@modelzen/feishu-codex-bridge 0.3.3 → 0.3.5

package/README.md

@@ -30,7 +30,8 @@
 - **流式卡片**：推理 / 命令 / 文件改动 / 结果实时刷新到一张可折叠卡片。
 - **免 @ 对话**：项目群话题内可直接说话、不必每次 @（可逐群开关）。
 - **文档评论回复（可选）**：在飞书云文档（doc/docx/sheet/file，含知识库 wiki）的评论里 **@机器人**，它会读评论、跑 Codex、把答案回到同一条评论线程里；每篇文档一条连续会话。需额外开通文档评论权限并订阅评论事件（见下方配置）。
-- **私聊控制台**：私聊机器人弹交互菜单 —— 新建项目、项目列表、设置、诊断、重连。
+- **私聊控制台**：私聊机器人弹交互菜单 —— 新建项目、项目列表、设置、用量、诊断、重连。
+- **📊 Codex 用量**：5 小时 / 7 天限额进度（剩余 % + 重置时间）、lifetime tokens、连续使用天数、GitHub 风格每日用量热力图；一键生成**战绩分享卡**，可原生转发给任何人或群（数据来自 Codex 个人资料页同款接口，需 ChatGPT 登录）。
 - **稳定隔离**：每会话独立 app-server 进程；卡死有 watchdog（默认 120s）→ 终止 → 回收，异常不波及其他群。
 - **本地加密密钥库**：飞书应用密钥用 AES-256-GCM 存在 `~/.feishu-codex-bridge/`，不入仓库、不进环境变量。
 - **跨平台常驻**：macOS / Windows / Linux·WSL 均可注册成后台服务、开机或登录自启（分别走 launchd / 登录自启免管理员 / systemd）。注：跨平台指进程运行与后台自启；「项目内只读/读写」隐私沙箱仅 macOS / 原生 Windows 可强制（见[安全须知](#-安全须知)）。
@@ -164,9 +165,11 @@ feishu-codex-bridge bot rm <名>     # 移除一个机器人配置
   - **💬 单会话群**：整群就是**一条连续会话**（全程**免 @**、消息按序排队、无 `/resume`）。适合**个人单线深入**、像私聊一样直接聊。
 - **干活**：在项目群里 **@机器人** 描述需求；机器人在该群绑定的目录里跑 Codex，流式卡片回结果。
 - **话题 = 会话**：对某条消息开话题后，话题内可**免 @** 连续对话，是一条连贯的 Codex 会话。
+- **发图 / 发附件**：直接在消息里**发图片**，Codex 能看到（多模态读图）；**发文件附件**（日志 / PDF / 代码等），桥会把它下载到本地并把**绝对路径**告诉 Codex，让它用工具直接打开分析。⚠️ 附件落在桥的全局临时目录（`~/.feishu-codex-bridge/inbound`，1h 后自动清），**只有「完全访问」档**能读到——「项目内只读 / 读写」档的沙箱把读取锁在项目目录内，读不到该目录。单文件上限 50MB、单条消息最多 9 个；合并转发里的附件飞书官方不支持取，故不支持。
 - **文档评论 @机器人**：在飞书文档评论里 @ 它就回（前提：已开通文档评论权限 + 订阅 `drive.notice.comment_add_v1`，且机器人对该文档有访问权限）。只支持 doc/docx/sheet/file；评论框不渲染 markdown，回复为纯文本，超长会截断。
 - **终止**：卡片上的 **⏹** 随时终止当前轮；卡死超过 watchdog 阈值（默认 120s）自动中止并回收进程。
-- **私聊控制台**：项目列表、设置（模型 / 推理强度 / 免 @ / watchdog / 管理员）、诊断、重连，全在私聊菜单里。
+- **私聊控制台**：项目列表、设置（模型 / 推理强度 / 免 @ / watchdog / 管理员）、用量、诊断、重连，全在私聊菜单里。
+- **📊 用量**：点「用量」看 5h/7d 限额（剩余 % + 重置时间）与 Codex 个人统计（lifetime tokens / streak / 每日热力图）；点「📤 生成分享卡」得到一张可转发的战绩卡——长按（手机）或右键（电脑）即可转发，数据定格在生成时刻。
 
 ---
 

package/dist/cli.js

@@ -68,7 +68,10 @@ var paths = {
    * passes lark-cli's AssertSecurePath audit.
    */
   secretsGetterScript: join(appDir, "secrets-getter"),
-  mediaDir: join(appDir, "media")
+  mediaDir: join(appDir, "media"),
+  /** Inbound file attachments downloaded from chat, handed to codex by absolute
+   * path (codex has no native file input). TTL-pruned like {@link mediaDir}. */
+  inboundDir: join(appDir, "inbound")
 };
 
 // src/config/bots.ts
@@ -2072,6 +2075,7 @@ var RunRender = class {
 // src/card/cards.ts
 function card(elements, opts = {}) {
   const config = { update_multi: true };
+  if (opts.forward === false) config.enable_forward = false;
   if (opts.streaming) {
     config.streaming_mode = true;
     config.streaming_config = {
@@ -3268,6 +3272,12 @@ var DM = {
   reconnect: "dm.reconnect",
   update: "dm.update",
   updateDo: "dm.update.do",
+  // 📊 Codex 用量（限额 + 个人资料统计 + 热力图）；share 打开内容选择卡，
+  // shareDo 按所选区块生成可转发的分享卡
+  usage: "dm.usage",
+  usageRefresh: "dm.usage.refresh",
+  usageShare: "dm.usage.share",
+  usageShareDo: "dm.usage.share.do",
   rmConfirm: "dm.rmConfirm",
   rmDo: "dm.rmDo",
   rmCancel: "dm.rmCancel",
@@ -3308,6 +3318,7 @@ function buildDmMenuCard() {
         button("\u2699\uFE0F \u8BBE\u7F6E", { a: DM.settings })
       ]),
       actions([
+        button("\u{1F4CA} \u7528\u91CF", { a: DM.usage }),
         button("\u{1FA7A} \u8BCA\u65AD", { a: DM.doctor }),
         button("\u{1F504} \u91CD\u8FDE", { a: DM.reconnect }),
         button("\u2B06\uFE0F \u7248\u672C\u66F4\u65B0", { a: DM.update })
@@ -4477,10 +4488,615 @@ async function restartDaemon() {
   await getServiceAdapter().restart();
 }
 
+// src/agent/codex-appserver/usage.ts
+import { readFile as readFile8 } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { join as join12 } from "path";
+var DEFAULT_BASE_URL = "https://chatgpt.com/backend-api";
+var HTTP_TIMEOUT_MS = 15e3;
+var REFRESH_TIMEOUT_MS = 2e4;
+var EXP_SKEW_MS = 6e4;
+var PROFILE_CACHE_MS = 5 * 6e4;
+var USAGE_CACHE_MS = 3e4;
+var UsageError = class extends Error {
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+    this.name = "UsageError";
+  }
+  kind;
+};
+function resolveCodexHome() {
+  return process.env.CODEX_HOME ?? join12(homedir5(), ".codex");
+}
+async function readCodexAuth() {
+  const file = join12(resolveCodexHome(), "auth.json");
+  let lastErr;
+  for (let i = 0; i < 3; i++) {
+    let raw;
+    try {
+      raw = await readFile8(file, "utf8");
+    } catch (err) {
+      throw new UsageError("no-auth", `\u8BFB\u4E0D\u5230 ${file}\uFF1A${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+      const j = JSON.parse(raw);
+      const accessToken = j.tokens?.access_token;
+      if (!accessToken) throw new UsageError("api-key-mode", "auth.json \u6CA1\u6709 ChatGPT access_token\uFF08API-key \u767B\u5F55\u6A21\u5F0F\uFF09");
+      return { accessToken, accountId: j.tokens?.account_id, lastRefresh: j.last_refresh };
+    } catch (err) {
+      if (err instanceof UsageError) throw err;
+      lastErr = err;
+      await new Promise((r) => setTimeout(r, 100));
+    }
+  }
+  throw new UsageError("no-auth", `auth.json \u53CD\u590D\u89E3\u6790\u5931\u8D25\uFF1A${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+}
+function jwtExpMs(token) {
+  const part = token.split(".")[1];
+  if (!part) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp * 1e3 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function chatgptBaseUrl() {
+  try {
+    const raw = await readFile8(join12(resolveCodexHome(), "config.toml"), "utf8");
+    for (const line of raw.split("\n")) {
+      const t = line.trim();
+      if (t.startsWith("[")) break;
+      const m = /^chatgpt_base_url\s*=\s*"([^"]+)"/.exec(t);
+      if (m?.[1]) return m[1].replace(/\/+$/, "");
+    }
+  } catch {
+  }
+  return DEFAULT_BASE_URL;
+}
+var refreshInFlight = null;
+async function refreshViaAppServer() {
+  if (refreshInFlight) return refreshInFlight;
+  refreshInFlight = (async () => {
+    const before = await readCodexAuth().catch(() => void 0);
+    const bin = resolveCodexBin();
+    if (!bin) return null;
+    const client = new AppServerClient({ bin, cwd: process.cwd(), clientName: "feishu-codex-bridge-usage" });
+    let account = void 0;
+    try {
+      await withDeadline2(client.connect(), REFRESH_TIMEOUT_MS, "usage-refresh connect");
+      const res = await withDeadline2(
+        client.request("account/read", { refreshToken: true }),
+        REFRESH_TIMEOUT_MS,
+        "account/read refresh"
+      );
+      account = res?.account;
+    } catch (err) {
+      log.fail("usage", err, { phase: "refresh" });
+      return null;
+    } finally {
+      await client.close().catch(() => void 0);
+    }
+    const after = await readCodexAuth().catch(() => void 0);
+    if (after && after.accessToken !== before?.accessToken) return after;
+    if (account === null) return "permanent-failure";
+    return null;
+  })();
+  try {
+    return await refreshInFlight;
+  } finally {
+    refreshInFlight = null;
+  }
+}
+function withDeadline2(p, ms, label) {
+  return new Promise((resolve7, reject) => {
+    const t = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+    p.then(
+      (v) => {
+        clearTimeout(t);
+        resolve7(v);
+      },
+      (e) => {
+        clearTimeout(t);
+        reject(e);
+      }
+    );
+  });
+}
+async function fetchWham(base, path, auth) {
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), HTTP_TIMEOUT_MS);
+  try {
+    const resp = await fetch(`${base}${path}`, {
+      headers: {
+        Authorization: `Bearer ${auth.accessToken}`,
+        ...auth.accountId ? { "ChatGPT-Account-Id": auth.accountId } : {},
+        "User-Agent": "codex-cli"
+      },
+      signal: ctl.signal
+    });
+    if (!resp.ok) return { status: resp.status };
+    return { status: resp.status, json: await resp.json() };
+  } finally {
+    clearTimeout(t);
+  }
+}
+async function whamGet(path) {
+  let auth = await readCodexAuth();
+  const exp = jwtExpMs(auth.accessToken);
+  if (exp !== void 0 && exp <= Date.now() + EXP_SKEW_MS) {
+    const refreshed = await refreshViaAppServer();
+    if (refreshed === "permanent-failure") throw new UsageError("need-relogin", "Codex \u767B\u5F55\u6001\u5DF2\u5931\u6548");
+    if (refreshed) auth = refreshed;
+    else throw new UsageError("transient", "\u767B\u5F55\u6001\u4E34\u671F\u4E14\u6682\u65F6\u65E0\u6CD5\u5237\u65B0");
+  }
+  const base = await chatgptBaseUrl();
+  const attempt = async (a) => {
+    try {
+      return await fetchWham(base, path, a);
+    } catch (err) {
+      throw new UsageError("transient", `\u8BF7\u6C42\u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}`);
+    }
+  };
+  let res = await attempt(auth);
+  if (res.status === 401) {
+    const fresh = await readCodexAuth();
+    if (fresh.accessToken !== auth.accessToken) {
+      auth = fresh;
+      res = await attempt(auth).catch(() => res);
+    }
+  }
+  if (res.status === 401) {
+    const refreshed = await refreshViaAppServer();
+    if (refreshed === "permanent-failure" || refreshed === null) {
+      throw refreshed === null ? new UsageError("transient", "\u6682\u65F6\u65E0\u6CD5\u5237\u65B0 Codex \u767B\u5F55\u6001") : new UsageError("need-relogin", "Codex \u767B\u5F55\u6001\u5DF2\u5931\u6548");
+    }
+    res = await attempt(refreshed);
+    if (res.status === 401) throw new UsageError("need-relogin", "\u5237\u65B0\u540E\u4ECD 401\uFF0C\u8D26\u53F7\u4FA7\u5DF2\u62D2\u7EDD");
+  }
+  if (res.json === void 0) throw new UsageError("transient", `HTTP ${res.status} (${path})`);
+  return res.json;
+}
+function mapWindow(w) {
+  if (!w || typeof w.used_percent !== "number") return void 0;
+  return {
+    usedPercent: Math.min(100, Math.max(0, w.used_percent)),
+    windowSeconds: w.limit_window_seconds,
+    resetAt: w.reset_at
+  };
+}
+function mapUsageResponse(raw, fetchedAt) {
+  const mapBucket = (rl, name) => ({
+    ...name ? { name } : {},
+    primary: mapWindow(rl?.primary_window),
+    secondary: mapWindow(rl?.secondary_window)
+  });
+  return {
+    planType: raw.plan_type,
+    main: mapBucket(raw.rate_limit),
+    extras: (raw.additional_rate_limits ?? []).filter((x) => x?.rate_limit).map((x) => mapBucket(x.rate_limit, x.limit_name)),
+    fetchedAt
+  };
+}
+function mapProfileResponse(raw) {
+  const s = raw.stats ?? {};
+  return {
+    // 只用 display_name，绝不兜底 username——后者是邮箱 local part，会随可转发的
+    // 分享卡泄出去；display_name 缺失时卡片侧降级「我的」。
+    displayName: raw.profile?.display_name || void 0,
+    lifetimeTokens: s.lifetime_tokens,
+    peakDailyTokens: s.peak_daily_tokens,
+    currentStreakDays: s.current_streak_days,
+    longestStreakDays: s.longest_streak_days,
+    longestTurnSec: s.longest_running_turn_sec,
+    totalThreads: s.total_threads,
+    fastModePct: s.fast_mode_usage_percentage,
+    totalSkillsUsed: s.total_skills_used,
+    uniqueSkillsUsed: s.unique_skills_used,
+    mostUsedEffort: s.most_used_reasoning_effort,
+    mostUsedEffortPct: s.most_used_reasoning_effort_percentage,
+    topInvocations: (s.top_invocations ?? []).map((t) => ({
+      name: t.plugin_name ?? t.skill_name ?? "",
+      count: t.usage_count ?? 0,
+      kind: t.plugin_name ? "plugin" : "skill"
+    })).filter((t) => t.name),
+    dailyBuckets: (s.daily_usage_buckets ?? []).filter((b) => typeof b.start_date === "string").map((b) => ({ date: b.start_date, tokens: b.tokens ?? 0 })),
+    statsAsOf: raw.metadata?.stats_as_of
+  };
+}
+var profileCache = null;
+var usageCache = null;
+async function fetchProfileStats(force = false) {
+  if (!force && profileCache && Date.now() - profileCache.at < PROFILE_CACHE_MS) return profileCache.data;
+  const raw = await whamGet("/wham/profiles/me");
+  const data = mapProfileResponse(raw);
+  profileCache = { at: Date.now(), data };
+  return data;
+}
+async function fetchUsageSnapshot(force = false) {
+  if (!force && usageCache && Date.now() - usageCache.at < USAGE_CACHE_MS) return usageCache.data;
+  const raw = await whamGet("/wham/usage");
+  const data = mapUsageResponse(raw, Date.now());
+  usageCache = { at: Date.now(), data };
+  return data;
+}
+async function fetchUsageBundle(force = false) {
+  const [profile, usage] = await Promise.all([fetchProfileStats(force), fetchUsageSnapshot(force)]);
+  return { profile, usage };
+}
+
+// src/card/usage-cards.ts
+function formatTokensZh(n) {
+  if (n === void 0 || n === null || Number.isNaN(n)) return "\u2014";
+  const fmt = (v) => {
+    const s = v.toFixed(1);
+    return s.endsWith(".0") ? s.slice(0, -2) : s;
+  };
+  if (n >= 1e8) return `${fmt(n / 1e8)}\u4EBF`;
+  if (n >= 1e4) {
+    const s = fmt(n / 1e4);
+    return s === "10000" ? "1\u4EBF" : `${s}\u4E07`;
+  }
+  return n.toLocaleString("en-US");
+}
+function windowLabel(seconds) {
+  if (!seconds) return "\u9650\u989D";
+  if (seconds === 18e3) return "5 \u5C0F\u65F6";
+  if (seconds === 604800) return "7 \u5929";
+  return seconds < 86400 ? `${Math.round(seconds / 3600)} \u5C0F\u65F6` : `${Math.round(seconds / 86400)} \u5929`;
+}
+function resetLabel(resetAtSec, nowMs2 = Date.now()) {
+  const d = new Date(resetAtSec * 1e3);
+  const hm = `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+  const dayKey = (x) => `${x.getFullYear()}-${x.getMonth()}-${x.getDate()}`;
+  const now = new Date(nowMs2);
+  if (dayKey(d) === dayKey(now)) return `\u4ECA\u5929 ${hm}`;
+  const tomorrow = new Date(nowMs2 + 864e5);
+  if (dayKey(d) === dayKey(tomorrow)) return `\u660E\u5929 ${hm}`;
+  return `${d.getMonth() + 1}\u6708${d.getDate()}\u65E5 ${hm}`;
+}
+function localDateStr(d = /* @__PURE__ */ new Date()) {
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
+}
+function toEpochDay(date) {
+  const [y = 1970, m = 1, d = 1] = date.split("-").map(Number);
+  return Date.UTC(y, m - 1, d) / 864e5;
+}
+function fromEpochDay(day) {
+  const d = new Date(day * 864e5);
+  return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, "0")}-${String(d.getUTCDate()).padStart(2, "0")}`;
+}
+function mondayOf(day) {
+  const dow = new Date(day * 864e5).getUTCDay();
+  return day - (dow + 6) % 7;
+}
+var DAY_LABELS = ["\u4E00", "\u4E8C", "\u4E09", "\u56DB", "\u4E94", "\u516D", "\u65E5"];
+function heatmapCells(buckets, today = localDateStr(), weeks = 14) {
+  const todayDay = toEpochDay(today);
+  const tokensByDay = /* @__PURE__ */ new Map();
+  for (const b of buckets) tokensByDay.set(toEpochDay(b.date), b.tokens);
+  const startMonday = mondayOf(todayDay) - (weeks - 1) * 7;
+  const weekLabel = (c) => {
+    const d = new Date((startMonday + c * 7) * 864e5);
+    return `${d.getUTCMonth() + 1}/${d.getUTCDate()}`;
+  };
+  const values = [];
+  for (let c = 0; c < weeks; c++) {
+    for (let r = 0; r < 7; r++) {
+      const day = startMonday + c * 7 + r;
+      if (day > todayDay) continue;
+      const v = tokensByDay.get(day) ?? 0;
+      const d = new Date(day * 864e5);
+      const date = `${d.getUTCMonth() + 1}\u6708${d.getUTCDate()}\u65E5`;
+      const label = v > 0 ? `${date} \u4F7F\u7528\u4E86 ${formatTokensZh(v)} Token` : `${date} \u65E0\u7528\u91CF`;
+      values.push({ week: weekLabel(c), day: DAY_LABELS[r] ?? "", value: v, label });
+    }
+  }
+  return { values, startDate: fromEpochDay(startMonday), endDate: today, weeks };
+}
+var HEAT_RANGE = ["#ebedf0", "#bbdefb", "#64b5f6", "#1e88e5", "#0d47a1"];
+var ROUNDED_CELL = "M -0.5 -0.25 Q -0.5 -0.5 -0.25 -0.5 L 0.25 -0.5 Q 0.5 -0.5 0.5 -0.25 L 0.5 0.25 Q 0.5 0.5 0.25 0.5 L -0.25 0.5 Q -0.5 0.5 -0.5 0.25 Z";
+function heatmapChartEl(buckets, today) {
+  const h = heatmapCells(buckets, today);
+  return {
+    tag: "chart",
+    aspect_ratio: "2:1",
+    chart_spec: {
+      type: "common",
+      padding: 4,
+      data: [{ id: "usage", values: h.values }],
+      series: [
+        {
+          type: "heatmap",
+          xField: "week",
+          yField: "day",
+          valueField: "label",
+          cell: { style: { fill: { field: "value", scale: "color" }, shape: ROUNDED_CELL } }
+        }
+      ],
+      color: { type: "linear", domain: [{ dataId: "usage", fields: ["value"] }], range: HEAT_RANGE },
+      axes: [
+        {
+          orient: "bottom",
+          type: "band",
+          bandPadding: 0.25,
+          domainLine: { visible: false },
+          tick: { visible: false }
+        },
+        {
+          orient: "left",
+          type: "band",
+          bandPadding: 0.25,
+          domainLine: { visible: false },
+          tick: { visible: false },
+          label: { visible: false }
+        }
+      ],
+      legends: { visible: false },
+      tooltip: { visible: true, mark: { title: { visible: false } } }
+    }
+  };
+}
+function planLabel(plan) {
+  if (!plan) return void 0;
+  const m = {
+    free: "Free",
+    go: "Go",
+    plus: "Plus",
+    pro: "Pro",
+    prolite: "Pro Lite",
+    team: "Team",
+    business: "Business",
+    enterprise: "Enterprise",
+    edu: "Edu",
+    education: "Edu"
+  };
+  return m[plan] ?? plan.charAt(0).toUpperCase() + plan.slice(1);
+}
+function formatDurationZh(seconds) {
+  if (seconds === void 0 || seconds === null || Number.isNaN(seconds) || seconds < 0) return "\u2014";
+  const mins = Math.round(seconds / 60);
+  if (mins < 60) return `${mins} \u5206`;
+  const h = Math.floor(mins / 60);
+  const rem = mins % 60;
+  return rem ? `${h} \u5C0F\u65F6 ${rem} \u5206` : `${h} \u5C0F\u65F6`;
+}
+var remainingPct = (w) => Math.max(0, 100 - w.usedPercent);
+function progressChartEl(w) {
+  const label = `${windowLabel(w.windowSeconds)}\u5269\u4F59`;
+  return {
+    tag: "chart",
+    height: "40px",
+    chart_spec: {
+      type: "linearProgress",
+      data: [{ id: "p", values: [{ type: label, value: remainingPct(w) / 100 }] }],
+      xField: "value",
+      yField: "type",
+      cornerRadius: 8,
+      bandWidth: 12,
+      axes: [
+        { orient: "left", type: "band", visible: false },
+        { orient: "bottom", type: "linear", visible: false }
+      ],
+      tooltip: {
+        visible: true,
+        mark: { title: { visible: false }, content: [{ key: label, value: `${remainingPct(w)}%` }] }
+      }
+    }
+  };
+}
+function rateLimitElements(bucket, nowMs2) {
+  const out = [];
+  const icons = ["\u26A1", "\u{1F4C5}"];
+  [bucket.primary, bucket.secondary].forEach((w, i) => {
+    if (!w) return;
+    const reset = w.resetAt ? `\u3000<font color='grey'>${resetLabel(w.resetAt, nowMs2)} \u91CD\u7F6E</font>` : "";
+    out.push(md(`${icons[i]} **${windowLabel(w.windowSeconds)}\u9650\u989D**\u3000\u5269\u4F59 ${remainingPct(w)}%${reset}`));
+    out.push(progressChartEl(w));
+  });
+  if (!out.length) return [note("\u6682\u65E0\u9650\u989D\u6570\u636E")];
+  return out;
+}
+function statColumns(items) {
+  return {
+    tag: "column_set",
+    flex_mode: "flow",
+    horizontal_spacing: "large",
+    columns: items.map((it) => ({
+      tag: "column",
+      width: "auto",
+      elements: [
+        { tag: "markdown", content: `**${it.value}**`, text_size: "heading" },
+        noteMd(it.label)
+      ]
+    }))
+  };
+}
+function profileStatItems(p) {
+  return [
+    { value: formatTokensZh(p.lifetimeTokens), label: "\u7D2F\u8BA1 Token \u6570" },
+    { value: formatTokensZh(p.peakDailyTokens), label: "\u5CF0\u503C Token \u6570" },
+    { value: formatDurationZh(p.longestTurnSec), label: "\u6700\u957F\u4EFB\u52A1\u65F6\u957F" },
+    { value: p.currentStreakDays !== void 0 ? `${p.currentStreakDays} \u5929` : "\u2014", label: "\u5F53\u524D\u8FDE\u7EED\u5929\u6570" },
+    { value: p.longestStreakDays !== void 0 ? `${p.longestStreakDays} \u5929` : "\u2014", label: "\u6700\u957F\u8FDE\u7EED\u5929\u6570" }
+  ];
+}
+function heatmapElements(p, today) {
+  return [md("\u{1F4C8} **\u6BCF\u65E5 Token \u7528\u91CF**"), heatmapChartEl(p.dailyBuckets, today)];
+}
+function effortLabel(effort) {
+  const m = { minimal: "\u6781\u4F4E", low: "\u4F4E", medium: "\u4E2D", high: "\u9AD8", xhigh: "\u8D85\u9AD8" };
+  return m[effort] ?? effort;
+}
+function insightsElements(p) {
+  const left = [];
+  if (p.fastModePct !== void 0) left.push(`Fast Mode\u3000**${Math.round(p.fastModePct)}%**`);
+  if (p.mostUsedEffort) {
+    const pct = p.mostUsedEffortPct !== void 0 ? ` \xB7 ${Math.round(p.mostUsedEffortPct)}%` : "";
+    left.push(`\u6700\u5E38\u7528\u63A8\u7406\u3000**${effortLabel(p.mostUsedEffort)}${pct}**`);
+  }
+  if (p.uniqueSkillsUsed !== void 0) left.push(`\u4F7F\u7528\u8FC7\u7684\u6280\u80FD\u3000**${p.uniqueSkillsUsed}**`);
+  if (p.totalSkillsUsed !== void 0) left.push(`\u6280\u80FD\u8C03\u7528\u603B\u6570\u3000**${p.totalSkillsUsed.toLocaleString("en-US")}**`);
+  if (p.totalThreads !== void 0) left.push(`\u4F1A\u8BDD\u603B\u6570\u3000**${p.totalThreads.toLocaleString("en-US")}**`);
+  const right = p.topInvocations.slice(0, 5).map((t) => `${t.kind === "plugin" ? "@" : "$"}${t.name}\u3000**\xD7${t.count}**`);
+  const col = (title, lines) => ({
+    tag: "column",
+    width: "weighted",
+    weight: 1,
+    elements: [md(`**${title}**`), noteMd(lines.join("\n"))]
+  });
+  const columns = [];
+  if (left.length) columns.push(col("\u6D3B\u52A8\u6D1E\u5BDF", left));
+  if (right.length) columns.push(col("\u5E38\u7528\u63D2\u4EF6 / \u6280\u80FD", right));
+  if (!columns.length) return [];
+  return [
+    { tag: "column_set", flex_mode: columns.length === 2 ? "bisect" : "stretch", horizontal_spacing: "large", columns }
+  ];
+}
+function joinWithHr(blocks) {
+  const present = blocks.filter((b) => b.length);
+  const out = [];
+  present.forEach((b, i) => {
+    if (i) out.push(hr());
+    out.push(...b);
+  });
+  return out;
+}
+var usageButtons = () => actions([
+  button("\u{1F504} \u5237\u65B0", { a: DM.usageRefresh }),
+  button("\u{1F4E4} \u751F\u6210\u5206\u4EAB\u5361", { a: DM.usageShare }, "primary"),
+  button("\u2B05\uFE0F \u83DC\u5355", { a: DM.menu })
+]);
+var ERROR_COPY = {
+  "no-auth": {
+    title: "\u672A\u627E\u5230 Codex \u767B\u5F55\u6001",
+    hint: "\u672C\u673A\u6CA1\u6709\u53EF\u8BFB\u7684 `~/.codex/auth.json`\uFF0C\u8BF7\u5728\u5BBF\u4E3B\u673A\u7EC8\u7AEF\u8FD0\u884C `codex login` \u540E\u91CD\u8BD5\u3002"
+  },
+  "api-key-mode": {
+    title: "\u5F53\u524D\u662F API-key \u767B\u5F55\u6A21\u5F0F",
+    hint: "\u7528\u91CF\u7EDF\u8BA1\u4E0E\u9650\u989D\u6570\u636E\u4EC5 **ChatGPT \u767B\u5F55**\uFF08`codex login`\uFF09\u53EF\u7528\uFF0CAPI-key \u6A21\u5F0F\u6CA1\u6709\u8FD9\u4EFD\u6570\u636E\u3002"
+  },
+  "need-relogin": {
+    title: "Codex \u767B\u5F55\u6001\u5DF2\u5931\u6548",
+    hint: "\u4EE4\u724C\u5DF2\u65E0\u6CD5\u5237\u65B0\uFF08\u8FC7\u671F/\u88AB\u64A4\u9500\uFF09\uFF0C\u8BF7\u5728\u5BBF\u4E3B\u673A\u7EC8\u7AEF\u91CD\u65B0\u8FD0\u884C `codex login`\u3002"
+  },
+  transient: {
+    title: "\u6682\u65F6\u62C9\u4E0D\u5230\u6570\u636E",
+    hint: "\u7F51\u7EDC\u6216 ChatGPT \u670D\u52A1\u6CE2\u52A8\uFF0C\u7A0D\u540E\u70B9\u300C\u{1F504} \u5237\u65B0\u300D\u91CD\u8BD5\u3002"
+  }
+};
+function buildUsageCard(state) {
+  if (state.phase === "loading") {
+    return card([md("\u23F3 \u6B63\u5728\u62C9\u53D6 Codex \u7528\u91CF\u6570\u636E\u2026"), note("\u67E5\u8BE2 ChatGPT \u540E\u7AEF\uFF0C\u901A\u5E38 1~3 \u79D2\u3002")], {
+      header: { title: "\u{1F4CA} Codex \u7528\u91CF", template: "wathet" },
+      forward: false
+    });
+  }
+  if (state.phase === "error") {
+    const copy = ERROR_COPY[state.kind];
+    return card(
+      [
+        md(`\u26A0\uFE0F **${copy.title}**`),
+        md(copy.hint),
+        ...state.kind === "transient" ? [note(state.message)] : [],
+        usageButtons()
+      ],
+      { header: { title: "\u{1F4CA} Codex \u7528\u91CF", template: "orange" }, forward: false }
+    );
+  }
+  const { profile, usage } = state.data;
+  const nowMs2 = state.now ?? Date.now();
+  const elements = joinWithHr([
+    rateLimitElements(usage.main, nowMs2),
+    [statColumns(profileStatItems(profile))],
+    heatmapElements(profile, state.today),
+    insightsElements(profile)
+  ]);
+  const plan = planLabel(usage.planType);
+  elements.push(
+    note(`\u7EDF\u8BA1\u622A\u81F3 ${profile.statsAsOf ?? "\u2014"}${plan ? ` \xB7 ${plan} \u5957\u9910` : ""} \xB7 \u6570\u636E\u6765\u81EA Codex \u4E2A\u4EBA\u8D44\u6599`),
+    usageButtons()
+  );
+  return card(elements, {
+    header: {
+      title: "\u{1F4CA} Codex \u7528\u91CF",
+      template: "wathet",
+      ...profile.displayName ? { subtitle: profile.displayName } : {}
+    },
+    forward: false
+  });
+}
+var SHARE_SECTIONS = [
+  { key: "stats", label: "\u6838\u5FC3\u7EDF\u8BA1\uFF08\u7D2F\u8BA1 / \u5CF0\u503C / \u8FDE\u7EED\u5929\u6570\uFF09" },
+  { key: "heatmap", label: "\u6BCF\u65E5\u7528\u91CF\u70ED\u529B\u56FE" },
+  { key: "insights", label: "\u6D3B\u52A8\u6D1E\u5BDF\u4E0E\u5E38\u7528\u6280\u80FD" },
+  { key: "limits", label: "\u9650\u989D\u8FDB\u5EA6\uFF085 \u5C0F\u65F6 / 7 \u5929\uFF09" },
+  { key: "plan", label: "\u5957\u9910\u4FE1\u606F" }
+];
+function parseShareSections(v) {
+  const all = SHARE_SECTIONS.map((s) => s.key);
+  const raw = Array.isArray(v) ? v : typeof v === "string" && v ? v.split(",") : [];
+  const picked = raw.filter((x) => all.includes(String(x)));
+  return new Set(picked.length ? picked : all);
+}
+function buildShareConfigCard(done = false) {
+  return card(
+    [
+      md("\u9009\u62E9\u8981\u653E\u8FDB\u5206\u4EAB\u5361\u7684\u5185\u5BB9\uFF08**\u4E0D\u9009 = \u5168\u90E8\u5C55\u793A**\uFF09\uFF0C\u751F\u6210\u540E\u957F\u6309 / \u53F3\u952E\u5373\u53EF\u8F6C\u53D1\uFF1A"),
+      {
+        tag: "form",
+        name: "shareCfg",
+        elements: [
+          {
+            tag: "multi_select_static",
+            name: "secs",
+            placeholder: { tag: "plain_text", content: "\u9ED8\u8BA4\u5168\u90E8\u5C55\u793A\uFF0C\u53EF\u53EA\u6311\u90E8\u5206\u533A\u5757" },
+            options: SHARE_SECTIONS.map((s) => ({ text: { tag: "plain_text", content: s.label }, value: s.key }))
+          },
+          submitButton("\u{1F4E4} \u751F\u6210\u5206\u4EAB\u5361", { a: DM.usageShareDo })
+        ]
+      },
+      ...done ? [note("\u2705 \u5206\u4EAB\u5361\u5DF2\u751F\u6210\uFF08\u89C1\u4E0B\u65B9\u65B0\u5361\u7247\uFF09\u3002\u6362\u4E2A\u7EC4\u5408\u53EF\u518D\u6B21\u751F\u6210\u3002")] : [],
+      actions([button("\u2B05\uFE0F \u8FD4\u56DE\u7528\u91CF", { a: DM.usage }), button("\u{1F3E0} \u83DC\u5355", { a: DM.menu })])
+    ],
+    { header: { title: "\u{1F4E4} \u5206\u4EAB\u5185\u5BB9\u9009\u62E9", template: "blue" }, forward: false }
+  );
+}
+function buildUsageShareCard(data, opts = {}) {
+  const { profile, usage } = data;
+  const nowMs2 = opts.now ?? Date.now();
+  const sec = opts.sections ?? new Set(SHARE_SECTIONS.map((s) => s.key));
+  const who = profile.displayName ? `${profile.displayName} \u7684` : "\u6211\u7684";
+  const plan = planLabel(usage.planType);
+  const elements = joinWithHr([
+    sec.has("stats") ? [statColumns(profileStatItems(profile))] : [],
+    sec.has("heatmap") ? heatmapElements(profile, opts.today) : [],
+    sec.has("insights") ? insightsElements(profile) : [],
+    sec.has("limits") ? rateLimitElements(usage.main, nowMs2) : [],
+    sec.has("plan") && plan ? [md(`\u{1F48E} **\u5957\u9910**\u3000${plan}`)] : []
+  ]);
+  const stamp = new Date(nowMs2);
+  const stampStr = `${stamp.getMonth() + 1}\u6708${stamp.getDate()}\u65E5 ${String(stamp.getHours()).padStart(2, "0")}:${String(stamp.getMinutes()).padStart(2, "0")}`;
+  elements.push({
+    tag: "markdown",
+    content: `<font color='grey'>\u{1F916} \u7531 </font>[feishu-codex-bridge](https://my.feishu.cn/docx/AFKNdf4QaooL5OxSR8bc5H7vn7b)<font color='grey'> \u4E8E ${stampStr} \u751F\u6210</font>`,
+    text_size: "notation",
+    text_align: "right"
+  });
+  return card(elements, {
+    header: {
+      title: `\u{1F4CA} ${who} Codex \u7528\u91CF`,
+      template: "blue",
+      ...profile.statsAsOf ? { subtitle: `\u7EDF\u8BA1\u622A\u81F3 ${profile.statsAsOf}` } : {}
+    }
+  });
+}
+
 // src/project/lifecycle.ts
 import { mkdir as mkdir9 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
-import { isAbsolute as isAbsolute2, join as join12, resolve as resolve6 } from "path";
+import { isAbsolute as isAbsolute2, join as join13, resolve as resolve6 } from "path";
 
 // src/project/git-info.ts
 import { execFile } from "child_process";
@@ -4622,7 +5238,7 @@ async function resolveCwd(name, existingPath) {
     if (!existsSync7(cwd2)) throw new Error(`\u6587\u4EF6\u5939\u4E0D\u5B58\u5728\uFF1A${cwd2}`);
     return { cwd: cwd2, blank: false };
   }
-  const cwd = join12(paths.projectsRootDir, name);
+  const cwd = join13(paths.projectsRootDir, name);
   await mkdir9(cwd, { recursive: true });
   return { cwd, blank: true };
 }
@@ -4702,12 +5318,12 @@ async function leaveChat(channel, chatId) {
 }
 
 // src/bot/session-store.ts
-import { mkdir as mkdir10, readFile as readFile8, rename as rename5, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir10, readFile as readFile9, rename as rename5, writeFile as writeFile8 } from "fs/promises";
 import { dirname as dirname10 } from "path";
 var FILE_VERSION3 = 1;
 async function read2() {
   try {
-    const text = await readFile8(paths.sessionsFile, "utf8");
+    const text = await readFile9(paths.sessionsFile, "utf8");
     const parsed = JSON.parse(text);
     return Array.isArray(parsed.sessions) ? parsed.sessions : [];
   } catch (err) {
@@ -4764,7 +5380,7 @@ async function handleDmConsole(channel, cfg, msg) {
 
 // src/bot/media.ts
 import { mkdir as mkdir11, readdir as readdir2, rm as rm4, stat as stat3 } from "fs/promises";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var MAX_IMAGES2 = 9;
 var MEDIA_TTL_MS = 60 * 6e4;
 var EXT_BY_CONTENT_TYPE = {
@@ -4791,7 +5407,7 @@ async function collectInboundImages(channel, msg) {
     return [];
   }
   if (refs.length === 0) return [];
-  await pruneOldMedia();
+  await pruneOldMedia(paths.mediaDir);
   try {
     await mkdir11(paths.mediaDir, { recursive: true });
   } catch {
@@ -4869,7 +5485,7 @@ async function downloadOne(channel, ref, index) {
       params: { type: "image" }
     });
     const ext = extFromHeaders(res.headers);
-    const file = join13(paths.mediaDir, `${safeName(ref.fileKey)}-${index}.${ext}`);
+    const file = join14(paths.mediaDir, `${safeName(ref.fileKey)}-${index}.${ext}`);
     await res.writeFile(file);
     return file;
   } catch (err) {
@@ -4894,16 +5510,16 @@ function readHeader(headers, name) {
 function safeName(fileKey) {
   return fileKey.replace(/[^a-zA-Z0-9_-]/g, "").slice(-40) || "img";
 }
-async function pruneOldMedia() {
+async function pruneOldMedia(dir) {
   let entries;
   try {
-    entries = await readdir2(paths.mediaDir);
+    entries = await readdir2(dir);
   } catch {
     return;
   }
   const cutoff = Date.now() - MEDIA_TTL_MS;
   for (const name of entries) {
-    const file = join13(paths.mediaDir, name);
+    const file = join14(dir, name);
     try {
       const st = await stat3(file);
       if (st.mtimeMs < cutoff) await rm4(file, { force: true });
@@ -4911,6 +5527,84 @@ async function pruneOldMedia() {
     }
   }
 }
+var MAX_FILES = 9;
+var MAX_FILE_BYTES = 50 * 1024 * 1024;
+function messageHasFiles(msg) {
+  return (msg.resources ?? []).some((r) => r.type === "file");
+}
+async function collectInboundFiles(channel, msg) {
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const r of msg.resources ?? []) {
+    if (r.type === "file" && r.fileKey && !seen.has(r.fileKey)) {
+      seen.add(r.fileKey);
+      refs.push({ messageId: msg.messageId, fileKey: r.fileKey, fileName: r.fileName });
+    }
+  }
+  if (refs.length === 0) return [];
+  await pruneOldMedia(paths.inboundDir);
+  try {
+    await mkdir11(paths.inboundDir, { recursive: true });
+  } catch {
+  }
+  const out = [];
+  for (const ref of refs.slice(0, MAX_FILES)) {
+    const f = await downloadOneFile(channel, ref);
+    if (f) out.push(f);
+  }
+  log.info("intake", "files", { found: refs.length, downloaded: out.length });
+  return out;
+}
+async function downloadOneFile(channel, ref) {
+  try {
+    const res = await channel.rawClient.im.v1.messageResource.get({
+      path: { message_id: ref.messageId, file_key: ref.fileKey },
+      params: { type: "file" }
+    });
+    const declared = Number(readHeader(res.headers, "content-length"));
+    if (Number.isFinite(declared) && declared > MAX_FILE_BYTES) {
+      log.warn("intake", "file-too-large", { fileKey: ref.fileKey.slice(0, 24), bytes: declared });
+      return void 0;
+    }
+    const name = cleanFileName(ref.fileName) || "attachment";
+    const onDisk = `${safeName(ref.fileKey)}-${name}`;
+    const file = join14(paths.inboundDir, onDisk);
+    await res.writeFile(file);
+    try {
+      const st = await stat3(file);
+      if (st.size > MAX_FILE_BYTES) {
+        await rm4(file, { force: true });
+        log.warn("intake", "file-too-large", { fileKey: ref.fileKey.slice(0, 24), bytes: st.size });
+        return void 0;
+      }
+    } catch {
+    }
+    return { path: file, name };
+  } catch (err) {
+    log.warn("intake", "file-download-failed", { fileKey: ref.fileKey.slice(0, 24), err: String(err) });
+    return void 0;
+  }
+}
+function cleanFileName(name) {
+  if (!name) return "";
+  const base = name.split(/[/\\]/).pop() ?? name;
+  const cleaned = base.replace(/[\x00-\x1f<>:"|?*]/g, "_").replace(/\s+/g, " ").trim().slice(0, 100);
+  return cleaned === "." || cleaned === ".." ? "" : cleaned;
+}
+function stripFileTokens(text) {
+  return text.replace(/<file\b[^<]*\/>/g, "").replace(/[ \t]+\n/g, "\n").trim();
+}
+function weaveFileManifest(text, files) {
+  const stripped = stripFileTokens(text);
+  if (files.length === 0) return stripped;
+  const lines = files.map((f) => `- ${f.name} \u2192 ${f.path}`).join("\n");
+  const head = stripped ? `${stripped}
+
+` : "";
+  return `${head}[\u7528\u6237\u4E0A\u4F20\u4E86 ${files.length} \u4E2A\u9644\u4EF6\uFF0C\u5DF2\u4FDD\u5B58\u5230\u672C\u5730\uFF0C\u53EF\u7528 shell / \u8BFB\u53D6\u5DE5\u5177\u6309\u4E0B\u9762\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76F4\u63A5\u6253\u5F00\uFF1A
+${lines}
+]`;
+}
 
 // src/bot/comments.ts
 var SUPPORTED_FILE_TYPES = /* @__PURE__ */ new Set(["doc", "docx", "sheet", "file"]);
@@ -5397,20 +6091,30 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
     const perm = turnPerm(project, senderId);
     return { sessionKey: perm.roleSuffix ? `${baseKey}#${perm.roleSuffix}` : baseKey, ...perm };
   }
+  async function ingestFiles(msg, text) {
+    if (!messageHasFiles(msg)) return text;
+    const files = await collectInboundFiles(channel, msg);
+    const woven = weaveFileManifest(text, files);
+    if (!woven.trim()) {
+      return "\u7528\u6237\u53D1\u6765\u4E00\u4E2A\u9644\u4EF6\uFF0C\u4F46\u6865\u6CA1\u80FD\u4E0B\u8F7D\u5B83\uFF08\u53EF\u80FD\u8D85\u8FC7 50MB \u4E0A\u9650\u6216\u88AB\u98DE\u4E66\u62D2\u7EDD\uFF09\u3002\u8BF7\u544A\u8BC9\u7528\u6237\u9644\u4EF6\u6CA1\u8BFB\u5230\uFF0C\u53EF\u4EE5\u91CD\u53D1\uFF0C\u6216\u6539\u4E3A\u7C98\u8D34\u6587\u672C / \u53D1\u56FE\u7247\u3002";
+    }
+    return woven;
+  }
   async function handleTurn(msg, text, sessionKey, flat, project, perm) {
     const existing = active.get(sessionKey);
     if (existing) {
       const images = messageHasImages(msg) ? await collectInboundImages(channel, msg) : void 0;
+      const woven = await ingestFiles(msg, text);
       const cur = active.get(sessionKey);
       if (!cur) {
-        startReservedRun(msg, text, sessionKey, flat, project, perm, images);
+        startReservedRun(msg, woven, sessionKey, flat, project, perm, images, true, text);
         return;
       }
       if (getPendingPolicy(cfg) === "steer" && cur.run && cur.thread) {
         const tid = cur.run.turnId();
         if (tid) {
           try {
-            await cur.thread.steer({ text, images }, tid);
+            await cur.thread.steer({ text: woven, images }, tid);
             log.info("intake", "steer", { tid, images: images?.length ?? 0 });
             return;
           } catch (err) {
@@ -5418,13 +6122,13 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
           }
         }
       }
-      cur.queue.push({ text, images });
+      cur.queue.push({ text: woven, images });
       log.info("intake", "queued", { depth: cur.queue.length });
       return;
     }
     startReservedRun(msg, text, sessionKey, flat, project, perm);
   }
-  function startReservedRun(msg, text, sessionKey, flat, project, perm, preloadedImages) {
+  function startReservedRun(msg, text, sessionKey, flat, project, perm, preloadedImages, preIngested, summaryText2) {
     const existing = active.get(sessionKey);
     if (existing) {
       existing.queue.push({ text, images: preloadedImages });
@@ -5437,6 +6141,7 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
       const reaction = runReaction(msg.messageId, !sema.hasFree());
       try {
         const images = preloadedImages ?? (messageHasImages(msg) ? await collectInboundImages(channel, msg) : void 0);
+        const firstText = preIngested ? text : await ingestFiles(msg, text);
         let thread = await resolveThread(sessionKey, msg.chatId, { mode: perm.mode, network: perm.network });
         if (!thread) {
           const cwd = project?.cwd ?? fallbackCwd;
@@ -5447,7 +6152,10 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
             chatId: msg.chatId,
             cwd,
             codexThreadId: thread.codexThreadId,
-            summary: text.slice(0, 80),
+            // `text` is already file-woven when preIngested; use the raw
+            // `summaryText` (handleTurn's original) so the session label isn't
+            // manifest boilerplate + a temp path.
+            summary: stripFileTokens(summaryText2 ?? text).slice(0, 80),
             createdAt: Date.now(),
             updatedAt: Date.now()
           });
@@ -5460,7 +6168,7 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
             replyInThread: !flat,
             flat,
             thread,
-            firstText: text,
+            firstText,
             images,
             knownThreadId: sessionKey,
             requesterOpenId: msg.senderId
@@ -5534,8 +6242,8 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
         await channel.send(msg.chatId, { markdown: `\u274C \u542F\u52A8\u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}` }, { replyTo: msg.messageId }).catch(() => void 0);
         return;
       }
-      const firstText = text || "\u4F60\u597D\uFF0C\u6211\u4EEC\u5F00\u59CB\u5427\u3002";
       const images = messageHasImages(msg) ? await collectInboundImages(channel, msg) : void 0;
+      const firstText = await ingestFiles(msg, text) || "\u4F60\u597D\uFF0C\u6211\u4EEC\u5F00\u59CB\u5427\u3002";
       log.info("card", "start", { project: project?.name ?? "(unregistered)", model, effort, images: images?.length ?? 0 });
       await launchRun(
         {
@@ -5548,7 +6256,7 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
           model,
           effort,
           cwd,
-          summary: text.slice(0, 80) || "(\u7A7A)",
+          summary: stripFileTokens(text).slice(0, 80) || "(\u7A7A)",
           requesterOpenId: msg.senderId,
           roleSuffix: perm.roleSuffix
         },
@@ -5714,6 +6422,46 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
   const freshMenu = (evt) => {
     patch(evt, buildDmMenuCard());
   };
+  const runUsage = (evt, force) => {
+    if (!dmAdmin(evt.operator?.openId)) return;
+    void (async () => {
+      await new Promise((r) => setTimeout(r, CARD_SETTLE_MS));
+      let msgId = evt.messageId;
+      const okLoading = await updateManagedCard(channel, msgId, buildUsageCard({ phase: "loading" })).catch(
+        () => false
+      );
+      if (!okLoading) {
+        const sent = await sendManagedCard(channel, evt.chatId, buildUsageCard({ phase: "loading" })).catch(
+          (e) => {
+            log.fail("console", e, { phase: "usage-loading" });
+            return void 0;
+          }
+        );
+        if (!sent) return;
+        msgId = sent.messageId;
+      }
+      let state;
+      try {
+        state = { phase: "ready", data: await fetchUsageBundle(force) };
+      } catch (err) {
+        log.fail("console", err, { phase: "usage" });
+        state = {
+          phase: "error",
+          kind: err instanceof UsageError ? err.kind : "transient",
+          message: err instanceof Error ? err.message : String(err)
+        };
+      }
+      const ok = await updateManagedCard(channel, msgId, buildUsageCard(state)).catch((e) => {
+        log.fail("console", e, { phase: "usage-render" });
+        return false;
+      });
+      if (!ok) {
+        await sendManagedCard(channel, evt.chatId, buildUsageCard(state)).catch(
+          (e) => log.fail("console", e, { phase: "usage-fallback" })
+        );
+      }
+    })();
+  };
   const renderProjectList = async () => {
     const [projects, sessions2] = await Promise.all([listProjects(), listSessions()]);
     const byChat = /* @__PURE__ */ new Map();
@@ -5867,6 +6615,25 @@ SDK \u4F1A\u81EA\u52A8\u91CD\u8FDE\uFF1B\u82E5\u957F\u671F\u65AD\u5F00\uFF0C\u8B
         await restartDaemon().catch((e) => log.fail("console", e, { phase: "update-restart" }));
       }
     })();
+  }).on(DM.usage, ({ evt }) => runUsage(evt, false)).on(DM.usageRefresh, ({ evt }) => runUsage(evt, true)).on(DM.usageShare, ({ evt }) => {
+    if (!dmAdmin(evt.operator?.openId)) return;
+    patch(evt, buildShareConfigCard());
+  }).on(DM.usageShareDo, ({ evt, formValue }) => {
+    if (!dmAdmin(evt.operator?.openId)) return;
+    const sections = parseShareSections(formValue?.secs);
+    void (async () => {
+      await new Promise((r) => setTimeout(r, CARD_SETTLE_MS));
+      try {
+        const data = await fetchUsageBundle();
+        await sendManagedCard(channel, evt.chatId, buildUsageShareCard(data, { sections }), evt.messageId);
+        log.info("console", "usage-share", { sections: [...sections].join(",") });
+        await updateManagedCard(channel, evt.messageId, buildShareConfigCard(true)).catch(() => void 0);
+      } catch (err) {
+        log.fail("console", err, { phase: "usage-share" });
+        const reason = err instanceof UsageError ? err.message : "\u62C9\u53D6\u7528\u91CF\u6570\u636E\u5931\u8D25";
+        await channel.send(evt.chatId, { markdown: `\u26A0\uFE0F \u751F\u6210\u5206\u4EAB\u5361\u5931\u8D25\uFF1A${reason}` }, { replyTo: evt.messageId }).catch(() => void 0);
+      }
+    })();
   }).on(DM.rmConfirm, async ({ evt, value }) => {
     const name = typeof value.n === "string" ? value.n : void 0;
     if (!dmAdmin(evt.operator?.openId) || !name) return;

package/dist/index.d.ts

@@ -42,6 +42,9 @@ declare const paths: {
      */
     secretsGetterScript: string;
     mediaDir: string;
+    /** Inbound file attachments downloaded from chat, handed to codex by absolute
+     * path (codex has no native file input). TTL-pruned like {@link mediaDir}. */
+    inboundDir: string;
 };
 
 export { log, newTraceId, paths, withTrace };

package/dist/index.js

@@ -47,7 +47,10 @@ var paths = {
    * passes lark-cli's AssertSecurePath audit.
    */
   secretsGetterScript: join(appDir, "secrets-getter"),
-  mediaDir: join(appDir, "media")
+  mediaDir: join(appDir, "media"),
+  /** Inbound file attachments downloaded from chat, handed to codex by absolute
+   * path (codex has no native file input). TTL-pruned like {@link mediaDir}. */
+  inboundDir: join(appDir, "inbound")
 };
 
 // src/core/logger.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelzen/feishu-codex-bridge",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Bridge Feishu/Lark messenger with local Codex via app-server (project=group, thread=session)",
   "type": "module",
   "bin": {