larkin 0.2.70

package/dist/app/agent-lark-cli-workspace.cjs

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.larkChannelSourceConfigPath = larkChannelSourceConfigPath;
+exports.larkChannelWorkspaceConfigPath = larkChannelWorkspaceConfigPath;
+exports.managedLarkCliEnv = managedLarkCliEnv;
+exports.managedOfficialLarkCli = managedOfficialLarkCli;
+exports.assertAgentWorkspaceBound = assertAgentWorkspaceBound;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const official_lark_cli_js_1 = require("./official-lark-cli.cjs");
+function larkChannelSourceConfigPath(agent) {
+    if (!agent.stateDir)
+        throw new Error(`Agent ${agent.agentId} 缺少 stateDir，无法建立 lark-channel binding`);
+    return node_path_1.default.join(node_path_1.default.resolve(agent.stateDir), "lark-channel-source", "config.json");
+}
+function larkChannelWorkspaceConfigPath(agent) {
+    if (!agent.larkConfigDir)
+        throw new Error(`Agent ${agent.agentId} 缺少 larkConfigDir，无法建立 lark-channel binding`);
+    return node_path_1.default.join(node_path_1.default.resolve(agent.larkConfigDir), "lark-channel", "config.json");
+}
+function managedLarkCliEnv(agent, env) {
+    if (!agent.larkConfigDir)
+        throw new Error(`Agent ${agent.agentId} 缺少 larkConfigDir，拒绝回退 local workspace`);
+    const isolated = { ...env };
+    for (const key of ["OPENCLAW_CLI", "OPENCLAW_HOME", "OPENCLAW_STATE_DIR", "OPENCLAW_CONFIG_PATH", "OPENCLAW_SERVICE_MARKER",
+        "OPENCLAW_SERVICE_VERSION", "OPENCLAW_GATEWAY_PORT", "OPENCLAW_SHELL", "HERMES_HOME", "HERMES_QUIET", "HERMES_EXEC_ASK",
+        "HERMES_GATEWAY_TOKEN", "HERMES_SESSION_KEY"])
+        delete isolated[key];
+    return {
+        ...isolated,
+        LARK_CHANNEL: "1",
+        LARK_CHANNEL_CONFIG: larkChannelSourceConfigPath(agent),
+        LARKSUITE_CLI_CONFIG_DIR: node_path_1.default.resolve(agent.larkConfigDir),
+    };
+}
+function managedOfficialLarkCli(agent, env, resolve = official_lark_cli_js_1.resolveOfficialLarkCli) {
+    assertAgentWorkspaceBound(agent);
+    const managedEnv = managedLarkCliEnv(agent, env);
+    return { command: resolve({ env: managedEnv }), env: managedEnv };
+}
+function readPrivateJson(file, label) {
+    const directory = node_fs_1.default.lstatSync(node_path_1.default.dirname(file));
+    if (!directory.isDirectory() || directory.isSymbolicLink() || (directory.mode & 0o777) !== 0o700
+        || (typeof process.getuid === "function" && directory.uid !== process.getuid()))
+        throw new Error(`${label} 目录不安全`);
+    const fd = node_fs_1.default.openSync(file, node_fs_1.default.constants.O_RDONLY | (node_fs_1.default.constants.O_NOFOLLOW || 0));
+    try {
+        const stat = node_fs_1.default.fstatSync(fd);
+        if (!stat.isFile() || (stat.mode & 0o777) !== 0o600
+            || (typeof process.getuid === "function" && stat.uid !== process.getuid()))
+            throw new Error(`${label} 文件不安全`);
+        return JSON.parse(node_fs_1.default.readFileSync(fd, "utf8"));
+    }
+    finally {
+        node_fs_1.default.closeSync(fd);
+    }
+}
+function assertAgentWorkspaceBound(agent) {
+    if (!agent.feishuAppId)
+        throw new Error(`Agent ${agent.agentId} 缺少 feishuAppId，拒绝回退 local workspace`);
+    let source;
+    let workspace;
+    try {
+        source = readPrivateJson(larkChannelSourceConfigPath(agent), "lark-channel source projection");
+        workspace = readPrivateJson(larkChannelWorkspaceConfigPath(agent), "lark-channel workspace");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            throw new Error(`Agent ${agent.agentId} lark-channel workspace 未绑定；运行 larkin setup`);
+        throw error;
+    }
+    const sourceApp = source.accounts?.app;
+    const provider = source.secrets?.providers?.["larkin-bot-credential"];
+    if (sourceApp?.id !== agent.feishuAppId || sourceApp?.secret?.source !== "exec"
+        || sourceApp?.secret?.provider !== "larkin-bot-credential" || sourceApp?.secret?.id !== agent.feishuAppId
+        || provider?.source !== "exec" || typeof provider.command !== "string" || !node_path_1.default.isAbsolute(provider.command)
+        || !Array.isArray(provider.args) || provider.env?.LARKIN_AGENT_ID !== agent.agentId
+        || provider.env?.LARKIN_SECRET_PROVIDER_CONTEXT !== "bind") {
+        throw new Error(`Agent ${agent.agentId} lark-channel source projection 错配`);
+    }
+    if (agent.credentialRevision && source.credentialRevision !== agent.credentialRevision) {
+        throw new Error(`Agent ${agent.agentId} lark-channel credential revision 已过期；运行 larkin setup`);
+    }
+    const apps = workspace.apps;
+    const app = Array.isArray(apps) && apps.length === 1 ? apps[0] : null;
+    if (!app || app.appId !== agent.feishuAppId || app.defaultAs !== "bot" || app.strictMode !== "bot"
+        || app.appSecret?.source !== "keychain" || app.appSecret?.id !== `appsecret:${agent.feishuAppId}`
+        || (Array.isArray(app.users) ? app.users.length !== 0
+            : app.users && typeof app.users === "object" ? Object.keys(app.users).length !== 0 : app.users !== undefined && app.users !== null)) {
+        throw new Error(`Agent ${agent.agentId} lark-channel workspace identity/bot-only policy 错配；运行 larkin setup`);
+    }
+}

package/dist/app/agent-lark-cli-workspace.mjs

@@ -0,0 +1,85 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveOfficialLarkCli } from "./official-lark-cli.mjs";
+export function larkChannelSourceConfigPath(agent) {
+    if (!agent.stateDir)
+        throw new Error(`Agent ${agent.agentId} 缺少 stateDir，无法建立 lark-channel binding`);
+    return path.join(path.resolve(agent.stateDir), "lark-channel-source", "config.json");
+}
+export function larkChannelWorkspaceConfigPath(agent) {
+    if (!agent.larkConfigDir)
+        throw new Error(`Agent ${agent.agentId} 缺少 larkConfigDir，无法建立 lark-channel binding`);
+    return path.join(path.resolve(agent.larkConfigDir), "lark-channel", "config.json");
+}
+export function managedLarkCliEnv(agent, env) {
+    if (!agent.larkConfigDir)
+        throw new Error(`Agent ${agent.agentId} 缺少 larkConfigDir，拒绝回退 local workspace`);
+    const isolated = { ...env };
+    for (const key of ["OPENCLAW_CLI", "OPENCLAW_HOME", "OPENCLAW_STATE_DIR", "OPENCLAW_CONFIG_PATH", "OPENCLAW_SERVICE_MARKER",
+        "OPENCLAW_SERVICE_VERSION", "OPENCLAW_GATEWAY_PORT", "OPENCLAW_SHELL", "HERMES_HOME", "HERMES_QUIET", "HERMES_EXEC_ASK",
+        "HERMES_GATEWAY_TOKEN", "HERMES_SESSION_KEY"])
+        delete isolated[key];
+    return {
+        ...isolated,
+        LARK_CHANNEL: "1",
+        LARK_CHANNEL_CONFIG: larkChannelSourceConfigPath(agent),
+        LARKSUITE_CLI_CONFIG_DIR: path.resolve(agent.larkConfigDir),
+    };
+}
+export function managedOfficialLarkCli(agent, env, resolve = resolveOfficialLarkCli) {
+    assertAgentWorkspaceBound(agent);
+    const managedEnv = managedLarkCliEnv(agent, env);
+    return { command: resolve({ env: managedEnv }), env: managedEnv };
+}
+function readPrivateJson(file, label) {
+    const directory = fs.lstatSync(path.dirname(file));
+    if (!directory.isDirectory() || directory.isSymbolicLink() || (directory.mode & 0o777) !== 0o700
+        || (typeof process.getuid === "function" && directory.uid !== process.getuid()))
+        throw new Error(`${label} 目录不安全`);
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || (stat.mode & 0o777) !== 0o600
+            || (typeof process.getuid === "function" && stat.uid !== process.getuid()))
+            throw new Error(`${label} 文件不安全`);
+        return JSON.parse(fs.readFileSync(fd, "utf8"));
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function assertAgentWorkspaceBound(agent) {
+    if (!agent.feishuAppId)
+        throw new Error(`Agent ${agent.agentId} 缺少 feishuAppId，拒绝回退 local workspace`);
+    let source;
+    let workspace;
+    try {
+        source = readPrivateJson(larkChannelSourceConfigPath(agent), "lark-channel source projection");
+        workspace = readPrivateJson(larkChannelWorkspaceConfigPath(agent), "lark-channel workspace");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            throw new Error(`Agent ${agent.agentId} lark-channel workspace 未绑定；运行 larkin setup`);
+        throw error;
+    }
+    const sourceApp = source.accounts?.app;
+    const provider = source.secrets?.providers?.["larkin-bot-credential"];
+    if (sourceApp?.id !== agent.feishuAppId || sourceApp?.secret?.source !== "exec"
+        || sourceApp?.secret?.provider !== "larkin-bot-credential" || sourceApp?.secret?.id !== agent.feishuAppId
+        || provider?.source !== "exec" || typeof provider.command !== "string" || !path.isAbsolute(provider.command)
+        || !Array.isArray(provider.args) || provider.env?.LARKIN_AGENT_ID !== agent.agentId
+        || provider.env?.LARKIN_SECRET_PROVIDER_CONTEXT !== "bind") {
+        throw new Error(`Agent ${agent.agentId} lark-channel source projection 错配`);
+    }
+    if (agent.credentialRevision && source.credentialRevision !== agent.credentialRevision) {
+        throw new Error(`Agent ${agent.agentId} lark-channel credential revision 已过期；运行 larkin setup`);
+    }
+    const apps = workspace.apps;
+    const app = Array.isArray(apps) && apps.length === 1 ? apps[0] : null;
+    if (!app || app.appId !== agent.feishuAppId || app.defaultAs !== "bot" || app.strictMode !== "bot"
+        || app.appSecret?.source !== "keychain" || app.appSecret?.id !== `appsecret:${agent.feishuAppId}`
+        || (Array.isArray(app.users) ? app.users.length !== 0
+            : app.users && typeof app.users === "object" ? Object.keys(app.users).length !== 0 : app.users !== undefined && app.users !== null)) {
+        throw new Error(`Agent ${agent.agentId} lark-channel workspace identity/bot-only policy 错配；运行 larkin setup`);
+    }
+}

package/dist/app/agent-readiness.cjs

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isChannelReconnecting = isChannelReconnecting;
+exports.projectAgentReadiness = projectAgentReadiness;
+const process_state_js_1 = require("../platform/process-state.cjs");
+function timestamp(value) {
+    const parsed = Date.parse(String(value || ""));
+    return Number.isFinite(parsed) ? parsed : null;
+}
+function isChannelReconnecting(status) {
+    const reconnectingAt = timestamp(status?.reconnectingAt);
+    const connectedAt = timestamp(status?.connectedAt);
+    const reconnectedAt = timestamp(status?.reconnectedAt);
+    const latestConnectedAt = Math.max(connectedAt ?? Number.NEGATIVE_INFINITY, reconnectedAt ?? Number.NEGATIVE_INFINITY);
+    return reconnectingAt !== null && reconnectingAt > latestConnectedAt;
+}
+function projectAgentReadiness(input) {
+    const status = input.status ?? null;
+    const daemonOwned = (0, process_state_js_1.daemonHasAgent)(input.daemon, input.agentId);
+    const daemonStartedAt = timestamp(input.daemon.startedAt);
+    const connectedAt = timestamp(status?.connectedAt);
+    const channelConnected = daemonOwned
+        && status?.connectedVia === "channel"
+        && daemonStartedAt !== null
+        && connectedAt !== null
+        && connectedAt >= daemonStartedAt;
+    const readiness = {
+        daemon_owned: daemonOwned,
+        runtime_ready: status?.runtimeReadiness?.state === "ready",
+        channel_connected: channelConnected,
+        channel_not_reconnecting: !isChannelReconnecting(status),
+    };
+    return {
+        ready: Object.values(readiness).every(Boolean),
+        readiness,
+        channel: {
+            connected_at: connectedAt === null ? null : status?.connectedAt ?? null,
+            connected_via: status?.connectedVia || null,
+            inbound_verified_at: timestamp(status?.inboundVerifiedAt) === null ? null : status?.inboundVerifiedAt ?? null,
+        },
+    };
+}

package/dist/app/agent-readiness.mjs

@@ -0,0 +1,38 @@
+import { daemonHasAgent } from "../platform/process-state.mjs";
+function timestamp(value) {
+    const parsed = Date.parse(String(value || ""));
+    return Number.isFinite(parsed) ? parsed : null;
+}
+export function isChannelReconnecting(status) {
+    const reconnectingAt = timestamp(status?.reconnectingAt);
+    const connectedAt = timestamp(status?.connectedAt);
+    const reconnectedAt = timestamp(status?.reconnectedAt);
+    const latestConnectedAt = Math.max(connectedAt ?? Number.NEGATIVE_INFINITY, reconnectedAt ?? Number.NEGATIVE_INFINITY);
+    return reconnectingAt !== null && reconnectingAt > latestConnectedAt;
+}
+export function projectAgentReadiness(input) {
+    const status = input.status ?? null;
+    const daemonOwned = daemonHasAgent(input.daemon, input.agentId);
+    const daemonStartedAt = timestamp(input.daemon.startedAt);
+    const connectedAt = timestamp(status?.connectedAt);
+    const channelConnected = daemonOwned
+        && status?.connectedVia === "channel"
+        && daemonStartedAt !== null
+        && connectedAt !== null
+        && connectedAt >= daemonStartedAt;
+    const readiness = {
+        daemon_owned: daemonOwned,
+        runtime_ready: status?.runtimeReadiness?.state === "ready",
+        channel_connected: channelConnected,
+        channel_not_reconnecting: !isChannelReconnecting(status),
+    };
+    return {
+        ready: Object.values(readiness).every(Boolean),
+        readiness,
+        channel: {
+            connected_at: connectedAt === null ? null : status?.connectedAt ?? null,
+            connected_via: status?.connectedVia || null,
+            inbound_verified_at: timestamp(status?.inboundVerifiedAt) === null ? null : status?.inboundVerifiedAt ?? null,
+        },
+    };
+}

package/dist/app/binary-entry.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env bun
+import { INTERNAL_COMMAND_MARKER, INTERNAL_MODES } from "./internal-command.mjs";
+function normalizeArgv(mode, rest) {
+    process.env.LARKIN_INTERNAL_DISPATCH = "1";
+    process.argv = [process.execPath, `${INTERNAL_COMMAND_MARKER} ${mode}`, ...rest];
+}
+async function dispatchInternal(mode, rest) {
+    normalizeArgv(mode, rest);
+    switch (mode) {
+        case "run":
+            await (await import("./run.mjs")).main();
+            return;
+        case "setup":
+            await (await import("./setup.mjs")).main();
+            return;
+        case "runtime-process":
+            await (await import("./runtime-process.mjs")).main();
+            return;
+        case "agent-cli":
+            await (await import("./agent-cli.mjs")).main(rest, process.env);
+            return;
+        case "lark-cli":
+            process.exitCode = await (await import("./lark-cli.mjs")).runLarkCliProcess(rest, process.env);
+            return;
+        case "runtime-model-directory":
+            await (await import("./runtime-model-directory.mjs")).main();
+            return;
+        case "agent-config":
+            await import("./agent-config.mjs");
+            return;
+        case "session-cli":
+            await (await import("./session-cli.mjs")).main(rest, process.env);
+            return;
+        case "lark":
+            await import("./lark.mjs");
+            return;
+        case "dashboard":
+            await import("./dashboard.mjs");
+            return;
+        case "bot-register":
+            await (await import("../setup/bot-register.mjs")).main();
+            return;
+        case "setup-bind":
+            await (await import("../setup/setup-bind.mjs")).main();
+            return;
+        case "grant-scopes":
+            await (await import("../setup/grant-scopes.mjs")).main();
+            return;
+        case "lark-channel-secret":
+            await (await import("./lark-channel-secret.mjs")).main(process.env);
+            return;
+        case "pi-rpc": {
+            const { prepareBuiltinPiPackageAssets } = await import("../runtime/builtin-pi-assets.mjs");
+            prepareBuiltinPiPackageAssets();
+            await import("@earendil-works/pi-coding-agent/rpc-entry");
+            return;
+        }
+        case "pi-auth":
+            await (await import("./pi-auth-cli.mjs")).main(rest, process.env);
+            return;
+        case "telemetry":
+            await (await import("./telemetry.mjs")).main(rest, process.env);
+            return;
+    }
+}
+export async function main() {
+    const standalone = process.env.LARKIN_STANDALONE === "1";
+    if (!standalone && process.argv[1])
+        process.env.LARKIN_BINARY_ENTRY_PATH = process.argv[1];
+    const argv = process.argv.slice(standalone ? 1 : 2);
+    if (argv[0] === INTERNAL_COMMAND_MARKER) {
+        const mode = argv[1];
+        if (!mode || !INTERNAL_MODES.includes(mode))
+            throw new Error("invalid internal command");
+        await dispatchInternal(mode, argv.slice(2));
+        return;
+    }
+    process.argv = [process.execPath, "larkin", ...argv];
+    await import("./cli.mjs");
+}
+if (typeof LARKIN_WRAPPED_ENTRY === "undefined" || !LARKIN_WRAPPED_ENTRY) {
+    main().catch((error) => {
+        process.stderr.write(`larkin: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}

package/dist/app/cli.mjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env bun
+// Public larkin CLI router. This file deliberately owns only the outer shell:
+// command selection, read-only help, child spawning, and signal/exit forwarding.
+import "../platform/check-bun-version.cjs";
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { CONFIG_CLI_USAGE } from "../agent/config-cli-contract.mjs";
+import { internalCommandSpec } from "./internal-command.mjs";
+import { packageVersion } from "../platform/build-info.mjs";
+const command = process.argv[2] || "help";
+let rest = process.argv.slice(3);
+const PACKAGE_VERSION = packageVersion(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../.."));
+const removedCommandMessages = {
+    init: "首次配置或重新授权请使用 larkin setup。",
+    "bot:connect": "首次配置或重新授权请使用 larkin setup。",
+    build: "源码构建命令已移除；仓库维护者请使用 bun run build。",
+    dashboard: "dashboard 已由 larkin start 自动启动和监控。",
+};
+if (removedCommandMessages[command]) {
+    console.error(`larkin: ${command} 已移除；${removedCommandMessages[command]}`);
+    process.exit(1);
+}
+const routes = {
+    start: ["run"],
+    setup: ["setup"],
+    status: ["agent-config", "agents"],
+    agents: ["agent-config", "agents"],
+    model: ["agent-config", "model"],
+    runtime: ["agent-config", "runtime"],
+    effort: ["agent-config", "effort"],
+    chats: ["agent-config", "chats"],
+    config: ["agent-config", "config"],
+    session: ["session-cli"],
+    "pi-auth": ["pi-auth"],
+    telemetry: ["telemetry"],
+};
+const runtimeAgentAuthority = typeof process.env.LARKIN_AGENT_ID === "string"
+    && process.env.LARKIN_AGENT_ID.trim().length > 0;
+const runtimeAgentCommand = runtimeAgentAuthority
+    && ["inbox", "reminder", "interaction", "profile", "config"].includes(command);
+if (runtimeAgentCommand)
+    routes[command] = ["agent-cli", command];
+if (runtimeAgentAuthority && command === "comment")
+    routes.comment = ["lark-cli", "comment"];
+// Help stays in the outer CLI so it never loads configuration, inspects a process,
+// or starts a foreground service merely to print usage.
+const commandHelp = {
+    start: `Usage: larkin start [--agent <App ID> | --agents <App ID,...>]
+Start one foreground supervisor for the daemon and local dashboard, or reuse it.`,
+    setup: `Usage: larkin setup [--runtime <runtime>] [--comment-subscription <none|application>] [--no-start]
+Run the interactive setup to create or connect a bot and configure its Agent.`,
+    status: `Usage: larkin status [--json]
+Show Agent configuration, bot identity, credentials, and connection status. Use --json for readiness automation.`,
+    agents: `Usage: larkin agents [--json]
+List every configured Agent and its current local status. Use --json for daemon/Runtime/channel readiness.`,
+    model: `Usage: larkin model [<model>] [--agent <App ID>]
+Show or change an Agent model.`,
+    runtime: `Usage: larkin runtime [<runtime>] [--agent <App ID>] [--model <model>]
+Show or change an Agent runtime.`,
+    effort: `Usage: larkin effort [<level>|clear|default] [--agent <App ID>]
+Show or change an Agent reasoning effort; clear/default restores the Runtime default.`,
+    chats: `Usage: larkin chats [--agent <App ID>]
+       larkin chats (free|strict) <oc_id> [--agent <App ID>]
+List known chats or configure mention requirements.`,
+    config: `Usage: ${CONFIG_CLI_USAGE.join("\n       ")}
+Inspect and safely update user-facing Larkin configuration.
+
+Values:
+  default / clear  Do not persist a model override / clear effort to Runtime default
+  inherit          Clear an Agent or chat mention override
+
+Examples:
+  larkin config show --agent cli_x --chat oc_x --json
+  larkin config runtime pi --agent cli_x --model default
+  larkin config mention chat oc_x free --agent cli_x
+
+Credentials, internal paths, serverId, activeAgent, and raw config are never exposed here.`,
+    session: `Usage: larkin session reset --agent <App ID> --json [--wait-ready <seconds>]
+Atomically replace one idle, zero-backlog Agent Runtime session through authenticated local control.`,
+    "pi-auth": `Usage: larkin pi-auth status [--agent <App ID>] [--json]
+       larkin pi-auth logout <provider> [--agent <App ID>]
+Show non-sensitive official Pi credential metadata or remove one target provider credential.`,
+    comment: `Usage: larkin comment reply --message-id <doc_comment_message_id> --text '<reply>' --json
+Reply once, as the Runtime-bound Bot, to the exact cloud-document comment locator supplied by canonical Inbox.`,
+    telemetry: `Usage: larkin telemetry <status|export|import|flush>
+Inspect the durable local trace queue, move an offline bundle, or upload queued OTLP traces.`,
+};
+if (command === "--version" || command === "-V") {
+    console.log(`larkin ${PACKAGE_VERSION}`);
+    process.exit(0);
+}
+if (command === "help" && rest[0] && commandHelp[rest[0]]) {
+    console.log(commandHelp[rest[0]]);
+    process.exit(0);
+}
+if (!runtimeAgentCommand && routes[command] && rest.some((argument) => argument === "--help" || argument === "-h")) {
+    console.log(commandHelp[command]);
+    process.exit(0);
+}
+if (!runtimeAgentCommand && command === "config" && ["runtime", "model", "effort"].includes(rest[0] || "")) {
+    routes.config = ["agent-config", rest[0]];
+    rest = rest.slice(1);
+}
+// At a user terminal, unregistered non-flag commands keep the legacy lark-cli passthrough.
+// Inside an Agent Runtime, unknown Feishu command groups enter the same Larkin-owned
+// identity and freshness AOP before delegation to the verified global official CLI.
+const wantsHelp = command === "help" || command === "--help" || command === "-h"
+    || (!runtimeAgentAuthority && command.startsWith("-"));
+if (!routes[command] && !wantsHelp) {
+    routes[command] = runtimeAgentAuthority ? ["lark-cli", command] : ["lark", command];
+}
+if (!routes[command]) {
+    console.log(`larkin — Run persistent-personality agents on Feishu
+
+Usage: larkin <command>
+  setup            Create or connect a bot, configure its Agent, start it, and open the dashboard
+  start            Start and supervise configured Agents plus the local dashboard
+  status           Show Agent configuration, bot identity, credentials, and connection status
+  agents           List all Agents, including runtime, model, bot identity, and credential status
+  model [<id>]     Show or change an Agent model, with workspace validation
+  runtime [<id>]   Show or change an Agent runtime; changing it resets the model to its default
+  effort [<level>] Show or set the reasoning effort; use clear to restore the default
+  chats            List known chats; use free/strict <oc_id> to configure mention requirements
+  config           Inspect effective config/source, edit mention inheritance, or explicitly apply runtime changes
+  session reset    Replace one idle, zero-backlog Agent Runtime session for a fresh scenario
+  pi-auth          Show non-sensitive built-in Pi auth status or logout one provider
+  comment reply    Reply to the exact cloud-document comment bound by a polled Inbox message
+  telemetry        Inspect, export, import, or flush the durable OpenTelemetry trace queue
+  <lark-cli 命令组>  im/docs/wiki/drive 等 lark-cli 命令原样转发，机器人身份已锁定（如 larkin im +chat-list）
+Getting started:
+  First-time setup: larkin setup
+  Daily startup:    larkin start
+  Health check:     larkin status
+
+Process persistence is managed externally. larkin start stays in the foreground and supervises the daemon and dashboard.`);
+    process.exit(command === "help" || command === "--help" || command === "-h" ? 0 : 1);
+}
+const [mode, ...presetArguments] = routes[command];
+const childSpec = internalCommandSpec(mode, [...presetArguments, ...rest]);
+const child = spawn(childSpec.command, childSpec.args, { stdio: "inherit" });
+// Package-manager bin shims add a wrapper process. Forward terminal signals so the actual command
+// does not become an orphan that keeps the machine lock or Feishu connection.
+const signalForwarders = new Map();
+for (const signal of ["SIGINT", "SIGTERM"]) {
+    const forward = () => {
+        if (child.exitCode === null && child.signalCode === null)
+            child.kill(signal);
+    };
+    signalForwarders.set(signal, forward);
+    process.on(signal, forward);
+}
+const stopForwardingSignals = () => {
+    for (const [signal, forward] of signalForwarders)
+        process.off(signal, forward);
+};
+child.on("error", (error) => {
+    stopForwardingSignals();
+    console.error(`larkin ${command} 启动失败: ${error.message}`);
+    process.exit(1);
+});
+child.on("exit", (code, signal) => {
+    stopForwardingSignals();
+    if (code !== null)
+        process.exit(code);
+    if (!signal)
+        process.exit(1);
+    const fallback = signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : signal === "SIGKILL" ? 137 : 1;
+    try {
+        process.kill(process.pid, signal);
+    }
+    catch {
+        process.exit(fallback);
+    }
+    setImmediate(() => process.exit(fallback));
+});