larkin 0.4.15 → 0.4.17

package/dist/app/setup.mjs

@@ -190,8 +190,9 @@ export async function main() {
         die(`setup 完成但 Agent ${selectedAgentId} 配置不可读`);
     if (!["codex", "claude", "pi"].includes(configuredAgent.runtime))
         die(`Runtime ${configuredAgent.runtime} 不受支持`);
-    // 非交互（Agent 驱动）时跳过 RPC probe：无 TTY 环境无法进行 pi RPC，探测留到 daemon 启动；
-    // 其余真实阻塞（缺 runtime 可执行文件 / 缺 key / 缺 lark-cli）一律 fast-fail 并给出 agent 可读的修复提示。
+    // 非交互（Agent 驱动）时仍跳过 probeNativeRuntimeReadiness：该探测保持 interactive-only。
+    // external-pi 绑定已在 setup-bind 内做非交互 Pi RPC catalog discovery（RPC over pipes 不需要 TTY）；
+    // daemon attach 探测仍是权威校验。其余真实阻塞（缺 runtime 可执行文件 / 缺 key / 缺 lark-cli）一律 fast-fail。
     if (!OPT.nonInteractive) {
         const runtimeReadiness = await probeNativeRuntimeReadiness({ runtime: configuredAgent.runtime,
             agentId: selectedAgentId, cwd: configuredAgent.workspaceDir,

package/dist/dashboard/dashboard-avatar.mjs

@@ -11,7 +11,9 @@ export function isAllowedDashboardAvatarUrl(value) {
             && url.username === ""
             && url.password === ""
             && (url.port === "" || url.port === "443")
-            && /^s\d+-imfile\.feishucdn\.com$/i.test(url.hostname)
+            // Feishu: s1-imfile.feishucdn.com
+            // Lark regional: s16-imfile-sg.feishucdn.com
+            && /^s\d+-imfile(?:-[a-z]{2,3})?\.feishucdn\.com$/i.test(url.hostname)
             && url.pathname.startsWith("/static-resource/v1/");
     }
     catch {

package/dist/runtime/pi-profile-migration.cjs

@@ -32,8 +32,12 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.releasePiProfileMigrationLock = releasePiProfileMigrationLock;
+exports.clearStalePiProfileMigrationLock = clearStalePiProfileMigrationLock;
 exports.preparePiProfileMigration = preparePiProfileMigration;
 exports.validatePiProfileMigrationState = validatePiProfileMigrationState;
 exports.assertPiProfileMigrationAfterState = assertPiProfileMigrationAfterState;
@@ -44,6 +48,7 @@ const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const node_child_process_1 = require("node:child_process");
+const process_inspect_cjs_1 = __importDefault(require("../platform/process-inspect.cjs"));
 const runtime_readiness_js_1 = require("./runtime-readiness.cjs");
 const pi_compaction_recovery_js_1 = require("./pi-compaction-recovery.cjs");
 const pi_provider_config_js_1 = require("./pi-provider-config.cjs");
@@ -87,6 +92,109 @@ function releasePiProfileMigrationLock(state) {
             throw error;
     }
 }
+const TARGET_BUSY = "Pi provider target is busy";
+function migrationLockPath(configDir, agentId) {
+    if (!AGENT_ID.test(agentId))
+        throw new Error("Pi Agent ID 格式无效");
+    return path.join(path.resolve(configDir), "providers", "pi", `${agentId}${TARGET_LOCK_SUFFIX}`);
+}
+function lockPidFromBytes(bytes) {
+    const text = bytes.toString("utf8");
+    if (text.endsWith("\n") ? text.slice(0, -1).includes("\n") : text.includes("\n"))
+        return null;
+    const line = text.endsWith("\n") ? text.slice(0, -1) : text;
+    if (!/^[1-9][0-9]*$/.test(line))
+        return null;
+    const pid = Number(line);
+    return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+function inspectOwnedLock(file) {
+    let fd;
+    try {
+        const initial = fs.lstatSync(file);
+        if (initial.isSymbolicLink() || !initial.isFile() || initial.nlink !== 1 || (initial.mode & 0o777) !== 0o600) {
+            throw new Error(TARGET_BUSY);
+        }
+        assertOwner(initial, "Pi provider lock");
+        const noFollow = fs.constants.O_NOFOLLOW ?? 0;
+        fd = fs.openSync(file, fs.constants.O_RDONLY | noFollow);
+        const before = fs.fstatSync(fd);
+        if (!before.isFile() || before.nlink !== 1 || (before.mode & 0o777) !== 0o600)
+            throw new Error(TARGET_BUSY);
+        assertOwner(before, "Pi provider lock");
+        const bytes = Buffer.allocUnsafe(before.size);
+        let offset = 0;
+        while (offset < before.size) {
+            const read = fs.readSync(fd, bytes, offset, before.size - offset, null);
+            if (read === 0)
+                throw new Error(TARGET_BUSY);
+            offset += read;
+        }
+        const after = fs.fstatSync(fd);
+        if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.nlink !== before.nlink
+            || after.uid !== before.uid || (after.mode & 0o777) !== 0o600)
+            throw new Error(TARGET_BUSY);
+        const pid = lockPidFromBytes(bytes.subarray(0, after.size));
+        if (pid === null)
+            throw new Error(TARGET_BUSY);
+        return { pid, dev: after.dev, ino: after.ino };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        if (error.code === "ELOOP")
+            throw new Error(TARGET_BUSY);
+        if (error instanceof Error && error.message === TARGET_BUSY)
+            throw error;
+        if (error instanceof Error && /unsafe/.test(error.message))
+            throw new Error(TARGET_BUSY);
+        throw new Error(TARGET_BUSY);
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/** Reclaim a credential-adjacent import lock only when it is a proven-dead owned regular file. */
+function clearStalePiProfileMigrationLock(configDir, agentId, options = {}) {
+    const file = migrationLockPath(configDir, agentId);
+    assertNoSymlinkAncestors(path.dirname(file));
+    const inspected = inspectOwnedLock(file);
+    if (!inspected)
+        return;
+    const kill = options.kill ?? process.kill;
+    if (process_inspect_cjs_1.default.pidAlive(inspected.pid, kill))
+        throw new Error(TARGET_BUSY);
+    const quarantine = `${file}.stale-${process.pid}-${crypto.randomUUID()}`;
+    try {
+        fs.renameSync(file, quarantine);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw new Error(TARGET_BUSY);
+    }
+    fsyncDirectory(path.dirname(file));
+    try {
+        const quarantined = fs.lstatSync(quarantine);
+        if (quarantined.isSymbolicLink() || !quarantined.isFile() || quarantined.nlink !== 1
+            || (quarantined.mode & 0o777) !== 0o600 || quarantined.dev !== inspected.dev || quarantined.ino !== inspected.ino) {
+            throw new Error(TARGET_BUSY);
+        }
+        assertOwner(quarantined, "Pi provider lock");
+        const bytes = fs.readFileSync(quarantine);
+        if (lockPidFromBytes(bytes) !== inspected.pid || process_inspect_cjs_1.default.pidAlive(inspected.pid, kill)) {
+            throw new Error(TARGET_BUSY);
+        }
+    }
+    finally {
+        try {
+            fs.unlinkSync(quarantine);
+        }
+        catch { /* quarantine is not the live lock path */ }
+        fsyncDirectory(path.dirname(file));
+    }
+}
 function isKnownSystemSymlink(value) {
     return value === "/tmp" || value === "/private/tmp" || value === "/var" || value === "/private/var"
         || value === "/var/folders" || /^\/var\/folders\/[^/]+$/.test(value)
@@ -263,7 +371,7 @@ function preparePiProfileMigration(env, configDir, agentId, distribution = "buil
     const sourceDirectoryState = assertDirectory(sourceDir, "external Pi profile");
     const sourceExecutable = sourceVersion(env, sourceDir);
     const sourceFiles = Object.fromEntries(FILES.map((name) => {
-        const file = readRegular(path.join(sourceDir, name), `external Pi ${name}`);
+        const file = readRegular(path.join(sourceDir, name), `external Pi ${name}`, false);
         if (!file)
             throw new Error(`external Pi ${name} is required`);
         if (name === "auth.json" && file.mode !== 0o600)

package/dist/runtime/pi-profile-migration.mjs

@@ -3,6 +3,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
+import processInspect from "../platform/process-inspect.cjs";
 import { resolveRuntimeExecutable } from "./runtime-readiness.mjs";
 import { mergeOwnedPiSettings, parsePiExecutableVersion } from "./pi-compaction-recovery.mjs";
 import { BUNDLED_PI_VERSION } from "./pi-provider-config.mjs";
@@ -46,6 +47,109 @@ export function releasePiProfileMigrationLock(state) {
             throw error;
     }
 }
+const TARGET_BUSY = "Pi provider target is busy";
+function migrationLockPath(configDir, agentId) {
+    if (!AGENT_ID.test(agentId))
+        throw new Error("Pi Agent ID 格式无效");
+    return path.join(path.resolve(configDir), "providers", "pi", `${agentId}${TARGET_LOCK_SUFFIX}`);
+}
+function lockPidFromBytes(bytes) {
+    const text = bytes.toString("utf8");
+    if (text.endsWith("\n") ? text.slice(0, -1).includes("\n") : text.includes("\n"))
+        return null;
+    const line = text.endsWith("\n") ? text.slice(0, -1) : text;
+    if (!/^[1-9][0-9]*$/.test(line))
+        return null;
+    const pid = Number(line);
+    return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+function inspectOwnedLock(file) {
+    let fd;
+    try {
+        const initial = fs.lstatSync(file);
+        if (initial.isSymbolicLink() || !initial.isFile() || initial.nlink !== 1 || (initial.mode & 0o777) !== 0o600) {
+            throw new Error(TARGET_BUSY);
+        }
+        assertOwner(initial, "Pi provider lock");
+        const noFollow = fs.constants.O_NOFOLLOW ?? 0;
+        fd = fs.openSync(file, fs.constants.O_RDONLY | noFollow);
+        const before = fs.fstatSync(fd);
+        if (!before.isFile() || before.nlink !== 1 || (before.mode & 0o777) !== 0o600)
+            throw new Error(TARGET_BUSY);
+        assertOwner(before, "Pi provider lock");
+        const bytes = Buffer.allocUnsafe(before.size);
+        let offset = 0;
+        while (offset < before.size) {
+            const read = fs.readSync(fd, bytes, offset, before.size - offset, null);
+            if (read === 0)
+                throw new Error(TARGET_BUSY);
+            offset += read;
+        }
+        const after = fs.fstatSync(fd);
+        if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.nlink !== before.nlink
+            || after.uid !== before.uid || (after.mode & 0o777) !== 0o600)
+            throw new Error(TARGET_BUSY);
+        const pid = lockPidFromBytes(bytes.subarray(0, after.size));
+        if (pid === null)
+            throw new Error(TARGET_BUSY);
+        return { pid, dev: after.dev, ino: after.ino };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        if (error.code === "ELOOP")
+            throw new Error(TARGET_BUSY);
+        if (error instanceof Error && error.message === TARGET_BUSY)
+            throw error;
+        if (error instanceof Error && /unsafe/.test(error.message))
+            throw new Error(TARGET_BUSY);
+        throw new Error(TARGET_BUSY);
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/** Reclaim a credential-adjacent import lock only when it is a proven-dead owned regular file. */
+export function clearStalePiProfileMigrationLock(configDir, agentId, options = {}) {
+    const file = migrationLockPath(configDir, agentId);
+    assertNoSymlinkAncestors(path.dirname(file));
+    const inspected = inspectOwnedLock(file);
+    if (!inspected)
+        return;
+    const kill = options.kill ?? process.kill;
+    if (processInspect.pidAlive(inspected.pid, kill))
+        throw new Error(TARGET_BUSY);
+    const quarantine = `${file}.stale-${process.pid}-${crypto.randomUUID()}`;
+    try {
+        fs.renameSync(file, quarantine);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw new Error(TARGET_BUSY);
+    }
+    fsyncDirectory(path.dirname(file));
+    try {
+        const quarantined = fs.lstatSync(quarantine);
+        if (quarantined.isSymbolicLink() || !quarantined.isFile() || quarantined.nlink !== 1
+            || (quarantined.mode & 0o777) !== 0o600 || quarantined.dev !== inspected.dev || quarantined.ino !== inspected.ino) {
+            throw new Error(TARGET_BUSY);
+        }
+        assertOwner(quarantined, "Pi provider lock");
+        const bytes = fs.readFileSync(quarantine);
+        if (lockPidFromBytes(bytes) !== inspected.pid || processInspect.pidAlive(inspected.pid, kill)) {
+            throw new Error(TARGET_BUSY);
+        }
+    }
+    finally {
+        try {
+            fs.unlinkSync(quarantine);
+        }
+        catch { /* quarantine is not the live lock path */ }
+        fsyncDirectory(path.dirname(file));
+    }
+}
 function isKnownSystemSymlink(value) {
     return value === "/tmp" || value === "/private/tmp" || value === "/var" || value === "/private/var"
         || value === "/var/folders" || /^\/var\/folders\/[^/]+$/.test(value)
@@ -222,7 +326,7 @@ export function preparePiProfileMigration(env, configDir, agentId, distribution
     const sourceDirectoryState = assertDirectory(sourceDir, "external Pi profile");
     const sourceExecutable = sourceVersion(env, sourceDir);
     const sourceFiles = Object.fromEntries(FILES.map((name) => {
-        const file = readRegular(path.join(sourceDir, name), `external Pi ${name}`);
+        const file = readRegular(path.join(sourceDir, name), `external Pi ${name}`, false);
         if (!file)
             throw new Error(`external Pi ${name} is required`);
         if (name === "auth.json" && file.mode !== 0o600)

package/dist/setup/setup-bind.mjs

@@ -9,7 +9,10 @@ import { fileURLToPath } from "node:url";
 import { isWindows } from "../platform/secure-metadata.mjs";
 import { TargetRootLayout } from "../platform/root-layout.mjs";
 import { planSingleRootBinding } from "./setup-binding.mjs";
-import { configureBuiltinPiProviderModel } from "../runtime/pi-provider-config.mjs";
+import { configureBuiltinPiProviderModel, piAgentDirectory } from "../runtime/pi-provider-config.mjs";
+import { applyPiProfileMigration, clearStalePiProfileMigrationLock, preparePiProfileMigration, releasePiProfileMigrationLock, rollbackPiProfileMigration, } from "../runtime/pi-profile-migration.mjs";
+import { discoverPiModelCatalog } from "../runtime/pi-model-catalog.mjs";
+import { calculatePiCompactionSettings } from "../runtime/pi-compaction-recovery.mjs";
 import { terminalSetupQuestioner } from "./setup-agent-choice.mjs";
 import { beginBuiltinPiCredentialTransaction, createOfficialPiAuthInteraction, createOfficialPiModelRuntime, runOfficialPiLogin, verifyOfficialPiProviderTurn, } from "../runtime/pi-official-auth.mjs";
 import * as larkinConfigImport from "../platform/config.mjs";
@@ -195,6 +198,30 @@ function fabricateAttachment(root, serverId) {
     };
     fs.writeFileSync(file, JSON.stringify(attachment, null, 2), { mode: 0o600 });
 }
+function catalogModelsFromError(error) {
+    if (!error || typeof error !== "object" || !("catalogModels" in error))
+        return [];
+    const models = error.catalogModels;
+    return Array.isArray(models) ? models.filter((id) => typeof id === "string" && id.length > 0) : [];
+}
+function formatExternalPiSetupFailure(error, options) {
+    const original = (error instanceof Error ? error.message : String(error)).replace(/[\r\n]+/g, " ").trim();
+    const alternatives = catalogModelsFromError(error);
+    const parts = [];
+    if (/external Pi (?:auth\.json|models\.json|settings\.json) is required|external Pi profile|external Pi auth\.json has an unsafe mode|external Pi models\.json has an unsafe mode|external Pi settings\.json has an unsafe mode/.test(original)) {
+        parts.push("external-pi requires the official file-backed Pi profile containing auth.json (0600), models.json, and settings.json, normally after `pi` login and default-model selection. Environment-variable-only credentials are unsupported.");
+    }
+    if (original)
+        parts.push(original);
+    parts.push("Fix the official `pi` login and default model, then rerun `larkin setup --runtime external-pi`.");
+    if (options.agentExisted) {
+        parts.push("This Agent already exists; after a successful setup you can switch models with `larkin model <provider>/<model>`.");
+    }
+    if (alternatives.length) {
+        parts.push(`Alternative models that report a context window: ${alternatives.join(", ")}.`);
+    }
+    return parts.join(" ");
+}
 function safeProviderFailure(error) {
     const message = error instanceof Error ? error.message : String(error);
     if (/\b(?:401|403)\b|unauth|invalid.*(?:key|token)|credential/i.test(message)) {
@@ -267,49 +294,90 @@ export async function main() {
     validateRuntime(runtime);
     const defaultModel = larkinConfig.defaultModelFor(runtime);
     const selectedModel = selection?.runtime === "pi" && selection.distribution === "builtin" ? selection.model : undefined;
-    const targetModelId = selectedModel || (prior?.runtime === runtime ? prior.model : defaultModel);
-    let runtimeModels = larkinConfig.loadRuntimeModels()[runtime];
-    if (runtime === "pi") {
-        const preservedEffort = prior?.runtime === "pi" && typeof prior.effort === "string" && prior.effort.trim()
-            ? [prior.effort]
-            : [];
-        runtimeModels = [{ id: targetModelId, supportedReasoningEfforts: preservedEffort }];
-    }
-    const targetModel = runtimeModels.find((model) => model.id === targetModelId);
-    if (!targetModel)
-        die(`目标模型 ${runtime}/${targetModelId} 不在 runtime 模型目录中；未修改 Agent 配置`);
-    const stored = planSingleRootBinding({
-        config: larkinConfig.toStored(config),
-        profile,
-        requestedAgent,
-        runtime: selection?.runtime || options.runtime,
-        ...(runtime === "pi" && piDistribution ? { piDistribution } : {}),
-        ...(selectedModel ? { model: selectedModel } : {}),
-        defaultModel,
-        supportedReasoningEfforts: targetModel.supportedReasoningEfforts || [],
-        now: new Date().toISOString(),
-    });
-    const bound = stored.agents[profile.appId];
-    fs.mkdirSync(CFG_DIR, { recursive: true });
+    let targetModelId = selectedModel || (prior?.runtime === runtime ? prior.model : defaultModel);
+    let resolvedExternalModel;
+    let pendingMigration = null;
+    let setupConfigCommitted = false;
     let providerTransaction = null;
     let providerPublished = false;
-    const authAlreadyCompleted = selection?.runtime === "pi" && selection.distribution === "builtin"
-        && selection.authCompleted === true;
-    const readinessAlreadyCompleted = authAlreadyCompleted
-        && selection.readinessCompleted === true;
     const authAbort = new AbortController();
-    const cancelProviderTransaction = (signal) => {
+    const cancelOnSignal = (signal) => {
         authAbort.abort();
+        if (!setupConfigCommitted && pendingMigration) {
+            try {
+                rollbackPiProfileMigration(pendingMigration.state);
+            }
+            catch { /* best effort */ }
+        }
         if (!providerPublished)
             providerTransaction?.rollback();
         process.exit(signal === "SIGINT" ? 130 : 143);
     };
-    const onSigint = () => cancelProviderTransaction("SIGINT");
-    const onSigterm = () => cancelProviderTransaction("SIGTERM");
+    const onSigint = () => cancelOnSignal("SIGINT");
+    const onSigterm = () => cancelOnSignal("SIGTERM");
     process.once("SIGINT", onSigint);
     process.once("SIGTERM", onSigterm);
+    let runtimeModels = larkinConfig.loadRuntimeModels()[runtime];
     let authQuestioner = null;
     try {
+        if (runtime === "pi" && piDistribution === "external" && targetModelId === "default") {
+            fs.mkdirSync(CFG_DIR, { recursive: true, mode: 0o700 });
+            try {
+                clearStalePiProfileMigrationLock(CFG_DIR, profile.appId);
+                const plan = preparePiProfileMigration(process.env, CFG_DIR, profile.appId, "external");
+                pendingMigration = plan;
+                applyPiProfileMigration(plan);
+                const catalog = await discoverPiModelCatalog({
+                    cwd: CFG_DIR,
+                    agentDir: piAgentDirectory(CFG_DIR, profile.appId),
+                    env: process.env,
+                });
+                const effective = catalog.effectiveModel;
+                const entry = effective ? catalog.models.find((model) => model.id === effective) : undefined;
+                if (!effective || !entry) {
+                    throw new Error("Pi official default resolution returned an unavailable model");
+                }
+                if (!entry.contextWindow) {
+                    const alternatives = catalog.models
+                        .filter((model) => Number.isFinite(model.contextWindow) && Number(model.contextWindow) > 0)
+                        .map((model) => model.id);
+                    throw Object.assign(new Error("Pi effective model is missing a context window"), { catalogModels: alternatives });
+                }
+                calculatePiCompactionSettings(entry.contextWindow);
+                targetModelId = effective;
+                resolvedExternalModel = effective;
+                runtimeModels = [{ id: effective, supportedReasoningEfforts: entry.supportedReasoningEfforts }];
+            }
+            catch (error) {
+                throw new Error(formatExternalPiSetupFailure(error, { agentExisted: Boolean(prior) }));
+            }
+        }
+        else if (runtime === "pi") {
+            const preservedEffort = prior?.runtime === "pi" && typeof prior.effort === "string" && prior.effort.trim()
+                ? [prior.effort]
+                : [];
+            runtimeModels = [{ id: targetModelId, supportedReasoningEfforts: preservedEffort }];
+        }
+        const targetModel = runtimeModels.find((model) => model.id === targetModelId);
+        if (!targetModel)
+            throw new Error(`目标模型 ${runtime}/${targetModelId} 不在 runtime 模型目录中；未修改 Agent 配置`);
+        const stored = planSingleRootBinding({
+            config: larkinConfig.toStored(config),
+            profile,
+            requestedAgent,
+            runtime: selection?.runtime || options.runtime,
+            ...(runtime === "pi" && piDistribution ? { piDistribution } : {}),
+            ...(selectedModel || resolvedExternalModel ? { model: selectedModel || resolvedExternalModel } : {}),
+            defaultModel,
+            supportedReasoningEfforts: targetModel.supportedReasoningEfforts || [],
+            now: new Date().toISOString(),
+        });
+        const bound = stored.agents[profile.appId];
+        fs.mkdirSync(CFG_DIR, { recursive: true });
+        const authAlreadyCompleted = selection?.runtime === "pi" && selection.distribution === "builtin"
+            && selection.authCompleted === true;
+        const readinessAlreadyCompleted = authAlreadyCompleted
+            && selection.readinessCompleted === true;
         providerTransaction = selection?.runtime === "pi" && selection.distribution === "builtin"
             && !authAlreadyCompleted ? beginBuiltinPiCredentialTransaction(CFG_DIR, profile.appId)
             : null;
@@ -349,10 +417,34 @@ export async function main() {
             }
         }
         larkinConfig.commitSetupConfig(process.env, loaded.revision, stored);
+        setupConfigCommitted = true;
         providerTransaction?.commit();
         providerPublished = true;
+        if (pendingMigration) {
+            try {
+                releasePiProfileMigrationLock(pendingMigration.state);
+            }
+            catch { /* post-commit lock release is best-effort; do not roll back credentials */ }
+            pendingMigration = null;
+        }
+        fabricateAttachment(layout.root, stored.serverId);
+        say(`\n✓ 已写配置: ${CFG_FILE}`);
+        say(`  agent=${profile.appId}  runtime=${bound.runtime}  model=${bound.model}`);
+        say(`  单服务 serverId=${stored.serverId}  larkinHome=${layout.root}`);
+        say("\n启动这个 Agent：");
+        say("  larkin start                     # 单服务启动全部已配置 Agent");
+        say(`  larkin start --agent ${profile.appId}  # 仅调试这个 Agent`);
+        say("创建独立飞书（Lark）机器人 + Agent：");
+        say("  larkin setup");
     }
     catch (error) {
+        if (!setupConfigCommitted && pendingMigration) {
+            try {
+                rollbackPiProfileMigration(pendingMigration.state);
+            }
+            catch { /* best effort */ }
+            pendingMigration = null;
+        }
         providerTransaction?.rollback();
         throw error;
     }
@@ -361,15 +453,6 @@ export async function main() {
         process.off("SIGINT", onSigint);
         process.off("SIGTERM", onSigterm);
     }
-    fabricateAttachment(layout.root, stored.serverId);
-    say(`\n✓ 已写配置: ${CFG_FILE}`);
-    say(`  agent=${profile.appId}  runtime=${bound.runtime}  model=${bound.model}`);
-    say(`  单服务 serverId=${stored.serverId}  larkinHome=${layout.root}`);
-    say("\n启动这个 Agent：");
-    say("  larkin start                     # 单服务启动全部已配置 Agent");
-    say(`  larkin start --agent ${profile.appId}  # 仅调试这个 Agent`);
-    say("创建独立飞书（Lark）机器人 + Agent：");
-    say("  larkin setup");
 }
 if (path.resolve(process.argv[1] || "") === path.resolve(fileURLToPath(import.meta.url))) {
     main().catch((error) => die(error instanceof Error ? error.message : String(error)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "larkin",
-  "version": "0.4.15",
+  "version": "0.4.17",
   "private": false,
   "larkinPackageRole": "npm-published",
   "files": [