dsh-lark-bot 0.3.0 → 0.4.0

package/dist/cli.js

@@ -1379,6 +1379,10 @@ function resolveAppPaths(root = defaultHome()) {
     workspacesFile: (profile) => profilePath(profile, "workspaces.json"),
     mediaDir: (profile) => profilePath(profile, "media"),
     logsDir: (profile) => profilePath(profile, "logs"),
+    serviceDir: join4(root, "service"),
+    serviceEnvFile: join4(root, "service", "service.env"),
+    serviceMetadataFile: join4(root, "service", "service.json"),
+    serviceLogFile: (profile) => profilePath(profile, "logs", "bot.log"),
     registryFile: join4(root, "registry", "processes.json"),
     locksDir: join4(root, "registry", "locks")
   };
@@ -1517,9 +1521,9 @@ async function writeFileAtomic(target, data, options = {}) {
   }
 }
 async function rmSilently(path) {
-  const { rm } = await import("fs/promises");
+  const { rm: rm3 } = await import("fs/promises");
   try {
-    await rm(path, { force: true });
+    await rm3(path, { force: true });
   } catch {
   }
 }
@@ -1690,7 +1694,7 @@ async function runDoctor(options) {
   if (critical) process.exitCode = 1;
 }
 
-// src/cli/commands/start.ts
+// src/cli/commands/run.ts
 import { mkdir as mkdir7 } from "fs/promises";
 
 // src/bot/active-runs.ts
@@ -3488,21 +3492,10 @@ var WorkspaceStore = class {
   }
 };
 
-// src/cli/commands/start.ts
+// src/cli/commands/run.ts
 var DEBOUNCE_MS = 600;
-async function runStart(options) {
-  const env = loadRuntimeEnv({
-    ...process.env,
-    ...options.workspace ? { DSH_LARK_WORKSPACE: options.workspace } : {},
-    ...options.tenant ? { DSH_LARK_TENANT: options.tenant } : {},
-    ...options.appId ? { DSH_LARK_APP_ID: options.appId } : {},
-    ...options.appSecret ? { DSH_LARK_APP_SECRET: options.appSecret } : {}
-  });
-  const paths = resolveAppPaths(env.home);
-  const profileName = options.profile ?? "default";
-  const configStore = new ConfigStore(paths.configFile);
-  await configStore.load();
-  const accessManager = new AccessManager(configStore, profileName);
+async function ensureBotProfile(store, options) {
+  const { env, profileName } = options;
   if (env.appId && env.appSecret) {
     const profileInput = {
       tenant: env.tenant,
@@ -3513,31 +3506,61 @@ async function runStart(options) {
       runTimeoutMs: env.runTimeoutMs
     };
     if (env.workspace !== void 0) profileInput.workspace = env.workspace;
-    await configStore.saveProfile(profileName, profileInput);
+    await store.saveProfile(profileName, profileInput);
   }
-  const profile = configStore.getProfile(profileName);
-  if (!profile) {
-    try {
-      const created = await onboardPersonalAgent();
-      const onboardingProfile = {
-        tenant: created.tenant,
-        appId: created.appId,
-        appSecret: created.appSecret,
-        model: env.model,
-        stopGraceMs: env.stopGraceMs,
-        runTimeoutMs: env.runTimeoutMs
-      };
-      if (created.operatorOpenId !== void 0) {
-        onboardingProfile.operatorOpenId = created.operatorOpenId;
-      }
-      if (env.workspace !== void 0) onboardingProfile.workspace = env.workspace;
-      await configStore.saveProfile(profileName, onboardingProfile);
-    } catch (error) {
-      log.fail("onboarding", error);
-      process.stderr.write("\u626B\u7801\u521B\u5EFA\u5E94\u7528\u5931\u8D25\uFF0C\u672A\u5199\u5165\u672C\u5730\u914D\u7F6E\u3002\n");
-      process.exitCode = 1;
-      return;
+  if (store.getProfile(profileName)) return true;
+  if (!options.allowOnboarding) {
+    process.stderr.write(
+      "\u672A\u68C0\u6D4B\u5230\u98DE\u4E66 / Lark \u5E94\u7528\u51ED\u636E\u3002\u8BF7\u5148\u5728\u7EC8\u7AEF\u8FD0\u884C `dsh-lark-bot start` \u5B8C\u6210\u626B\u7801\u7ED1\u5B9A\u3002\n"
+    );
+    return false;
+  }
+  try {
+    const created = await onboardPersonalAgent();
+    const onboardingProfile = {
+      tenant: created.tenant,
+      appId: created.appId,
+      appSecret: created.appSecret,
+      model: env.model,
+      stopGraceMs: env.stopGraceMs,
+      runTimeoutMs: env.runTimeoutMs
+    };
+    if (created.operatorOpenId !== void 0) {
+      onboardingProfile.operatorOpenId = created.operatorOpenId;
     }
+    if (env.workspace !== void 0) onboardingProfile.workspace = env.workspace;
+    await store.saveProfile(profileName, onboardingProfile);
+    return true;
+  } catch (error) {
+    log.fail("onboarding", error);
+    process.stderr.write("\u626B\u7801\u521B\u5EFA\u5E94\u7528\u5931\u8D25\uFF0C\u672A\u5199\u5165\u672C\u5730\u914D\u7F6E\u3002\n");
+    process.exitCode = 1;
+    return false;
+  }
+}
+function mergeStartEnv(options) {
+  return {
+    ...process.env,
+    ...options.workspace ? { DSH_LARK_WORKSPACE: options.workspace } : {},
+    ...options.tenant ? { DSH_LARK_TENANT: options.tenant } : {},
+    ...options.appId ? { DSH_LARK_APP_ID: options.appId } : {},
+    ...options.appSecret ? { DSH_LARK_APP_SECRET: options.appSecret } : {}
+  };
+}
+async function runBot(options) {
+  const env = loadRuntimeEnv(mergeStartEnv(options));
+  const paths = resolveAppPaths(env.home);
+  const profileName = options.profile ?? "default";
+  const configStore = new ConfigStore(paths.configFile);
+  await configStore.load();
+  const ready = await ensureBotProfile(configStore, {
+    env,
+    profileName,
+    allowOnboarding: false
+  });
+  if (!ready) {
+    process.exitCode = 1;
+    return;
   }
   const activeProfile = configStore.getProfile(profileName);
   if (!activeProfile) {
@@ -3629,7 +3652,7 @@ async function runStart(options) {
     questions,
     densityStore,
     defaultRunTimeoutMs: activeProfile.preferences.runTimeoutMs ?? env.runTimeoutMs,
-    accessManager,
+    accessManager: new AccessManager(configStore, profileName),
     pending,
     defaultWorkspace,
     accessDefaultDeny: env.accessDefaultDeny,
@@ -3672,21 +3695,959 @@ function waitForShutdown() {
   });
 }
 
+// src/service/manager.ts
+import { mkdir as mkdir12, readFile as readFile7 } from "fs/promises";
+import { dirname as dirname6 } from "path";
+
+// src/service/command.ts
+import { execFile as execFile2 } from "child_process";
+import { basename, dirname as dirname4, join as join9 } from "path";
+import { fileURLToPath } from "url";
+var runCommand = (command, args, options) => new Promise((resolve5) => {
+  execFile2(
+    command,
+    [...args],
+    {
+      env: options?.env,
+      maxBuffer: 16 * 1024 * 1024,
+      windowsHide: true
+    },
+    (error, stdout, stderr) => {
+      let code = 0;
+      if (error) {
+        const errorCode = error.code;
+        code = typeof errorCode === "number" ? errorCode : 1;
+      }
+      resolve5({ code, stdout: stdout ?? "", stderr: stderr ?? "" });
+    }
+  );
+});
+function resolveCliJsPath(metaUrl = import.meta.url) {
+  const current = fileURLToPath(metaUrl);
+  const name = basename(current);
+  if (name === "cli.js" || name === "cli.mjs" || name === "cli.cjs") return current;
+  return join9(dirname4(current), "..", "dist", "cli.js");
+}
+function slugify2(value) {
+  const slug = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "default";
+}
+function serviceNameFor(profile) {
+  return profile === "default" ? "dsh-lark-bot" : `dsh-lark-bot-${slugify2(profile)}`;
+}
+function launchdLabelFor(profile) {
+  return profile === "default" ? "io.dsh-lark-bot" : `io.dsh-lark-bot.${slugify2(profile)}`;
+}
+
+// src/service/env-snapshot.ts
+import { readFile as readFile5 } from "fs/promises";
+var EXTRA_KEYS = ["PATH", "HOME", "DEEPSEEK_API_KEY", "DSH_HOME"];
+function snapshotServiceEnv(source = process.env) {
+  const env = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (value === void 0) continue;
+    if (key.startsWith("DSH_LARK_") || EXTRA_KEYS.includes(key)) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
+function formatEnvFile(env) {
+  const lines = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      throw new Error(`invalid service env key: ${key}`);
+    }
+    if (/[\r\n]/.test(value)) {
+      throw new Error(`service env value for ${key} contains a newline`);
+    }
+    const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    lines.push(`${key}="${escaped}"`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function parseEnvFile(text) {
+  const env = {};
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#") || line.startsWith(";")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    let value = line.slice(eq + 1).trim();
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+      value = value.slice(1, -1).replace(/\\(.)/g, "$1");
+    } else if (value.length >= 2 && value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    env[key] = value;
+  }
+  return env;
+}
+async function writeServiceEnv(file, env) {
+  await writeFileAtomic(file, formatEnvFile(env), { mode: 384 });
+}
+async function readServiceEnv(file) {
+  try {
+    return parseEnvFile(await readFile5(file, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  }
+}
+
+// src/service/linux-systemd.ts
+import { mkdir as mkdir8, stat as stat3 } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { join as join10 } from "path";
+function defaultSystemdUnitDir() {
+  return join10(homedir5(), ".config", "systemd", "user");
+}
+function quoteSystemdArg(arg) {
+  if (!/[\s"\\]/.test(arg)) return arg;
+  return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function buildSystemdUnit(spec) {
+  const exec = [spec.nodePath, spec.cliJsPath, "run", "--profile", spec.profile].map(quoteSystemdArg).join(" ");
+  return [
+    "[Unit]",
+    "Description=dsh-lark-bot bridge service",
+    "After=network-online.target",
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `EnvironmentFile=${quoteSystemdArg(spec.envFile)}`,
+    `ExecStart=${exec}`,
+    "Restart=always",
+    "RestartSec=5",
+    "KillMode=mixed",
+    "TimeoutStopSec=30",
+    `StandardOutput=append:${spec.logFile}`,
+    `StandardError=append:${spec.logFile}`,
+    "",
+    "[Install]",
+    "WantedBy=default.target",
+    ""
+  ].join("\n");
+}
+async function isSystemdUserAvailable(runner = runCommand) {
+  const result = await runner("systemctl", ["--user", "show-environment"]);
+  return result.code === 0;
+}
+async function fileExists(path) {
+  try {
+    return (await stat3(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+function parseMainPid(value) {
+  const raw = value?.trim();
+  if (!raw || raw === "0" || raw === "4294967295") return void 0;
+  const pid = Number(raw);
+  return Number.isInteger(pid) && pid > 0 ? pid : void 0;
+}
+function parseNumber(value) {
+  const raw = value?.trim();
+  if (!raw) return void 0;
+  const parsed = Number(raw);
+  return Number.isInteger(parsed) ? parsed : void 0;
+}
+var SystemdServiceController = class {
+  platform = "linux-systemd";
+  run;
+  unitDir;
+  constructor(options = {}) {
+    this.run = options.runCommand ?? runCommand;
+    this.unitDir = options.userUnitDir ?? defaultSystemdUnitDir();
+  }
+  unitPath(spec) {
+    return join10(this.unitDir, `${spec.serviceName}.service`);
+  }
+  unitName(spec) {
+    return `${spec.serviceName}.service`;
+  }
+  async isActive(name) {
+    const result = await this.run("systemctl", ["--user", "is-active", name]);
+    return result.code === 0;
+  }
+  async installAndStart(spec) {
+    await mkdir8(this.unitDir, { recursive: true });
+    await writeFileAtomic(this.unitPath(spec), buildSystemdUnit(spec));
+    await this.run("systemctl", ["--user", "daemon-reload"]);
+    const name = this.unitName(spec);
+    if (await this.isActive(name)) {
+      await this.run("systemctl", ["--user", "restart", name]);
+    } else {
+      await this.run("systemctl", ["--user", "enable", "--now", name]);
+    }
+  }
+  async stop(spec) {
+    await this.run("systemctl", ["--user", "disable", "--now", this.unitName(spec)]);
+  }
+  async restart(spec) {
+    await this.run("systemctl", ["--user", "daemon-reload"]);
+    await this.run("systemctl", ["--user", "restart", this.unitName(spec)]);
+  }
+  async status(spec) {
+    const name = this.unitName(spec);
+    const unitFile = this.unitPath(spec);
+    const installed = await fileExists(unitFile);
+    let autostartEnabled = false;
+    if (installed) {
+      const enabled = await this.run("systemctl", ["--user", "is-enabled", name]);
+      autostartEnabled = enabled.code === 0 && enabled.stdout.trim() === "enabled";
+    }
+    const active = await this.run("systemctl", ["--user", "is-active", name]);
+    const isActive = active.code === 0;
+    let detail = active.stdout.trim() || (isActive ? "active" : "inactive");
+    let pid;
+    let restarts;
+    if (isActive || installed) {
+      const show = await this.run(
+        "systemctl",
+        ["--user", "show", name, "-p", "MainPID", "-p", "ActiveState", "-p", "NRestarts", "--value"]
+      );
+      const [activeState, mainPid, nRestarts] = show.stdout.trim().split("\n");
+      if (activeState?.trim()) detail = activeState.trim();
+      pid = parseMainPid(mainPid);
+      restarts = parseNumber(nRestarts);
+    }
+    let state;
+    if (!installed) {
+      state = "stopped";
+    } else if (detail === "failed") {
+      state = "error";
+    } else if (isActive || detail === "activating" || detail === "deactivating" || detail === "reloading") {
+      state = "running";
+    } else {
+      state = "stopped";
+    }
+    return {
+      name: spec.serviceName,
+      platform: this.platform,
+      installed,
+      autostartEnabled,
+      state,
+      pid,
+      detail,
+      restarts
+    };
+  }
+};
+
+// src/service/macos-launchd.ts
+import { mkdir as mkdir9, rm, stat as stat4 } from "fs/promises";
+import { homedir as homedir6 } from "os";
+import { join as join11 } from "path";
+function defaultLaunchAgentDir() {
+  return join11(homedir6(), "Library", "LaunchAgents");
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function buildLaunchdPlist(spec) {
+  const envLines = Object.entries(spec.env).filter(([, value]) => value !== void 0).map(
+    ([key, value]) => `    <key>${xmlEscape(key)}</key>
+    <string>${xmlEscape(value)}</string>`
+  ).join("\n");
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "  <key>Label</key>",
+    `  <string>${xmlEscape(spec.label)}</string>`,
+    "  <key>ProgramArguments</key>",
+    "  <array>",
+    `    <string>${xmlEscape(spec.nodePath)}</string>`,
+    `    <string>${xmlEscape(spec.cliJsPath)}</string>`,
+    "    <string>run</string>",
+    "    <string>--profile</string>",
+    `    <string>${xmlEscape(spec.profile)}</string>`,
+    "  </array>",
+    "  <key>RunAtLoad</key>",
+    "  <true/>",
+    "  <key>KeepAlive</key>",
+    "  <true/>",
+    "  <key>EnvironmentVariables</key>",
+    "  <dict>",
+    envLines,
+    "  </dict>",
+    "  <key>StandardOutPath</key>",
+    `  <string>${xmlEscape(spec.logFile)}</string>`,
+    "  <key>StandardErrorPath</key>",
+    `  <string>${xmlEscape(spec.logFile)}</string>`,
+    "  <key>ProcessType</key>",
+    "  <string>Background</string>",
+    "</dict>",
+    "</plist>",
+    ""
+  ].join("\n");
+}
+async function fileExists2(path) {
+  try {
+    return (await stat4(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+var LaunchdServiceController = class {
+  platform = "darwin-launchd";
+  run;
+  agentDir;
+  uid;
+  constructor(options = {}) {
+    this.run = options.runCommand ?? runCommand;
+    this.agentDir = options.launchAgentDir ?? defaultLaunchAgentDir();
+    this.uid = options.uid ?? process.getuid?.() ?? -1;
+  }
+  domain() {
+    return `gui/${this.uid}`;
+  }
+  plistPath(spec) {
+    return join11(this.agentDir, `${spec.label}.plist`);
+  }
+  serviceRef(spec) {
+    return `${this.domain()}/${spec.label}`;
+  }
+  async installAndStart(spec) {
+    await mkdir9(this.agentDir, { recursive: true });
+    await writeFileAtomic(this.plistPath(spec), buildLaunchdPlist(spec));
+    const bootstrap = await this.run("launchctl", ["bootstrap", this.domain(), this.plistPath(spec)]);
+    if (bootstrap.code !== 0) {
+      await this.run("launchctl", ["kickstart", "-k", this.serviceRef(spec)]);
+    }
+  }
+  async stop(spec) {
+    await this.run("launchctl", ["bootout", this.serviceRef(spec)]);
+    await rm(this.plistPath(spec), { force: true });
+  }
+  async restart(spec) {
+    const kickstart = await this.run("launchctl", ["kickstart", "-k", this.serviceRef(spec)]);
+    if (kickstart.code !== 0) {
+      await this.installAndStart(spec);
+    }
+  }
+  async status(spec) {
+    const plistExists = await fileExists2(this.plistPath(spec));
+    const printed = await this.run("launchctl", ["print", this.serviceRef(spec)]);
+    const loaded = printed.code === 0;
+    let pid;
+    let state = "stopped";
+    let detail = loaded ? "loaded" : "not loaded";
+    if (loaded) {
+      const pidMatch = /pid = (\d+)/.exec(printed.stdout);
+      if (pidMatch?.[1]) pid = Number(pidMatch[1]);
+      if (/state = running/.test(printed.stdout)) {
+        state = "running";
+        detail = "running";
+      } else if (/state = exited|state = waiting/.test(printed.stdout)) {
+        state = "stopped";
+        detail = /state = exited/.test(printed.stdout) ? "exited" : "waiting";
+      }
+    }
+    return {
+      name: spec.serviceName,
+      platform: this.platform,
+      installed: plistExists,
+      autostartEnabled: loaded,
+      state,
+      pid,
+      detail,
+      restarts: void 0
+    };
+  }
+};
+
+// src/service/portable.ts
+import { spawn as spawn5 } from "child_process";
+import { mkdir as mkdir10, readFile as readFile6, rm as rm2, stat as stat5, writeFile as writeFile4 } from "fs/promises";
+import { homedir as homedir7 } from "os";
+import { join as join12 } from "path";
+function defaultAutostartDir() {
+  return join12(homedir7(), ".config", "autostart");
+}
+function quoteDesktopArg(arg) {
+  const escaped = arg.replace(/%/g, "%%").replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  return /[\s"\\]/.test(arg) ? `"${escaped}"` : escaped;
+}
+function buildDesktopEntry(spec) {
+  const exec = [spec.nodePath, spec.cliJsPath, "supervise", "--profile", spec.profile].map(quoteDesktopArg).join(" ");
+  return [
+    "[Desktop Entry]",
+    "Type=Application",
+    `Name=${spec.serviceName}`,
+    "Comment=Keep dsh-lark-bot running in the background",
+    `Exec=${exec}`,
+    "Terminal=false",
+    "X-GNOME-Autostart-enabled=true",
+    "Hidden=false",
+    ""
+  ].join("\n");
+}
+function supervisorStatusFile(serviceDir, serviceName) {
+  return join12(serviceDir, `supervisor-${serviceName}.json`);
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+async function readSupervisorStatus(file) {
+  try {
+    return JSON.parse(await readFile6(file, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function defaultSpawnDetached(nodePath, args) {
+  const child = spawn5(nodePath, [...args], {
+    detached: true,
+    stdio: "ignore",
+    env: process.env
+  });
+  child.unref();
+  return child;
+}
+var PortableServiceController = class {
+  platform = "linux-portable";
+  autostartDir;
+  serviceDir;
+  spawnDetached;
+  constructor(options = {}) {
+    this.autostartDir = options.autostartDir ?? defaultAutostartDir();
+    this.serviceDir = options.serviceDir ?? "";
+    this.spawnDetached = options.spawnDetached ?? defaultSpawnDetached;
+  }
+  desktopPath(spec) {
+    return join12(this.autostartDir, `${spec.serviceName}.desktop`);
+  }
+  statusFile(spec) {
+    return supervisorStatusFile(this.serviceDir, spec.serviceName);
+  }
+  async sendStopSignal(spec) {
+    const status = await readSupervisorStatus(this.statusFile(spec));
+    if (!status) return;
+    try {
+      process.kill(status.pid, "SIGTERM");
+    } catch {
+      return;
+    }
+    for (let attempt = 0; attempt < 20; attempt += 1) {
+      await new Promise((resolvePromise) => setTimeout(resolvePromise, 250));
+      if (!isProcessAlive(status.pid)) return;
+    }
+    try {
+      process.kill(status.pid, "SIGKILL");
+    } catch {
+    }
+  }
+  async installAndStart(spec) {
+    await this.sendStopSignal(spec);
+    await mkdir10(this.autostartDir, { recursive: true });
+    await writeFile4(this.desktopPath(spec), buildDesktopEntry(spec), { encoding: "utf8", mode: 420 });
+    if (!this.serviceDir) throw new Error("serviceDir is required for the portable supervisor");
+    await mkdir10(this.serviceDir, { recursive: true });
+    this.spawnDetached(spec.nodePath, [spec.cliJsPath, "supervise", "--profile", spec.profile]);
+  }
+  async stop(spec) {
+    await this.sendStopSignal(spec);
+    await rm2(this.desktopPath(spec), { force: true });
+  }
+  async restart(spec) {
+    await this.stop(spec);
+    await this.installAndStart(spec);
+  }
+  async status(spec) {
+    let desktopExists = false;
+    try {
+      desktopExists = (await stat5(this.desktopPath(spec))).isFile();
+    } catch {
+      desktopExists = false;
+    }
+    const status = await readSupervisorStatus(this.statusFile(spec));
+    const alive = status !== void 0 && isProcessAlive(status.pid);
+    return {
+      name: spec.serviceName,
+      platform: this.platform,
+      installed: desktopExists,
+      autostartEnabled: desktopExists,
+      state: alive ? "running" : "stopped",
+      pid: status?.childPid,
+      detail: alive ? `supervisor ${status?.pid ?? "?"}` : "stopped",
+      restarts: status?.restarts
+    };
+  }
+};
+
+// src/service/windows-task.ts
+import { mkdir as mkdir11, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname5, join as join13 } from "path";
+function psQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function buildScheduledTaskScript(action, spec) {
+  const vars = [
+    `$taskName = ${psQuote(spec.serviceName)}`,
+    `$node = ${psQuote(spec.nodePath)}`,
+    `$cli = ${psQuote(spec.cliJsPath)}`,
+    `$log = ${psQuote(spec.logFile)}`,
+    `$profile = ${psQuote(spec.profile)}`,
+    `$workDir = ${psQuote(dirname5(spec.cliJsPath))}`
+  ].join("\n");
+  const install = [
+    `$inner = '"' + $node + '" "' + $cli + '" run --profile "' + $profile + '" >> "' + $log + '" 2>&1'`,
+    `$action = New-ScheduledTaskAction -Execute 'cmd.exe' -Argument ('/c ' + $inner) -WorkingDirectory $workDir`,
+    `$trigger = New-ScheduledTaskTrigger -AtLogOn`,
+    `$settings = New-ScheduledTaskSettingsSet -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -StartWhenAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries`,
+    `Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue`,
+    `Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force`,
+    `Enable-ScheduledTask -TaskName $taskName`,
+    `Start-ScheduledTask -TaskName $taskName`
+  ].join("\n");
+  const stop = [
+    `Stop-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue`,
+    `Disable-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue`
+  ].join("\n");
+  const restart = [
+    `Stop-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue`,
+    `Start-ScheduledTask -TaskName $taskName`
+  ].join("\n");
+  const status = [
+    `$task = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue`,
+    `if ($null -eq $task) { Write-Output 'STATE:missing'; Write-Output 'ENABLED:false'; exit 2 }`,
+    `$info = Get-ScheduledTaskInfo -TaskName $taskName`,
+    `Write-Output ('STATE:' + $task.State)`,
+    `Write-Output ('ENABLED:' + $task.Settings.Enabled)`,
+    `Write-Output ('LAST_RESULT:' + $info.LastTaskResult)`,
+    `Write-Output ('LAST_RUN:' + $info.LastRunTime)`
+  ].join("\n");
+  const body = {
+    install,
+    stop,
+    restart,
+    status
+  };
+  return [
+    `$ErrorActionPreference = 'Stop'`,
+    vars,
+    body[action],
+    ""
+  ].join("\n");
+}
+function parseTaskStatusOutput(output) {
+  const fields = /* @__PURE__ */ new Map();
+  for (const rawLine of output.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    const eq = line.indexOf(":");
+    if (eq <= 0) continue;
+    fields.set(line.slice(0, eq).trim(), line.slice(eq + 1).trim());
+  }
+  const stateValue = fields.get("STATE") ?? "missing";
+  const enabled = fields.get("ENABLED") === "True";
+  const installed = stateValue !== "missing";
+  let state = "unknown";
+  if (stateValue === "Running") state = "running";
+  else if (stateValue === "Ready" || stateValue === "Disabled") state = "stopped";
+  else if (stateValue === "Unknown") state = "unknown";
+  else if (stateValue === "missing") state = "stopped";
+  const lastResultRaw = fields.get("LAST_RESULT");
+  const lastResult = lastResultRaw !== void 0 ? Number.parseInt(lastResultRaw, 10) : void 0;
+  const lastResultValue = lastResult !== void 0 && Number.isFinite(lastResult) ? lastResult : void 0;
+  if (installed && lastResultValue !== void 0 && lastResultValue !== 0 && stateValue === "Ready") {
+    state = "error";
+  }
+  return {
+    installed,
+    autostartEnabled: enabled,
+    state,
+    detail: stateValue,
+    lastResult: lastResultValue
+  };
+}
+var WindowsTaskServiceController = class {
+  platform = "win32-task";
+  run;
+  scriptDir;
+  constructor(options = {}) {
+    this.run = options.runCommand ?? runCommand;
+    this.scriptDir = options.scriptDir ?? "";
+  }
+  scriptPath(spec, action) {
+    return join13(this.scriptDir, `${action}-${spec.serviceName}.ps1`);
+  }
+  async runScript(spec, action) {
+    const script = this.scriptPath(spec, action);
+    if (this.scriptDir) await mkdir11(this.scriptDir, { recursive: true });
+    await writeFile5(script, buildScheduledTaskScript(action, spec), { encoding: "utf8" });
+    const result = await this.run("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-File",
+      script
+    ]);
+    return { result, script };
+  }
+  async installAndStart(spec) {
+    const { result } = await this.runScript(spec, "install");
+    if (result.code !== 0) {
+      throw new Error(
+        `\u65E0\u6CD5\u6CE8\u518C Windows \u8BA1\u5212\u4EFB\u52A1\uFF08exit ${result.code}\uFF09\uFF1A${result.stderr.trim() || result.stdout.trim() || "\u672A\u77E5\u9519\u8BEF"}`
+      );
+    }
+  }
+  async stop(spec) {
+    const { result } = await this.runScript(spec, "stop");
+    if (result.code !== 0) {
+      throw new Error(
+        `\u65E0\u6CD5\u505C\u6B62 Windows \u8BA1\u5212\u4EFB\u52A1\uFF08exit ${result.code}\uFF09\uFF1A${result.stderr.trim() || result.stdout.trim() || "\u672A\u77E5\u9519\u8BEF"}`
+      );
+    }
+  }
+  async restart(spec) {
+    const { result } = await this.runScript(spec, "restart");
+    if (result.code !== 0) {
+      throw new Error(
+        `\u65E0\u6CD5\u91CD\u542F Windows \u8BA1\u5212\u4EFB\u52A1\uFF08exit ${result.code}\uFF09\uFF1A${result.stderr.trim() || result.stdout.trim() || "\u672A\u77E5\u9519\u8BEF"}`
+      );
+    }
+  }
+  async status(spec) {
+    const { result } = await this.runScript(spec, "status");
+    const parsed = parseTaskStatusOutput(result.stdout);
+    if (result.code !== 0 && result.code !== 2) {
+      throw new Error(
+        `\u65E0\u6CD5\u67E5\u8BE2 Windows \u8BA1\u5212\u4EFB\u52A1\uFF08exit ${result.code}\uFF09\uFF1A${result.stderr.trim() || result.stdout.trim() || "\u672A\u77E5\u9519\u8BEF"}`
+      );
+    }
+    return {
+      name: spec.serviceName,
+      platform: this.platform,
+      installed: parsed.installed,
+      autostartEnabled: parsed.autostartEnabled,
+      state: parsed.state,
+      pid: void 0,
+      detail: parsed.detail,
+      restarts: void 0
+    };
+  }
+};
+
+// src/service/manager.ts
+var ServiceManager = class {
+  profile;
+  sourceEnv;
+  paths;
+  version;
+  controllerOverride;
+  constructor(deps = {}) {
+    this.profile = deps.profile ?? "default";
+    this.sourceEnv = deps.env ?? process.env;
+    this.paths = deps.paths ?? resolveAppPaths();
+    this.version = deps.version ?? "0.0.0";
+    this.controllerOverride = deps.controller;
+  }
+  buildSpec() {
+    const serviceName = serviceNameFor(this.profile);
+    return {
+      serviceName,
+      label: launchdLabelFor(this.profile),
+      profile: this.profile,
+      nodePath: process.execPath,
+      cliJsPath: resolveCliJsPath(),
+      envFile: this.paths.serviceEnvFile,
+      logFile: this.paths.serviceLogFile(this.profile),
+      env: snapshotServiceEnv(this.sourceEnv)
+    };
+  }
+  async resolveController() {
+    if (this.controllerOverride) return this.controllerOverride;
+    if (process.platform === "darwin") return new LaunchdServiceController();
+    if (process.platform === "win32") return new WindowsTaskServiceController({
+      scriptDir: this.paths.serviceDir
+    });
+    const systemd = new SystemdServiceController();
+    if (await isSystemdUserAvailable()) return systemd;
+    return new PortableServiceController({ serviceDir: this.paths.serviceDir });
+  }
+  async saveMetadata(platform) {
+    const metadata = {
+      schemaVersion: 1,
+      serviceName: this.buildSpec().serviceName,
+      profile: this.profile,
+      platform,
+      version: this.version,
+      installedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await writeFileAtomic(this.paths.serviceMetadataFile, `${JSON.stringify(metadata, null, 2)}
+`);
+  }
+  async readMetadata() {
+    try {
+      return JSON.parse(await readFile7(this.paths.serviceMetadataFile, "utf8"));
+    } catch {
+      return void 0;
+    }
+  }
+  async prepareFiles(spec) {
+    await mkdir12(dirname6(spec.logFile), { recursive: true });
+    await mkdir12(dirname6(spec.envFile), { recursive: true });
+    await writeServiceEnv(spec.envFile, spec.env);
+  }
+  async start() {
+    const controller = await this.resolveController();
+    const spec = this.buildSpec();
+    await this.prepareFiles(spec);
+    await controller.installAndStart(spec);
+    await this.saveMetadata(controller.platform);
+    return controller.status(spec);
+  }
+  async stop() {
+    const controller = await this.resolveController();
+    const spec = this.buildSpec();
+    await controller.stop(spec);
+    return controller.status(spec);
+  }
+  async restart() {
+    const controller = await this.resolveController();
+    const spec = this.buildSpec();
+    const before = await controller.status(spec);
+    if (!before.installed) {
+      throw new Error("\u540E\u53F0\u670D\u52A1\u5C1A\u672A\u5B89\u88C5\uFF0C\u8BF7\u5148\u8FD0\u884C dsh-lark-bot start");
+    }
+    await this.prepareFiles(spec);
+    await controller.restart(spec);
+    await this.saveMetadata(controller.platform);
+    return controller.status(spec);
+  }
+  async status() {
+    const controller = await this.resolveController();
+    const spec = this.buildSpec();
+    return controller.status(spec);
+  }
+};
+
+// src/cli/commands/service.ts
+function mergeStartEnv2(options) {
+  return {
+    ...process.env,
+    ...options.workspace ? { DSH_LARK_WORKSPACE: options.workspace } : {},
+    ...options.tenant ? { DSH_LARK_TENANT: options.tenant } : {},
+    ...options.appId ? { DSH_LARK_APP_ID: options.appId } : {},
+    ...options.appSecret ? { DSH_LARK_APP_SECRET: options.appSecret } : {}
+  };
+}
+function createManager(options, version) {
+  const env = loadRuntimeEnv(mergeStartEnv2(options));
+  const paths = resolveAppPaths(env.home);
+  return new ServiceManager({
+    profile: options.profile ?? "default",
+    env: mergeStartEnv2(options),
+    paths,
+    version
+  });
+}
+function printServiceStatus(status, output) {
+  const lines = [
+    "dsh-lark-bot \u670D\u52A1\u72B6\u6001",
+    `  name:      ${status.name}`,
+    `  platform:  ${status.platform}`,
+    `  installed: ${status.installed ? "\u662F" : "\u5426"}`,
+    `  autostart: ${status.autostartEnabled ? "\u5DF2\u542F\u7528\uFF08\u5F00\u673A\u81EA\u542F\uFF09" : "\u672A\u542F\u7528"}`,
+    `  state:     ${status.state}`,
+    `  detail:    ${status.detail}`,
+    `  pid:       ${status.pid ?? "-"}`,
+    `  restarts:  ${status.restarts ?? "-"}`
+  ];
+  output(`${lines.join("\n")}
+`);
+}
+async function runServiceStart(options, deps = {}) {
+  const version = deps.version ?? "0.0.0";
+  const output = deps.output ?? ((text) => process.stdout.write(text));
+  if (!deps.manager) {
+    const env = loadRuntimeEnv(mergeStartEnv2(options));
+    const paths = resolveAppPaths(env.home);
+    const profileName = options.profile ?? "default";
+    const store = new ConfigStore(paths.configFile);
+    await store.load();
+    const ready = await ensureBotProfile(store, {
+      env,
+      profileName,
+      allowOnboarding: true
+    });
+    if (!ready) {
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const manager = deps.manager ?? createManager(options, version);
+  try {
+    const status = await manager.start();
+    printServiceStatus(status, output);
+    if (status.state !== "running") process.exitCode = 1;
+  } catch (error) {
+    output(`${error instanceof Error ? error.message : String(error)}
+`);
+    process.exitCode = 1;
+  }
+}
+async function runServiceCommand(action, options, deps = {}) {
+  const output = deps.output ?? ((text) => process.stdout.write(text));
+  const manager = deps.manager ?? createManager(options, deps.version ?? "0.0.0");
+  try {
+    let status;
+    if (action === "status") {
+      status = await manager.status();
+    } else if (action === "restart") {
+      status = await manager.restart();
+    } else {
+      status = await manager.stop();
+    }
+    printServiceStatus(status, output);
+    if (action === "status") {
+      if (status.state !== "running") process.exitCode = 1;
+    } else if (action === "restart") {
+      if (status.state !== "running") process.exitCode = 1;
+    } else if (status.state === "running") {
+      process.exitCode = 1;
+    }
+  } catch (error) {
+    output(`${error instanceof Error ? error.message : String(error)}
+`);
+    process.exitCode = 1;
+  }
+}
+
+// src/cli/commands/supervise.ts
+import { spawn as spawn6 } from "child_process";
+import { closeSync, mkdirSync, openSync } from "fs";
+import { dirname as dirname7 } from "path";
+var BASE_BACKOFF_MS = 5e3;
+var MAX_BACKOFF_MS = 3e4;
+function computeBackoffMs(restarts) {
+  return Math.min(MAX_BACKOFF_MS, BASE_BACKOFF_MS * 2 ** Math.min(restarts, 3));
+}
+function waitForExit(child) {
+  return new Promise((resolvePromise) => {
+    const done = () => resolvePromise();
+    child.once("exit", done);
+    child.once("error", done);
+  });
+}
+function sleep(ms) {
+  return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
+}
+async function runSupervise(options) {
+  const env = loadRuntimeEnv(process.env);
+  const paths = resolveAppPaths(env.home);
+  const profile = options.profile ?? "default";
+  const serviceName = serviceNameFor(profile);
+  const statusFile = supervisorStatusFile(paths.serviceDir, serviceName);
+  const logFile = paths.serviceLogFile(profile);
+  const serviceEnv = await readServiceEnv(paths.serviceEnvFile);
+  const childEnv = { ...process.env, ...serviceEnv };
+  const cliJsPath = resolveCliJsPath();
+  mkdirSync(dirname7(statusFile), { recursive: true });
+  mkdirSync(dirname7(logFile), { recursive: true });
+  const logFd = openSync(logFile, "a");
+  const writeStatus = async (state, childPid, restarts2) => {
+    const status = {
+      pid: process.pid,
+      childPid,
+      state,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      restarts: restarts2,
+      profile
+    };
+    await writeFileAtomic(statusFile, `${JSON.stringify(status)}
+`);
+  };
+  let stopping = false;
+  let child;
+  const stop = () => {
+    stopping = true;
+    child?.kill("SIGTERM");
+  };
+  process.once("SIGTERM", stop);
+  process.once("SIGINT", stop);
+  let restarts = 0;
+  try {
+    while (!stopping) {
+      await writeStatus("running", void 0, restarts);
+      const spawned = spawn6(process.execPath, [cliJsPath, "run", "--profile", profile], {
+        env: childEnv,
+        stdio: ["ignore", logFd, logFd]
+      });
+      child = spawned;
+      await writeStatus("running", spawned.pid, restarts);
+      await waitForExit(spawned);
+      child = void 0;
+      if (stopping) break;
+      restarts += 1;
+      await writeStatus("restarting", void 0, restarts);
+      const backoff = computeBackoffMs(restarts);
+      await sleep(backoff);
+    }
+  } finally {
+    await writeStatus("stopped", void 0, restarts);
+    closeSync(logFd);
+  }
+}
+
 // src/cli.ts
 function packageVersion() {
   const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8");
   const pkg = JSON.parse(raw);
   return typeof pkg.version === "string" ? pkg.version : "0.0.0";
 }
+function addBotOptions(command) {
+  return command.option("--profile <name>", "profile name").option("--workspace <path>", "initial working directory").option("--app-id <id>", "existing Lark/Feishu app id").option("--app-secret <secret>", "existing Lark/Feishu app secret").option("--tenant <tenant>", "feishu or lark");
+}
 function buildProgram() {
   const program = new Command();
   program.name("dsh-lark-bot").description("Bridge DeepSeek Harness into Feishu / Lark").version(packageVersion(), "-v, --version");
-  program.command("start").description("Start the bridge in the foreground").option("--profile <name>", "profile name").option("--workspace <path>", "initial working directory").option("--app-id <id>", "existing Lark/Feishu app id").option("--app-secret <secret>", "existing Lark/Feishu app secret").option("--tenant <tenant>", "feishu or lark").action(async (opts) => {
-    await runStart(opts);
+  addBotOptions(
+    program.command("start").description("Install and start the background service (autostart + auto-restart)")
+  ).action(async (opts) => {
+    await runServiceStart(opts, { version: packageVersion() });
   });
+  addBotOptions(program.command("status").description("Show background service status")).action(
+    async (opts) => {
+      await runServiceCommand("status", opts, { version: packageVersion() });
+    }
+  );
+  addBotOptions(program.command("restart").description("Restart the background service")).action(
+    async (opts) => {
+      await runServiceCommand("restart", opts, { version: packageVersion() });
+    }
+  );
+  addBotOptions(program.command("stop").description("Stop the background service and remove autostart")).action(
+    async (opts) => {
+      await runServiceCommand("stop", opts, { version: packageVersion() });
+    }
+  );
   program.command("doctor").description("Run local diagnostics").option("--profile <name>", "profile name").option("--workspace <path>", "initial working directory").option("--app-id <id>", "existing Lark/Feishu app id").option("--app-secret <secret>", "existing Lark/Feishu app secret").option("--tenant <tenant>", "feishu or lark").action(async (opts) => {
     await runDoctor({ ...opts, version: packageVersion() });
   });
+  addBotOptions(
+    program.command("run", { hidden: true }).description("Run the bridge process (managed by the background service; not for interactive use)")
+  ).action(async (opts) => {
+    await runBot(opts);
+  });
+  addBotOptions(
+    program.command("supervise", { hidden: true }).description("Supervisor loop for the portable background service; not for interactive use")
+  ).action(async (opts) => {
+    await runSupervise(opts);
+  });
   return program;
 }
 async function main(argv = process.argv) {