dsh-lark-bot 0.19.0 → 0.19.2

package/README.md

@@ -49,7 +49,7 @@
 **基础能力**：
 
 - 私聊、群聊、话题（thread）里指挥本机 dsh coding agent，图片 / 文本文件直接发给 bot 即可；
-- 流式过程卡以飞书原生折叠面板实时展示阶段、耗时以及工具名称与状态，完成后最终回答单独发送，支持交互按钮（停止 / 计划门禁 / 审批 / 问答卡）；原始推理、工具输入输出与底层错误不会进入卡片；卡片更新失败会有限重试并降级为普通提示，Agent 与最终回答继续，不会拖垮 bridge 进程；
+- 流式过程卡以飞书原生折叠面板实时展示阶段、耗时以及工具名称与状态；完成但存在失败工具时汇总为“已完成（含警告）/Completed with warnings”，不把“任务轮次结束”冒充为“所有工具成功”。完成后最终回答单独发送，支持交互按钮（停止 / 计划门禁 / 审批 / 问答卡）；原始推理、工具输入输出与底层错误不会进入卡片；卡片更新失败会有限重试并降级为普通提示，Agent 与最终回答继续，不会拖垮 bridge 进程；
 - Git 仓库内为每个会话自动创建隔离 worktree 项目工作区，多项目互不干扰。
 
 **十二项全网独有组合**：
@@ -154,7 +154,8 @@ Markdown、toast 与旧客户端降级路径同时显示中英文。agent 最终
 | `/help` | 查看帮助|
 
 每轮 SDK / ACP / Web 请求都会注入结构化、无密钥的频道上下文，并注册官方 runtime Skill
-`dsh-lark-bot`。API Key、token 与 App Secret 必须经 `/key set <引用名>`、`/secret set …` 或 Agent
+`dsh-lark-bot`。上下文明确区分 bridge 预处理的用户斜杠命令与 Agent 可调用工具；后者的列表不代表
+前者不存在，Skill 暂时不可加载时仍以 `/help` 为当前版本权威命令入口。API Key、token 与 App Secret 必须经 `/key set <引用名>`、`/secret set …` 或 Agent
 工具 `lark_request_secret` 打开的密码表单提交；普通聊天、旧 `/key set <引用名> <值>` 与
 `--api-key` 不再消费值。表单只允许发起者提交，值直接写入本机受支持目标，不进入 prompt、session、
 任务账本、归档、日志、诊断包或回复。Guardian 安全模式是降级恢复面，不提供该完整配置与密钥工具。
@@ -247,7 +248,7 @@ guardian 仍只救援其配置的主实例。
 
 **结果文件直接回传**：SDK / ACP / Web agent 可调用 `lark_send_file`，把当前会话 workspace、实际执行 worktree、当前 scope 归档或实例日志中的文件直接上传到原飞书聊天 / 话题；普通 `/archive [note]` 会在落盘后立即发送 Markdown + JSONL，失败时保留路径并可用 `/archive send <id> [scope|chatId]` 重试或由管理员转发到指定会话。上传只接受普通文件，默认单文件不超过 20 MiB；真实路径必须位于 bridge 计算的会话目录内，runtime 自报 cwd 不能扩大边界。
 
-**逐操作审批与 scope 权限策略**：SDK / ACP / Web runtime 在任何本地快速通道和计划门裁决前，先通过鉴权回环读取当前 immutable scope 的 `ask|allow|deny`。`deny` 对低风险与高风险工具都先行拒绝并返回 `permission-policy` 来源；`ask` 对保守只读自省静默放行、对高风险调用弹“允许执行一次 / 拒绝”卡；`allow` 自动放行逐工具审批，但仍不替代高风险任务的计划确认或 Harness 文件沙箱。管理员可用 `/permission allow|deny|ask [scope]` 修改当前聊天内 scope；策略成功落盘后才确认，持久化到 profile 的 `permission-policies.json`（0600），重启不丢并显示在 `/status`。legacy `headless` 不具备工具回调能力。
+**逐操作审批与 scope 权限策略**：SDK / ACP / Web runtime 在任何本地快速通道和计划门裁决前，先通过鉴权回环同步读取当前 immutable scope 的 `ask|allow|deny`；该 policy-only 查询不创建卡片或进入人类等待传输。`deny` 对低风险与高风险工具都先行拒绝并返回 `permission-policy` 来源；`ask` 对保守只读自省静默放行、对高风险调用弹“允许执行一次 / 拒绝”卡；`allow` 自动放行逐工具审批，但仍不替代高风险任务的计划确认或 Harness 文件沙箱。管理员可用 `/permission allow|deny|ask [scope]` 修改当前聊天内 scope；策略成功落盘后才确认，持久化到 profile 的 `permission-policies.json`（0600），重启不丢并显示在 `/status`。legacy `headless` 不具备工具回调能力。
 
 **关键任务计划门禁**：SDK / ACP / Web agent 在修改文件、运行脚本等较大或高风险动作前使用
 `lark_request_plan_approval`；同一 turn 未获批准时，runtime pre-execute 策略会拒绝写入、删除、
@@ -528,6 +529,8 @@ SDK / ACP 启动会先解析完整 provider/model route：显式双字段优先
 `agent-default-model: { provider, model }`；仍无法得到完整 route 时在 bridge/doctor 入口给出本项目的
 明确配置错误，不把空 provider 传给上游 runtime。受管 service 的 install/start/restart 会把旧 env
 文件中的受管键与当前 shell 合并（当前 shell 显式值优先），避免从另一个终端重启时静默丢失已有 route。
+模型目录在进程冷启动时暂时不可达，也会保留该对象形式默认 route 作为最小离线条目；这不会放行
+settings 中没有明确配置的未知模型。
 
 启动时会自动查找本机常见的 `@deepseek-ai/dsh` 安装位置。只有自动发现失败或需要指定特殊 profile 时，才需要设置这两个变量。
 

package/README_EN.md

@@ -51,7 +51,7 @@ Bot-owned command help, status/error messages and interactive cards are availabl
 **Core**:
 
 - Drive your local dsh coding agent from private chats, group chats and threads; images / text files can be sent straight to the bot;
-- A streaming process card with a native collapsible panel for phase, elapsed time, and tool names/statuses; raw reasoning, tool payloads, and underlying errors stay out of the card. The final answer arrives separately, with interactive buttons for stop / plan gate / approval / questions. Failed card patches are retried finitely and degrade to a plain notice—the agent and final reply continue instead of taking down the bridge;
+- A streaming process card with a native collapsible panel for phase, elapsed time, and tool names/statuses. A completed turn containing a failed tool is summarized as **Completed with warnings** in native and legacy views without changing the completed job outcome. Raw reasoning, tool payloads, and underlying errors stay out of the card. The final answer arrives separately, with interactive buttons for stop / plan gate / approval / questions. Failed card patches are retried finitely and degrade to a plain notice—the agent and final reply continue instead of taking down the bridge;
 - Automatic session archival and retention policies; per-session isolated git worktrees inside Git repositories, so multiple projects never interfere with each other.
 
 **Twelve exclusive capabilities**:
@@ -152,7 +152,9 @@ Send a normal message to the bot in Feishu to get started. Common commands:
 | `/help` | Show help |
 
 Every SDK, ACP, and Web turn receives structured, secret-free channel context and the official runtime
-`dsh-lark-bot` skill. API keys, tokens, and App Secrets must be entered through the owner-only password form opened
+`dsh-lark-bot` skill. The context distinguishes bridge-side slash commands from model-callable tools: the tool list
+does not imply that slash commands are absent, and `/help` remains the authoritative command list if the runtime
+skill cannot be loaded. API keys, tokens, and App Secrets must be entered through the owner-only password form opened
 by `/key set <ref>`, `/secret set …`, or `lark_request_secret`. Ordinary chat, legacy `/key set <ref> <value>`, and
 `--api-key` no longer consume values. The value never enters prompts, sessions, jobs, archives, logs, diagnostics,
 or replies. Guardian safe mode is a degraded recovery surface without the full configuration/secret seam.
@@ -168,7 +170,8 @@ The `/model` card merges the dsh default into its switchable catalogue even when
 list omits it, and uses compact distinguishing labels with at most two buttons per mobile row. Provider
 names, models, input modalities, and reasoning-effort options are discovered from the models.dev runtime
 catalogue and cached in memory for 15 minutes. If it is unavailable, only explicit dsh settings and the
-configured default are shown—there is no hardcoded fallback list. Override the feed with
+configured default are shown, and an object-form `agent-default-model` remains a minimally resolvable offline
+route—there is no hardcoded fallback list and other unknown models remain rejected. Override the feed with
 `DSH_LARK_MODEL_CATALOG_URL`; model commands and the wizard preserve `inputModalities`.
 
 **Message-level DSH session sync (`web` adapter)**: `/session` lists metadata only for non-subagent sessions
@@ -256,7 +259,7 @@ reject `web`, because a shared Web agent broadcast stream cannot isolate session
 
 **Direct result-file delivery**: SDK / ACP / Web agents can call `lark_send_file` to upload a file from the current session workspace, its actual execution worktree, its scope archive, or the instance logs to the originating Feishu chat/topic. `/archive [note]` uploads its Markdown and JSONL after the durable local write; `/archive send <id> [scope|chatId]` retries locally or lets an admin forward it to a registered session. Only regular files up to 20 MiB are accepted by default. The resolved path must remain inside roots computed by the bridge; a runtime-supplied cwd never expands access.
 
-**Per-action approval and scope policy**: the default SDK and Web host enforce a `tools/pre-execute` gate and wire dsh rc.8's official `approval/request` seam into Feishu; ACP uses native `session/request_permission`. The default `ask` policy shows **Allow once** / **Reject**. An admin may use `/permission allow` to auto-allow tool approvals in the current isolated scope, `/permission deny` to reject them with an explicit chat notice, or `/permission ask` to restore prompts. In member isolation, copy the target from `/status` and use `/permission <policy> <scope>`; cross-chat targets are rejected. Success is confirmed only after the owner-only `permission-policies.json` write completes, so policies survive restarts and appear in `/status`. They never bypass the separate plan gate; legacy `headless` has no tool callback channel.
+**Per-action approval and scope policy**: the default SDK and Web host enforce a `tools/pre-execute` gate and wire dsh rc.8's official `approval/request` seam into Feishu; ACP uses native `session/request_permission`. Before any fast path or plan gate, the runtime synchronously queries the immutable scope policy through the authenticated policy-only callback; this response is `ask|allow|deny`, requires no approval outcome, and never creates or waits for a card. The default `ask` policy shows **Allow once** / **Reject** for high-risk calls. An admin may use `/permission allow` to auto-allow tool approvals in the current isolated scope, `/permission deny` to reject them with an explicit chat notice, or `/permission ask` to restore prompts. In member isolation, copy the target from `/status` and use `/permission <policy> <scope>`; cross-chat targets are rejected. Success is confirmed only after the owner-only `permission-policies.json` write completes, so policies survive restarts and appear in `/status`. They never bypass the separate plan gate; legacy `headless` has no tool callback channel.
 
 **Plan gate for substantial tasks**: SDK / ACP / Web agents use `lark_request_plan_approval` before file
 changes, scripts, or other substantial/high-risk actions. A runtime pre-execute policy denies writes, deletes,

package/dist/cli.js

@@ -1247,6 +1247,19 @@ var PUBLIC_MODEL_CATALOG = new ModelsDevCatalog();
 function isMapLike(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function defaultModelSelectionFromSettings(settings) {
+  const section = settings[AGENT_DEFAULT_MODEL_NAMESPACE];
+  if (typeof section === "string") {
+    return { provider: DEEPSEEK_PROVIDER, model: section };
+  }
+  if (isMapLike(section) && typeof section.model === "string") {
+    return {
+      provider: typeof section.provider === "string" ? section.provider : DEEPSEEK_PROVIDER,
+      model: section.model
+    };
+  }
+  return void 0;
+}
 function deepEqualJson(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
@@ -1490,10 +1503,24 @@ var DshProviderManager = class {
         error: error instanceof Error ? error.message : String(error)
       });
     }
-    return [
+    const providers = [
       await this.describeDeepseek(settings, catalogProviders),
       ...await this.describePiAi(settings, catalogProviders)
     ];
+    const configuredDefault = defaultModelSelectionFromSettings(settings);
+    if (!configuredDefault) return providers;
+    return providers.map((provider) => {
+      if (provider.id !== configuredDefault.provider || provider.models.some((model) => model.id === configuredDefault.model)) return provider;
+      return {
+        ...provider,
+        models: [...provider.models, {
+          id: configuredDefault.model,
+          name: void 0,
+          contextWindow: void 0,
+          maxTokens: void 0
+        }]
+      };
+    });
   }
   async describeDeepseek(settings, catalogProviders) {
     const deepseek = isMapLike(settings[DEEPSEEK_NAMESPACE]) ? settings[DEEPSEEK_NAMESPACE] : {};
@@ -1544,18 +1571,7 @@ var DshProviderManager = class {
   }
   /** Read the full `agent-default-model` selection (provider + model). */
   async defaultModelSelection() {
-    const settings = await this.readSettings();
-    const section = settings[AGENT_DEFAULT_MODEL_NAMESPACE];
-    if (typeof section === "string") {
-      return { provider: DEEPSEEK_PROVIDER, model: section };
-    }
-    if (isMapLike(section) && typeof section.model === "string") {
-      return {
-        provider: typeof section.provider === "string" ? section.provider : DEEPSEEK_PROVIDER,
-        model: section.model
-      };
-    }
-    return void 0;
+    return defaultModelSelectionFromSettings(await this.readSettings());
   }
   /**
    * Resolve the provider that owns a model id across the configured providers.
@@ -7123,7 +7139,13 @@ function summaryText(state, locale) {
   if (state.terminal === "interrupted") return zh ? "\u5DF2\u4E2D\u65AD" : "Interrupted";
   if (state.terminal === "idle_timeout") return zh ? "\u5DF2\u8D85\u65F6" : "Timed out";
   if (state.terminal === "error") return zh ? "\u51FA\u9519" : "Failed";
-  if (state.terminal === "done") return zh ? "\u5DF2\u5B8C\u6210" : "Completed";
+  if (state.terminal === "done") {
+    const hasToolWarning = state.blocks.some(
+      (block) => block.kind === "tool" && block.tool.status === "error"
+    );
+    if (hasToolWarning) return zh ? "\u5DF2\u5B8C\u6210\uFF08\u542B\u8B66\u544A\uFF09" : "Completed with warnings";
+    return zh ? "\u5DF2\u5B8C\u6210" : "Completed";
+  }
   if (state.footer === "tool_running") return zh ? "\u6B63\u5728\u8C03\u7528\u5DE5\u5177" : "Running tools";
   if (state.footer === "streaming") return zh ? "\u6B63\u5728\u8F93\u51FA" : "Responding";
   return zh ? "\u601D\u8003\u4E2D" : "Thinking";
@@ -7198,7 +7220,10 @@ function thinkingPanel(state, locale, maxTools) {
 }
 function compatibilityProcessSnapshot(state, locale, maxTools) {
   const zh = locale === "zh_cn";
-  const lines = [zh ? "_\u6267\u884C\u72B6\u6001\uFF08\u517C\u5BB9\u663E\u793A\uFF09_" : "_Execution status (compatibility view)_"];
+  const lines = [
+    zh ? "_\u6267\u884C\u72B6\u6001\uFF08\u517C\u5BB9\u663E\u793A\uFF09_" : "_Execution status (compatibility view)_",
+    summaryText(state, locale)
+  ];
   const toolBlocks = state.blocks.filter((block) => block.kind === "tool");
   const visibleCount = Math.min(3, maxTools);
   const tools = visibleCount === 0 ? [] : toolBlocks.slice(-visibleCount);
@@ -7209,7 +7234,6 @@ function compatibilityProcessSnapshot(state, locale, maxTools) {
   for (const block of tools) {
     lines.push(`\u{1F9F0} ${boundedText(block.tool.name, MAX_TOOL_NAME_LENGTH)} \xB7 ${block.tool.status}`);
   }
-  if (lines.length === 1) lines.push(state.terminal === "running" ? zh ? "\u6B63\u5728\u5904\u7406\u8BF7\u6C42\u2026" : "Processing the request\u2026" : zh ? "\u6267\u884C\u8FC7\u7A0B\u5DF2\u7ED3\u675F" : "Execution finished");
   return noteMd(lines.join("\n"));
 }
 function runFailureLine(locale) {
@@ -7695,7 +7719,8 @@ function renderChannelContext(context) {
     `language_policy: ui=${context.language.ui}; plain=${context.language.plain}; agent=${context.language.agent}`,
     `secure_value_collection: ${context.secretCollection}`,
     agentLanguage,
-    "This turn arrived through the dsh-lark-bot Feishu/Lark channel. Use the dsh-lark-bot skill for channel setup, configuration, and diagnostics. Never ask for a secret in ordinary chat; use lark_request_secret when secure value collection is available."
+    "This turn arrived through the dsh-lark-bot Feishu/Lark channel. Use the dsh-lark-bot skill for channel setup, configuration, and diagnostics. Never ask for a secret in ordinary chat; use lark_request_secret when secure value collection is available.",
+    "Slash commands are handled by the bridge before the agent and are separate from model-callable tools: do not infer their absence from available_channel_tools. If the runtime skill cannot be loaded, tell the user to run /help for the authoritative command list."
   ].join("\n");
 }
 
@@ -14183,6 +14208,22 @@ var NotifyServer = class {
           respond(400, { ok: false, error: "sessionId and toolName are required" });
           return;
         }
+        if (payload.policyCheckOnly) {
+          const result2 = await this.deps.approval(payload);
+          if (!result2.ok || !isPermissionPolicy(result2.policy)) {
+            respond(404, {
+              ok: false,
+              ...result2.error ? { error: result2.error } : { error: "invalid policy response" }
+            });
+            return;
+          }
+          respond(200, {
+            ok: true,
+            policy: result2.policy,
+            ...result2.denial === void 0 ? {} : { denial: result2.denial }
+          });
+          return;
+        }
         const result = await waitForHuman(
           (signal) => this.deps.approval(payload, signal)
         );
@@ -14270,6 +14311,9 @@ var NotifyServer = class {
     }
   }
 };
+function isPermissionPolicy(value) {
+  return value === "ask" || value === "allow" || value === "deny";
+}
 function readBody(req) {
   return new Promise((resolve6, reject) => {
     const chunks = [];
@@ -20175,7 +20219,7 @@ async function runSupervise(options, deps = {}) {
   mkdirSync(dirname17(logFile), { recursive: true });
   const logFd = openSync(logFile, "a");
   const writeStatus = async (state, childPid, restarts2) => {
-    const processIdentity = await readLinuxProcessIdentity(process.pid);
+    const processIdentity = await (deps.readProcessIdentity ?? readLinuxProcessIdentity)(process.pid);
     const status = {
       pid: process.pid,
       childPid,
@@ -20211,8 +20255,9 @@ async function runSupervise(options, deps = {}) {
         stdio: ["ignore", logFd, logFd]
       });
       child = spawned;
+      const exited = waitForExit(spawned);
       await writeStatus("running", spawned.pid, restarts);
-      await waitForExit(spawned);
+      await exited;
       if (forceStopTimer) {
         clearTimeout(forceStopTimer);
         forceStopTimer = void 0;