@wagemule/daemon 0.1.0 → 0.1.3

package/dist/main.cjs

@@ -34,6 +34,7 @@ __export(main_exports, {
   runCli: () => runCli
 });
 module.exports = __toCommonJS(main_exports);
+var import_node_os9 = __toESM(require("node:os"));
 
 // src/process/command.ts
 var import_node_child_process = require("node:child_process");
@@ -2136,7 +2137,7 @@ var import_node_os = __toESM(require("node:os"));
 var import_node_path3 = __toESM(require("node:path"));
 async function scanAgentSkills(input) {
   const homeDir = input.homeDir ?? import_node_os.default.homedir();
-  const workspaceDir = import_node_path3.default.join(input.rootDir, input.serverNamespace, input.machineId, input.agentId);
+  const workspaceDir = input.machineDirectoryName ? import_node_path3.default.join(input.rootDir, input.machineDirectoryName, input.agentDirectoryName ?? input.agentId) : import_node_path3.default.join(input.rootDir, input.serverNamespace, input.machineId, input.agentId);
   return {
     global: await scanGroupedSkillRoots(runtimeSkillRoots(homeDir, input.runtime), "global"),
     workspace: await scanGroupedSkillRoots(workspaceSkillRoots(workspaceDir, input.runtime), "workspace")
@@ -2261,36 +2262,14 @@ Use this skill whenever you need to interact with Wage Mule platform state: chan
 - \`wm task claim --id <task-id>\`
 - \`wm task update --id <task-id> --status <status>\`
 `;
-var LARK_SKILL = `---
-description: Lark and Feishu delegation tools
-version: 0.1.0
----
-# lark
-
-Use this skill only when this agent has Feishu delegation enabled and the daemon has provided a token file at \`.wm/feishu/token\`.
-
-## Token rule
-
-- Read the token file path from the task context or use \`.wm/feishu/token\` relative to the agent workspace.
-- Never print, store, or send the token in platform messages, logs, memory, or notes.
-
-## Delegation workflow
-
-- Search recent Feishu messages for the delegated human.
-- Classify each message yourself: answer directly, ask another agent through the platform, or escalate to the human.
-- Record meaningful work with \`wm task create\` or \`wm task update\` so the platform has an audit trail.
-- When another agent is needed, use platform DM/thread collaboration instead of guessing.
-`;
-function skillTemplatesForWorkspace(input) {
-  const templates = [{ name: "wm-platform", content: WM_PLATFORM_SKILL }];
-  if (input.feishuEnabled) templates.push({ name: "lark", content: LARK_SKILL });
-  return templates;
+function skillTemplatesForWorkspace() {
+  return [{ name: "wm-platform", content: WM_PLATFORM_SKILL }];
 }
 
 // src/workspace/agent-workspace.ts
 async function createAgentWorkspace(input) {
-  const serverDir = input.machineId ? import_node_path4.default.join(input.rootDir, input.serverNamespace, input.machineId) : import_node_path4.default.join(input.rootDir, input.serverNamespace);
-  const agentDir = import_node_path4.default.join(serverDir, input.agentId);
+  const serverDir = input.machineId ? import_node_path4.default.join(input.rootDir, input.machineDirectoryName) : import_node_path4.default.join(input.rootDir, input.serverNamespace);
+  const agentDir = import_node_path4.default.join(serverDir, input.agentDirectoryName);
   const wmDir = import_node_path4.default.join(agentDir, ".wm");
   const notesDir = import_node_path4.default.join(agentDir, "notes");
   const runtimeSessionsDir = import_node_path4.default.join(wmDir, "runtime-sessions");
@@ -2415,24 +2394,26 @@ async function buildSystemPrompt(input, paths) {
     "",
     "1. `wm message check` -- Non-blocking check for new channel, DM, or thread messages at natural breakpoints.",
     "2. `wm message send` -- Send a channel, DM, or thread reply through the platform.",
-    "3. `wm message read` -- Read visible history with pagination or around a specific message.",
-    "4. `wm message search` -- Search visible channel and DM history before answering historical questions.",
-    "5. `wm server info` -- Inspect the current server, visible channels, humans, agents, and memberships.",
-    "6. `wm channel members` -- Inspect members of a channel, DM, or thread target.",
-    "7. `wm task list` -- View task messages for a channel or relevant target.",
-    "8. `wm task claim` -- Claim a task before doing work that changes files, runs tools, or performs multi-step investigation.",
-    "9. `wm task unclaim` -- Release a task you cannot or should not continue.",
-    "10. `wm task update` -- Move a task through statuses such as todo, in_progress, in_review, and done.",
-    "11. `wm task create` -- Create genuine new follow-up work when no canonical message/task exists.",
-    "12. `wm attachment upload` -- Upload a local artifact and reference it in a platform message.",
-    "13. `wm attachment view` -- Download and inspect a platform attachment.",
-    "14. `wm profile show` -- Inspect your own profile or a visible human/agent profile.",
-    "15. `wm profile update` -- Update your display name, description, or avatar when explicitly asked.",
-    "16. `wm reminder schedule` -- Schedule a platform-visible reminder for follow-up work.",
-    "17. `wm reminder list` -- List reminders and their lifecycle history.",
-    "18. `wm reminder snooze` -- Push an existing reminder later.",
-    "19. `wm reminder update` -- Change a reminder without creating a duplicate.",
-    "20. `wm reminder cancel` -- Cancel a reminder that is no longer needed.",
+    "3. `wm dm send` -- Send a private agent-to-agent DM, optionally waiting for a reply.",
+    "4. `wm message read` -- Read visible history with pagination or around a specific message.",
+    "5. `wm message search` -- Search visible channel and DM history before answering historical questions.",
+    "6. `wm server info` -- Inspect the current server, visible channels, humans, agents, and memberships.",
+    "7. `wm channel members` -- Inspect members of a channel, DM, or thread target.",
+    "8. `wm member find` -- Find platform members by Feishu open_id.",
+    "9. `wm task list` -- View task messages for a channel or relevant target.",
+    "10. `wm task claim` -- Claim a task before doing work that changes files, runs tools, or performs multi-step investigation.",
+    "11. `wm task unclaim` -- Release a task you cannot or should not continue.",
+    "12. `wm task update` -- Move a task through statuses such as todo, in_progress, in_review, and done.",
+    "13. `wm task create` -- Create genuine new follow-up work when no canonical message/task exists.",
+    "14. `wm attachment upload` -- Upload a local artifact and reference it in a platform message.",
+    "15. `wm attachment view` -- Download and inspect a platform attachment.",
+    "16. `wm profile show` -- Inspect your own profile or a visible human/agent profile.",
+    "17. `wm profile update` -- Update your display name, description, or avatar when explicitly asked.",
+    "18. `wm reminder schedule` -- Schedule a platform-visible reminder for follow-up work.",
+    "19. `wm reminder list` -- List reminders and their lifecycle history.",
+    "20. `wm reminder snooze` -- Push an existing reminder later.",
+    "21. `wm reminder update` -- Change a reminder without creating a duplicate.",
+    "22. `wm reminder cancel` -- Cancel a reminder that is no longer needed.",
     "",
     "Diagnostic command:",
     "",
@@ -2440,10 +2421,21 @@ async function buildSystemPrompt(input, paths) {
     "- Use `--json` on wm commands only when you need machine-readable output; default output is optimized for agent collaboration.",
     "- Use platform communication commands as the only channel for channel/task-visible communication. Runtime stdout/final answers are daemon transport details, not the long-term platform protocol.",
     "",
+    "## Work Surface Routing",
+    "",
+    "First identify where the requested work must happen, then choose the tool for that surface.",
+    "",
+    "- Wage Mule platform: use `wm` for channel replies, DMs, thread collaboration, tasks, attachments, profiles, reminders, and questions directed at other platform agents.",
+    "- Local workspace: use normal filesystem and shell tools for code, documents, local diagnostics, and verification.",
+    "- External systems: use the relevant installed workspace skill, token, CLI, or API for tools outside Wage Mule, such as Feishu/Lark.",
+    "- Do not turn external-contact requests into platform mentions. If the user asks you to contact a person through an external system, use that external system and then report the result back to the original platform thread.",
+    "- If a request needs both surfaces, do the external work on the external surface and use `wm message send` only for the platform-visible progress or final report.",
+    "",
     "## CRITICAL RULES",
     "",
     "- Other agents may be running on different machines. Do not use local processes, workspaces, server activity, task lists, or runtime sessions to answer what another agent is doing.",
-    '- When a human asks you to ask, check, confirm, contact, or get status from another agent, your first platform action is to ask that agent in the original message thread with `wm message send --target "#channel:<message>"` and an @mention.',
+    '- When a human asks you to ask, check, confirm, contact, or get status from another platform agent, your first platform action is to ask that agent in the original message thread with `wm message send --target "#channel:<message>"` and an @mention.',
+    "- When the request explicitly calls for a private agent DM, use `wm dm send --to-agent-id <agent_id>` instead of a thread mention.",
     "- Wait for that agent's platform reply via delivered messages, `wm message check`, or recent unread output; then summarize the reply in the same thread.",
     "- `wm server info`, `wm channel members`, and `wm task list` are discovery tools. They are not authoritative answers for another agent's current work.",
     "",
@@ -2521,19 +2513,46 @@ async function buildSystemPrompt(input, paths) {
 async function syncWorkspaceSkills(wmDir, feishuEnabled) {
   const skillsDir = import_node_path4.default.join(wmDir, "skills");
   await (0, import_promises4.mkdir)(skillsDir, { recursive: true });
-  for (const template of skillTemplatesForWorkspace({ feishuEnabled })) {
+  for (const template of skillTemplatesForWorkspace()) {
     const targetDir = import_node_path4.default.join(skillsDir, template.name);
     await (0, import_promises4.mkdir)(targetDir, { recursive: true });
-    await (0, import_promises4.writeFile)(import_node_path4.default.join(targetDir, "SKILL.md"), template.content, { flag: "wx" }).catch((error) => {
-      if (error?.code !== "EEXIST") throw error;
+    await (0, import_promises4.writeFile)(import_node_path4.default.join(targetDir, "SKILL.md"), template.content, "utf8");
+  }
+  await (0, import_promises4.rm)(import_node_path4.default.join(skillsDir, "lark"), { recursive: true, force: true });
+  if (feishuEnabled) await copyLarksuiteSkills(skillsDir);
+}
+async function copyLarksuiteSkills(skillsDir) {
+  const sourceDir = await resolveLarksuiteSkillsSourceDir();
+  const entries = await (0, import_promises4.readdir)(sourceDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !entry.name.startsWith("lark-")) continue;
+    await (0, import_promises4.cp)(import_node_path4.default.join(sourceDir, entry.name), import_node_path4.default.join(skillsDir, entry.name), {
+      recursive: true,
+      force: true
     });
   }
 }
+async function resolveLarksuiteSkillsSourceDir() {
+  const candidates = [
+    import_node_path4.default.join(__dirname, "..", "..", "vendor", "larksuite-cli-skills"),
+    import_node_path4.default.join(__dirname, "skills", "larksuite")
+  ];
+  for (const candidate of candidates) {
+    try {
+      const entries = await (0, import_promises4.readdir)(candidate, { withFileTypes: true });
+      if (entries.some((entry) => entry.isDirectory() && entry.name === "lark-im")) return candidate;
+    } catch {
+    }
+  }
+  throw new Error("official Lark/Feishu skills are missing from daemon package");
+}
 async function buildWorkspaceSkillsSection(input) {
   const result = await scanAgentSkills({
     rootDir: input.rootDir,
     serverNamespace: input.serverNamespace,
+    machineDirectoryName: input.machineDirectoryName,
     machineId: input.machineId ?? "",
+    agentDirectoryName: input.agentDirectoryName,
     agentId: input.agentId,
     runtime: input.runtime
   }).catch(() => ({ global: [], workspace: [] }));
@@ -2589,7 +2608,7 @@ if (fs.existsSync(envPath)) {
 
 const args = process.argv.slice(2);
 const [group, command] = args;
-const help = "Available commands: wm auth whoami; wm message send/check/read/search; wm server info; wm channel members; wm channel members; wm task list/claim/unclaim/update/create; wm attachment upload/view; wm profile show/update; wm reminder schedule/list/snooze/update/cancel";
+const help = "Available commands: wm auth whoami; wm message send/check/read/search; wm dm send; wm server info; wm channel members; wm member find; wm task list/claim/unclaim/update/create; wm attachment upload/view; wm profile show/update; wm reminder schedule/list/snooze/update/cancel";
 
 function valueAfter(name) {
   const index = args.indexOf(name);
@@ -2601,7 +2620,7 @@ function hasFlag(name) {
 }
 
 function positionalText() {
-  const knownOptions = new Set(["--target", "--channel", "--text", "--content", "--attachment-ids", "--query", "--q", "--around", "--status", "--id", "--task-id", "--title", "--description", "--file", "--at", "--every", "--role", "--instructions", "--body"]);
+  const knownOptions = new Set(["--target", "--channel", "--text", "--content", "--attachment-ids", "--query", "--q", "--around", "--status", "--id", "--task-id", "--title", "--description", "--file", "--at", "--every", "--role", "--instructions", "--body", "--to-agent-id", "--timeout", "--feishu-open-id", "--open-id"]);
   const values = [];
   for (let index = 2; index < args.length; index++) {
     const arg = args[index];
@@ -2671,6 +2690,17 @@ function formatSendResult(result, target) {
   return lines.join("\\n");
 }
 
+function formatDmSendResult(payload) {
+  const messageId = payload.messageId || payload.message?.id || "unknown";
+  const lines = [\`DM sent. Message ID: \${messageId}\`];
+  if (payload.reply) {
+    lines.push("", "--- Reply ---", messageLine(payload.reply));
+  } else if (payload.timed_out) {
+    lines.push("Timed out waiting for reply.");
+  }
+  return lines.join("\\n");
+}
+
 function formatMessages(payload) {
   const messages = payload.messages || [];
   if (!messages.length) return "No messages.";
@@ -2705,6 +2735,26 @@ function formatMembers(payload) {
   return members.map((member) => \`- \${member.mention} type=\${member.type}\${member.runtime ? \` runtime=\${member.runtime}\` : ""}\`).join("\\n");
 }
 
+function formatMemberFind(payload) {
+  const lines = [];
+  if (payload.human) {
+    lines.push(\`Human: @\${payload.human.name} (\${payload.human.id})\`);
+    if (payload.human.feishu_open_id) lines.push(\`Feishu open_id: \${payload.human.feishu_open_id}\`);
+    if (payload.human.email) lines.push(\`Email: \${payload.human.email}\`);
+  } else {
+    lines.push("Human: not found");
+  }
+  lines.push("Agents:");
+  if (payload.agents?.length) {
+    for (const agent of payload.agents) {
+      lines.push(\`- @\${agent.name} id=\${agent.agent_id} runtime=\${agent.runtime} machine=\${agent.machine_id} \${agent.online ? "online" : "offline"}\`);
+    }
+  } else {
+    lines.push("- none");
+  }
+  return lines.join("\\n");
+}
+
 async function main() {
   const agentId = process.env.WM_AGENT_ID || process.env.WM_DAEMON_AGENT_ID;
   if (group === "auth" && command === "whoami") {
@@ -2736,6 +2786,20 @@ async function main() {
     printResult(payload, formatSendResult(payload, target));
     return;
   }
+  if (group === "dm" && command === "send") {
+    const toAgentId = valueAfter("--to-agent-id");
+    if (!toAgentId) throw new Error("--to-agent-id is required");
+    const text = (valueAfter("--text") || valueAfter("--content") || await stdin() || positionalText()).trim();
+    if (!text) throw new Error("message text is required; use --text, --content, stdin, or a positional message");
+    const payload = await request("POST", \`/internal/agent/\${agentId}/dm/send\`, {
+      to_agent_id: toAgentId,
+      text,
+      wait_for_reply: hasFlag("--wait-for-reply"),
+      timeout_ms: valueAfter("--timeout") ? Number(valueAfter("--timeout")) : undefined,
+    });
+    printResult(payload, formatDmSendResult(payload));
+    return;
+  }
   if (group === "message" && command === "check") {
     const payload = await request("GET", \`/internal/agent/\${agentId}/receive\`);
     printResult(payload, formatMessages(payload).replace("No messages.", "No new messages."));
@@ -2774,6 +2838,13 @@ async function main() {
     printResult(payload, formatMembers(payload));
     return;
   }
+  if (group === "member" && command === "find") {
+    const openId = (valueAfter("--feishu-open-id") || valueAfter("--open-id") || "").trim();
+    if (!openId) throw new Error("--feishu-open-id is required");
+    const payload = await request("GET", \`/internal/agent/\${agentId}/members/find?feishu_open_id=\${encodeURIComponent(openId)}\`);
+    printResult(payload, formatMemberFind(payload));
+    return;
+  }
   if (group === "task" && command === "list") {
     const status = valueAfter("--status");
     const suffix = status ? \`?status=\${encodeURIComponent(status)}\` : "";
@@ -2889,7 +2960,11 @@ async function runAdapterSmokeTest(input) {
     input.runtime,
     "adapter runtime must match requested runtime"
   );
-  const workspace = await createAgentWorkspace(input);
+  const workspace = await createAgentWorkspace({
+    ...input,
+    machineDirectoryName: input.machineDirectoryName ?? input.serverNamespace,
+    agentDirectoryName: input.agentDirectoryName ?? input.agentId
+  });
   const runDir = input.runDir ?? workspace.agentDir;
   const systemPrompt = await (0, import_promises5.readFile)(workspace.systemPromptPath, "utf8");
   const result = await input.adapter.run({
@@ -3033,6 +3108,8 @@ async function createLabAgent(input) {
     rootDir: input.rootDir,
     serverNamespace: input.serverNamespace,
     serverId: `lab:${input.serverNamespace}`,
+    machineDirectoryName: input.serverNamespace,
+    agentDirectoryName: agentId,
     daemonId: import_node_os4.default.hostname() || "local",
     agentId,
     agentName: input.agentName,
@@ -3724,7 +3801,7 @@ var import_ws = __toESM(require("ws"));
 // package.json
 var package_default = {
   name: "@wagemule/daemon",
-  version: "0.1.0",
+  version: "0.1.3",
   private: false,
   description: "Wage Mule local daemon for connecting local agent runtimes to Workspace Server.",
   main: "./dist/main.cjs",
@@ -3761,6 +3838,7 @@ var package_default = {
   dependencies: {
     "@anthropic-ai/claude-agent-sdk": "^0.2.138",
     "@inquirer/prompts": "^8.4.2",
+    "@larksuite/cli": "^1.0.32",
     commander: "^14.0.3",
     ws: "^8.0.0"
   }
@@ -4590,10 +4668,15 @@ var ReminderCache = class {
 
 // src/workspace/feishu-token-writer.ts
 var import_promises10 = require("node:fs/promises");
+var import_node_module = require("node:module");
 var import_node_path11 = __toESM(require("node:path"));
+var requireFromHere = (0, import_node_module.createRequire)(__filename);
 function feishuTokenPath(workspaceDir) {
   return import_node_path11.default.join(workspaceDir, ".wm", "feishu", "token");
 }
+function larkCliWrapperPath(workspaceDir) {
+  return import_node_path11.default.join(workspaceDir, ".wm", "lark-cli");
+}
 async function writeFeishuToken(input) {
   const tokenPath = feishuTokenPath(input.workspaceDir);
   const dir = import_node_path11.default.dirname(tokenPath);
@@ -4605,9 +4688,46 @@ async function writeFeishuToken(input) {
   await (0, import_promises10.chmod)(tokenPath, 384);
   return tokenPath;
 }
+async function writeLarkCliWrapper(input) {
+  const wrapperPath = larkCliWrapperPath(input.workspaceDir);
+  await (0, import_promises10.mkdir)(import_node_path11.default.dirname(wrapperPath), { recursive: true });
+  await (0, import_promises10.writeFile)(wrapperPath, buildLarkCliWrapper(input), { encoding: "utf8", mode: 493 });
+  await (0, import_promises10.chmod)(wrapperPath, 493);
+  return wrapperPath;
+}
 async function clearFeishuToken(input) {
   await (0, import_promises10.rm)(feishuTokenPath(input.workspaceDir), { force: true });
 }
+function buildLarkCliWrapper(input) {
+  const runner = resolveLarkCliRunner();
+  return [
+    "#!/usr/bin/env bash",
+    "set -euo pipefail",
+    'SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"',
+    'TOKEN_FILE="${SELF_DIR}/feishu/token"',
+    'if [[ ! -s "$TOKEN_FILE" ]]; then',
+    '  echo "Feishu token unavailable" >&2',
+    "  exit 2",
+    "fi",
+    `export LARKSUITE_CLI_APP_ID=${shellQuote(input.appId)}`,
+    'export LARKSUITE_CLI_USER_ACCESS_TOKEN="$(cat "$TOKEN_FILE")"',
+    "export LARKSUITE_CLI_DEFAULT_AS=user",
+    "export LARKSUITE_CLI_STRICT_MODE=user",
+    `export LARKSUITE_CLI_BRAND=${shellQuote(input.brand ?? "feishu")}`,
+    runner ? `exec ${shellQuote(process.execPath)} ${shellQuote(runner)} "$@"` : 'exec lark-cli "$@"',
+    ""
+  ].join("\n");
+}
+function resolveLarkCliRunner() {
+  try {
+    return requireFromHere.resolve("@larksuite/cli/scripts/run.js");
+  } catch {
+    return void 0;
+  }
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 
 // src/agent-manager/activity-tracker.ts
 var ActivityTracker = class {
@@ -4706,9 +4826,7 @@ var WorkspaceBrowser = class {
   }
   rootDirForAgent(agentId, serverNamespace, machineId) {
     if (typeof this.options === "function") return this.options(agentId);
-    const scope = serverNamespace && machineId ? { serverNamespace, machineId } : this.options.workspaceScopeForAgent(agentId);
-    if (!scope) return void 0;
-    return import_node_path12.default.join(this.options.rootDir, scope.serverNamespace, scope.machineId, agentId);
+    return this.options.workspaceDirectoryForAgent(agentId, serverNamespace, machineId);
   }
   resolveInside(base, relativePath) {
     const resolved = import_node_path12.default.resolve(base, relativePath);
@@ -4723,6 +4841,21 @@ function isSafeWorkspaceDirectoryName(directoryName) {
     directoryName && directoryName !== "." && directoryName !== ".." && !directoryName.includes("/") && !directoryName.includes("\\") && !directoryName.includes("..")
   );
 }
+function displayNameToWorkspaceDirectoryName(displayName, fallback = "machine") {
+  const cleaned = displayName.trim().normalize("NFKC").replace(/[\/\\:]+/g, "-").replace(/\s+/g, "-").replace(/[^A-Za-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^[.-]+|[.-]+$/g, "").slice(0, 80);
+  return cleaned || fallback;
+}
+function namedWorkspaceDirectoryName(displayName, id, fallback = "item") {
+  const namePart = displayNameToWorkspaceDirectoryName(displayName, fallback);
+  const idPart = workspaceDirectoryIdPart(namePart, id);
+  return `${namePart}-${idPart}`;
+}
+function workspaceDirectoryIdPart(namePart, id) {
+  let idPart = displayNameToWorkspaceDirectoryName(id, "id");
+  if (idPart.startsWith(`${namePart}-`)) idPart = idPart.slice(namePart.length + 1);
+  idPart = idPart.replace(/^(machine|agent|org)[_-]/, "");
+  return idPart || displayNameToWorkspaceDirectoryName(id, "id");
+}
 
 // src/agent-manager/agent-process-manager.ts
 var AgentProcessManager = class {
@@ -4731,9 +4864,11 @@ var AgentProcessManager = class {
     this.modelDetector = options.modelDetector ?? new RuntimeModelDetector();
     this.browser = new WorkspaceBrowser({
       rootDir: this.options.rootDir,
-      workspaceScopeForAgent: (agentId) => {
+      workspaceDirectoryForAgent: (agentId, serverNamespace, machineId) => {
         const config = this.running.get(agentId)?.config ?? this.idleConfigs.get(agentId)?.config;
-        return config ? { serverNamespace: config.serverNamespace, machineId: config.machineId } : void 0;
+        if (config) return this.resolveWorkspaceDirectory(config, agentId);
+        if (serverNamespace && machineId) return this.resolveWorkspaceDirectoryForParts(machineId, machineId, agentId, agentId);
+        return void 0;
       }
     });
     this.reminderCache.onFire((job) => {
@@ -4801,15 +4936,15 @@ var AgentProcessManager = class {
     } else if (message.type === "agent:workspace:list") {
       await this.replyWorkspaceList(message.agentId, message.requestId, message.path, message.serverNamespace, message.machineId, message.config);
     } else if (message.type === "agent:workspace:read") {
-      await this.replyWorkspaceRead(message.agentId, message.requestId, message.path, message.serverNamespace, message.machineId);
+      await this.replyWorkspaceRead(message.agentId, message.requestId, message.path, message.serverNamespace, message.machineId, message.config);
     } else if (message.type === "agent:workspace:write") {
-      await this.replyWorkspaceWrite(message.agentId, message.requestId, message.path, message.content, message.serverNamespace, message.machineId);
+      await this.replyWorkspaceWrite(message.agentId, message.requestId, message.path, message.content, message.serverNamespace, message.machineId, message.config);
     } else if (message.type === "agent:skills:list") {
       await this.replyAgentSkillsList(message.agentId, message.requestId, message.runtime, message.serverNamespace, message.machineId, message.config);
     } else if (message.type === "agent:workspace:init") {
       await this.replyWorkspaceInit(message.requestId, message.agentId, message.config);
     } else if (message.type === "feishu:token:write") {
-      await this.replyFeishuTokenWrite(message.requestId, message.agentId, message.token, message.config);
+      await this.replyFeishuTokenWrite(message.requestId, message.agentId, message.token, message.appId, message.brand, message.config);
     } else if (message.type === "feishu:token:clear") {
       await this.replyFeishuTokenClear(message.requestId, message.agentId, message.config);
     } else if (message.type === "feishu:delegation:start" || message.type === "feishu:delegation:update") {
@@ -4834,9 +4969,9 @@ var AgentProcessManager = class {
       const results = await this.detectRuntimeModels(message.runtimes ?? ["cursor", "claude", "codex", "gemini", "kimi", "hermes", "opencode"]);
       this.options.sendToServer({ type: "machine:runtime_models:result", requestId: message.requestId, results });
     } else if (message.type === "machine:workspace:scan") {
-      await this.replyMachineWorkspaceScan(message.requestId, message.serverNamespace, message.machineId, message.knownAgentIds ?? []);
+      await this.replyMachineWorkspaceScan(message.requestId, message.serverNamespace, message.machineId, message.machineName, message.knownAgentIds ?? []);
     } else if (message.type === "machine:workspace:delete") {
-      await this.replyMachineWorkspaceDelete(message.requestId, message.serverNamespace, message.machineId, message.directoryName);
+      await this.replyMachineWorkspaceDelete(message.requestId, message.serverNamespace, message.machineId, message.machineName, message.directoryName);
     } else if (message.type === "agent:reset-workspace") {
       await this.replyResetWorkspace(message.requestId, message.agentId, message.config);
     } else if (message.type === "agent:diagnostic") {
@@ -4973,7 +5108,9 @@ var AgentProcessManager = class {
       rootDir: this.options.rootDir,
       serverNamespace: config.serverNamespace,
       serverId: config.spaceId,
+      machineDirectoryName: this.machineDirectoryName(config),
       machineId: config.machineId,
+      agentDirectoryName: this.agentDirectoryName(config, agentId),
       daemonId: import_node_os8.default.hostname() || "local-daemon",
       agentId,
       agentName: config.agentName,
@@ -5043,16 +5180,18 @@ var AgentProcessManager = class {
   }
   async ensureAgentWorkspace(agentId, config) {
     const running = this.running.get(agentId);
-    if (running) return { workspace: running.workspace };
+    if (running && !config?.feishuDelegationEnabled) return { workspace: running.workspace };
     const idle = this.idleConfigs.get(agentId);
-    if (idle?.workspace) return { workspace: idle.workspace };
+    if (idle?.workspace && !config?.feishuDelegationEnabled) return { workspace: idle.workspace };
     const effectiveConfig = config ?? idle?.config;
     if (!effectiveConfig) return { missing: true };
     const workspace = await createAgentWorkspace({
       rootDir: this.options.rootDir,
       serverNamespace: effectiveConfig.serverNamespace,
       serverId: effectiveConfig.spaceId,
+      machineDirectoryName: this.machineDirectoryName(effectiveConfig),
       machineId: effectiveConfig.machineId,
+      agentDirectoryName: this.agentDirectoryName(effectiveConfig, agentId),
       daemonId: import_node_os8.default.hostname() || "local-daemon",
       agentId,
       agentName: effectiveConfig.agentName,
@@ -5060,6 +5199,10 @@ var AgentProcessManager = class {
       role: effectiveConfig.role,
       feishuDelegationEnabled: effectiveConfig.feishuDelegationEnabled
     });
+    if (running) {
+      running.workspace = workspace;
+      running.config = effectiveConfig;
+    }
     this.idleConfigs.set(agentId, { config: effectiveConfig, sessionId: effectiveConfig.sessionId, workspace });
     return { workspace };
   }
@@ -5071,7 +5214,7 @@ var AgentProcessManager = class {
         requestId,
         agentId,
         ok: true,
-        workspacePath: workspace ? `~/.wm/${config.serverNamespace}/${config.machineId}/${agentId}/` : void 0
+        workspacePath: workspace ? this.workspaceDisplayPath(config, agentId) : void 0
       });
     } catch (error) {
       this.options.sendToServer({
@@ -5083,11 +5226,12 @@ var AgentProcessManager = class {
       });
     }
   }
-  async replyFeishuTokenWrite(requestId, agentId, token, config) {
+  async replyFeishuTokenWrite(requestId, agentId, token, appId, brand, config) {
     try {
       const { workspace } = await this.ensureAgentWorkspace(agentId, config);
       if (!workspace) throw new Error(`workspace missing for ${agentId}`);
       const tokenPath = await writeFeishuToken({ workspaceDir: workspace.agentDir, token });
+      await writeLarkCliWrapper({ workspaceDir: workspace.agentDir, appId, brand });
       this.options.sendToServer({ type: "feishu:token:write_result", requestId, agentId, ok: true, tokenPath });
     } catch (error) {
       this.options.sendToServer({
@@ -5651,9 +5795,7 @@ var AgentProcessManager = class {
         return;
       }
       const effectiveConfig = config ?? this.running.get(agentId)?.config ?? this.idleConfigs.get(agentId)?.config;
-      const namespace = serverNamespace ?? effectiveConfig?.serverNamespace;
-      const machine = machineId ?? effectiveConfig?.machineId;
-      const entries = await this.browser.listFiles(agentId, dirPath, namespace, machine);
+      const entries = await this.browser.listFiles(agentId, dirPath, serverNamespace ?? effectiveConfig?.serverNamespace, machineId ?? effectiveConfig?.machineId);
       this.options.sendToServer({ type: "agent:workspace:file_tree", agentId, requestId, entries });
     } catch (error) {
       this.log(`workspace list failed agent=${agentId} request=${requestId} error=${error instanceof Error ? error.message : String(error)}`);
@@ -5666,10 +5808,11 @@ var AgentProcessManager = class {
       });
     }
   }
-  async replyWorkspaceRead(agentId, requestId, filePath, serverNamespace, machineId) {
+  async replyWorkspaceRead(agentId, requestId, filePath, serverNamespace, machineId, config) {
     try {
       this.log(`workspace read agent=${agentId} request=${requestId} path=${filePath}`);
-      const file = await this.browser.readFile(agentId, filePath, serverNamespace, machineId);
+      const effectiveConfig = config ?? this.running.get(agentId)?.config ?? this.idleConfigs.get(agentId)?.config;
+      const file = await this.browser.readFile(agentId, filePath, serverNamespace ?? effectiveConfig?.serverNamespace, machineId ?? effectiveConfig?.machineId);
       this.options.sendToServer({ type: "agent:workspace:file_content", agentId, requestId, file });
     } catch (error) {
       this.log(`workspace read failed agent=${agentId} request=${requestId} error=${error instanceof Error ? error.message : String(error)}`);
@@ -5682,10 +5825,11 @@ var AgentProcessManager = class {
       });
     }
   }
-  async replyWorkspaceWrite(agentId, requestId, filePath, content, serverNamespace, machineId) {
+  async replyWorkspaceWrite(agentId, requestId, filePath, content, serverNamespace, machineId, config) {
     try {
       this.log(`workspace write agent=${agentId} request=${requestId} path=${filePath}`);
-      const result = await this.browser.writeFile(agentId, filePath, content, serverNamespace, machineId);
+      const effectiveConfig = config ?? this.running.get(agentId)?.config ?? this.idleConfigs.get(agentId)?.config;
+      const result = await this.browser.writeFile(agentId, filePath, content, serverNamespace ?? effectiveConfig?.serverNamespace, machineId ?? effectiveConfig?.machineId);
       this.options.sendToServer({ type: "agent:workspace:write_result", agentId, requestId, ...result });
     } catch (error) {
       this.options.sendToServer({
@@ -5708,7 +5852,9 @@ var AgentProcessManager = class {
       const result = await scanAgentSkills({
         rootDir: this.options.rootDir,
         serverNamespace: namespace,
+        machineDirectoryName: this.machineDirectoryName(effectiveConfig),
         machineId: machine,
+        agentDirectoryName: effectiveConfig ? this.agentDirectoryName(effectiveConfig, agentId) : namedWorkspaceDirectoryName(agentId, agentId, "agent"),
         agentId,
         runtime
       });
@@ -5724,9 +5870,9 @@ var AgentProcessManager = class {
       });
     }
   }
-  async replyMachineWorkspaceScan(requestId, serverNamespace, machineId, knownAgentIds) {
+  async replyMachineWorkspaceScan(requestId, serverNamespace, machineId, machineName, knownAgentIds) {
     try {
-      const entries = await this.scanWorkspaces(serverNamespace, machineId, new Set(knownAgentIds));
+      const entries = await this.scanWorkspaces(serverNamespace, machineId, machineName, new Set(knownAgentIds));
       this.options.sendToServer({ type: "machine:workspace:scan/result", requestId, entries });
     } catch (error) {
       this.options.sendToServer({
@@ -5737,11 +5883,11 @@ var AgentProcessManager = class {
       });
     }
   }
-  async replyMachineWorkspaceDelete(requestId, serverNamespace, machineId, directoryName) {
+  async replyMachineWorkspaceDelete(requestId, serverNamespace, machineId, machineName, directoryName) {
     try {
       if (!isSafeWorkspaceDirectoryName(directoryName)) throw new Error("unsafe workspace directory name");
       if (this.running.has(directoryName) || this.starting.has(directoryName)) throw new Error("cannot delete a running workspace");
-      const target = this.resolveWorkspaceDirectory(serverNamespace, machineId, directoryName);
+      const target = this.resolveWorkspaceDirectoryName(machineName ?? machineId, machineId, directoryName);
       await (0, import_promises12.rm)(target, { recursive: true, force: true });
       this.options.sendToServer({ type: "machine:workspace:delete/result", requestId, directoryName, ok: true });
     } catch (error) {
@@ -5757,13 +5903,15 @@ var AgentProcessManager = class {
   async replyResetWorkspace(requestId, agentId, config) {
     try {
       await this.stopAgent(agentId, "reset-workspace");
-      const target = this.resolveWorkspaceDirectory(config.serverNamespace, config.machineId, agentId);
+      const target = this.resolveWorkspaceDirectory(config, agentId);
       await (0, import_promises12.rm)(target, { recursive: true, force: true });
       const workspace = await createAgentWorkspace({
         rootDir: this.options.rootDir,
         serverNamespace: config.serverNamespace,
         serverId: config.spaceId,
+        machineDirectoryName: this.machineDirectoryName(config),
         machineId: config.machineId,
+        agentDirectoryName: this.agentDirectoryName(config, agentId),
         daemonId: import_node_os8.default.hostname() || "local-daemon",
         agentId,
         agentName: config.agentName,
@@ -5808,7 +5956,7 @@ var AgentProcessManager = class {
     const idle = this.idleConfigs.get(agentId);
     const effectiveConfig = running?.config ?? idle?.config ?? config;
     const workspace = running?.workspace ?? idle?.workspace;
-    const workspacePath = workspace?.agentDir ?? (effectiveConfig ? this.resolveWorkspaceDirectory(effectiveConfig.serverNamespace, effectiveConfig.machineId, agentId) : void 0);
+    const workspacePath = workspace?.agentDir ?? (effectiveConfig ? this.resolveWorkspaceDirectory(effectiveConfig, agentId) : void 0);
     const workspaceExists = workspacePath ? await pathExists(workspacePath) : false;
     return {
       agentId,
@@ -5824,8 +5972,8 @@ var AgentProcessManager = class {
       lastActivity: this.lastActivities.get(agentId)
     };
   }
-  async scanWorkspaces(serverNamespace, machineId, knownAgentIds) {
-    const machineRoot = this.resolveMachineRoot(serverNamespace, machineId);
+  async scanWorkspaces(serverNamespace, machineId, machineName, knownAgentIds) {
+    const machineRoot = this.resolveMachineRoot(machineName ?? machineId, machineId);
     const names = await (0, import_promises12.readdir)(machineRoot, { withFileTypes: true }).catch((error) => {
       if (error.code === "ENOENT") return [];
       throw error;
@@ -5833,14 +5981,15 @@ var AgentProcessManager = class {
     const entries = [];
     for (const entry of names) {
       if (!entry.isDirectory() || !isSafeWorkspaceDirectoryName(entry.name)) continue;
-      const fullPath = this.resolveWorkspaceDirectory(serverNamespace, machineId, entry.name);
+      const fullPath = this.resolveWorkspaceDirectoryName(machineName ?? machineId, machineId, entry.name);
       const summary = await summarizeDirectory(fullPath);
+      const agentId = agentIdFromDirectoryName(entry.name, knownAgentIds);
       entries.push({
         directoryName: entry.name,
-        agentId: entry.name,
-        workspacePath: `~/.wm/${serverNamespace}/${machineId}/${entry.name}/`,
-        knownToServer: knownAgentIds.has(entry.name),
-        running: this.running.has(entry.name) || this.starting.has(entry.name),
+        agentId,
+        workspacePath: `~/.wm/${this.machineDirectoryNameForParts(machineName ?? machineId, machineId)}/${entry.name}/`,
+        knownToServer: knownAgentIds.has(agentId),
+        running: this.running.has(agentId) || this.starting.has(agentId),
         fileCount: summary.fileCount,
         totalSizeBytes: summary.totalSizeBytes,
         lastModified: summary.lastModified
@@ -5848,25 +5997,36 @@ var AgentProcessManager = class {
     }
     return entries.sort((a, b) => b.lastModified - a.lastModified || a.directoryName.localeCompare(b.directoryName));
   }
-  resolveNamespaceRoot(serverNamespace) {
-    if (!isSafeWorkspaceDirectoryName(serverNamespace)) throw new Error("unsafe server namespace");
-    const resolved = import_node_path13.default.resolve(this.options.rootDir, serverNamespace);
+  resolveMachineRoot(machineName, machineId) {
+    const machineDirectoryName = this.machineDirectoryNameForParts(machineName, machineId);
+    if (!isSafeWorkspaceDirectoryName(machineDirectoryName)) throw new Error("unsafe machine directory");
+    const resolved = import_node_path13.default.resolve(this.options.rootDir, machineDirectoryName);
     const base = import_node_path13.default.resolve(this.options.rootDir);
     if (resolved !== base && !resolved.startsWith(`${base}${import_node_path13.default.sep}`)) throw new Error("workspace root escapes daemon root");
     return resolved;
   }
-  resolveMachineRoot(serverNamespace, machineId) {
-    if (!isSafeWorkspaceDirectoryName(machineId)) throw new Error("unsafe machine id");
-    const namespaceRoot = this.resolveNamespaceRoot(serverNamespace);
-    const resolved = import_node_path13.default.resolve(namespaceRoot, machineId);
-    if (resolved !== namespaceRoot && !resolved.startsWith(`${namespaceRoot}${import_node_path13.default.sep}`)) {
-      throw new Error("machine workspace root escapes namespace");
-    }
-    return resolved;
+  machineDirectoryName(config) {
+    return this.machineDirectoryNameForParts(config?.machineName ?? this.options.machineDisplayName, config?.machineId ?? "machine");
+  }
+  machineDirectoryNameForParts(machineName, machineId) {
+    return namedWorkspaceDirectoryName(machineName, machineId, "machine");
+  }
+  agentDirectoryName(config, agentId) {
+    return namedWorkspaceDirectoryName(config.agentName, agentId, "agent");
+  }
+  workspaceDisplayPath(config, agentId) {
+    return `~/.wm/${this.machineDirectoryName(config)}/${this.agentDirectoryName(config, agentId)}/`;
   }
-  resolveWorkspaceDirectory(serverNamespace, machineId, directoryName) {
+  resolveWorkspaceDirectory(config, agentId) {
+    return this.resolveWorkspaceDirectoryForParts(config.machineName ?? this.options.machineDisplayName, config.machineId, config.agentName, agentId);
+  }
+  resolveWorkspaceDirectoryForParts(machineName, machineId, agentName, agentId) {
+    const directoryName = namedWorkspaceDirectoryName(agentName, agentId, "agent");
+    return this.resolveWorkspaceDirectoryName(machineName, machineId, directoryName);
+  }
+  resolveWorkspaceDirectoryName(machineName, machineId, directoryName) {
     if (!isSafeWorkspaceDirectoryName(directoryName)) throw new Error("unsafe workspace directory name");
-    const machineRoot = this.resolveMachineRoot(serverNamespace, machineId);
+    const machineRoot = this.resolveMachineRoot(machineName, machineId);
     const resolved = import_node_path13.default.resolve(machineRoot, directoryName);
     if (resolved !== machineRoot && !resolved.startsWith(`${machineRoot}${import_node_path13.default.sep}`)) {
       throw new Error("workspace directory escapes machine root");
@@ -5946,7 +6106,9 @@ function formatActionableMessagePrompt(messages, wrapperPath) {
     first?.message_id ? `Message ID: ${first.message_id}` : "Message ID: unknown",
     `Thread reply target: ${replyTarget}`,
     "",
-    "Collaboration rule: if this message asks you to ask, check, confirm, contact, or get status from another agent, do not inspect local process/workspace/server activity/task list to answer for them. Ask that agent in this exact thread target with an @mention, wait for their platform reply, then summarize in the same thread.",
+    "Before acting, identify the requested work surface: Wage Mule platform, local workspace, or an external system. Use the tool for that surface.",
+    "Platform-agent collaboration rule: if this message asks you to ask, check, confirm, contact, or get status from another platform agent, do not inspect local process/workspace/server activity/task list to answer for them. Ask that agent in this exact thread target with an @mention, wait for their platform reply, then summarize in the same thread.",
+    "External-system rule: if the user names an external system such as Feishu/Lark, do the action through that external skill, CLI, token, or API, then report the result in this thread. Do not replace an external contact request with a platform mention.",
     "",
     "Complete the requested work. When you have a channel-visible final reply, send it with this agent-local absolute command:",
     replyCommand,
@@ -6029,6 +6191,12 @@ async function summarizeDirectory(root) {
   await visit(root);
   return { fileCount, totalSizeBytes, lastModified };
 }
+function agentIdFromDirectoryName(directoryName, knownAgentIds) {
+  for (const agentId of knownAgentIds) {
+    if (directoryName.endsWith(`-${agentId}`)) return agentId;
+  }
+  return directoryName;
+}
 async function pathExists(targetPath) {
   try {
     await (0, import_promises12.stat)(targetPath);
@@ -6129,6 +6297,7 @@ async function runDaemon(input) {
   let connection;
   const manager = new AgentProcessManager({
     rootDir: input.rootDir,
+    machineDisplayName: input.name?.trim() || import_node_os9.default.hostname() || "machine",
     sendToServer: (msg) => connection.send(msg),
     log
   });