@modelzen/feishu-codex-bridge 0.1.2 → 0.1.4

package/README.md

@@ -1,5 +1,10 @@
 # feishu-codex-bridge
 
+[![npm version](https://badgen.net/npm/v/@modelzen/feishu-codex-bridge)](https://www.npmjs.com/package/@modelzen/feishu-codex-bridge)
+[![total downloads](https://badgen.net/npm/dt/@modelzen/feishu-codex-bridge)](https://www.npmjs.com/package/@modelzen/feishu-codex-bridge)
+[![downloads/month](https://badgen.net/npm/dm/@modelzen/feishu-codex-bridge)](https://www.npmjs.com/package/@modelzen/feishu-codex-bridge)
+[![license](https://badgen.net/npm/license/@modelzen/feishu-codex-bridge)](https://github.com/modelzen/feishu-codex-bridge/blob/main/LICENSE)
+
 > 把飞书 / Lark 桥接到你本机的 [Codex](https://github.com/openai/codex)，在群里 @ 机器人就能让 Codex 在指定项目目录里干活，结果以流式 Markdown 卡片实时回到群里。
 >
 > **项目 = 群 = 固定工作目录（cwd）**，**话题（thread）= 一个 Codex 会话（session）**。
@@ -78,8 +83,11 @@ feishu-codex-bridge status     # 状态 / pid / 日志路径 / 上次退出码
 feishu-codex-bridge logs -f    # 跟踪日志
 feishu-codex-bridge restart    # 重启
 feishu-codex-bridge stop       # 停止并关闭开机自启
+feishu-codex-bridge update     # 更新到最新版（npm i -g）并自动重启 daemon（--check 只查不装）
 ```
 
+> 💡 升级很省事：装了后台 daemon 的，直接 `feishu-codex-bridge update` 一条命令 = 拉最新版 + 自动 `restart`；也可在**私聊管理台**点 **⬆️ 版本更新** 按钮，机器人自更新后重启服务。
+
 `start` 会**先在当前终端完成 init**（没配置则扫码），并**阻塞到授权完成**——权限全部开通、且你确认已订阅事件/发布版本——才真正装服务，绝不会装一个收不到消息的空壳。daemon 体跑的就是 `run`。
 
 > ⚠️ **后台 daemon 必须全局安装（`npm i -g`），不要用 npx**：launchd plist 里硬编码了 CLI 路径，而 npx 的临时缓存（`~/.npm/_npx/...`）会被清理，缓存一没服务就起不来。前台 `run` 用 npx 没问题（单次进程）。
@@ -109,7 +117,7 @@ feishu-codex-bridge bot rm <名>     # 移除一个机器人配置
 
 启动时若有缺失权限，会**自动打开浏览器**到形如 `https://open.feishu.cn/app/<app_id>/auth?q=...` 的页面（同时在终端打印链接），**一次性勾选全部 → 确认**即可（即时生效、无需重启）。`start`（后台 daemon）会阻塞到这步开通完成才装服务。
 
-本桥需要的全部权限以 [`src/config/scopes.ts`](src/config/scopes.ts) 的 `REQUIRED_SCOPES` 为权威清单，包含：收群 @ 消息 / 全量群消息（免 @）/ 私聊消息、以机器人身份发消息与回话题、消息置顶、表情回复、上传下载资源、建群 / 转让群主、群公告读写、置顶横幅、群标签页、交互卡片。**这些都在首次开通链接里一并申请，正常用不会再遇到「权限不足」。**
+本桥需要的全部权限以 [`src/config/scopes.ts`](src/config/scopes.ts) 的 `REQUIRED_SCOPES` 为权威清单，包含：收群 @ 消息 / 全量群消息（免 @）/ 私聊消息、以机器人身份发消息与回话题、消息置顶、表情回复、上传下载资源、建群 / 转让群主 / 设群管理员、群公告读写、置顶横幅、群标签页、交互卡片。**这些都在首次开通链接里一并申请，正常用不会再遇到「权限不足」。**
 
 > 「**文档评论回复**」功能另需 `docs:document.comment:read`、`docs:document.comment:create`、`wiki:wiki:readonly` 三项（见 `COMMENT_SCOPES`）。它们**已预勾选进同一个开通链接**，但**不属于** `REQUIRED_SCOPES` —— 不开通也不会卡住后台服务安装，只是该功能静默关闭。
 
@@ -188,6 +196,7 @@ feishu-codex-bridge bot rm <名>     # 移除一个机器人配置
 feishu-codex-bridge run                前台启动（没配置先扫码 init；Ctrl+C 优雅退出）
 feishu-codex-bridge start              后台 daemon 启动（装 launchd 开机自启；阻塞到授权完成）
 feishu-codex-bridge stop|restart|status|logs   后台 daemon 生命周期
+feishu-codex-bridge update             更新到最新版并自动重启 daemon（--check 只查不装）
 feishu-codex-bridge bot init|list|use|rm       多飞书机器人：注册 / 列表 / 切当前 / 移除
 feishu-codex-bridge doctor             本地自检：codex / 登录 / lark-cli / 当前机器人
 ```
@@ -215,7 +224,7 @@ src/
   project/    项目注册表、建群/公告/标签页 onboarding、生命周期
   config/     加密密钥库、密钥解析、配置存储、多机器人注册表、scope 清单、路径
   core/       watchdog、单实例锁、日志
-  cli/        commander 命令（run / start / stop / restart / status / logs / bot / doctor / secrets）
+  cli/        commander 命令（run / start / stop / restart / status / logs / update / bot / doctor / secrets）
   service/    launchd 后台服务
 ```
 

package/dist/cli.js

@@ -1,9 +1,19 @@
 // src/cli/index.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname8, resolve as resolve3 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command } from "commander";
 
+// src/core/version.ts
+import { readFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { fileURLToPath } from "url";
+function bridgeVersion() {
+  try {
+    const pkgPath = resolve(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync(pkgPath, "utf8")).version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
 // src/cli/commands/doctor.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync3 } from "fs";
@@ -65,11 +75,11 @@ var paths = {
 // src/config/bots.ts
 import { existsSync } from "fs";
 import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join2 } from "path";
 
 // src/config/store.ts
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
-import { dirname } from "path";
+import { dirname as dirname2 } from "path";
 
 // src/config/schema.ts
 function isComplete(cfg) {
@@ -158,7 +168,7 @@ async function ensureSecretsGetterWrapper() {
 # Auto-generated by feishu-codex-bridge. Do not edit.
 exec ${sq(node)} ${sq(bridgeEntry)} secrets get "$@"
 `;
-  await mkdir(dirname(wrapperPath), { recursive: true });
+  await mkdir(dirname2(wrapperPath), { recursive: true });
   const tmp = `${wrapperPath}.tmp-${process.pid}`;
   await writeFile(tmp, content, "utf8");
   await chmod(tmp, 448);
@@ -166,7 +176,7 @@ exec ${sq(node)} ${sq(bridgeEntry)} secrets get "$@"
   return wrapperPath;
 }
 async function saveConfig(cfg, path = paths.configFile) {
-  await mkdir(dirname(path), { recursive: true });
+  await mkdir(dirname2(path), { recursive: true });
   const tmp = `${path}.tmp-${process.pid}`;
   await writeFile(tmp, `${JSON.stringify(cfg, null, 2)}
 `, "utf8");
@@ -187,7 +197,7 @@ async function loadBots() {
   }
 }
 async function saveBots(reg) {
-  await mkdir2(dirname2(paths.botsFile), { recursive: true });
+  await mkdir2(dirname3(paths.botsFile), { recursive: true });
   const tmp = `${paths.botsFile}.tmp-${process.pid}`;
   await writeFile2(tmp, `${JSON.stringify(reg, null, 2)}
 `, "utf8");
@@ -358,7 +368,7 @@ import { createInterface } from "readline/promises";
 import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from "crypto";
 import { chmod as chmod3, mkdir as mkdir3, readFile as readFile3, rename as rename3, writeFile as writeFile3 } from "fs/promises";
 import { hostname, userInfo } from "os";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 var KEY_LEN = 32;
 var IV_LEN = 12;
 var TAG_LEN = 16;
@@ -377,7 +387,7 @@ async function readStore() {
   }
 }
 async function writeStore(store) {
-  await mkdir3(dirname3(paths.secretsFile), { recursive: true });
+  await mkdir3(dirname4(paths.secretsFile), { recursive: true });
   const tmp = `${paths.secretsFile}.tmp-${process.pid}`;
   await writeFile3(tmp, `${JSON.stringify(store, null, 2)}
 `, "utf8");
@@ -392,7 +402,7 @@ async function loadOrCreateSalt() {
     if (err.code !== "ENOENT") throw err;
   }
   const salt = randomBytes(KEY_LEN);
-  await mkdir3(dirname3(paths.keystoreSaltFile), { recursive: true });
+  await mkdir3(dirname4(paths.keystoreSaltFile), { recursive: true });
   const tmp = `${paths.keystoreSaltFile}.tmp-${process.pid}`;
   await writeFile3(tmp, salt);
   await chmod3(tmp, 384);
@@ -528,7 +538,7 @@ async function spawnExecProvider(pc, ref) {
   const timeoutMs = pc.noOutputTimeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS;
   const maxOutput = pc.maxOutputBytes ?? DEFAULT_EXEC_MAX_OUTPUT;
   const providerName = ref.provider ?? DEFAULT_PROVIDER;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const env = {};
     if (pc.passEnv) for (const k of pc.passEnv) {
       const v = process.env[k];
@@ -573,7 +583,7 @@ async function spawnExecProvider(pc, ref) {
       try {
         const parsed = JSON.parse(stdout);
         const value = parsed.values?.[ref.id];
-        if (typeof value === "string") return resolve4(value);
+        if (typeof value === "string") return resolve5(value);
         const err = parsed.errors?.[ref.id]?.message;
         reject(new Error(`exec provider did not return secret for ${ref.id}${err ? `: ${err}` : ""}`));
       } catch (err) {
@@ -651,6 +661,8 @@ var REQUIRED_SCOPES = [
   // create the project group
   "im:chat:update",
   // transfer ownership on unbind
+  "im:chat.managers:write_only",
+  // promote the project creator to group admin (im.v1.chat.managers.add_managers)
   "im:chat.announcement:read",
   // read group announcement blocks (list)
   "im:chat.announcement:write_only",
@@ -1100,7 +1112,7 @@ var AsyncQueue = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve4) => this.waiters.push(resolve4));
+      const next = await new Promise((resolve5) => this.waiters.push(resolve5));
       if (next.done) return;
       yield next.value;
     }
@@ -1151,8 +1163,8 @@ var AppServerClient = class {
     const id = ++this.nextId;
     const payload = `${JSON.stringify({ jsonrpc: "2.0", id, method, params: params ?? {} })}
 `;
-    return new Promise((resolve4, reject) => {
-      this.pending.set(id, { resolve: resolve4, reject });
+    return new Promise((resolve5, reject) => {
+      this.pending.set(id, { resolve: resolve5, reject });
       this.child.stdin.write(payload, (err) => {
         if (err) {
           this.pending.delete(id);
@@ -1176,14 +1188,14 @@ var AppServerClient = class {
     const child = this.child;
     if (!child || child.exitCode !== null) return;
     child.kill("SIGTERM");
-    await new Promise((resolve4) => {
+    await new Promise((resolve5) => {
       const t = setTimeout(() => {
         if (child.exitCode === null) child.kill("SIGKILL");
-        resolve4();
+        resolve5();
       }, graceMs);
       child.once("exit", () => {
         clearTimeout(t);
-        resolve4();
+        resolve5();
       });
     });
   }
@@ -1302,12 +1314,12 @@ var APPROVAL_POLICY = "never";
 var SANDBOX = "danger-full-access";
 var READ_HISTORY_TIMEOUT_MS = 2e4;
 function withDeadline(p, ms, label) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const t = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
     p.then(
       (v) => {
         clearTimeout(t);
-        resolve4(v);
+        resolve5(v);
       },
       (e) => {
         clearTimeout(t);
@@ -1347,11 +1359,11 @@ var CodexThread = class {
       if (self.model) params.model = self.model;
       if (self.effort) params.effort = self.effort;
       let startError;
-      const startFailed = new Promise((resolve4) => {
+      const startFailed = new Promise((resolve5) => {
         self.client.request("turn/start", params).then(void 0, (err) => {
           startError = err instanceof Error ? err : new Error(String(err));
           log.fail("agent", startError, { phase: "turn/start" });
-          resolve4("start-failed");
+          resolve5("start-failed");
         });
       });
       const stream2 = self.client.stream()[Symbol.asyncIterator]();
@@ -2616,6 +2628,7 @@ var RunCardStream = class {
 function openChatUrl(chatId) {
   return `https://applink.feishu.cn/client/chat/open?openChatId=${encodeURIComponent(chatId)}`;
 }
+var REPO = "https://github.com/modelzen/feishu-codex-bridge";
 var DM = {
   menu: "dm.menu",
   newProject: "dm.newProject",
@@ -2624,6 +2637,8 @@ var DM = {
   settings: "dm.settings",
   doctor: "dm.doctor",
   reconnect: "dm.reconnect",
+  update: "dm.update",
+  updateDo: "dm.update.do",
   rmConfirm: "dm.rmConfirm",
   rmDo: "dm.rmDo",
   rmCancel: "dm.rmCancel",
@@ -2650,12 +2665,159 @@ function buildDmMenuCard() {
       ]),
       actions([
         button("\u{1FA7A} \u8BCA\u65AD", { a: DM.doctor }),
-        button("\u{1F504} \u91CD\u8FDE", { a: DM.reconnect })
+        button("\u{1F504} \u91CD\u8FDE", { a: DM.reconnect }),
+        button("\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", { a: DM.update })
       ])
     ],
     { header: { title: "\u{1F916} Codex Bridge \u7BA1\u7406\u53F0", template: "blue" } }
   );
 }
+var backToMenu = () => actions([button("\u2B05\uFE0F \u83DC\u5355", { a: DM.menu })]);
+function buildUpdateCard(state) {
+  switch (state.phase) {
+    case "checking":
+      return card([md("\u23F3 \u6B63\u5728\u67E5\u8BE2\u6700\u65B0\u7248\u672C\u2026"), note("\u4ECE npm registry \u62C9\u53D6\u7248\u672C\u4FE1\u606F\uFF0C\u8BF7\u7A0D\u5019\u3002")], {
+        header: { title: "\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", template: "turquoise" }
+      });
+    case "checked": {
+      const cur = state.current ?? "?";
+      if (!state.latest) {
+        return card(
+          [
+            md(`\u5F53\u524D\u7248\u672C\uFF1A**v${cur}**`),
+            md("\u26A0\uFE0F \u67E5\u4E0D\u5230\u6700\u65B0\u7248\u672C\uFF08\u7F51\u7EDC\u6216 npm registry \u95EE\u9898\uFF09\u3002"),
+            actions([button("\u{1F504} \u91CD\u8BD5", { a: DM.update }), button("\u2B05\uFE0F \u83DC\u5355", { a: DM.menu })])
+          ],
+          { header: { title: "\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", template: "red" } }
+        );
+      }
+      if (!state.hasUpdate) {
+        return card(
+          [md(`\u2705 \u5DF2\u662F\u6700\u65B0\u7248\u672C\uFF1A**v${cur}**`), backToMenu()],
+          { header: { title: "\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", template: "green" } }
+        );
+      }
+      const head = [
+        md(`\u53D1\u73B0\u65B0\u7248\u672C \u{1F389}`),
+        note(`\u5F53\u524D v${cur}  \u2192  \u6700\u65B0 v${state.latest}`)
+      ];
+      if (state.dev) {
+        return card(
+          [
+            ...head,
+            md("\u68C0\u6D4B\u5230**\u6E90\u7801\u5F00\u53D1\u6A21\u5F0F**\uFF08\u4ED3\u5E93\u5185\u6709 .git\uFF09\u3002\u8BF7\u5728\u7EC8\u7AEF\u7528 `git pull && npm i` \u66F4\u65B0\uFF0C\u800C\u4E0D\u662F\u5168\u5C40\u5B89\u88C5\u3002"),
+            backToMenu()
+          ],
+          { header: { title: "\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", template: "orange" } }
+        );
+      }
+      return card(
+        [
+          ...head,
+          note("\u70B9\u300C\u7ACB\u5373\u66F4\u65B0\u300D\u4F1A\u6267\u884C `npm i -g` \u5E76\u81EA\u52A8\u91CD\u542F\u540E\u53F0\u670D\u52A1\uFF08\u7EA6\u6570\u5341\u79D2\uFF09\u3002"),
+          actions([
+            button("\u2B06\uFE0F \u7ACB\u5373\u66F4\u65B0", { a: DM.updateDo }, "primary"),
+            button("\u2B05\uFE0F \u83DC\u5355", { a: DM.menu })
+          ])
+        ],
+        { header: { title: "\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", template: "blue" } }
+      );
+    }
+    case "updating":
+      return card(
+        [
+          md(`\u23F3 \u6B63\u5728\u66F4\u65B0\u5230\u6700\u65B0\u7248\u2026`),
+          note(`\u4ECE v${state.from ?? "?"} \u5347\u7EA7\u4E2D\uFF0C\u4E0B\u8F7D\u5B89\u88C5\u7EA6\u6570\u5341\u79D2\uFF0C\u8BF7\u52FF\u91CD\u590D\u70B9\u51FB\u3002`)
+        ],
+        { header: { title: "\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", template: "turquoise" } }
+      );
+    case "done": {
+      const tail = state.willRestart ? note("\u6B63\u5728\u91CD\u542F\u540E\u53F0\u670D\u52A1\u4EE5\u751F\u6548 \u2014\u2014 \u91CD\u542F\u671F\u95F4\u672C\u5361\u7247\u505C\u6B62\u66F4\u65B0\uFF1B\u7A0D\u540E\u53D1\u6211\u4EFB\u610F\u6D88\u606F\u53EF\u91CD\u5F00\u7BA1\u7406\u53F0\u3002") : note("\u524D\u53F0\u6A21\u5F0F\uFF1A\u8BF7\u5728\u7EC8\u7AEF\u624B\u52A8\u91CD\u542F `run` \u8FDB\u7A0B\u4F7F\u65B0\u7248\u672C\u751F\u6548\u3002");
+      return card(
+        [md(`\u2705 \u5DF2\u66F4\u65B0 **v${state.from ?? "?"} \u2192 v${state.to ?? "?"}**`), tail],
+        { header: { title: "\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", template: "green" } }
+      );
+    }
+    case "error":
+      return card(
+        [
+          md("\u274C **\u66F4\u65B0\u5931\u8D25**"),
+          state.message ? note(state.message) : note("npm \u5B89\u88C5\u672A\u6210\u529F\u3002"),
+          md("\u53EF\u5728\u7EC8\u7AEF\u624B\u52A8\u6267\u884C\uFF1A`npm i -g @modelzen/feishu-codex-bridge@latest`\uFF08\u5FC5\u8981\u65F6\u52A0 sudo\uFF09\u3002"),
+          actions([button("\u{1F504} \u91CD\u8BD5", { a: DM.update }), button("\u2B05\uFE0F \u83DC\u5355", { a: DM.menu })])
+        ],
+        { header: { title: "\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", template: "red" } }
+      );
+  }
+}
+function connLabel(state) {
+  switch (state) {
+    case "connected":
+      return "\u2705 \u5DF2\u8FDE\u63A5";
+    case "connecting":
+      return "\u23F3 \u8FDE\u63A5\u4E2D";
+    case "reconnecting":
+      return "\u21BB \u91CD\u8FDE\u4E2D";
+    case "disconnected":
+      return "\u274C \u5DF2\u65AD\u5F00";
+    default:
+      return state;
+  }
+}
+function codexDiagnosePrompt(i) {
+  return [
+    "\u6211\u5728\u7528 feishu-codex-bridge\uFF08\u98DE\u4E66 \u2194 \u672C\u5730 Codex \u6865\u63A5\uFF09\u9047\u5230\u95EE\u9898\uFF0C\u8BF7\u5E2E\u6211\u5B9A\u4F4D\u539F\u56E0\u5E76\u7ED9\u51FA\u4FEE\u590D\u6B65\u9AA4\u3002",
+    "",
+    "\u3010\u73AF\u5883\u3011",
+    `- bridge \u7248\u672C\uFF1Av${i.bridgeVer}`,
+    `- codex \u7248\u672C\uFF1A${i.codexVer ?? "\u672A\u627E\u5230\uFF08PATH / CODEX_BIN \u91CC\u90FD\u6CA1\u6709 codex\uFF09"}`,
+    `- Node\uFF1A${i.node}`,
+    `- \u5E73\u53F0\uFF1A${i.platform}`,
+    `- \u9879\u76EE\u4ED3\u5E93\uFF1A${REPO}`,
+    "",
+    "\u3010\u8FD0\u884C\u5FEB\u7167\u3011",
+    `- codex \u53EF\u7528\uFF1A${i.codexOk ? "\u662F" : "\u5426"}`,
+    `- \u98DE\u4E66\u957F\u8FDE\u63A5\uFF1A${i.conn}`,
+    "",
+    "\u3010\u8BF7\u4F60\u505A\u7684\u4E8B\u3011",
+    "1. \u8BFB\u53D6\u5E76\u5206\u6790\u65E5\u5FD7\uFF0C\u627E\u51FA\u6700\u8FD1\u7684\u62A5\u9519\u6216\u5F02\u5E38\u5806\u6808\uFF1A",
+    `   - \u540E\u53F0\u5B88\u62A4\u8F93\u51FA\u65E5\u5FD7\uFF1A${i.logStdout}`,
+    `   - \u540E\u53F0\u5B88\u62A4\u9519\u8BEF\u65E5\u5FD7\uFF1A${i.logStderr}`,
+    "   \uFF08\u82E5\u662F\u524D\u53F0 feishu-codex-bridge run \u6A21\u5F0F\uFF0C\u65E5\u5FD7\u5728\u542F\u52A8\u5B83\u7684\u7EC8\u7AEF\u7A97\u53E3\uFF0C\u8BF7\u628A\u7EC8\u7AEF\u91CC\u7684\u62A5\u9519\u4E00\u8D77\u53D1\u6211\uFF09",
+    `2. \u5224\u65AD\u95EE\u9898\u5C5E\u4E8E\u54EA\u7C7B\uFF1Acodex \u542F\u52A8 / \u767B\u5F55\u3001\u98DE\u4E66\u9274\u6743\u6216\u6743\u9650\u4E0D\u8DB3\u3001\u957F\u8FDE\u63A5\u65AD\u5F00\u3001\u8FD8\u662F\u914D\u7F6E\u7F3A\u5931\uFF08\u914D\u7F6E\u6587\u4EF6\uFF1A${i.configFile}\uFF09\u3002`,
+    `3. \u5FC5\u8981\u65F6\u5BF9\u7167\u4ED3\u5E93 README \u4E0E issues \u7ED9\u65B9\u6848\uFF1A${REPO}/issues`,
+    "4. \u7ED9\u51FA\u53EF\u76F4\u63A5\u6267\u884C\u7684\u4FEE\u590D\u6B65\u9AA4\u3002",
+    "",
+    "\u3010\u6211\u9047\u5230\u7684\u73B0\u8C61\u3011",
+    "\uFF08\u5728\u8FD9\u91CC\u8865\u5145\uFF1A\u6BD4\u5982 @\u673A\u5668\u4EBA\u4E0D\u56DE\u590D / \u5361\u7247\u6309\u94AE\u70B9\u4E86\u6CA1\u53CD\u5E94 / \u542F\u52A8\u5C31\u62A5\u9519\u2026\u2026\uFF09"
+  ].join("\n");
+}
+function buildDoctorCard(i) {
+  const prompt = codexDiagnosePrompt(i);
+  return card(
+    [
+      md("**\u521D\u6B65\u8BCA\u65AD**"),
+      md(
+        `- Codex\uFF1A${i.codexOk ? `\u2705 \u53EF\u7528${i.codexVer ? `\uFF08${i.codexVer}\uFF09` : ""}` : "\u274C \u4E0D\u53EF\u7528\uFF08\u68C0\u67E5 CODEX_BIN / PATH\uFF09"}`
+      ),
+      md(`- \u98DE\u4E66\u957F\u8FDE\u63A5\uFF1A${connLabel(i.conn)}`),
+      note(`bridge v${i.bridgeVer}\u3000\xB7\u3000Node ${i.node}\u3000\xB7\u3000${i.platform}`),
+      hr(),
+      md("**\u65E5\u5FD7\u8DEF\u5F84**"),
+      note(`\u540E\u53F0\u5B88\u62A4\u8F93\u51FA\uFF1A\`${i.logStdout}\``),
+      note(`\u540E\u53F0\u5B88\u62A4\u9519\u8BEF\uFF1A\`${i.logStderr}\``),
+      note("\u524D\u53F0 `run` \u6A21\u5F0F\uFF1A\u65E5\u5FD7\u5728\u542F\u52A8\u5B83\u7684\u7EC8\u7AEF\u7A97\u53E3\u91CC"),
+      hr(),
+      md("**\u8BA9 Codex \u5E2E\u4F60\u6DF1\u5EA6\u8BCA\u65AD** \u2014 \u590D\u5236\u4E0B\u9762\u6574\u6BB5\uFF0C\u5230\u4EFB\u610F\u9879\u76EE\u7FA4\u91CC **@\u6211** \u7C98\u8D34\u53D1\u9001\uFF1A"),
+      md("```\n" + prompt + "\n```"),
+      actions([
+        linkButton("\u{1F4E6} \u9879\u76EE\u4ED3\u5E93", REPO),
+        linkButton("\u{1F41E} \u63D0 Issue", `${REPO}/issues`)
+      ])
+    ],
+    { header: { title: "\u{1FA7A} \u8BCA\u65AD", template: i.codexOk ? "blue" : "orange" } }
+  );
+}
 function buildNewProjectFormCard(opts = {}) {
   const elements = [];
   if (opts.error) elements.push(md(`\u274C **\u521B\u5EFA\u5931\u8D25**\uFF1A${opts.error}`));
@@ -2788,9 +2950,266 @@ function buildGroupSettingsCard(project) {
   );
 }
 
+// src/service/update.ts
+import { execFile, spawn as spawn5 } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname6, join as join8, resolve as resolve3 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { promisify } from "util";
+
+// src/service/launchd.ts
+import { spawn as spawn4, spawnSync } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { appendFile, mkdir as mkdir4, rm as rm2, writeFile as writeFile4 } from "fs/promises";
+import { homedir as homedir3, userInfo as userInfo2 } from "os";
+import { dirname as dirname5, join as join7, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var LAUNCHD_LABEL = "ai.feishu-codex-bridge.bot";
+function launchAgentPlistPath() {
+  return join7(homedir3(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+}
+function serviceStdoutPath() {
+  return join7(paths.appDir, "service.log");
+}
+function serviceStderrPath() {
+  return join7(paths.appDir, "service.err.log");
+}
+function resolveCliBinPath() {
+  const distDir = dirname5(fileURLToPath2(import.meta.url));
+  return resolve2(distDir, "..", "bin", "feishu-codex-bridge.mjs");
+}
+function escapeXml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function buildPlist() {
+  const nodePath = process.execPath;
+  const cliBinPath = resolveCliBinPath();
+  const pathEnv = process.env.PATH ?? "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(nodePath)}</string>
+    <string>${escapeXml(cliBinPath)}</string>
+    <string>run</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(serviceStdoutPath())}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(serviceStderrPath())}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${escapeXml(pathEnv)}</string>
+  </dict>
+</dict>
+</plist>
+`;
+}
+async function installLaunchd() {
+  const plistPath = launchAgentPlistPath();
+  await mkdir4(dirname5(plistPath), { recursive: true });
+  await ensureLogFiles();
+  await writeFile4(plistPath, buildPlist(), "utf8");
+  if (isLoaded()) {
+    const bootout = runLaunchctl(["bootout", serviceTarget()]);
+    if (!bootout.ok) throw launchctlError("launchctl bootout", bootout);
+    await waitUntilUnloaded();
+  }
+  const bootstrap = runLaunchctl(["bootstrap", userTarget(), plistPath]);
+  if (!bootstrap.ok) throw launchctlError("launchctl bootstrap", bootstrap);
+  return statusLaunchd();
+}
+async function uninstallLaunchd() {
+  if (isLoaded()) {
+    const bootout = runLaunchctl(["bootout", serviceTarget()]);
+    if (!bootout.ok) throw launchctlError("launchctl bootout", bootout);
+    await waitUntilUnloaded();
+  }
+  await rm2(launchAgentPlistPath(), { force: true });
+}
+async function restartLaunchd() {
+  if (!existsSync4(launchAgentPlistPath())) {
+    throw new Error(`launchd service \u672A\u5B89\u88C5\uFF1A${launchAgentPlistPath()}`);
+  }
+  if (isLoaded()) {
+    const bootout = runLaunchctl(["bootout", serviceTarget()]);
+    if (!bootout.ok) throw launchctlError("launchctl bootout", bootout);
+    await waitUntilUnloaded();
+  }
+  const bootstrap = runLaunchctl(["bootstrap", userTarget(), launchAgentPlistPath()]);
+  if (!bootstrap.ok) throw launchctlError("launchctl bootstrap", bootstrap);
+  return statusLaunchd();
+}
+function statusLaunchd() {
+  const result = runLaunchctl(["print", serviceTarget()]);
+  const raw = result.stdout || result.stderr;
+  const parsed = parseLaunchdStatus(raw);
+  return {
+    installed: existsSync4(launchAgentPlistPath()),
+    loaded: result.ok,
+    plistPath: launchAgentPlistPath(),
+    stdoutPath: serviceStdoutPath(),
+    stderrPath: serviceStderrPath(),
+    pid: parsed.pid,
+    lastExit: parsed.lastExit,
+    raw
+  };
+}
+async function tailLaunchdLogs(follow) {
+  await ensureLogFiles();
+  const args = follow ? ["-f", serviceStdoutPath(), serviceStderrPath()] : ["-n", "100", serviceStdoutPath(), serviceStderrPath()];
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn4("tail", args, { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0 || follow && code === null) {
+        resolvePromise();
+        return;
+      }
+      reject(new Error(`tail \u9000\u51FA\u7801 ${code ?? "unknown"}`));
+    });
+  });
+}
+function parseLaunchdStatus(text) {
+  return {
+    pid: text.match(/\bpid\s*=\s*(\d+)/)?.[1],
+    lastExit: text.match(/last exit code\s*=\s*(-?\d+)/i)?.[1]
+  };
+}
+function isLoaded() {
+  const result = spawnSync("launchctl", ["print", serviceTarget()], {
+    stdio: ["ignore", "ignore", "ignore"]
+  });
+  return result.status === 0;
+}
+async function waitUntilUnloaded(timeoutMs = 5e3) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!isLoaded()) return;
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 200));
+  }
+  throw new Error(`launchd service \u672A\u5728 ${timeoutMs}ms \u5185\u5378\u8F7D\u5B8C\u6210`);
+}
+async function ensureLogFiles() {
+  await mkdir4(paths.appDir, { recursive: true });
+  await appendFile(serviceStdoutPath(), "");
+  await appendFile(serviceStderrPath(), "");
+}
+function userTarget() {
+  return `gui/${userInfo2().uid}`;
+}
+function serviceTarget() {
+  return `${userTarget()}/${LAUNCHD_LABEL}`;
+}
+function runLaunchctl(args) {
+  const result = spawnSync("launchctl", args, { encoding: "utf8" });
+  return {
+    ok: result.status === 0,
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? ""
+  };
+}
+function launchctlError(command, result) {
+  const output = [result.stderr.trim(), result.stdout.trim()].filter(Boolean).join("\n");
+  return new Error(`${command} \u5931\u8D25\uFF08exit ${result.status ?? "unknown"}\uFF09${output ? `\uFF1A${output}` : ""}`);
+}
+
+// src/service/adapter.ts
+function getServiceAdapter() {
+  if (process.platform !== "darwin") {
+    throw new Error("service\uFF1A\u5F53\u524D\u5E73\u53F0\u6682\u4E0D\u652F\u6301\uFF0C\u540E\u7EED\u4F1A\u652F\u6301 Windows/systemd\u3002");
+  }
+  return {
+    install: installLaunchd,
+    uninstall: uninstallLaunchd,
+    status: async () => statusLaunchd(),
+    restart: restartLaunchd,
+    logs: tailLaunchdLogs
+  };
+}
+
+// src/service/update.ts
+var execFileP = promisify(execFile);
+var NPM = process.platform === "win32" ? "npm.cmd" : "npm";
+function pkgRoot() {
+  return resolve3(dirname6(fileURLToPath3(import.meta.url)), "..");
+}
+function pkgJson() {
+  try {
+    return JSON.parse(readFileSync2(join8(pkgRoot(), "package.json"), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function currentVersion() {
+  return pkgJson().version ?? "0.0.0";
+}
+function packageName() {
+  return pkgJson().name ?? "@modelzen/feishu-codex-bridge";
+}
+function isDevSource() {
+  return existsSync5(join8(pkgRoot(), ".git"));
+}
+function isNewer(a, b) {
+  const pa = a.split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => Number.parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d > 0;
+  }
+  return false;
+}
+async function latestVersion() {
+  try {
+    const { stdout } = await execFileP(NPM, ["view", packageName(), "version"], { timeout: 2e4 });
+    const v = stdout.trim();
+    return /^\d+\.\d+\.\d+/.test(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+async function installLatest(opts = {}) {
+  const target = `${packageName()}@latest`;
+  return await new Promise((resolveP) => {
+    const child = spawn5(NPM, ["install", "-g", target], {
+      stdio: opts.inherit ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"]
+    });
+    let out = "";
+    if (!opts.inherit) {
+      child.stdout?.on("data", (d) => out += d);
+      child.stderr?.on("data", (d) => out += d);
+    }
+    child.on("error", (e) => resolveP({ ok: false, message: e.message }));
+    child.on("close", (code) => {
+      const tail = out.trim().slice(-600);
+      resolveP({ ok: code === 0, message: opts.inherit ? `\u9000\u51FA\u7801 ${code}` : tail || `\u9000\u51FA\u7801 ${code}` });
+    });
+  });
+}
+function daemonRunning() {
+  try {
+    return statusLaunchd().loaded;
+  } catch {
+    return false;
+  }
+}
+async function restartDaemon() {
+  await getServiceAdapter().restart();
+}
+
 // src/project/registry.ts
-import { mkdir as mkdir4, readFile as readFile5, rename as rename4, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4 } from "path";
+import { mkdir as mkdir5, readFile as readFile5, rename as rename4, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname7 } from "path";
 var FILE_VERSION2 = 1;
 async function read() {
   try {
@@ -2803,10 +3222,10 @@ async function read() {
   }
 }
 async function write(projects) {
-  await mkdir4(dirname4(paths.projectsFile), { recursive: true });
+  await mkdir5(dirname7(paths.projectsFile), { recursive: true });
   const tmp = `${paths.projectsFile}.tmp-${process.pid}`;
   const body = { version: FILE_VERSION2, projects };
-  await writeFile4(tmp, `${JSON.stringify(body, null, 2)}
+  await writeFile5(tmp, `${JSON.stringify(body, null, 2)}
 `, "utf8");
   await rename4(tmp, paths.projectsFile);
 }
@@ -2847,14 +3266,14 @@ async function removeProject(name) {
 }
 
 // src/project/lifecycle.ts
-import { mkdir as mkdir5 } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
-import { isAbsolute, join as join7, resolve } from "path";
+import { mkdir as mkdir6 } from "fs/promises";
+import { existsSync as existsSync6 } from "fs";
+import { isAbsolute, join as join9, resolve as resolve4 } from "path";
 
 // src/project/git-info.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync = promisify2(execFile2);
 async function currentBranch(cwd) {
   try {
     const { stdout } = await execFileAsync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
@@ -2987,20 +3406,25 @@ async function createProject(channel, input2) {
   let cwd;
   let blank;
   if (input2.existingPath) {
-    cwd = isAbsolute(input2.existingPath) ? input2.existingPath : resolve(input2.existingPath);
-    if (!existsSync4(cwd)) throw new Error(`\u6587\u4EF6\u5939\u4E0D\u5B58\u5728\uFF1A${cwd}`);
+    cwd = isAbsolute(input2.existingPath) ? input2.existingPath : resolve4(input2.existingPath);
+    if (!existsSync6(cwd)) throw new Error(`\u6587\u4EF6\u5939\u4E0D\u5B58\u5728\uFF1A${cwd}`);
     blank = false;
   } else {
-    cwd = join7(paths.projectsRootDir, name);
-    await mkdir5(cwd, { recursive: true });
+    cwd = join9(paths.projectsRootDir, name);
+    await mkdir6(cwd, { recursive: true });
     blank = true;
   }
   const res = await channel.rawClient.im.v1.chat.create({
-    params: { user_id_type: "open_id", set_bot_manager: true },
+    params: { user_id_type: "open_id" },
     data: { name, user_id_list: [input2.ownerOpenId] }
   });
   const chatId = res.data?.chat_id;
   if (!chatId) throw new Error(`\u5EFA\u7FA4\u5931\u8D25\uFF1A${JSON.stringify(res).slice(0, 200)}`);
+  await channel.rawClient.im.v1.chatManagers.addManagers({
+    path: { chat_id: chatId },
+    params: { member_id_type: "open_id" },
+    data: { manager_ids: [input2.ownerOpenId] }
+  }).catch((err) => log.fail("project", err, { phase: "add-manager" }));
   const project = { name, chatId, cwd, blank, createdAt: Date.now(), kind: input2.kind ?? "multi" };
   await addProject(project);
   log.info("project", "create", { name, chatId, cwd, blank });
@@ -3020,8 +3444,8 @@ async function transferOwnership(channel, chatId, toOpenId) {
 }
 
 // src/bot/session-store.ts
-import { mkdir as mkdir6, readFile as readFile6, rename as rename5, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5 } from "path";
+import { mkdir as mkdir7, readFile as readFile6, rename as rename5, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname8 } from "path";
 var FILE_VERSION3 = 1;
 async function read2() {
   try {
@@ -3034,10 +3458,10 @@ async function read2() {
   }
 }
 async function write2(sessions) {
-  await mkdir6(dirname5(paths.sessionsFile), { recursive: true });
+  await mkdir7(dirname8(paths.sessionsFile), { recursive: true });
   const tmp = `${paths.sessionsFile}.tmp-${process.pid}`;
   const body = { version: FILE_VERSION3, sessions };
-  await writeFile5(tmp, `${JSON.stringify(body, null, 2)}
+  await writeFile6(tmp, `${JSON.stringify(body, null, 2)}
 `, "utf8");
   await rename5(tmp, paths.sessionsFile);
 }
@@ -3777,16 +4201,74 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
     if (dmAdmin(evt.operator?.openId)) await patch(evt, buildSettingsCard(cfg));
   }).on(DM.doctor, async ({ evt }) => {
     if (!dmAdmin(evt.operator?.openId)) return;
-    const ok = await backend.isAvailable().catch(() => false);
-    const conn = channel.getConnectionStatus?.()?.state ?? "unknown";
-    await channel.send(evt.chatId, { markdown: `\u{1FA7A} **\u8BCA\u65AD**
-- codex: ${ok ? "\u2705 \u53EF\u7528" : "\u274C \u4E0D\u53EF\u7528\uFF08\u68C0\u67E5 CODEX_BIN/PATH\uFF09"}
-- \u957F\u8FDE\u63A5: ${conn}` }, { replyTo: evt.messageId }).catch(() => void 0);
+    const codexBin = resolveCodexBin();
+    const info = {
+      codexOk: await backend.isAvailable().catch(() => false),
+      codexVer: codexBin ? codexVersion(codexBin) : null,
+      conn: channel.getConnectionStatus?.()?.state ?? "unknown",
+      bridgeVer: bridgeVersion(),
+      node: process.version,
+      platform: `${process.platform}-${process.arch}`,
+      logStdout: serviceStdoutPath(),
+      logStderr: serviceStderrPath(),
+      configFile: paths.configFile
+    };
+    await sendManagedCard(channel, evt.chatId, buildDoctorCard(info), evt.messageId).catch(
+      (err) => log.fail("console", err, { cmd: "doctor" })
+    );
   }).on(DM.reconnect, async ({ evt }) => {
     if (!dmAdmin(evt.operator?.openId)) return;
     const conn = channel.getConnectionStatus?.()?.state ?? "unknown";
     await channel.send(evt.chatId, { markdown: `\u{1F504} \u957F\u8FDE\u63A5\u72B6\u6001\uFF1A**${conn}**
 SDK \u4F1A\u81EA\u52A8\u91CD\u8FDE\uFF1B\u82E5\u957F\u671F\u65AD\u5F00\uFF0C\u8BF7\u5728\u7EC8\u7AEF\u91CD\u8DD1 \`feishu-codex-bridge run\`\uFF08\u524D\u53F0\uFF09\u6216 \`feishu-codex-bridge restart\`\uFF08\u540E\u53F0\u5B88\u62A4\uFF09\u3002` }, { replyTo: evt.messageId }).catch(() => void 0);
+  }).on(DM.update, ({ evt }) => {
+    if (!dmAdmin(evt.operator?.openId)) return;
+    void (async () => {
+      await new Promise((r) => setTimeout(r, CARD_SETTLE_MS));
+      await updateManagedCard(channel, evt.messageId, buildUpdateCard({ phase: "checking" })).catch(
+        () => void 0
+      );
+      const current = currentVersion();
+      const latest = await latestVersion().catch(() => null);
+      const hasUpdate = !!latest && isNewer(latest, current);
+      log.info("console", "update-check", { current, latest, hasUpdate });
+      await updateManagedCard(
+        channel,
+        evt.messageId,
+        buildUpdateCard({ phase: "checked", current, latest, hasUpdate, dev: isDevSource() })
+      ).catch((e) => log.fail("console", e, { phase: "update-check" }));
+    })();
+  }).on(DM.updateDo, ({ evt }) => {
+    if (!dmAdmin(evt.operator?.openId)) return;
+    void (async () => {
+      await new Promise((r) => setTimeout(r, CARD_SETTLE_MS));
+      const from = currentVersion();
+      await updateManagedCard(channel, evt.messageId, buildUpdateCard({ phase: "updating", from })).catch(
+        () => void 0
+      );
+      const res = await installLatest();
+      if (!res.ok) {
+        log.info("console", "update-failed", { from });
+        await updateManagedCard(
+          channel,
+          evt.messageId,
+          buildUpdateCard({ phase: "error", from, message: res.message })
+        ).catch((e) => log.fail("console", e, { phase: "update-error" }));
+        return;
+      }
+      const to = currentVersion();
+      const willRestart = daemonRunning();
+      log.info("console", "update-done", { from, to, willRestart });
+      await updateManagedCard(
+        channel,
+        evt.messageId,
+        buildUpdateCard({ phase: "done", from, to, willRestart })
+      ).catch((e) => log.fail("console", e, { phase: "update-done" }));
+      if (willRestart) {
+        await new Promise((r) => setTimeout(r, 800));
+        await restartDaemon().catch((e) => log.fail("console", e, { phase: "update-restart" }));
+      }
+    })();
   }).on(DM.rmConfirm, async ({ evt, value }) => {
     const name = typeof value.n === "string" ? value.n : void 0;
     if (!dmAdmin(evt.operator?.openId) || !name) return;
@@ -4192,8 +4674,8 @@ async function startBridge(opts) {
 }
 
 // src/core/single-instance.ts
-import { mkdirSync as mkdirSync2, readFileSync, unlinkSync, writeFileSync } from "fs";
-import { dirname as dirname6 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync } from "fs";
+import { dirname as dirname9 } from "path";
 var BridgeAlreadyRunningError = class extends Error {
   constructor(pid) {
     super(
@@ -4215,20 +4697,20 @@ function isAlive(pid) {
 function acquireSingleInstanceLock(appId) {
   const file = paths.processesFile;
   try {
-    const rec = JSON.parse(readFileSync(file, "utf8"));
+    const rec = JSON.parse(readFileSync3(file, "utf8"));
     if (rec.pid && rec.pid !== process.pid && rec.appId === appId && isAlive(rec.pid)) {
       throw new BridgeAlreadyRunningError(rec.pid);
     }
   } catch (err) {
     if (err instanceof BridgeAlreadyRunningError) throw err;
   }
-  mkdirSync2(dirname6(file), { recursive: true });
+  mkdirSync2(dirname9(file), { recursive: true });
   const record = { pid: process.pid, appId, startedAt: Date.now() };
   writeFileSync(file, `${JSON.stringify(record)}
 `, "utf8");
   const release = () => {
     try {
-      const rec = JSON.parse(readFileSync(file, "utf8"));
+      const rec = JSON.parse(readFileSync3(file, "utf8"));
       if (rec.pid === process.pid) unlinkSync(file);
     } catch {
     }
@@ -4279,187 +4761,6 @@ async function runRun() {
   });
 }
 
-// src/service/launchd.ts
-import { spawn as spawn4, spawnSync } from "child_process";
-import { existsSync as existsSync5 } from "fs";
-import { appendFile, mkdir as mkdir7, rm as rm2, writeFile as writeFile6 } from "fs/promises";
-import { homedir as homedir3, userInfo as userInfo2 } from "os";
-import { dirname as dirname7, join as join8, resolve as resolve2 } from "path";
-import { fileURLToPath } from "url";
-var LAUNCHD_LABEL = "ai.feishu-codex-bridge.bot";
-function launchAgentPlistPath() {
-  return join8(homedir3(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-}
-function serviceStdoutPath() {
-  return join8(paths.appDir, "service.log");
-}
-function serviceStderrPath() {
-  return join8(paths.appDir, "service.err.log");
-}
-function resolveCliBinPath() {
-  const distDir = dirname7(fileURLToPath(import.meta.url));
-  return resolve2(distDir, "..", "bin", "feishu-codex-bridge.mjs");
-}
-function escapeXml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function buildPlist() {
-  const nodePath = process.execPath;
-  const cliBinPath = resolveCliBinPath();
-  const pathEnv = process.env.PATH ?? "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin";
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${LAUNCHD_LABEL}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>${escapeXml(nodePath)}</string>
-    <string>${escapeXml(cliBinPath)}</string>
-    <string>run</string>
-  </array>
-  <key>RunAtLoad</key>
-  <true/>
-  <key>KeepAlive</key>
-  <true/>
-  <key>StandardOutPath</key>
-  <string>${escapeXml(serviceStdoutPath())}</string>
-  <key>StandardErrorPath</key>
-  <string>${escapeXml(serviceStderrPath())}</string>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>PATH</key>
-    <string>${escapeXml(pathEnv)}</string>
-  </dict>
-</dict>
-</plist>
-`;
-}
-async function installLaunchd() {
-  const plistPath = launchAgentPlistPath();
-  await mkdir7(dirname7(plistPath), { recursive: true });
-  await ensureLogFiles();
-  await writeFile6(plistPath, buildPlist(), "utf8");
-  if (isLoaded()) {
-    const bootout = runLaunchctl(["bootout", serviceTarget()]);
-    if (!bootout.ok) throw launchctlError("launchctl bootout", bootout);
-    await waitUntilUnloaded();
-  }
-  const bootstrap = runLaunchctl(["bootstrap", userTarget(), plistPath]);
-  if (!bootstrap.ok) throw launchctlError("launchctl bootstrap", bootstrap);
-  return statusLaunchd();
-}
-async function uninstallLaunchd() {
-  if (isLoaded()) {
-    const bootout = runLaunchctl(["bootout", serviceTarget()]);
-    if (!bootout.ok) throw launchctlError("launchctl bootout", bootout);
-    await waitUntilUnloaded();
-  }
-  await rm2(launchAgentPlistPath(), { force: true });
-}
-async function restartLaunchd() {
-  if (!existsSync5(launchAgentPlistPath())) {
-    throw new Error(`launchd service \u672A\u5B89\u88C5\uFF1A${launchAgentPlistPath()}`);
-  }
-  if (isLoaded()) {
-    const bootout = runLaunchctl(["bootout", serviceTarget()]);
-    if (!bootout.ok) throw launchctlError("launchctl bootout", bootout);
-    await waitUntilUnloaded();
-  }
-  const bootstrap = runLaunchctl(["bootstrap", userTarget(), launchAgentPlistPath()]);
-  if (!bootstrap.ok) throw launchctlError("launchctl bootstrap", bootstrap);
-  return statusLaunchd();
-}
-function statusLaunchd() {
-  const result = runLaunchctl(["print", serviceTarget()]);
-  const raw = result.stdout || result.stderr;
-  const parsed = parseLaunchdStatus(raw);
-  return {
-    installed: existsSync5(launchAgentPlistPath()),
-    loaded: result.ok,
-    plistPath: launchAgentPlistPath(),
-    stdoutPath: serviceStdoutPath(),
-    stderrPath: serviceStderrPath(),
-    pid: parsed.pid,
-    lastExit: parsed.lastExit,
-    raw
-  };
-}
-async function tailLaunchdLogs(follow) {
-  await ensureLogFiles();
-  const args = follow ? ["-f", serviceStdoutPath(), serviceStderrPath()] : ["-n", "100", serviceStdoutPath(), serviceStderrPath()];
-  await new Promise((resolvePromise, reject) => {
-    const child = spawn4("tail", args, { stdio: "inherit" });
-    child.on("error", reject);
-    child.on("close", (code) => {
-      if (code === 0 || follow && code === null) {
-        resolvePromise();
-        return;
-      }
-      reject(new Error(`tail \u9000\u51FA\u7801 ${code ?? "unknown"}`));
-    });
-  });
-}
-function parseLaunchdStatus(text) {
-  return {
-    pid: text.match(/\bpid\s*=\s*(\d+)/)?.[1],
-    lastExit: text.match(/last exit code\s*=\s*(-?\d+)/i)?.[1]
-  };
-}
-function isLoaded() {
-  const result = spawnSync("launchctl", ["print", serviceTarget()], {
-    stdio: ["ignore", "ignore", "ignore"]
-  });
-  return result.status === 0;
-}
-async function waitUntilUnloaded(timeoutMs = 5e3) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (!isLoaded()) return;
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, 200));
-  }
-  throw new Error(`launchd service \u672A\u5728 ${timeoutMs}ms \u5185\u5378\u8F7D\u5B8C\u6210`);
-}
-async function ensureLogFiles() {
-  await mkdir7(paths.appDir, { recursive: true });
-  await appendFile(serviceStdoutPath(), "");
-  await appendFile(serviceStderrPath(), "");
-}
-function userTarget() {
-  return `gui/${userInfo2().uid}`;
-}
-function serviceTarget() {
-  return `${userTarget()}/${LAUNCHD_LABEL}`;
-}
-function runLaunchctl(args) {
-  const result = spawnSync("launchctl", args, { encoding: "utf8" });
-  return {
-    ok: result.status === 0,
-    status: result.status,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? ""
-  };
-}
-function launchctlError(command, result) {
-  const output = [result.stderr.trim(), result.stdout.trim()].filter(Boolean).join("\n");
-  return new Error(`${command} \u5931\u8D25\uFF08exit ${result.status ?? "unknown"}\uFF09${output ? `\uFF1A${output}` : ""}`);
-}
-
-// src/service/adapter.ts
-function getServiceAdapter() {
-  if (process.platform !== "darwin") {
-    throw new Error("service\uFF1A\u5F53\u524D\u5E73\u53F0\u6682\u4E0D\u652F\u6301\uFF0C\u540E\u7EED\u4F1A\u652F\u6301 Windows/systemd\u3002");
-  }
-  return {
-    install: installLaunchd,
-    uninstall: uninstallLaunchd,
-    status: async () => statusLaunchd(),
-    restart: restartLaunchd,
-    logs: tailLaunchdLogs
-  };
-}
-
 // src/cli/commands/daemon.ts
 async function runStart() {
   const ready = await ensureOnboarded({ allowCreate: true });
@@ -4505,6 +4806,54 @@ function printStatus(status) {
   }
 }
 
+// src/cli/commands/update.ts
+async function runUpdate(opts = {}) {
+  const pkg = packageName();
+  const current = currentVersion();
+  console.log(`\u5F53\u524D\u7248\u672C\uFF1Av${current}`);
+  console.log("\u67E5\u8BE2\u6700\u65B0\u7248\u672C\u2026");
+  const latest = await latestVersion();
+  if (!latest) {
+    console.log("\u26A0\uFE0F \u67E5\u4E0D\u5230\u6700\u65B0\u7248\u672C\uFF08\u7F51\u7EDC\u6216 npm registry \u95EE\u9898\uFF09\u3002");
+    process.exitCode = 1;
+    return;
+  }
+  if (!isNewer(latest, current)) {
+    console.log(`\u2713 \u5DF2\u662F\u6700\u65B0\u7248\u672C\uFF08v${current}\uFF09\u3002`);
+    return;
+  }
+  console.log(`\u53D1\u73B0\u65B0\u7248\u672C\uFF1Av${current} \u2192 v${latest}`);
+  if (opts.check) {
+    console.log("\u8FD0\u884C `feishu-codex-bridge update` \u5B89\u88C5\u66F4\u65B0\u3002");
+    return;
+  }
+  if (isDevSource()) {
+    console.log("\u68C0\u6D4B\u5230\u6E90\u7801\u5F00\u53D1\u6A21\u5F0F\uFF08\u4ED3\u5E93\u5185\u6709 .git\uFF09\u3002\u8BF7\u7528\uFF1Agit pull && npm i \u2014\u2014 \u8DF3\u8FC7\u5168\u5C40\u5B89\u88C5\u3002");
+    return;
+  }
+  console.log(`\u5F00\u59CB\u5168\u5C40\u5B89\u88C5\u6700\u65B0\u7248\uFF08npm i -g ${pkg}@latest\uFF09\u2026`);
+  const res = await installLatest({ inherit: true });
+  if (!res.ok) {
+    console.log(`\u274C \u5B89\u88C5\u5931\u8D25\uFF1A${res.message}`);
+    console.log(`\u53EF\u5728\u7EC8\u7AEF\u624B\u52A8\u6267\u884C\uFF1Anpm i -g ${pkg}@latest`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(`\u2713 \u5DF2\u66F4\u65B0\u5230 v${latest}`);
+  if (daemonRunning()) {
+    console.log("\u91CD\u542F\u540E\u53F0\u670D\u52A1\u4EE5\u52A0\u8F7D\u65B0\u7248\u672C\u2026");
+    try {
+      await restartDaemon();
+      console.log("\u2713 \u540E\u53F0\u670D\u52A1\u5DF2\u91CD\u542F\uFF0C\u65B0\u7248\u672C\u5DF2\u751F\u6548\u3002");
+    } catch (err) {
+      console.log(`\u26A0\uFE0F \u81EA\u52A8\u91CD\u542F\u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}`);
+      console.log("\u8BF7\u624B\u52A8\u6267\u884C\uFF1Afeishu-codex-bridge restart");
+    }
+  } else {
+    console.log("\u672A\u68C0\u6D4B\u5230\u8FD0\u884C\u4E2D\u7684\u540E\u53F0 daemon\uFF1B\u4E0B\u6B21 `start` / `run` \u5373\u7528\u65B0\u7248\u672C\u3002");
+  }
+}
+
 // src/cli/commands/bot.ts
 import { rm as rm3 } from "fs/promises";
 async function runBotInit(name) {
@@ -4618,29 +4967,21 @@ async function secretsRemove(id) {
   console.log(ok ? `\u2713 \u5DF2\u5220\u9664: ${id}` : `\u672A\u627E\u5230: ${id}`);
 }
 function readStdin() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let data = "";
     if (process.stdin.isTTY) {
-      resolve4("");
+      resolve5("");
       return;
     }
     process.stdin.setEncoding("utf8");
     process.stdin.on("data", (c) => data += c);
-    process.stdin.on("end", () => resolve4(data));
+    process.stdin.on("end", () => resolve5(data));
   });
 }
 
 // src/cli/index.ts
 var program = new Command();
-function readVersion() {
-  try {
-    const pkgPath = resolve3(dirname8(fileURLToPath2(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync2(pkgPath, "utf8")).version ?? "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
-program.name("feishu-codex-bridge").description("\u628A\u98DE\u4E66/Lark \u6865\u63A5\u5230\u672C\u673A Codex\uFF08\u9879\u76EE=\u7FA4, \u8BDD\u9898=\u4F1A\u8BDD\uFF09").version(readVersion());
+program.name("feishu-codex-bridge").description("\u628A\u98DE\u4E66/Lark \u6865\u63A5\u5230\u672C\u673A Codex\uFF08\u9879\u76EE=\u7FA4, \u8BDD\u9898=\u4F1A\u8BDD\uFF09").version(bridgeVersion());
 program.command("run").description("\u524D\u53F0\u542F\u52A8 bot\uFF08\u6CA1\u914D\u7F6E\u5219\u5148\u626B\u7801 init\uFF1BCtrl+C \u4F18\u96C5\u9000\u51FA\uFF09").action(async () => {
   await runRun();
 });
@@ -4659,6 +5000,9 @@ program.command("status").description("\u540E\u53F0 daemon \u72B6\u6001\uFF08pid
 program.command("logs").description("\u67E5\u770B\u540E\u53F0 daemon \u65E5\u5FD7").option("-f, --follow", "\u6301\u7EED\u8DDF\u968F\u65E5\u5FD7").action(async (options) => {
   await runLogs(Boolean(options.follow));
 });
+program.command("update").description("\u66F4\u65B0\u5230\u6700\u65B0\u7248\uFF08npm i -g\uFF09\uFF0C\u5E76\u81EA\u52A8\u91CD\u542F\u540E\u53F0 daemon").option("--check", "\u53EA\u68C0\u67E5\u6709\u65E0\u65B0\u7248\uFF0C\u4E0D\u5B89\u88C5").action(async (options) => {
+  await runUpdate({ check: Boolean(options.check) });
+});
 var bot = program.command("bot").description("\u98DE\u4E66\u673A\u5668\u4EBA\u7BA1\u7406\uFF08\u591A\u673A\u5668\u4EBA\uFF09");
 bot.command("init [name]").description("\u6CE8\u518C\u4E00\u4E2A\u98DE\u4E66\u673A\u5668\u4EBA\u5E76\u6388\u6743\uFF08\u53EF\u9009\u77ED\u540D\uFF09").action(async (name) => {
   await runBotInit(name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelzen/feishu-codex-bridge",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Bridge Feishu/Lark messenger with local Codex via app-server (project=group, thread=session)",
   "type": "module",
   "bin": {