codelark 0.1.0 → 0.1.1

package/scripts/setup-wizard-real-e2e.ts

@@ -27,6 +27,7 @@ function printUsage(): void {
     '  --app-secret <secret>   App Secret for the isolated smoke app; prefer env file/env vars to avoid npm echo',
     '  --site <feishu|lark>    Site brand; default feishu',
     '  --keep-temp             Keep temporary root for diagnosis; default cleans it in success and failure paths',
+    '  --skip-lark-cli-bind    Test-only: write the private lark-cli runtime projection without invoking macOS Keychain',
     '  --simulate-failure-after-sync  Test cleanup on a post-lark-cli failure',
     '  --help                  Show this help',
     '',
@@ -67,6 +68,38 @@ function assertInside(parentPath: string, childPath: string): void {
   throw new Error(`Path escaped temp root: ${child}`);
 }
 
+function writeJsonFile(filePath: string, value: unknown): void {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+  const tmpPath = `${filePath}.tmp`;
+  fs.writeFileSync(tmpPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(tmpPath, filePath);
+}
+
+function writeTestLarkCliRuntimeProjection(options: {
+  sourcePath: string;
+  runtimePath: string;
+  appId: string;
+  appSecret: string;
+  site: FeishuSite;
+}): void {
+  writeJsonFile(options.sourcePath, {
+    accounts: {
+      app: {
+        id: options.appId,
+        secret: options.appSecret,
+        tenant: options.site,
+      },
+    },
+  });
+  writeJsonFile(options.runtimePath, {
+    apps: [{
+      appId: options.appId,
+      appSecret: options.appSecret,
+      brand: options.site,
+    }],
+  });
+}
+
 async function main(): Promise<void> {
   const argv = process.argv.slice(2);
   if (hasFlag(argv, '--help')) {
@@ -85,6 +118,7 @@ async function main(): Promise<void> {
     path.join(os.tmpdir(), `clk-setup-wizard-real-e2e-${Date.now()}`),
   ));
   const keepTemp = hasFlag(argv, '--keep-temp');
+  const skipLarkCliBind = hasFlag(argv, '--skip-lark-cli-bind');
   const appId = valueArg(
     argv,
     '--app-id',
@@ -105,22 +139,22 @@ async function main(): Promise<void> {
   const runtimeHome = path.join(runRoot, 'home');
   const codelarkHome = path.join(runRoot, 'clk-home');
   const workspaceRoot = path.join(runRoot, 'workspace');
-  const larkConfigPath = path.join(runtimeHome, '.lark-cli', 'config.json');
+  const larkSourceConfigPath = path.join(codelarkHome, 'runtime', 'lark-cli-source', 'config.json');
+  const larkRuntimeConfigPath = path.join(codelarkHome, 'runtime', 'lark-cli', 'lark-channel', 'config.json');
   const configEnvPath = path.join(codelarkHome, 'config.env');
   const configJsonPath = path.join(codelarkHome, 'config.json');
+  const configTomlPath = path.join(codelarkHome, 'config.toml');
 
   try {
     assertInside(os.tmpdir(), runRoot);
     fs.mkdirSync(runtimeHome, { recursive: true });
     fs.mkdirSync(codelarkHome, { recursive: true });
     fs.mkdirSync(workspaceRoot, { recursive: true });
-    fs.writeFileSync(configEnvPath, '# custom env survives setup\nCUSTOM_KEEP=1\n', { mode: 0o600 });
 
     process.env.HOME = runtimeHome;
     process.env.USERPROFILE = runtimeHome;
     process.env.CODELARK_HOME = codelarkHome;
 
-    const configuration = await import('../src/configuration/index.js');
     const setupWizard = await import('../src/entrypoints/setup-wizard.js');
 
     const credentials = {
@@ -130,55 +164,56 @@ async function main(): Promise<void> {
       alias: 'codelark',
     };
 
-    await setupWizard.syncLarkCliCredentials(credentials, runtimeHome);
-    const entriesAfterSync = setupWizard.readLarkCliAppEntries(larkConfigPath);
-    const syncedEntry = entriesAfterSync.find((entry) => entry.appId === appId);
-    if (!syncedEntry) throw new Error(`lark-cli config missing synced app ${appId}`);
-    if (syncedEntry.brand !== site) throw new Error(`lark-cli brand mismatch: ${syncedEntry.brand}`);
-    if (syncedEntry.appSecret) {
-      throw new Error('real lark-cli e2e expected lark-cli to avoid plaintext appSecret in this environment');
-    }
-    if (syncedEntry.secretStorage !== 'keychain') {
-      throw new Error(`expected keychain/local encrypted lark-cli secret storage, got ${syncedEntry.secretStorage}`);
-    }
-    const importableApps = setupWizard.readLarkCliApps(larkConfigPath);
-    const importableApp = importableApps.find((entry) => entry.appId === appId);
-    if (!importableApp) throw new Error(`CodeLark could not import synced lark-cli app ${appId}`);
-    if (importableApp.appSecret !== appSecret) {
-      throw new Error('CodeLark did not recover App Secret from lark-cli local encrypted storage');
+    const current = setupWizard.loadSetupConfig(codelarkHome);
+    setupWizard.saveSetupConfigToHomeToml(
+      setupWizard.buildSetupConfig(current, credentials, 'codex', workspaceRoot),
+      codelarkHome,
+    );
+
+    const savedConfig = setupWizard.loadSetupConfig(codelarkHome);
+    if (skipLarkCliBind) {
+      writeTestLarkCliRuntimeProjection({
+        sourcePath: larkSourceConfigPath,
+        runtimePath: larkRuntimeConfigPath,
+        appId,
+        appSecret,
+        site,
+      });
+    } else {
+      const localService = await import('../src/local-service/manager.js');
+      const larkRuntime = await localService.ensureLarkCliRuntimeConfig(savedConfig, { allowUserAuthorization: true });
+      if (larkRuntime.warning) throw new Error(larkRuntime.warning);
+      if (!larkRuntime.ready) throw new Error('CodeLark private lark-cli runtime was not initialized');
     }
     if (hasFlag(argv, '--simulate-failure-after-sync')) {
       throw new Error('simulated setup wizard real e2e failure after lark-cli sync');
     }
 
-    const current = configuration.loadConfig();
-    configuration.saveConfig(setupWizard.buildSetupConfig(current, credentials, 'codex', workspaceRoot));
-
-    const savedConfig = configuration.loadConfig();
     const savedFeishu = savedConfig.channels?.find((channel) => channel.provider === 'feishu');
-    if (savedConfig.runtime !== 'codex') throw new Error(`runtime mismatch: ${savedConfig.runtime}`);
-    if (savedConfig.defaultWorkspaceRoot !== workspaceRoot) {
-      throw new Error(`workspace mismatch: ${savedConfig.defaultWorkspaceRoot}`);
+    if (savedConfig.runtime.agent !== 'codex') throw new Error(`runtime mismatch: ${savedConfig.runtime.agent}`);
+    if (savedConfig.bridge.defaultWorkspace !== workspaceRoot) {
+      throw new Error(`workspace mismatch: ${savedConfig.bridge.defaultWorkspace}`);
     }
-    if (savedFeishu?.config.appId !== appId) throw new Error('config.v1 appId mismatch');
-    if (savedFeishu?.config.appSecret !== appSecret) throw new Error('config.v1 appSecret mismatch');
-    if (savedFeishu?.config.site !== site) throw new Error('config.v1 site mismatch');
+    if (savedFeishu?.config.appId !== appId) throw new Error('config appId mismatch');
+    if (savedFeishu?.config.appSecret !== appSecret) throw new Error('config appSecret mismatch');
+    if (savedFeishu?.config.site !== site) throw new Error('config site mismatch');
 
-    const envContent = fs.readFileSync(configEnvPath, 'utf-8');
-    if (!envContent.includes('CUSTOM_KEEP=1')) throw new Error('custom config.env line was not preserved');
-    if (!envContent.includes(`CODELARK_FEISHU_APP_ID=${appId}`)) throw new Error('config.env appId missing');
-    if (!envContent.includes(`CODELARK_FEISHU_APP_SECRET=${appSecret}`)) throw new Error('config.env appSecret missing');
-    if (!fs.existsSync(configJsonPath)) throw new Error('config.json missing');
+    if (!fs.existsSync(configTomlPath)) throw new Error('config.toml missing');
+    if (fs.existsSync(configEnvPath)) throw new Error('setup should not create config.env');
+    if (fs.existsSync(configJsonPath)) throw new Error('setup should not create config.json');
+    if (!fs.existsSync(larkSourceConfigPath)) throw new Error('CodeLark lark-cli source config missing');
+    if (!fs.existsSync(larkRuntimeConfigPath)) throw new Error('CodeLark private lark-cli runtime config missing');
 
     const result = {
       ok: true,
       runRoot,
       runtimeHome,
       codelarkHome,
-      larkConfigPath,
+      larkSourceConfigPath,
+      larkRuntimeConfigPath,
       configEnvPath,
       configJsonPath,
-      larkSecretStorage: syncedEntry.secretStorage,
+      configTomlPath,
       cleanedRunRoot: !keepTemp,
     };
     process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);

package/scripts/setup-wizard-real-wizard-e2e.ts

@@ -0,0 +1,342 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { parse } from 'smol-toml';
+import { feishuSetupUserAuthScopeArgument } from '../src/channels/feishu/permissions.js';
+
+type FeishuSite = 'feishu' | 'lark';
+
+interface PtyProcess {
+  write(data: string): void;
+  kill(signal?: string): void;
+  onData(callback: (data: string) => void): void;
+  onExit(callback: (event: { exitCode: number; signal?: number }) => void): void;
+}
+
+interface PtyModule {
+  spawn(
+    command: string,
+    args: string[],
+    options: { name: string; cols: number; rows: number; cwd: string; env: NodeJS.ProcessEnv },
+  ): PtyProcess;
+}
+
+const require = createRequire(import.meta.url);
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+function valueArg(args: string[], name: string, fallback = ''): string {
+  const index = args.indexOf(name);
+  if (index < 0) return fallback;
+  return args[index + 1] || fallback;
+}
+
+function hasFlag(args: string[], name: string): boolean {
+  return args.includes(name);
+}
+
+function printUsage(): void {
+  process.stdout.write([
+    'Usage:',
+    '  CODELARK_SETUP_WIZARD_REAL_E2E=1 npm run real:setup-wizard:wizard-e2e -- [options]',
+    '',
+    'Options:',
+    '  --run-root <path>       Temporary root; default /tmp/clk-setup-wizard-wizard-e2e-<timestamp>',
+    '  --timeout-ms <number>   Overall wizard timeout; default 600000',
+    '  --keep-temp             Keep temporary root for diagnosis; default cleans it after success',
+    '  --help                  Show this help',
+    '',
+    'The script starts the real setup wizard in a fresh mock HOME, accepts default',
+    'answers, prints setup/login URLs for manual scanning, then writes the created',
+    `app credentials to ${defaultRealFeishuTestEnvFile()}.`,
+    '',
+  ].join('\n'));
+}
+
+function assertInside(parentPath: string, childPath: string): void {
+  const parent = path.resolve(parentPath);
+  const child = path.resolve(childPath);
+  const relative = path.relative(parent, child);
+  if (relative === '' || (relative && !relative.startsWith('..') && !path.isAbsolute(relative))) return;
+  throw new Error(`Path escaped temp root: ${child}`);
+}
+
+function npxCommand(): string {
+  return process.platform === 'win32' ? 'npx.cmd' : 'npx';
+}
+
+function defaultRealFeishuTestEnvFile(): string {
+  const codelarkHome = process.env.CODELARK_HOME || path.join(os.homedir(), '.codelark');
+  return path.join(codelarkHome, 'real-feishu-e2e', 'test.env');
+}
+
+async function loadPtyModule(): Promise<PtyModule> {
+  const dynamicImport = new Function('specifier', 'return import(specifier)') as (specifier: string) => Promise<unknown>;
+  const loaded = await dynamicImport('@homebridge/node-pty-prebuilt-multiarch') as { default?: unknown };
+  return (loaded.default || loaded) as PtyModule;
+}
+
+function runCommand(
+  command: string,
+  args: string[],
+  options: { cwd: string; env: NodeJS.ProcessEnv; timeoutMs: number },
+): Promise<{ code: number; stdout: string; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    const timeout = setTimeout(() => {
+      child.kill('SIGTERM');
+      reject(new Error(`${command} ${args.join(' ')} timed out after ${options.timeoutMs}ms`));
+    }, options.timeoutMs);
+    child.stdout?.setEncoding('utf8');
+    child.stderr?.setEncoding('utf8');
+    child.stdout?.on('data', (chunk) => { stdout += chunk; });
+    child.stderr?.on('data', (chunk) => { stderr += chunk; });
+    child.on('error', (error) => {
+      clearTimeout(timeout);
+      reject(error);
+    });
+    child.on('close', (code) => {
+      clearTimeout(timeout);
+      resolve({ code: code ?? 1, stdout, stderr });
+    });
+  });
+}
+
+async function runWizardWithDefaults(options: {
+  env: NodeJS.ProcessEnv;
+  timeoutMs: number;
+}): Promise<string> {
+  const pty = await loadPtyModule();
+  const child = pty.spawn(npxCommand(), ['tsx', 'src/entrypoints/cli.ts', 'setup'], {
+    name: 'xterm-256color',
+    cols: 120,
+    rows: 40,
+    cwd: packageRoot,
+    env: options.env,
+  });
+
+  let output = '';
+  const printedUrls = new Set<string>();
+  let defaultConfirmCount = 0;
+  const maxDefaultConfirms = 40;
+  let exited = false;
+
+  const defaultInput = setInterval(() => {
+    if (exited || defaultConfirmCount >= maxDefaultConfirms) return;
+    child.write('\r');
+    defaultConfirmCount += 1;
+  }, 900);
+
+  return await new Promise<string>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      clearInterval(defaultInput);
+      child.kill('SIGTERM');
+      reject(new Error(`setup wizard timed out after ${options.timeoutMs}ms`));
+    }, options.timeoutMs);
+
+    child.onData((data) => {
+      output += data;
+      process.stdout.write(data);
+      for (const match of output.matchAll(/https?:\/\/[^\s<>"'`]+/giu)) {
+        const url = match[0].replace(/[),.;\]}，。；）】]+$/u, '');
+        if (!url || printedUrls.has(url)) continue;
+        printedUrls.add(url);
+        process.stdout.write(`\n[setup-wizard-real-wizard-e2e] 授权链接：${url}\n`);
+      }
+      if (output.length > 80_000) output = output.slice(-40_000);
+    });
+
+    child.onExit((event) => {
+      exited = true;
+      clearInterval(defaultInput);
+      clearTimeout(timeout);
+      if (event.exitCode === 0) {
+        resolve(output);
+        return;
+      }
+      reject(new Error(`setup wizard exited with ${event.signal || event.exitCode}\n${output.slice(-4000)}`));
+    });
+  });
+}
+
+interface CreatedWizardCredentials {
+  appId: string;
+  appSecret: string;
+  site: FeishuSite;
+}
+
+function buildLarkCliRuntimeEnv(codelarkHome: string): NodeJS.ProcessEnv {
+  return {
+    LARK_CHANNEL: '1',
+    LARK_CHANNEL_HOME: codelarkHome,
+    LARK_CHANNEL_CONFIG: path.join(codelarkHome, 'runtime', 'lark-cli-source', 'config.json'),
+    LARKSUITE_CLI_CONFIG_DIR: path.join(codelarkHome, 'runtime', 'lark-cli'),
+  };
+}
+
+async function assertLarkCliAuthorization(options: {
+  env: NodeJS.ProcessEnv;
+  timeoutMs: number;
+}): Promise<void> {
+  const larkCliScript = require.resolve('@larksuite/cli/scripts/run.js');
+  const status = await runCommand(process.execPath, [larkCliScript, 'auth', 'status'], {
+    cwd: packageRoot,
+    env: options.env,
+    timeoutMs: options.timeoutMs,
+  });
+  if (status.code !== 0) {
+    throw new Error(`lark-cli auth status failed\n${status.stdout}\n${status.stderr}`);
+  }
+
+  const check = await runCommand(
+    process.execPath,
+    [larkCliScript, 'auth', 'check', '--scope', feishuSetupUserAuthScopeArgument()],
+    {
+      cwd: packageRoot,
+      env: options.env,
+      timeoutMs: options.timeoutMs,
+    },
+  );
+  if (check.code !== 0) {
+    throw new Error(`lark-cli auth check failed\n${check.stdout}\n${check.stderr}`);
+  }
+}
+
+function assertCodeLarkConfig(options: {
+  codelarkHome: string;
+  workspaceRoot: string;
+}): CreatedWizardCredentials {
+  const configTomlPath = path.join(options.codelarkHome, 'config.toml');
+  const configJsonPath = path.join(options.codelarkHome, 'config.json');
+  const configEnvPath = path.join(options.codelarkHome, 'config.env');
+  const larkCliRuntimeConfigPath = path.join(options.codelarkHome, 'runtime', 'lark-cli', 'lark-channel', 'config.json');
+  const parsed = parse(fs.readFileSync(configTomlPath, 'utf-8')) as {
+    runtime?: { provider?: string };
+    bridge?: { default_workspace?: string };
+    channels?: Array<{ provider?: string; enabled?: boolean; config?: { app_id?: string; app_secret?: string; site?: string } }>;
+  };
+  const feishu = parsed.channels?.find((channel) => channel.provider === 'feishu');
+
+  if (parsed.runtime?.provider !== 'codex') throw new Error(`runtime provider mismatch: ${parsed.runtime?.provider}`);
+  if (parsed.bridge?.default_workspace !== options.workspaceRoot) {
+    throw new Error(`workspace mismatch: ${parsed.bridge?.default_workspace}`);
+  }
+  if (feishu?.enabled !== true) throw new Error('Feishu channel is not enabled');
+  const appId = feishu?.config?.app_id?.trim();
+  const appSecret = feishu?.config?.app_secret?.trim();
+  const site = feishu?.config?.site === 'lark' ? 'lark' : 'feishu';
+  if (!appId) throw new Error('CodeLark config appId missing');
+  if (!appSecret) throw new Error('CodeLark config appSecret missing');
+  if (fs.existsSync(configEnvPath)) throw new Error('setup should not create config.env');
+  if (fs.existsSync(configJsonPath)) throw new Error('setup should not create config.json');
+  if (!fs.existsSync(larkCliRuntimeConfigPath)) throw new Error('CodeLark private lark-cli runtime config missing');
+  return { appId, appSecret, site };
+}
+
+function writeDefaultRealFeishuTestEnvFile(filePath: string, credentials: CreatedWizardCredentials): void {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const tmpPath = `${filePath}.tmp`;
+  fs.writeFileSync(
+    tmpPath,
+    [
+      '# Generated by setup-wizard-real-wizard-e2e.ts',
+      `CODELARK_REAL_FEISHU_TEST_APP_ID=${credentials.appId}`,
+      `CODELARK_REAL_FEISHU_TEST_APP_SECRET=${credentials.appSecret}`,
+      `CODELARK_REAL_FEISHU_TEST_SITE=${credentials.site}`,
+      '',
+    ].join('\n'),
+    { mode: 0o600 },
+  );
+  fs.renameSync(tmpPath, filePath);
+}
+
+async function main(): Promise<void> {
+  const argv = process.argv.slice(2);
+  if (hasFlag(argv, '--help')) {
+    printUsage();
+    return;
+  }
+  if (process.env.CODELARK_SETUP_WIZARD_REAL_E2E !== '1') {
+    throw new Error('Refusing to run setup wizard real e2e without CODELARK_SETUP_WIZARD_REAL_E2E=1.');
+  }
+
+  const outputTestEnvFile = defaultRealFeishuTestEnvFile();
+  const runRoot = path.resolve(valueArg(
+    argv,
+    '--run-root',
+    path.join(os.tmpdir(), `clk-setup-wizard-wizard-e2e-${Date.now()}`),
+  ));
+  const keepTemp = hasFlag(argv, '--keep-temp');
+  const timeoutMs = Number(valueArg(argv, '--timeout-ms', '600000'));
+
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new Error(`Invalid --timeout-ms: ${timeoutMs}`);
+  }
+
+  const runtimeHome = path.join(runRoot, 'home');
+  const codelarkHome = path.join(runRoot, 'codelark-home');
+  const workspaceRoot = path.join(runRoot, 'workspace');
+  const codexHome = path.join(runtimeHome, '.codex');
+
+  try {
+    assertInside(os.tmpdir(), runRoot);
+    fs.mkdirSync(runtimeHome, { recursive: true });
+    fs.mkdirSync(codexHome, { recursive: true });
+    fs.mkdirSync(workspaceRoot, { recursive: true });
+
+    const env = {
+      ...process.env,
+      HOME: runtimeHome,
+      USERPROFILE: runtimeHome,
+      CODEX_HOME: codexHome,
+      CODELARK_HOME: codelarkHome,
+      FORCE_COLOR: '0',
+      NO_COLOR: '1',
+      TERM: 'xterm-256color',
+    };
+    delete env.CI;
+
+    await runWizardWithDefaults({ env, timeoutMs });
+
+    const larkCliEnv = {
+      ...env,
+      ...buildLarkCliRuntimeEnv(codelarkHome),
+    };
+    await assertLarkCliAuthorization({ env: larkCliEnv, timeoutMs: 60_000 });
+    const credentials = assertCodeLarkConfig({ codelarkHome, workspaceRoot });
+    writeDefaultRealFeishuTestEnvFile(outputTestEnvFile, credentials);
+
+    const result = {
+      ok: true,
+      runRoot,
+      runtimeHome,
+      codelarkHome,
+      workspaceRoot,
+      testEnvFile: outputTestEnvFile,
+      appId: credentials.appId,
+      site: credentials.site,
+      larkCliRuntimeDir: path.join(codelarkHome, 'runtime', 'lark-cli'),
+      cleanedRunRoot: !keepTemp,
+    };
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  } finally {
+    if (!keepTemp) {
+      fs.rmSync(runRoot, { recursive: true, force: true });
+    }
+  }
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.stack || error.message : String(error)}\n`);
+  process.exit(1);
+});

package/scripts/supervisor-windows.ps1

@@ -36,7 +36,6 @@ $StatusFile = Join-Path $RuntimeDir 'status.json'
 $LogFile    = Join-Path (Join-Path $CodelarkHome 'logs') 'bridge.log'
 $ErrLogFile = Join-Path (Join-Path $CodelarkHome 'logs') 'bridge.stderr.log'
 $DaemonMjs  = Join-Path (Join-Path $SkillDir 'dist') 'daemon.mjs'
-$ConfigFile = Join-Path $CodelarkHome 'config.env'
 
 $ServiceName = 'CodeLarkBridge'
 
@@ -68,32 +67,6 @@ function Ensure-Built {
     }
 }
 
-function Get-ConfigEnvironment {
-    $configEnv = @{}
-    if (-not (Test-Path $ConfigFile)) {
-        return $configEnv
-    }
-
-    foreach ($line in Get-Content $ConfigFile) {
-        $trimmed = $line.Trim()
-        if (-not $trimmed -or $trimmed.StartsWith('#')) { continue }
-        $eqIndex = $trimmed.IndexOf('=')
-        if ($eqIndex -lt 1) { continue }
-
-        $name = $trimmed.Substring(0, $eqIndex).Trim()
-        $value = $trimmed.Substring($eqIndex + 1).Trim()
-        if (
-            ($value.StartsWith('"') -and $value.EndsWith('"')) -or
-            ($value.StartsWith("'") -and $value.EndsWith("'"))
-        ) {
-            $value = $value.Substring(1, $value.Length - 2)
-        }
-        $configEnv[$name] = $value
-    }
-
-    return $configEnv
-}
-
 function Read-Pid {
     if (Test-Path $PidFile) { return (Get-Content $PidFile -Raw).Trim() }
     return $null
@@ -144,7 +117,7 @@ function Show-FailureHelp {
 function Get-NodePath {
     $nodePath = (Get-Command node -ErrorAction SilentlyContinue).Source
     if (-not $nodePath) {
-        Write-Error "Node.js not found in PATH. Install Node.js >= 20."
+        Write-Error "Node.js not found in PATH. Install Node.js >= 24."
         exit 1
     }
     return $nodePath
@@ -167,7 +140,6 @@ function Install-WinSWService {
     param([string]$WinSWPath)
     $nodePath = Get-NodePath
     $xmlPath = Join-Path $SkillDir "$ServiceName.xml"
-    $configEnv = Get-ConfigEnvironment
 
     # Run as current user so the service can access ~/.codelark and Codex login state
     $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
@@ -204,13 +176,6 @@ function Install-WinSWService {
 </service>
 "@
 
-    $extraEnvXml = ($configEnv.GetEnumerator() | ForEach-Object {
-        '  <env name="{0}" value="{1}"/>' -f $_.Key, [System.Security.SecurityElement]::Escape($_.Value)
-    }) -join "`r`n"
-    if ($extraEnvXml) {
-        $xml = $xml -replace '  <logpath>', "$extraEnvXml`r`n  <logpath>"
-    }
-
     $xml | Set-Content -Path $xmlPath -Encoding UTF8
 
     # Copy WinSW next to the XML with matching name
@@ -227,7 +192,6 @@ function Install-WinSWService {
 function Install-NSSMService {
     param([string]$NSSMPath)
     $nodePath = Get-NodePath
-    $configEnv = Get-ConfigEnvironment
 
     # Run as current user so the service can access ~/.codelark and Codex login state
     $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
@@ -250,9 +214,6 @@ function Install-NSSMService {
         "LOCALAPPDATA=$env:LOCALAPPDATA",
         "CODELARK_HOME=$CodelarkHome"
     )
-    foreach ($entry in $configEnv.GetEnumerator()) {
-        $envArgs += "$($entry.Key)=$($entry.Value)"
-    }
     & $NSSMPath set $ServiceName AppEnvironmentExtra @envArgs
 
     Write-Host "Service '$ServiceName' installed via NSSM."
@@ -265,7 +226,6 @@ function Install-NSSMService {
 
 function Start-Fallback {
     $nodePath = Get-NodePath
-    $configEnv = Get-ConfigEnvironment
 
     # Clean env
     $envClone = [System.Collections.Hashtable]::new()
@@ -276,10 +236,6 @@ function Start-Fallback {
     [System.Environment]::SetEnvironmentVariable('CLAUDECODE', $null)
     [System.Environment]::SetEnvironmentVariable('CODELARK_HOME', $CodelarkHome, 'Process')
 
-    foreach ($entry in $configEnv.GetEnumerator()) {
-        [System.Environment]::SetEnvironmentVariable($entry.Key, $entry.Value, 'Process')
-    }
-
     try {
         $proc = Start-Process -FilePath $nodePath `
             -ArgumentList $DaemonMjs `
@@ -292,11 +248,6 @@ function Start-Fallback {
         foreach ($key in $envClone.Keys) {
             [System.Environment]::SetEnvironmentVariable($key, $envClone[$key], 'Process')
         }
-        foreach ($entry in $configEnv.GetEnumerator()) {
-            if (-not $envClone.ContainsKey($entry.Key)) {
-                [System.Environment]::SetEnvironmentVariable($entry.Key, $null, 'Process')
-            }
-        }
         if (-not $envClone.ContainsKey('CODELARK_HOME')) {
             [System.Environment]::SetEnvironmentVariable('CODELARK_HOME', $null, 'Process')
         }

package/skills/codelark-question/SKILL.md

@@ -23,6 +23,10 @@ description: 在 CodeLark 中需要向 IM 用户发起结构化确认、选择
 
 CodeLark 会把最终回复里的 `<clk-ask>` 块转换成飞书/Lark 问题卡片。用户提交后的结果会作为下一条用户消息回到同一个 bridge session。
 
+## 生效时机
+
+`<clk-ask>` 必须放在 assistant 的 completed/final 回复里，CodeLark 才会解析成问题卡片。不要把 `<clk-ask>` 放在工作过程消息、commentary/intermediate update、流式状态更新或工具调用说明里；这些路径只会进入 streaming card，不会生成弹窗。
+
 ## 输出格式
 
 在一个 `<clk-ask>` 块里输出合法 JSON。不要把 JSON 放进 markdown 代码块。
@@ -47,6 +51,7 @@ CodeLark 会把最终回复里的 `<clk-ask>` 块转换成飞书/Lark 问题卡
 ## 规则
 
 - 只有在确实需要用户输入才能继续时才使用。
+- 必须把 `<clk-ask>` 放在 completed/final 回复中；不要放在工作过程消息或流式更新中。
 - 普通说明放在 `<clk-ask>` 块外。
 - 只是在总结、写代码、汇报已完成工作时，不要发问题卡片。
 - `options` 要短，并且互斥；最多展示 8 个选项。