dsh-lark-bot 0.4.0 → 0.5.0

package/dist/cli.js

@@ -584,7 +584,8 @@ var init_acp_adapter = __esm({
 });
 
 // src/cli.ts
-import { readFileSync } from "fs";
+import { readFileSync, realpathSync as realpathSync2 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command } from "commander";
 
 // src/cli/commands/doctor.ts
@@ -1521,9 +1522,9 @@ async function writeFileAtomic(target, data, options = {}) {
   }
 }
 async function rmSilently(path) {
-  const { rm: rm3 } = await import("fs/promises");
+  const { rm: rm4 } = await import("fs/promises");
   try {
-    await rm3(path, { force: true });
+    await rm4(path, { force: true });
   } catch {
   }
 }
@@ -1695,7 +1696,7 @@ async function runDoctor(options) {
 }
 
 // src/cli/commands/run.ts
-import { mkdir as mkdir7 } from "fs/promises";
+import { mkdir as mkdir8 } from "fs/promises";
 
 // src/bot/active-runs.ts
 var ActiveRuns = class {
@@ -1878,6 +1879,20 @@ var DensityStore = class {
   }
 };
 
+// src/bot/model-store.ts
+var ModelStore = class {
+  overrides = /* @__PURE__ */ new Map();
+  get(scope) {
+    return this.overrides.get(scope);
+  }
+  set(scope, model) {
+    this.overrides.set(scope, model);
+  }
+  clear(scope) {
+    return this.overrides.delete(scope);
+  }
+};
+
 // src/bot/pending-queue.ts
 var PendingQueue = class {
   constructor(quietMs, onFlush) {
@@ -2636,6 +2651,749 @@ function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/config/dsh-config.ts
+import { mkdir as mkdir5, readFile as readFile2, rm, writeFile as writeFile4 } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname3, join as join7 } from "path";
+import { Document, parseDocument } from "yaml";
+init_dsh_runtime();
+var DEEPSEEK_NAMESPACE = "llm-deepseek";
+var DEEPSEEK_PROVIDER = "deepseek-official";
+var DEEPSEEK_DEFAULT_API_KEY_ENV = "DEEPSEEK_API_KEY";
+var PIAI_NAMESPACE = "llm-pi-ai";
+var AGENT_DEFAULT_MODEL_NAMESPACE = "agent-default-model";
+var SUPPORTED_PI_AI_PROTOCOLS = [
+  "openai-completions",
+  "openai-responses",
+  "anthropic-messages"
+];
+var PROVIDER_ID_PATTERN = /^[a-z][a-z0-9._-]*$/;
+var CREDENTIAL_REF_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var DEFAULT_DEEPSEEK_MODELS = [
+  { id: "deepseek-v4-flash", name: "DeepSeek-V4-Flash", contextWindow: void 0, maxTokens: void 0 },
+  { id: "deepseek-v4-pro", name: "DeepSeek-V4-Pro", contextWindow: void 0, maxTokens: void 0 }
+];
+var LOCK_TIMEOUT_MS = 1e4;
+function isMapLike(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepEqualJson(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function parseModels(value) {
+  if (!Array.isArray(value)) return void 0;
+  const models = [];
+  for (const raw of value) {
+    if (!isMapLike(raw) || typeof raw.id !== "string" || raw.id.length === 0) continue;
+    models.push({
+      id: raw.id,
+      name: typeof raw.name === "string" ? raw.name : void 0,
+      contextWindow: typeof raw.contextWindow === "number" ? raw.contextWindow : void 0,
+      maxTokens: typeof raw.maxTokens === "number" ? raw.maxTokens : void 0
+    });
+  }
+  return models;
+}
+function rawModels(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((entry) => isMapLike(entry));
+}
+function modelRecord(input) {
+  const record = { id: input.id };
+  if (input.name !== void 0) record.name = input.name;
+  if (input.contextWindow !== void 0) record.contextWindow = input.contextWindow;
+  if (input.maxTokens !== void 0) record.maxTokens = input.maxTokens;
+  return record;
+}
+function validateProviderId(id) {
+  if (!PROVIDER_ID_PATTERN.test(id)) {
+    throw new Error(`provider id \u5FC5\u987B\u662F\u5C0F\u5199\u5B57\u6BCD\u5F00\u5934\u4E14\u4EC5\u542B a-z 0-9 . _ -\uFF0C\u5F97\u5230 "${id}"`);
+  }
+}
+function validateBaseUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`baseURL \u4E0D\u662F\u5408\u6CD5 URL\uFF1A${url}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`baseURL \u4EC5\u652F\u6301 http/https\uFF1A${url}`);
+  }
+}
+function assertProtocol(api) {
+  if (!SUPPORTED_PI_AI_PROTOCOLS.includes(api)) {
+    throw new Error(`\u4E0D\u652F\u6301\u7684 API \u534F\u8BAE "${api}"\uFF0C\u53EF\u9009\uFF1A${SUPPORTED_PI_AI_PROTOCOLS.join(" / ")}`);
+  }
+}
+function patchNode(document, path, current, next) {
+  if (isMapLike(current) && isMapLike(next)) {
+    for (const key of Object.keys(current)) {
+      if (!(key in next)) document.deleteIn([...path, key]);
+    }
+    for (const [key, value] of Object.entries(next)) {
+      patchNode(document, [...path, key], current[key], value);
+    }
+    return;
+  }
+  if (!deepEqualJson(current, next)) document.setIn([...path], next);
+}
+function parseYamlMap(text, filename) {
+  if (text === void 0 || text.trim().length === 0) return {};
+  const document = parseDocument(text, { prettyErrors: true });
+  if (document.errors.length > 0) {
+    throw new Error(`invalid dsh config at ${filename}: ${document.errors.map((e) => e.message).join("; ")}`);
+  }
+  const root = document.toJS() ?? {};
+  if (!isMapLike(root)) {
+    throw new TypeError(`dsh config ${filename} must be a mapping`);
+  }
+  return root;
+}
+async function readOptional(file) {
+  try {
+    return await readFile2(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+async function withFileLock(filename, operation) {
+  const lockPath = `${filename}.lock`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  for (; ; ) {
+    try {
+      await writeFile4(lockPath, `${process.pid}
+`, { flag: "wx" });
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) {
+        throw new Error(`dsh config lock timed out at ${lockPath}`);
+      }
+      await sleep(80 + Math.random() * 120);
+    }
+  }
+  try {
+    return await operation();
+  } finally {
+    await rm(lockPath, { force: true }).catch(() => void 0);
+  }
+}
+var DshProviderManager = class {
+  home;
+  env;
+  settingsFile;
+  credentialsFile;
+  constructor(options = {}) {
+    this.home = options.home ?? homedir5();
+    this.env = options.env ?? process.env;
+    const dshHome = resolveDshHome(this.home, this.env);
+    this.settingsFile = options.settingsFile ?? join7(dshHome, "settings.yaml");
+    this.credentialsFile = options.credentialsFile ?? join7(dshHome, ".credentials.yaml");
+  }
+  async readSettings() {
+    return parseYamlMap(await readOptional(this.settingsFile), this.settingsFile);
+  }
+  async readCredentials() {
+    const root = parseYamlMap(await readOptional(this.credentialsFile), this.credentialsFile);
+    const entries = {};
+    for (const [key, value] of Object.entries(root)) {
+      if (typeof value === "string" && value.length > 0) entries[key] = value;
+    }
+    return entries;
+  }
+  async hasCredential(ref) {
+    const entries = await this.readCredentials();
+    if (entries[ref]) return true;
+    return Boolean(this.env[ref]?.trim());
+  }
+  async listCredentialRefs() {
+    return Object.keys(await this.readCredentials());
+  }
+  async listProviders() {
+    const settings = await this.readSettings();
+    return [await this.describeDeepseek(settings), ...await this.describePiAi(settings)];
+  }
+  async describeDeepseek(settings) {
+    const deepseek = isMapLike(settings[DEEPSEEK_NAMESPACE]) ? settings[DEEPSEEK_NAMESPACE] : {};
+    const credentialRef = typeof deepseek.apiKeyEnv === "string" && deepseek.apiKeyEnv.length > 0 ? deepseek.apiKeyEnv : DEEPSEEK_DEFAULT_API_KEY_ENV;
+    return {
+      id: DEEPSEEK_PROVIDER,
+      displayName: "DeepSeek",
+      namespace: DEEPSEEK_NAMESPACE,
+      configured: Object.keys(deepseek).length > 0,
+      credentialRef,
+      credentialReady: await this.hasCredential(credentialRef),
+      models: parseModels(deepseek.models) ?? DEFAULT_DEEPSEEK_MODELS,
+      managed: true
+    };
+  }
+  async describePiAi(settings) {
+    const piAi = isMapLike(settings[PIAI_NAMESPACE]) ? settings[PIAI_NAMESPACE] : {};
+    const providers = isMapLike(piAi.providers) ? piAi.providers : {};
+    const summaries = [];
+    for (const [id, raw] of Object.entries(providers)) {
+      const profile = isMapLike(raw) ? raw : {};
+      const ref = typeof profile.apiKeyEnv === "string" && profile.apiKeyEnv.length > 0 ? profile.apiKeyEnv : void 0;
+      summaries.push({
+        id,
+        displayName: typeof profile.displayName === "string" ? profile.displayName : id,
+        namespace: PIAI_NAMESPACE,
+        configured: true,
+        credentialRef: ref,
+        credentialReady: ref === void 0 ? false : await this.hasCredential(ref),
+        models: parseModels(profile.models) ?? [],
+        managed: true
+      });
+    }
+    return summaries;
+  }
+  async defaultModel() {
+    const settings = await this.readSettings();
+    const section = settings[AGENT_DEFAULT_MODEL_NAMESPACE];
+    return isMapLike(section) && typeof section.model === "string" ? section.model : void 0;
+  }
+  async setDefaultModel(model) {
+    if (!model.trim()) throw new Error("\u9ED8\u8BA4\u6A21\u578B\u4E0D\u80FD\u4E3A\u7A7A");
+    await this.writeNamespace(AGENT_DEFAULT_MODEL_NAMESPACE, { model });
+  }
+  async upsertDeepseekProvider(input) {
+    const settings = await this.readSettings();
+    const current = isMapLike(settings[DEEPSEEK_NAMESPACE]) ? settings[DEEPSEEK_NAMESPACE] : {};
+    const section = { ...current };
+    if (input.baseURL !== void 0) {
+      validateBaseUrl(input.baseURL);
+      section.baseURL = input.baseURL;
+    }
+    if (input.apiKeyEnv !== void 0) section.apiKeyEnv = input.apiKeyEnv;
+    if (input.apiKey !== void 0) {
+      const ref = typeof section.apiKeyEnv === "string" && section.apiKeyEnv.length > 0 ? section.apiKeyEnv : DEEPSEEK_DEFAULT_API_KEY_ENV;
+      await this.setCredential(ref, input.apiKey);
+    }
+    await this.writeNamespace(DEEPSEEK_NAMESPACE, section);
+  }
+  async removeDeepseekProvider() {
+    const settings = await this.readSettings();
+    const section = isMapLike(settings[DEEPSEEK_NAMESPACE]) ? settings[DEEPSEEK_NAMESPACE] : {};
+    await this.deleteNamespace(DEEPSEEK_NAMESPACE);
+    await this.removeCredential(
+      typeof section.apiKeyEnv === "string" && section.apiKeyEnv.length > 0 ? section.apiKeyEnv : DEEPSEEK_DEFAULT_API_KEY_ENV
+    );
+  }
+  async addDeepseekModel(input) {
+    const settings = await this.readSettings();
+    const current = isMapLike(settings[DEEPSEEK_NAMESPACE]) ? settings[DEEPSEEK_NAMESPACE] : {};
+    const models = rawModels(current.models).length > 0 ? rawModels(current.models) : DEFAULT_DEEPSEEK_MODELS.map((model) => modelRecord(model));
+    if (models.some((model) => model.id === input.id)) {
+      throw new Error(`\u6A21\u578B ${input.id} \u5DF2\u5B58\u5728\u4E8E ${DEEPSEEK_PROVIDER}`);
+    }
+    await this.writeNamespace(DEEPSEEK_NAMESPACE, {
+      ...current,
+      models: [...models, modelRecord(input)]
+    });
+  }
+  async removeDeepseekModel(id) {
+    const settings = await this.readSettings();
+    const current = isMapLike(settings[DEEPSEEK_NAMESPACE]) ? settings[DEEPSEEK_NAMESPACE] : {};
+    const models = rawModels(current.models);
+    if (models.length === 0) return false;
+    const next = models.filter((model) => model.id !== id);
+    if (next.length === models.length) return false;
+    await this.writeNamespace(DEEPSEEK_NAMESPACE, { ...current, models: next });
+    return true;
+  }
+  async upsertPiAiProvider(input) {
+    validateProviderId(input.id);
+    const settings = await this.readSettings();
+    const piAi = isMapLike(settings[PIAI_NAMESPACE]) ? settings[PIAI_NAMESPACE] : {};
+    const providers = isMapLike(piAi.providers) ? piAi.providers : {};
+    const existing = isMapLike(providers[input.id]) ? providers[input.id] : void 0;
+    const section = existing === void 0 ? {} : { ...existing };
+    if (input.displayName !== void 0) section.displayName = input.displayName;
+    if (input.apiKeyEnv !== void 0) section.apiKeyEnv = input.apiKeyEnv;
+    if (input.api !== void 0) {
+      assertProtocol(input.api);
+      section.api = input.api;
+    }
+    if (input.baseURL !== void 0) {
+      validateBaseUrl(input.baseURL);
+      section.baseURL = input.baseURL;
+    }
+    if (input.models !== void 0) section.models = input.models.map(modelRecord);
+    if (existing === void 0) {
+      if (typeof section.api !== "string") {
+        throw new Error("\u65B0\u589E\u81EA\u5B9A\u4E49 provider \u5FC5\u987B\u6307\u5B9A --api\uFF08openai-completions / openai-responses / anthropic-messages\uFF09");
+      }
+      assertProtocol(section.api);
+      if (typeof section.baseURL !== "string") {
+        throw new Error("\u65B0\u589E\u81EA\u5B9A\u4E49 provider \u5FC5\u987B\u6307\u5B9A --base-url");
+      }
+      validateBaseUrl(section.baseURL);
+      const models = rawModels(section.models);
+      if (models.length === 0) {
+        throw new Error("\u65B0\u589E\u81EA\u5B9A\u4E49 provider \u81F3\u5C11\u9700\u8981\u4E00\u4E2A --model\uFF08models \u4E0D\u80FD\u4E3A\u7A7A\uFF09");
+      }
+      for (const model of models) {
+        if (typeof model.id !== "string" || model.id.length === 0) {
+          throw new Error(`--model \u7F3A\u5C11\u6709\u6548 id\uFF1A${JSON.stringify(model)}`);
+        }
+      }
+    }
+    await this.writeNamespace(PIAI_NAMESPACE, {
+      ...piAi,
+      providers: { ...providers, [input.id]: section }
+    });
+  }
+  async removePiAiProvider(id) {
+    const settings = await this.readSettings();
+    const piAi = isMapLike(settings[PIAI_NAMESPACE]) ? settings[PIAI_NAMESPACE] : {};
+    const providers = isMapLike(piAi.providers) ? piAi.providers : {};
+    if (!(id in providers)) return false;
+    const next = {};
+    for (const [key, value] of Object.entries(providers)) {
+      if (key !== id) next[key] = value;
+    }
+    if (Object.keys(next).length === 0) {
+      await this.deleteNamespace(PIAI_NAMESPACE);
+    } else {
+      await this.writeNamespace(PIAI_NAMESPACE, { ...piAi, providers: next });
+    }
+    return true;
+  }
+  async addPiAiModel(providerId, input) {
+    validateProviderId(providerId);
+    const settings = await this.readSettings();
+    const piAi = isMapLike(settings[PIAI_NAMESPACE]) ? settings[PIAI_NAMESPACE] : {};
+    const providers = isMapLike(piAi.providers) ? piAi.providers : {};
+    const section = isMapLike(providers[providerId]) ? providers[providerId] : void 0;
+    if (section === void 0) {
+      throw new Error(`provider ${providerId} \u4E0D\u5B58\u5728\uFF0C\u8BF7\u5148\u7528 /provider add \u521B\u5EFA`);
+    }
+    const models = rawModels(section.models);
+    if (models.some((model) => model.id === input.id)) {
+      throw new Error(`\u6A21\u578B ${input.id} \u5DF2\u5B58\u5728\u4E8E ${providerId}`);
+    }
+    await this.writeNamespace(PIAI_NAMESPACE, {
+      ...piAi,
+      providers: {
+        ...providers,
+        [providerId]: { ...section, models: [...models, modelRecord(input)] }
+      }
+    });
+  }
+  async removePiAiModel(providerId, modelId) {
+    const settings = await this.readSettings();
+    const piAi = isMapLike(settings[PIAI_NAMESPACE]) ? settings[PIAI_NAMESPACE] : {};
+    const providers = isMapLike(piAi.providers) ? piAi.providers : {};
+    const section = isMapLike(providers[providerId]) ? providers[providerId] : void 0;
+    if (section === void 0) {
+      throw new Error(`provider ${providerId} \u4E0D\u5B58\u5728`);
+    }
+    const models = rawModels(section.models);
+    const next = models.filter((model) => model.id !== modelId);
+    if (next.length === models.length) return false;
+    await this.writeNamespace(PIAI_NAMESPACE, {
+      ...piAi,
+      providers: {
+        ...providers,
+        [providerId]: { ...section, models: next }
+      }
+    });
+    return true;
+  }
+  async setCredential(ref, value) {
+    if (!CREDENTIAL_REF_PATTERN.test(ref)) {
+      throw new Error(`\u975E\u6CD5\u51ED\u636E\u5F15\u7528\u540D\uFF1A${ref}\uFF08\u5E94\u4E3A POSIX \u73AF\u5883\u53D8\u91CF\u540D\uFF0C\u5982 OPENAI_API_KEY\uFF09`);
+    }
+    if (value.length === 0) throw new Error("\u51ED\u636E\u503C\u4E0D\u80FD\u4E3A\u7A7A");
+    await mkdir5(dirname3(this.credentialsFile), { recursive: true, mode: 448 });
+    await withFileLock(this.credentialsFile, async () => {
+      const text = await readOptional(this.credentialsFile);
+      const root = parseYamlMap(text, this.credentialsFile);
+      const document = text === void 0 || text.trim().length === 0 ? new Document() : parseDocument(text);
+      if (document.errors.length > 0) {
+        throw new Error(`invalid dsh credentials at ${this.credentialsFile}`);
+      }
+      patchNode(document, [ref], root[ref], value);
+      await writeFileAtomic(this.credentialsFile, document.toString(), { mode: 384 });
+    });
+  }
+  async removeCredential(ref) {
+    let removed = false;
+    await withFileLock(this.credentialsFile, async () => {
+      const text = await readOptional(this.credentialsFile);
+      if (text === void 0 || text.trim().length === 0) return;
+      const document = parseDocument(text);
+      if (document.errors.length > 0) {
+        throw new Error(`invalid dsh credentials at ${this.credentialsFile}`);
+      }
+      if (document.has(ref)) {
+        document.deleteIn([ref]);
+        removed = true;
+        await writeFileAtomic(this.credentialsFile, document.toString(), { mode: 384 });
+      }
+    });
+    return removed;
+  }
+  async writeNamespace(ns, section) {
+    await mkdir5(dirname3(this.settingsFile), { recursive: true });
+    await withFileLock(this.settingsFile, async () => {
+      const text = await readOptional(this.settingsFile);
+      const root = parseYamlMap(text, this.settingsFile);
+      if (text === void 0 || text.trim().length === 0) {
+        await writeFileAtomic(this.settingsFile, new Document({ [ns]: section }).toString(), {});
+        return;
+      }
+      const document = parseDocument(text);
+      if (document.errors.length > 0) {
+        throw new Error(`invalid dsh settings at ${this.settingsFile}`);
+      }
+      patchNode(document, [ns], root[ns], section);
+      await writeFileAtomic(this.settingsFile, document.toString(), {});
+    });
+  }
+  async deleteNamespace(ns) {
+    await withFileLock(this.settingsFile, async () => {
+      const text = await readOptional(this.settingsFile);
+      if (text === void 0 || text.trim().length === 0) return;
+      const document = parseDocument(text);
+      if (document.errors.length > 0) {
+        throw new Error(`invalid dsh settings at ${this.settingsFile}`);
+      }
+      if (document.has(ns)) {
+        document.deleteIn([ns]);
+        await writeFileAtomic(this.settingsFile, document.toString(), {});
+      }
+    });
+  }
+};
+
+// src/commands/models.ts
+function parseArgs(input) {
+  const tokens = input.trim().split(/\s+/).filter(Boolean);
+  const positionals = [];
+  const flags = {};
+  const repeated = {};
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index] ?? "";
+    if (!token.startsWith("--")) {
+      positionals.push(token);
+      continue;
+    }
+    const name = token.slice(2);
+    const next = tokens[index + 1];
+    let value;
+    if (next !== void 0 && !next.startsWith("--")) {
+      value = next;
+      index += 1;
+    }
+    flags[name] = value;
+    if (value !== void 0) {
+      const list = repeated[name] ?? [];
+      list.push(value);
+      repeated[name] = list;
+    }
+  }
+  return { positionals, flags, repeated };
+}
+async function reply(ctx, markdown2) {
+  await ctx.channel.sendMarkdown(ctx.chatId, markdown2, {
+    replyTo: ctx.messageId
+  });
+}
+function requireAdmin(ctx) {
+  if (!ctx.accessManager.isAdmin(ctx.senderId)) {
+    void reply(ctx, "\u4EC5\u7BA1\u7406\u5458\u53EF\u6267\u884C\u8BE5\u64CD\u4F5C\u3002");
+    return false;
+  }
+  return true;
+}
+function formatModel(model) {
+  return model.name ? `\`${model.id}\` (${model.name})` : `\`${model.id}\``;
+}
+function credentialLabel(provider) {
+  if (provider.credentialReady) return "\u51ED\u636E\u5C31\u7EEA";
+  return provider.credentialRef === void 0 ? "\u672A\u914D\u7F6E\u51ED\u636E" : "\u51ED\u636E\u7F3A\u5931";
+}
+function formatProviders(providers) {
+  const lines = providers.map((provider) => {
+    const state = provider.configured ? "\u5DF2\u914D\u7F6E" : "\u672A\u914D\u7F6E";
+    const models = provider.models.length > 0 ? provider.models.map((model) => model.id).join(", ") : "(\u65E0)";
+    return `- **${provider.id}** (${provider.displayName}) \u2014 ${state} \xB7 ${credentialLabel(provider)}
+  models: ${models}`;
+  });
+  return lines.join("\n");
+}
+async function findModelOwner(ctx, id) {
+  const providers = await ctx.dshConfig.listProviders();
+  return providers.find((provider) => provider.models.some((model) => model.id === id));
+}
+function deepseekModelInput(args) {
+  return {
+    id: args.id,
+    name: args.flags.name,
+    contextWindow: void 0,
+    maxTokens: void 0
+  };
+}
+async function handleModel(args, ctx) {
+  const { positionals, flags } = parseArgs(args);
+  const [sub, ...rest] = positionals;
+  if (!sub) {
+    const active = ctx.models.get(ctx.scope) ?? ctx.defaultModel;
+    const dshDefault = await ctx.dshConfig.defaultModel();
+    const providers = await ctx.dshConfig.listProviders();
+    const modelLines = providers.flatMap(
+      (provider) => provider.models.map((model) => `- ${formatModel(model)} \u2190 ${provider.id}`)
+    );
+    await reply(
+      ctx,
+      [
+        `**\u5F53\u524D\u4F1A\u8BDD\u6A21\u578B**\uFF1A\`${active}\``,
+        `**dsh \u9ED8\u8BA4\u6A21\u578B**\uFF08agent-default-model\uFF09\uFF1A\`${dshDefault ?? "(\u672A\u8BBE\u7F6E)"}\``,
+        `**bot \u56DE\u9000\u9ED8\u8BA4**\uFF08profile / DSH_LARK_MODEL\uFF09\uFF1A\`${ctx.defaultModel}\``,
+        "",
+        "**\u53EF\u7528\u6A21\u578B**\uFF08dsh \u5DF2\u914D\u7F6E\uFF09\uFF1A",
+        ...modelLines.length > 0 ? modelLines : ["\uFF08\u6682\u65E0\uFF09"],
+        "",
+        "\u7528\u6CD5\uFF1A`/model use <id>`\u3001`/model default <id>`\u3001`/model reset`\u3001`/model add|remove <provider> <modelId> [--name <name>]`"
+      ].join("\n")
+    );
+    return;
+  }
+  if (sub === "use") {
+    const id = rest.join(" ").trim();
+    if (!id) {
+      await reply(ctx, "\u7528\u6CD5\uFF1A`/model use <modelId>`");
+      return;
+    }
+    const provider = await findModelOwner(ctx, id);
+    if (!provider) {
+      await reply(ctx, `\u672A\u627E\u5230\u6A21\u578B \`${id}\`\uFF0C\u53EF\u7528 /model \u67E5\u770B\u5217\u8868\u3002`);
+      return;
+    }
+    ctx.models.set(ctx.scope, id);
+    await reply(ctx, `\u5DF2\u70ED\u5207\u6362\u5F53\u524D\u4F1A\u8BDD\u6A21\u578B\uFF1A\`${id}\`\uFF08\u4E0B\u4E00\u8F6E\u6D88\u606F\u751F\u6548\uFF0C\u65E0\u9700\u91CD\u542F bot\uFF09\u3002`);
+    return;
+  }
+  if (sub === "reset") {
+    const cleared = ctx.models.clear(ctx.scope);
+    await reply(ctx, cleared ? "\u5DF2\u6E05\u9664\u5F53\u524D\u4F1A\u8BDD\u6A21\u578B\u8986\u76D6\uFF0C\u6062\u590D bot \u9ED8\u8BA4\u6A21\u578B\u3002" : "\u5F53\u524D\u4F1A\u8BDD\u6CA1\u6709\u6A21\u578B\u8986\u76D6\u3002");
+    return;
+  }
+  if (sub === "default") {
+    const id = rest.join(" ").trim();
+    if (!id) {
+      await reply(ctx, "\u7528\u6CD5\uFF1A`/model default <modelId>`");
+      return;
+    }
+    const provider = await findModelOwner(ctx, id);
+    if (!provider) {
+      await reply(ctx, `\u672A\u627E\u5230\u6A21\u578B \`${id}\`\uFF0C\u53EF\u7528 /model \u67E5\u770B\u5217\u8868\u3002`);
+      return;
+    }
+    if (!requireAdmin(ctx)) return;
+    await ctx.dshConfig.setDefaultModel(id);
+    await reply(ctx, `\u5DF2\u5199\u5165 dsh \u9ED8\u8BA4\u6A21\u578B\uFF08agent-default-model\uFF09\uFF1A\`${id}\`\uFF0C\u65B0\u4F1A\u8BDD\u751F\u6548\u3002`);
+    return;
+  }
+  if (sub === "add" || sub === "remove") {
+    if (!requireAdmin(ctx)) return;
+    const providerId = rest[0];
+    const id = rest[1];
+    if (!providerId || !id) {
+      await reply(ctx, `\u7528\u6CD5\uFF1A\`/model ${sub} <provider> <modelId> [--name <name>]\``);
+      return;
+    }
+    if (sub === "add") {
+      if (providerId === DEEPSEEK_PROVIDER) {
+        await ctx.dshConfig.addDeepseekModel(deepseekModelInput({ id, flags }));
+        await reply(ctx, `\u5DF2\u6DFB\u52A0\u6A21\u578B\uFF1A\`${providerId}\` \u2192 \`${id}\`\uFF08settings.yaml \u5DF2\u66F4\u65B0\uFF0C\u4E0B\u4E00\u8BF7\u6C42\u751F\u6548\uFF09\u3002`);
+      } else {
+        await ctx.dshConfig.addPiAiModel(providerId, deepseekModelInput({ id, flags }));
+        await reply(ctx, `\u5DF2\u6DFB\u52A0\u6A21\u578B\uFF1A\`${providerId}\` \u2192 \`${id}\`\uFF08settings.yaml \u5DF2\u66F4\u65B0\uFF0C\u4E0B\u4E00\u8BF7\u6C42\u751F\u6548\uFF09\u3002`);
+      }
+    } else if (providerId === DEEPSEEK_PROVIDER) {
+      const removed = await ctx.dshConfig.removeDeepseekModel(id);
+      await reply(ctx, removed ? `\u5DF2\u5220\u9664\u6A21\u578B\uFF1A\`${providerId}\` \u2192 \`${id}\`\u3002` : `\u672A\u627E\u5230\u6A21\u578B\uFF1A\`${id}\`\u3002`);
+    } else {
+      const removed = await ctx.dshConfig.removePiAiModel(providerId, id);
+      await reply(ctx, removed ? `\u5DF2\u5220\u9664\u6A21\u578B\uFF1A\`${providerId}\` \u2192 \`${id}\`\u3002` : `\u672A\u627E\u5230\u6A21\u578B\uFF1A\`${id}\`\u3002`);
+    }
+    return;
+  }
+  await reply(ctx, "\u672A\u77E5 `/model` \u5B50\u547D\u4EE4\uFF0C\u8BF7\u4F7F\u7528 use / default / reset / add / remove\u3002");
+}
+async function handleProviders(_args, ctx) {
+  const providers = await ctx.dshConfig.listProviders();
+  const dshDefault = await ctx.dshConfig.defaultModel();
+  await reply(
+    ctx,
+    [
+      "**dsh \u5DF2\u914D\u7F6E providers**",
+      "",
+      ...formatProviders(providers).split("\n"),
+      "",
+      `dsh \u9ED8\u8BA4\u6A21\u578B\uFF1A\`${dshDefault ?? "(\u672A\u8BBE\u7F6E)"}\``,
+      "",
+      "\u7BA1\u7406\uFF1A`/provider add|update|remove`\u3001`/model add|remove`\u3001`/key set|remove`\uFF08\u9700\u7BA1\u7406\u5458\uFF09"
+    ].join("\n")
+  );
+}
+async function handleProvider(args, ctx) {
+  const { positionals, flags, repeated } = parseArgs(args);
+  const [sub, id] = positionals;
+  if ((sub === "add" || sub === "update") && id) {
+    if (!requireAdmin(ctx)) return;
+    const deepseekFlags = ["base-url", "api-key-env", "api-key"];
+    const piAiFlags = [
+      "display-name",
+      "api-key-env",
+      "api",
+      "base-url",
+      "model"
+    ];
+    const provided = /* @__PURE__ */ new Set([...Object.keys(flags), ...Object.keys(repeated)]);
+    if (id === DEEPSEEK_PROVIDER) {
+      const unsupported2 = [...provided].filter((name) => !deepseekFlags.includes(name));
+      if (unsupported2.length > 0) {
+        await reply(ctx, `\`deepseek-official\` \u4EC5\u652F\u6301 ${deepseekFlags.map((name) => `--${name}`).join(" / ")}\uFF0C\u4E0D\u652F\u6301\u7684\u53C2\u6570\uFF1A${unsupported2.map((name) => `--${name}`).join("\u3001")}`);
+        return;
+      }
+      if (provided.size === 0) {
+        await reply(ctx, "\u7528\u6CD5\uFF1A`/provider add|update deepseek-official --base-url <url> [--api-key-env <ref>] [--api-key <key>]`");
+        return;
+      }
+      await ctx.dshConfig.upsertDeepseekProvider({
+        ...flags["base-url"] ? { baseURL: flags["base-url"] } : {},
+        ...flags["api-key-env"] ? { apiKeyEnv: flags["api-key-env"] } : {},
+        ...flags["api-key"] ? { apiKey: flags["api-key"] } : {}
+      });
+      await reply(
+        ctx,
+        `\u5DF2${sub === "add" ? "\u6DFB\u52A0/\u66F4\u65B0" : "\u66F4\u65B0"} provider\uFF1A\`${id}\`\u3002\u51ED\u636E${flags["api-key"] ? "\u5DF2\u5199\u5165 .credentials.yaml\uFF08\u503C\u5DF2\u9690\u85CF\uFF09" : "\u4E0D\u53D8"}\uFF1B\u5176\u4ED6\u5B57\u6BB5\u6309\u53C2\u6570\u66F4\u65B0\u3002`
+      );
+      return;
+    }
+    const unsupported = [...provided].filter((name) => !piAiFlags.includes(name));
+    if (unsupported.length > 0) {
+      await reply(ctx, `\u4E0D\u652F\u6301\u7684\u53C2\u6570\uFF1A${unsupported.map((name) => `--${name}`).join("\u3001")}\u3002\u53EF\u7528\uFF1A${piAiFlags.map((name) => `--${name}`).join(" / ")}`);
+      return;
+    }
+    if (provided.size === 0) {
+      await reply(ctx, "\u7528\u6CD5\uFF1A`/provider add|update <id> --api <protocol> --base-url <url> --model <modelId> [--display-name <name>] [--api-key-env <ref>]`");
+      return;
+    }
+    const models = (repeated.model ?? []).map((modelId) => ({
+      id: modelId,
+      name: void 0,
+      contextWindow: void 0,
+      maxTokens: void 0
+    }));
+    try {
+      await ctx.dshConfig.upsertPiAiProvider({
+        id,
+        ...flags["display-name"] ? { displayName: flags["display-name"] } : {},
+        ...flags["api-key-env"] ? { apiKeyEnv: flags["api-key-env"] } : {},
+        ...flags.api ? { api: flags.api } : {},
+        ...flags["base-url"] ? { baseURL: flags["base-url"] } : {},
+        ...models.length > 0 ? { models } : {}
+      });
+      const protocolNote = flags.api ? `\u534F\u8BAE \`${flags.api}\`` : "\u534F\u8BAE\u4E0D\u53D8";
+      const modelNote = models.length > 0 ? `\uFF0Cmodels \u5DF2${sub === "add" ? "\u5199\u5165" : "\u66FF\u6362\u4E3A"} ${models.length} \u4E2A` : "";
+      await reply(
+        ctx,
+        [
+          `\u5DF2${sub === "add" ? "\u6DFB\u52A0" : "\u66F4\u65B0"} provider\uFF1A\`${id}\`\uFF08${protocolNote}${modelNote}\uFF09\u3002`,
+          "",
+          "\u51ED\u636E\u8BF7\u7528 `/key set <\u5F15\u7528\u540D> <\u503C>` \u5199\u5165\uFF08\u6216\u914D\u7F6E\u5BF9\u5E94\u73AF\u5883\u53D8\u91CF\uFF09\uFF0C\u5BC6\u94A5\u4E0D\u4F1A\u663E\u793A\u5728\u804A\u5929\u4E2D\u3002",
+          `\u534F\u8BAE\u53EF\u9009\uFF1A${SUPPORTED_PI_AI_PROTOCOLS.join(" / ")}`
+        ].join("\n")
+      );
+    } catch (error) {
+      await reply(ctx, `\u64CD\u4F5C\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
+    }
+    return;
+  }
+  if (sub === "remove" && id) {
+    if (!requireAdmin(ctx)) return;
+    if (id === DEEPSEEK_PROVIDER) {
+      await ctx.dshConfig.removeDeepseekProvider();
+      await reply(
+        ctx,
+        `\u5DF2\u5220\u9664 provider\uFF1A\`${id}\`\uFF08\u542B settings \u4E2D llm-deepseek \u6BB5\u53CA\u5BF9\u5E94\u51ED\u636E\uFF09\u3002\u6B64\u64CD\u4F5C\u4F1A\u79FB\u9664 dsh \u5B98\u65B9 DeepSeek \u914D\u7F6E\uFF0C\u8BF7\u8C28\u614E\u3002`
+      );
+      return;
+    }
+    const removed = await ctx.dshConfig.removePiAiProvider(id);
+    await reply(ctx, removed ? `\u5DF2\u5220\u9664 provider\uFF1A\`${id}\`\uFF08settings.yaml \u5DF2\u66F4\u65B0\uFF09\u3002` : `\u672A\u627E\u5230 provider\uFF1A\`${id}\`\u3002`);
+    return;
+  }
+  await reply(
+    ctx,
+    [
+      "\u7528\u6CD5\uFF1A",
+      "- `/provider add <id> --api <protocol> --base-url <url> --model <modelId> [--model <modelId> ...] [--display-name <name>] [--api-key-env <ref>]`",
+      "- `/provider update <id> [--api <protocol>] [--base-url <url>] [--model <modelId> ...] [--display-name <name>] [--api-key-env <ref>]`",
+      "- `/provider remove <id>`",
+      "",
+      `\`deepseek-official\` \u4EC5\u652F\u6301 --base-url / --api-key-env / --api-key\uFF1B\u5176\u4ED6 id \u8D70 llm-pi-ai \u81EA\u5B9A\u4E49 provider\uFF08\u534F\u8BAE\u53EF\u9009\uFF1A${SUPPORTED_PI_AI_PROTOCOLS.join(" / ")}\uFF09\u3002`
+    ].join("\n")
+  );
+}
+async function handleKey(args, ctx) {
+  const { positionals } = parseArgs(args);
+  const [sub, ...rest] = positionals;
+  if (!sub || sub === "list") {
+    const refs = await ctx.dshConfig.listCredentialRefs();
+    await reply(
+      ctx,
+      [
+        "**dsh \u51ED\u636E**\uFF08\u4EC5\u663E\u793A\u5F15\u7528\u540D\uFF0C\u4E0D\u663E\u793A\u503C\uFF09\uFF1A",
+        ...refs.length > 0 ? refs.map((ref) => `- \`${ref}\``) : ["\uFF08.credentials.yaml \u6682\u65E0\u6761\u76EE\uFF09"],
+        "",
+        "\u63D0\u793A\uFF1A\u73AF\u5883\u53D8\u91CF\u4E2D\u7684\u51ED\u636E\u4E0D\u4F1A\u663E\u793A\u5728\u8FD9\u91CC\uFF1Bprovider \u7684 apiKeyEnv \u53EF\u5F15\u7528\u4EFB\u610F\u73AF\u5883\u53D8\u91CF\u3002"
+      ].join("\n")
+    );
+    return;
+  }
+  if (!requireAdmin(ctx)) return;
+  if (sub === "set") {
+    const ref = rest[0];
+    const value = rest.slice(1).join(" ").trim();
+    if (!ref || !value) {
+      await reply(ctx, "\u7528\u6CD5\uFF1A`/key set <\u5F15\u7528\u540D> <\u503C>`");
+      return;
+    }
+    try {
+      await ctx.dshConfig.setCredential(ref, value);
+    } catch (error) {
+      await reply(ctx, `\u5199\u5165\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
+      return;
+    }
+    await reply(
+      ctx,
+      `\u5DF2\u5199\u5165\u51ED\u636E \`${ref}\` \u5230 \`~/.dsh/.credentials.yaml\`\uFF080600\uFF0C\u503C\u5DF2\u9690\u85CF\uFF09\u3002\u5EFA\u8BAE\u5728\u79C1\u804A\u4E2D\u4F7F\u7528\uFF1B\u7FA4\u804A\u91CC\u7C98\u8D34\u7684\u5BC6\u94A5\u4F1A\u5BF9\u7FA4\u6210\u5458\u53EF\u89C1\u3002`
+    );
+    return;
+  }
+  if (sub === "remove") {
+    const ref = rest[0];
+    if (!ref) {
+      await reply(ctx, "\u7528\u6CD5\uFF1A`/key remove <\u5F15\u7528\u540D>`");
+      return;
+    }
+    const removed = await ctx.dshConfig.removeCredential(ref);
+    await reply(ctx, removed ? `\u5DF2\u5220\u9664\u51ED\u636E \`${ref}\`\u3002` : `\u672A\u627E\u5230\u51ED\u636E \`${ref}\`\u3002`);
+    return;
+  }
+  await reply(ctx, "\u7528\u6CD5\uFF1A`/key set <\u5F15\u7528\u540D> <\u503C>`\u3001`/key remove <\u5F15\u7528\u540D>`\u3001`/key list`");
+}
+
 // src/commands/index.ts
 var HELP = [
   "**dsh-lark-bot \u547D\u4EE4**",
@@ -2648,11 +3406,18 @@ var HELP = [
   "- `/stop` \u2014 \u7EC8\u6B62\u5F53\u524D\u4EFB\u52A1",
   "- `/timeout [N|off|default]` \u2014 \u67E5\u770B\u6216\u8BBE\u7F6E\u5F53\u524D\u4F1A\u8BDD\u8FD0\u884C\u8D85\u65F6",
   "- `/density [compact|standard|detailed]` \u2014 \u67E5\u770B\u6216\u8BBE\u7F6E\u5361\u7247\u5BC6\u5EA6",
+  "- `/model` \u2014 \u67E5\u770B\u5F53\u524D\u6A21\u578B\u4E0E dsh \u53EF\u7528\u6A21\u578B",
+  "- `/model use <id>` \u2014 \u70ED\u5207\u6362\u5F53\u524D\u4F1A\u8BDD\u6A21\u578B\uFF08\u4E0B\u4E00\u8F6E\u751F\u6548\uFF09",
+  "- `/model default <id>` \u2014 \u5199\u5165 dsh \u9ED8\u8BA4\u6A21\u578B agent-default-model\uFF08\u7BA1\u7406\u5458\uFF09",
+  "- `/model add|remove <provider> <modelId>` \u2014 \u7BA1\u7406 provider \u7684\u6A21\u578B\uFF08\u7BA1\u7406\u5458\uFF09",
+  "- `/providers` \u2014 \u67E5\u770B dsh providers / \u6A21\u578B / \u51ED\u636E\u72B6\u6001",
+  "- `/provider add|update|remove <id>` \u2014 \u7BA1\u7406 provider\uFF08\u7BA1\u7406\u5458\uFF1Bdeepseek-official \u4E0E\u81EA\u5B9A\u4E49 pi-ai\uFF09",
+  "- `/key set|remove|list <\u5F15\u7528\u540D>` \u2014 \u7BA1\u7406 dsh \u51ED\u636E\uFF08set/remove \u9700\u7BA1\u7406\u5458\uFF09",
   "- `/ask <\u95EE\u9898>` \u2014 \u53D1\u9001\u7ED3\u6784\u5316\u95EE\u7B54\u5361\uFF08\u56DE\u7B54\u5C06\u8BB0\u5165\u4F1A\u8BDD\uFF09",
   "- `/invite user|admin|group <id>` \u2014 \u7BA1\u7406\u8BBF\u95EE\u767D\u540D\u5355",
   "- `/help` \u2014 \u663E\u793A\u672C\u5E2E\u52A9"
 ].join("\n");
-async function reply(ctx, markdown2) {
+async function reply2(ctx, markdown2) {
   await ctx.channel.sendMarkdown(ctx.chatId, markdown2, {
     replyTo: ctx.messageId
   });
@@ -2660,19 +3425,19 @@ async function reply(ctx, markdown2) {
 async function handleNew(_args, ctx) {
   const wasRunning = await ctx.activeRuns.interrupt(ctx.scope);
   ctx.sessions.clear(ctx.scope);
-  await reply(ctx, wasRunning ? "\u5DF2\u4E2D\u65AD\u5F53\u524D\u4EFB\u52A1\u5E76\u5F00\u59CB\u65B0\u4F1A\u8BDD\u3002" : "\u5DF2\u5F00\u59CB\u65B0\u4F1A\u8BDD\u3002");
+  await reply2(ctx, wasRunning ? "\u5DF2\u4E2D\u65AD\u5F53\u524D\u4EFB\u52A1\u5E76\u5F00\u59CB\u65B0\u4F1A\u8BDD\u3002" : "\u5DF2\u5F00\u59CB\u65B0\u4F1A\u8BDD\u3002");
 }
 async function handleCd(args, ctx) {
   const path = args.trim();
   if (!path) {
-    await reply(ctx, "\u7528\u6CD5\uFF1A`/cd <path>`");
+    await reply2(ctx, "\u7528\u6CD5\uFF1A`/cd <path>`");
     return;
   }
   const cwd = resolve4(path);
   await ctx.activeRuns.interrupt(ctx.scope);
   ctx.workspaces.setCwd(ctx.scope, cwd);
   ctx.sessions.clear(ctx.scope);
-  await reply(ctx, `\u5DF2\u5207\u6362\u5DE5\u4F5C\u76EE\u5F55\uFF1A\`${cwd}\`\uFF0C\u4F1A\u8BDD\u5DF2\u91CD\u7F6E\u3002`);
+  await reply2(ctx, `\u5DF2\u5207\u6362\u5DE5\u4F5C\u76EE\u5F55\uFF1A\`${cwd}\`\uFF0C\u4F1A\u8BDD\u5DF2\u91CD\u7F6E\u3002`);
 }
 async function handleWs(args, ctx) {
   const [sub, ...rest] = args.trim().split(/\s+/);
@@ -2688,7 +3453,7 @@ async function handleWs(args, ctx) {
     const lines = Object.entries(named).map(
       ([key, value]) => `- **${key}** \u2192 \`${value}\`${value === current ? " \u2190 \u5F53\u524D" : ""}`
     );
-    await reply(
+    await reply2(
       ctx,
       [
         `\u5F53\u524D cwd\uFF1A\`${current}\``,
@@ -2700,48 +3465,48 @@ async function handleWs(args, ctx) {
   }
   if (sub === "save") {
     if (!name) {
-      await reply(ctx, "\u7528\u6CD5\uFF1A`/ws save <name>`");
+      await reply2(ctx, "\u7528\u6CD5\uFF1A`/ws save <name>`");
       return;
     }
     const current = ctx.workspaces.cwdFor(ctx.scope) ?? ctx.defaultWorkspace;
     ctx.workspaces.saveNamed(name, current);
-    await reply(ctx, `\u5DF2\u4FDD\u5B58\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}** \u2192 \`${current}\``);
+    await reply2(ctx, `\u5DF2\u4FDD\u5B58\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}** \u2192 \`${current}\``);
     return;
   }
   if (sub === "use") {
     if (!name) {
-      await reply(ctx, "\u7528\u6CD5\uFF1A`/ws use <name>`");
+      await reply2(ctx, "\u7528\u6CD5\uFF1A`/ws use <name>`");
       return;
     }
     const cwd = ctx.workspaces.getNamed(name);
     if (!cwd) {
-      await reply(ctx, `\u672A\u627E\u5230\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}**`);
+      await reply2(ctx, `\u672A\u627E\u5230\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}**`);
       return;
     }
     await ctx.activeRuns.interrupt(ctx.scope);
     ctx.workspaces.setCwd(ctx.scope, cwd);
     ctx.workspaces.touchNamed(name);
     ctx.sessions.clear(ctx.scope);
-    await reply(ctx, `\u5DF2\u5207\u6362\u5230\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}** \u2192 \`${cwd}\``);
+    await reply2(ctx, `\u5DF2\u5207\u6362\u5230\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}** \u2192 \`${cwd}\``);
     return;
   }
   if (sub === "remove") {
     if (!name) {
-      await reply(ctx, "\u7528\u6CD5\uFF1A`/ws remove <name>`");
+      await reply2(ctx, "\u7528\u6CD5\uFF1A`/ws remove <name>`");
       return;
     }
     const removed = ctx.workspaces.removeNamed(name);
-    await reply(ctx, removed ? `\u5DF2\u5220\u9664\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}**` : `\u672A\u627E\u5230\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}**`);
+    await reply2(ctx, removed ? `\u5DF2\u5220\u9664\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}**` : `\u672A\u627E\u5230\u5DE5\u4F5C\u7A7A\u95F4\uFF1A**${name}**`);
     return;
   }
-  await reply(ctx, "\u672A\u77E5 `/ws` \u5B50\u547D\u4EE4\uFF0C\u8BF7\u4F7F\u7528 list / save / use / remove\u3002");
+  await reply2(ctx, "\u672A\u77E5 `/ws` \u5B50\u547D\u4EE4\uFF0C\u8BF7\u4F7F\u7528 list / save / use / remove\u3002");
 }
 async function handleStatus(_args, ctx) {
   const cwd = ctx.workspaces.cwdFor(ctx.scope) ?? ctx.defaultWorkspace;
   const session = ctx.sessions.getRaw(ctx.scope)?.sessionId ?? "(\u65E0)";
   const running = Boolean(ctx.activeRuns.get(ctx.scope));
   const scopeLabel = ctx.chatMode === "topic" ? `${ctx.scope}\uFF08\u8BDD\u9898\u72EC\u7ACB session\uFF09` : ctx.scope;
-  await reply(
+  await reply2(
     ctx,
     [
       `\u{1F9ED} **scope**: \`${scopeLabel}\``,
@@ -2755,25 +3520,25 @@ async function handleResume(_args, ctx) {
   const cwd = ctx.workspaces.cwdFor(ctx.scope) ?? ctx.defaultWorkspace;
   const history = ctx.sessions.historyFor(ctx.scope, cwd);
   if (history.length === 0) {
-    await reply(ctx, "\u5F53\u524D\u4F1A\u8BDD\u6CA1\u6709\u5386\u53F2\u4E0A\u4E0B\u6587\u3002");
+    await reply2(ctx, "\u5F53\u524D\u4F1A\u8BDD\u6CA1\u6709\u5386\u53F2\u4E0A\u4E0B\u6587\u3002");
     return;
   }
   const recent = history.slice(-6).map((message) => {
     const speaker = message.role === "user" ? "\u{1F464}" : "\u{1F916}";
     return `${speaker} ${message.content.slice(0, 300)}`;
   });
-  await reply(ctx, [`\u5F53\u524D scope\uFF1A\`${ctx.scope}\``, "", ...recent].join("\n"));
+  await reply2(ctx, [`\u5F53\u524D scope\uFF1A\`${ctx.scope}\``, "", ...recent].join("\n"));
 }
 async function handleStop(_args, ctx) {
   const stopped = await ctx.activeRuns.interrupt(ctx.scope);
-  await reply(ctx, stopped ? "\u5DF2\u8BF7\u6C42\u7EC8\u6B62\u5F53\u524D\u4EFB\u52A1\u3002" : "\u5F53\u524D\u6CA1\u6709\u8FD0\u884C\u4E2D\u7684\u4EFB\u52A1\u3002");
+  await reply2(ctx, stopped ? "\u5DF2\u8BF7\u6C42\u7EC8\u6B62\u5F53\u524D\u4EFB\u52A1\u3002" : "\u5F53\u524D\u6CA1\u6709\u8FD0\u884C\u4E2D\u7684\u4EFB\u52A1\u3002");
 }
 async function handleTimeout(args, ctx) {
   const input = args.trim();
   const effectiveMs = ctx.runPolicies.get(ctx.scope) ?? ctx.defaultRunTimeoutMs;
   if (!input) {
     const minutes2 = effectiveMs > 0 ? Math.round(effectiveMs / 6e4) : 0;
-    await reply(
+    await reply2(
       ctx,
       minutes2 > 0 ? `\u5F53\u524D\u4F1A\u8BDD\u8FD0\u884C\u8D85\u65F6\uFF1A${minutes2} \u5206\u949F\u3002\u53EF\u7528 \`/timeout <N|off|default>\` \u8C03\u6574\u3002` : "\u5F53\u524D\u4F1A\u8BDD\u8FD0\u884C\u8D85\u65F6\uFF1A\u5173\u95ED\u3002"
     );
@@ -2781,27 +3546,27 @@ async function handleTimeout(args, ctx) {
   }
   if (input === "off") {
     ctx.runPolicies.set(ctx.scope, 0);
-    await reply(ctx, "\u5DF2\u5173\u95ED\u5F53\u524D\u4F1A\u8BDD\u8FD0\u884C\u8D85\u65F6\u3002");
+    await reply2(ctx, "\u5DF2\u5173\u95ED\u5F53\u524D\u4F1A\u8BDD\u8FD0\u884C\u8D85\u65F6\u3002");
     return;
   }
   if (input === "default") {
     ctx.runPolicies.clear(ctx.scope);
-    await reply(ctx, "\u5DF2\u6062\u590D\u9ED8\u8BA4\u8FD0\u884C\u8D85\u65F6\u3002");
+    await reply2(ctx, "\u5DF2\u6062\u590D\u9ED8\u8BA4\u8FD0\u884C\u8D85\u65F6\u3002");
     return;
   }
   const minutes = Number(input);
   if (!Number.isInteger(minutes) || minutes <= 0) {
-    await reply(ctx, "\u7528\u6CD5\uFF1A`/timeout <N|off|default>`\uFF0CN \u4E3A\u5927\u4E8E 0 \u7684\u5206\u949F\u6570\u3002");
+    await reply2(ctx, "\u7528\u6CD5\uFF1A`/timeout <N|off|default>`\uFF0CN \u4E3A\u5927\u4E8E 0 \u7684\u5206\u949F\u6570\u3002");
     return;
   }
   ctx.runPolicies.set(ctx.scope, minutes * 6e4);
-  await reply(ctx, `\u5DF2\u8BBE\u7F6E\u5F53\u524D\u4F1A\u8BDD\u8FD0\u884C\u8D85\u65F6\uFF1A${minutes} \u5206\u949F\u3002`);
+  await reply2(ctx, `\u5DF2\u8BBE\u7F6E\u5F53\u524D\u4F1A\u8BDD\u8FD0\u884C\u8D85\u65F6\uFF1A${minutes} \u5206\u949F\u3002`);
 }
 async function handleDensity(args, ctx) {
   const input = args.trim().toLowerCase();
   if (!input) {
     const current = ctx.densityStore?.get(ctx.scope) ?? "standard";
-    await reply(
+    await reply2(
       ctx,
       `\u5F53\u524D\u5361\u7247\u5BC6\u5EA6\uFF1A**${current}**\u3002\u53EF\u7528 \`/density compact|standard|detailed\` \u8C03\u6574\u3002`
     );
@@ -2809,25 +3574,25 @@ async function handleDensity(args, ctx) {
   }
   if (input === "default") {
     ctx.densityStore?.clear(ctx.scope);
-    await reply(ctx, "\u5DF2\u6062\u590D\u9ED8\u8BA4\u5361\u7247\u5BC6\u5EA6\u3002");
+    await reply2(ctx, "\u5DF2\u6062\u590D\u9ED8\u8BA4\u5361\u7247\u5BC6\u5EA6\u3002");
     return;
   }
   const density = parseCardDensity(input);
   if (!density) {
-    await reply(ctx, "\u7528\u6CD5\uFF1A`/density [compact|standard|detailed|default]`");
+    await reply2(ctx, "\u7528\u6CD5\uFF1A`/density [compact|standard|detailed|default]`");
     return;
   }
   ctx.densityStore?.set(ctx.scope, density);
-  await reply(ctx, `\u5DF2\u8BBE\u7F6E\u5F53\u524D\u4F1A\u8BDD\u5361\u7247\u5BC6\u5EA6\uFF1A**${density}**\u3002`);
+  await reply2(ctx, `\u5DF2\u8BBE\u7F6E\u5F53\u524D\u4F1A\u8BDD\u5361\u7247\u5BC6\u5EA6\uFF1A**${density}**\u3002`);
 }
 async function handleAsk(args, ctx) {
   const question = args.trim();
   if (!question) {
-    await reply(ctx, "\u7528\u6CD5\uFF1A`/ask <\u95EE\u9898>`");
+    await reply2(ctx, "\u7528\u6CD5\uFF1A`/ask <\u95EE\u9898>`");
     return;
   }
   if (!ctx.questions) {
-    await reply(ctx, "\u95EE\u7B54\u5361\u672A\u542F\u7528\uFF08\u8BF7\u786E\u8BA4 questions \u5DF2\u63A5\u7EBF\uFF09\u3002");
+    await reply2(ctx, "\u95EE\u7B54\u5361\u672A\u542F\u7528\uFF08\u8BF7\u786E\u8BA4 questions \u5DF2\u63A5\u7EBF\uFF09\u3002");
     return;
   }
   const answer = await questionHandlerFor({
@@ -2843,9 +3608,9 @@ async function handleAsk(args, ctx) {
   if (answer !== void 0) {
     const text = Array.isArray(answer) ? answer.join("\u3001") : answer;
     ctx.sessions.recordExchange(ctx.scope, ctx.workspaces.cwdFor(ctx.scope) ?? ctx.defaultWorkspace, [text], void 0);
-    await reply(ctx, `\u5DF2\u8BB0\u5F55\u4F60\u7684\u56DE\u7B54\uFF0C\u5E76\u5199\u5165\u4F1A\u8BDD\u4E0A\u4E0B\u6587\u3002`);
+    await reply2(ctx, `\u5DF2\u8BB0\u5F55\u4F60\u7684\u56DE\u7B54\uFF0C\u5E76\u5199\u5165\u4F1A\u8BDD\u4E0A\u4E0B\u6587\u3002`);
   } else {
-    await reply(ctx, "\u672A\u6536\u5230\u56DE\u7B54\uFF08\u5361\u7247\u53EF\u80FD\u5DF2\u8D85\u65F6\u6216\u88AB\u5FFD\u7565\uFF09\u3002");
+    await reply2(ctx, "\u672A\u6536\u5230\u56DE\u7B54\uFF08\u5361\u7247\u53EF\u80FD\u5DF2\u8D85\u65F6\u6216\u88AB\u5FFD\u7565\uFF09\u3002");
   }
 }
 async function handleInvite(args, ctx) {
@@ -2853,7 +3618,7 @@ async function handleInvite(args, ctx) {
   const id = rest.join(" ").trim();
   if (kind === "list") {
     const snapshot = ctx.accessManager.snapshot();
-    await reply(
+    await reply2(
       ctx,
       [
         "**\u8BBF\u95EE\u767D\u540D\u5355**",
@@ -2865,7 +3630,7 @@ async function handleInvite(args, ctx) {
     return;
   }
   if (!kind || !id) {
-    await reply(
+    await reply2(
       ctx,
       "\u7528\u6CD5\uFF1A`/invite user|admin|group <id>`\u3001`/invite list`\u3001`/invite remove user|group <id>`"
     );
@@ -2873,38 +3638,38 @@ async function handleInvite(args, ctx) {
   }
   if (kind === "user") {
     await ctx.accessManager.addUser(id);
-    await reply(ctx, `\u5DF2\u5141\u8BB8\u7528\u6237\uFF1A\`${id}\``);
+    await reply2(ctx, `\u5DF2\u5141\u8BB8\u7528\u6237\uFF1A\`${id}\``);
     return;
   }
   if (kind === "admin") {
     await ctx.accessManager.addAdmin(id);
-    await reply(ctx, `\u5DF2\u8BBE\u4E3A\u7BA1\u7406\u5458\uFF1A\`${id}\``);
+    await reply2(ctx, `\u5DF2\u8BBE\u4E3A\u7BA1\u7406\u5458\uFF1A\`${id}\``);
     return;
   }
   if (kind === "group") {
     await ctx.accessManager.addChat(id);
-    await reply(ctx, `\u5DF2\u5141\u8BB8\u7FA4\u804A\uFF1A\`${id}\``);
+    await reply2(ctx, `\u5DF2\u5141\u8BB8\u7FA4\u804A\uFF1A\`${id}\``);
     return;
   }
   if (kind === "remove") {
     const [sub, target] = rest;
     if (sub === "user" && target) {
       await ctx.accessManager.removeUser(target);
-      await reply(ctx, `\u5DF2\u79FB\u9664\u7528\u6237\uFF1A\`${target}\``);
+      await reply2(ctx, `\u5DF2\u79FB\u9664\u7528\u6237\uFF1A\`${target}\``);
       return;
     }
     if (sub === "group" && target) {
       await ctx.accessManager.removeChat(target);
-      await reply(ctx, `\u5DF2\u79FB\u9664\u7FA4\u804A\uFF1A\`${target}\``);
+      await reply2(ctx, `\u5DF2\u79FB\u9664\u7FA4\u804A\uFF1A\`${target}\``);
       return;
     }
-    await reply(ctx, "\u7528\u6CD5\uFF1A`/invite remove user <id>` \u6216 `/invite remove group <chatId>`");
+    await reply2(ctx, "\u7528\u6CD5\uFF1A`/invite remove user <id>` \u6216 `/invite remove group <chatId>`");
     return;
   }
-  await reply(ctx, "\u672A\u77E5 `/invite` \u7C7B\u578B\uFF0C\u8BF7\u4F7F\u7528 user / admin / group / list / remove\u3002");
+  await reply2(ctx, "\u672A\u77E5 `/invite` \u7C7B\u578B\uFF0C\u8BF7\u4F7F\u7528 user / admin / group / list / remove\u3002");
 }
 async function handleHelp(_args, ctx) {
-  await reply(ctx, HELP);
+  await reply2(ctx, HELP);
 }
 var handlers = {
   "/new": handleNew,
@@ -2916,6 +3681,10 @@ var handlers = {
   "/stop": handleStop,
   "/timeout": handleTimeout,
   "/density": handleDensity,
+  "/model": handleModel,
+  "/providers": handleProviders,
+  "/provider": handleProvider,
+  "/key": handleKey,
   "/ask": handleAsk,
   "/invite": handleInvite,
   "/help": handleHelp
@@ -3016,8 +3785,12 @@ async function startChannel(deps) {
         approvals: deps.approvals,
         questions: deps.questions,
         densityStore: deps.densityStore,
+        models: deps.models,
+        dshConfig: deps.dshConfig,
         channel: commandChannel,
-        defaultWorkspace: deps.defaultWorkspace
+        defaultWorkspace: deps.defaultWorkspace,
+        defaultModel: deps.defaultModel,
+        senderId: msg.senderId
       };
       const handled = await tryHandleCommand(msg.content, context).catch((error) => {
         log.fail("channel-command", error, { scope });
@@ -3090,6 +3863,9 @@ var AccessManager = class {
       admins: [...profile.access.admins]
     };
   }
+  isAdmin(openId) {
+    return Boolean(openId && this.snapshot().admins.includes(openId));
+  }
   async addUser(id) {
     const snapshot = this.snapshot();
     if (!snapshot.allowedUsers.includes(id)) snapshot.allowedUsers.push(id);
@@ -3180,8 +3956,8 @@ async function onboardPersonalAgent(deps = {}) {
 }
 
 // src/media/attachments.ts
-import { mkdir as mkdir5, readFile as readFile2, stat as stat2 } from "fs/promises";
-import { join as join7 } from "path";
+import { mkdir as mkdir6, readFile as readFile3, stat as stat2 } from "fs/promises";
+import { join as join8 } from "path";
 var MAX_TEXT_FILE_BYTES = 256e3;
 function assertSafeMediaName(mediaDir, destination) {
   if (!isPathWithin(mediaDir, destination)) {
@@ -3189,11 +3965,11 @@ function assertSafeMediaName(mediaDir, destination) {
   }
 }
 async function prepareAttachments(channel, message, mediaDir) {
-  await mkdir5(mediaDir, { recursive: true });
+  await mkdir6(mediaDir, { recursive: true });
   const result = { imagePaths: [], textFileNotes: [] };
   for (const resource of message.resources) {
     if (!channel || resource.type !== "image" && resource.type !== "file") continue;
-    const destination = join7(mediaDir, `${message.messageId}-${resource.fileKey}`);
+    const destination = join8(mediaDir, `${message.messageId}-${resource.fileKey}`);
     assertSafeMediaName(mediaDir, destination);
     await channel.downloadResourceToFile(
       message.messageId,
@@ -3210,7 +3986,7 @@ async function prepareAttachments(channel, message, mediaDir) {
       result.textFileNotes.push(`[attachment: ${resource.fileName ?? resource.fileKey}] ${destination}`);
       continue;
     }
-    const content = await readFile2(destination, "utf8");
+    const content = await readFile3(destination, "utf8");
     const safeContent = truncateUtf8Safe(content, MAX_TEXT_FILE_BYTES);
     result.textFileNotes.push(
       `[attachment: ${resource.fileName ?? resource.fileKey}]
@@ -3221,7 +3997,7 @@ ${safeContent}`
 }
 
 // src/session/store.ts
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 var SessionStore = class {
   data = { chats: {} };
   saving = Promise.resolve();
@@ -3231,7 +4007,7 @@ var SessionStore = class {
   }
   async load() {
     try {
-      const raw = await readFile3(this.path, "utf8");
+      const raw = await readFile4(this.path, "utf8");
       const parsed = JSON.parse(raw);
       this.data = {
         chats: Object.fromEntries(
@@ -3335,8 +4111,8 @@ var SessionStore = class {
 // src/workspace/git-worktree.ts
 import { execFile } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { access, copyFile, mkdir as mkdir6 } from "fs/promises";
-import { dirname as dirname3, join as join8 } from "path";
+import { access, copyFile, mkdir as mkdir7 } from "fs/promises";
+import { dirname as dirname4, join as join9 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 async function defaultRunGit(args, cwd) {
@@ -3355,7 +4131,7 @@ async function exists(path) {
   }
 }
 async function defaultCopyRulesFile(source, target) {
-  await mkdir6(dirname3(target), { recursive: true });
+  await mkdir7(dirname4(target), { recursive: true });
   await copyFile(source, target);
 }
 function slugify(scope) {
@@ -3375,7 +4151,7 @@ var GitWorktreeManager = class {
     const isGit = await this.isGitRepository(base);
     if (!isGit) return { cwd: base, created: false };
     const slug = slugify(scope);
-    const target = join8(this.options.worktreesRoot, slug);
+    const target = join9(this.options.worktreesRoot, slug);
     if (!isPathWithin(this.options.worktreesRoot, target)) {
       throw new Error(`unsafe worktree target rejected: ${target}`);
     }
@@ -3384,7 +4160,7 @@ var GitWorktreeManager = class {
       return { cwd: target, created: false };
     }
     const branch = `dsh-lark/${slug}-${Date.now().toString(36)}-${randomBytes2(3).toString("hex")}`;
-    await mkdir6(this.options.worktreesRoot, { recursive: true });
+    await mkdir7(this.options.worktreesRoot, { recursive: true });
     await this.runGit(["worktree", "add", "-b", branch, target, "HEAD"], base);
     await this.ensureProjectRules(base, target);
     return { cwd: target, created: true, branch };
@@ -3398,9 +4174,9 @@ var GitWorktreeManager = class {
     }
   }
   async ensureProjectRules(base, target) {
-    const destination = join8(target, "AGENTS.md");
+    const destination = join9(target, "AGENTS.md");
     if (await exists(destination)) return;
-    const sourceCandidates = [join8(base, ".dsh-lark", "AGENTS.md"), join8(base, "AGENTS.md")];
+    const sourceCandidates = [join9(base, ".dsh-lark", "AGENTS.md"), join9(base, "AGENTS.md")];
     for (const source of sourceCandidates) {
       if (await exists(source)) {
         await this.copyRulesFile(source, destination);
@@ -3411,7 +4187,7 @@ var GitWorktreeManager = class {
 };
 
 // src/workspace/store.ts
-import { readFile as readFile4 } from "fs/promises";
+import { readFile as readFile5 } from "fs/promises";
 var WorkspaceStore = class {
   data = { chats: {}, named: {}, lastUsed: {} };
   saving = Promise.resolve();
@@ -3421,7 +4197,7 @@ var WorkspaceStore = class {
   }
   async load() {
     try {
-      const raw = await readFile4(this.path, "utf8");
+      const raw = await readFile5(this.path, "utf8");
       const parsed = JSON.parse(raw);
       this.data = {
         chats: parsed.chats ?? {},
@@ -3569,7 +4345,7 @@ async function runBot(options) {
     return;
   }
   const defaultWorkspace = options.workspace ?? activeProfile.workspaces.default ?? env.workspace ?? paths.profilePath(profileName, "workspace");
-  await mkdir7(defaultWorkspace, { recursive: true });
+  await mkdir8(defaultWorkspace, { recursive: true });
   const sessions = new SessionStore(paths.sessionsFile(profileName));
   const workspaces = new WorkspaceStore(paths.workspacesFile(profileName));
   const worktreeManager = new GitWorktreeManager({
@@ -3594,6 +4370,8 @@ async function runBot(options) {
   const approvals = new ApprovalRegistry();
   const questions = new QuestionRegistry();
   const densityStore = new DensityStore();
+  const models = new ModelStore();
+  const dshConfig = new DshProviderManager({ env: process.env });
   let streaming;
   let larkChannel;
   const pending = new PendingQueue(DEBOUNCE_MS, async (scope, batch) => {
@@ -3628,9 +4406,9 @@ async function runBot(options) {
         defaultWorkspace,
         replyTo: first.messageId,
         runTimeoutMs: activeProfile.preferences.runTimeoutMs ?? env.runTimeoutMs,
-        images: attachments.imagePaths
+        images: attachments.imagePaths,
+        model: models.get(scope) ?? activeProfile.preferences.model ?? await dshConfig.defaultModel().catch(() => void 0) ?? env.model
       };
-      if (activeProfile.preferences.model !== void 0) runInput.model = activeProfile.preferences.model;
       if (activeProfile.preferences.stopGraceMs !== void 0) {
         runInput.stopGraceMs = activeProfile.preferences.stopGraceMs;
       }
@@ -3651,7 +4429,10 @@ async function runBot(options) {
     approvals,
     questions,
     densityStore,
+    models,
+    dshConfig,
     defaultRunTimeoutMs: activeProfile.preferences.runTimeoutMs ?? env.runTimeoutMs,
+    defaultModel: activeProfile.preferences.model ?? env.model,
     accessManager: new AccessManager(configStore, profileName),
     pending,
     defaultWorkspace,
@@ -3660,7 +4441,6 @@ async function runBot(options) {
     allowedUsers: activeProfile.access.allowedUsers,
     allowedChats: activeProfile.access.allowedChats
   };
-  if (activeProfile.preferences.model !== void 0) channelInput.model = activeProfile.preferences.model;
   if (activeProfile.preferences.stopGraceMs !== void 0) {
     channelInput.stopGraceMs = activeProfile.preferences.stopGraceMs;
   }
@@ -3696,12 +4476,12 @@ function waitForShutdown() {
 }
 
 // src/service/manager.ts
-import { mkdir as mkdir12, readFile as readFile7 } from "fs/promises";
-import { dirname as dirname6 } from "path";
+import { mkdir as mkdir13, readFile as readFile8 } from "fs/promises";
+import { dirname as dirname7 } from "path";
 
 // src/service/command.ts
 import { execFile as execFile2 } from "child_process";
-import { basename, dirname as dirname4, join as join9 } from "path";
+import { basename, dirname as dirname5, join as join10 } from "path";
 import { fileURLToPath } from "url";
 var runCommand = (command, args, options) => new Promise((resolve5) => {
   execFile2(
@@ -3726,7 +4506,7 @@ function resolveCliJsPath(metaUrl = import.meta.url) {
   const current = fileURLToPath(metaUrl);
   const name = basename(current);
   if (name === "cli.js" || name === "cli.mjs" || name === "cli.cjs") return current;
-  return join9(dirname4(current), "..", "dist", "cli.js");
+  return join10(dirname5(current), "..", "dist", "cli.js");
 }
 function slugify2(value) {
   const slug = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -3740,7 +4520,7 @@ function launchdLabelFor(profile) {
 }
 
 // src/service/env-snapshot.ts
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 var EXTRA_KEYS = ["PATH", "HOME", "DEEPSEEK_API_KEY", "DSH_HOME"];
 function snapshotServiceEnv(source = process.env) {
   const env = {};
@@ -3790,7 +4570,7 @@ async function writeServiceEnv(file, env) {
 }
 async function readServiceEnv(file) {
   try {
-    return parseEnvFile(await readFile5(file, "utf8"));
+    return parseEnvFile(await readFile6(file, "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") return {};
     throw error;
@@ -3798,11 +4578,11 @@ async function readServiceEnv(file) {
 }
 
 // src/service/linux-systemd.ts
-import { mkdir as mkdir8, stat as stat3 } from "fs/promises";
-import { homedir as homedir5 } from "os";
-import { join as join10 } from "path";
+import { mkdir as mkdir9, stat as stat3 } from "fs/promises";
+import { homedir as homedir6 } from "os";
+import { join as join11 } from "path";
 function defaultSystemdUnitDir() {
-  return join10(homedir5(), ".config", "systemd", "user");
+  return join11(homedir6(), ".config", "systemd", "user");
 }
 function quoteSystemdArg(arg) {
   if (!/[\s"\\]/.test(arg)) return arg;
@@ -3864,7 +4644,7 @@ var SystemdServiceController = class {
     this.unitDir = options.userUnitDir ?? defaultSystemdUnitDir();
   }
   unitPath(spec) {
-    return join10(this.unitDir, `${spec.serviceName}.service`);
+    return join11(this.unitDir, `${spec.serviceName}.service`);
   }
   unitName(spec) {
     return `${spec.serviceName}.service`;
@@ -3874,7 +4654,7 @@ var SystemdServiceController = class {
     return result.code === 0;
   }
   async installAndStart(spec) {
-    await mkdir8(this.unitDir, { recursive: true });
+    await mkdir9(this.unitDir, { recursive: true });
     await writeFileAtomic(this.unitPath(spec), buildSystemdUnit(spec));
     await this.run("systemctl", ["--user", "daemon-reload"]);
     const name = this.unitName(spec);
@@ -3939,11 +4719,11 @@ var SystemdServiceController = class {
 };
 
 // src/service/macos-launchd.ts
-import { mkdir as mkdir9, rm, stat as stat4 } from "fs/promises";
-import { homedir as homedir6 } from "os";
-import { join as join11 } from "path";
+import { mkdir as mkdir10, rm as rm2, stat as stat4 } from "fs/promises";
+import { homedir as homedir7 } from "os";
+import { join as join12 } from "path";
 function defaultLaunchAgentDir() {
-  return join11(homedir6(), "Library", "LaunchAgents");
+  return join12(homedir7(), "Library", "LaunchAgents");
 }
 function xmlEscape(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
@@ -4008,13 +4788,13 @@ var LaunchdServiceController = class {
     return `gui/${this.uid}`;
   }
   plistPath(spec) {
-    return join11(this.agentDir, `${spec.label}.plist`);
+    return join12(this.agentDir, `${spec.label}.plist`);
   }
   serviceRef(spec) {
     return `${this.domain()}/${spec.label}`;
   }
   async installAndStart(spec) {
-    await mkdir9(this.agentDir, { recursive: true });
+    await mkdir10(this.agentDir, { recursive: true });
     await writeFileAtomic(this.plistPath(spec), buildLaunchdPlist(spec));
     const bootstrap = await this.run("launchctl", ["bootstrap", this.domain(), this.plistPath(spec)]);
     if (bootstrap.code !== 0) {
@@ -4023,7 +4803,7 @@ var LaunchdServiceController = class {
   }
   async stop(spec) {
     await this.run("launchctl", ["bootout", this.serviceRef(spec)]);
-    await rm(this.plistPath(spec), { force: true });
+    await rm2(this.plistPath(spec), { force: true });
   }
   async restart(spec) {
     const kickstart = await this.run("launchctl", ["kickstart", "-k", this.serviceRef(spec)]);
@@ -4064,11 +4844,11 @@ var LaunchdServiceController = class {
 
 // src/service/portable.ts
 import { spawn as spawn5 } from "child_process";
-import { mkdir as mkdir10, readFile as readFile6, rm as rm2, stat as stat5, writeFile as writeFile4 } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { join as join12 } from "path";
+import { mkdir as mkdir11, readFile as readFile7, rm as rm3, stat as stat5, writeFile as writeFile5 } from "fs/promises";
+import { homedir as homedir8 } from "os";
+import { join as join13 } from "path";
 function defaultAutostartDir() {
-  return join12(homedir7(), ".config", "autostart");
+  return join13(homedir8(), ".config", "autostart");
 }
 function quoteDesktopArg(arg) {
   const escaped = arg.replace(/%/g, "%%").replace(/\\/g, "\\\\").replace(/"/g, '\\"');
@@ -4089,7 +4869,7 @@ function buildDesktopEntry(spec) {
   ].join("\n");
 }
 function supervisorStatusFile(serviceDir, serviceName) {
-  return join12(serviceDir, `supervisor-${serviceName}.json`);
+  return join13(serviceDir, `supervisor-${serviceName}.json`);
 }
 function isProcessAlive(pid) {
   try {
@@ -4101,7 +4881,7 @@ function isProcessAlive(pid) {
 }
 async function readSupervisorStatus(file) {
   try {
-    return JSON.parse(await readFile6(file, "utf8"));
+    return JSON.parse(await readFile7(file, "utf8"));
   } catch {
     return void 0;
   }
@@ -4126,7 +4906,7 @@ var PortableServiceController = class {
     this.spawnDetached = options.spawnDetached ?? defaultSpawnDetached;
   }
   desktopPath(spec) {
-    return join12(this.autostartDir, `${spec.serviceName}.desktop`);
+    return join13(this.autostartDir, `${spec.serviceName}.desktop`);
   }
   statusFile(spec) {
     return supervisorStatusFile(this.serviceDir, spec.serviceName);
@@ -4150,15 +4930,15 @@ var PortableServiceController = class {
   }
   async installAndStart(spec) {
     await this.sendStopSignal(spec);
-    await mkdir10(this.autostartDir, { recursive: true });
-    await writeFile4(this.desktopPath(spec), buildDesktopEntry(spec), { encoding: "utf8", mode: 420 });
+    await mkdir11(this.autostartDir, { recursive: true });
+    await writeFile5(this.desktopPath(spec), buildDesktopEntry(spec), { encoding: "utf8", mode: 420 });
     if (!this.serviceDir) throw new Error("serviceDir is required for the portable supervisor");
-    await mkdir10(this.serviceDir, { recursive: true });
+    await mkdir11(this.serviceDir, { recursive: true });
     this.spawnDetached(spec.nodePath, [spec.cliJsPath, "supervise", "--profile", spec.profile]);
   }
   async stop(spec) {
     await this.sendStopSignal(spec);
-    await rm2(this.desktopPath(spec), { force: true });
+    await rm3(this.desktopPath(spec), { force: true });
   }
   async restart(spec) {
     await this.stop(spec);
@@ -4187,8 +4967,8 @@ var PortableServiceController = class {
 };
 
 // src/service/windows-task.ts
-import { mkdir as mkdir11, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5, join as join13 } from "path";
+import { mkdir as mkdir12, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname6, join as join14 } from "path";
 function psQuote(value) {
   return `'${value.replace(/'/g, "''")}'`;
 }
@@ -4199,7 +4979,7 @@ function buildScheduledTaskScript(action, spec) {
     `$cli = ${psQuote(spec.cliJsPath)}`,
     `$log = ${psQuote(spec.logFile)}`,
     `$profile = ${psQuote(spec.profile)}`,
-    `$workDir = ${psQuote(dirname5(spec.cliJsPath))}`
+    `$workDir = ${psQuote(dirname6(spec.cliJsPath))}`
   ].join("\n");
   const install = [
     `$inner = '"' + $node + '" "' + $cli + '" run --profile "' + $profile + '" >> "' + $log + '" 2>&1'`,
@@ -4280,12 +5060,12 @@ var WindowsTaskServiceController = class {
     this.scriptDir = options.scriptDir ?? "";
   }
   scriptPath(spec, action) {
-    return join13(this.scriptDir, `${action}-${spec.serviceName}.ps1`);
+    return join14(this.scriptDir, `${action}-${spec.serviceName}.ps1`);
   }
   async runScript(spec, action) {
     const script = this.scriptPath(spec, action);
-    if (this.scriptDir) await mkdir11(this.scriptDir, { recursive: true });
-    await writeFile5(script, buildScheduledTaskScript(action, spec), { encoding: "utf8" });
+    if (this.scriptDir) await mkdir12(this.scriptDir, { recursive: true });
+    await writeFile6(script, buildScheduledTaskScript(action, spec), { encoding: "utf8" });
     const result = await this.run("powershell.exe", [
       "-NoProfile",
       "-NonInteractive",
@@ -4392,14 +5172,14 @@ var ServiceManager = class {
   }
   async readMetadata() {
     try {
-      return JSON.parse(await readFile7(this.paths.serviceMetadataFile, "utf8"));
+      return JSON.parse(await readFile8(this.paths.serviceMetadataFile, "utf8"));
     } catch {
       return void 0;
     }
   }
   async prepareFiles(spec) {
-    await mkdir12(dirname6(spec.logFile), { recursive: true });
-    await mkdir12(dirname6(spec.envFile), { recursive: true });
+    await mkdir13(dirname7(spec.logFile), { recursive: true });
+    await mkdir13(dirname7(spec.envFile), { recursive: true });
     await writeServiceEnv(spec.envFile, spec.env);
   }
   async start() {
@@ -4530,7 +5310,7 @@ async function runServiceCommand(action, options, deps = {}) {
 // src/cli/commands/supervise.ts
 import { spawn as spawn6 } from "child_process";
 import { closeSync, mkdirSync, openSync } from "fs";
-import { dirname as dirname7 } from "path";
+import { dirname as dirname8 } from "path";
 var BASE_BACKOFF_MS = 5e3;
 var MAX_BACKOFF_MS = 3e4;
 function computeBackoffMs(restarts) {
@@ -4543,7 +5323,7 @@ function waitForExit(child) {
     child.once("error", done);
   });
 }
-function sleep(ms) {
+function sleep2(ms) {
   return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
 }
 async function runSupervise(options) {
@@ -4556,8 +5336,8 @@ async function runSupervise(options) {
   const serviceEnv = await readServiceEnv(paths.serviceEnvFile);
   const childEnv = { ...process.env, ...serviceEnv };
   const cliJsPath = resolveCliJsPath();
-  mkdirSync(dirname7(statusFile), { recursive: true });
-  mkdirSync(dirname7(logFile), { recursive: true });
+  mkdirSync(dirname8(statusFile), { recursive: true });
+  mkdirSync(dirname8(logFile), { recursive: true });
   const logFd = openSync(logFile, "a");
   const writeStatus = async (state, childPid, restarts2) => {
     const status = {
@@ -4595,7 +5375,7 @@ async function runSupervise(options) {
       restarts += 1;
       await writeStatus("restarting", void 0, restarts);
       const backoff = computeBackoffMs(restarts);
-      await sleep(backoff);
+      await sleep2(backoff);
     }
   } finally {
     await writeStatus("stopped", void 0, restarts);
@@ -4653,8 +5433,20 @@ function buildProgram() {
 async function main(argv = process.argv) {
   await buildProgram().parseAsync([...argv]);
 }
+function isDirectInvocation(entry = process.argv[1], metaUrl = import.meta.url) {
+  if (!entry) return false;
+  try {
+    return realpathSync2(entry) === fileURLToPath2(metaUrl);
+  } catch {
+    return false;
+  }
+}
+if (isDirectInvocation()) {
+  await main();
+}
 export {
   buildProgram,
+  isDirectInvocation,
   main
 };
 //# sourceMappingURL=cli.js.map