larkin 0.5.12 → 0.5.13

package/dist/setup/bot-register.mjs

@@ -16,7 +16,7 @@ import { collectSetupAgentChoice, missingRuntimeInstallMessage, terminalSetupQue
 import { documentCommentSubscriptionCapability, markDocumentCommentSubscriptionVerified, } from "../platform/callback-capability.mjs";
 import { openPlatformHost, parseLarkinTenant, registerAppAccountsHost, } from "../feishu/platform-hosts.mjs";
 import { authorizationUrlFailureMessage, presentAuthorizationUrl } from "./setup-authorization-url.mjs";
-import { reconcileTenantScopes, tenantScopeRecoveryMessage } from "./tenant-scope-grant.mjs";
+import { missingOptionalScopeImpacts, reconcileTenantScopes, tenantScopeRecoveryMessage } from "./tenant-scope-grant.mjs";
 // qrcode-terminal does not publish TypeScript declarations.
 // @ts-expect-error bundled CommonJS dependency
 import qrcodePackage from "qrcode-terminal";
@@ -770,8 +770,11 @@ Lark 必须用 --tenant lark：授权二维码是官方 /page/cli（begin 仍走
             : "Tenant scopes 对账未验证：权威 API 失败或响应无效，不能确认任何申请项已授予。");
         if (!grants.verified)
             say("请检查所选 Agent 的受管 bot CLI 与网络后重跑原 larkin setup 命令，保留 --tenant/--runtime 参数；不要重建 Agent，也不要据此修改应用权限。");
-        if (grants.verified && !grants.missingRequired.length && grants.missingOptional.length)
-            say("! 可选权限未授予，setup 可继续；相关能力仍不可用或未验证。");
+        if (grants.verified && !grants.missingRequired.length && grants.missingOptional.length) {
+            say("! 可选权限未授予，setup 可继续；以下能力可能受限（实际以平台校验为准）：");
+            for (const impact of missingOptionalScopeImpacts(grants.missingOptional))
+                say(`  - ${impact}`);
+        }
         if (missing.length)
             say(tenantScopeRecoveryMessage(tenant, id, missing));
         if (!grants.verified || grants.missingRequired.length > 0) {

package/dist/setup/grant-scopes.mjs

@@ -11,7 +11,7 @@ import { managedOfficialLarkCli } from "../app/agent-lark-cli-workspace.mjs";
 import { loadValidatedBotCredential } from "./run-credential-preflight.mjs";
 import { parseLarkinTenant, registerAppAccountsHost } from "../feishu/platform-hosts.mjs";
 import { presentAuthorizationUrl } from "./setup-authorization-url.mjs";
-import { reconcileTenantScopes, tenantScopeRecoveryMessage } from "./tenant-scope-grant.mjs";
+import { missingOptionalScopeImpacts, reconcileTenantScopes, tenantScopeRecoveryMessage } from "./tenant-scope-grant.mjs";
 // qrcode-terminal does not publish TypeScript declarations.
 // @ts-expect-error bundled CommonJS dependency
 import qrcodePackage from "qrcode-terminal";
@@ -178,8 +178,11 @@ export async function main() {
     const missing = [...grants.missingRequired, ...grants.missingOptional];
     if (!grants.verified)
         throw new Error("Bot tenant scope 未验证；请检查所选 Agent 的受管 bot CLI 与网络，再重跑原 setup 命令并保留 --tenant/--runtime；不要据此修改应用权限。");
-    if (!grants.missingRequired.length && grants.missingOptional.length)
-        log("! 可选权限未授予，setup 可继续；相关能力仍不可用或未验证。");
+    if (!grants.missingRequired.length && grants.missingOptional.length) {
+        log("! 可选权限未授予，setup 可继续；以下能力可能受限（实际以平台校验为准）：");
+        for (const impact of missingOptionalScopeImpacts(grants.missingOptional))
+            log(`  - ${impact}`);
+    }
     if (missing.length)
         log(tenantScopeRecoveryMessage(TENANT, APP_ID, missing));
     if (grants.missingRequired.length)

package/dist/setup/tenant-scope-grant.mjs

@@ -31,6 +31,33 @@ export function reconcileTenantScopes(payload, requested) {
         missingOptional: verified ? missingGrantedTenantScopes(payload, optional) : [],
     };
 }
+/**
+ * Capability each requested-but-optional tenant scope backs. The freshness gate
+ * keeps `im:message.group_msg` as the only blocking requirement, but a missing
+ * optional scope still degrades a named capability at runtime — an im:chat* gap
+ * surfaces as "成员表拉取失败" in the daemon log, for example. Setup reports the
+ * impact beside the scope names so the gap is visible before the first run.
+ */
+const OPTIONAL_SCOPE_CAPABILITIES = [
+    { capability: "群与成员信息（成员姓名/群名解析）", scopes: ["im:chat:readonly", "im:chat.group_info:readonly", "im:chat.members:read"] },
+    { capability: "群管理（建群/改名/成员变更/退群）", scopes: ["im:chat", "im:chat:create", "im:chat:update", "im:chat.members:write_only", "im:chat:operate_as_owner"] },
+    { capability: "云文档评论事件与回复", scopes: ["drive:drive", "docs:document.comment:read", "docs:document.comment:create"] },
+    { capability: "应用可用范围自动设为全员可见", scopes: ["admin:app.visibility"] },
+    { capability: "发送者签名中的工号（employee_id）", scopes: ["contact:user.employee_id:readonly"] },
+    { capability: "机器人消息搜索", scopes: ["search:message"] },
+    { capability: "消息收发与资源（基本消息能力）", scopes: ["im:message", "im:message.p2p_msg:readonly", "im:message.group_at_msg:readonly", "im:message:send_as_bot", "im:resource"] },
+];
+/** Missing optional scopes grouped by the capability they degrade, in declaration order. */
+export function missingOptionalScopeImpacts(missing) {
+    const names = new Set(missing);
+    const lines = OPTIONAL_SCOPE_CAPABILITIES.flatMap(({ capability, scopes }) => {
+        const hit = scopes.filter((scope) => names.has(scope));
+        return hit.length ? [`${capability}：${hit.join(", ")}`] : [];
+    });
+    const covered = new Set(OPTIONAL_SCOPE_CAPABILITIES.flatMap(({ scopes }) => scopes));
+    const rest = missing.filter((scope) => !covered.has(scope));
+    return rest.length ? [...lines, `其他权限：${rest.join(", ")}`] : lines;
+}
 /** Official console recovery form used by lark-cli; scopes are tenant permissions. */
 export function tenantScopeRecoveryMessage(tenant, appId, scopes) {
     const url = new URL(`${openPlatformHost(tenant)}/app/${encodeURIComponent(appId)}/auth`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "larkin",
-  "version": "0.5.12",
+  "version": "0.5.13",
   "private": false,
   "larkinPackageRole": "npm-published",
   "files": [