@yep-ai/cli 1.1.0 → 1.2.2

package/README.md

@@ -5,14 +5,14 @@
 ## 安装与使用
 
 ```sh
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep --help
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep --help
 ```
 
-以下远程命令适用于 1.1.0 发布之后；本次实现不代表 npm 或网站已更新。用户可通过 npx 运行设备节点安装包，无需全局安装：
+用户可通过 npx 运行安装包，无需全局安装：
 
 ```sh
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep --help
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device start
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep --help
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep device start
 ```
 
 本包包含完整实现。`yep-cli` 是计划中的同版本入口包，当前尚未发布本项目版本，请使用 `@yep-ai/cli`。
@@ -26,31 +26,31 @@ npm install
 npm run yep -- --help
 npm run build:yep-node
 npm run pack:cli
-npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.1.0.tgz ./dist/cli/unscoped/yep-cli-1.1.0.tgz
+npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.2.2.tgz ./dist/cli/unscoped/yep-cli-1.2.2.tgz
 ./tmp/yep-install/node_modules/.bin/yep --version
 ```
 
-完整实现包为 `scoped/yep-ai-cli-1.1.0.tgz`，入口包为 `unscoped/yep-cli-1.1.0.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
+完整实现包为 `scoped/yep-ai-cli-1.2.2.tgz`，入口包为 `unscoped/yep-cli-1.2.2.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
 
 ## 市场与 Git 内容版本
 
 ```sh
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep login --registry https://yep.nihao.cool
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep whoami
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep search assistant
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep info @creator/demo
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep client set codex,claude
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep install @creator/demo --client codex
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep list
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep list --remote
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep list --mine
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep uninstall @creator/demo --client codex
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep publish ./my-skill
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep history @creator/demo
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep diff @creator/demo --base published
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep publish ./my-agent --kind agent
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep submit @creator/demo --kind agent
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep withdraw @creator/demo --kind agent
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep login --registry https://yep.nihao.cool
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep whoami
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep search assistant
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep info @creator/demo
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep client set codex,claude
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep install @creator/demo --client codex
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep list
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep list --remote
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep list --mine
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep uninstall @creator/demo --client codex
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep publish ./my-skill
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep history @creator/demo
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep diff @creator/demo --base published
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep publish ./my-agent --kind agent
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep submit @creator/demo --kind agent
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep withdraw @creator/demo --kind agent
 ```
 
 默认资源类型为 `skill`，也支持 `--kind agent|plugin`。Skill 私有保存后从网页申请共享审核；Agent/Plugin 的发布会提交审核。审核通过才进入公开市场。`history` 和 `diff` 访问服务端保留的真实 Git 版本。
@@ -60,10 +60,10 @@ npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep withd
 ## 设备节点
 
 ```sh
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device login
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device start "/path/to/documents"
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device status
-npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device logout
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep device login
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep device start "/path/to/documents"
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep device status
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep device logout
 ```
 
 设备通过 HTTPS 配对和 WSS 出站连接；网页批准设备后，还需在某场咨询中选择目录和权限。目录不会整体上传。最多指定 5 个目录；指定目录时仅提供受限内置命令。不指定目录时仅授权当前目录；必须显式使用 `--privacy system` 才启用完整系统终端，该终端拥有当前系统用户权限，可访问其他文件和网络，输入输出不经过文件脱敏。进程退出后节点离线，不安装后台服务。设备授权最长 24 小时，可以从网页或 CLI 撤销。
@@ -75,7 +75,7 @@ npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep devic
 原生程序随 npm 包一起分发，无需用户安装 Go。当前构建目标为 Windows x64 / ARM64、macOS Intel / Apple Silicon、Linux x64 / ARM64；Windows 需要支持 ConPTY 的 Windows 10 1809 / Server 2019 或更新版本。鸿蒙 / OpenHarmony 原生 ABI 尚未适配，不能将 Linux ARM64 包视为鸿蒙包。缺少原生程序时会明确提示并提供兼容的逐条命令模式；受限目录始终使用内置命令模式，不启动系统 Shell。
 
 设备配对和网络通道使用 HTTPS / WSS；服务端保存令牌摘要，客户端每小时轮换设备令牌并保留短暂交接窗口，轮换不会延长原有 24 小时授权。客户端先持久化待交接凭据，断线后继续完成交接。TLS 在站点入口终止，集群内部连接不属于端到端加密。
-指定启动目录时仅支持 `pwd`、`ls` / `dir`、`echo`、`cat` / `type`、`head`、`tail`、`grep` / `findstr`、`wc -l` 与终端内的 `cd`，不能使用管道、重定向或外部程序。已有旧版节点若提示不支持终端，请停止旧进程，将原启动命令中的 `yep` 替换为 `npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep`，保留原目录参数。
+指定启动目录时仅支持 `pwd`、`ls` / `dir`、`echo`、`cat` / `type`、`head`、`tail`、`grep` / `findstr`、`wc -l` 与终端内的 `cd`，不能使用管道、重定向或外部程序。已有旧版节点若提示不支持终端，请停止旧进程，将原启动命令中的 `yep` 替换为 `npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep`，保留原目录参数。
 
 设备默认连接 `https://yep.nihao.cool`，使用本站时无需指定服务器。连接自建站点时可使用 `--server https://your-site.example`；只接受 HTTPS 源站（回环开发地址允许 HTTP），显式指定后记住该源站，令牌按源站隔离。市场登录不等于设备授权。
 
@@ -95,9 +95,9 @@ npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep devic
 
 市场凭据保存为 `~/.config/yep/config.json`；设备身份和各源站的授权保存在 `~/.config/yep/devices/`。目录权限 `0700`、凭据文件 `0600`；Windows 使用当前用户专属 ACL。市场和设备令牌分别管理。域名改变后需要在新源站重新登录、配对，不会把旧源站令牌发送到新地址。
 
-执行 `npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep --help` 或 `npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device --help` 查看全部选项。
+执行 `npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep --help` 或 `npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.2.2.tgz yep device --help` 查看全部选项。
 
-## 本地脱敏（1.1.0）
+## 本地脱敏（1.2.2）
 
 默认 `device start` 为严格模式，无目录参数时仅授权当前目录；完整系统终端需显式 `--privacy system`，其输入输出不经过文件脱敏。读取、搜索、下载及发布前使用本机 Go 核心，规则修改不需要用户编译。
 
@@ -113,4 +113,28 @@ yep privacy export ./report.txt --out ./report.safe.txt --offline
 
 支持 10 MiB 以内的 UTF-8 文本、源码、JSON/YAML/CSV；PDF、Office、图片、压缩包与其他无法解析为文本的文件默认允许原样传输。可在「设备节点 → 脱敏规则」选择阻断，或设置本地 `unsupportedFiles: block`；任一适用策略要求阻断时以阻断为准。原件不覆盖。任意 JS 脚本不在默认引擎中执行。检测不保证穷尽自然语言秘密，发送前仍需本机复核。详见仓库 `docs/privacy.md`。
 
-本仓库已准备 1.1.0；npm 发布与网站部署完成后，对应远程版本命令才可使用。
+本仓库已准备 1.2.2；npm 发布与网站部署完成后，对应远程版本命令才可使用。
+
+## 飞书智能体节点
+
+飞书节点由独立的 Go 进程负责，与 `yep device start` 的设备、目录和权限分开管理。
+
+```sh
+npx --yes @yep-ai/cli@1.2.2 feishu setup --install-service
+npx --yes @yep-ai/cli@1.2.2 feishu status
+npx --yes @yep-ai/cli@1.2.2 feishu doctor --fix
+npx --yes @yep-ai/cli@1.2.2 feishu restart
+npx --yes @yep-ai/cli@1.2.2 feishu logs --follow
+```
+
+`setup` 自动打开平台授权页、飞书官方创建/授权二维码；完成扫码后保存节点专用凭据，启动长连接并检查权限。飞书官方扫码和企业管理员要求的审批需要本人完成。网页「飞书节点」也支持直接托管，关闭浏览器后继续运行。
+
+在网页选择允许的私聊用户、群和回复规则。机器人消息需显式允许发送方机器人，而且必须 @ 本机器人，防止循环回复。群消息只处理白名单群；默认只回复 @ 消息，可选择关键词或群内全部消息（后者需额外权限）。当前支持文本收发、会话上下文、自动回复和消息处理记录，用户画像与知识库暂未接入回复。
+
+`doctor --fix` 打开权限修复页并重新检查，不会代替飞书的授权审批。`feishu stop` 停止本机服务，`feishu remove` 撤销节点。系统服务使用当前用户的 systemd / LaunchAgent / Windows 任务计划程序；运行文件、凭据和日志独立保存。完整说明见仓库 `packages/yep-feishu-node/README.md`。
+
+### Windows 配置权限修复（1.2.2）
+
+已有飞书配置目录或文件继承了 Windows 用户目录权限时，CLI 会自动限制本人拥有的配置路径，只允许本人、SYSTEM 和 Administrators 访问。目录权限传递给子目录与文件；配置内容保持。使用独立脚本和 `-NoProfile` 执行，路径包含空格、中文、方括号或单引号均按字面值处理。无法修复时显示路径及可操作说明。
+
+从旧版升级后执行 `npx --yes @yep-ai/cli@1.2.2 feishu setup`；不需要删除已有凭据或切换终端。PowerShell 启动配置中的 Docker 报错与飞书节点无关。

package/bin/market.js

@@ -592,6 +592,8 @@ Usage:
   ${cliName} login                                   Sign in and save a registry token
   ${cliName} logout                                  Revoke the current saved login
   ${cliName} whoami                                  Show the signed-in account
+  ${cliName} feishu setup                            Connect an independent Feishu bot node
+  ${cliName} feishu --help                           Feishu status, diagnostics and service control
   ${cliName} search <query>                          Search marketplace skills
   ${cliName} info <skill-name>                       Print skill metadata
   ${cliName} client [list|set <clients>|reset]        Show, pin or clear default clients
@@ -1318,7 +1320,7 @@ async function privatePackageFiles(packageDir, registry, token) {
     for (const [name, content] of Object.entries(files)) {
       await manager.checkPath(name); await manager.metadata(name);
       const result = await manager.scan(Buffer.from(content), name, "marketplace-publication");
-      sanitized[name] = result.data; changed ||= !Buffer.from(content).equals(result.data);
+      sanitized[name] = result.data; changed ||= result.action === "redact";
     }
     if (changed) {
       const review = join(manager.directory, "review", String(Date.now()));

package/bin/yep.js

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 import { runMarketplace } from "./market.js";
+import { runFeishu } from "../lib/feishu/command.js";
 import { runDevice } from "../lib/device/command.js";
 import { runPrivacy } from "../lib/privacy/command.js";
 const argv = process.argv.slice(2);
 try {
   if (argv[0] === "device") await runDevice(argv.slice(1));
+  else if (argv[0] === "feishu") await runFeishu(argv.slice(1));
   else if (argv[0] === "privacy") await runPrivacy(argv.slice(1));
   else await runMarketplace(argv);
 } catch (error) {

package/lib/feishu/command.js

@@ -0,0 +1,534 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { createHash, randomUUID } from "node:crypto";
+import { spawn, execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+import { setTimeout as delay } from "node:timers/promises";
+import { service } from "./service.js";
+
+const exec = promisify(execFile);
+const windowsACLScript = fileURLToPath(new URL("./private-path.ps1", import.meta.url));
+const help = `Yep 飞书智能体（独立 Go 服务）
+yep feishu setup [--server https://yep.nihao.cool] [--app-id cli_…] [--all-group-messages] [--no-open] [--install-service]
+yep feishu start [--foreground] [--install-service]
+yep feishu status [--json]
+yep feishu doctor [--fix] [--no-open]
+yep feishu logs [--follow]
+yep feishu stop | restart | remove
+yep feishu service install | uninstall
+
+可选：--node <节点 ID>、--server <平台地址>。
+setup 自动打开账号确认页与飞书授权页，确认后启动服务。
+remove 撤销平台节点令牌并删除本机凭据；飞书应用保留。
+平台管理：<server>/feishu。升级：npm install -g @yep-ai/cli@latest，然后 yep feishu restart。`;
+export function origin(value) {
+  const u = new URL(value);
+  if (
+    u.username ||
+    u.password ||
+    u.search ||
+    u.hash ||
+    u.pathname !== "/" ||
+    (u.protocol !== "https:" &&
+      !(
+        u.protocol === "http:" &&
+        ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname)
+      ))
+  )
+    throw new Error("平台地址须为 HTTPS origin；本机开发支持 HTTP。");
+  return u.origin;
+}
+export async function privatePath(location, directory = false) {
+  const st = await fs.lstat(location);
+  if (st.isSymbolicLink() || (directory ? !st.isDirectory() : !st.isFile()))
+    throw new Error("飞书配置路径不安全。");
+  if (
+    process.platform !== "win32" &&
+    (st.mode & 0o077 || st.uid !== process.getuid())
+  )
+    throw new Error("飞书配置权限不安全，请设为目录 0700、文件 0600。");
+  if (process.platform === "win32") {
+    try {
+      await exec("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", windowsACLScript], {
+        env: { ...process.env, YEP_FEISHU_ACL_PATH: location, YEP_FEISHU_ACL_DIRECTORY: directory ? "1" : "0" },
+        windowsHide: true,
+        timeout: 15000,
+      });
+    } catch (cause) {
+      throw new Error(`无法保护飞书配置路径：${location}。请使用创建该目录的 Windows 账号运行，并确认目录可写。`, { cause });
+    }
+  }
+  return st;
+}
+async function protect(location, directory = false) {
+  if (process.platform !== "win32")
+    return fs.chmod(location, directory ? 0o700 : 0o600);
+  await privatePath(location, directory);
+}
+async function privateWrite(location, value) {
+  const temp = location + "." + randomUUID();
+  try {
+    const f = await fs.open(temp, "wx", 0o600);
+    try {
+      await f.writeFile(JSON.stringify(value, null, 2));
+      await protect(temp);
+      await f.sync();
+    } finally {
+      await f.close();
+    }
+    await fs.rename(temp, location);
+  } finally {
+    await fs.rm(temp, { force: true });
+  }
+}
+export async function request(
+  server,
+  route,
+  { token, method = "GET", body, signal } = {},
+) {
+  const res = await fetch(server + route, {
+    method,
+    headers: {
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      ...(body ? { "Content-Type": "application/json" } : {}),
+    },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+    signal: signal || AbortSignal.timeout(30000),
+    redirect: "error",
+  });
+  const value = await res.json();
+  if (!res.ok)
+    throw new Error(value.error || `飞书服务返回 HTTP ${res.status}`);
+  return value;
+}
+async function openURL(value, noOpen) {
+  console.log(`打开：${value}`);
+  if (noOpen) return;
+  const [bin, args] =
+    process.platform === "darwin"
+      ? ["open", [value]]
+      : process.platform === "win32"
+        ? ["rundll32.exe", ["url.dll,FileProtocolHandler", value]]
+        : ["xdg-open", [value]];
+  try {
+    await exec(bin, args, { timeout: 5000, windowsHide: true });
+  } catch {
+    console.log("浏览器未自动打开，请使用上方地址。");
+  }
+}
+export async function nativeBinary() {
+  const target = `${process.platform}-${process.arch}`,
+    file =
+      process.platform === "win32" ? "yep-feishu-node.exe" : "yep-feishu-node",
+    root = fileURLToPath(new URL("../../", import.meta.url)),
+    manifest = JSON.parse(
+      await fs.readFile(
+        path.join(root, "native", "feishu-manifest.json"),
+        "utf8",
+      ),
+    ),
+    relative = `${target}/${file}`,
+    binary = path.join(root, "native", relative);
+  const expected = manifest.files[relative]?.sha256;
+  if (!expected)
+    throw new Error(`当前系统 ${target} 尚无飞书节点，请使用平台托管。`);
+  const hash = createHash("sha256")
+    .update(await fs.readFile(binary))
+    .digest("hex");
+  if (hash !== expected)
+    throw new Error("飞书节点文件校验失败，请重新安装 Yep CLI。");
+  if (process.platform !== "win32") await fs.chmod(binary, 0o755);
+  return binary;
+}
+async function control(dir, action = "status") {
+  await privatePath(path.join(dir, "control.json"));
+  const c = JSON.parse(
+    await fs.readFile(path.join(dir, "control.json"), "utf8"),
+  );
+  const u = new URL(c.url);
+  if (
+    u.protocol !== "http:" ||
+    u.hostname !== "127.0.0.1" ||
+    !u.port ||
+    u.pathname !== "/" ||
+    !c.token
+  )
+    throw new Error("本机飞书控制地址不安全。");
+  return request(u.origin, `/${action}`, {
+    token: c.token,
+    method: action === "status" ? "GET" : "POST",
+    body: action === "status" ? undefined : {},
+    signal: AbortSignal.timeout(5000),
+  });
+}
+async function running(dir) {
+  try {
+    return await control(dir);
+  } catch (e) {
+    if (
+      e.code === "ENOENT" ||
+      e.cause?.code === "ECONNREFUSED" ||
+      e.name === "TimeoutError" ||
+      e.message === "fetch failed"
+    )
+      return null;
+    throw e;
+  }
+}
+async function stop(dir) {
+  const current = await running(dir);
+  if (!current) return;
+  await control(dir, "stop");
+  for (let i = 0; i < 80; i++) {
+    if (!(await running(dir))) return;
+    await delay(100);
+  }
+  throw new Error("节点仍在退出，请稍后查看状态。");
+}
+async function start(dir, foreground = false) {
+  if (await running(dir)) {
+    console.log("飞书节点已在运行。");
+    return;
+  }
+  const binary = await nativeBinary(),
+    config = path.join(dir, "credential.json");
+  await privatePath(config);
+  if (foreground) {
+    const child = spawn(binary, ["--config", config], {
+      stdio: "inherit",
+      windowsHide: true,
+    });
+    const close = () => child.kill("SIGTERM");
+    process.once("SIGINT", close);
+    process.once("SIGTERM", close);
+    try {
+      await new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("exit", (code) =>
+          code === 0 ? resolve() : reject(new Error(`飞书节点退出（${code}）`)),
+        );
+      });
+    } finally {
+      process.removeListener("SIGINT", close);
+      process.removeListener("SIGTERM", close);
+    }
+    return;
+  }
+  const log = path.join(dir, "service.log");
+  try {
+    const st = await fs.lstat(log);
+    if (st.isSymbolicLink()) throw new Error("日志路径不安全");
+    if (st.size > 8 * 1024 * 1024) await fs.truncate(log, 0);
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  const out = await fs.open(log, "a", 0o600);
+  await protect(log);
+  let child;
+  try {
+    child = spawn(binary, ["--config", config], {
+      stdio: ["ignore", out.fd, out.fd],
+      detached: true,
+      windowsHide: true,
+    });
+    await new Promise((resolve, reject) => {
+      child.once("spawn", resolve);
+      child.once("error", reject);
+    });
+    child.unref();
+  } finally {
+    await out.close();
+  }
+  for (let i = 0; i < 80; i++) {
+    if (await running(dir)) {
+      console.log("飞书节点已启动；权限检测正在后台进行。");
+      return;
+    }
+    await delay(100);
+  }
+  throw new Error("节点尚未就绪，请运行 yep feishu logs 查看原因。");
+}
+export async function runFeishu(argv) {
+  const command = argv[0] || "help";
+  if (["help", "--help", "-h"].includes(command)) {
+    console.log(help);
+    return;
+  }
+  const allowed = new Set([
+      "--server",
+      "--node",
+      "--app-id",
+      "--name",
+      "--no-open",
+      "--all-group-messages",
+      "--install-service",
+      "--foreground",
+      "--fix",
+      "--follow",
+      "--json",
+    ]),
+    opts = {};
+  let serviceAction;
+  for (let i = 1; i < argv.length; i++) {
+    const arg = argv[i];
+    if (command === "service" && i === 1 && !arg.startsWith("--")) {
+      serviceAction = arg;
+      continue;
+    }
+    if (!allowed.has(arg)) throw new Error(`未知参数：${arg}`);
+    if (["--server", "--node", "--app-id", "--name"].includes(arg)) {
+      if (!argv[i + 1] || argv[i + 1].startsWith("--"))
+        throw new Error(`${arg} 缺少值`);
+      opts[arg] = argv[++i];
+    } else opts[arg] = true;
+  }
+  if (
+    ![
+      "setup",
+      "start",
+      "status",
+      "doctor",
+      "logs",
+      "stop",
+      "restart",
+      "remove",
+      "service",
+    ].includes(command)
+  )
+    throw new Error("未知命令；运行 yep feishu --help。");
+  const base =
+    process.env.YEP_FEISHU_CONFIG_DIR ||
+    path.join(
+      process.env.YEP_CONFIG_DIR || path.join(os.homedir(), ".config", "yep"),
+      "feishu",
+    );
+  const made = await fs.mkdir(base, { recursive: true, mode: 0o700 });
+  if (made) await protect(base, true);
+  await privatePath(base, true);
+  let server = opts["--server"];
+  if (!server) {
+    try {
+      await privatePath(path.join(base, "default.json"));
+      server = JSON.parse(
+        await fs.readFile(path.join(base, "default.json"), "utf8"),
+      ).server;
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+  }
+  server = origin(server || "https://yep.nihao.cool");
+  const platform = path.join(
+    base,
+    createHash("sha256").update(server).digest("hex"),
+  );
+  if (await fs.mkdir(platform, { recursive: true, mode: 0o700 }))
+    await protect(platform, true);
+  await privatePath(platform, true);
+  let node = opts["--node"];
+  if (!node && command !== "setup") {
+    try {
+      await privatePath(path.join(platform, "default.json"));
+      node = JSON.parse(
+        await fs.readFile(path.join(platform, "default.json"), "utf8"),
+      ).node;
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+  }
+  if (node && !/^[A-Za-z0-9_-]{20,100}$/.test(node))
+    throw new Error("节点 ID 不合法。");
+  if (command === "setup") {
+    if (!node) {
+      const v = await request(server, "/api/feishu/setups", {
+        method: "POST",
+        body: {
+          name: opts["--name"] || "我的飞书智能体",
+          mode: "local",
+          appId: opts["--app-id"] || "",
+          fullGroups: Boolean(opts["--all-group-messages"]),
+        },
+      });
+      if (new URL(v.approvalUrl).origin !== server)
+        throw new Error("账号确认地址不属于当前平台。");
+      await openURL(v.approvalUrl, opts["--no-open"]);
+      let seen = "",
+        credential;
+      while (Date.now() < Date.parse(v.setup.expiresAt)) {
+        const s = await request(server, `/api/feishu/setups/${v.setup.id}`, {
+          token: v.pollToken,
+        });
+        if (s.status !== seen) {
+          console.log(
+            {
+              approval: "1/4 等待浏览器确认 Yep 账号",
+              registering: "2/4 准备飞书官方授权页",
+              authorizing: "2/4 等待飞书授权",
+              ready: "3/4 应用授权完成",
+            }[s.status] || s.status,
+          );
+          seen = s.status;
+        }
+        if (s.url) {
+          const url = new URL(s.url);
+          if (
+            url.protocol !== "https:" ||
+            ![
+              "accounts.feishu.cn",
+              "accounts.larksuite.com",
+              "open.feishu.cn",
+              "open.larksuite.com",
+            ].includes(url.hostname)
+          )
+            throw new Error("飞书授权地址不可信。");
+          if (opts.openedURL !== s.url) {
+            await openURL(s.url, opts["--no-open"]);
+            opts.openedURL = s.url;
+          }
+        }
+        if (["failed", "expired"].includes(s.status))
+          throw new Error(s.error || "飞书授权已过期，请重新 setup。");
+        if (s.status === "ready") {
+          credential = await request(
+            server,
+            `/api/feishu/setups/${v.setup.id}/claim`,
+            { method: "POST", token: v.pollToken, body: {} },
+          );
+          break;
+        }
+        await delay(2500);
+      }
+      if (!credential) throw new Error("飞书授权已超时，请重新 setup。");
+      node = credential.nodeId;
+      if (!/^[A-Za-z0-9_-]{20,100}$/.test(node) || credential.server !== server)
+        throw new Error("节点凭据格式不正确。");
+      const dir = path.join(platform, node);
+      await fs.mkdir(dir, { mode: 0o700 });
+      await protect(dir, true);
+      await privateWrite(path.join(dir, "credential.json"), credential);
+      await request(server, `/api/feishu/setups/${v.setup.id}/ack`, {
+        method: "POST",
+        token: v.pollToken,
+        body: {},
+      }).catch(() => {});
+      await privateWrite(path.join(platform, "default.json"), { node });
+      await privateWrite(path.join(base, "default.json"), { server });
+      console.log("凭据已保存到独立飞书配置目录。");
+    }
+  }
+  if (!node) throw new Error("尚未连接飞书；先运行 yep feishu setup。");
+  const dir = path.join(platform, node);
+  await privatePath(dir, true);
+  const credentialFile = path.join(dir, "credential.json");
+  await privatePath(credentialFile);
+  const credential = JSON.parse(await fs.readFile(credentialFile, "utf8"));
+  if (credential.server !== server || credential.nodeId !== node)
+    throw new Error("节点凭据与平台不一致。");
+  const managedStart=async(install=false,foreground=false,refresh=false)=>{
+    if(foreground){await start(dir,true);return}
+    let installed=false;try{await fs.access(path.join(dir,"service.json"));installed=true}catch(e){if(e.code!=="ENOENT")throw e}
+    if(install||installed&&refresh){try{await service("install",dir,await nativeBinary());installed=true}catch(e){console.error("开机服务未安装成功，将启动普通后台进程："+e.message);installed=false}}
+    if(installed){await service("start",dir);for(let i=0;i<80;i++){if(await running(dir)){console.log("飞书开机服务已启动。");return};await delay(100)};throw new Error("开机服务尚未就绪，请运行 yep feishu logs 检查。")}
+    await start(dir);
+  };
+  if(command==="setup"||command==="start"){await managedStart(Boolean(opts["--install-service"]),Boolean(opts["--foreground"]));console.log(`管理页面：${server}/feishu`);return}
+  if(command==="restart"){await service("stop",dir);await stop(dir);await managedStart(false,false,true);return}
+  if (command === "stop") {
+    await service("stop", dir);
+    await stop(dir);
+    console.log("本机飞书节点已停止。");
+    return;
+  }
+  if (command === "service") {
+    if (!["install", "uninstall"].includes(serviceAction))
+      throw new Error("使用 yep feishu service install | uninstall");
+    if(serviceAction==="install"){await stop(dir);await managedStart(true)}else{await service("uninstall",dir);await stop(dir)}
+    console.log("飞书开机服务设置已更新。");
+    return;
+  }
+  if (command === "remove") {
+    await request(server, "/api/feishu/runtime/self", {
+      method: "DELETE",
+      token: credential.token,
+    });
+    await service("uninstall", dir);
+    await stop(dir);
+    await fs.rm(dir, { recursive: true });
+    try {
+      const selected = JSON.parse(
+        await fs.readFile(path.join(platform, "default.json"), "utf8"),
+      );
+      if (selected.node === node)
+        await fs.rm(path.join(platform, "default.json"), { force: true });
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+    console.log("飞书节点已解绑，本机凭据已删除。");
+    return;
+  }
+  if (command === "logs") {
+    const log = path.join(dir, "service.log");
+    await privatePath(log);
+    let offset = 0;
+    do {
+      const st = await fs.stat(log);
+      if (st.size < offset) offset = 0;
+      const f = await fs.open(log, "r");
+      try {
+        const size = Math.min(st.size - offset, 65536);
+        if (size > 0) {
+          const buffer = Buffer.alloc(size);
+          const { bytesRead } = await f.read(
+            buffer,
+            0,
+            size,
+            Math.max(offset, st.size - 65536),
+          );
+          process.stdout.write(buffer.subarray(0, bytesRead));
+          offset = st.size;
+        }
+      } finally {
+        await f.close();
+      }
+      if (opts["--follow"]) await delay(1000);
+    } while (opts["--follow"]);
+    return;
+  }
+  if (command === "doctor" && opts["--fix"]) {
+    if (await running(dir)) await control(dir, "doctor");
+    else await start(dir);
+    console.log("已重新连接并触发权限检测；约 15 秒后可查看更新。");
+    await delay(1500);
+  }
+  const remote = await request(server, "/api/feishu/runtime/self", {
+      token: credential.token,
+    }),
+    local = await running(dir);
+  if (opts["--json"]) {
+    console.log(
+      JSON.stringify(
+        { local: local || { running: false }, node: remote },
+        null,
+        2,
+      ),
+    );
+    return;
+  }
+  console.log(
+    `节点：${remote.name}\n本机进程：${local ? "运行中" : "已停止"}\n飞书连接：${remote.connection}\n版本：${remote.workerVersion || "待连接"}\n配置：${remote.appliedRevision}/${remote.revision}\n最近接收：${remote.lastReceived}\n最近回复：${remote.lastReplied}`,
+  );
+  if (command === "doctor") {
+    for (const check of remote.checks || [])
+      console.log(`${check.status.padEnd(8)} ${check.id}：${check.evidence}`);
+    console.log("--fix 自动修复本机启动和连接；权限授权需在飞书官方页面确认。");
+    const missing = (remote.checks || []).some((c) =>
+      ["missing", "pending", "failed"].includes(c.status),
+    );
+    if (missing && opts["--fix"])
+      await openURL(
+        `https://open.feishu.cn/app/${encodeURIComponent(remote.appId)}/auth`,
+        opts["--no-open"],
+      );
+  }
+}

package/lib/feishu/private-path.ps1

@@ -0,0 +1,50 @@
+$ErrorActionPreference = 'Stop'
+$path = $env:YEP_FEISHU_ACL_PATH
+$directory = $env:YEP_FEISHU_ACL_DIRECTORY -eq '1'
+$item = Get-Item -LiteralPath $path -Force
+if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or $item.PSIsContainer -ne $directory) {
+    throw 'Unsafe Feishu configuration path'
+}
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$sid = $identity.User
+$allowed = @($sid.Value, 'S-1-5-18', 'S-1-5-32-544')
+$acl = Get-Acl -LiteralPath $path
+$rules = $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])
+$safe = $acl.AreAccessRulesProtected
+$ownerAccess = $false
+foreach ($rule in $rules) {
+    if ($rule.AccessControlType -eq 'Allow') {
+        if ($rule.IdentityReference.Value -notin $allowed) { $safe = $false }
+        if ($rule.IdentityReference.Value -eq $sid.Value -and
+            ($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl -and
+            (!$directory -or ($rule.InheritanceFlags -band 3) -eq 3)) { $ownerAccess = $true }
+    }
+}
+if ($safe -and $ownerAccess) { exit 0 }
+
+# Repair only a path owned by this account (or its elevated Administrators token).
+$owner = $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if ($owner -ne $sid.Value -and !($owner -eq 'S-1-5-32-544' -and $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))) {
+    throw 'Feishu configuration belongs to another account'
+}
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($rule in $acl.GetAccessRules($true, $false, [Security.Principal.SecurityIdentifier])) {
+    [void]$acl.RemoveAccessRuleSpecific($rule)
+}
+$inheritance = [Security.AccessControl.InheritanceFlags]::None
+if ($directory) { $inheritance = [Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit' }
+foreach ($value in @($allowed | Select-Object -Unique)) {
+    $account = [Security.Principal.SecurityIdentifier]::new($value)
+    $rule = [Security.AccessControl.FileSystemAccessRule]::new($account, [Security.AccessControl.FileSystemRights]::FullControl, $inheritance, [Security.AccessControl.PropagationFlags]::None, [Security.AccessControl.AccessControlType]::Allow)
+    $acl.AddAccessRule($rule)
+}
+Set-Acl -LiteralPath $path -AclObject $acl
+$actual = Get-Acl -LiteralPath $path
+if (!$actual.AreAccessRulesProtected) { throw 'Feishu configuration ACL remains inherited' }
+foreach ($rule in $actual.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+    if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) {
+        throw 'Feishu configuration ACL remains shared'
+    }
+}
+exit 0

package/lib/feishu/service.js

@@ -0,0 +1,53 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const exec = promisify(execFile);
+const xml = value => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+const quote = value => '"' + value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%").replaceAll("$", "$$") + '"';
+export async function service(action, dir, sourceBinary) {
+  const id = createHash("sha256").update(dir).digest("hex").slice(0, 20), name = `yep-feishu-${id}`, config = path.join(dir, "credential.json"), marker = path.join(dir, "service.json");
+  let installed = false, metadata;
+  try { const st = await fs.lstat(marker); if (!st.isFile() || st.isSymbolicLink()) throw new Error("开机服务配置路径不安全"); metadata = JSON.parse(await fs.readFile(marker, "utf8")); installed = true; } catch (e) { if (e.code !== "ENOENT") throw e; }
+  if (action !== "install" && !installed) return false;
+  let binary = sourceBinary;
+  if (action === "install") {
+    if (/[\r\n\0]/.test(dir + binary)) throw new Error("开机服务路径包含不支持的字符");
+    // npx cache paths may disappear. Keep an independently verified executable
+    // beside the node configuration, with no credentials in service arguments.
+    const data = await fs.readFile(binary), digest = createHash("sha256").update(data).digest("hex");
+    binary = path.join(dir, `runtime-${digest.slice(0, 16)}${process.platform === "win32" ? ".exe" : ""}`);
+    try { await fs.writeFile(binary, data, { mode: 0o700, flag: "wx" }); } catch (e) { if (e.code !== "EEXIST") throw e; const st = await fs.lstat(binary); if (!st.isFile() || st.isSymbolicLink() || createHash("sha256").update(await fs.readFile(binary)).digest("hex") !== digest) throw new Error("开机服务节点文件校验失败"); }
+  }
+  if (process.platform === "linux") {
+    const folder = path.join(os.homedir(), ".config", "systemd", "user"), file = path.join(folder, `${name}.service`);
+    await fs.mkdir(folder, { recursive: true, mode: 0o700 });
+    if (action === "install") {
+      await fs.writeFile(file, `[Unit]\nDescription=Yep Feishu node\nAfter=network-online.target\n[Service]\nExecStart=${quote(binary)} --config ${quote(config)} --log-file ${quote(path.join(dir,"service.log"))}\nRestart=on-failure\nRestartSec=10\nUMask=0077\n[Install]\nWantedBy=default.target\n`, { mode: 0o600 });
+      await exec("systemctl", ["--user", "daemon-reload"]); await exec("systemctl", ["--user", "enable", `${name}.service`]);
+    } else if (action === "start") await exec("systemctl", ["--user", "start", `${name}.service`]);
+    else { await exec("systemctl", ["--user", "stop", `${name}.service`]); if (action === "uninstall") { await exec("systemctl", ["--user", "disable", `${name}.service`]); await fs.rm(file, { force: true }); await exec("systemctl", ["--user", "daemon-reload"]); } }
+  } else if (process.platform === "darwin") {
+    const label = `cool.nihao.${name}`, folder = path.join(os.homedir(), "Library", "LaunchAgents"), file = path.join(folder, `${label}.plist`), target = `gui/${process.getuid()}/${label}`;
+    await fs.mkdir(folder, { recursive: true, mode: 0o700 });
+    if (action === "install") {
+      if (installed) await exec("launchctl", ["bootout", target]);
+      await fs.writeFile(file, `<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>Label</key><string>${label}</string><key>ProgramArguments</key><array><string>${xml(binary)}</string><string>--config</string><string>${xml(config)}</string><string>--log-file</string><string>${xml(path.join(dir,"service.log"))}</string></array><key>RunAtLoad</key><true/><key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict><key>StandardOutPath</key><string>${xml(path.join(dir, "service.log"))}</string><key>StandardErrorPath</key><string>${xml(path.join(dir, "service.log"))}</string></dict></plist>`, { mode: 0o600 });
+      await exec("launchctl", ["bootstrap", `gui/${process.getuid()}`, file]);
+    } else if (action === "start") await exec("launchctl", ["kickstart", target]);
+    else if (action === "uninstall") { await exec("launchctl", ["bootout", target]); await fs.rm(file, { force: true }); }
+    else await exec("launchctl", ["kill", "SIGTERM", target]).catch(() => {});
+  } else if (process.platform === "win32") {
+    if (action === "install") {
+      const task = path.join(dir, "service-task.xml"), identity = await exec("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"], { windowsHide: true }), user = identity.stdout.trim();
+      await fs.writeFile(task, `\ufeff<?xml version="1.0" encoding="UTF-16"?><Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"><Triggers><LogonTrigger><Enabled>true</Enabled></LogonTrigger></Triggers><Principals><Principal id="Author"><UserId>${xml(user)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals><Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><ExecutionTimeLimit>PT0S</ExecutionTimeLimit><RestartOnFailure><Interval>PT1M</Interval><Count>3</Count></RestartOnFailure></Settings><Actions Context="Author"><Exec><Command>${xml(binary)}</Command><Arguments>--config &quot;${xml(config)}&quot; --log-file &quot;${xml(path.join(dir,"service.log"))}&quot;</Arguments></Exec></Actions></Task>`, { encoding: "utf16le", mode: 0o600 });
+      await exec("schtasks.exe", ["/Create", "/TN", name, "/XML", task, "/F"], { windowsHide: true }); await fs.rm(task, { force: true });
+    } else if (action === "start") await exec("schtasks.exe", ["/Run", "/TN", name], { windowsHide: true });
+    else { await exec("schtasks.exe", ["/End", "/TN", name], { windowsHide: true }).catch(() => {}); if (action === "uninstall") await exec("schtasks.exe", ["/Delete", "/TN", name, "/F"], { windowsHide: true }); }
+  } else throw new Error("此系统暂不支持安装开机服务，可使用 yep feishu start。");
+  if (action === "install") await fs.writeFile(marker, JSON.stringify({ name, binary, platform: process.platform }), { mode: 0o600 });
+  if (action === "uninstall") await fs.rm(marker, { force: true });
+  return true;
+}

package/native/feishu-manifest.json

@@ -0,0 +1,37 @@
+{
+  "schema": 1,
+  "version": "1.2.0",
+  "sourceSHA256": "219834c05c18424d9caf09b3871c59b69ce556dcf9e8963120493ec7447c9534",
+  "files": {
+    "win32-x64/yep-feishu-node.exe": {
+      "sha256": "4b3e1c702d983aebd2fddb9686da9b944dfb4a4efc214180c81a19c6d7cd8d5c",
+      "goos": "windows",
+      "goarch": "amd64"
+    },
+    "win32-arm64/yep-feishu-node.exe": {
+      "sha256": "402f753d18fb4e09dfd3f440553d2164e3cae85e0eef2aa658872e2732413ec9",
+      "goos": "windows",
+      "goarch": "arm64"
+    },
+    "darwin-x64/yep-feishu-node": {
+      "sha256": "a5f2c64081d8cde42ca5d65a2b783d404c88e02b96e05f59768e3a232a7b71fb",
+      "goos": "darwin",
+      "goarch": "amd64"
+    },
+    "darwin-arm64/yep-feishu-node": {
+      "sha256": "994611d04d5e18a8b906b9b4a75d02d8e8381d459c703eb6e98b75514f84ac42",
+      "goos": "darwin",
+      "goarch": "arm64"
+    },
+    "linux-x64/yep-feishu-node": {
+      "sha256": "86ddf8a4981410cc363d45ab1c9e304b6f1d95ea67903f8c18184cab1d5b8ebe",
+      "goos": "linux",
+      "goarch": "amd64"
+    },
+    "linux-arm64/yep-feishu-node": {
+      "sha256": "85cc788a0d07f0bfb1e403a7cdbf5fd7944304469c117b5cbf0c822586b392b9",
+      "goos": "linux",
+      "goarch": "arm64"
+    }
+  }
+}

package/native/manifest.json

@@ -3,32 +3,32 @@
   "sourceSHA256": "f50333c164d2c15cc8b72308e0d7660bb87298f086019cd7d596e878f1f1daca",
   "files": {
     "win32-x64/yep-node.exe": {
-      "sha256": "82ea2f49afca3d46defb4cbfe09158635e00c5f4fe8980633ba9909ddef16843",
+      "sha256": "591c825af2f9055d43518feea2fc71f9c4006e76ef3d53a5fde218db7d775029",
       "goos": "windows",
       "goarch": "amd64"
     },
     "win32-arm64/yep-node.exe": {
-      "sha256": "3d974c4b22c97ea5ef2389d55d6daf3dffe27ed50bd54dd6cbcbf309001f2196",
+      "sha256": "ba90902f88f9c2f96c011c46bfcfc174b8fca051d71dc8bd20e1dd22e84691d6",
       "goos": "windows",
       "goarch": "arm64"
     },
     "darwin-x64/yep-node": {
-      "sha256": "d3379f423d57598382ca56018b206b4f6eddafd3f1e733cf22070fd9d27a5eda",
+      "sha256": "e355792f5da8b267ed610732b977390b00cb0387e17ef4f9b97805f4f3909a5b",
       "goos": "darwin",
       "goarch": "amd64"
     },
     "darwin-arm64/yep-node": {
-      "sha256": "ec47bef2b4f5f221dc0363710e95bd7df412e509e411b93ec9b786c1473fea41",
+      "sha256": "c35be324d425adf394e5bb951d92303f10b806b0a8707337cde3272725030e85",
       "goos": "darwin",
       "goarch": "arm64"
     },
     "linux-x64/yep-node": {
-      "sha256": "5bc06697598bb6bb0d36b08bf0eabe877204c3f73f48cbfac675fdf1590d0499",
+      "sha256": "fb0f1b62f54e6f069ac83e8334f317793bdf8e5981a3e1eb0766260778e6880d",
       "goos": "linux",
       "goarch": "amd64"
     },
     "linux-arm64/yep-node": {
-      "sha256": "8eee868c965b7388b23935c9da6124cb2b59f9d03ff6d2ba36981e8d04fb2136",
+      "sha256": "76176e184e872e4a6a9601d7e86b2a33f1cdf2e3f1a86f5429717ba883be0dde",
       "goos": "linux",
       "goarch": "arm64"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yep-ai/cli",
-  "version": "1.1.0",
+  "version": "1.2.2",
   "description": "Yep Marketplace unified CLI: skills, agents, plugins and authorized device nodes.",
   "type": "module",
   "bin": {
@@ -26,9 +26,9 @@
     "registry": "https://registry.npmjs.org"
   },
   "scripts": {
-    "prepack": "node ../../scripts/verify-yep-node.mjs",
+    "prepack": "node ../../scripts/verify-yep-node.mjs && node ../../scripts/verify-feishu-node.mjs",
     "build": "node bin/yep.js --version",
-    "check": "node --check bin/yep.js && node --check bin/market.js && node --check lib/device/command.js && node --check lib/device/client.js && node --check lib/device/tools.js",
+    "check": "node --check bin/yep.js && node --check bin/market.js && node --check lib/device/command.js && node --check lib/device/client.js && node --check lib/device/tools.js && node --check lib/feishu/command.js && node --check lib/feishu/service.js",
     "test": "node --test"
   }
 }