dsh-lark-bot 0.9.0 → 0.9.2

package/README.md

@@ -87,12 +87,14 @@ npx dsh-lark-bot@latest setup --profile dsh-lark
 ```
 
 `setup` 会自动完成：发现本机 dsh → 预批准 pnpm 构建策略 → 执行标准的
-`dsh plugin --profile dsh-lark add dsh-lark-bot`，并**默认同时安装「安全网守护」**——系统级
+`dsh plugin --profile dsh-lark add dsh-lark-bot@<版本>`（版本号由当前包固定，避免 pnpm
+裸名解析到旧版本），并**默认同时安装「安全网守护」**——系统级
 常驻、dsh 全部下线后仍保留飞书救援入口（核心能力之一，见下文「安全网守护」一节）。
 一条命令即完成全部安装。
 
 `setup` automatically: locates your dsh install → pre-approves pnpm's build policy → runs the
-standard `dsh plugin --profile dsh-lark add dsh-lark-bot`, and **also installs the safety-net
+standard `dsh plugin --profile dsh-lark add dsh-lark-bot@<version>` (pinned to the running
+package so pnpm never resolves an outdated bare-name release), and **also installs the safety-net
 guardian by default** — a system-level resident process that keeps the Feishu rescue entrance
 alive even when dsh is fully down (one of the core features; see "Safety-net guardian" below).
 One command installs everything.
@@ -592,6 +594,7 @@ pnpm install
 pnpm typecheck
 pnpm test
 pnpm build
+pnpm check:publish-bundle   # 校验 dist 与全部 exports/bin 入口一致（发布前防线）| verifies dist matches every export & the CLI entry (release gate)
 pnpm ci:local
 pnpm release:check   # ci:local + 上游一致性检查 | ci:local + upstream consistency check
 pnpm compat:probe    # 临时 DSH_HOME 安装锁定版 dsh，跑真实 SDK 握手 | installs pinned dsh into a temp DSH_HOME and runs a real SDK handshake
@@ -623,7 +626,7 @@ pnpm publish:dual:dry-run
 pnpm publish:dual
 ```
 
-`scripts/publish-dual-packages.mjs` 从根 `package.json` 生成两份仅 `name` / `bin` 不同的发布清单，避免两份源码漂移。GitHub tag `v*` 会触发 [`release.yml`](.github/workflows/release.yml) 自动发布两个 npm 包并创建 Release。
+`scripts/publish-dual-packages.mjs` 从根 `package.json` 生成两份仅 `name` / `bin` 不同的发布清单，避免两份源码漂移。发布时整目录同步 `dist/`，并在发布前校验 `package.json` 每个 `exports` 子路径与 CLI 入口在产物中都存在——任何缺失（如 v0.9.0 的 `ask` 入口漏拷）都会直接中止发布。GitHub tag `v*` 会触发 [`release.yml`](.github/workflows/release.yml) 自动发布两个 npm 包并创建 Release。
 
 `scripts/publish-dual-packages.mjs` generates two publish manifests from the root
 `package.json`, differing only in `name` / `bin`, so the two copies never drift. A GitHub tag

package/dist/ask.d.ts

@@ -0,0 +1,25 @@
+import { Context } from '@deepseek-ai/cordis';
+
+/** Cordis plugin name; referenced by the runtime patch row. */
+declare const name = "lark-ask";
+/** Requires the dsh tool registry before registering. */
+declare const inject: string[];
+interface Config {
+    /** Localhost callback URL of the running bridge process (/ask). */
+    endpoint?: string;
+    /** Shared token authorizing the callback. */
+    token?: string;
+}
+/** The user may take a while to answer a card; keep the tool well above the
+ *  default run-timeout so the question itself is not what kills the task. */
+declare const ASK_TOOL_TIMEOUT_MS = 600000;
+/**
+ * dsh tool that asks the user a question through a Feishu/Lark card when the
+ * agent needs a decision, confirmation, or missing information before
+ * proceeding. The bridge runs a localhost-only callback server; this plugin
+ * is the runtime side of that channel: it posts the question and blocks until
+ * the human answers the card.
+ */
+declare function apply(ctx: Context, config?: Config): void;
+
+export { ASK_TOOL_TIMEOUT_MS, type Config, apply, inject, name };

package/dist/ask.js

@@ -0,0 +1,95 @@
+// src/notify/ask-tool.ts
+import { defineTool } from "@deepseek-ai/dsh-tools";
+var name = "lark-ask";
+var inject = ["tools"];
+var ASK_TOOL_TIMEOUT_MS = 6e5;
+function apply(ctx, config = {}) {
+  ctx.tools.register(
+    defineTool({
+      name: "lark_ask_user",
+      description: "Ask the user a question through a Feishu/Lark card when you need a decision, confirmation, or missing information before proceeding. The tool blocks until the user answers. Use it sparingly and only for choices or facts only the user can provide; resolve everything discoverable by inspection yourself first.",
+      timeoutMs: ASK_TOOL_TIMEOUT_MS,
+      parameters: {
+        question: {
+          type: "string",
+          required: true,
+          description: "The question to ask the user."
+        },
+        kind: {
+          type: "string",
+          enum: ["single", "multi", "text"],
+          description: "single = one choice, multi = multiple choices, text = free text. Defaults to single when options are given, otherwise text."
+        },
+        options: {
+          type: "array",
+          items: { type: "string" },
+          description: "Choices for single / multi questions."
+        },
+        header: {
+          type: "string",
+          description: "Optional short heading shown above the question."
+        }
+      },
+      output: {
+        schema: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            answered: { type: "boolean", required: true },
+            answer: { type: "json" },
+            error: { type: "string" }
+          }
+        },
+        render: (_args, value) => [
+          {
+            type: "text",
+            text: value.answered ? `User answered: ${JSON.stringify(value.answer)}` : `Question failed: ${value.error ?? "no answer"}`
+          }
+        ]
+      },
+      async execute(args, exec) {
+        const endpoint = config.endpoint ?? process.env.DSH_LARK_ASK_URL;
+        const token = config.token ?? process.env.DSH_LARK_NOTIFY_TOKEN;
+        if (!endpoint || !token) {
+          throw new Error("lark_ask_user is not configured (endpoint/token missing)");
+        }
+        const sessionId = exec?.agent?.session === void 0 ? void 0 : String(exec.agent.session.id);
+        if (!sessionId) {
+          throw new Error("lark_ask_user needs an active session to route the question");
+        }
+        const kind = args.kind ?? (args.options && args.options.length > 0 ? "single" : "text");
+        const response = await fetch(endpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            token,
+            sessionId,
+            question: args.question,
+            kind,
+            ...args.options && args.options.length > 0 ? { options: args.options } : {},
+            ...args.header === void 0 ? {} : { header: args.header }
+          }),
+          ...exec?.signal === void 0 ? {} : { signal: exec.signal }
+        });
+        const body = await response.json();
+        if (!response.ok || body.ok !== true) {
+          return {
+            answered: false,
+            ...body.error === void 0 ? {} : { error: body.error }
+          };
+        }
+        return {
+          answered: true,
+          ...body.answer === void 0 ? {} : { answer: body.answer ?? null }
+        };
+      }
+    })
+  );
+}
+export {
+  ASK_TOOL_TIMEOUT_MS,
+  apply,
+  inject,
+  name
+};
+//# sourceMappingURL=ask.js.map

package/dist/ask.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/notify/ask-tool.ts"],"sourcesContent":["import type { Context } from '@deepseek-ai/cordis';\nimport { defineTool } from '@deepseek-ai/dsh-tools';\n\n/** Cordis plugin name; referenced by the runtime patch row. */\nexport const name = 'lark-ask';\n\n/** Requires the dsh tool registry before registering. */\nexport const inject = ['tools'];\n\nexport interface Config {\n  /** Localhost callback URL of the running bridge process (/ask). */\n  endpoint?: string;\n  /** Shared token authorizing the callback. */\n  token?: string;\n}\n\n/** The user may take a while to answer a card; keep the tool well above the\n *  default run-timeout so the question itself is not what kills the task. */\nexport const ASK_TOOL_TIMEOUT_MS = 600_000;\n\ninterface AskToolExec {\n  agent?: { session?: { id?: unknown } };\n  signal?: AbortSignal;\n}\n\n/**\n * dsh tool that asks the user a question through a Feishu/Lark card when the\n * agent needs a decision, confirmation, or missing information before\n * proceeding. The bridge runs a localhost-only callback server; this plugin\n * is the runtime side of that channel: it posts the question and blocks until\n * the human answers the card.\n */\nexport function apply(ctx: Context, config: Config = {}) {\n  ctx.tools.register(\n    defineTool({\n      name: 'lark_ask_user',\n      description:\n        'Ask the user a question through a Feishu/Lark card when you need a decision, confirmation, or missing information before proceeding. The tool blocks until the user answers. Use it sparingly and only for choices or facts only the user can provide; resolve everything discoverable by inspection yourself first.',\n      timeoutMs: ASK_TOOL_TIMEOUT_MS,\n      parameters: {\n        question: {\n          type: 'string',\n          required: true,\n          description: 'The question to ask the user.',\n        },\n        kind: {\n          type: 'string',\n          enum: ['single', 'multi', 'text'],\n          description:\n            'single = one choice, multi = multiple choices, text = free text. Defaults to single when options are given, otherwise text.',\n        },\n        options: {\n          type: 'array',\n          items: { type: 'string' },\n          description: 'Choices for single / multi questions.',\n        },\n        header: {\n          type: 'string',\n          description: 'Optional short heading shown above the question.',\n        },\n      },\n      output: {\n        schema: {\n          type: 'object',\n          additionalProperties: false,\n          properties: {\n            answered: { type: 'boolean', required: true },\n            answer: { type: 'json' },\n            error: { type: 'string' },\n          },\n        },\n        render: (_args, value) => [\n          {\n            type: 'text',\n            text: value.answered\n              ? `User answered: ${JSON.stringify(value.answer)}`\n              : `Question failed: ${value.error ?? 'no answer'}`,\n          },\n        ],\n      },\n      async execute(args, exec: AskToolExec | undefined) {\n        // The callback endpoint/token may be configured by the patch row or\n        // injected at runtime: the bridge process sets the env vars when its\n        // notify server starts, so read them lazily at execute time.\n        const endpoint = config.endpoint ?? process.env.DSH_LARK_ASK_URL;\n        const token = config.token ?? process.env.DSH_LARK_NOTIFY_TOKEN;\n        if (!endpoint || !token) {\n          throw new Error('lark_ask_user is not configured (endpoint/token missing)');\n        }\n        const sessionId =\n          exec?.agent?.session === undefined\n            ? undefined\n            : String(exec.agent.session.id);\n        if (!sessionId) {\n          throw new Error('lark_ask_user needs an active session to route the question');\n        }\n        const kind =\n          args.kind ?? (args.options && args.options.length > 0 ? 'single' : 'text');\n        const response = await fetch(endpoint, {\n          method: 'POST',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({\n            token,\n            sessionId,\n            question: args.question,\n            kind,\n            ...(args.options && args.options.length > 0 ? { options: args.options } : {}),\n            ...(args.header === undefined ? {} : { header: args.header }),\n          }),\n          ...(exec?.signal === undefined ? {} : { signal: exec.signal }),\n        });\n        const body = (await response.json()) as {\n          ok?: boolean;\n          answer?: string | string[] | null;\n          error?: string;\n        };\n        if (!response.ok || body.ok !== true) {\n          return {\n            answered: false,\n            ...(body.error === undefined ? {} : { error: body.error }),\n          };\n        }\n        return {\n          answered: true,\n          ...(body.answer === undefined ? {} : { answer: body.answer ?? null }),\n        };\n      },\n    }),\n  );\n}\n"],"mappings":";AACA,SAAS,kBAAkB;AAGpB,IAAM,OAAO;AAGb,IAAM,SAAS,CAAC,OAAO;AAWvB,IAAM,sBAAsB;AAc5B,SAAS,MAAM,KAAc,SAAiB,CAAC,GAAG;AACvD,MAAI,MAAM;AAAA,IACR,WAAW;AAAA,MACT,MAAM;AAAA,MACN,aACE;AAAA,MACF,WAAW;AAAA,MACX,YAAY;AAAA,QACV,UAAU;AAAA,UACR,MAAM;AAAA,UACN,UAAU;AAAA,UACV,aAAa;AAAA,QACf;AAAA,QACA,MAAM;AAAA,UACJ,MAAM;AAAA,UACN,MAAM,CAAC,UAAU,SAAS,MAAM;AAAA,UAChC,aACE;AAAA,QACJ;AAAA,QACA,SAAS;AAAA,UACP,MAAM;AAAA,UACN,OAAO,EAAE,MAAM,SAAS;AAAA,UACxB,aAAa;AAAA,QACf;AAAA,QACA,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,aAAa;AAAA,QACf;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,sBAAsB;AAAA,UACtB,YAAY;AAAA,YACV,UAAU,EAAE,MAAM,WAAW,UAAU,KAAK;AAAA,YAC5C,QAAQ,EAAE,MAAM,OAAO;AAAA,YACvB,OAAO,EAAE,MAAM,SAAS;AAAA,UAC1B;AAAA,QACF;AAAA,QACA,QAAQ,CAAC,OAAO,UAAU;AAAA,UACxB;AAAA,YACE,MAAM;AAAA,YACN,MAAM,MAAM,WACR,kBAAkB,KAAK,UAAU,MAAM,MAAM,CAAC,KAC9C,oBAAoB,MAAM,SAAS,WAAW;AAAA,UACpD;AAAA,QACF;AAAA,MACF;AAAA,MACA,MAAM,QAAQ,MAAM,MAA+B;AAIjD,cAAM,WAAW,OAAO,YAAY,QAAQ,IAAI;AAChD,cAAM,QAAQ,OAAO,SAAS,QAAQ,IAAI;AAC1C,YAAI,CAAC,YAAY,CAAC,OAAO;AACvB,gBAAM,IAAI,MAAM,0DAA0D;AAAA,QAC5E;AACA,cAAM,YACJ,MAAM,OAAO,YAAY,SACrB,SACA,OAAO,KAAK,MAAM,QAAQ,EAAE;AAClC,YAAI,CAAC,WAAW;AACd,gBAAM,IAAI,MAAM,6DAA6D;AAAA,QAC/E;AACA,cAAM,OACJ,KAAK,SAAS,KAAK,WAAW,KAAK,QAAQ,SAAS,IAAI,WAAW;AACrE,cAAM,WAAW,MAAM,MAAM,UAAU;AAAA,UACrC,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU;AAAA,YACnB;AAAA,YACA;AAAA,YACA,UAAU,KAAK;AAAA,YACf;AAAA,YACA,GAAI,KAAK,WAAW,KAAK,QAAQ,SAAS,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,YAC3E,GAAI,KAAK,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;AAAA,UAC7D,CAAC;AAAA,UACD,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;AAAA,QAC9D,CAAC;AACD,cAAM,OAAQ,MAAM,SAAS,KAAK;AAKlC,YAAI,CAAC,SAAS,MAAM,KAAK,OAAO,MAAM;AACpC,iBAAO;AAAA,YACL,UAAU;AAAA,YACV,GAAI,KAAK,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM;AAAA,UAC1D;AAAA,QACF;AACA,eAAO;AAAA,UACL,UAAU;AAAA,UACV,GAAI,KAAK,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU,KAAK;AAAA,QACrE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/cli.js

@@ -145,7 +145,9 @@ function findOwnPackageRoot(startDir) {
     try {
       const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
       if (typeof pkg.name === "string" && isOwnPackageName(pkg.name)) {
-        return { name: pkg.name, root: dir };
+        const info = { name: pkg.name, root: dir };
+        if (typeof pkg.version === "string") info.version = pkg.version;
+        return info;
       }
     } catch {
     }
@@ -246,14 +248,14 @@ function acpPluginInstalled(profileRoot) {
 }
 function isAcpProfileReady(profileRoot) {
   const own = ownPackageInfo();
-  return existsSync4(join4(profileRoot, "package.json")) && existsSync4(join4(profileRoot, "cordis.yml")) && existsSync4(join4(profileRoot, "cordis.patch.yml")) && acpPluginInstalled(profileRoot) && ownPackageLinked2(profileRoot, own.name);
+  return existsSync4(join4(profileRoot, "package.json")) && existsSync4(join4(profileRoot, "cordis.yml")) && existsSync4(join4(profileRoot, "cordis.patch.yml")) && acpPluginInstalled(profileRoot) && ownPackageLinked2(profileRoot, own);
 }
-function ownPackageLinked2(profileRoot, ownName) {
-  const linkPath = join4(profileRoot, "node_modules", ownName);
+function ownPackageLinked2(profileRoot, own) {
+  const linkPath = join4(profileRoot, "node_modules", own.name);
   try {
     const real = realpathSync2(linkPath);
     const pkg = JSON.parse(readFileSync3(join4(real, "package.json"), "utf8"));
-    return pkg.name === ownName && pkg.dsh?.bundle?.patch !== void 0;
+    return pkg.name === own.name && pkg.dsh?.bundle?.patch !== void 0 && real === realpathSync2(own.root);
   } catch {
     return false;
   }
@@ -1352,14 +1354,14 @@ function sdkServerInstalled(profileRoot) {
 }
 function isSdkProfileReady(profileRoot) {
   const own = ownPackageInfo();
-  return existsSync3(join3(profileRoot, "package.json")) && existsSync3(join3(profileRoot, "cordis.yml")) && existsSync3(join3(profileRoot, "cordis.patch.yml")) && sdkServerInstalled(profileRoot) && ownPackageLinked(profileRoot, own.name);
+  return existsSync3(join3(profileRoot, "package.json")) && existsSync3(join3(profileRoot, "cordis.yml")) && existsSync3(join3(profileRoot, "cordis.patch.yml")) && sdkServerInstalled(profileRoot) && ownPackageLinked(profileRoot, own);
 }
-function ownPackageLinked(profileRoot, ownName) {
-  const linkPath = join3(profileRoot, "node_modules", ownName);
+function ownPackageLinked(profileRoot, own) {
+  const linkPath = join3(profileRoot, "node_modules", own.name);
   try {
     const real = realpathSync(linkPath);
     const pkg = JSON.parse(readFileSync2(join3(real, "package.json"), "utf8"));
-    return pkg.name === ownName && pkg.dsh?.bundle?.patch !== void 0;
+    return pkg.name === own.name && pkg.dsh?.bundle?.patch !== void 0 && real === realpathSync(own.root);
   } catch {
     return false;
   }
@@ -6281,7 +6283,7 @@ async function uninstallGuardian(options) {
 async function runSetup(options = {}) {
   const profile = options.profile ?? "dsh-lark";
   const own = ownPackageInfo();
-  const packageSpec = options.packageSpec ?? process.env.DSH_LARK_SETUP_PACKAGE ?? own.name;
+  const packageSpec = options.packageSpec ?? process.env.DSH_LARK_SETUP_PACKAGE ?? (own.version ? `${own.name}@${own.version}` : own.name);
   const dshHome = options.dshHome ?? resolveDshHome(homedir7(), process.env);
   const bin = options.bin ?? discoverDshBin(homedir7(), process.env);
   if (!bin) {