lark-remote 0.5.3 → 0.5.5

package/dist/config/index.js

@@ -130,10 +130,11 @@ export const CodexConfigSchema = z.object({
 });
 /** OpenCode-specific configuration (pure ACP mode: `opencode acp` over stdio). */
 const OpencodeConfigSchema = z.object({
-    /** Provider ID for the LLM backend (e.g. 'anthropic'). */
-    providerID: z.string().default('anthropic'),
-    /** Model ID for the LLM backend (e.g. 'claude-sonnet-4-20250514'). */
-    modelID: z.string().default('claude-sonnet-4-20250514'),
+    /** Provider ID for the LLM backend. `opencode` is present in both v1 and v2
+     *  catalogs; a user-selected provider/model overrides it. */
+    providerID: z.string().default('opencode'),
+    /** Model ID for the LLM backend. `big-pickle` exists in both v1 and v2. */
+    modelID: z.string().default('big-pickle'),
     /** Session mode (opencode agent name): 'build' (default) or 'plan'. */
     mode: z.enum(['build', 'plan']).default('build'),
     /** ACP sub-configuration. Structurally mirrors kimi: the card exposes
@@ -189,8 +190,33 @@ const KimiConfigSchema = z.object({
 export const DEFAULT_DSH_HOST = 'http://127.0.0.1:3080';
 /** DSH (DeepSeek Harness) Web Host connection config. */
 const DshConfigSchema = z.object({
-    /** DSH Web Host base URL (no auth, local). */
+    /** DSH Web Host base URL (local). */
     host: z.string().url().default(DEFAULT_DSH_HOST),
+    /**
+     * 全局 DSH 未运行时是否由 lark-remote 后台拉起（detached，lark-remote
+     * 退出后继续运行）。默认 true；设为 false 时只连接已运行的 DSH。
+     */
+    manageProcess: z.boolean().default(true),
+    /** DSH 的 $DSH_HOME；默认 $DSH_HOME 或 ~/.dsh。用于启动锁和 DSH 日志目录。 */
+    dshHome: z.string().optional(),
+    /** DSH 可执行文件；默认 dsh。 */
+    dshCommand: z.string().optional(),
+    /** 后台拉起 DSH 后等待端口可用的上限（毫秒）。 */
+    startTimeoutMs: z.number().int().min(1000).max(600000).default(30_000),
+    /**
+     * DSH Web launch token (0.2.x requires auth). Paste the token from the URL
+     * printed by `dsh web`, or the whole URL — the client extracts `token`.
+     * Optional fallback: normally lark-remote mints cookies from the durable
+     * DSH browser-session secret instead.
+     */
+    token: z.string().optional(),
+    /**
+     * DSH credentials file containing the durable browser-session signing
+     * secret. Defaults to `$DSH_HOME/.credentials.yaml` or
+     * `~/.dsh/.credentials.yaml`. Reading that secret lets lark-remote mint a
+     * fresh browser cookie after an external `dsh web` restart.
+     */
+    credentialsFile: z.string().optional(),
     /**
      * Session preset（agentPreset）。preset 在 session 创建时固定，中途切换会被
      * 服务端拒绝（agent-preset-conflict）。留空 = 跟随服务端默认（不传 agentPreset）。
@@ -198,10 +224,24 @@ const DshConfigSchema = z.object({
      * 控制 + 运行时 DSH API 报错兜底。
      */
     agentPreset: z.string().optional(),
+    /**
+     * 权限预设（沙箱模式 + 审批策略）。与 agentPreset 不同，它可以在会话中
+     * 切换；lark-remote 会在会话首次 run 前执行一次 `/permission <preset>`
+     * 对齐。留空 = 不干预，跟随 DSH 当前会话/服务端默认。
+     */
+    permissionPreset: z.string().optional(),
+    /**
+     * 模型服务商（DSH provider route）。取值来自 `session/modelCatalog` 的
+     * `groups[].id`，例如 deepseek-official / deepseek-account / anthropic。
+     * 留空 = 兼容旧配置：按 deepseek-official 处理（与 provider 硬编码时代的
+     * 行为一致）。枚举不在此硬编码：provider 清单随 DSH profile bundle 与
+     * 用户配置变化。
+     */
+    provider: z.string().optional(),
     /** 模型 ID。留空 = 跟随服务端默认。 */
     model: z.string().optional(),
     /**
-     * 推理强度（off / low / high / max，跟随 llm.models 实际档位）。留空 = 跟随
+     * 推理强度（off / low / high / max，跟随 session/modelCatalog 实际档位）。留空 = 跟随
      * 服务端默认。枚举不硬编码（理由同上 agentPreset）。
      */
     reasoningEffort: z.string().optional(),

package/dist/config/opencode-config.d.ts

@@ -1,7 +1,7 @@
 /**
  * OpenCode 配置读取工具
  *
- * 从 opencode models --verbose 命令获取 provider 和 model 信息
+ * 从 opencode models 命令获取 provider 和 model 信息
  */
 interface OpencodeConfigResult {
     /** provider 名称列表 */
@@ -12,9 +12,9 @@ interface OpencodeConfigResult {
 /** 清空缓存（仅供测试使用，生产代码无调用点） */
 export declare function invalidateOpencodeConfigCache(): void;
 /**
- * 加载 opencode 配置，执行 opencode models --verbose 并解析
+ * 加载 opencode 配置，执行 opencode models 并解析
  *
  * @returns provider 列表和 model 查询接口
  */
-export declare function loadOpencodeConfig(): OpencodeConfigResult;
+export declare function loadOpencodeConfig(binary?: string): OpencodeConfigResult;
 export {};

package/dist/config/opencode-config.js

@@ -1,7 +1,7 @@
 /**
  * OpenCode 配置读取工具
  *
- * 从 opencode models --verbose 命令获取 provider 和 model 信息
+ * 从 opencode models 命令获取 provider 和 model 信息
  */
 import { resolveExecutable } from '../platform/command.js';
 import { spawnProcessSync } from '../platform/spawn.js';
@@ -13,7 +13,8 @@ import { getLogger } from '../logger/index.js';
  */
 const FALLBACK_MODELS = {
     opencode: ['big-pickle'],
-    deepseek: ['deepseek-chat'],
+    'opencode-go': ['deepseek-v4.1-flash'],
+    deepseek: ['deepseek-chat', 'deepseek-flash', 'deepseek-v4-pro'],
     'minimax-cn-coding-plan': ['MiniMax-M2.5'],
 };
 /** fallback provider 列表从模型表派生，保证不会出现空模型列表的 provider（历史曾混入无模型的 myprovider/volcengine-plan） */
@@ -51,33 +52,41 @@ function buildFallbackResult() {
     };
 }
 /**
- * 加载 opencode 配置，执行 opencode models --verbose 并解析
+ * 加载 opencode 配置，执行 opencode models 并解析
  *
  * @returns provider 列表和 model 查询接口
  */
-export function loadOpencodeConfig() {
+export function loadOpencodeConfig(binary = 'opencode') {
     const now = Date.now();
     // 正缓存命中：TTL 内不重复 execSync
-    if (opencodeConfigCache && now - opencodeConfigCache.timestamp < OPENCODE_CONFIG_CACHE_TTL_MS) {
+    if (opencodeConfigCache?.binary === binary &&
+        now - opencodeConfigCache.timestamp < OPENCODE_CONFIG_CACHE_TTL_MS) {
         return opencodeConfigCache.result;
     }
     // 失败负缓存：命令最近失败过，TTL 内直接用 fallback，不再同步阻塞
-    if (opencodeConfigFailedAt !== null &&
-        now - opencodeConfigFailedAt < OPENCODE_NEGATIVE_CACHE_TTL_MS) {
+    if (opencodeConfigFailedAt?.binary === binary &&
+        now - opencodeConfigFailedAt.timestamp < OPENCODE_NEGATIVE_CACHE_TTL_MS) {
         return buildFallbackResult();
     }
     try {
         // 经 seam 解析真实可执行文件（win32 PATHEXT），cross-spawn 同步执行
-        const resolved = resolveExecutable('opencode');
+        const resolved = resolveExecutable(binary);
         if (!resolved)
             throw new Error('opencode not found');
-        // 执行 opencode models --verbose 获取所有模型信息
-        const res = spawnProcessSync(resolved.file, ['models', '--verbose'], {
+        // v2 removed `--verbose`; plain `models` prints one `provider/model` per
+        // line in both v1 and v2. Try the warm shared daemon first (fast); if it is
+        // unavailable, retry with v2's private `--standalone` server.
+        const modelOpts = {
             encoding: 'utf-8',
             // 30s → 10s，与 codex/kimi 对齐；maxBuffer 防模型清单 ENOBUFS 隐性截断
             timeout: 10000,
             maxBuffer: 64 * 1024 * 1024,
-        });
+            windowsHide: true,
+        };
+        let res = spawnProcessSync(resolved.file, ['models'], modelOpts);
+        if (res.error || res.status !== 0) {
+            res = spawnProcessSync(resolved.file, ['models', '--standalone'], modelOpts);
+        }
         if (res.error)
             throw res.error;
         if (res.status !== 0) {
@@ -89,16 +98,23 @@ export function loadOpencodeConfig() {
         // 解析输出：每个模型以 provider/model 格式开头，后面跟着 JSON 块
         const lines = output.split('\n');
         for (const line of lines) {
-            // 检测模型头如 "opencode/big-pickle" 或 "deepseek/deepseek-chat"
-            const match = line.match(/^([a-zA-Z0-9_-]+)\/([a-zA-Z0-9_.-]+)$/);
-            if (match) {
-                const providerID = match[1];
-                const modelID = match[2];
-                if (!providerModels.has(providerID)) {
-                    providerModels.set(providerID, []);
-                }
-                providerModels.get(providerID).push(modelID);
+            // 检测模型头如 "opencode/big-pickle" 或 "deepseek/deepseek-chat".
+            // Split on the FIRST slash: some providers expose model IDs that
+            // themselves contain "/" (e.g. openrouter/anthropic/...).
+            const trimmed = line.trim();
+            const slash = trimmed.indexOf('/');
+            if (slash <= 0 || slash === trimmed.length - 1)
+                continue;
+            const providerID = trimmed.slice(0, slash);
+            const modelID = trimmed.slice(slash + 1);
+            if (!/^[a-zA-Z0-9_.-]+$/.test(providerID))
+                continue;
+            if (/\s/.test(modelID))
+                continue;
+            if (!providerModels.has(providerID)) {
+                providerModels.set(providerID, []);
             }
+            providerModels.get(providerID).push(modelID);
         }
         const providerNames = Array.from(providerModels.keys()).sort();
         const modelOptions = (provider) => {
@@ -115,7 +131,7 @@ export function loadOpencodeConfig() {
             return providerModels.get(provider) ?? [];
         };
         const result = { providerNames, modelOptions };
-        opencodeConfigCache = { result, timestamp: now };
+        opencodeConfigCache = { binary, result, timestamp: now };
         opencodeConfigFailedAt = null;
         return result;
     }
@@ -123,7 +139,7 @@ export function loadOpencodeConfig() {
         // 如果命令失败，使用 fallback
         const logger = getLogger();
         logger.warn(`[opencode-config] failed to load opencode models: ${error}`);
-        opencodeConfigFailedAt = now;
+        opencodeConfigFailedAt = { binary, timestamp: now };
         return buildFallbackResult();
     }
 }

package/dist/inbound/authorize.d.ts

@@ -0,0 +1,34 @@
+/**
+ * InboundAuthorizer：入站消息/媒体的统一 owner 授权入口。
+ *
+ * owner 绑定只发生在文本消息的 `binder.authorize()`
+ * 里，媒体入口只做只读 `isOwner()` 检查。新安装用户的第一条消息是纯图片/文件
+ * 时，媒体处理被静默丢弃、绑定也永远不完成。文本与媒体现在都走这里：
+ *
+ *  - `rejected`：已绑定但不是 owner → 调用方静默丢弃；
+ *  - `bind_success`：首条入站消息完成绑定 → 触发一次 onboarding（默认 cwd、
+ *    欢迎语、帮助卡），媒体调用方继续下载（纯媒体最终走 no-text 回执）；
+ *  - `owner`：正常放行。
+ *
+ * onboarding 用一次性 promise 去重：一条 post 同时带图和文字时，connector 会
+ * 先后触发媒体与文本两个入口，两个入口都看到 bind_success 也只跑一次。
+ */
+import type { OwnerBinder } from '../binder.js';
+export type InboundAuthorization = 'owner' | 'bind_success' | 'rejected';
+export interface InboundAuthorizerOptions {
+    binder: OwnerBinder;
+    /**
+     * 首次绑定时的副作用（同步设置默认 cwd + 异步发欢迎语/帮助卡）。
+     * 同步部分必须在返回前完成：用户的下一条消息要能找到已写好的 cwd。
+     */
+    onBind: (userId: string, chatId: string) => void | Promise<void>;
+}
+export declare class InboundAuthorizer {
+    private readonly opts;
+    private onboarding;
+    constructor(opts: InboundAuthorizerOptions);
+    /** 绑定/授权判定 + 首次绑定时触发 onboarding。 */
+    authorize(userId: string, chatId: string): InboundAuthorization;
+    /** 等待首次绑定的 onboarding 完成（测试 / 收尾用；生产路径不阻塞）。 */
+    whenBound(): Promise<void>;
+}

package/dist/inbound/authorize.js

@@ -0,0 +1,31 @@
+import { getLogger } from '../logger/index.js';
+export class InboundAuthorizer {
+    opts;
+    onboarding;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /** 绑定/授权判定 + 首次绑定时触发 onboarding。 */
+    authorize(userId, chatId) {
+        const decision = this.opts.binder.authorize(userId, chatId);
+        if (decision.kind === 'bind_success' && this.onboarding === undefined) {
+            // onBind 同步调用（默认 cwd 的写入必须在返回前生效，下一条消息才会命中
+            // 已设置的 cwd）；只把它的异步后续（发欢迎语/帮助卡）挂到 promise 上。
+            try {
+                this.onboarding = Promise.resolve(this.opts.onBind(userId, chatId)).catch((err) => {
+                    getLogger().error('[binder] onboarding failed:', err);
+                });
+            }
+            catch (err) {
+                this.onboarding = Promise.resolve();
+                getLogger().error('[binder] onboarding failed:', err);
+            }
+        }
+        return decision.kind;
+    }
+    /** 等待首次绑定的 onboarding 完成（测试 / 收尾用；生产路径不阻塞）。 */
+    whenBound() {
+        return this.onboarding ?? Promise.resolve();
+    }
+}
+//# sourceMappingURL=authorize.js.map

package/dist/index.js

@@ -10,6 +10,7 @@ import { warmCodexCatalogCache } from './config/codex-config.js';
 import { SessionReaderRegistry, SessionStore } from './session/index.js';
 import { ClaudeSessionReader, CodexSessionReader, OpencodeSessionReader, PiSessionReader, KimiSessionReader, DshSessionReader, } from './session/index.js';
 import { CommandRouter, isImmediateAction, DIRECT_RETURN_CMDS, SESSION_MUTATING_ACTION_CMDS, COMPACT_ACTION_CMDS, } from './router/index.js';
+import { DshDaemon } from './runner/dsh/daemon.js';
 import { dispatchOrderExecForQueue } from './router/order-exec-dispatch.js';
 import { buildCardActionFullValue } from './router/card-action-payload.js';
 import { actionFeedbackText } from './router/card-action-feedback.js';
@@ -26,6 +27,7 @@ import { checkLatestVersion, compareVersions, runInstallLatest, formatUpdateHint
 import { classifyRejection } from './error-classification.js';
 import { WorkspaceStore } from './workspace/index.js';
 import { InboundTurnAssembler } from './inbound/turn-assembler.js';
+import { InboundAuthorizer } from './inbound/authorize.js';
 import { stripPlaceholders } from './inbound/placeholder.js';
 import { buildSessionHistoryCard } from './router/card-helpers.js';
 import { newSessionButton, resumeCompactButton, agentDisplayName } from './card/card-shared.js';
@@ -136,6 +138,15 @@ function initializeRunner(config, configDir, cliArgs) {
     // 单点化：runner factory 取最新 config 的唯一入口（语义保持，
     // container 未接线时回退启动快照）。
     const latest = () => agentRegistry.getConfigContainer()?.current ?? config;
+    // One global DSH per machine/DSH_HOME. This resolver reuses a listening
+    // process or starts `dsh web` detached; it never owns the child's lifetime.
+    const dshDaemon = new DshDaemon({
+        host: () => getAgentConfig(latest(), 'dsh')?.host,
+        dshHome: () => getAgentConfig(latest(), 'dsh')?.dshHome,
+        dshCommand: () => getAgentConfig(latest(), 'dsh')?.dshCommand,
+        manageProcess: () => getAgentConfig(latest(), 'dsh')?.manageProcess ?? true,
+        startTimeoutMs: () => getAgentConfig(latest(), 'dsh')?.startTimeoutMs,
+    });
     // Claude factory reads from configContainer (not closure) so runtime
     // config changes (model, effort, stopGraceMs) take effect after
     // bridge.setConfig() + clearRunners(). Same pattern as codex/pi/kimi.
@@ -181,8 +192,14 @@ function initializeRunner(config, configDir, cliArgs) {
     sessionReaderRegistry.register('claude', new ClaudeSessionReader());
     sessionReaderRegistry.register('codex', codexSessionReader);
     // Register OpencodeSessionReader (CLI version)
-    // Using `opencode session list` and `opencode export` instead of HTTP API
-    const opencodeSessionReader = new OpencodeSessionReader();
+    // Using `opencode session list` and `session export` instead of HTTP API.
+    // Share the configured binary with the ACP runner so `opencode2` (v2) can
+    // be used without the reader silently falling back to a v1 `opencode`.
+    // The reader is registered once; changing acp.binary at runtime requires a
+    // lark-remote restart.
+    const opencodeSessionReader = new OpencodeSessionReader({
+        binary: getAgentConfig(config, 'opencode')?.acp?.binary,
+    });
     agentRegistry.register('opencode', (_ws) => {
         const ocConfig = getAgentConfig(latest(), 'opencode');
         // Build model string with validation: provider/model format
@@ -258,19 +275,39 @@ function initializeRunner(config, configDir, cliArgs) {
         // hostProvider 每次调用读最新 config：/config 修改 host 后 runner 重建为
         // 新 host，reader（/resume、用量、完成卡）也跟随新 host。
         hostProvider: () => getAgentConfig(latest(), 'dsh')?.host,
+        dshHomeProvider: () => getAgentConfig(latest(), 'dsh')?.dshHome,
+        tokenProvider: () => getAgentConfig(latest(), 'dsh')?.token,
+        credentialsFileProvider: () => getAgentConfig(latest(), 'dsh')?.credentialsFile,
     });
     agentRegistry.register('dsh', (_ws) => {
         const dshConf = getAgentConfig(latest(), 'dsh');
+        // Warm the shared process in the background so the first message and
+        // `/resume` do not pay the full startup delay. Failures surface from
+        // DshRunner.run(), which awaits the same resolver.
+        void dshDaemon.ensure().catch((error) => {
+            getLogger().warn(`[dsh] background start failed: ${error.message}`);
+        });
         return new DshRunner({
             kind: 'dsh',
             sessionReader: dshSessionReader,
+            daemon: dshDaemon,
             host: dshConf?.host,
+            dshHome: dshConf?.dshHome,
+            token: dshConf?.token,
+            credentialsFile: dshConf?.credentialsFile,
             agentPreset: dshConf?.agentPreset,
+            permissionPreset: dshConf?.permissionPreset,
+            provider: dshConf?.provider,
             model: dshConf?.model,
             reasoningEffort: dshConf?.reasoningEffort,
         });
     });
     sessionReaderRegistry.register('dsh', dshSessionReader);
+    if (config.defaultAgent === 'dsh') {
+        void dshDaemon.ensure().catch((error) => {
+            getLogger().warn(`[dsh] startup probe failed: ${error.message}`);
+        });
+    }
     // 2026-07-17: 注册所有 agent 的显示名，实现单点真相
     agentRegistry.registerDisplayName('claude', 'Claude');
     agentRegistry.registerDisplayName('codex', 'Codex');
@@ -347,13 +384,69 @@ function setupMessageHandlers(connector, router, bridge, sessionStore, workspace
         },
     });
     router.setInboundFlusher(() => assembler.flushAll('flush'));
+    // 统一的入站授权入口（文本 + 媒体共用）：未绑定时，首条入站消息——无论
+    // 纯文本、纯媒体还是图文混合——都完成 owner 绑定并触发一次 onboarding。
+    // 媒体入口原先只做只读 isOwner 检查，新安装用户第一条消息是截图时既不绑定、
+    // 也不保存、也没有任何反馈。
+    const authorizer = new InboundAuthorizer({
+        binder,
+        onBind: (userId, chatId) => {
+            // First-run onboarding: set default cwd + send welcome + Help card.
+            // setCwd is synchronous (before returning the async send promise) so the
+            // user's next message — which will hit the `owner` branch now that
+            // startup-contact.json has been written — finds cwd already set.
+            // process.cwd() is the only sensible default: the user started
+            // lark-remote in the directory they want to work in.
+            // setCwd only when no cwd is set yet (e.g. fresh start after bind).
+            // Don't overwrite an existing cwd — the user may have already set one
+            // via /cd or a previous bind. Use realpath for canonical form (matching
+            // Claude JSONL cwd, e.g. /tmp → /private/tmp on macOS).
+            let resolvedCwd;
+            try {
+                resolvedCwd = fs.realpathSync(process.cwd());
+            }
+            catch {
+                resolvedCwd = process.cwd();
+            }
+            if (!sessionStore.getCwd(userId)) {
+                sessionStore.setCwd(userId, resolvedCwd);
+            }
+            return (async () => {
+                try {
+                    // Message 1: bind confirmation + status (combined to avoid
+                    // Feishu out-of-order delivery across three separate messages).
+                    await connector.sendWithRetry(chatId, {
+                        text: `✅ 已绑定到本账号，此后仅你可使用本应用\n` +
+                            `📂 当前工作目录: \`${resolvedCwd}\`\n` +
+                            `🤖 默认 Agent: ${agentDisplayName(config.defaultAgent)}\n` +
+                            `💡 直接输入消息即可开始对话，或 /cd 切换目录`,
+                    });
+                    // Message 2: Help card.
+                    // Use router.cmdHelp() + manual send (without replyTo) so the Help
+                    // card appears as an independent message, not a reply to the PIN
+                    // message. router.handle('/help') would set replyTo=msg.messageId
+                    // (the PIN), causing the card to nest under the PIN in Feishu UI.
+                    const helpResult = router.cmdHelp();
+                    if (helpResult.card) {
+                        await connector.sendWithRetry(chatId, { card: helpResult.card });
+                    }
+                }
+                catch (err) {
+                    logger.error('[binder] onboarding send failed:', err);
+                }
+            })();
+        },
+    });
     // 入站媒体（图片/文件/视频/语音/表情）：先认证后下载（修复）。
     // connector 只上报"媒体到达"，这里先过 owner + enabled 闸门，通过后才
     // 下载——未认证/关闭配置时不会发生任何网络下载或内存/磁盘占用。
     // 下载是异步的：立刻把在途 promise 交给装配器（`kind: 'media'`），
     // 保证「先图后文」不会先提交一个只含文本的 turn。
     connector.setInboundMediaDetectedHandler((msg) => {
-        if (!binder.isOwner(msg.userId)) {
+        // 与文本入口共用授权：首条纯媒体也在这里完成 owner 绑定（bind_success
+        // 继续走下载 + 装配，纯媒体最终由装配器发 no-text 回执）。
+        const authorization = authorizer.authorize(msg.userId, msg.chatId);
+        if (authorization === 'rejected') {
             logger.warn(`[media] rejected inbound media from non-owner ${msg.userId}`);
             return;
         }
@@ -402,58 +495,16 @@ function setupMessageHandlers(connector, router, bridge, sessionStore, workspace
         });
     });
     connector.setMessageHandler((msg) => {
-        // 绑定/授权闸门：仅 owner 放行；非 owner 静默丢弃；未绑定时首条消息认领
-        const decision = binder.authorize(msg.userId, msg.chatId);
-        if (decision.kind === 'rejected')
+        // 绑定/授权闸门：仅 owner 放行；非 owner 静默丢弃；未绑定时首条消息认领。
+        // 与媒体入口共用 InboundAuthorizer：bind_success 的 onboarding 只跑一次
+        // （同一条 post 同时带图和文字时两个入口都会看到 bind_success）。
+        const decision = authorizer.authorize(msg.userId, msg.chatId);
+        if (decision === 'rejected')
             return;
-        if (decision.kind === 'bind_success') {
-            // First-run onboarding: set default cwd + send welcome + Help card.
-            // setCwd is synchronous (outside the async closure) so that the user's
-            // next message — which will hit the `owner` branch now that
-            // startup-contact.json has been written — finds cwd already set.
-            // process.cwd() is the only sensible default: the user started
-            // lark-remote in the directory they want to work in.
-            // setCwd only when no cwd is set yet (e.g. fresh start after bind).
-            // Don't overwrite an existing cwd — the user may have already set one
-            // via /cd or a previous bind. Use realpath for canonical form (matching
-            // Claude JSONL cwd, e.g. /tmp → /private/tmp on macOS).
-            let resolvedCwd;
-            try {
-                resolvedCwd = fs.realpathSync(process.cwd());
-            }
-            catch {
-                resolvedCwd = process.cwd();
-            }
-            if (!sessionStore.getCwd(msg.userId)) {
-                sessionStore.setCwd(msg.userId, resolvedCwd);
-            }
-            void (async () => {
-                try {
-                    // Message 1: bind confirmation + status (combined to avoid
-                    // Feishu out-of-order delivery across three separate messages).
-                    await connector.sendWithRetry(msg.chatId, {
-                        text: `✅ 已绑定到本账号，此后仅你可使用本应用\n` +
-                            `📂 当前工作目录: \`${resolvedCwd}\`\n` +
-                            `🤖 默认 Agent: ${agentDisplayName(config.defaultAgent)}\n` +
-                            `💡 直接输入消息即可开始对话，或 /cd 切换目录`,
-                    });
-                    // Message 2: Help card.
-                    // Use router.cmdHelp() + manual send (without replyTo) so the Help
-                    // card appears as an independent message, not a reply to the PIN
-                    // message. router.handle('/help') would set replyTo=msg.messageId
-                    // (the PIN), causing the card to nest under the PIN in Feishu UI.
-                    const helpResult = router.cmdHelp();
-                    if (helpResult.card) {
-                        await connector.sendWithRetry(msg.chatId, { card: helpResult.card });
-                    }
-                }
-                catch (err) {
-                    logger.error('[binder] onboarding send failed:', err);
-                }
-            })();
+        // 首条消息只用于完成绑定，不转发给 agent（与旧行为一致）。
+        if (decision === 'bind_success')
             return;
-        }
-        // decision.kind === 'owner'：正常处理（不再每条覆盖 startup-contact）
+        // decision === 'owner'：正常处理（不再每条覆盖 startup-contact）
         logger.info(`message from ${msg.userId} (${msg.rawContentType}): ${msg.content.slice(0, 100)}`);
         // Add Typing reaction to indicate "still alive"
         void connector.addReaction(msg.messageId, 'Typing');
@@ -497,17 +548,19 @@ function setupMessageHandlers(connector, router, bridge, sessionStore, workspace
                 `(msg_type=${msg.rawContentType})`);
         }
         const commandEligible = msg.rawContentType === 'text' && stripped.kinds.length === 0 && stripped.clean !== '';
-        // 命令消息旁路装配窗口：其它 /命令 立即执行，窗口内已装配的内容
-        // 作为独立提交冲刷（/stop 已在上面处理，立即生效不等待）。
+        // 命令消息旁路装配窗口：/命令 立即执行，但必须先等窗口内已装配的内容
+        // （含在途媒体下载）提交完成。此前 `void flush()` 不等待，
+        // 有下载在途时命令会先于 commit 执行——发送在 /cd、/new 前的消息被绑定到
+        // 新 cwd/session，媒体也落到新目录。/stop 已在上面走快速路径，不受影响。
         if (commandEligible && (stripped.clean.startsWith('/') || stripped.clean.startsWith('!'))) {
-            void assembler.flush(msg.userId, msg.chatId, 'flush');
-            void router
-                .handle(stripped.clean, {
-                userId: msg.userId,
-                chatId: msg.chatId,
-                messageId: msg.messageId,
-            }, { allowCommandPrefix: true })
-                .catch((err) => logger.error('[control] command failed:', err));
+            void (async () => {
+                await assembler.flush(msg.userId, msg.chatId, 'flush');
+                await router.handle(stripped.clean, {
+                    userId: msg.userId,
+                    chatId: msg.chatId,
+                    messageId: msg.messageId,
+                }, { allowCommandPrefix: true });
+            })().catch((err) => logger.error('[control] command failed:', err));
             return;
         }
         // 普通消息：进装配器，等静默期窗口到期（下载落定）后合并成一个 turn。

package/dist/instance-lock.d.ts

@@ -33,6 +33,15 @@ export declare class InstanceLock {
      * 与 CIM CommandLine 首 token 归一后必然一致（bun/node 垫片场景亦然）。
      */
     private lockContents;
+    /** 原子创建锁文件；已存在返回 false，其它 IO 错误向上抛。 */
+    private tryCreate;
+    /**
+     * 把夺来的活锁放回原位。优先 `link`（目标已存在会失败，不会覆盖更新的锁），
+     * 再删 quarantine。目标已被更新锁占据时放弃恢复——此时当前锁文件属于一个
+     * 活实例，拒绝取锁仍然是对的。
+     */
+    private restoreQuarantine;
+    /** 读取锁文件内容（无副作用：不再在读取失败时 unlink 当前锁）。 */
     private readPidAndName;
     /**
      * 锁是否仍由「我们的」实例持有（fail-open 三态）：