dsh-lark-bot 0.19.2 → 0.19.3

package/README.md

@@ -334,7 +334,7 @@ profile 的前台进程会拒绝并提示先停止，生命周期锁阻止并发
 
 ### 升级
 
-**完全不接触命令行：** profile 管理员在飞书发送 `/upgrade`。有新版本时 bot 弹出只允许发起人操作的确认卡；点击“确认更新”后，Guardian 通过独立 worker 安装卡片中确认的精确 npm 版本，复用完整升级、runtime profile 修复、guardian/profile 重启和 doctor 验证链，并在重载后回到原会话报告结果。点击“取消”不会产生任何变更。更新会重启机器人，正在执行的任务可能被中断；配置、会话、归档和凭据保持不变。每次 `/new` / `/reset` 都会 best-effort 查询一次 npm；仅在有新版本时额外发送一条简短普通消息。
+**完全不接触命令行：** profile 管理员在飞书发送 `/upgrade`。有新版本时 bot 弹出只允许发起人操作的确认卡；点击“确认更新”后，Guardian 通过独立 worker 安装卡片中确认的精确 npm 版本，复用完整升级、runtime profile 修复、guardian/profile 重启和 doctor 验证链，并在重载后回到原会话报告结果。worker 使用 owner-only 中立工作目录与每次请求隔离的 npm cache，不依赖 bridge 启动目录或用户全局 npm cache；失败时只回传脱敏的可行动类别，不发送原始命令输出。点击“取消”不会产生任何变更。更新会重启机器人，正在执行的任务可能被中断；配置、会话、归档和凭据保持不变。每次 `/new` / `/reset` 都会 best-effort 查询一次 npm；仅在有新版本时额外发送一条简短普通消息。
 
 **推荐：一行命令彻底升级（v0.12.0+ 新增，issue #10）**
 
@@ -724,6 +724,8 @@ pnpm publish:dual
 默认安装的「安全网守护」（`src/guardian/`）独立于 dsh 进程常驻：dsh 在线时静默，下线时接管飞书
 通道接收 `/safemode` 控制信号，以仅核心 profile（`dsh-base` + `dsh-headless`）拉起受限对话
 用于自愈，`/safemode exit` 重启完整 profile 并交还通道。
+`dsh-lark-bot guardian status` 只报告精确 `guardian run` 进程身份唯一且存活的常驻 PID，并在
+系统服务 PID 可用时交叉验证；身份不确定时显示“未发现”，不会把查询命令自身 PID 当成守护进程。
 
 ## 目录结构
 

package/dist/cli.js

@@ -838,14 +838,67 @@ var init_acp_adapter = __esm({
 var process_exports = {};
 __export(process_exports, {
   captureOutput: () => captureOutput,
+  findGuardianProcess: () => findGuardianProcess,
   findProfileProcess: () => findProfileProcess,
   isProcessAlive: () => isProcessAlive,
   listProcesses: () => listProcesses,
   looksLikeDshProcess: () => looksLikeDshProcess,
+  matchGuardianProcess: () => matchGuardianProcess,
   matchProfileProcess: () => matchProfileProcess,
   spawnDetached: () => spawnDetached
 });
 import { spawn as spawn5 } from "child_process";
+function commandTokens(cmdline) {
+  const tokens = [];
+  let token = "";
+  let quote;
+  const input = cmdline.trim();
+  for (let index = 0; index < input.length; index += 1) {
+    const character = input[index] ?? "";
+    const next = input[index + 1];
+    if (character === "\\" && quote === void 0 && next !== void 0 && /[\s\\"']/u.test(next)) {
+      token += next;
+      index += 1;
+    } else if (character === "\\" && quote === '"' && next === '"') {
+      token += next;
+      index += 1;
+    } else if (quote !== void 0) {
+      if (character === quote) quote = void 0;
+      else token += character;
+    } else if (character === '"' || character === "'") {
+      quote = character;
+    } else if (/\s/u.test(character)) {
+      if (token !== "") {
+        tokens.push(token);
+        token = "";
+      }
+    } else {
+      token += character;
+    }
+  }
+  if (token !== "") tokens.push(token);
+  return tokens;
+}
+function isGuardianCliEntry(token) {
+  const normalized = token.replace(/\\/gu, "/").toLowerCase();
+  return normalized.endsWith("/dist/cli.js") && (normalized.includes("/dsh-lark-bot/") || normalized.includes("/dsh-feishu-bot/"));
+}
+function hasOnlyGuardianRunOptions(tokens) {
+  for (let index = 0; index < tokens.length; index += 2) {
+    if (tokens[index] !== "--dsh-profile" && tokens[index] !== "--bridge-profile") return false;
+    if (tokens[index + 1] === void 0 || tokens[index + 1]?.startsWith("--")) return false;
+  }
+  return true;
+}
+function matchGuardianProcess(cmdline) {
+  const tokens = commandTokens(cmdline);
+  const cliIndex = tokens.findIndex(isGuardianCliEntry);
+  if (cliIndex < 1) return false;
+  const executable = tokens[cliIndex - 1]?.replace(/\\/gu, "/").split("/").pop()?.toLowerCase();
+  if (executable !== "node" && executable !== "node.exe") return false;
+  if (tokens[cliIndex + 1] !== "guardian" || tokens[cliIndex + 2] !== "run") return false;
+  return hasOnlyGuardianRunOptions(tokens.slice(cliIndex + 3));
+}
 function hasProfileFlag(cmdline, dshProfile) {
   const pattern = new RegExp(
     `(?:^|\\s)--profile(?:\\s+|=)${escapeRegExp(dshProfile)}(?:\\s|$)`
@@ -865,14 +918,14 @@ function matchProfileProcess(cmdline, dshProfile) {
   if (/(?:^|\s)plugin(?:\s|$)/.test(cmdline)) return false;
   return hasProfileFlag(cmdline, dshProfile) && looksLikeDshProcess(cmdline);
 }
-async function listProcesses() {
-  if (process.platform === "win32") {
-    return listProcessesWindows();
+async function listProcesses(platform = process.platform, run = captureOutput) {
+  if (platform === "win32") {
+    return listProcessesWindows(run);
   }
-  return listProcessesPosix();
+  return listProcessesPosix(run);
 }
-async function listProcessesPosix() {
-  const { stdout } = await captureOutput("ps", ["-axo", "pid=,args="], 1e4);
+async function listProcessesPosix(run) {
+  const { stdout } = await run("ps", ["-axo", "pid=,args="], 1e4);
   const result = [];
   for (const line of stdout.split("\n")) {
     const match = /^\s*(\d+)\s+(.+)$/.exec(line);
@@ -882,33 +935,46 @@ async function listProcessesPosix() {
   }
   return result;
 }
-async function listProcessesWindows() {
-  const { stdout } = await captureOutput(
+async function listProcessesWindows(run) {
+  const { stdout } = await run(
     "powershell.exe",
     [
       "-NoProfile",
       "-NonInteractive",
       "-Command",
-      "Get-CimInstance Win32_Process | Select-Object ProcessId, CommandLine | ConvertTo-Csv -NoTypeInformation"
+      "Get-CimInstance Win32_Process | Select-Object ProcessId, CommandLine | ConvertTo-Json -Compress"
     ],
     1e4
   );
-  const result = [];
-  for (const line of stdout.split("\n").slice(1)) {
-    const [pid, ...rest] = line.trim().split(",");
-    const numeric = Number(pid?.replace(/"/g, ""));
-    if (Number.isInteger(numeric) && rest.length > 0) {
-      result.push({ pid: numeric, cmdline: rest.join(",").replace(/^"|"$/g, "") });
-    }
+  try {
+    const parsed = JSON.parse(stdout);
+    const rows = Array.isArray(parsed) ? parsed : [parsed];
+    return rows.flatMap((row) => {
+      if (typeof row !== "object" || row === null) return [];
+      const record = row;
+      const pid = Number(record.ProcessId);
+      const cmdline = record.CommandLine;
+      return Number.isInteger(pid) && pid > 0 && typeof cmdline === "string" ? [{ pid, cmdline }] : [];
+    });
+  } catch {
+    return [];
   }
-  return result;
 }
-async function captureOutput(command, args, timeoutMs = 3e4) {
+async function captureOutput(command, args, timeoutMs = 3e4, options = {}) {
   return new Promise((resolve6) => {
-    const child = spawn5(command, [...args], {
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true
-    });
+    const previousUmask = options.umask !== void 0 && process.platform !== "win32" ? process.umask(options.umask) : void 0;
+    const child = (() => {
+      try {
+        return spawn5(command, [...args], {
+          stdio: ["ignore", "pipe", "pipe"],
+          windowsHide: true,
+          ...options.cwd ? { cwd: options.cwd } : {},
+          ...options.env ? { env: options.env } : {}
+        });
+      } finally {
+        if (previousUmask !== void 0) process.umask(previousUmask);
+      }
+    })();
     let stdout = "";
     let stderr = "";
     child.stdout?.on("data", (chunk) => {
@@ -934,6 +1000,47 @@ async function findProfileProcess(dshProfile) {
   const processes = await listProcesses();
   return processes.find((entry) => matchProfileProcess(entry.cmdline, dshProfile));
 }
+async function managedGuardianPid(platform, run, uid) {
+  let result;
+  if (platform === "linux") {
+    result = await run(
+      "systemctl",
+      ["--user", "show", "dsh-lark-guardian.service", "--property=MainPID", "--value"],
+      1e4
+    );
+  } else if (platform === "darwin") {
+    result = await run(
+      "launchctl",
+      ["print", `gui/${uid}/io.dsh-lark.dsh-lark-guardian`],
+      1e4
+    );
+  } else {
+    return void 0;
+  }
+  if (result.code !== 0) return void 0;
+  const raw = platform === "darwin" ? /(?:^|\n)\s*pid\s*=\s*(\d+)\s*(?:\n|$)/u.exec(result.stdout)?.[1] : /^(\d+)\s*$/u.exec(result.stdout.trim())?.[1];
+  const pid = Number(raw);
+  return Number.isInteger(pid) && pid > 0 ? pid : void 0;
+}
+async function findGuardianProcess(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const run = options.run ?? captureOutput;
+  const isAlive = options.isAlive ?? isProcessAlive;
+  const currentPid = options.currentPid ?? process.pid;
+  const candidates = (await listProcesses(platform, run)).filter(
+    (entry) => entry.pid !== currentPid && matchGuardianProcess(entry.cmdline) && isAlive(entry.pid)
+  );
+  if (candidates.length !== 1) return void 0;
+  const candidate = candidates[0];
+  if (candidate === void 0) return void 0;
+  const servicePid = await managedGuardianPid(
+    platform,
+    run,
+    options.uid ?? process.getuid?.() ?? 0
+  );
+  if (servicePid !== void 0 && servicePid !== candidate.pid) return void 0;
+  return isAlive(candidate.pid) ? candidate : void 0;
+}
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -997,9 +1104,9 @@ async function writeFileAtomic(target, data, options = {}) {
   }
 }
 async function rmSilently(path) {
-  const { rm: rm12 } = await import("fs/promises");
+  const { rm: rm13 } = await import("fs/promises");
   try {
-    await rm12(path, { force: true });
+    await rm13(path, { force: true });
   } catch {
   }
 }
@@ -17059,12 +17166,36 @@ function buildSecretHandler(deps) {
 init_own_package();
 
 // src/guardian/update-handoff.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID13 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { mkdir as mkdir21, readFile as readFile31 } from "fs/promises";
+import { chmod, mkdir as mkdir21, readFile as readFile31, rm as rm10 } from "fs/promises";
 import { dirname as dirname16, join as join26 } from "path";
 init_own_package();
 init_process();
+function guardianUpdateFailureHint(code) {
+  switch (code) {
+    case "filesystem-access":
+      return {
+        zh: "\u66F4\u65B0\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u53EF\u8BBF\u95EE\uFF1B\u8BF7\u53D1\u9001 `/doctor` \u68C0\u67E5\u6587\u4EF6\u6743\u9650\u540E\u91CD\u8BD5\u3002",
+        en: "The private update workspace is inaccessible. Send `/doctor` to check file permissions, then retry."
+      };
+    case "registry-unavailable":
+      return {
+        zh: "\u65E0\u6CD5\u8FDE\u63A5 npm \u6B63\u5F0F\u6E90\uFF1B\u8BF7\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5\u3002",
+        en: "The npm registry is unreachable. Check the network, then retry."
+      };
+    case "bootstrap-unavailable":
+      return {
+        zh: "\u65E0\u6CD5\u542F\u52A8 npm/npx\uFF1B\u8BF7\u53D1\u9001 `/doctor` \u68C0\u67E5 Node.js \u4E0E npm\u3002",
+        en: "npm/npx could not start. Send `/doctor` to check Node.js and npm."
+      };
+    default:
+      return {
+        zh: "\u5347\u7EA7\u547D\u4EE4\u672A\u5B8C\u6210\uFF1B\u8BF7\u53D1\u9001 `/doctor` \u68C0\u67E5\u540E\u91CD\u8BD5\u3002",
+        en: "The upgrade command did not complete. Send `/doctor`, then retry."
+      };
+  }
+}
 async function loadState(file) {
   try {
     const parsed = JSON.parse(await readFile31(file, "utf8"));
@@ -17085,6 +17216,36 @@ function validPackageName(value) {
 function validVersion(value) {
   return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value);
 }
+async function ensurePrivateDirectory(path) {
+  await mkdir21(path, { recursive: true, mode: 448 });
+  if (process.platform !== "win32") await chmod(path, 448);
+}
+function classifyWorkerFailure(code, stdout, stderr) {
+  const output = `${stderr}
+${stdout}`;
+  if (/\b(?:EACCES|EPERM)\b|permission denied|access is denied/iu.test(output)) {
+    return {
+      errorCode: "filesystem-access",
+      error: "upgrade worker could not access its private working files"
+    };
+  }
+  if (/\b(?:ENOTFOUND|EAI_AGAIN|ECONNREFUSED|ETIMEDOUT)\b|registry unavailable/iu.test(output)) {
+    return {
+      errorCode: "registry-unavailable",
+      error: "upgrade worker could not reach the npm registry"
+    };
+  }
+  if (/\bENOENT\b|not found|not recognized/iu.test(output)) {
+    return {
+      errorCode: "bootstrap-unavailable",
+      error: "upgrade worker could not start the npm bootstrap command"
+    };
+  }
+  return {
+    errorCode: "upgrade-failed",
+    error: `upgrade worker exited with code ${code}`
+  };
+}
 async function defaultLaunch(request) {
   const cliPath = join26(ownPackageInfo().root, "dist", "cli.js");
   await new Promise((resolve6, reject) => {
@@ -17120,23 +17281,48 @@ async function runGuardianUpdateWorker(request, options = {}) {
   if (delayMs > 0) await new Promise((resolve6) => setTimeout(resolve6, delayMs));
   const spec = `${state.packageName}@${state.targetVersion}`;
   const run = options.run ?? captureOutput;
-  const result = await run(
-    process.platform === "win32" ? "npx.cmd" : "npx",
-    [
-      "--yes",
-      "--registry",
-      defaultRegistryUrl(),
-      spec,
-      "upgrade",
-      "--profile",
-      state.dshProfile,
-      "--yes",
-      "--restart",
-      "--package",
-      spec
-    ],
-    30 * 6e4
+  const workerRoot = join26(dirname16(request.stateFile), "update-worker");
+  const cacheRoot = join26(workerRoot, "npm-cache");
+  const cacheDir = join26(
+    cacheRoot,
+    createHash3("sha256").update(state.id).digest("hex")
   );
+  const cwd = join26(workerRoot, "cwd");
+  let result;
+  try {
+    await ensurePrivateDirectory(workerRoot);
+    await rm10(cacheRoot, { recursive: true, force: true });
+    await rm10(cwd, { recursive: true, force: true });
+    await ensurePrivateDirectory(cacheRoot);
+    await ensurePrivateDirectory(cacheDir);
+    await ensurePrivateDirectory(cwd);
+    result = await run(
+      process.platform === "win32" ? "npx.cmd" : "npx",
+      [
+        "--yes",
+        "--cache",
+        cacheDir,
+        "--registry",
+        defaultRegistryUrl(),
+        spec,
+        "upgrade",
+        "--profile",
+        state.dshProfile,
+        "--yes",
+        "--restart",
+        "--package",
+        spec
+      ],
+      30 * 6e4,
+      { cwd, umask: 63 }
+    );
+  } catch (error) {
+    result = {
+      code: 1,
+      stdout: "",
+      stderr: error instanceof Error ? `${error.name}: ${error.message}` : "unknown worker failure"
+    };
+  }
   const latest = await loadState(request.stateFile);
   if (!latest || latest.id !== request.id) return;
   if (latest.status === "succeeded") return;
@@ -17145,7 +17331,7 @@ async function runGuardianUpdateWorker(request, options = {}) {
     status: result.code === 0 ? "succeeded" : "failed",
     finishedAt: (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
     delivered: false,
-    ...result.code === 0 ? {} : { error: `upgrade worker exited with code ${result.code}` }
+    ...result.code === 0 ? {} : classifyWorkerFailure(result.code, result.stdout, result.stderr)
   };
   await saveState(request.stateFile, finished);
 }
@@ -17913,12 +18099,13 @@ async function startBridgeEngine(options) {
   const deliverUpdateResult = async () => {
     await updateHandoff.deliverResult(async (state) => {
       if (!streaming) throw new Error("channel is not ready");
+      const failureHint = guardianUpdateFailureHint(state.errorCode);
       const markdown2 = state.status === "succeeded" ? bilingualMarkdown(
         `\u2705 dsh-lark-bot \u5DF2\u66F4\u65B0\u5230 \`${state.targetVersion}\`\uFF0C\u673A\u5668\u4EBA\u5DF2\u5B8C\u6210\u91CD\u8F7D\u3002`,
         `\u2705 dsh-lark-bot was updated to \`${state.targetVersion}\` and reloaded.`
       ) : bilingualMarkdown(
-        `\u26A0\uFE0F dsh-lark-bot \u66F4\u65B0\u5230 \`${state.targetVersion}\` \u5931\u8D25\u3002\u8BF7\u91CD\u65B0\u53D1\u9001 \`/upgrade\`\uFF1B\u5982\u4ECD\u5931\u8D25\uFF0C\u53D1\u9001 \`/doctor\` \u68C0\u67E5\u3002`,
-        `\u26A0\uFE0F Failed to update dsh-lark-bot to \`${state.targetVersion}\`. Send \`/upgrade\` to retry, or \`/doctor\` if it still fails.`
+        `\u26A0\uFE0F dsh-lark-bot \u66F4\u65B0\u5230 \`${state.targetVersion}\` \u5931\u8D25\u3002${failureHint.zh}`,
+        `\u26A0\uFE0F Failed to update dsh-lark-bot to \`${state.targetVersion}\`. ${failureHint.en}`
       );
       await streaming.sendMarkdown(state.route.chatId, markdown2, {
         ...state.route.threadId ? { threadId: state.route.threadId } : {}
@@ -18310,11 +18497,11 @@ async function restartProfileProcess(profile, options = {}) {
 // src/upgrade/runtime.ts
 init_own_package();
 import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { mkdir as mkdir24, rm as rm10, symlink } from "fs/promises";
+import { mkdir as mkdir24, rm as rm11, symlink } from "fs/promises";
 import { join as join29 } from "path";
 init_acp_runtime();
 async function defaultRelink(linkPath, target) {
-  await rm10(linkPath, { recursive: true, force: true });
+  await rm11(linkPath, { recursive: true, force: true });
   await mkdir24(join29(linkPath, ".."), { recursive: true });
   await symlink(target, linkPath, process.platform === "win32" ? "junction" : "dir");
 }
@@ -20055,7 +20242,7 @@ async function uninstallGuardianCommand(options = {}) {
   const result = await uninstallGuardian({ env });
   printResult(result);
 }
-async function statusGuardianCommand(options = {}) {
+async function statusGuardianCommand(options = {}, deps = {}) {
   const env = envWithOverrides(options);
   const paths = resolveAppPaths(env.home);
   const fallback = newGuardianState({
@@ -20066,6 +20253,7 @@ async function statusGuardianCommand(options = {}) {
   const layout = guardianLayoutFor(env, state.bridgeProfile);
   const heartbeat = await readHeartbeat(layout.heartbeatFile);
   const processFound = await findProfileProcess(state.dshProfile);
+  const guardianProcess = await (deps.findGuardianProcess ?? findGuardianProcess)();
   const up = isHeartbeatFresh(heartbeat, env.guardianStaleMs) || processFound !== void 0;
   printLines([
     "\u5B89\u5168\u7F51\u5B88\u62A4\u72B6\u6001",
@@ -20077,7 +20265,7 @@ async function statusGuardianCommand(options = {}) {
     `dsh \u662F\u5426\u5728\u7EBF\uFF1A${up ? "\u662F" : "\u5426"}${processFound ? `\uFF08pid ${processFound.pid}\uFF09` : ""}`,
     `\u5FC3\u8DF3\u9F84\uFF1A${heartbeat ? `${heartbeatAgeMs(heartbeat)}ms` : "\u65E0"}`,
     `\u5DF2\u89C2\u5BDF\u8FC7 dsh \u8FD0\u884C\uFF1A${state.profileSeenUp ? "\u662F" : "\u5426"}`,
-    "\u5B88\u62A4\u8FDB\u7A0B pid\uFF1A\u672A\u53D1\u73B0\uFF08\u72B6\u6001\u547D\u4EE4\u4E0D\u4F1A\u628A\u81EA\u8EAB PID \u5192\u5145\u4E3A\u5B88\u62A4\u8FDB\u7A0B\uFF09",
+    guardianProcess === void 0 ? "\u5B88\u62A4\u8FDB\u7A0B pid\uFF1A\u672A\u53D1\u73B0\uFF08\u65E0\u6CD5\u552F\u4E00\u8BC1\u660E resident guardian \u8EAB\u4EFD\uFF09" : `\u5B88\u62A4\u8FDB\u7A0B pid\uFF1A${guardianProcess.pid}`,
     `\u72B6\u6001\u6587\u4EF6\uFF1A${layout.stateFile}`,
     `\u5FC3\u8DF3\u6587\u4EF6\uFF1A${layout.heartbeatFile}`
   ]);
@@ -20320,7 +20508,7 @@ async function runServiceRuntime(options = {}, deps = {}) {
 // src/cli/commands/bot.ts
 init_dsh_runtime();
 import { homedir as homedir24 } from "os";
-import { rm as rm11 } from "fs/promises";
+import { rm as rm12 } from "fs/promises";
 import { join as join34 } from "path";
 async function runBotCommand(action, options = {}, deps = {}) {
   const output = deps.output ?? ((text) => process.stdout.write(text));
@@ -20379,7 +20567,7 @@ ${rows.join("\n")}
       current.dshProfile,
       instanceEnv(sourceEnv, name, current.dshHome)
     ).uninstall();
-    await rm11(join34(paths.botDshHome(name), ".credentials.yaml"), { force: true });
+    await rm12(join34(paths.botDshHome(name), ".credentials.yaml"), { force: true });
     await configs.removeProfile(current.bridgeProfile);
     await fleet.remove(name);
     output(
@@ -20416,7 +20604,7 @@ ${rows.join("\n")}
   } catch (error) {
     try {
       await service.uninstall();
-      await rm11(join34(dshHome, ".credentials.yaml"), { force: true });
+      await rm12(join34(dshHome, ".credentials.yaml"), { force: true });
       await fleet.remove(name);
       await configs.removeProfile(name);
     } catch (cleanupError) {