larkin 0.2.75 → 0.2.77

package/README.md

@@ -1,10 +1,10 @@
 # Larkin
 
-Larkin connects Codex, Claude Code, and Pi agent runtimes to Feishu. It provides a local runtime host, persistent sessions, reminders, interactive messages, and a local dashboard.
+Larkin connects Codex, Claude Code, and Pi agent runtimes to Feishu (Lark). It provides a local runtime host, persistent sessions, reminders, interactive messages, and a local dashboard.
 
 ## Requirements
 
-- A supported macOS or Linux system
+- A supported macOS, Linux, or Windows (x64) system
 - `lark-cli`
 - At least one supported agent runtime and its authentication
 - Bun 1.3.14 when running the npm package or building from source (standalone binaries bundle their own runtime)
@@ -22,7 +22,7 @@ npm install -g larkin
 larkin --version
 ```
 
-Standalone binaries for macOS and Linux are attached to every [GitHub Release](https://github.com/eddiearc/larkin/releases) for environments without Bun or npm.
+Standalone binaries for macOS, Linux, and Windows (x64) are attached to every [GitHub Release](https://github.com/eddiearc/larkin/releases) for environments without Bun or npm. Windows binaries are cross-compiled; their runtime behavior has not been end-to-end verified on a Windows host.
 
 ## Usage
 

package/dist/agent/context-prompt.cjs

@@ -16,7 +16,7 @@ const agent_cli_capabilities_js_1 = require("./agent-cli-capabilities.cjs");
  * 5. 版本化：每次实质改动 bump LARKIN_STANDING_PROMPT_VERSION，并同步 eval 数据集/graders/断言。
  * 6. 用 eval 验证：行为变化必须配套固定场景 + rubric（evals/*、test/support/*-grader.mjs、live 测试）。
  */
-exports.LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v18";
+exports.LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v19";
 /**
  * Agent 间协作唤醒引导（issue #75）：纯文本 @ 不会产生飞书 mention 事件，
  * 必须由模型直接构造真实的 mention 元素；`--mention` 扩展参数已移除。
@@ -154,7 +154,7 @@ class ContextPromptBuilder {
             "For the known canonical Inbox poll, scoped chat/thread history, and exact send/reply recipes specified here, execute them directly; you must not read or re-read a skill file or reference merely to rediscover or confirm their command syntax.",
             `For a task that starts from an exact group name and asks for user and bot counts, after the required Inbox poll use this known canonical two-read recipe directly: first run \`${executable} im +chat-search --query '<exact_group_name>' --json\`, require one result with an exact name match and confirm its \`oc_\` chat id, then run \`${executable} im chats get --chat-id <confirmed_oc_chat_id> --json\` and answer from its \`user_count\` and \`bot_count\`. This group user/bot counts recipe uses exactly two post-poll business read calls; you must not read or re-read a skill or reference, open help or schema, invoke bare \`lark-cli\`, call \`chat.members\` or \`+chat-members-list\`, fall back to \`+chat-list\`, or add shell filters or output truncation. If the exact name is not a unique visible match, the chat id is not confirmed, or either count is missing, fail visibly without another discovery path or a guess.`,
             "This narrow direct-recipe rule does not waive required skill safety gates, authorization, identity, freshness, or other safety checks. Unknown commands or high-risk operations still require the applicable skill/reference guidance or help.",
-            "The Larkin wrapper derives the stable per-intent idempotency key; do not pass `--idempotency-key` in an ordinary send or reply recipe.",
+            "The Larkin wrapper derives the stable per-intent idempotency key; do not pass `--idempotency-key` in an ordinary send or reply recipe. A successful write result carrying `duplicate: true` means the provider returned the earlier delivery for the same derived key: the message was already delivered and no new message was created. Do not resend the same command after a `duplicate: true` result; treat the message as delivered. To deliberately send identical content again as a fresh intent (e.g., a new reminder), pass an explicit new `--idempotency-key`, which the wrapper respects instead of deriving its own.",
             "Both `freshness_unavailable` and `freshness_conflict` are pre-commit, provider-not-reached results. If a retry is warranted for an unchanged exact operation, rerun the identical safe ordinary command: `--text` for a direct literal or the same deterministic `--content` dataflow for a tool source. The wrapper reuses its derived key. If the target or body changes after reconsideration, run the revised ordinary command and let the wrapper derive a new key. A result with `committed=true` must not be repeated; ambiguous termination follows the existing wrapper same-key recovery contract.",
             "For multiline `--markdown` or `--text` content in zsh or bash, prefer shell ANSI-C quoting so the command passes one argument with real newline characters: `--markdown $'First line\\nSecond line'` or `--text $'First line\\nSecond line'`. Putting `\"First line\\nSecond line\"` in ordinary double quotes is wrong: ordinary quotes do not decode `\\n`, so lark-cli and Feishu receive a backslash followed by the letter `n`. A literal multiline argument containing real newline characters is also valid. If ANSI-C-quoted content contains an apostrophe, use a safe shell single-quote splice or the literal-newline form; never use `eval`, `echo`, a temporary file, or unsafe variable interpolation to construct the body.",
             ...FEISHU_IM_COMMAND_GROUPS.map(([label, suffixes]) => `- ${label}: ${suffixes.map((suffix) => `\`${executable} ${suffix}\``).join(", ")}.`),

package/dist/agent/context-prompt.mjs

@@ -13,7 +13,7 @@ import { agentCliPromptCapabilities } from "./agent-cli-capabilities.mjs";
  * 5. 版本化：每次实质改动 bump LARKIN_STANDING_PROMPT_VERSION，并同步 eval 数据集/graders/断言。
  * 6. 用 eval 验证：行为变化必须配套固定场景 + rubric（evals/*、test/support/*-grader.mjs、live 测试）。
  */
-export const LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v18";
+export const LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v19";
 /**
  * Agent 间协作唤醒引导（issue #75）：纯文本 @ 不会产生飞书 mention 事件，
  * 必须由模型直接构造真实的 mention 元素；`--mention` 扩展参数已移除。
@@ -151,7 +151,7 @@ export class ContextPromptBuilder {
             "For the known canonical Inbox poll, scoped chat/thread history, and exact send/reply recipes specified here, execute them directly; you must not read or re-read a skill file or reference merely to rediscover or confirm their command syntax.",
             `For a task that starts from an exact group name and asks for user and bot counts, after the required Inbox poll use this known canonical two-read recipe directly: first run \`${executable} im +chat-search --query '<exact_group_name>' --json\`, require one result with an exact name match and confirm its \`oc_\` chat id, then run \`${executable} im chats get --chat-id <confirmed_oc_chat_id> --json\` and answer from its \`user_count\` and \`bot_count\`. This group user/bot counts recipe uses exactly two post-poll business read calls; you must not read or re-read a skill or reference, open help or schema, invoke bare \`lark-cli\`, call \`chat.members\` or \`+chat-members-list\`, fall back to \`+chat-list\`, or add shell filters or output truncation. If the exact name is not a unique visible match, the chat id is not confirmed, or either count is missing, fail visibly without another discovery path or a guess.`,
             "This narrow direct-recipe rule does not waive required skill safety gates, authorization, identity, freshness, or other safety checks. Unknown commands or high-risk operations still require the applicable skill/reference guidance or help.",
-            "The Larkin wrapper derives the stable per-intent idempotency key; do not pass `--idempotency-key` in an ordinary send or reply recipe.",
+            "The Larkin wrapper derives the stable per-intent idempotency key; do not pass `--idempotency-key` in an ordinary send or reply recipe. A successful write result carrying `duplicate: true` means the provider returned the earlier delivery for the same derived key: the message was already delivered and no new message was created. Do not resend the same command after a `duplicate: true` result; treat the message as delivered. To deliberately send identical content again as a fresh intent (e.g., a new reminder), pass an explicit new `--idempotency-key`, which the wrapper respects instead of deriving its own.",
             "Both `freshness_unavailable` and `freshness_conflict` are pre-commit, provider-not-reached results. If a retry is warranted for an unchanged exact operation, rerun the identical safe ordinary command: `--text` for a direct literal or the same deterministic `--content` dataflow for a tool source. The wrapper reuses its derived key. If the target or body changes after reconsideration, run the revised ordinary command and let the wrapper derive a new key. A result with `committed=true` must not be repeated; ambiguous termination follows the existing wrapper same-key recovery contract.",
             "For multiline `--markdown` or `--text` content in zsh or bash, prefer shell ANSI-C quoting so the command passes one argument with real newline characters: `--markdown $'First line\\nSecond line'` or `--text $'First line\\nSecond line'`. Putting `\"First line\\nSecond line\"` in ordinary double quotes is wrong: ordinary quotes do not decode `\\n`, so lark-cli and Feishu receive a backslash followed by the letter `n`. A literal multiline argument containing real newline characters is also valid. If ANSI-C-quoted content contains an apostrophe, use a safe shell single-quote splice or the literal-newline form; never use `eval`, `echo`, a temporary file, or unsafe variable interpolation to construct the body.",
             ...FEISHU_IM_COMMAND_GROUPS.map(([label, suffixes]) => `- ${label}: ${suffixes.map((suffix) => `\`${executable} ${suffix}\``).join(", ")}.`),

package/dist/app/agent-cli.mjs

@@ -105,7 +105,7 @@ function query(requestPath, name) {
 }
 function migrationError(group, subcommand) {
     if (group === "message") {
-        return "message 已移除：只读查看收件箱用 `larkin inbox check`，领取完整消息用 `larkin inbox poll`；飞书发送、回复和查询请使用 `larkin im +messages-send`、`+messages-reply`、`+chat-messages-list` 或 `+messages-mget`。";
+        return "message 已移除：只读查看收件箱用 `larkin inbox check`，领取完整消息用 `larkin inbox poll`；飞书（Lark）发送、回复和查询请使用 `larkin im +messages-send`、`+messages-reply`、`+chat-messages-list` 或 `+messages-mget`。";
     }
     if (group === "channel") {
         return "channel 已移除：群聊操作请使用 `larkin im +chat-list`、`+chat-search`、`chats get`、`+chat-create`、`+chat-update` 或 `chat.members get/create/delete`。";
@@ -114,9 +114,9 @@ function migrationError(group, subcommand) {
         return "attachment 已移除：发送附件请使用 `larkin im +messages-send --file/--image/--video/--audio`；下载请使用 `larkin im +messages-resources-download`。";
     }
     if (group === "server")
-        return "server 已移除；飞书群与消息信息请通过 `larkin im ...` 查询。";
+        return "server 已移除；飞书（Lark）群与消息信息请通过 `larkin im ...` 查询。";
     if (group === "im")
-        return "请通过 `larkin im ...` 使用飞书命令；Runtime 会自动绑定当前 Bot identity，并在写入前执行 freshness gate。可运行 `larkin im --help` 查看帮助。";
+        return "请通过 `larkin im ...` 使用飞书（Lark）命令；Runtime 会自动绑定当前 Bot identity，并在写入前执行 freshness gate。可运行 `larkin im --help` 查看帮助。";
     if (group === "profile" && subcommand !== "show") {
         return "profile 只保留只读的 `larkin profile show`；身份和凭证由 `larkin setup` 管理，不支持 update。";
     }

package/dist/app/agent-lark-cli-workspace.cjs

@@ -10,6 +10,7 @@ exports.managedOfficialLarkCli = managedOfficialLarkCli;
 exports.assertAgentWorkspaceBound = assertAgentWorkspaceBound;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const secure_metadata_js_1 = require("../platform/secure-metadata.cjs");
 const official_lark_cli_js_1 = require("./official-lark-cli.cjs");
 function larkChannelSourceConfigPath(agent) {
     if (!agent.stateDir)
@@ -43,13 +44,13 @@ function managedOfficialLarkCli(agent, env, resolve = official_lark_cli_js_1.res
 }
 function readPrivateJson(file, label) {
     const directory = node_fs_1.default.lstatSync(node_path_1.default.dirname(file));
-    if (!directory.isDirectory() || directory.isSymbolicLink() || (directory.mode & 0o777) !== 0o700
+    if (!directory.isDirectory() || directory.isSymbolicLink() || !(0, secure_metadata_js_1.exactMode)(directory, 0o700)
         || (typeof process.getuid === "function" && directory.uid !== process.getuid()))
         throw new Error(`${label} 目录不安全`);
     const fd = node_fs_1.default.openSync(file, node_fs_1.default.constants.O_RDONLY | (node_fs_1.default.constants.O_NOFOLLOW || 0));
     try {
         const stat = node_fs_1.default.fstatSync(fd);
-        if (!stat.isFile() || (stat.mode & 0o777) !== 0o600
+        if (!stat.isFile() || !(0, secure_metadata_js_1.exactMode)(stat, 0o600)
             || (typeof process.getuid === "function" && stat.uid !== process.getuid()))
             throw new Error(`${label} 文件不安全`);
         return JSON.parse(node_fs_1.default.readFileSync(fd, "utf8"));

package/dist/app/agent-lark-cli-workspace.mjs

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { exactMode } from "../platform/secure-metadata.mjs";
 import { resolveOfficialLarkCli } from "./official-lark-cli.mjs";
 export function larkChannelSourceConfigPath(agent) {
     if (!agent.stateDir)
@@ -33,13 +34,13 @@ export function managedOfficialLarkCli(agent, env, resolve = resolveOfficialLark
 }
 function readPrivateJson(file, label) {
     const directory = fs.lstatSync(path.dirname(file));
-    if (!directory.isDirectory() || directory.isSymbolicLink() || (directory.mode & 0o777) !== 0o700
+    if (!directory.isDirectory() || directory.isSymbolicLink() || !exactMode(directory, 0o700)
         || (typeof process.getuid === "function" && directory.uid !== process.getuid()))
         throw new Error(`${label} 目录不安全`);
     const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
     try {
         const stat = fs.fstatSync(fd);
-        if (!stat.isFile() || (stat.mode & 0o777) !== 0o600
+        if (!stat.isFile() || !exactMode(stat, 0o600)
             || (typeof process.getuid === "function" && stat.uid !== process.getuid()))
             throw new Error(`${label} 文件不安全`);
         return JSON.parse(fs.readFileSync(fd, "utf8"));

package/dist/app/cli.mjs

@@ -111,7 +111,7 @@ if (!routes[command] && !wantsHelp) {
     routes[command] = runtimeAgentAuthority ? ["lark-cli", command] : ["lark", command];
 }
 if (!routes[command]) {
-    console.log(`larkin — Run persistent-personality agents on Feishu
+    console.log(`larkin — Run persistent-personality agents on Feishu (Lark)
 
 Usage: larkin <command>
   setup            Create or connect a bot, configure its Agent, start it, and open the dashboard

package/dist/app/lark-cli.mjs

@@ -269,6 +269,24 @@ function parseCommentReply(argv) {
         throw new Error("comment reply 的 --text 超过 20000 字符");
     return { messageId, text };
 }
+const IM_WRITE_MEMO_LIMIT = 512;
+// 只标注、不拦截：每次成功写把「实际生效的幂等 key → 服务端返回的 message_id」记进备忘。
+// 同 key 再次成功且服务端返回同一个 message_id，说明服务端走了幂等去重（没有产生新消息），
+// 返回 true 供输出标注 duplicate。拦截权始终在服务端，备忘不会吞掉任何发送。
+function recordImWriteMemo(store, key, messageId) {
+    let duplicate = false;
+    store.mutateJson("freshnessState", { version: 1, cursors: {} }, (state) => {
+        state.im_write_memo ??= {};
+        const prior = state.im_write_memo[key];
+        if (prior && prior.message_id === messageId)
+            duplicate = true;
+        state.im_write_memo[key] = { message_id: messageId, updated_at: new Date().toISOString() };
+        const keys = Object.keys(state.im_write_memo);
+        for (const stale of keys.slice(0, Math.max(0, keys.length - IM_WRITE_MEMO_LIMIT)))
+            delete state.im_write_memo[stale];
+    });
+    return duplicate;
+}
 function runCommentReply(argv, privateEnv, io, dependencies, store) {
     const input = parseCommentReply(argv);
     const targetKey = store.resolveInboxMessageTarget(input.messageId);
@@ -499,9 +517,12 @@ function parseHistory(result, target, requireBotIdentity = false) {
     }
     return { messages };
 }
-function intentId(target, cursor, argv) {
+// 防重编号只由 target + argv 决定：同一逻辑命令的重试永远得到同一个 key，
+// 服务端幂等去重才能生效。cursor（freshness 水位）会随每次观察读/冲突合并推进，
+// 掺入会让「已送达但回执丢失」的重试漂移成新 key，从而发出第二条消息。
+function intentId(target, argv) {
     const fingerprint = createHash("sha256")
-        .update(JSON.stringify([target, cursor, argv])).digest("hex");
+        .update(JSON.stringify([target, argv])).digest("hex");
     return `larkin-${fingerprint.slice(0, 32)}`;
 }
 function emitFreshnessError(io, input) {
@@ -709,6 +730,26 @@ function emitNativeResult(result, io) {
     }
     return result.status ?? (result.signal ? portableSignalCode(result.signal) : 1);
 }
+function emitDuplicatedWrite(result, io, input) {
+    let providerResponse;
+    try {
+        providerResponse = JSON.parse(result.stdout || "");
+    }
+    catch {
+        providerResponse = { raw_stdout: result.stdout || "" };
+    }
+    const providerDocument = providerResponse && typeof providerResponse === "object" && !Array.isArray(providerResponse)
+        ? providerResponse
+        : { provider_response: providerResponse };
+    io.stdout(`${JSON.stringify({
+        ...providerDocument,
+        ok: true,
+        duplicate: true,
+        target: input.target,
+        ...(result.stderr ? { provider_stderr_present: true } : {}),
+    })}\n`);
+    return 0;
+}
 function emitCommittedUnverified(result, io, input) {
     let providerResponse;
     try {
@@ -817,7 +858,16 @@ export function runLarkCli(argv, env = process.env, dependencies = {}) {
             store.mergeFreshnessCursor(targetKey, gated.current, mergeFeishuImCursor, generation);
             return 3;
         }
-        const write = callNative(botArgv(effectiveArgv, intentId(targetKey, gated.current, effectiveArgv)), privateEnv, io, nativeDependencies);
+        const intentKey = policyFlagValue(effectiveArgv, "--idempotency-key") ?? intentId(targetKey, effectiveArgv);
+        const write = callNative(botArgv(effectiveArgv, intentKey), privateEnv, io, nativeDependencies);
+        const writeMessage = writeResponseMessage(write);
+        const duplicate = !write.error && write.status === 0 && writeMessage
+            ? recordImWriteMemo(store, intentKey, writeMessage.message_id) : false;
+        if (duplicate) {
+            observeSuccessfulWrite(write, target, targetKey, store, generation);
+            emitDuplicatedWrite(write, io, { target: targetKey });
+            return 0;
+        }
         if (!write.error && write.status === 0 && !observeSuccessfulWrite(write, target, targetKey, store, generation)) {
             const responseMessage = writeResponseMessage(write);
             try {

package/dist/app/local-control.mjs

@@ -7,11 +7,14 @@ import path from "node:path";
 import { readProcessState } from "../platform/process-state.mjs";
 import { currentProcessMetadata } from "../platform/process-inspect.cjs";
 import { processCommandToken } from "./internal-command.mjs";
+import { isWindows, notGroupOrWorldAccessible } from "../platform/secure-metadata.mjs";
 const AGENT_ID = /^cli_[A-Za-z0-9]+$/;
 const OPERATION_ID = /^[A-Za-z0-9_-]{8,128}$/;
 const AUTHORIZATION = /^[A-Za-z0-9_-]{43,128}$/;
 const UNIX_SOCKET_PATH_MAX_BYTES = process.platform === "darwin" ? 103 : 107;
 function socketPathsFit(root) {
+    if (isWindows)
+        return true; // Windows named-pipe socket paths use a much larger limit
     return ["supervisor.sock", "daemon.sock"].every((name) => Buffer.byteLength(path.join(root, name)) <= UNIX_SOCKET_PATH_MAX_BYTES);
 }
 function controlSocketRoot(larkinHome) {
@@ -21,6 +24,8 @@ function controlSocketRoot(larkinHome) {
     const preferred = path.join(path.resolve(os.tmpdir()), leaf);
     if (socketPathsFit(preferred))
         return preferred;
+    if (isWindows)
+        throw new Error("无法生成满足 Windows socket 路径限制的 control root");
     const fallback = path.join("/tmp", leaf);
     if (socketPathsFit(fallback))
         return fallback;
@@ -30,7 +35,7 @@ function assertSecureSocketDirectory(root) {
     const stat = fs.lstatSync(root);
     if (!stat.isDirectory() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-        || (stat.mode & 0o077) !== 0)
+        || !notGroupOrWorldAccessible(stat))
         throw new Error("control socket root 不安全");
     return root;
 }
@@ -52,7 +57,7 @@ function assertSecureRoot(root) {
     const stat = fs.lstatSync(root);
     if (!stat.isDirectory() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-        || (stat.mode & 0o077) !== 0)
+        || !notGroupOrWorldAccessible(stat))
         throw new Error("Larkin config root 必须由当前用户拥有且不可被其他用户访问");
 }
 function removeLegacyResetLedger(larkinHome) {
@@ -67,7 +72,7 @@ function removeLegacyResetLedger(larkinHome) {
         throw error;
     }
     if (!stat.isFile() || stat.isSymbolicLink()
-        || (typeof process.getuid === "function" && stat.uid !== process.getuid()) || (stat.mode & 0o077) !== 0) {
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid()) || !notGroupOrWorldAccessible(stat)) {
         throw new Error("legacy daemon control operation ledger 不安全");
     }
     fs.unlinkSync(file);
@@ -114,7 +119,7 @@ function secureAuthority(larkinHome) {
     const stat = fs.lstatSync(file);
     if (!stat.isFile() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-        || (stat.mode & 0o077) !== 0)
+        || !notGroupOrWorldAccessible(stat))
         throw new Error("daemon control authority 不安全");
     const value = JSON.parse(fs.readFileSync(file, "utf8"));
     const validBinding = (binding) => !!binding && Number.isSafeInteger(binding.pid) && binding.pid > 0
@@ -634,7 +639,7 @@ async function sendSupervisorRecovery(larkinHome, operationId, timeoutMs) {
     const stat = fs.lstatSync(socket);
     if (!stat.isSocket() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-        || (stat.mode & 0o077) !== 0)
+        || !notGroupOrWorldAccessible(stat))
         throw new Error("supervisor control socket 不安全");
     return await new Promise((resolve, reject) => {
         const client = net.createConnection(socket);
@@ -690,7 +695,7 @@ async function requestAgentControl({ larkinHome, timeoutMs = 30_000, request, })
     const stat = fs.lstatSync(socket);
     if (!stat.isSocket() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-        || (stat.mode & 0o077) !== 0)
+        || !notGroupOrWorldAccessible(stat))
         throw new Error("daemon control socket 不安全");
     return await new Promise((resolve, reject) => {
         const client = net.createConnection(socket);

package/dist/app/official-lark-cli.cjs

@@ -12,10 +12,20 @@ exports.ensureOfficialLarkCliForSetup = ensureOfficialLarkCliForSetup;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+function safeRealpath(target) {
+    try {
+        return node_fs_1.default.realpathSync(target);
+    }
+    catch {
+        return null;
+    }
+}
 exports.OFFICIAL_LARK_CLI_VERSION = "1.0.79";
 exports.OFFICIAL_LARK_CLI_INSTALL = `npm install --global @larksuite/cli@${exports.OFFICIAL_LARK_CLI_VERSION}`;
 function loginShellPath(dependencies) {
     const env = dependencies.env ?? process.env;
+    if ((dependencies.platform ?? process.platform) === "win32")
+        return windowsLoginShellPath(dependencies, env);
     const shell = dependencies.shell || env.SHELL || "/bin/sh";
     const result = (dependencies.spawn ?? node_child_process_1.spawnSync)(shell, ["-lc", "command -v lark-cli 2>/dev/null"], {
         encoding: "utf8", env,
@@ -25,6 +35,30 @@ function loginShellPath(dependencies) {
     const candidate = String(result.stdout || "").split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "";
     return node_path_1.default.isAbsolute(candidate) ? node_path_1.default.resolve(candidate) : null;
 }
+/**
+ * Windows 登录 shell 探测：npm 全局安装会生成 `lark-cli.cmd`/`lark-cli` shim，真正的
+ * 原生二进制位于 `<npm 前缀>/node_modules/@larksuite/cli/bin/lark-cli.exe`。`where lark-cli`
+ * 返回 shim 路径，从 shim 所在目录推导原生二进制优先返回；否则回退到命中的 .exe/.cmd
+ * 路径（交由 officialPackage 校验）。
+ */
+function windowsLoginShellPath(dependencies, env) {
+    const shell = dependencies.shell || "cmd.exe";
+    const result = (dependencies.spawn ?? node_child_process_1.spawnSync)(shell, ["/d", "/s", "/c", "where lark-cli 2>nul"], {
+        encoding: "utf8", env,
+    });
+    if (result.status !== 0 || result.error)
+        return null;
+    for (const line of String(result.stdout || "").split(/\r?\n/).map((value) => value.trim()).filter(Boolean)) {
+        if (!node_path_1.default.isAbsolute(line))
+            continue;
+        const native = node_path_1.default.join(node_path_1.default.dirname(line), "node_modules", "@larksuite", "cli", "bin", "lark-cli.exe");
+        if (safeRealpath(native))
+            return node_path_1.default.resolve(native);
+        if (/\.(exe|cmd)$/i.test(line))
+            return node_path_1.default.resolve(line);
+    }
+    return null;
+}
 function compatibleVersion(version) {
     const parse = (value) => {
         const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(value);
@@ -37,7 +71,7 @@ function compatibleVersion(version) {
     return actual[0] > minimum[0] || (actual[0] === minimum[0]
         && (actual[1] > minimum[1] || (actual[1] === minimum[1] && actual[2] >= minimum[2])));
 }
-function officialPackage(executable) {
+function officialPackage(executable, platform = process.platform) {
     let resolved;
     try {
         resolved = node_fs_1.default.realpathSync(executable);
@@ -55,8 +89,11 @@ function officialPackage(executable) {
                 const packageRoot = node_fs_1.default.realpathSync(directory);
                 const requested = node_path_1.default.resolve(packageRoot, bin);
                 const relative = node_path_1.default.relative(packageRoot, requested);
-                if ((relative === "" || (!relative.startsWith(`..${node_path_1.default.sep}`) && relative !== ".."))
-                    && node_fs_1.default.realpathSync(requested) === resolved) {
+                const withinPackage = relative === "" || (!relative.startsWith(`..${node_path_1.default.sep}`) && relative !== "..");
+                const matchesBinTarget = withinPackage && safeRealpath(requested) === resolved;
+                const matchesNativeWindows = withinPackage && platform === "win32"
+                    && safeRealpath(node_path_1.default.join(packageRoot, "bin", "lark-cli.exe")) === resolved;
+                if (matchesBinTarget || matchesNativeWindows) {
                     return { command: node_path_1.default.resolve(executable), argsPrefix: [], version: manifest.version };
                 }
             }
@@ -114,8 +151,29 @@ function validateOfficialCommand(command, env, spawn) {
  * 仅当 PATH 解析出可用的官方 CLI 时才返回结果；否则返回 null 回退到
  * 登录 shell 探测（保留对 shell 自定义 PATH 环境的兼容）。
  */
-function probePathResolution(env) {
+function probePathResolution(env, platform = process.platform) {
     const dirs = String(env.PATH || "").split(node_path_1.default.delimiter).filter(Boolean);
+    if (platform === "win32") {
+        for (const dir of dirs) {
+            for (const candidate of [
+                node_path_1.default.resolve(dir, "node_modules", "@larksuite", "cli", "bin", "lark-cli.exe"),
+                node_path_1.default.resolve(dir, "lark-cli.exe"),
+            ]) {
+                try {
+                    if (!node_fs_1.default.statSync(candidate).isFile())
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+                const command = officialPackage(candidate, platform);
+                if (!command)
+                    continue;
+                return validateOfficialCommand(command, env, node_child_process_1.spawnSync);
+            }
+        }
+        return null;
+    }
     for (const dir of dirs) {
         const candidate = node_path_1.default.resolve(dir, "lark-cli");
         try {
@@ -125,7 +183,7 @@ function probePathResolution(env) {
         catch {
             continue;
         }
-        const command = officialPackage(candidate);
+        const command = officialPackage(candidate, platform);
         if (!command)
             return null;
         return validateOfficialCommand(command, env, node_child_process_1.spawnSync);
@@ -134,8 +192,9 @@ function probePathResolution(env) {
 }
 function probeOfficialLarkCliUncached(dependencies) {
     const env = dependencies.env ?? process.env;
+    const platform = dependencies.platform ?? process.platform;
     if (!dependencies.spawn && !dependencies.shell) {
-        const fromPath = probePathResolution(env);
+        const fromPath = probePathResolution(env, platform);
         if (fromPath)
             return fromPath;
     }
@@ -146,7 +205,7 @@ function probeOfficialLarkCliUncached(dependencies) {
             reason: "真实 login shell 找不到官方 lark-cli",
             nextAction: `运行 larkin setup，并确认执行：${exports.OFFICIAL_LARK_CLI_INSTALL}`,
         };
-    const command = officialPackage(executable);
+    const command = officialPackage(executable, platform);
     if (!command)
         return {
             state: "conflict",

package/dist/app/official-lark-cli.mjs

@@ -1,10 +1,20 @@
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
+function safeRealpath(target) {
+    try {
+        return fs.realpathSync(target);
+    }
+    catch {
+        return null;
+    }
+}
 export const OFFICIAL_LARK_CLI_VERSION = "1.0.79";
 export const OFFICIAL_LARK_CLI_INSTALL = `npm install --global @larksuite/cli@${OFFICIAL_LARK_CLI_VERSION}`;
 function loginShellPath(dependencies) {
     const env = dependencies.env ?? process.env;
+    if ((dependencies.platform ?? process.platform) === "win32")
+        return windowsLoginShellPath(dependencies, env);
     const shell = dependencies.shell || env.SHELL || "/bin/sh";
     const result = (dependencies.spawn ?? spawnSync)(shell, ["-lc", "command -v lark-cli 2>/dev/null"], {
         encoding: "utf8", env,
@@ -14,6 +24,30 @@ function loginShellPath(dependencies) {
     const candidate = String(result.stdout || "").split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "";
     return path.isAbsolute(candidate) ? path.resolve(candidate) : null;
 }
+/**
+ * Windows 登录 shell 探测：npm 全局安装会生成 `lark-cli.cmd`/`lark-cli` shim，真正的
+ * 原生二进制位于 `<npm 前缀>/node_modules/@larksuite/cli/bin/lark-cli.exe`。`where lark-cli`
+ * 返回 shim 路径，从 shim 所在目录推导原生二进制优先返回；否则回退到命中的 .exe/.cmd
+ * 路径（交由 officialPackage 校验）。
+ */
+function windowsLoginShellPath(dependencies, env) {
+    const shell = dependencies.shell || "cmd.exe";
+    const result = (dependencies.spawn ?? spawnSync)(shell, ["/d", "/s", "/c", "where lark-cli 2>nul"], {
+        encoding: "utf8", env,
+    });
+    if (result.status !== 0 || result.error)
+        return null;
+    for (const line of String(result.stdout || "").split(/\r?\n/).map((value) => value.trim()).filter(Boolean)) {
+        if (!path.isAbsolute(line))
+            continue;
+        const native = path.join(path.dirname(line), "node_modules", "@larksuite", "cli", "bin", "lark-cli.exe");
+        if (safeRealpath(native))
+            return path.resolve(native);
+        if (/\.(exe|cmd)$/i.test(line))
+            return path.resolve(line);
+    }
+    return null;
+}
 function compatibleVersion(version) {
     const parse = (value) => {
         const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(value);
@@ -26,7 +60,7 @@ function compatibleVersion(version) {
     return actual[0] > minimum[0] || (actual[0] === minimum[0]
         && (actual[1] > minimum[1] || (actual[1] === minimum[1] && actual[2] >= minimum[2])));
 }
-function officialPackage(executable) {
+function officialPackage(executable, platform = process.platform) {
     let resolved;
     try {
         resolved = fs.realpathSync(executable);
@@ -44,8 +78,11 @@ function officialPackage(executable) {
                 const packageRoot = fs.realpathSync(directory);
                 const requested = path.resolve(packageRoot, bin);
                 const relative = path.relative(packageRoot, requested);
-                if ((relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".."))
-                    && fs.realpathSync(requested) === resolved) {
+                const withinPackage = relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== "..");
+                const matchesBinTarget = withinPackage && safeRealpath(requested) === resolved;
+                const matchesNativeWindows = withinPackage && platform === "win32"
+                    && safeRealpath(path.join(packageRoot, "bin", "lark-cli.exe")) === resolved;
+                if (matchesBinTarget || matchesNativeWindows) {
                     return { command: path.resolve(executable), argsPrefix: [], version: manifest.version };
                 }
             }
@@ -103,8 +140,29 @@ function validateOfficialCommand(command, env, spawn) {
  * 仅当 PATH 解析出可用的官方 CLI 时才返回结果；否则返回 null 回退到
  * 登录 shell 探测（保留对 shell 自定义 PATH 环境的兼容）。
  */
-function probePathResolution(env) {
+function probePathResolution(env, platform = process.platform) {
     const dirs = String(env.PATH || "").split(path.delimiter).filter(Boolean);
+    if (platform === "win32") {
+        for (const dir of dirs) {
+            for (const candidate of [
+                path.resolve(dir, "node_modules", "@larksuite", "cli", "bin", "lark-cli.exe"),
+                path.resolve(dir, "lark-cli.exe"),
+            ]) {
+                try {
+                    if (!fs.statSync(candidate).isFile())
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+                const command = officialPackage(candidate, platform);
+                if (!command)
+                    continue;
+                return validateOfficialCommand(command, env, spawnSync);
+            }
+        }
+        return null;
+    }
     for (const dir of dirs) {
         const candidate = path.resolve(dir, "lark-cli");
         try {
@@ -114,7 +172,7 @@ function probePathResolution(env) {
         catch {
             continue;
         }
-        const command = officialPackage(candidate);
+        const command = officialPackage(candidate, platform);
         if (!command)
             return null;
         return validateOfficialCommand(command, env, spawnSync);
@@ -123,8 +181,9 @@ function probePathResolution(env) {
 }
 function probeOfficialLarkCliUncached(dependencies) {
     const env = dependencies.env ?? process.env;
+    const platform = dependencies.platform ?? process.platform;
     if (!dependencies.spawn && !dependencies.shell) {
-        const fromPath = probePathResolution(env);
+        const fromPath = probePathResolution(env, platform);
         if (fromPath)
             return fromPath;
     }
@@ -135,7 +194,7 @@ function probeOfficialLarkCliUncached(dependencies) {
             reason: "真实 login shell 找不到官方 lark-cli",
             nextAction: `运行 larkin setup，并确认执行：${OFFICIAL_LARK_CLI_INSTALL}`,
         };
-    const command = officialPackage(executable);
+    const command = officialPackage(executable, platform);
     if (!command)
         return {
             state: "conflict",

package/dist/app/runtime-agent-config.mjs

@@ -3,6 +3,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { exactMode, notGroupOrWorldAccessible } from "../platform/secure-metadata.mjs";
 import { acquireProcessLock } from "../platform/process-state.mjs";
 import { assertSecureBotsDirectory, readSecureBotCredential, validCredentialRecord, } from "../setup/run-credential-preflight.mjs";
 import { resolveOfficialLarkCli } from "./official-lark-cli.mjs";
@@ -12,7 +13,7 @@ function assertSecureProfileDirectory(directory) {
     const stat = fs.lstatSync(directory);
     if (!stat.isDirectory() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-        || (stat.mode & 0o777) !== 0o700)
+        || !exactMode(stat, 0o700))
         throw new Error("lark-cli profile 目录不安全");
 }
 function captureProfileSnapshot(file) {
@@ -22,7 +23,7 @@ function captureProfileSnapshot(file) {
         const stat = fs.fstatSync(fd);
         if (!stat.isFile()
             || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-            || (stat.mode & 0o077) !== 0)
+            || !notGroupOrWorldAccessible(stat))
             throw new Error("lark-cli config.json 不安全");
         const raw = fs.readFileSync(fd);
         const value = JSON.parse(raw.toString("utf8"));

package/dist/app/setup.mjs

@@ -22,7 +22,7 @@ const flag = (name) => { const index = argv.indexOf(name); return index >= 0 ? a
 const say = (...args) => console.log(...args);
 const die = (message) => { console.error(`✗ ${message}`); process.exit(1); };
 if (argv.some((arg) => arg === "--app-id" || arg.startsWith("--app-id="))) {
-    die("setup 不支持 --app-id；请运行 larkin setup 并在飞书网页中选择机器人");
+    die("setup 不支持 --app-id；请运行 larkin setup 并在飞书（Lark）网页中选择机器人");
 }
 if (argv.some((arg) => arg === "--no-dashboard" || arg.startsWith("--no-dashboard="))) {
     die("--no-dashboard 已移除；dashboard 由 larkin start 统一管理");
@@ -67,7 +67,7 @@ if (!OPT.help && normalizedRuntime.distribution === "external" && (flag("--provi
     die("external-pi 使用已有 pi 环境，不接受 --provider/--api-key/--base-url");
 }
 if (OPT.help) {
-    say(`larkin setup — Create or connect a Feishu bot, then configure and attach its Agent
+    say(`larkin setup — Create or connect a Feishu (Lark) bot, then configure and attach its Agent
 
 Usage:
   larkin setup                         Select a bot in the browser and run setup（默认：内置 Pi + 配置完成即热挂载）
@@ -128,7 +128,7 @@ export async function main() {
         env: process.env,
         interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
         async confirmInstall(command) {
-            say("[setup 0/5] Larkin 需要未修改的官方 lark-cli 作为 Feishu 命令下游。");
+            say("[setup 0/5] Larkin 需要未修改的官方 lark-cli 作为 Feishu (Lark) 命令下游。");
             say(`将执行：${command}`);
             const input = readline.createInterface({ input: process.stdin, output: process.stdout });
             const answer = (await input.question("是否安装？[y/N] ")).trim().toLowerCase();
@@ -137,7 +137,7 @@ export async function main() {
         },
     }).catch((error) => die(error instanceof Error ? error.message : String(error)));
     say(`[setup 0/5] ✓ 官方 lark-cli ${official.command.version}: ${official.command.command}${official.installed ? "（刚刚安装）" : ""}`);
-    say("\nAgent 与飞书机器人按 App ID 一一对应：");
+    say("\nAgent 与飞书（Lark）机器人按 App ID 一一对应：");
     say("  • 网页选择同一个机器人 → 热更新该 Agent，不重启其他 Agent");
     say("  • 网页创建新机器人 → 热挂载新 Agent，状态彼此独立\n");
     fs.mkdirSync(CFG_DIR, { recursive: true, mode: 0o700 });