larkit 0.0.0-stage → 0.1.1

package/scripts/check-syntax.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const roots = ["bin", "src", "scripts"];
+const files = [];
+function walk(dir) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) walk(full);
+    else if (/\.(?:js|mjs)$/.test(entry.name)) files.push(full);
+  }
+}
+for (const root of roots) if (fs.existsSync(root)) walk(root);
+
+let failed = 0;
+for (const file of files.sort()) {
+  const result = spawnSync(process.execPath, ["--check", file], {
+    encoding: "utf8",
+  });
+  if (result.status !== 0) {
+    failed++;
+    console.error(`FAIL ${file}\n${result.stderr}`);
+  }
+}
+console.log(`${files.length - failed}/${files.length} files passed syntax check`);
+process.exit(failed ? 1 : 0);

package/scripts/login-worker.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import "../src/shared/quiet.js";
+import fs from "node:fs";
+import { loginWithQr } from "../src/auth/login.js";
+
+function arg(name, fallback) {
+  const index = process.argv.indexOf(`--${name}`);
+  return index >= 0 ? process.argv[index + 1] : fallback;
+}
+
+const name = arg("name", "default");
+const timeoutMs = Number(arg("timeout", "120000")) || 120000;
+const statusFile = arg("status", undefined);
+const headless = !process.argv.includes("--headful");
+
+try {
+  const result = await loginWithQr({ name, timeoutMs, headless, statusFile });
+  if (statusFile) {
+    fs.writeFileSync(
+      statusFile,
+      `${JSON.stringify(
+        {
+          phase: result.ok ? "success" : "failed",
+          updated_at: new Date().toISOString(),
+          ...result,
+        },
+        null,
+        2,
+      )}\n`,
+    );
+  }
+  process.exit(result.ok ? 0 : 2);
+} catch (error) {
+  if (statusFile) {
+    fs.writeFileSync(
+      statusFile,
+      `${JSON.stringify(
+        {
+          phase: "error",
+          updated_at: new Date().toISOString(),
+          error: error instanceof Error ? error.message : String(error),
+        },
+        null,
+        2,
+      )}\n`,
+    );
+  }
+  console.error(error);
+  process.exit(1);
+}

package/scripts/publish-pack.mjs

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+/**
+ * Publish a built truth pack to Cloudflare R2.
+ *
+ *   # maintainer machine — truth source release (no npm involved)
+ *   node bin/larkit.js pack build --out=dist/truth-pack \
+ *     --tag=2026.11.15 --base-url=https://larkit.tapeless.eu.org
+ *   node scripts/publish-pack.mjs --pack-dir=dist/truth-pack \
+ *     --bucket=larkit-truth --base-url=https://larkit.tapeless.eu.org
+ *
+ * Objects are uploaded with immutable cache headers (archive names carry the
+ * pack tag), then `manifest.json` last — clients never observe a manifest that
+ * points at objects which are not there yet.  A pinned copy (`<tag>.json`) is
+ * published alongside for reproducible installs, plus `index.json` that lists
+ * every published tag so a tag can never be silently reused for new bytes.
+ *
+ * Uploads go through `wrangler r2 object put`, so either run `wrangler login`
+ * once or export CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+
+const IMMUTABLE = "public, max-age=31536000, immutable";
+const MANIFEST_CACHE = "public, max-age=60, must-revalidate";
+
+function parseArgs(argv) {
+  const flags = {};
+  for (const arg of argv) {
+    if (!arg.startsWith("--")) continue;
+    const [key, ...rest] = arg.slice(2).split("=");
+    const value = rest.join("=");
+    flags[key] = value === "" ? true : value;
+  }
+  return flags;
+}
+
+function fail(message) {
+  console.error(`[publish] ${message}`);
+  process.exit(1);
+}
+
+function mib(bytes) {
+  return `${(bytes / 1024 / 1024).toFixed(1)} MiB`;
+}
+
+const flags = parseArgs(process.argv.slice(2));
+const packDir = path.resolve(flags["pack-dir"] || "dist/truth-pack");
+const bucket = flags.bucket || process.env.LARKIT_R2_BUCKET || "larkit-truth";
+const prefix = String(flags.prefix || "").replace(/^\/+|\/+$/g, "");
+const dryRun = Boolean(flags["dry-run"]);
+const manifestOnly = Boolean(flags["manifest-only"]);
+const force = Boolean(flags.force);
+const wrangler = flags.wrangler || "npx --yes wrangler@latest";
+
+const manifestFile = path.join(packDir, "manifest.json");
+if (!fs.existsSync(manifestFile)) {
+  fail(
+    `missing ${manifestFile}; run "larkit pack build --out=${path.relative(process.cwd(), packDir)}" first`,
+  );
+}
+
+const manifest = JSON.parse(fs.readFileSync(manifestFile, "utf8"));
+if (manifest.kind !== "larkit-truth-pack") fail(`${manifestFile} is not a truth pack manifest`);
+const tiers = Object.entries(manifest.tiers || {});
+if (!tiers.length) fail(`${manifestFile} has no tiers`);
+
+const tag = String(manifest.packVersion || manifest.larkitVersion || "0.0.0");
+if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(tag)) fail(`unsafe pack tag "${tag}"`);
+
+function baseUrlFromManifest() {
+  for (const [, tier] of tiers) {
+    if (typeof tier.url === "string" && /^https?:\/\//.test(tier.url)) {
+      return tier.url.replace(/\/[^/]*$/, "");
+    }
+  }
+  return "";
+}
+
+const baseUrl = String(
+  flags["base-url"] || process.env.LARKIT_PACK_BASE_URL || baseUrlFromManifest(),
+).replace(/\/+$/, "");
+if (!baseUrl) {
+  fail("no public base URL: pass --base-url=https://host/prefix (or build with --base-url)");
+}
+
+function keyFor(name) {
+  return prefix ? `${prefix}/${name}` : name;
+}
+
+function urlFor(name) {
+  return `${baseUrl}/${keyFor(name)}`;
+}
+
+function sha256(file) {
+  return createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
+
+function upload(localFile, name, { contentType, cacheControl }) {
+  const key = keyFor(name);
+  const args = [
+    "r2",
+    "object",
+    "put",
+    `${bucket}/${key}`,
+    `--file=${localFile}`,
+    `--content-type=${contentType}`,
+    `--cache-control=${cacheControl}`,
+    "--remote",
+    "-y",
+  ];
+  const label = `${bucket}/${key}`;
+  if (dryRun) {
+    console.log(`[publish] dry-run ${label} <- ${path.relative(process.cwd(), localFile)}`);
+    return;
+  }
+  console.log(`[publish] upload ${label} (${mib(fs.statSync(localFile).size)})`);
+  const [command, ...prefixArgs] = wrangler.split(/\s+/);
+  const result = spawnSync(command, [...prefixArgs, ...args], { stdio: "inherit" });
+  if (result.status !== 0) fail(`wrangler failed for ${label}`);
+}
+
+async function fetchIndex() {
+  try {
+    const response = await fetch(urlFor("index.json"), {
+      headers: { "cache-control": "no-cache" },
+    });
+    if (response.status === 404) return { schemaVersion: 1, packs: [] };
+    if (!response.ok) fail(`GET ${urlFor("index.json")} -> HTTP ${response.status}`);
+    const index = await response.json();
+    if (!Array.isArray(index.packs)) return { schemaVersion: 1, packs: [] };
+    return index;
+  } catch (error) {
+    if (dryRun) return { schemaVersion: 1, packs: [] };
+    fail(`cannot read ${urlFor("index.json")}: ${error.message}`);
+  }
+  return { schemaVersion: 1, packs: [] };
+}
+
+async function verifyRemote(name, entry) {
+  if (dryRun) return;
+  const url = urlFor(name);
+  const head = await fetch(url, { method: "HEAD", redirect: "follow" });
+  if (!head.ok) fail(`HEAD ${url} -> HTTP ${head.status}`);
+  const length = Number(head.headers.get("content-length")) || 0;
+  if (length !== entry.bytes) fail(`content-length mismatch for ${url}: ${length} != ${entry.bytes}`);
+  const range = await fetch(url, { headers: { range: "bytes=0-15" } });
+  if (range.status !== 206) {
+    console.warn(`[publish] warning: ${url} answered ${range.status} to a range request (no resume)`);
+  }
+  const response = await fetch(url, { redirect: "follow" });
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const actual = createHash("sha256").update(buffer).digest("hex");
+  if (entry.sha256 && actual !== entry.sha256) {
+    fail(`sha256 mismatch for ${url}: ${actual} != ${entry.sha256}`);
+  }
+  console.log(`[publish] verified ${url}`);
+}
+
+// Pre-flight: never publish a manifest that does not match the bytes on disk.
+const artifacts = [];
+for (const [tier] of tiers) {
+  if (tier !== "full") {
+    fail(
+      `legacy "${tier}" tier in ${manifestFile}; larkit now publishes a single "full" archive ` +
+        "(rebuild with `larkit pack build`)",
+    );
+  }
+}
+for (const [tier, entry] of tiers) {
+  const file = path.join(packDir, entry.file);
+  if (!fs.existsSync(file)) fail(`missing artifact for ${tier} tier: ${file}`);
+  const stat = fs.statSync(file);
+  if (entry.bytes && stat.size !== entry.bytes) {
+    fail(`${entry.file}: size ${stat.size} != manifest ${entry.bytes}`);
+  }
+  const actual = sha256(file);
+  if (entry.sha256 && actual !== entry.sha256) {
+    fail(`${entry.file}: sha256 ${actual} != manifest ${entry.sha256}`);
+  }
+  artifacts.push({ tier, file, name: entry.file, bytes: stat.size, sha256: actual });
+}
+
+// Immutability guard: archive names carry the tag, so a tag is a permanent URL.
+const index = await fetchIndex();
+const existing = index.packs.find((entry) => entry.tag === tag);
+const fingerprint = Object.fromEntries(artifacts.map((a) => [a.tier, a.sha256]));
+if (existing && !force) {
+  const drift = Object.entries(fingerprint).filter(
+    ([tier, sha]) => existing.tiers?.[tier]?.sha256 && existing.tiers[tier].sha256 !== sha,
+  );
+  if (drift.length) {
+    fail(
+      `tag "${tag}" is already published with different bytes (${drift
+        .map(([tier]) => tier)
+        .join(", ")}); rebuild with a new --tag=<date> (tags are immutable), or pass --force`,
+    );
+  }
+  console.log(`[publish] tag "${tag}" already published with identical content`);
+  if (!(manifestOnly || force)) {
+    console.log("[publish] nothing to upload (use --manifest-only to refresh manifest.json)");
+  }
+}
+
+console.log(
+  `[publish] pack ${tag} (larkit ${manifest.larkitVersion}) -> r2://${bucket}/${prefix || ""}, base ${baseUrl}`,
+);
+
+const uploaded = [];
+if (!manifestOnly) {
+  for (const artifact of artifacts) {
+    if (existing && !force && existing.tiers?.[artifact.tier]?.sha256 === artifact.sha256) {
+      console.log(`[publish] re-use ${keyFor(artifact.name)} (same sha256)`);
+      continue;
+    }
+    upload(artifact.file, artifact.name, {
+      contentType: "application/gzip",
+      cacheControl: IMMUTABLE,
+    });
+    uploaded.push(artifact);
+  }
+}
+
+upload(manifestFile, `${tag}.json`, { contentType: "application/json", cacheControl: IMMUTABLE });
+upload(manifestFile, "manifest.json", {
+  contentType: "application/json",
+  cacheControl: MANIFEST_CACHE,
+});
+
+const nextIndex = {
+  schemaVersion: 1,
+  updatedAt: new Date().toISOString(),
+  latest: tag,
+  packs: [
+    ...index.packs.filter((entry) => entry.tag !== tag),
+    {
+      tag,
+      builtAt: manifest.builtAt || null,
+      larkitVersion: manifest.larkitVersion || null,
+      clientVersion: manifest.clientVersion || null,
+      stats: manifest.stats || null,
+      manifest: urlFor(`${tag}.json`),
+      tiers: Object.fromEntries(
+        artifacts.map((a) => [a.tier, { url: urlFor(a.name), bytes: a.bytes, sha256: a.sha256 }]),
+      ),
+    },
+  ].sort((a, b) => String(a.tag).localeCompare(String(b.tag))),
+};
+const indexPath = path.join(packDir, "index.json");
+fs.writeFileSync(indexPath, `${JSON.stringify(nextIndex, null, 2)}\n`);
+upload(indexPath, "index.json", { contentType: "application/json", cacheControl: MANIFEST_CACHE });
+
+if (!manifestOnly) {
+  for (const artifact of uploaded) {
+    await verifyRemote(artifact.name, artifact);
+  }
+}
+
+const manifestUrl = urlFor("manifest.json");
+if (!dryRun) {
+  const check = await fetch(manifestUrl, { redirect: "follow", headers: { "cache-control": "no-cache" } });
+  if (!check.ok) fail(`GET ${manifestUrl} -> HTTP ${check.status}`);
+  const served = await check.json();
+  if ((served.packVersion || served.larkitVersion) !== tag) {
+    fail(`served manifest tag ${served.packVersion || served.larkitVersion} != ${tag}`);
+  }
+}
+
+console.log("");
+console.log("[publish] done. truth source is live:");
+console.log(`  manifest   ${manifestUrl}`);
+console.log(`  pinned     ${urlFor(`${tag}.json`)}`);
+console.log(`  index      ${urlFor("index.json")}`);
+console.log("");
+console.log("[publish] keep old tags on R2: published npm versions and pinned");
+console.log("[publish] manifests point at those archive names forever.");

package/scripts/verify-bootstrap.mjs

@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+/**
+ * End-to-end bootstrap verification with a synthetic pack:
+ *   tar round-trip → pack build → `larkit init` in a temp home → search/status.
+ *
+ * Uses child processes for init/search because paths are resolved from the
+ * environment at module load time.
+ */
+import "../src/shared/quiet.js";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync } from "node:child_process";
+import { createTarGz, extractTarGz } from "../src/bootstrap/tar.js";
+
+const root = path.resolve(import.meta.dirname, "..");
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "larkit-verify-"));
+let failed = 0;
+
+function check(name, condition, detail = "") {
+  if (condition) {
+    console.log(`PASS ${name}`);
+  } else {
+    failed++;
+    console.error(`FAIL ${name}${detail ? `: ${detail}` : ""}`);
+  }
+}
+
+async function makeFixture() {
+  const { DatabaseSync } = await import("node:sqlite");
+  const dataDir = path.join(tmp, "source-data");
+  const verifiedDir = path.join(tmp, "source-verified");
+  fs.mkdirSync(verifiedDir, { recursive: true });
+  const formatted = path.join(dataDir, "formatted", "demo");
+  fs.mkdirSync(formatted, { recursive: true });
+  fs.writeFileSync(
+    path.join(formatted, "sample.js"),
+    "function cardLink() {\n  return 'card_link';\n}\n",
+  );
+  fs.writeFileSync(
+    path.join(verifiedDir, "demo-truth.md"),
+    "---\ntopic: demo card truth\nsource: doc\nconfidence: high\n---\n\n## 结论\n\nchart_spec is documented here.\n",
+  );
+  const db = new DatabaseSync(path.join(dataDir, "truth.db"));
+  db.exec(`
+    CREATE TABLE verified_truths (
+      id INTEGER PRIMARY KEY, topic TEXT, section TEXT, path TEXT,
+      line_start INTEGER, line_end INTEGER, verified_at TEXT, source TEXT,
+      confidence TEXT, body TEXT
+    );
+    CREATE VIRTUAL TABLE verified_fts USING fts5(
+      topic, section, body, path, search_text
+    );
+    CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT);
+  `);
+  db.prepare(
+    `INSERT INTO verified_truths (topic, section, path, line_start, line_end, verified_at, source, confidence, body)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+  ).run(
+    "demo card truth",
+    "结论",
+    "verified_truths/demo-truth.md",
+    1,
+    3,
+    "2026-01-01T00:00:00.000Z",
+    "doc",
+    "high",
+    "chart_spec is documented here.",
+  );
+  db.prepare(
+    `INSERT INTO verified_fts (rowid, topic, section, body, path, search_text)
+     VALUES (1, ?, ?, ?, ?, ?)`,
+  ).run(
+    "demo card truth",
+    "结论",
+    "chart_spec is documented here.",
+    "verified_truths/demo-truth.md",
+    "chart_spec demo card truth",
+  );
+  db.close();
+  fs.writeFileSync(
+    path.join(dataDir, "truth.meta.json"),
+    `${JSON.stringify({ generatedAt: new Date().toISOString(), protocolCatalog: 1, codeAnchors: 1, verifiedSections: 1, protocolDocs: 0 }, null, 2)}\n`,
+  );
+  return { dataDir, verifiedDir };
+}
+
+function run(args, env) {
+  const result = spawnSync(process.execPath, [path.join(root, "bin", "larkit.js"), ...args], {
+    cwd: root,
+    env: { ...process.env, ...env },
+    encoding: "utf8",
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout,
+    stderr: result.stderr,
+    json: (() => {
+      try {
+        return JSON.parse(result.stdout);
+      } catch {
+        return null;
+      }
+    })(),
+  };
+}
+
+try {
+  // 1. tar round-trip, including long and UTF-8 paths.
+  const longRel =
+    "formatted/very/deep/directory/that/exceeds/the/classic/ustar/one-hundred-byte/name/limit/for/sure/file.js";
+  const tarSource = path.join(tmp, "tar-source");
+  fs.mkdirSync(path.join(tarSource, path.dirname(longRel)), { recursive: true });
+  fs.writeFileSync(path.join(tarSource, longRel), "console.log('卡片 chart_spec');\n");
+  fs.writeFileSync(path.join(tarSource, "short.txt"), "hello\n");
+  const archive = path.join(tmp, "roundtrip.tar.gz");
+  await createTarGz(archive, {
+    entries: [
+      { file: path.join(tarSource, "short.txt"), tarPath: "short.txt" },
+      { file: path.join(tarSource, longRel), tarPath: longRel },
+    ],
+  });
+  const tarOut = path.join(tmp, "tar-out");
+  await extractTarGz(archive, tarOut);
+  check("tar: short file", fs.readFileSync(path.join(tarOut, "short.txt"), "utf8") === "hello\n");
+  check(
+    "tar: long path + utf8",
+    fs.readFileSync(path.join(tarOut, longRel), "utf8").includes("卡片 chart_spec"),
+  );
+  const traversal = path.join(tmp, "traversal.tar.gz");
+  await createTarGz(traversal, {
+    entries: [{ tarPath: "../escape.txt", content: "nope" }],
+  });
+  let traversalRejected = false;
+  try {
+    await extractTarGz(traversal, path.join(tmp, "traversal-out"));
+  } catch {
+    traversalRejected = true;
+  }
+  check("tar: path traversal rejected", traversalRejected);
+  const symlinkDir = path.join(tmp, "symlink-out");
+  fs.mkdirSync(symlinkDir, { recursive: true });
+  fs.symlinkSync(path.join(tmp, "outside.txt"), path.join(symlinkDir, "x.txt"));
+  const symlinkArchive = path.join(tmp, "symlink.tar.gz");
+  await createTarGz(symlinkArchive, {
+    entries: [{ tarPath: "x.txt", content: "oops" }],
+  });
+  let symlinkRejected = false;
+  try {
+    await extractTarGz(symlinkArchive, symlinkDir);
+  } catch {
+    symlinkRejected = true;
+  }
+  check("tar: symlink overwrite rejected", symlinkRejected);
+
+  // 2. Build a synthetic truth pack.
+  const fixture = await makeFixture();
+  const packDir = path.join(tmp, "pack");
+  const build = spawnSync(
+    process.execPath,
+    [
+      path.join(root, "bin", "larkit.js"),
+      "pack",
+      "build",
+      `--out=${packDir}`,
+    ],
+    {
+      cwd: root,
+      env: {
+        ...process.env,
+        LARKIT_DATA_DIR: fixture.dataDir,
+        LARKIT_VERIFIED_DIR: fixture.verifiedDir,
+        LARKIT_HOME: path.join(tmp, "builder-home"),
+      },
+      encoding: "utf8",
+    },
+  );
+  check("pack build exits 0", build.status === 0, build.stderr?.slice(-600));
+  check("pack manifest exists", fs.existsSync(path.join(packDir, "manifest.json")));
+
+  // 3. Init into a temp home.
+  const home = path.join(tmp, "home");
+  const userHome = path.join(tmp, "userhome");
+  fs.mkdirSync(userHome, { recursive: true });
+  const skillDir = path.join(userHome, ".agents", "skills", "larkit");
+  const env = {
+    HOME: userHome,
+    USERPROFILE: userHome,
+    LARKIT_HOME: home,
+    LARKIT_DATA_DIR: path.join(home, "data"),
+    LARKIT_VERIFIED_DIR: path.join(home, "verified_truths"),
+    LARKIT_BIN_DIR: path.join(home, "bin"),
+  };
+  const init = run(
+    ["init", `--pack=${packDir}`, "--no-cli", "--json"],
+    env,
+  );
+  check("init exits 0", init.status === 0, init.stderr?.slice(-1200));
+  check("init reports truth ready", init.json?.steps?.truth?.status === "ready", init.stdout);
+  check("truth.db installed", fs.existsSync(path.join(home, "data", "truth.db")));
+  check(
+    "verified truth seeded",
+    fs.existsSync(path.join(home, "verified_truths", "demo-truth.md")),
+  );
+  check("skill installed", fs.existsSync(path.join(skillDir, "SKILL.md")));
+  check("skill references installed", fs.existsSync(path.join(skillDir, "references", "playbooks.md")));
+  check("mcp config written", fs.existsSync(path.join(home, "mcp.json")));
+
+  // 4. Query through the installed home.
+  const search = run(["search", "chart_spec", "--scope=verified"], env);
+  check("search exits 0", search.status === 0, search.stderr?.slice(-600));
+  check("search hits seeded truth", (search.json?.results?.length || 0) > 0, search.stdout);
+
+  const status = run(["status", "--json"], env);
+  check("status exits 0", status.status === 0, status.stderr?.slice(-600));
+  check("status sees installed truth", status.json?.truth?.installed === true);
+  check("status sees skill", (status.json?.skills?.length || 0) === 1, status.stdout);
+
+  const slice = run(
+    ["inspect", "verified_truths/demo-truth.md", "5", "--max-lines=10"],
+    env,
+  );
+  check("inspect verified path", slice.status === 0 && slice.json?.lines?.length > 0, slice.stderr);
+
+  fs.rmSync(tmp, { recursive: true, force: true });
+} catch (error) {
+  failed++;
+  console.error(error);
+  try {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  } catch {
+    // ignore
+  }
+}
+
+console.log(failed ? `\n${failed} bootstrap check(s) failed` : "\nall bootstrap checks passed");
+process.exit(failed ? 1 : 0);

package/scripts/verify-console.mjs

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import "../src/shared/quiet.js";
+import process from "node:process";
+import { checkAuth } from "../src/auth/service.js";
+import {
+  enableBotWs,
+  getCredentials,
+  grantScopes,
+  listApps,
+  publishVersion,
+} from "../src/console/client.js";
+import { probeOpenApi } from "../src/probe/openapi.js";
+
+const profileArg = process.argv.find((arg) => arg.startsWith("--profile="));
+const profile = profileArg ? profileArg.slice(10) : "geren";
+
+const auth = await checkAuth({ profile });
+console.log("auth:", auth.ok, auth.profile, auth.user?.name || auth.hint || auth.error);
+if (!auth.ok) process.exit(1);
+
+const apps = await listApps({ profile, limit: 30 });
+console.log("apps:", apps.ok, apps.total);
+if (!apps.ok || !apps.apps.length) process.exit(1);
+
+const app =
+  apps.apps.find((item) => item.status === 2 && item.abilities?.includes("bot")) ||
+  apps.apps[0];
+console.log("selected app:", app.app_id, app.name, "status=" + app.status);
+
+const cred = await getCredentials({ appId: app.app_id, profile });
+console.log("credentials:", cred.ok, "secret_len=" + (cred.app_secret?.length || 0));
+if (!cred.ok) process.exit(1);
+
+const probe = await probeOpenApi({
+  appId: cred.app_id,
+  appSecret: cred.app_secret,
+  method: "GET",
+  path: "/im/v1/chats",
+  query: { page_size: 1 },
+});
+console.log("openapi probe:", probe.status, probe.code, probe.msg, probe.log_id || "");
+
+const wsPlan = await enableBotWs({ appId: app.app_id, profile, dryRun: true });
+console.log("bot ws dry-run:", wsPlan.ok, wsPlan.calls?.length || 0, "calls");
+
+const scopePlan = await grantScopes({
+  appId: app.app_id,
+  scopes: ["im:message"],
+  profile,
+  dryRun: true,
+});
+console.log(
+  "scope dry-run:",
+  scopePlan.ok,
+  "resolved=" + (scopePlan.plan?.resolved?.map((s) => s.name).join(",") || ""),
+  "missing=" + (scopePlan.plan?.missing?.join(",") || ""),
+);
+
+const publishPlan = await publishVersion({ appId: app.app_id, profile, dryRun: true });
+console.log("publish dry-run:", publishPlan.ok, publishPlan.plan?.steps?.length || 0, "steps");