dsh-lark-bot 0.19.2 → 0.19.4

package/README.md

@@ -334,7 +334,7 @@ profile 的前台进程会拒绝并提示先停止，生命周期锁阻止并发
 
 ### 升级
 
-**完全不接触命令行：** profile 管理员在飞书发送 `/upgrade`。有新版本时 bot 弹出只允许发起人操作的确认卡；点击“确认更新”后，Guardian 通过独立 worker 安装卡片中确认的精确 npm 版本，复用完整升级、runtime profile 修复、guardian/profile 重启和 doctor 验证链，并在重载后回到原会话报告结果。点击“取消”不会产生任何变更。更新会重启机器人，正在执行的任务可能被中断；配置、会话、归档和凭据保持不变。每次 `/new` / `/reset` 都会 best-effort 查询一次 npm；仅在有新版本时额外发送一条简短普通消息。
+**完全不接触命令行：** profile 管理员在飞书发送 `/upgrade`。有新版本时 bot 弹出只允许发起人操作的确认卡；点击“确认更新”后，Guardian 通过独立 worker 安装卡片中确认的精确 npm 版本，复用完整升级、runtime profile 修复、guardian/profile 重启和 doctor 验证链，并在重载后回到原会话报告结果。worker 使用 owner-only 中立工作目录与每次请求隔离的 npm cache，不依赖 bridge 启动目录或用户全局 npm cache；失败时只回传脱敏的可行动类别，不发送原始命令输出。点击“取消”不会产生任何变更。更新会重启机器人，正在执行的任务可能被中断；配置、会话、归档和凭据保持不变。每次 `/new` / `/reset` 都会 best-effort 查询一次 npm；仅在有新版本时额外发送一条简短普通消息。
 
 **推荐：一行命令彻底升级（v0.12.0+ 新增，issue #10）**
 
@@ -724,6 +724,8 @@ pnpm publish:dual
 默认安装的「安全网守护」（`src/guardian/`）独立于 dsh 进程常驻：dsh 在线时静默，下线时接管飞书
 通道接收 `/safemode` 控制信号，以仅核心 profile（`dsh-base` + `dsh-headless`）拉起受限对话
 用于自愈，`/safemode exit` 重启完整 profile 并交还通道。
+`dsh-lark-bot guardian status` 只报告精确 `guardian run` 进程身份唯一且存活的常驻 PID，并在
+系统服务 PID 可用时交叉验证；身份不确定时显示“未发现”，不会把查询命令自身 PID 当成守护进程。
 
 ## 目录结构
 

package/dist/cli.js

@@ -838,14 +838,67 @@ var init_acp_adapter = __esm({
 var process_exports = {};
 __export(process_exports, {
   captureOutput: () => captureOutput,
+  findGuardianProcess: () => findGuardianProcess,
   findProfileProcess: () => findProfileProcess,
   isProcessAlive: () => isProcessAlive,
   listProcesses: () => listProcesses,
   looksLikeDshProcess: () => looksLikeDshProcess,
+  matchGuardianProcess: () => matchGuardianProcess,
   matchProfileProcess: () => matchProfileProcess,
   spawnDetached: () => spawnDetached
 });
 import { spawn as spawn5 } from "child_process";
+function commandTokens(cmdline) {
+  const tokens = [];
+  let token = "";
+  let quote;
+  const input = cmdline.trim();
+  for (let index = 0; index < input.length; index += 1) {
+    const character = input[index] ?? "";
+    const next = input[index + 1];
+    if (character === "\\" && quote === void 0 && next !== void 0 && /[\s\\"']/u.test(next)) {
+      token += next;
+      index += 1;
+    } else if (character === "\\" && quote === '"' && next === '"') {
+      token += next;
+      index += 1;
+    } else if (quote !== void 0) {
+      if (character === quote) quote = void 0;
+      else token += character;
+    } else if (character === '"' || character === "'") {
+      quote = character;
+    } else if (/\s/u.test(character)) {
+      if (token !== "") {
+        tokens.push(token);
+        token = "";
+      }
+    } else {
+      token += character;
+    }
+  }
+  if (token !== "") tokens.push(token);
+  return tokens;
+}
+function isGuardianCliEntry(token) {
+  const normalized = token.replace(/\\/gu, "/").toLowerCase();
+  return normalized.endsWith("/dist/cli.js") && (normalized.includes("/dsh-lark-bot/") || normalized.includes("/dsh-feishu-bot/"));
+}
+function hasOnlyGuardianRunOptions(tokens) {
+  for (let index = 0; index < tokens.length; index += 2) {
+    if (tokens[index] !== "--dsh-profile" && tokens[index] !== "--bridge-profile") return false;
+    if (tokens[index + 1] === void 0 || tokens[index + 1]?.startsWith("--")) return false;
+  }
+  return true;
+}
+function matchGuardianProcess(cmdline) {
+  const tokens = commandTokens(cmdline);
+  const cliIndex = tokens.findIndex(isGuardianCliEntry);
+  if (cliIndex < 1) return false;
+  const executable = tokens[cliIndex - 1]?.replace(/\\/gu, "/").split("/").pop()?.toLowerCase();
+  if (executable !== "node" && executable !== "node.exe") return false;
+  if (tokens[cliIndex + 1] !== "guardian" || tokens[cliIndex + 2] !== "run") return false;
+  return hasOnlyGuardianRunOptions(tokens.slice(cliIndex + 3));
+}
 function hasProfileFlag(cmdline, dshProfile) {
   const pattern = new RegExp(
     `(?:^|\\s)--profile(?:\\s+|=)${escapeRegExp(dshProfile)}(?:\\s|$)`
@@ -865,14 +918,14 @@ function matchProfileProcess(cmdline, dshProfile) {
   if (/(?:^|\s)plugin(?:\s|$)/.test(cmdline)) return false;
   return hasProfileFlag(cmdline, dshProfile) && looksLikeDshProcess(cmdline);
 }
-async function listProcesses() {
-  if (process.platform === "win32") {
-    return listProcessesWindows();
+async function listProcesses(platform = process.platform, run = captureOutput) {
+  if (platform === "win32") {
+    return listProcessesWindows(run);
   }
-  return listProcessesPosix();
+  return listProcessesPosix(run);
 }
-async function listProcessesPosix() {
-  const { stdout } = await captureOutput("ps", ["-axo", "pid=,args="], 1e4);
+async function listProcessesPosix(run) {
+  const { stdout } = await run("ps", ["-axo", "pid=,args="], 1e4);
   const result = [];
   for (const line of stdout.split("\n")) {
     const match = /^\s*(\d+)\s+(.+)$/.exec(line);
@@ -882,33 +935,46 @@ async function listProcessesPosix() {
   }
   return result;
 }
-async function listProcessesWindows() {
-  const { stdout } = await captureOutput(
+async function listProcessesWindows(run) {
+  const { stdout } = await run(
     "powershell.exe",
     [
       "-NoProfile",
       "-NonInteractive",
       "-Command",
-      "Get-CimInstance Win32_Process | Select-Object ProcessId, CommandLine | ConvertTo-Csv -NoTypeInformation"
+      "Get-CimInstance Win32_Process | Select-Object ProcessId, CommandLine | ConvertTo-Json -Compress"
     ],
     1e4
   );
-  const result = [];
-  for (const line of stdout.split("\n").slice(1)) {
-    const [pid, ...rest] = line.trim().split(",");
-    const numeric = Number(pid?.replace(/"/g, ""));
-    if (Number.isInteger(numeric) && rest.length > 0) {
-      result.push({ pid: numeric, cmdline: rest.join(",").replace(/^"|"$/g, "") });
-    }
+  try {
+    const parsed = JSON.parse(stdout);
+    const rows = Array.isArray(parsed) ? parsed : [parsed];
+    return rows.flatMap((row) => {
+      if (typeof row !== "object" || row === null) return [];
+      const record = row;
+      const pid = Number(record.ProcessId);
+      const cmdline = record.CommandLine;
+      return Number.isInteger(pid) && pid > 0 && typeof cmdline === "string" ? [{ pid, cmdline }] : [];
+    });
+  } catch {
+    return [];
   }
-  return result;
 }
-async function captureOutput(command, args, timeoutMs = 3e4) {
+async function captureOutput(command, args, timeoutMs = 3e4, options = {}) {
   return new Promise((resolve6) => {
-    const child = spawn5(command, [...args], {
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true
-    });
+    const previousUmask = options.umask !== void 0 && process.platform !== "win32" ? process.umask(options.umask) : void 0;
+    const child = (() => {
+      try {
+        return spawn5(command, [...args], {
+          stdio: ["ignore", "pipe", "pipe"],
+          windowsHide: true,
+          ...options.cwd ? { cwd: options.cwd } : {},
+          ...options.env ? { env: options.env } : {}
+        });
+      } finally {
+        if (previousUmask !== void 0) process.umask(previousUmask);
+      }
+    })();
     let stdout = "";
     let stderr = "";
     child.stdout?.on("data", (chunk) => {
@@ -934,6 +1000,47 @@ async function findProfileProcess(dshProfile) {
   const processes = await listProcesses();
   return processes.find((entry) => matchProfileProcess(entry.cmdline, dshProfile));
 }
+async function managedGuardianPid(platform, run, uid) {
+  let result;
+  if (platform === "linux") {
+    result = await run(
+      "systemctl",
+      ["--user", "show", "dsh-lark-guardian.service", "--property=MainPID", "--value"],
+      1e4
+    );
+  } else if (platform === "darwin") {
+    result = await run(
+      "launchctl",
+      ["print", `gui/${uid}/io.dsh-lark.dsh-lark-guardian`],
+      1e4
+    );
+  } else {
+    return void 0;
+  }
+  if (result.code !== 0) return void 0;
+  const raw = platform === "darwin" ? /(?:^|\n)\s*pid\s*=\s*(\d+)\s*(?:\n|$)/u.exec(result.stdout)?.[1] : /^(\d+)\s*$/u.exec(result.stdout.trim())?.[1];
+  const pid = Number(raw);
+  return Number.isInteger(pid) && pid > 0 ? pid : void 0;
+}
+async function findGuardianProcess(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const run = options.run ?? captureOutput;
+  const isAlive = options.isAlive ?? isProcessAlive;
+  const currentPid = options.currentPid ?? process.pid;
+  const candidates = (await listProcesses(platform, run)).filter(
+    (entry) => entry.pid !== currentPid && matchGuardianProcess(entry.cmdline) && isAlive(entry.pid)
+  );
+  if (candidates.length !== 1) return void 0;
+  const candidate = candidates[0];
+  if (candidate === void 0) return void 0;
+  const servicePid = await managedGuardianPid(
+    platform,
+    run,
+    options.uid ?? process.getuid?.() ?? 0
+  );
+  if (servicePid !== void 0 && servicePid !== candidate.pid) return void 0;
+  return isAlive(candidate.pid) ? candidate : void 0;
+}
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -997,9 +1104,9 @@ async function writeFileAtomic(target, data, options = {}) {
   }
 }
 async function rmSilently(path) {
-  const { rm: rm12 } = await import("fs/promises");
+  const { rm: rm13 } = await import("fs/promises");
   try {
-    await rm12(path, { force: true });
+    await rm13(path, { force: true });
   } catch {
   }
 }
@@ -2672,6 +2779,18 @@ function patchYamlFor(options) {
     "",
     "- id: hmr",
     "  disabled: true",
+    "",
+    // Model-invocable channel skill: expose the dsh-lark-bot operations guide
+    // to THIS agent session's skill catalog — the one the `skill` tool reads.
+    // The bridge engine registers the same skill on its own cordis context
+    // (plugin.ts), but that context is never the one the model reads. This row
+    // ensures the skill also lands on the agent runtime's context so that
+    // `skill("dsh-lark-bot")` resolves in a live SDK session. It is kept
+    // outside the bridgeTools gate because it needs no callback endpoint and
+    // is also useful to the guardian's core-only safe profile.
+    "- insert:",
+    "    - id: lark-skill",
+    `      name: '${own.name}/skill'`,
     ""
   ];
   if (bridgeTools) {
@@ -7207,7 +7326,11 @@ function processElements(state, locale, maxTools) {
 function thinkingPanel(state, locale, maxTools) {
   return {
     tag: "collapsible_panel",
-    expanded: state.terminal === "running",
+    // Default to collapsed: the top-level compatibility snapshot already shows
+    // the latest status and current tools, so keep the detailed per-tool list
+    // collapsed to avoid two overlapping expanded surfaces. (Both sections are
+    // retained for now.)
+    expanded: false,
     header: {
       title: { tag: "plain_text", content: `\u2699\uFE0F ${locale === "zh_cn" ? "\u6267\u884C\u8FC7\u7A0B" : "Execution"} \xB7 ${summaryText(state, locale)}` },
       icon: { tag: "standard_icon", token: "down-small-ccm_outlined" },
@@ -7893,6 +8016,15 @@ async function runAttempt(input, cwd, workspaceCwd, sessionId, resuming, replyOp
           log.warn("run-flow", "card-update-failed", { scope: input.scope, error });
         }
       };
+      const unregisterReanchor = input.runCardAnchors?.register(input.chatId, async () => {
+        if (state.terminal !== "running") return;
+        try {
+          await controller.update(renderer(state, density, Date.now()));
+          if (typeof controller.reanchor === "function") await controller.reanchor();
+        } catch (error) {
+          log.warn("run-flow", "card-reanchor-failed", { scope: input.scope, error });
+        }
+      });
       const showResumeRecovery = async (error) => {
         if (classifySessionError(errorMessage(error)) === void 0) throw error;
         resumeFailure = errorMessage(error);
@@ -8066,6 +8198,7 @@ async function runAttempt(input, cwd, workspaceCwd, sessionId, resuming, replyOp
         unsubscribeQuestion?.();
         unsubscribePlan?.();
         unsubscribeApproval?.();
+        unregisterReanchor?.();
       }
     };
     let producerStarted = false;
@@ -11797,6 +11930,41 @@ var ResilientCardStreamController = class {
       });
     }
   }
+  /**
+   * Recall the current card and re-create it as the newest top-level message in
+   * the chat, rebinding the controller to the fresh message id. Because Feishu
+   * cannot reorder an existing message, this is the only way to keep an
+   * in-progress process card visible at the tail while interim agent bubbles are
+   * appended below. Best-effort: if the recall fails the card is left where it
+   * is (no duplicate is created); if the controller is closed or failed the id
+   * is left unchanged.
+   */
+  async reanchor() {
+    if (this.closed || this.failed) return this.messageId;
+    if (this.inFlight !== void 0) await this.inFlight;
+    if (this.timer !== void 0) {
+      clearTimeout(this.timer);
+      this.timer = void 0;
+    }
+    const card = this.latest;
+    if (card === void 0) return this.messageId;
+    try {
+      await this.channel.recallMessage(this.messageId);
+    } catch (error) {
+      log.warn("lark-card-stream", "reanchor-recall-failed", {
+        messageId: this.messageId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return this.messageId;
+    }
+    const sent = await this.channel.send(this.chatId, { card }, {});
+    if (!sent.messageId) throw new Error("Feishu card re-anchor returned no message_id");
+    this.messageId = sent.messageId;
+    this.latest = card;
+    this.dirty = false;
+    this.failed = false;
+    return this.messageId;
+  }
 };
 function adaptLarkChannel(channel) {
   const base = {
@@ -14040,6 +14208,63 @@ function wizardContextFor(event, deps, channel, scope) {
   };
 }
 
+// src/bridge/run-card-anchors.ts
+var RunCardAnchors = class {
+  byChatId = /* @__PURE__ */ new Map();
+  /**
+   * Register a re-anchor callback for a chat. Returns a disposer; safe to call
+   * more than once (idempotent).
+   */
+  register(chatId, reanchor) {
+    const set = this.byChatId.get(chatId) ?? /* @__PURE__ */ new Set();
+    set.add(reanchor);
+    this.byChatId.set(chatId, set);
+    let active = true;
+    return () => {
+      if (!active) return;
+      active = false;
+      set.delete(reanchor);
+      if (set.size === 0) this.byChatId.delete(chatId);
+    };
+  }
+  /** Notify that a new bubble was delivered to the chat. */
+  async bubbleSent(chatId) {
+    const set = this.byChatId.get(chatId);
+    if (!set || set.size === 0) return;
+    await Promise.allSettled([...set].map((reanchor) => reanchor()));
+  }
+};
+function attachRunCardAnchors(channel, anchors) {
+  const notify = (chatId) => {
+    void anchors.bubbleSent(chatId).catch((error) => {
+      log.warn("run-card-anchors", "bubble-sent-failed", {
+        chatId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+  };
+  return {
+    ...channel,
+    async sendMarkdown(chatId, markdown2, options) {
+      const result = await channel.sendMarkdown(chatId, markdown2, options);
+      notify(chatId);
+      return result;
+    },
+    async sendCard(chatId, card, options) {
+      if (typeof channel.sendCard !== "function") return void 0;
+      const result = await channel.sendCard(chatId, card, options);
+      notify(chatId);
+      return result;
+    },
+    async sendFile(chatId, fileName, content, options) {
+      if (typeof channel.sendFile !== "function") return void 0;
+      const result = await channel.sendFile(chatId, fileName, content, options);
+      notify(chatId);
+      return result;
+    }
+  };
+}
+
 // src/notify/server.ts
 import { createServer } from "http";
 import { randomBytes as randomBytes2 } from "crypto";
@@ -17059,12 +17284,36 @@ function buildSecretHandler(deps) {
 init_own_package();
 
 // src/guardian/update-handoff.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID13 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { mkdir as mkdir21, readFile as readFile31 } from "fs/promises";
+import { chmod, mkdir as mkdir21, readFile as readFile31, rm as rm10 } from "fs/promises";
 import { dirname as dirname16, join as join26 } from "path";
 init_own_package();
 init_process();
+function guardianUpdateFailureHint(code) {
+  switch (code) {
+    case "filesystem-access":
+      return {
+        zh: "\u66F4\u65B0\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u53EF\u8BBF\u95EE\uFF1B\u8BF7\u53D1\u9001 `/doctor` \u68C0\u67E5\u6587\u4EF6\u6743\u9650\u540E\u91CD\u8BD5\u3002",
+        en: "The private update workspace is inaccessible. Send `/doctor` to check file permissions, then retry."
+      };
+    case "registry-unavailable":
+      return {
+        zh: "\u65E0\u6CD5\u8FDE\u63A5 npm \u6B63\u5F0F\u6E90\uFF1B\u8BF7\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5\u3002",
+        en: "The npm registry is unreachable. Check the network, then retry."
+      };
+    case "bootstrap-unavailable":
+      return {
+        zh: "\u65E0\u6CD5\u542F\u52A8 npm/npx\uFF1B\u8BF7\u53D1\u9001 `/doctor` \u68C0\u67E5 Node.js \u4E0E npm\u3002",
+        en: "npm/npx could not start. Send `/doctor` to check Node.js and npm."
+      };
+    default:
+      return {
+        zh: "\u5347\u7EA7\u547D\u4EE4\u672A\u5B8C\u6210\uFF1B\u8BF7\u53D1\u9001 `/doctor` \u68C0\u67E5\u540E\u91CD\u8BD5\u3002",
+        en: "The upgrade command did not complete. Send `/doctor`, then retry."
+      };
+  }
+}
 async function loadState(file) {
   try {
     const parsed = JSON.parse(await readFile31(file, "utf8"));
@@ -17085,6 +17334,36 @@ function validPackageName(value) {
 function validVersion(value) {
   return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value);
 }
+async function ensurePrivateDirectory(path) {
+  await mkdir21(path, { recursive: true, mode: 448 });
+  if (process.platform !== "win32") await chmod(path, 448);
+}
+function classifyWorkerFailure(code, stdout, stderr) {
+  const output = `${stderr}
+${stdout}`;
+  if (/\b(?:EACCES|EPERM)\b|permission denied|access is denied/iu.test(output)) {
+    return {
+      errorCode: "filesystem-access",
+      error: "upgrade worker could not access its private working files"
+    };
+  }
+  if (/\b(?:ENOTFOUND|EAI_AGAIN|ECONNREFUSED|ETIMEDOUT)\b|registry unavailable/iu.test(output)) {
+    return {
+      errorCode: "registry-unavailable",
+      error: "upgrade worker could not reach the npm registry"
+    };
+  }
+  if (/\bENOENT\b|not found|not recognized/iu.test(output)) {
+    return {
+      errorCode: "bootstrap-unavailable",
+      error: "upgrade worker could not start the npm bootstrap command"
+    };
+  }
+  return {
+    errorCode: "upgrade-failed",
+    error: `upgrade worker exited with code ${code}`
+  };
+}
 async function defaultLaunch(request) {
   const cliPath = join26(ownPackageInfo().root, "dist", "cli.js");
   await new Promise((resolve6, reject) => {
@@ -17120,23 +17399,48 @@ async function runGuardianUpdateWorker(request, options = {}) {
   if (delayMs > 0) await new Promise((resolve6) => setTimeout(resolve6, delayMs));
   const spec = `${state.packageName}@${state.targetVersion}`;
   const run = options.run ?? captureOutput;
-  const result = await run(
-    process.platform === "win32" ? "npx.cmd" : "npx",
-    [
-      "--yes",
-      "--registry",
-      defaultRegistryUrl(),
-      spec,
-      "upgrade",
-      "--profile",
-      state.dshProfile,
-      "--yes",
-      "--restart",
-      "--package",
-      spec
-    ],
-    30 * 6e4
+  const workerRoot = join26(dirname16(request.stateFile), "update-worker");
+  const cacheRoot = join26(workerRoot, "npm-cache");
+  const cacheDir = join26(
+    cacheRoot,
+    createHash3("sha256").update(state.id).digest("hex")
   );
+  const cwd = join26(workerRoot, "cwd");
+  let result;
+  try {
+    await ensurePrivateDirectory(workerRoot);
+    await rm10(cacheRoot, { recursive: true, force: true });
+    await rm10(cwd, { recursive: true, force: true });
+    await ensurePrivateDirectory(cacheRoot);
+    await ensurePrivateDirectory(cacheDir);
+    await ensurePrivateDirectory(cwd);
+    result = await run(
+      process.platform === "win32" ? "npx.cmd" : "npx",
+      [
+        "--yes",
+        "--cache",
+        cacheDir,
+        "--registry",
+        defaultRegistryUrl(),
+        spec,
+        "upgrade",
+        "--profile",
+        state.dshProfile,
+        "--yes",
+        "--restart",
+        "--package",
+        spec
+      ],
+      30 * 6e4,
+      { cwd, umask: 63 }
+    );
+  } catch (error) {
+    result = {
+      code: 1,
+      stdout: "",
+      stderr: error instanceof Error ? `${error.name}: ${error.message}` : "unknown worker failure"
+    };
+  }
   const latest = await loadState(request.stateFile);
   if (!latest || latest.id !== request.id) return;
   if (latest.status === "succeeded") return;
@@ -17145,7 +17449,7 @@ async function runGuardianUpdateWorker(request, options = {}) {
     status: result.code === 0 ? "succeeded" : "failed",
     finishedAt: (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
     delivered: false,
-    ...result.code === 0 ? {} : { error: `upgrade worker exited with code ${result.code}` }
+    ...result.code === 0 ? {} : classifyWorkerFailure(result.code, result.stdout, result.stderr)
   };
   await saveState(request.stateFile, finished);
 }
@@ -17476,6 +17780,7 @@ async function startBridgeEngine(options) {
   const questions = new QuestionRegistry();
   const plans = new PlanApprovalRegistry();
   const densityStore = new DensityStore();
+  const runCardAnchors = new RunCardAnchors();
   const models = new ModelStore();
   const wizardStore = new WizardStore();
   const dshConfig = new DshProviderManager({ env: process.env });
@@ -17706,6 +18011,7 @@ async function startBridgeEngine(options) {
           plans,
           densityStore,
           channel: streaming,
+          runCardAnchors,
           defaultWorkspace,
           replyTo: first.messageId,
           deliverFinalReply: (replyScope, chatId, markdown2, options2) => replyDispatcher.deliver(replyScope, chatId, markdown2, options2),
@@ -17908,17 +18214,18 @@ async function startBridgeEngine(options) {
       error: "channel does not expose getBotIdentity"
     });
   }
-  streaming = adaptLarkChannel(bridge.channel);
+  streaming = attachRunCardAnchors(adaptLarkChannel(bridge.channel), runCardAnchors);
   larkChannel = bridge.channel;
   const deliverUpdateResult = async () => {
     await updateHandoff.deliverResult(async (state) => {
       if (!streaming) throw new Error("channel is not ready");
+      const failureHint = guardianUpdateFailureHint(state.errorCode);
       const markdown2 = state.status === "succeeded" ? bilingualMarkdown(
         `\u2705 dsh-lark-bot \u5DF2\u66F4\u65B0\u5230 \`${state.targetVersion}\`\uFF0C\u673A\u5668\u4EBA\u5DF2\u5B8C\u6210\u91CD\u8F7D\u3002`,
         `\u2705 dsh-lark-bot was updated to \`${state.targetVersion}\` and reloaded.`
       ) : bilingualMarkdown(
-        `\u26A0\uFE0F dsh-lark-bot \u66F4\u65B0\u5230 \`${state.targetVersion}\` \u5931\u8D25\u3002\u8BF7\u91CD\u65B0\u53D1\u9001 \`/upgrade\`\uFF1B\u5982\u4ECD\u5931\u8D25\uFF0C\u53D1\u9001 \`/doctor\` \u68C0\u67E5\u3002`,
-        `\u26A0\uFE0F Failed to update dsh-lark-bot to \`${state.targetVersion}\`. Send \`/upgrade\` to retry, or \`/doctor\` if it still fails.`
+        `\u26A0\uFE0F dsh-lark-bot \u66F4\u65B0\u5230 \`${state.targetVersion}\` \u5931\u8D25\u3002${failureHint.zh}`,
+        `\u26A0\uFE0F Failed to update dsh-lark-bot to \`${state.targetVersion}\`. ${failureHint.en}`
       );
       await streaming.sendMarkdown(state.route.chatId, markdown2, {
         ...state.route.threadId ? { threadId: state.route.threadId } : {}
@@ -18310,11 +18617,11 @@ async function restartProfileProcess(profile, options = {}) {
 // src/upgrade/runtime.ts
 init_own_package();
 import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { mkdir as mkdir24, rm as rm10, symlink } from "fs/promises";
+import { mkdir as mkdir24, rm as rm11, symlink } from "fs/promises";
 import { join as join29 } from "path";
 init_acp_runtime();
 async function defaultRelink(linkPath, target) {
-  await rm10(linkPath, { recursive: true, force: true });
+  await rm11(linkPath, { recursive: true, force: true });
   await mkdir24(join29(linkPath, ".."), { recursive: true });
   await symlink(target, linkPath, process.platform === "win32" ? "junction" : "dir");
 }
@@ -20055,7 +20362,7 @@ async function uninstallGuardianCommand(options = {}) {
   const result = await uninstallGuardian({ env });
   printResult(result);
 }
-async function statusGuardianCommand(options = {}) {
+async function statusGuardianCommand(options = {}, deps = {}) {
   const env = envWithOverrides(options);
   const paths = resolveAppPaths(env.home);
   const fallback = newGuardianState({
@@ -20066,6 +20373,7 @@ async function statusGuardianCommand(options = {}) {
   const layout = guardianLayoutFor(env, state.bridgeProfile);
   const heartbeat = await readHeartbeat(layout.heartbeatFile);
   const processFound = await findProfileProcess(state.dshProfile);
+  const guardianProcess = await (deps.findGuardianProcess ?? findGuardianProcess)();
   const up = isHeartbeatFresh(heartbeat, env.guardianStaleMs) || processFound !== void 0;
   printLines([
     "\u5B89\u5168\u7F51\u5B88\u62A4\u72B6\u6001",
@@ -20077,7 +20385,7 @@ async function statusGuardianCommand(options = {}) {
     `dsh \u662F\u5426\u5728\u7EBF\uFF1A${up ? "\u662F" : "\u5426"}${processFound ? `\uFF08pid ${processFound.pid}\uFF09` : ""}`,
     `\u5FC3\u8DF3\u9F84\uFF1A${heartbeat ? `${heartbeatAgeMs(heartbeat)}ms` : "\u65E0"}`,
     `\u5DF2\u89C2\u5BDF\u8FC7 dsh \u8FD0\u884C\uFF1A${state.profileSeenUp ? "\u662F" : "\u5426"}`,
-    "\u5B88\u62A4\u8FDB\u7A0B pid\uFF1A\u672A\u53D1\u73B0\uFF08\u72B6\u6001\u547D\u4EE4\u4E0D\u4F1A\u628A\u81EA\u8EAB PID \u5192\u5145\u4E3A\u5B88\u62A4\u8FDB\u7A0B\uFF09",
+    guardianProcess === void 0 ? "\u5B88\u62A4\u8FDB\u7A0B pid\uFF1A\u672A\u53D1\u73B0\uFF08\u65E0\u6CD5\u552F\u4E00\u8BC1\u660E resident guardian \u8EAB\u4EFD\uFF09" : `\u5B88\u62A4\u8FDB\u7A0B pid\uFF1A${guardianProcess.pid}`,
     `\u72B6\u6001\u6587\u4EF6\uFF1A${layout.stateFile}`,
     `\u5FC3\u8DF3\u6587\u4EF6\uFF1A${layout.heartbeatFile}`
   ]);
@@ -20320,7 +20628,7 @@ async function runServiceRuntime(options = {}, deps = {}) {
 // src/cli/commands/bot.ts
 init_dsh_runtime();
 import { homedir as homedir24 } from "os";
-import { rm as rm11 } from "fs/promises";
+import { rm as rm12 } from "fs/promises";
 import { join as join34 } from "path";
 async function runBotCommand(action, options = {}, deps = {}) {
   const output = deps.output ?? ((text) => process.stdout.write(text));
@@ -20379,7 +20687,7 @@ ${rows.join("\n")}
       current.dshProfile,
       instanceEnv(sourceEnv, name, current.dshHome)
     ).uninstall();
-    await rm11(join34(paths.botDshHome(name), ".credentials.yaml"), { force: true });
+    await rm12(join34(paths.botDshHome(name), ".credentials.yaml"), { force: true });
     await configs.removeProfile(current.bridgeProfile);
     await fleet.remove(name);
     output(
@@ -20416,7 +20724,7 @@ ${rows.join("\n")}
   } catch (error) {
     try {
       await service.uninstall();
-      await rm11(join34(dshHome, ".credentials.yaml"), { force: true });
+      await rm12(join34(dshHome, ".credentials.yaml"), { force: true });
       await fleet.remove(name);
       await configs.removeProfile(name);
     } catch (cleanupError) {