feishu-codex-console 1.0.0-beta.6

package/scripts/config-file.mjs

@@ -0,0 +1,137 @@
+import { chmod, copyFile, lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+export function parseEnvEntries(content = "") {
+  const entries = {};
+  for (const line of content.split(/\r?\n/)) {
+    const parsed = parseAssignment(line);
+    if (parsed) entries[parsed.key] = decodeEnvValue(parsed.value);
+  }
+  return entries;
+}
+
+export function mergeEnvContent(existing, generated) {
+  if (!existing.trim()) return ensureFinalNewline(generated);
+  const generatedAssignments = new Map();
+  for (const line of generated.split(/\r?\n/)) {
+    const parsed = parseAssignment(line);
+    if (parsed) generatedAssignments.set(parsed.key, line);
+  }
+
+  const seen = new Set();
+  const output = [];
+  for (const line of existing.split(/\r?\n/)) {
+    const parsed = parseAssignment(line);
+    if (!parsed || !generatedAssignments.has(parsed.key)) {
+      output.push(line);
+      continue;
+    }
+    if (!seen.has(parsed.key)) output.push(generatedAssignments.get(parsed.key));
+    seen.add(parsed.key);
+  }
+
+  const missing = [...generatedAssignments]
+    .filter(([key]) => !seen.has(key))
+    .map(([, line]) => line);
+  if (missing.length > 0) {
+    while (output.at(-1) === "") output.pop();
+    output.push("", "# Managed by feishu-codex-console init", ...missing);
+  }
+  return ensureFinalNewline(output.join("\n"));
+}
+
+export async function readEnvFile(file) {
+  const content = await readSafeFile(file);
+  return content === null ? {} : parseEnvEntries(content);
+}
+
+export async function readEnvContent(file) {
+  return await readSafeFile(file);
+}
+
+export async function writeManagedConfig(file, generated, options = {}) {
+  const directory = path.dirname(file);
+  await ensurePrivateDirectory(directory);
+  const existing = await readSafeFile(file);
+  const forceReset = Boolean(options.forceReset);
+  const nextContent = existing === null || forceReset
+    ? ensureFinalNewline(generated)
+    : mergeEnvContent(existing, generated);
+  let backupFile;
+  if (existing !== null) {
+    backupFile = `${file}.bak.${timestamp(options.now ?? new Date())}`;
+    await copyFile(file, backupFile);
+    await chmod(backupFile, 0o600);
+  }
+
+  const temporary = path.join(
+    directory,
+    `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`,
+  );
+  try {
+    await writeFile(temporary, nextContent, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    await chmod(temporary, 0o600);
+    await rename(temporary, file);
+    await chmod(file, 0o600);
+  } catch (error) {
+    await rm(temporary, { force: true });
+    throw error;
+  }
+  return {
+    created: existing === null,
+    backupFile,
+    entries: parseEnvEntries(nextContent),
+  };
+}
+
+async function readSafeFile(file) {
+  try {
+    const details = await lstat(file);
+    if (!details.isFile() || details.isSymbolicLink()) {
+      throw new Error(`Unsafe configuration path: ${file}`);
+    }
+    return await readFile(file, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+async function ensurePrivateDirectory(directory) {
+  let created = false;
+  let details;
+  try {
+    details = await lstat(directory);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    details = await lstat(directory);
+    created = true;
+  }
+  if (!details.isDirectory() || details.isSymbolicLink()) {
+    throw new Error(`Unsafe configuration directory: ${directory}`);
+  }
+  if (created) await chmod(directory, 0o700);
+}
+
+function parseAssignment(line) {
+  const match = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+  return match ? { key: match[1], value: match[2] ?? "" } : null;
+}
+
+function decodeEnvValue(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    return trimmed.slice(1, -1).replaceAll('\\"', '"').replaceAll("\\\\", "\\");
+  }
+  if (trimmed.startsWith("'") && trimmed.endsWith("'")) return trimmed.slice(1, -1);
+  return trimmed;
+}
+
+function ensureFinalNewline(value) {
+  return `${value.replace(/\n+$/, "")}\n`;
+}
+
+function timestamp(value) {
+  return value.toISOString().replace(/[:.]/g, "-");
+}

package/scripts/discovery-lib.mjs

@@ -0,0 +1,78 @@
+import { spawn } from "node:child_process";
+
+export function parseDiscoveryEvent(line) {
+  let value;
+  try {
+    value = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object") return null;
+  if (value.type !== "im.message.receive_v1") return null;
+  if (value.sender_type && value.sender_type !== "user") return null;
+  if (typeof value.sender_id !== "string" || !/^ou_[A-Za-z0-9_-]+$/.test(value.sender_id)) {
+    return null;
+  }
+  if (typeof value.chat_id !== "string" || !/^oc_[A-Za-z0-9_-]+$/.test(value.chat_id)) {
+    return null;
+  }
+  if (value.chat_type !== "p2p" && value.chat_type !== "group") return null;
+  return {
+    senderId: value.sender_id,
+    chatId: value.chat_id,
+    chatType: value.chat_type,
+    messageId: typeof value.message_id === "string" ? value.message_id : undefined,
+  };
+}
+
+export function discoveryCommandArgs(timeout = "2m") {
+  return [
+    "event",
+    "consume",
+    "im.message.receive_v1",
+    "--as",
+    "bot",
+    "--max-events",
+    "1",
+    "--timeout",
+    timeout,
+    "--quiet",
+  ];
+}
+
+export function discoverFeishuIdentity(cliPath, options = {}) {
+  const timeout = options.timeout ?? "2m";
+  const cwd = options.cwd ?? process.cwd();
+  const child = spawn(cliPath, discoveryCommandArgs(timeout), {
+    cwd,
+    env: options.env ?? process.env,
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  return new Promise((resolve, reject) => {
+    let buffer = "";
+    let stderr = "";
+    let discovered = null;
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      buffer += chunk;
+      while (buffer.includes("\n")) {
+        const newline = buffer.indexOf("\n");
+        const line = buffer.slice(0, newline).trim();
+        buffer = buffer.slice(newline + 1);
+        discovered ??= parseDiscoveryEvent(line);
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.once("error", (error) => reject(error));
+    child.once("exit", (code) => {
+      discovered ??= parseDiscoveryEvent(buffer.trim());
+      if (discovered) resolve(discovered);
+      else if (code === 0) resolve(null);
+      else reject(new Error(stderr.trim() || `lark-cli 退出，状态码 ${code ?? "unknown"}`));
+    });
+  });
+}

package/scripts/install-card.mjs

@@ -0,0 +1,37 @@
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+export async function sendInstallationCard(options) {
+  const LarkCliClass = options.LarkCliClass ?? (await import(
+    pathToFileURL(path.join(options.packageRoot, "dist", "lark-cli.js")).href
+  )).LarkCli;
+  const renderOnboardingCard = options.renderOnboardingCard ?? (await import(
+    pathToFileURL(path.join(options.packageRoot, "dist", "onboarding-card.js")).href
+  )).renderOnboardingCard;
+  const lark = new LarkCliClass({
+    binary: options.larkCliPath,
+    cwd: options.packageRoot,
+    maxReplyChars: 12_000,
+  });
+  const card = renderOnboardingCard({
+    role: "admin",
+    state: {
+      ownerId: options.ownerId,
+      status: "active",
+      step: 1,
+      updatedAt: new Date().toISOString(),
+    },
+    projectName: options.projectName,
+    modelLabel: "Codex 默认",
+    sandboxLabel: options.sandboxLabel,
+    deviceOnline: true,
+    feedback: "安装成功，飞书、本地服务和 CardKit 已完成端到端验证。",
+  });
+  const cardId = await lark.createCard(card);
+  await lark.replyCard(
+    options.messageId,
+    cardId,
+    `install_${options.instanceId}_${options.messageId}`,
+  );
+  return { cardId };
+}

package/scripts/install-detection.mjs

@@ -0,0 +1,126 @@
+import { spawnSync } from "node:child_process";
+import { lstat, readdir, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+
+import { serviceHealthPath } from "./service-health.mjs";
+
+export async function detectExistingInstallation({
+  configFile,
+  dataDir,
+  instanceId,
+  platform = process.platform,
+  homeDir = homedir(),
+  uid = typeof process.getuid === "function" ? process.getuid() : 0,
+  run = runCommand,
+}) {
+  const config = await fileState(configFile);
+  const data = await directoryState(dataDir);
+  const health = await healthState(dataDir);
+  const service = await serviceState({ instanceId, platform, homeDir, uid, run });
+  return {
+    exists: config.exists || data.exists || service.installed || health.exists,
+    config,
+    data,
+    health,
+    service,
+  };
+}
+
+async function serviceState({ instanceId, platform, homeDir, uid, run }) {
+  if (platform === "darwin") {
+    const label = `com.feishu-codex-bridge.${instanceId}`;
+    const definition = path.join(homeDir, "Library", "LaunchAgents", `${label}.plist`);
+    const definitionState = await fileState(definition);
+    const outcome = run("launchctl", ["print", `gui/${uid}/${label}`]);
+    return {
+      manager: "launchd",
+      name: label,
+      definition,
+      installed: definitionState.exists || outcome.status === 0,
+      running: outcome.status === 0,
+    };
+  }
+  if (platform === "linux") {
+    const name = `feishu-codex-bridge-${instanceId}.service`;
+    const definition = path.join(homeDir, ".config", "systemd", "user", name);
+    const definitionState = await fileState(definition);
+    const outcome = run("systemctl", ["--user", "is-active", "--quiet", name]);
+    return {
+      manager: "systemd",
+      name,
+      definition,
+      installed: definitionState.exists || outcome.status === 0,
+      running: outcome.status === 0,
+    };
+  }
+  return {
+    manager: "unsupported",
+    name: "",
+    definition: "",
+    installed: false,
+    running: false,
+  };
+}
+
+async function fileState(file) {
+  try {
+    const details = await lstat(file);
+    return {
+      path: file,
+      exists: details.isFile() && !details.isSymbolicLink(),
+      unsafe: !details.isFile() || details.isSymbolicLink(),
+    };
+  } catch (error) {
+    if (error?.code === "ENOENT") return { path: file, exists: false, unsafe: false };
+    throw error;
+  }
+}
+
+async function directoryState(directory) {
+  try {
+    const details = await lstat(directory);
+    if (!details.isDirectory() || details.isSymbolicLink()) {
+      return { path: directory, exists: true, unsafe: true, entryCount: 0 };
+    }
+    const entries = await readdir(directory);
+    return {
+      path: directory,
+      exists: true,
+      unsafe: false,
+      entryCount: entries.length,
+    };
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return { path: directory, exists: false, unsafe: false, entryCount: 0 };
+    }
+    throw error;
+  }
+}
+
+async function healthState(dataDir) {
+  const file = serviceHealthPath(dataDir);
+  const state = await fileState(file);
+  if (!state.exists) return { path: file, exists: false };
+  try {
+    const parsed = JSON.parse(await readFile(file, "utf8"));
+    return {
+      path: file,
+      exists: true,
+      status: typeof parsed.status === "string" ? parsed.status : "unknown",
+      pid: Number.isSafeInteger(parsed.pid) ? parsed.pid : null,
+      instanceId: typeof parsed.instanceId === "string" ? parsed.instanceId : null,
+      updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : null,
+    };
+  } catch {
+    return { path: file, exists: true, status: "invalid", pid: null, instanceId: null, updatedAt: null };
+  }
+}
+
+function runCommand(command, args) {
+  const outcome = spawnSync(command, args, {
+    env: process.env,
+    stdio: "ignore",
+  });
+  return { status: outcome.status ?? 1 };
+}

package/scripts/install-state.mjs

@@ -0,0 +1,107 @@
+import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+export const INSTALL_STEPS = Object.freeze([
+  "environment_ready",
+  "feishu_bound",
+  "capabilities_verified",
+  "identity_discovered",
+  "preferences_confirmed",
+  "config_written",
+  "service_running",
+  "test_card_delivered",
+  "completed",
+]);
+
+export function installStatePath(configFile) {
+  return configFile.endsWith(".env")
+    ? `${configFile.slice(0, -4)}.install-state.json`
+    : `${configFile}.install-state.json`;
+}
+
+export async function loadInstallState(configFile) {
+  const file = installStatePath(configFile);
+  try {
+    const details = await lstat(file);
+    if (!details.isFile() || details.isSymbolicLink()) throw new Error(`Unsafe install state: ${file}`);
+    const value = JSON.parse(await readFile(file, "utf8"));
+    if (value?.version !== 1 || !Array.isArray(value.completedSteps)) {
+      throw new Error(`Unsupported install state format: ${file}`);
+    }
+    return value;
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+export async function recordInstallStep(configFile, previous, step, details = {}) {
+  if (!INSTALL_STEPS.includes(step)) throw new Error(`Unknown install step: ${step}`);
+  const completedSteps = [...new Set([...(previous?.completedSteps ?? []), step])]
+    .sort((left, right) => INSTALL_STEPS.indexOf(left) - INSTALL_STEPS.indexOf(right));
+  const previousIndex = INSTALL_STEPS.indexOf(previous?.status);
+  const stepIndex = INSTALL_STEPS.indexOf(step);
+  const status = previousIndex > stepIndex ? previous.status : step;
+  const state = {
+    version: 1,
+    status,
+    completedSteps,
+    configFile: path.resolve(configFile),
+    updatedAt: new Date().toISOString(),
+    ...safeDetails(previous ?? {}),
+    ...safeDetails(details),
+  };
+  await writeInstallState(configFile, state);
+  return state;
+}
+
+export async function recordInstallError(configFile, previous, error) {
+  const state = {
+    version: 1,
+    status: previous?.status ?? "not_started",
+    completedSteps: previous?.completedSteps ?? [],
+    configFile: path.resolve(configFile),
+    updatedAt: new Date().toISOString(),
+    ...safeDetails(previous ?? {}),
+    lastError: String(error instanceof Error ? error.message : error).slice(0, 500),
+  };
+  await writeInstallState(configFile, state);
+  return state;
+}
+
+async function writeInstallState(configFile, state) {
+  const file = installStatePath(configFile);
+  const directory = path.dirname(file);
+  let created = false;
+  try {
+    const details = await lstat(directory);
+    if (!details.isDirectory() || details.isSymbolicLink()) {
+      throw new Error(`Unsafe install state directory: ${directory}`);
+    }
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    created = true;
+  }
+  if (created) await chmod(directory, 0o700);
+  const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(state, null, 2)}\n`, {
+      encoding: "utf8",
+      mode: 0o600,
+      flag: "wx",
+    });
+    await rename(temporary, file);
+    await chmod(file, 0o600);
+  } catch (error) {
+    await rm(temporary, { force: true });
+    throw error;
+  }
+}
+
+function safeDetails(details) {
+  const allowed = ["instanceId", "preset", "chatType", "serviceInstalled", "testCardDisabled"];
+  return Object.fromEntries(
+    Object.entries(details).filter(([key, value]) => allowed.includes(key) && value !== undefined),
+  );
+}

package/scripts/launchd.mjs

@@ -0,0 +1,161 @@
+import "dotenv/config";
+
+import { spawnSync } from "node:child_process";
+import { chmod, lstat, mkdir, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const projectDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const instanceId = safeInstanceId(process.env.BRIDGE_INSTANCE_ID);
+const configFile = process.env.DOTENV_CONFIG_PATH?.trim();
+const label = `com.feishu-codex-bridge.${instanceId}`;
+const legacyLabels = ["com.leochaseyoung.feishu-codex-bridge"];
+const agentDir = path.join(homedir(), "Library", "LaunchAgents");
+const plistPath = path.join(agentDir, `${label}.plist`);
+const domain = `gui/${process.getuid()}`;
+const service = `${domain}/${label}`;
+const action = process.argv[2] ?? "status";
+
+if (process.platform !== "darwin") {
+  console.error("LaunchAgent 仅支持 macOS。");
+  process.exit(1);
+}
+
+if (action === "install") {
+  await install();
+} else if (action === "uninstall") {
+  await uninstall();
+} else if (action === "status") {
+  const result = launchctl(["print", service], true);
+  process.exitCode = result.status === 0 ? 0 : 1;
+} else if (action === "stop") {
+  const result = launchctl(["bootout", service], false);
+  process.exitCode = result.status === 0 ? 0 : 1;
+  if (result.status === 0) console.log(`已停止 ${label}`);
+} else if (action === "restart") {
+  const result = launchctl(["kickstart", "-k", service], true);
+  process.exitCode = result.status === 0 ? 0 : 1;
+  if (result.status === 0) console.log(`已重启 ${label}`);
+} else {
+  console.error("用法：node scripts/launchd.mjs install|uninstall|status|stop|restart");
+  process.exitCode = 2;
+}
+
+async function install() {
+  const dataDir = path.resolve(process.env.BRIDGE_DATA_DIR || path.join(projectDir, "var"));
+  const logDir = path.join(dataDir, "log");
+  await mkdir(agentDir, { recursive: true });
+  await ensurePrivateDirectory(logDir);
+  await writeFile(plistPath, plist(logDir), { encoding: "utf8", mode: 0o644 });
+  await chmod(plistPath, 0o644);
+  launchctl(["bootout", service], false);
+  for (const legacyLabel of legacyLabels) {
+    const legacyService = `${domain}/${legacyLabel}`;
+    launchctl(["bootout", legacyService], false);
+    await rm(path.join(agentDir, `${legacyLabel}.plist`), { force: true });
+  }
+  await delay(750);
+  let boot = launchctl(["bootstrap", domain, plistPath], true);
+  for (let attempt = 1; boot.status !== 0 && attempt < 3; attempt += 1) {
+    await delay(750 * (attempt + 1));
+    boot = launchctl(["bootstrap", domain, plistPath], true);
+  }
+  if (boot.status !== 0) process.exit(boot.status ?? 1);
+  launchctl(["enable", service], false);
+  // Bootstrap + RunAtLoad already starts the service. A non-destructive kickstart
+  // covers slower launchd versions without racing a second bridge process against
+  // the first one while its Feishu subscriptions are still being registered.
+  const start = launchctl(["kickstart", service], true);
+  if (start.status !== 0) process.exit(start.status ?? 1);
+  console.log(`已安装并启动 ${label}`);
+  console.log(`日志目录：${logDir}`);
+}
+
+async function ensurePrivateDirectory(directory) {
+  try {
+    const details = await lstat(directory);
+    if (!details.isDirectory() || details.isSymbolicLink()) {
+      throw new Error(`Unsafe service directory: ${directory}`);
+    }
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+  }
+  await chmod(directory, 0o700);
+}
+
+function delay(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+async function uninstall() {
+  launchctl(["bootout", service], false);
+  await rm(plistPath, { force: true });
+  for (const legacyLabel of legacyLabels) {
+    launchctl(["bootout", `${domain}/${legacyLabel}`], false);
+    await rm(path.join(agentDir, `${legacyLabel}.plist`), { force: true });
+  }
+  console.log(`已卸载 ${label}`);
+}
+
+function launchctl(args, inherit) {
+  return spawnSync("launchctl", args, {
+    cwd: projectDir,
+    env: process.env,
+    encoding: "utf8",
+    stdio: inherit ? "inherit" : "ignore",
+  });
+}
+
+function plist(logDir) {
+  const environmentPath = process.env.PATH ?? "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin";
+  const configEnvironment = configFile
+    ? `\n    <key>DOTENV_CONFIG_PATH</key><string>${xml(path.resolve(configFile))}</string>`
+    : "";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${xml(label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${xml(process.execPath)}</string>
+    <string>--disable-warning=ExperimentalWarning</string>
+    <string>${xml(path.join(projectDir, "dist", "index.js"))}</string>
+  </array>
+  <key>WorkingDirectory</key><string>${xml(projectDir)}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>NODE_ENV</key><string>production</string>
+    <key>PATH</key><string>${xml(environmentPath)}</string>${configEnvironment}
+  </dict>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>ThrottleInterval</key><integer>5</integer>
+  <key>ProcessType</key><string>Interactive</string>
+  <key>StandardOutPath</key><string>${xml(path.join(logDir, "bridge.log"))}</string>
+  <key>StandardErrorPath</key><string>${xml(path.join(logDir, "bridge.error.log"))}</string>
+</dict>
+</plist>
+`;
+}
+
+function xml(value) {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&apos;");
+}
+
+function safeInstanceId(value) {
+  const normalized = (value?.trim() || "default")
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 40);
+  if (!normalized) throw new Error("BRIDGE_INSTANCE_ID must contain letters or numbers");
+  return normalized;
+}