larkin 0.4.28 → 0.4.29

package/dist/feishu/host-shell.cjs

@@ -208,26 +208,72 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
             runtimeReadiness: { runtime: agent.runtime, state: "unavailable", reason, nextAction: "Wait for the current daemon epoch to publish Runtime readiness.", observedAt: new Date().toISOString() },
         });
     };
+    const unresolvedCurrentAuth = (agent) => {
+        try {
+            const persisted = (0, runtime_readiness_js_1.parsePersistedAuthFailure)(stateStore(agent).readJson("agentState", {}));
+            if (!persisted)
+                return null;
+            // 只使用当前 agentState 作用域标记，不扫描历史 delivery 的 authProvider。
+            return (0, runtime_readiness_js_1.authFailureAppliesTo)({
+                runtime: agent.runtime,
+                model: agent.model,
+                piDistribution: agent.piDistribution,
+            }, persisted) ? persisted : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const projectReadyUnlessUnresolvedAuth = (agent, observedAt) => {
+        const failure = unresolvedCurrentAuth(agent);
+        if (failure) {
+            hostState.updateStatus(agent, {
+                runtimeReadiness: { ...(0, runtime_readiness_js_1.readinessForPersistedAuthFailure)(failure), observedAt },
+            });
+            return;
+        }
+        hostState.updateStatus(agent, { runtimeReadiness: { runtime: agent.runtime, state: "ready", observedAt } });
+    };
     const recordInboundDeliveryFailure = (agent, code) => {
         const at = new Date().toISOString();
         const reason = "Inbound Runtime delivery failed non-retryably; durable Inbox/ledger state is retained for recovery.";
         const nextAction = "Inspect the delivery/status error, correct the Runtime or canonical Inbox state, then restart to replay safely.";
+        const currentReadiness = hostState.readStatus(agent).runtimeReadiness;
         hostState.updateStatus(agent, {
             inboundDeliveryHealth: { state: "error", code, at, reason, nextAction },
-            runtimeReadiness: { runtime: agent.runtime, state: "incompatible", reason, nextAction },
+            ...(currentReadiness?.state === "unauthenticated" ? {} : {
+                runtimeReadiness: { runtime: agent.runtime, state: "incompatible", reason, nextAction },
+            }),
         });
         hostState.recordStatusError(agent, `${reason} ${nextAction} code=${code}`);
     };
     const agentStates = new Map();
+    const mergePersistedAgentState = (record) => {
+        const latest = record.store.readJson("agentState", {});
+        if (isRecord(latest.previousSessions)) {
+            record.state.previousSessions = {
+                ...latest.previousSessions,
+                ...(record.state.previousSessions ?? {}),
+            };
+        }
+        const persisted = (0, runtime_readiness_js_1.parsePersistedAuthFailure)(latest);
+        if (persisted) {
+            record.state.authFailure = persisted;
+            if (persisted.kind === "missing-provider" && persisted.provider) {
+                record.state.authFailureProvider = persisted.provider;
+            }
+            else {
+                delete record.state.authFailureProvider;
+            }
+        }
+        else {
+            delete record.state.authFailure;
+            delete record.state.authFailureProvider;
+        }
+    };
     const saveAgentState = (record) => {
         try {
-            const latest = record.store.readJson("agentState", {});
-            if (isRecord(latest.previousSessions)) {
-                record.state.previousSessions = {
-                    ...latest.previousSessions,
-                    ...(record.state.previousSessions ?? {}),
-                };
-            }
+            mergePersistedAgentState(record);
             record.store.writeJson("agentState", record.state);
         }
         catch (error) {
@@ -1276,12 +1322,16 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
                         observedAt,
                     },
                 });
-            else if (message.readiness)
-                hostState.updateStatus(agent, { runtimeReadiness: { ...message.readiness, observedAt } });
+            else if (message.readiness) {
+                if (message.readiness.state === "ready" && unresolvedCurrentAuth(agent)) {
+                    projectReadyUnlessUnresolvedAuth(agent, observedAt);
+                }
+                else {
+                    hostState.updateStatus(agent, { runtimeReadiness: { ...message.readiness, observedAt } });
+                }
+            }
             else if (message.status === "active")
-                hostState.updateStatus(agent, { runtimeReadiness: {
-                        runtime: agent.runtime, state: "ready", observedAt,
-                    } });
+                projectReadyUnlessUnresolvedAuth(agent, observedAt);
             if (message.status === "active") {
                 const redeliveryTimer = setTimeout(() => {
                     void reminder.redeliverUnread(agent).catch((error) => log("启动补投失败", errorMessage(error)));
@@ -1448,6 +1498,7 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
                         record.state.sessions[agent.runtime] = reset.sessionId;
                     else
                         delete record.state.sessions[agent.runtime];
+                    mergePersistedAgentState(record);
                     record.store.writeJson("agentState", record.state);
                 }
                 if (!reset.sessionId) {
@@ -1455,11 +1506,11 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
                     hostState.updateStatus(agent, {
                         session: { runtime: agent.runtime, id: null, launchId: null, startedAt: observedAt,
                             lastSeenAt: null, lastTurnAt: null, turns: 0 },
-                        runtimeReadiness: { runtime: agent.runtime, state: "ready", observedAt },
                     });
+                    projectReadyUnlessUnresolvedAuth(agent, observedAt);
                 }
                 else if (reset.runtimeReady) {
-                    hostState.updateStatus(agent, { runtimeReadiness: { runtime: agent.runtime, state: "ready", observedAt: new Date().toISOString() } });
+                    projectReadyUnlessUnresolvedAuth(agent, new Date().toISOString());
                 }
             }
             catch (error) {
@@ -1527,7 +1578,7 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
                 throw Object.assign(error instanceof Error ? error : new Error(String(error)), readinessProjection());
             }
             if (recovery.runtimeReady) {
-                hostState.updateStatus(agent, { runtimeReadiness: { runtime: agent.runtime, state: "ready", observedAt: new Date().toISOString() } });
+                projectReadyUnlessUnresolvedAuth(agent, new Date().toISOString());
             }
             const record = agentStates.get(agentId);
             try {
@@ -1536,6 +1587,7 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
                         record.state.sessions[agent.runtime] = recovery.sessionId;
                     else
                         delete record.state.sessions[agent.runtime];
+                    mergePersistedAgentState(record);
                     record.store.writeJson("agentState", record.state);
                 }
             }

package/dist/feishu/host-shell.mjs

@@ -16,7 +16,7 @@ import { inboxAuditRegistryFile, observeInboxAuditTarget } from "../agent/missed
 import { HostChannelBusiness } from "./host-channel-business.mjs";
 import { HostInteractionOrchestrator } from "./interaction-orchestrator.mjs";
 import { targetFor } from "./message-policy.mjs";
-import { providerAuthenticationFailureReadiness, RuntimePrerequisiteError } from "../runtime/runtime-readiness.mjs";
+import { authFailureAppliesTo, parsePersistedAuthFailure, providerAuthenticationFailureReadiness, readinessForPersistedAuthFailure, RuntimePrerequisiteError, } from "../runtime/runtime-readiness.mjs";
 import { readDocumentCommentSubscription, verifyCallbackProbe } from "../platform/callback-capability.mjs";
 import { loadConfig, resolveMentionPolicy } from "../platform/config.mjs";
 import { processCommandToken } from "../app/internal-command.mjs";
@@ -168,26 +168,72 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
             runtimeReadiness: { runtime: agent.runtime, state: "unavailable", reason, nextAction: "Wait for the current daemon epoch to publish Runtime readiness.", observedAt: new Date().toISOString() },
         });
     };
+    const unresolvedCurrentAuth = (agent) => {
+        try {
+            const persisted = parsePersistedAuthFailure(stateStore(agent).readJson("agentState", {}));
+            if (!persisted)
+                return null;
+            // 只使用当前 agentState 作用域标记，不扫描历史 delivery 的 authProvider。
+            return authFailureAppliesTo({
+                runtime: agent.runtime,
+                model: agent.model,
+                piDistribution: agent.piDistribution,
+            }, persisted) ? persisted : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const projectReadyUnlessUnresolvedAuth = (agent, observedAt) => {
+        const failure = unresolvedCurrentAuth(agent);
+        if (failure) {
+            hostState.updateStatus(agent, {
+                runtimeReadiness: { ...readinessForPersistedAuthFailure(failure), observedAt },
+            });
+            return;
+        }
+        hostState.updateStatus(agent, { runtimeReadiness: { runtime: agent.runtime, state: "ready", observedAt } });
+    };
     const recordInboundDeliveryFailure = (agent, code) => {
         const at = new Date().toISOString();
         const reason = "Inbound Runtime delivery failed non-retryably; durable Inbox/ledger state is retained for recovery.";
         const nextAction = "Inspect the delivery/status error, correct the Runtime or canonical Inbox state, then restart to replay safely.";
+        const currentReadiness = hostState.readStatus(agent).runtimeReadiness;
         hostState.updateStatus(agent, {
             inboundDeliveryHealth: { state: "error", code, at, reason, nextAction },
-            runtimeReadiness: { runtime: agent.runtime, state: "incompatible", reason, nextAction },
+            ...(currentReadiness?.state === "unauthenticated" ? {} : {
+                runtimeReadiness: { runtime: agent.runtime, state: "incompatible", reason, nextAction },
+            }),
         });
         hostState.recordStatusError(agent, `${reason} ${nextAction} code=${code}`);
     };
     const agentStates = new Map();
+    const mergePersistedAgentState = (record) => {
+        const latest = record.store.readJson("agentState", {});
+        if (isRecord(latest.previousSessions)) {
+            record.state.previousSessions = {
+                ...latest.previousSessions,
+                ...(record.state.previousSessions ?? {}),
+            };
+        }
+        const persisted = parsePersistedAuthFailure(latest);
+        if (persisted) {
+            record.state.authFailure = persisted;
+            if (persisted.kind === "missing-provider" && persisted.provider) {
+                record.state.authFailureProvider = persisted.provider;
+            }
+            else {
+                delete record.state.authFailureProvider;
+            }
+        }
+        else {
+            delete record.state.authFailure;
+            delete record.state.authFailureProvider;
+        }
+    };
     const saveAgentState = (record) => {
         try {
-            const latest = record.store.readJson("agentState", {});
-            if (isRecord(latest.previousSessions)) {
-                record.state.previousSessions = {
-                    ...latest.previousSessions,
-                    ...(record.state.previousSessions ?? {}),
-                };
-            }
+            mergePersistedAgentState(record);
             record.store.writeJson("agentState", record.state);
         }
         catch (error) {
@@ -1236,12 +1282,16 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
                         observedAt,
                     },
                 });
-            else if (message.readiness)
-                hostState.updateStatus(agent, { runtimeReadiness: { ...message.readiness, observedAt } });
+            else if (message.readiness) {
+                if (message.readiness.state === "ready" && unresolvedCurrentAuth(agent)) {
+                    projectReadyUnlessUnresolvedAuth(agent, observedAt);
+                }
+                else {
+                    hostState.updateStatus(agent, { runtimeReadiness: { ...message.readiness, observedAt } });
+                }
+            }
             else if (message.status === "active")
-                hostState.updateStatus(agent, { runtimeReadiness: {
-                        runtime: agent.runtime, state: "ready", observedAt,
-                    } });
+                projectReadyUnlessUnresolvedAuth(agent, observedAt);
             if (message.status === "active") {
                 const redeliveryTimer = setTimeout(() => {
                     void reminder.redeliverUnread(agent).catch((error) => log("启动补投失败", errorMessage(error)));
@@ -1408,6 +1458,7 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
                         record.state.sessions[agent.runtime] = reset.sessionId;
                     else
                         delete record.state.sessions[agent.runtime];
+                    mergePersistedAgentState(record);
                     record.store.writeJson("agentState", record.state);
                 }
                 if (!reset.sessionId) {
@@ -1415,11 +1466,11 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
                     hostState.updateStatus(agent, {
                         session: { runtime: agent.runtime, id: null, launchId: null, startedAt: observedAt,
                             lastSeenAt: null, lastTurnAt: null, turns: 0 },
-                        runtimeReadiness: { runtime: agent.runtime, state: "ready", observedAt },
                     });
+                    projectReadyUnlessUnresolvedAuth(agent, observedAt);
                 }
                 else if (reset.runtimeReady) {
-                    hostState.updateStatus(agent, { runtimeReadiness: { runtime: agent.runtime, state: "ready", observedAt: new Date().toISOString() } });
+                    projectReadyUnlessUnresolvedAuth(agent, new Date().toISOString());
                 }
             }
             catch (error) {
@@ -1487,7 +1538,7 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
                 throw Object.assign(error instanceof Error ? error : new Error(String(error)), readinessProjection());
             }
             if (recovery.runtimeReady) {
-                hostState.updateStatus(agent, { runtimeReadiness: { runtime: agent.runtime, state: "ready", observedAt: new Date().toISOString() } });
+                projectReadyUnlessUnresolvedAuth(agent, new Date().toISOString());
             }
             const record = agentStates.get(agentId);
             try {
@@ -1496,6 +1547,7 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
                         record.state.sessions[agent.runtime] = recovery.sessionId;
                     else
                         delete record.state.sessions[agent.runtime];
+                    mergePersistedAgentState(record);
                     record.store.writeJson("agentState", record.state);
                 }
             }

package/dist/platform/config.cjs

@@ -53,6 +53,8 @@ exports.resolveAgentGlobalMentionPolicy = resolveAgentGlobalMentionPolicy;
 exports.runtimeConfigSignature = runtimeConfigSignature;
 exports.configApplyState = configApplyState;
 exports.markConfigApplied = markConfigApplied;
+exports.withConfigMutationLock = withConfigMutationLock;
+exports.withConfigMutationLockAsync = withConfigMutationLockAsync;
 exports.mutateConfig = mutateConfig;
 exports.rollbackConfig = rollbackConfig;
 exports.commitSetupConfig = commitSetupConfig;
@@ -652,7 +654,7 @@ function applyMutation(config, mutation) {
                 (0, pi_provider_config_js_1.assertBuiltinPiAgentDirectory)((0, pi_provider_config_js_1.piAgentDirectory)(config.configDir, mutation.agentId));
             }
             catch (error) {
-                throw new Error(`无法切换到 builtin-pi：${error instanceof Error ? error.message : String(error)}。请先运行 larkin setup 并为该 Agent 选择 builtin-pi 完成 provider 配置`);
+                throw new Error(`无法切换到 builtin-pi：${error instanceof Error ? error.message : String(error)}。请使用 Dashboard Provider Credentials 或 larkin pi-auth login。`);
             }
         }
         assertModel(stored.runtime, mutation.model || "default");
@@ -665,6 +667,9 @@ function applyMutation(config, mutation) {
         delete agent.effort;
     }
     else if (mutation.kind === "set-agent-model") {
+        if (mutation.requireBuiltinPi && (agent.runtime !== "pi" || agent.piDistribution !== "builtin")) {
+            throw new Error(`Agent ${mutation.agentId} 不是内置 Pi`);
+        }
         if (!mutation.model.trim())
             throw new Error("model 不能为空");
         assertModel(agent.runtime, mutation.model);
@@ -815,7 +820,7 @@ function assertConfigRoot(root) {
     if (typeof process.getuid === "function" && stat.uid !== process.getuid())
         throw new Error("config root owner is unsafe");
 }
-function withConfigLock(layout, action) {
+function acquireConfigLock(layout) {
     assertNoSymlinkAncestors(layout.root);
     fs.mkdirSync(layout.root, { recursive: true, mode: 0o700 });
     const rootStat = fs.lstatSync(layout.root);
@@ -854,20 +859,43 @@ function withConfigLock(layout, action) {
     }
     if (!acquired)
         throw new Error("配置正被其他进程修改，请稍后重试");
+    return {
+        release() {
+            const current = readLockRecord(lock);
+            if (current?.record?.nonce === owner.nonce && current.record.pid === owner.pid) {
+                try {
+                    fs.unlinkSync(lock);
+                    (0, secure_metadata_js_1.fsyncDirectoryOf)(lock);
+                }
+                catch { /* best effort */ }
+            }
+        },
+    };
+}
+function withConfigLock(layout, action) {
+    const held = acquireConfigLock(layout);
     try {
         recoverMigrationJournal(layout.root);
         recoverRollbackJournal(layout.root);
         return action();
     }
     finally {
-        const current = readLockRecord(lock);
-        if (current?.record?.nonce === owner.nonce && current.record.pid === owner.pid) {
-            try {
-                fs.unlinkSync(lock);
-                (0, secure_metadata_js_1.fsyncDirectoryOf)(lock);
-            }
-            catch { /* best effort */ }
-        }
+        held.release();
+    }
+}
+function withConfigMutationLock(env, action) {
+    return withConfigLock(root_layout_js_1.TargetRootLayout.fromConfigDir(resolveConfigDir(env)), action);
+}
+async function withConfigMutationLockAsync(env, action) {
+    const layout = root_layout_js_1.TargetRootLayout.fromConfigDir(resolveConfigDir(env));
+    const held = acquireConfigLock(layout);
+    try {
+        recoverMigrationJournal(layout.root);
+        recoverRollbackJournal(layout.root);
+        return await action();
+    }
+    finally {
+        held.release();
     }
 }
 const CONFIG_ROLLBACK_JOURNAL_FILE = ".config-rollback-journal.json";

package/dist/platform/config.mjs

@@ -586,7 +586,7 @@ function applyMutation(config, mutation) {
                 assertBuiltinPiAgentDirectory(piAgentDirectory(config.configDir, mutation.agentId));
             }
             catch (error) {
-                throw new Error(`无法切换到 builtin-pi：${error instanceof Error ? error.message : String(error)}。请先运行 larkin setup 并为该 Agent 选择 builtin-pi 完成 provider 配置`);
+                throw new Error(`无法切换到 builtin-pi：${error instanceof Error ? error.message : String(error)}。请使用 Dashboard Provider Credentials 或 larkin pi-auth login。`);
             }
         }
         assertModel(stored.runtime, mutation.model || "default");
@@ -599,6 +599,9 @@ function applyMutation(config, mutation) {
         delete agent.effort;
     }
     else if (mutation.kind === "set-agent-model") {
+        if (mutation.requireBuiltinPi && (agent.runtime !== "pi" || agent.piDistribution !== "builtin")) {
+            throw new Error(`Agent ${mutation.agentId} 不是内置 Pi`);
+        }
         if (!mutation.model.trim())
             throw new Error("model 不能为空");
         assertModel(agent.runtime, mutation.model);
@@ -749,7 +752,7 @@ function assertConfigRoot(root) {
     if (typeof process.getuid === "function" && stat.uid !== process.getuid())
         throw new Error("config root owner is unsafe");
 }
-function withConfigLock(layout, action) {
+function acquireConfigLock(layout) {
     assertNoSymlinkAncestors(layout.root);
     fs.mkdirSync(layout.root, { recursive: true, mode: 0o700 });
     const rootStat = fs.lstatSync(layout.root);
@@ -788,20 +791,43 @@ function withConfigLock(layout, action) {
     }
     if (!acquired)
         throw new Error("配置正被其他进程修改，请稍后重试");
+    return {
+        release() {
+            const current = readLockRecord(lock);
+            if (current?.record?.nonce === owner.nonce && current.record.pid === owner.pid) {
+                try {
+                    fs.unlinkSync(lock);
+                    fsyncDirectoryOf(lock);
+                }
+                catch { /* best effort */ }
+            }
+        },
+    };
+}
+function withConfigLock(layout, action) {
+    const held = acquireConfigLock(layout);
     try {
         recoverMigrationJournal(layout.root);
         recoverRollbackJournal(layout.root);
         return action();
     }
     finally {
-        const current = readLockRecord(lock);
-        if (current?.record?.nonce === owner.nonce && current.record.pid === owner.pid) {
-            try {
-                fs.unlinkSync(lock);
-                fsyncDirectoryOf(lock);
-            }
-            catch { /* best effort */ }
-        }
+        held.release();
+    }
+}
+export function withConfigMutationLock(env, action) {
+    return withConfigLock(TargetRootLayout.fromConfigDir(resolveConfigDir(env)), action);
+}
+export async function withConfigMutationLockAsync(env, action) {
+    const layout = TargetRootLayout.fromConfigDir(resolveConfigDir(env));
+    const held = acquireConfigLock(layout);
+    try {
+        recoverMigrationJournal(layout.root);
+        recoverRollbackJournal(layout.root);
+        return await action();
+    }
+    finally {
+        held.release();
     }
 }
 const CONFIG_ROLLBACK_JOURNAL_FILE = ".config-rollback-journal.json";