temporary = `${file}.tmp.${process.pid}`;
+const payload = {
+  version: 1,
+  checked_at: Math.floor(Date.now() / 1000),
+  current_version: process.env.CURRENT_VERSION || "",
+  latest_version: process.env.LATEST_VERSION || "",
+  package: process.env.NPM_PACKAGE || "",
+  registry: process.env.NPM_REGISTRY_VALUE || "",
+};
+try {
+  fs.writeFileSync(temporary, JSON.stringify(payload, null, 2) + "\n", { mode: 0o600 });
+  fs.renameSync(temporary, file);
+} finally {
+  try { fs.unlinkSync(temporary); } catch {}
+}
+' 2>>"${ONE_CLICK_LOG:-/dev/null}" || true
+}
+
 codex_cli_update_available() {
   CODEX_CURRENT_VERSION="$1" CODEX_LATEST_VERSION="$2" node -e '
 function parse(value) {
@@ -3005,7 +3844,13 @@ ensure_codex_cli_updated() {
   codex_bin="$(resolve_codex_cli_for_acp || true)"
   [ -n "$codex_bin" ] || return 0
   version_before="$(codex_cli_version_number "$codex_bin" || true)"
-  latest_version="$(resolve_latest_codex_cli_version || true)"
+  latest_version="$(codex_update_cache_latest "$version_before" || true)"
+  if [ -n "$latest_version" ]; then
+    agent_detail "Codex CLI update check cache is fresh: current=${version_before:-unknown} latest=$latest_version"
+  else
+    latest_version="$(resolve_latest_codex_cli_version || true)"
+    write_codex_update_cache "$version_before" "$latest_version"
+  fi
   version_line="当前 Codex CLI 版本是：${version_before:-未知}，最新版本是：${latest_version:-获取失败}"
   write_one_click_log "[aamp-one-click] $version_line"
   agent_detail "checking Codex CLI update: path=$codex_bin version=${version_before:-unknown}"
@@ -3016,7 +3861,6 @@ ensure_codex_cli_updated() {
     comparison_status=$?
   fi
   if [ "$comparison_status" -eq 1 ]; then
-    printf '%s\n' "$version_line"
     agent_detail "Codex CLI is already current: current=${version_before:-unknown} latest=${latest_version:-unknown}"
     return 0
   fi
@@ -3105,6 +3949,142 @@ run_codex_login() {
   return "$status"
 }
 
+run_quiet_command_with_timeout() {
+  local timeout_seconds="$1"
+  shift
+  node - "$timeout_seconds" "$@" <<'NODE'
+const { spawn } = require('node:child_process');
+
+const timeoutSeconds = Number(process.argv[2] || '10');
+const timeoutMs = Math.max(1, Number.isFinite(timeoutSeconds) ? timeoutSeconds : 10) * 1000;
+const [command, ...args] = process.argv.slice(3);
+if (!command) process.exit(127);
+
+let finished = false;
+let timedOut = false;
+const child = spawn(command, args, { stdio: ['ignore', 'ignore', 'ignore'] });
+const timer = setTimeout(() => {
+  timedOut = true;
+  child.kill('SIGTERM');
+  setTimeout(() => child.kill('SIGKILL'), 1000).unref();
+}, timeoutMs);
+
+child.once('error', (error) => {
+  if (finished) return;
+  finished = true;
+  clearTimeout(timer);
+  process.exit(error && error.code === 'ENOENT' ? 127 : 1);
+});
+
+child.once('exit', (code, signal) => {
+  if (finished) return;
+  finished = true;
+  clearTimeout(timer);
+  if (timedOut) process.exit(124);
+  if (typeof code === 'number') process.exit(code);
+  process.exit(signal ? 1 : 0);
+});
+NODE
+}
+
+run_trae_login_status_for_bin() {
+  local trae_bin="$1"
+  run_quiet_command_with_timeout "$AAMP_TRAE_LOGIN_STATUS_TIMEOUT_SECONDS" "$trae_bin" login status
+}
+
+trae_login_status_timeout_message() {
+  printf '%s' "traex login status 超时。请手动执行 'traex login status' 检查登录状态后重新运行脚本。"
+}
+
+run_traex_login_status() {
+  local trae_bin status
+  trae_bin="$(find_traex_cli || true)"
+  [ -n "$trae_bin" ] || return 127
+  TRAE_CLI_BIN="$trae_bin"
+  agent_detail "checking Trae CLI login status: $trae_bin"
+  if run_trae_login_status_for_bin "$trae_bin"; then
+    return 0
+  else
+    status=$?
+  fi
+  if [ "$status" -eq 124 ]; then
+    agent_log "Trae CLI login status timed out after ${AAMP_TRAE_LOGIN_STATUS_TIMEOUT_SECONDS}s: $trae_bin"
+  fi
+  return "$status"
+}
+
+run_traex_login() {
+  local trae_bin
+  trae_bin="$(resolve_trae_cli || true)"
+  [ -n "$trae_bin" ] || return 127
+  "$trae_bin" login
+}
+
+trae_cli_is_traex() {
+  [ -n "$TRAE_CLI_BIN" ] && [ "${TRAE_CLI_BIN##*/}" = "traex" ]
+}
+
+confirm_trae_upgrade() {
+  local answer
+  printf '\n检测到 Trae CLI（内部版），飞书任务 Agent 暂不支持使用该版本建立连接。\n' >&2
+  printf '建议升级到 Trae CLI Next（内部版）（traex）后继续。\n' >&2
+  printf '升级过程中可自行选择是否保留 Trae CLI（内部版）。\n' >&2
+  answer="$(read_tty_line "是否现在升级到 traex？[y/N] ")"
+  case "$answer" in
+    y|Y|yes|YES|Yes) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+run_traex_installer() {
+  agent_log "正在安装/升级 traex..."
+  curl -fsSL "$TRAEX_INSTALLER_URL" | sh
+}
+
+maybe_upgrade_legacy_trae_cli() {
+  if trae_cli_is_traex; then
+    AGENT="traex"
+    return 0
+  fi
+
+  if confirm_trae_upgrade; then
+    run_traex_installer || agent_fail "traex 安装失败。请手动执行：curl -fsSL $TRAEX_INSTALLER_URL | sh"
+    hash -r 2>/dev/null || true
+    TRAE_CLI_BIN=""
+    find_traex_cli >/dev/null 2>&1 || agent_fail "traex 安装后仍未检测到。请确认 traex 在 PATH 中，然后重新运行脚本。"
+    AGENT="traex"
+    agent_log "已切换为 traex，继续启动。"
+    return 0
+  fi
+
+  AGENT_PREPARE_CANCELLED="true"
+  AGENT_PREPARE_CANCEL_REASON="用户取消升级。飞书任务 Agent 暂不支持使用 Trae CLI（内部版）建立连接，本次未启动飞书任务连接。如需继续，请先安装 Trae CLI Next（内部版）：curl -fsSL $TRAEX_INSTALLER_URL | sh"
+  agent_log "已取消升级，本次未启动飞书任务连接。"
+}
+
+ensure_traex_login() {
+  local trae_login_status
+  set +e
+  run_traex_login_status
+  trae_login_status=$?
+  set -e
+  if [ "$trae_login_status" -eq 124 ]; then
+    agent_fail "$(trae_login_status_timeout_message)"
+  fi
+  if [ "$trae_login_status" -ne 0 ]; then
+    agent_log "Trae CLI Next（内部版）未登录，正在启动登录流程。"
+    run_traex_login || agent_fail "Trae CLI Next（内部版）登录失败。请先执行 'traex login' 完成登录后重新运行脚本。"
+    set +e
+    run_traex_login_status
+    trae_login_status=$?
+    set -e
+    if [ "$trae_login_status" -eq 124 ]; then
+      agent_fail "$(trae_login_status_timeout_message)"
+    fi
+    [ "$trae_login_status" -eq 0 ] || agent_fail "Trae CLI Next（内部版）仍未登录。请先执行 'traex login' 完成登录后重新运行脚本。"
+  fi
+}
+
 print_cursor_gatekeeper_help() {
   local cursor_bin
   local cursor_real
@@ -3366,6 +4346,144 @@ ensure_codem_provider_ready() {
   return "$status"
 }
 
+traecode_readiness_helper_path() {
+  if [ -n "$AAMP_TRAECODE_READINESS_HELPER" ]; then printf '%s\n' "$AAMP_TRAECODE_READINESS_HELPER"; return 0; fi
+  local helper
+  helper="$(task_agent_global_package_dir)/bin/traecode-readiness.mjs"
+  [ -r "$helper" ] || return 1
+  printf '%s\n' "$helper"
+}
+
+run_traecode_check() {
+  local action="$1" helper traecode_bin
+  helper="$(traecode_readiness_helper_path)" || return 127
+  traecode_bin="$(find_traecode_cli)" || return $?
+  node "$helper" "$action" "$traecode_bin" "$AAMP_TRAECODE_CHECK_TIMEOUT_SECONDS"
+}
+
+confirm_traecode_update() {
+  local answer tty_path
+  tty_path="${AAMP_TRAECODE_UPDATE_TTY:-/dev/tty}"
+  if ! exec 6<>"$tty_path"; then return 2; fi
+  printf '%s' '当前 TraeCode CLI 版本较旧，不支持 ACP。是否执行 `traecli update` 升级？[y/N] ' >&6
+  if ! IFS= read -r answer <&6; then exec 6>&-; return 2; fi
+  exec 6>&-
+  case "$answer" in y|Y|yes|YES|Yes) return 0 ;; *) return 1 ;; esac
+}
+
+run_traecode_update() {
+  local traecode_bin="$1"
+  [ -n "$traecode_bin" ] || return 127
+  "$traecode_bin" update
+}
+
+ensure_traecode_acp() {
+  local probe_status confirm_status update_bin
+  set +e; run_traecode_check probe-acp >/dev/null; probe_status=$?; set -e
+  [ "$probe_status" -eq 0 ] && return 0
+  [ "$probe_status" -ne 124 ] || agent_fail "TraeCode CLI ACP 能力检查超时，请稍后重试。"
+  [ "$probe_status" -eq 3 ] || agent_fail "无法检查 TraeCode CLI 的 ACP 能力。"
+
+  set +e; confirm_traecode_update; confirm_status=$?; set -e
+  if [ "$confirm_status" -eq 2 ]; then
+    agent_fail "当前 TraeCode CLI 需要升级。请在交互式终端执行 'traecli update' 后重试。"
+  fi
+  if [ "$confirm_status" -ne 0 ]; then
+    AGENT_PREPARE_CANCELLED="true"
+    AGENT_PREPARE_CANCEL_REASON="用户取消升级 TraeCode CLI，本次未启动飞书任务连接。"
+    return 0
+  fi
+
+  update_bin="$(find_traecode_cli)" || agent_fail "升级前无法重新定位 TraeCode CLI，请手动执行 'traecli update' 后重试。"
+  run_traecode_update "$update_bin" || agent_fail "TraeCode CLI 升级失败，请查看上方升级输出，或手动执行 'traecli update' 后重试。"
+  hash -r 2>/dev/null || true
+  TRAECODE_CLI_BIN=""
+  find_traecode_cli >/dev/null 2>&1 || agent_fail "升级后仍未检测到 TraeCode CLI，请检查 PATH 后重试。"
+  set +e; run_traecode_check probe-acp >/dev/null; probe_status=$?; set -e
+  [ "$probe_status" -eq 0 ] || agent_fail "TraeCode CLI 升级后仍不支持 ACP，请确认升级结果后重试。"
+}
+
+ensure_traecode_doctor() {
+  local output doctor_status
+  set +e; output="$(run_traecode_check doctor 2>&1)"; doctor_status=$?; set -e
+  case "$doctor_status" in
+    0) [ -z "$output" ] || printf 'TraeCode CLI 诊断警告：%s\n' "$output" ;;
+    10) agent_fail "TraeCode CLI 尚未准备好。请打开 TraeCode CLI，按提示完成登录，并使用 /model 选择模型后重试。" ;;
+    11) agent_fail "TraeCode CLI 诊断未通过：${output:-未知错误}" ;;
+    65) agent_fail "TraeCode CLI 诊断结果无法解析，请执行 'traecli doctor --json' 检查后重试。" ;;
+    124) agent_fail "TraeCode CLI 诊断超时，请稍后重试。" ;;
+    *) agent_fail "TraeCode CLI 诊断执行失败：${output:-请执行 'traecli doctor --json' 检查。}" ;;
+  esac
+}
+
+ensure_traecode_ready() {
+  ensure_traecode_acp
+  [ "$AGENT_PREPARE_CANCELLED" = "true" ] && return 0
+  ensure_traecode_doctor
+}
+
+run_aime_auth_status() {
+  "$(aime_acp_cli_path)" auth status --site "$(aime_acp_site)" --json
+}
+
+run_aime_auth_login() {
+  "$(aime_acp_cli_path)" auth login --site "$(aime_acp_site)"
+}
+
+run_aime_doctor() {
+  "$(aime_acp_cli_path)" doctor --site "$(aime_acp_site)" --json
+}
+
+ensure_aime_ready() {
+  local auth_output auth_status auth_kind login_status doctor_status
+  set +e
+  auth_output="$(run_aime_auth_status)"
+  auth_status=$?
+  set -e
+  auth_kind="$(printf '%s' "$auth_output" | node -e '
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { input += chunk; });
+process.stdin.on("end", () => {
+  try {
+    const value = JSON.parse(input.trim());
+    if (value?.ok === true && value?.status === "authenticated") process.stdout.write("authenticated");
+    else if (value?.ok === true && value?.status === "unauthenticated") process.stdout.write("unauthenticated");
+    else process.stdout.write("error");
+  } catch {
+    process.stdout.write("error");
+  }
+});
+')"
+  if [ "$auth_status" -eq 0 ] && [ "$auth_kind" = "authenticated" ]; then
+    agent_detail "AIME managed-user authentication is ready"
+  elif [ "$auth_status" -eq 1 ] && [ "$auth_kind" = "unauthenticated" ]; then
+    agent_log "AIME 尚未登录，正在启动独立登录流程。"
+    set +e
+    run_aime_auth_login
+    login_status=$?
+    set -e
+    case "$login_status" in
+      0) ;;
+      2)
+        agent_fail "AIME 登录仍在等待完成。请继续完成浏览器授权，或重新执行 'aime-acp auth login --site cn' 后重试。"
+        ;;
+      *)
+        agent_fail "AIME 登录失败。请执行 'aime-acp auth login --site cn' 后重试。"
+        ;;
+    esac
+  else
+    agent_fail "AIME 认证状态检查失败。请执行 'aime-acp auth status --site cn --json' 查看安全诊断。"
+  fi
+
+  set +e
+  run_aime_doctor >/dev/null
+  doctor_status=$?
+  set -e
+  [ "$doctor_status" -eq 0 ] \
+    || agent_fail "AIME doctor 未通过。请确认公司内网与账号状态，并执行 'aime-acp doctor --site cn --json' 查看安全诊断。"
+}
+
 ensure_agent_login() {
   case "$AGENT" in
     codex)
@@ -3386,6 +4504,35 @@ ensure_agent_login() {
         run_cursor_login_status || agent_fail "cursor CLI 仍未登录。请先执行 'cursor login' 或 'agent login' 完成登录后重新运行脚本。"
       fi
       ;;
+    traex)
+      ensure_traex_login
+      ;;
+    traecli)
+      ensure_traecode_ready
+      ;;
+    coco)
+      if find_traex_cli >/dev/null 2>&1; then
+        AGENT="traex"
+        ensure_traex_login
+      elif find_coco_cli >/dev/null 2>&1; then
+        maybe_upgrade_legacy_trae_cli
+        if [ "$AGENT" = "traex" ]; then ensure_traex_login; fi
+      elif find_traecode_cli >/dev/null 2>&1; then
+        AGENT="traecli"
+        ensure_traecode_ready
+      else
+        agent_fail "未检测到 Trae CLI（内部版）、Trae CLI Next（内部版）或 TraeCode CLI。"
+      fi
+      ;;
+    workbuddy)
+      agent_detail "WorkBuddy authentication is managed by the desktop app"
+      ;;
+    workbuddy_ai)
+      agent_detail "WorkBuddy AI authentication is managed by the desktop app"
+      ;;
+    aime)
+      ensure_aime_ready
+      ;;
     codem)
       ensure_codem_local_bin_on_path
       codem --version >/dev/null
@@ -3467,8 +4614,69 @@ resolve_codex_cli_for_acp() {
   return 1
 }
 
+acp_command_word() {
+  local value="$1" single_quote_escape
+  case "$value" in *$'\n'*|*$'\r'*) return 1 ;; esac
+  single_quote_escape="'\"'\"'"
+  value="${value//\'/$single_quote_escape}"
+  printf "'%s'" "$value"
+}
+
 build_acp_agent_command() {
   ACP_AGENT_COMMAND="$AGENT"
+  if [ "$AGENT" = "workbuddy" ]; then
+    local workbuddy_bin workbuddy_config_dir_word
+    workbuddy_bin="$(find_workbuddy_cli)" \
+      || agent_fail "WorkBuddy 不可用。请确认已安装到 /Applications/WorkBuddy.app。"
+    workbuddy_config_dir_word="$(acp_command_word "$HOME/.workbuddy")" \
+      || agent_fail "WorkBuddy 配置目录包含不受支持的换行符。"
+    ACP_AGENT_COMMAND="env CODEBUDDY_CONFIG_DIR=$workbuddy_config_dir_word CODEBUDDY_SKIP_BUILTIN_MARKETPLACE=1 $workbuddy_bin --acp"
+    agent_detail "using native WorkBuddy ACP command: $ACP_AGENT_COMMAND"
+    return 0
+  fi
+
+  if [ "$AGENT" = "workbuddy_ai" ]; then
+    local workbuddy_ai_bin workbuddy_ai_word workbuddy_ai_config_dir_word
+    workbuddy_ai_bin="$(find_workbuddy_ai_cli)" \
+      || agent_fail "WorkBuddy AI CLI 不可用：${WORKBUDDY_AI_APP_CLI}。请确认该文件存在且可执行。"
+    workbuddy_ai_word="$(acp_command_word "$workbuddy_ai_bin")" \
+      || agent_fail "WorkBuddy AI 路径包含不受支持的换行符。"
+    workbuddy_ai_config_dir_word="$(acp_command_word "$HOME/.workbuddy-ai")" \
+      || agent_fail "WorkBuddy AI 配置目录包含不受支持的换行符。"
+    ACP_AGENT_COMMAND="env CODEBUDDY_CONFIG_DIR=$workbuddy_ai_config_dir_word CODEBUDDY_SKIP_BUILTIN_MARKETPLACE=1 $workbuddy_ai_word --acp"
+    agent_detail "using native WorkBuddy AI ACP command: $ACP_AGENT_COMMAND"
+    return 0
+  fi
+
+  if [ "$AGENT" = "aime" ]; then
+    local aime_bin aime_word
+    aime_bin="$(aime_acp_cli_path)"
+    [ -x "$aime_bin" ] || agent_fail "AIME_ACP_UNAVAILABLE: AIME ACP executable is unavailable after preparation."
+    aime_word="$(acp_command_word "$aime_bin")" \
+      || agent_fail "AIME_ACP_PATH_INVALID: AIME ACP executable path is invalid."
+    ACP_AGENT_COMMAND="$aime_word --site $(aime_acp_site)"
+    agent_detail "AIME ACP configured for site $(aime_acp_site)"
+    return 0
+  fi
+
+  if [ "$AGENT" = "traecli" ]; then
+    local traecode_bin traecode_word
+    traecode_bin="$(find_traecode_cli)" || agent_fail "TraeCode CLI 不可用，无法启动 ACP 服务。"
+    traecode_word="$(acp_command_word "$traecode_bin")" \
+      || agent_fail "TraeCode CLI 路径包含不受支持的换行符。"
+    ACP_AGENT_COMMAND="$traecode_word acp serve"
+    agent_detail "using native TraeCode ACP command: $ACP_AGENT_COMMAND"
+    return 0
+  fi
+
+  if [ "$AGENT" = "coco" ] || [ "$AGENT" = "traex" ]; then
+    local trae_bin
+    trae_bin="$(find_traex_cli)" || agent_fail "Trae CLI Next（内部版）（traex）不可用，无法启动飞书任务所需的 ACP 服务。"
+    ACP_AGENT_COMMAND="$trae_bin acp serve"
+    agent_detail "using native Trae ACP command: $ACP_AGENT_COMMAND"
+    return 0
+  fi
+
   if [ "$AGENT" != "codex" ]; then
     return 0
   fi
@@ -3689,6 +4897,22 @@ run_internal_discover_agents() {
   if agent_cli_detected cursor; then
     agents+=("cursor")
   fi
+  if agent_cli_detected traex; then
+    agents+=("traex")
+  elif agent_cli_detected coco; then
+    agents+=("coco")
+  elif agent_cli_detected traecli; then
+    agents+=("traecli")
+  fi
+  if agent_cli_detected workbuddy; then
+    agents+=("workbuddy")
+  fi
+  if agent_cli_detected workbuddy_ai; then
+    agents+=("workbuddy_ai")
+  fi
+  if agent_cli_detected aime; then
+    agents+=("aime")
+  fi
   local joined=""
   if [ "${#agents[@]}" -gt 0 ]; then
     joined="$(IFS=,; printf '%s' "${agents[*]}")"
@@ -3702,32 +4926,79 @@ process.stdout.write(JSON.stringify({ agents }));
 prepare_internal_agent_environment() {
   [ -n "$AGENT" ] || agent_fail "internal Agent preparation requires --agent"
   validate_agent_name "$AGENT"
-  source_lark_env
+  ensure_agent_selection_available "$AGENT"
+  load_agent_metadata
+  if [ "$AGENT_EXECUTION_LOCATION" = "local" ]; then
+    source_lark_env
+  fi
   ensure_agent_cli
 }
 
 run_internal_register_binding() {
   [ -n "$AGENT" ] || agent_fail "internal Bot registration requires --agent"
   validate_agent_name "$AGENT"
-  source_lark_env
+  ensure_agent_selection_available "$AGENT"
+  load_agent_metadata
   register_feishu_app
-  emit_internal_result "{\"app_id\":\"$(json_escape "$APP_ID")\",\"app_secret\":\"$(json_escape "$APP_SECRET")\",\"display_name\":\"$(json_escape "$BOT_NAME")\",\"lark_cli_profile\":\"$(json_escape "$LARK_CLI_PROFILE")\"}"
+  if [ "$AGENT_EXECUTION_LOCATION" = "remote" ]; then
+    emit_internal_result "{\"app_id\":\"$(json_escape "$APP_ID")\",\"app_secret\":\"$(json_escape "$APP_SECRET")\",\"display_name\":\"$(json_escape "$BOT_NAME")\",\"auth_mode\":\"app-secret\"}"
+  else
+    emit_internal_result "{\"app_id\":\"$(json_escape "$APP_ID")\",\"app_secret\":\"$(json_escape "$APP_SECRET")\",\"display_name\":\"$(json_escape "$BOT_NAME")\",\"lark_cli_profile\":\"$(json_escape "$LARK_CLI_PROFILE")\",\"auth_mode\":\"lark-cli\"}"
+  fi
 }
 
 run_internal_prepare_agent() {
   prepare_internal_agent_environment
   ensure_codex_cli_updated
   ensure_agent_login
+  if [ "$AGENT_PREPARE_CANCELLED" = "true" ]; then
+    emit_internal_result "{\"cancelled\":true,\"agent_type\":\"$(json_escape "$AGENT")\",\"reason\":\"$(json_escape "$AGENT_PREPARE_CANCEL_REASON")\"}"
+    return 0
+  fi
   maybe_mock_fail "agent-login"
   ensure_acpx
   build_acp_agent_command
-  emit_internal_result "{\"agent_type\":\"$(json_escape "$AGENT")\",\"acp_command\":\"$(json_escape "$ACP_AGENT_COMMAND")\",\"lark_cli_config_dir\":\"$(json_escape "${LARKSUITE_CLI_CONFIG_DIR:-}")\"}"
+  if [ "$AGENT_EXECUTION_LOCATION" = "remote" ]; then
+    emit_internal_result "{\"agent_type\":\"$(json_escape "$AGENT")\",\"acp_command\":\"$(json_escape "$ACP_AGENT_COMMAND")\"}"
+  else
+    emit_internal_result "{\"agent_type\":\"$(json_escape "$AGENT")\",\"acp_command\":\"$(json_escape "$ACP_AGENT_COMMAND")\",\"lark_cli_config_dir\":\"$(json_escape "${LARKSUITE_CLI_CONFIG_DIR:-}")\"}"
+  fi
+}
+
+run_internal_probe_profile() {
+  AAMP_TASK_INTERNAL_BINDING_JSON=""
+  IFS= read -r AAMP_TASK_INTERNAL_BINDING_JSON <&"$AAMP_TASK_INTERNAL_INPUT_FD" || true
+  [ -n "$AAMP_TASK_INTERNAL_BINDING_JSON" ] || agent_fail "missing internal binding payload"
+  AGENT="$(binding_json_field agent_type)"
+  validate_agent_name "$AGENT"
+  load_agent_metadata
+  [ "$AGENT_EXECUTION_LOCATION" != "remote" ] || agent_fail "remote bindings do not use lark-cli profiles"
+  APP_ID="$(binding_json_field bot.app_id)"
+  LARK_CLI_PROFILE="$(binding_json_field bot.lark_cli_profile)"
+  [ -n "$APP_ID" ] && [ -n "$LARK_CLI_PROFILE" ] || agent_fail "binding is missing Feishu app or profile"
+  AAMP_TASK_INTERNAL_BINDING_JSON=""
+  unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy
+  export LARKSUITE_CLI_CONFIG_DIR="$AAMP_LARK_CLI_CONFIG_DIR"
+  unset LARK_CLI_NO_PROXY
+  if ! select_lark_cli_bin_from_candidates; then
+    emit_internal_result '{"ready":false}'
+    return 0
+  fi
+  if with_lark_cli_config_lock probe_lark_cli_profile_locked "$LARK_CLI_PROFILE"; then
+    emit_internal_result "{\"ready\":true,\"lark_cli_bin\":\"$(json_escape "$LARK_CLI_CMD")\",\"lark_cli_config_dir\":\"$(json_escape "${LARKSUITE_CLI_CONFIG_DIR:-}")\"}"
+  else
+    emit_internal_result '{"ready":false}'
+  fi
 }
 
 run_internal_ensure_profile() {
   AAMP_TASK_INTERNAL_BINDING_JSON=""
   IFS= read -r AAMP_TASK_INTERNAL_BINDING_JSON <&"$AAMP_TASK_INTERNAL_INPUT_FD" || true
   [ -n "$AAMP_TASK_INTERNAL_BINDING_JSON" ] || agent_fail "missing internal binding payload"
+  AGENT="$(binding_json_field agent_type)"
+  validate_agent_name "$AGENT"
+  load_agent_metadata
+  [ "$AGENT_EXECUTION_LOCATION" != "remote" ] || agent_fail "remote bindings do not use lark-cli profiles"
   APP_ID="$(binding_json_field bot.app_id)"
   APP_SECRET="$(binding_json_field bot.app_secret)"
   BOT_NAME="$(binding_json_field bot.display_name)"
@@ -3742,7 +5013,9 @@ run_internal_ensure_profile() {
 
 run_internal_action() {
   AAMP_TASK_INTERNAL="true"
-  ensure_node_toolchain
+  if [ "$AAMP_TASK_ACTION" != "__probe-profile" ]; then
+    ensure_node_toolchain
+  fi
   case "$AAMP_TASK_ACTION" in
     __discover-agents)
       run_internal_discover_agents
@@ -3753,6 +5026,9 @@ run_internal_action() {
     __prepare-agent)
       run_internal_prepare_agent
       ;;
+    __probe-profile)
+      run_internal_probe_profile
+      ;;
     __ensure-profile)
       run_internal_ensure_profile
       ;;
@@ -3766,6 +5042,92 @@ task_agent_controller_path() {
   printf '%s/bin/feishu-task-agent-controller.mjs\n' "$(task_agent_global_package_dir)"
 }
 
+task_agent_metadata_path() {
+  printf '%s/bin/agent-metadata.mjs\n' "$(task_agent_global_package_dir)"
+}
+
+local_package_override_is_supported() {
+  local spec local_path
+  spec="${1:-}"
+  case "$spec" in
+    file:*)
+      local_path="${spec#file:}"
+      [ -n "$local_path" ] && [ -d "$local_path" ]
+      ;;
+    *.tgz) [ -f "$spec" ] ;;
+    *) return 1 ;;
+  esac
+}
+
+aime_local_package_override_path() {
+  local directory filename spec
+  spec="${1:-}"
+  case "$spec" in
+    -*|file:*|*://*) return 1 ;;
+  esac
+  if [[ "$spec" =~ (^|@)[[:alpha:]][[:alnum:]+.-]*: ]]; then
+    return 1
+  fi
+  case "$spec" in
+    *.tgz) [ -f "$spec" ] || return 1 ;;
+    *) return 1 ;;
+  esac
+  case "$spec" in
+    */*)
+      directory="${spec%/*}"
+      filename="${spec##*/}"
+      [ -n "$directory" ] || directory="/"
+      ;;
+    *)
+      directory="."
+      filename="$spec"
+      ;;
+  esac
+  directory="$(cd -P -- "$directory" 2>/dev/null && pwd -P)" || return 1
+  printf '%s/%s\n' "$directory" "$filename"
+}
+
+apply_task_agent_package_override_policy() {
+  local aime_override_path
+  ACP_BRIDGE_PKG="$AAMP_TASK_DEFAULT_ACP_BRIDGE_PKG"
+  FEISHU_BRIDGE_PKG="$AAMP_TASK_DEFAULT_FEISHU_BRIDGE_PKG"
+  AIME_ACP_PKG="$AAMP_TASK_DEFAULT_AIME_ACP_PKG"
+  [ "$AAMP_TASK_ALLOW_PACKAGE_OVERRIDES" = "true" ] || return 0
+
+  if [ -n "$AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG" ]; then
+    local_package_override_is_supported "$AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG" \
+      || agent_fail "Local ACP Bridge package override is invalid."
+    ACP_BRIDGE_PKG="$AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG"
+  fi
+  if [ -n "$AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG" ]; then
+    local_package_override_is_supported "$AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG" \
+      || agent_fail "Local Feishu Bridge package override is invalid."
+    FEISHU_BRIDGE_PKG="$AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG"
+  fi
+  if [ -n "$AAMP_TASK_REQUESTED_AIME_ACP_PKG" ]; then
+    aime_override_path="$(aime_local_package_override_path "$AAMP_TASK_REQUESTED_AIME_ACP_PKG")" \
+      || agent_fail "AIME_ACP_PACKAGE_OVERRIDE_INVALID: AIME ACP package override must be an existing local .tgz file."
+    AAMP_TASK_REQUESTED_AIME_ACP_PKG="$aime_override_path"
+    AIME_ACP_PKG="$aime_override_path"
+  fi
+}
+
+load_agent_metadata() {
+  local metadata_path metadata_json
+  metadata_path="$(task_agent_metadata_path)"
+  [ -r "$metadata_path" ] || agent_fail "Task Agent metadata is missing: $metadata_path"
+  metadata_json="$(node "$metadata_path" --json "$AGENT")" \
+    || agent_fail "failed to resolve Task Agent metadata for $AGENT"
+  AGENT_EXECUTION_LOCATION="$(node -e 'const value=JSON.parse(process.argv[1]);process.stdout.write(value.executionLocation)' "$metadata_json")"
+  AGENT_ATTACHMENT_POLICY="$(node -e 'const value=JSON.parse(process.argv[1]);process.stdout.write(value.attachmentPolicy || "")' "$metadata_json")"
+  AGENT_TASK_DISPATCH_CONCURRENCY="$(node -e 'const value=JSON.parse(process.argv[1]);process.stdout.write(value.taskDispatchConcurrency ? String(value.taskDispatchConcurrency) : "")' "$metadata_json")"
+  if [ -n "$AAMP_TASK_INTERNAL_EXECUTION_LOCATION" ] \
+    && [ "$AAMP_TASK_INTERNAL_EXECUTION_LOCATION" != "$AGENT_EXECUTION_LOCATION" ]; then
+    agent_fail "Task Agent execution metadata mismatch"
+  fi
+  AAMP_TASK_INTERNAL_EXECUTION_LOCATION="$AGENT_EXECUTION_LOCATION"
+}
+
 run_task_agent_controller() {
   local controller bootstrap_path install_command
   controller="$(task_agent_controller_path)"
@@ -3778,6 +5140,17 @@ run_task_agent_controller() {
   export AAMP_TASK_NPX_BIN="$NPX_BIN"
   export AAMP_TASK_ACP_BRIDGE_PKG="$ACP_BRIDGE_PKG"
   export AAMP_TASK_FEISHU_BRIDGE_PKG="$FEISHU_BRIDGE_PKG"
+  export AAMP_TASK_AIME_ACP_PKG="$AIME_ACP_PKG"
+  export AAMP_TASK_ALLOW_PACKAGE_OVERRIDES
+  if [ "$AAMP_TASK_ALLOW_PACKAGE_OVERRIDES" != "true" ]; then
+    AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG=""
+    AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG=""
+    AAMP_TASK_REQUESTED_AIME_ACP_PKG=""
+  fi
+  export AAMP_TASK_PACKAGE_OVERRIDES_RESOLVED=true
+  export AAMP_TASK_REQUESTED_ACP_BRIDGE_PKG
+  export AAMP_TASK_REQUESTED_FEISHU_BRIDGE_PKG
+  export AAMP_TASK_REQUESTED_AIME_ACP_PKG
   export AAMP_TASK_CODEX_ACP_PKG="$CODEX_ACP_PKG"
   export AAMP_TASK_AGENT_VERSION
   export AAMP_TASK_DEFAULT_AGENT="$AGENT"
@@ -3835,13 +5208,19 @@ main() {
     return 0
   fi
 
+  apply_task_agent_package_override_policy
+
   case "$AAMP_TASK_ACTION" in
-    __discover-agents|__register-binding|__prepare-agent|__ensure-profile)
+    __discover-agents|__register-binding|__prepare-agent|__probe-profile|__ensure-profile)
       run_internal_action
       return 0
       ;;
   esac
 
+  if [ "$AGENT" = "aime" ]; then
+    ensure_agent_selection_available "$AGENT"
+  fi
+
   trap cleanup EXIT INT TERM HUP
   init_log_run
   validate_mock_fail_stage