botmux 2.105.1 → 2.106.0

package/dist/dashboard.js

@@ -63,8 +63,10 @@ import { startPlatformTunnelClient } from './platform/tunnel-client.js';
 import { applyPlatformTeamSync, getPlatformTeamSyncRev, listPlatformTeams } from './services/platform-team-store.js';
 import { getBotUnionId } from './services/bot-union-ids-store.js';
 import { cleanupIdleSessions, parseIdleCleanupHours } from './dashboard/session-cleanup.js';
+import { automateOpenPlatformSetup } from './setup/open-platform-automation.js';
+import { VC_MEETING_FEATURE_SCOPES, VC_MEETING_REALTIME_VOICE_SCOPES } from './setup/verify-permissions.js';
+import { checkLarkCliVersion, MIN_LARK_CLI_VERSION_FOR_VC_BOT } from './vc-agent/polling-source.js';
 import { larkHosts } from './im/lark/lark-hosts.js';
-import { VC_MEETING_FEATURE_SCOPES, VC_MEETING_REALTIME_VOICE_SCOPES, } from './setup/verify-permissions.js';
 const SECRET_PATH = join(homedir(), '.botmux', '.dashboard-secret');
 const TOKEN_PATH = join(homedir(), '.botmux', '.dashboard-token');
 /** Per-daemon budget for the cross-daemon insight overview fan-out — bounds
@@ -261,52 +263,6 @@ function vcMeetingListenerBotOptions() {
         return [];
     }
 }
-async function fetchGrantedScopesForBotConfig(bot) {
-    const brand = bot.brand === 'lark' ? 'lark' : 'feishu';
-    const openApi = larkHosts(brand).openApi;
-    const ac = new AbortController();
-    const timer = setTimeout(() => ac.abort(), 10_000);
-    try {
-        const tokenRes = await fetch(`${openApi}/open-apis/auth/v3/tenant_access_token/internal`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ app_id: bot.larkAppId, app_secret: bot.larkAppSecret }),
-            signal: ac.signal,
-        });
-        const tokenData = await tokenRes.json();
-        if (tokenData?.code !== 0 || typeof tokenData?.tenant_access_token !== 'string') {
-            return { ok: false, error: `vcMeetingAgent_listenerBot_invalid_credentials: code=${tokenData?.code ?? '?'} msg=${tokenData?.msg ?? ''}` };
-        }
-        const infoRes = await fetch(`${openApi}/open-apis/application/v6/applications/${bot.larkAppId}?lang=zh_cn`, { headers: { Authorization: `Bearer ${tokenData.tenant_access_token}` }, signal: ac.signal });
-        const infoData = await infoRes.json();
-        if (infoData?.code === 99991672) {
-            return { ok: false, error: 'vcMeetingAgent_listenerBot_scope_check_unavailable: missing application:application:self_manage' };
-        }
-        if (infoData?.code !== 0) {
-            return { ok: false, error: `vcMeetingAgent_listenerBot_scope_check_failed: code=${infoData?.code ?? '?'} msg=${infoData?.msg ?? ''}` };
-        }
-        const scopesRaw = infoData.data?.app?.scopes
-            ?? infoData.data?.application?.scopes
-            ?? infoData.data?.scopes
-            ?? [];
-        if (!Array.isArray(scopesRaw) || scopesRaw.length === 0) {
-            return { ok: false, error: 'vcMeetingAgent_listenerBot_scope_check_failed: empty scopes' };
-        }
-        const granted = new Set(scopesRaw.map(s => typeof s === 'string' ? s : s?.scope).filter(Boolean));
-        return { ok: true, granted };
-    }
-    catch (err) {
-        return {
-            ok: false,
-            error: ac.signal.aborted
-                ? 'vcMeetingAgent_listenerBot_scope_check_timeout'
-                : `vcMeetingAgent_listenerBot_scope_check_failed: ${err?.message ?? err}`,
-        };
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
 async function validateVcMeetingListenerBotAppId(appId) {
     let bots;
     try {
@@ -318,19 +274,6 @@ async function validateVcMeetingListenerBotAppId(appId) {
     const bot = bots.find(b => b.larkAppId === appId);
     if (!bot)
         return { ok: false, error: 'vcMeetingAgent_listenerBot_unknown' };
-    const cfg = bot.vcMeetingAgent ?? {};
-    if (!cfg.larkCliProfile)
-        return { ok: false, error: 'vcMeetingAgent_listenerBot_missing_larkCliProfile' };
-    const granted = await fetchGrantedScopesForBotConfig(bot);
-    if (!granted.ok)
-        return granted;
-    const required = cfg.realtimeVoice?.enabled === true
-        ? [...VC_MEETING_FEATURE_SCOPES, ...VC_MEETING_REALTIME_VOICE_SCOPES]
-        : VC_MEETING_FEATURE_SCOPES;
-    const missing = required.filter(scope => !granted.granted.has(scope.name));
-    if (missing.length > 0) {
-        return { ok: false, error: `vcMeetingAgent_listenerBot_missing_scopes: ${missing.map(s => s.name).join(',')}` };
-    }
     return { ok: true };
 }
 function normalizeVcMeetingAgentRecord(raw) {
@@ -368,11 +311,220 @@ async function reloadVcMeetingBotConfigOnDaemons(appIds) {
         }).catch(() => undefined);
     }));
 }
+/**
+ * Fetch the set of actually granted scopes for a bot app via Feishu Open API.
+ * Used after automateOpenPlatformSetup to verify that VC meeting scopes were
+ * actually applied (not just "requested").
+ */
+async function fetchGrantedScopesForBot(bot) {
+    const brand = bot.brand === 'lark' ? 'lark' : 'feishu';
+    const openApi = larkHosts(brand).openApi;
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), 10_000);
+    try {
+        const tokenRes = await fetch(`${openApi}/open-apis/auth/v3/tenant_access_token/internal`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ app_id: bot.larkAppId, app_secret: bot.larkAppSecret }),
+            signal: ac.signal,
+        });
+        const tokenData = await tokenRes.json();
+        if (tokenData?.code !== 0 || typeof tokenData?.tenant_access_token !== 'string') {
+            return { ok: false, error: `invalid_credentials: code=${tokenData?.code ?? '?'} msg=${tokenData?.msg ?? ''}` };
+        }
+        const infoRes = await fetch(`${openApi}/open-apis/application/v6/applications/${bot.larkAppId}?lang=zh_cn`, { headers: { Authorization: `Bearer ${tokenData.tenant_access_token}` }, signal: ac.signal });
+        const infoData = await infoRes.json();
+        if (infoData?.code === 99991672) {
+            return { ok: false, error: 'missing application:application:self_manage' };
+        }
+        if (infoData?.code !== 0) {
+            return { ok: false, error: `scope_check_failed: code=${infoData?.code ?? '?'} msg=${infoData?.msg ?? ''}` };
+        }
+        const scopesRaw = infoData.data?.app?.scopes
+            ?? infoData.data?.application?.scopes
+            ?? infoData.data?.scopes
+            ?? [];
+        const granted = new Set(scopesRaw.map((s) => typeof s === 'string' ? s : s?.scope).filter(Boolean));
+        return { ok: true, granted };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: ac.signal.aborted ? 'timeout' : `${err?.message ?? err}`,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Validate that a bot has the required VC meeting scopes granted.
+ * Checks both VC_MEETING_FEATURE_SCOPES and (if realtimeVoice is enabled)
+ * VC_MEETING_REALTIME_VOICE_SCOPES.
+ */
+async function validateVcMeetingScopesForBot(bot) {
+    const result = await fetchGrantedScopesForBot(bot);
+    if (!result.ok)
+        return { ok: false, error: result.error };
+    const needsRealtime = bot.vcMeetingAgent?.realtimeVoice?.enabled === true;
+    const required = needsRealtime
+        ? [...VC_MEETING_FEATURE_SCOPES, ...VC_MEETING_REALTIME_VOICE_SCOPES]
+        : VC_MEETING_FEATURE_SCOPES;
+    const missing = required.filter(s => !result.granted.has(s.name));
+    if (missing.length > 0) {
+        return { ok: false, error: `缺少权限: ${missing.map(s => s.name).join(', ')}` };
+    }
+    return { ok: true };
+}
+/**
+ * Wait for FeishuLoginManager to produce a QR code after start().
+ * The start() method returns immediately with status='starting'; the QR code
+ * is set asynchronously in the onQrCode callback. Poll until qrDataUrl appears
+ * or we hit the timeout.
+ */
+async function waitForFeishuLoginQr(timeoutMs = 8_000, intervalMs = 200) {
+    const start = Date.now();
+    while (Date.now() - start < timeoutMs) {
+        const snap = feishuLogin.get();
+        if (snap?.qrDataUrl)
+            return snap.qrDataUrl;
+        // Also stop waiting if login already failed
+        if (snap?.status === 'failed' || snap?.status === 'success')
+            return null;
+        await new Promise(r => setTimeout(r, intervalMs));
+    }
+    return null;
+}
 async function syncVcMeetingListenerBotConfig(listenerBotAppId, previousListenerBotAppId) {
     const nextAppId = listenerBotAppId?.trim() || null;
     const prevAppId = previousListenerBotAppId?.trim() || null;
     if (!nextAppId && !prevAppId)
         return { ok: true };
+    // Require lark-cli >= MIN_LARK_CLI_VERSION_FOR_VC_BOT for VC bot meeting commands
+    // (vc +meeting-join/events/message-send --as bot). Earlier versions silently reject
+    // `--as bot` with "this command only supports: user", so the listener bot can
+    // never actually join a meeting.
+    if (nextAppId) {
+        const larkCli = checkLarkCliVersion();
+        if (!larkCli) {
+            return { ok: false, error: 'vcMeetingAgent_listenerBot_larkCli_not_found: 未检测到 lark-cli，请先安装 `npm i -g @larksuite/cli`' };
+        }
+        if (!larkCli.meetsVcBotRequirement) {
+            return {
+                ok: false,
+                error: `vcMeetingAgent_listenerBot_larkCli_too_old: 当前 lark-cli ${larkCli.version} 不支持 VC bot 入会，需要 >= ${MIN_LARK_CLI_VERSION_FOR_VC_BOT}。请运行 \`npm i -g @larksuite/cli@latest\` 升级`,
+            };
+        }
+    }
+    // Best-effort auto-import VC meeting scopes via Open Platform automation.
+    // Run BEFORE writing bots.json so that hard failures (missing session, needs QR)
+    // don't leave per-bot vcMeetingAgent in a half-configured state.
+    // For `brand: 'lark'` bots the open-platform automation only supports feishu.cn;
+    // skip it silently and let the user configure manually.
+    if (nextAppId) {
+        const bots = loadBotConfigs();
+        const bot = bots.find(b => b.larkAppId === nextAppId);
+        const brand = bot?.brand === 'lark' ? 'lark' : 'feishu';
+        if (brand === 'lark') {
+            logger.info(`[vc-agent] skipping open-platform automation for lark-brand bot ${nextAppId} (feishu.cn only)`);
+            // For lark brand, still validate that required scopes exist before saving
+            if (bot) {
+                const scopeCheck = await validateVcMeetingScopesForBot(bot);
+                if (!scopeCheck.ok) {
+                    return { ok: false, error: `vcMeetingAgent_listenerBot_missing_scopes: ${scopeCheck.error}` };
+                }
+            }
+        }
+        else {
+            try {
+                const result = await automateOpenPlatformSetup({
+                    appId: nextAppId,
+                    brand,
+                    maxWaitMs: 5_000,
+                    onStatus: (msg) => logger.info(`[vc-agent] scope auto-import: ${msg}`),
+                });
+                if (result.ok) {
+                    logger.info(`[vc-agent] auto-imported ${result.scopeCount} scopes, subscribed ${result.subscribedEventCount} events for listener bot ${nextAppId}`);
+                    if (result.scopeWarning)
+                        logger.warn(`[vc-agent] scope import warning: ${result.scopeWarning}`);
+                    if (result.eventWarning)
+                        logger.warn(`[vc-agent] event subscription warning: ${result.eventWarning}`);
+                    // Post-validation: verify VC meeting scopes are actually granted after automation.
+                    // The internal scope/update may silently skip some scopes (e.g. not available
+                    // in this tenant). Without this check, a bot without VC scopes could be saved
+                    // as global listener and silently drop all meeting events.
+                    if (bot) {
+                        const scopeCheck = await validateVcMeetingScopesForBot(bot);
+                        if (!scopeCheck.ok) {
+                            return {
+                                ok: false,
+                                error: `vcMeetingAgent_listenerBot_missing_scopes_after_auto: ${scopeCheck.error}。请到开放平台手动开通 VC 会议权限后重试。`,
+                            };
+                        }
+                    }
+                    // Event subscription is also critical: if all 3 event update endpoints
+                    // failed (eventWarning set, subscribedEventCount === 0), the bot won't
+                    // receive vc.bot.meeting_*_v1 push events → meeting invite black hole.
+                    if (result.eventWarning && result.subscribedEventCount === 0) {
+                        return {
+                            ok: false,
+                            error: `vcMeetingAgent_listenerBot_event_subscribe_failed: 事件订阅全部失败(${result.eventWarning})，bot 无法接收会议邀请事件。请到开放平台手动订阅 VC 会议事件后重试。`,
+                        };
+                    }
+                }
+                else {
+                    const reason = result.reason;
+                    // Session/login-related failures are hard failures — return QR so user can re-login.
+                    // Without a valid Open Platform session, scope/event auto-import is impossible.
+                    if (reason === 'missing_session'
+                        || reason === 'invalid_session'
+                        || reason === 'missing_csrf'
+                        || reason === 'qr_expired'
+                        || reason === 'timeout'
+                        || reason === 'login_failed') {
+                        feishuLogin.start();
+                        // feishuLogin.start() returns immediately with status='starting'; the QR
+                        // code is set asynchronously in onQrCode. Wait briefly for it to be ready
+                        // so the frontend can display it inline instead of showing an error without
+                        // a scan entry.
+                        const qrDataUrl = await waitForFeishuLoginQr();
+                        const hint = '请用飞书扫码完成开放平台登录，登录后重新选择监听 bot 即可自动配置权限';
+                        return {
+                            ok: false,
+                            error: `vcMeetingAgent_listenerBot_scope_auto_import_failed: ${reason}: ${hint}`,
+                            feishuLoginQr: qrDataUrl ?? undefined,
+                        };
+                    }
+                    // Non-login failures (network, api_error, etc.) are best-effort — don't
+                    // block the save. The user can fix scopes manually in the console.
+                    logger.warn(`[vc-agent] open-platform automation failed for ${nextAppId}: ${reason}: ${result.message}`);
+                    // Even on non-login automation failure, verify scopes before saving —
+                    // if the bot genuinely lacks VC permissions, don't silently make it listener.
+                    if (bot) {
+                        const scopeCheck = await validateVcMeetingScopesForBot(bot);
+                        if (!scopeCheck.ok) {
+                            return {
+                                ok: false,
+                                error: `vcMeetingAgent_listenerBot_missing_scopes: ${scopeCheck.error}。自动化配置失败(${reason})且权限未满足，请手动开通后重试。`,
+                            };
+                        }
+                    }
+                    // Also check event subscription status — if event update failed (all 3
+                    // endpoints) before the downstream api_error hit, the bot still won't
+                    // receive meeting invite events → listener black hole.
+                    if (result.eventWarning && (result.subscribedEventCount ?? 0) === 0) {
+                        return {
+                            ok: false,
+                            error: `vcMeetingAgent_listenerBot_event_subscribe_failed: 事件订阅失败(${result.eventWarning})，bot 无法接收会议邀请事件。自动化配置失败(${reason})，请手动订阅 VC 会议事件后重试。`,
+                        };
+                    }
+                }
+            }
+            catch (err) {
+                logger.warn(`[vc-agent] open-platform automation error for ${nextAppId}: ${err?.message ?? err}`);
+            }
+        }
+    }
     const changedAppIds = new Set();
     try {
         const path = requireConfigPath();
@@ -391,6 +543,23 @@ async function syncVcMeetingListenerBotConfig(listenerBotAppId, previousListener
                     next.dashboardManagedListener = true;
                     entryChanged = true;
                 }
+                if (!next.larkCliProfile) {
+                    next.larkCliProfile = nextAppId;
+                    entryChanged = true;
+                }
+                const mc = next.meetingConsumer;
+                if (!mc || typeof mc !== 'object' || Array.isArray(mc)) {
+                    next.meetingConsumer = { enabled: true };
+                    entryChanged = true;
+                }
+                else {
+                    const mcRec = mc;
+                    if (mcRec.enabled !== true) {
+                        mcRec.enabled = true;
+                        next.meetingConsumer = mcRec;
+                        entryChanged = true;
+                    }
+                }
                 if (entryChanged) {
                     compactVcMeetingAgentEntry(entry, next);
                     changed = true;
@@ -426,6 +595,7 @@ async function syncVcMeetingListenerBotConfig(listenerBotAppId, previousListener
 function resolveDashboardSettings() {
     const global = readGlobalConfig();
     const dashboard = global.dashboard ?? {};
+    const larkCli = checkLarkCliVersion();
     return {
         publicReadOnly: dashboard.publicReadOnly ?? config.dashboard.publicReadOnly,
         openTerminalInFeishu: dashboard.openTerminalInFeishu === true,
@@ -434,6 +604,9 @@ function resolveDashboardSettings() {
             enabled: global.vcMeetingAgent?.enabled !== false,
             listenerBotAppId: global.vcMeetingAgent?.listenerBotAppId ?? null,
             listenerBotOptions: vcMeetingListenerBotOptions(),
+            larkCliVersion: larkCli?.version ?? null,
+            larkCliMeetsRequirement: larkCli?.meetsVcBotRequirement ?? false,
+            larkCliMinVersion: MIN_LARK_CLI_VERSION_FOR_VC_BOT,
         },
         repoPickerMode: global.repoPickerMode ?? 'all',
         maintenance: global.maintenance ?? {},
@@ -1453,8 +1626,12 @@ const server = createServer(async (req, res) => {
                 return jsonRes(res, 400, { ok: false, error: 'bad_json' });
             }
             const result = await applySettingsWrite(parsed, settingsWriteApplierDeps);
-            if (!result.ok)
-                return jsonRes(res, 400, { ok: false, error: result.error });
+            if (!result.ok) {
+                const body = { ok: false, error: result.error };
+                if ('feishuLoginQr' in result && result.feishuLoginQr)
+                    body.feishuLoginQr = result.feishuLoginQr;
+                return jsonRes(res, 400, body);
+            }
             return jsonRes(res, 200, { ok: true, settings: result.settings });
         }
         // ─── Version & manual update ─────────────────────────────────────────────