larkway 0.3.7 → 0.3.9

package/dist/main.js

@@ -107360,7 +107360,6 @@ var require_main = __commonJS({
 });
 
 // src/main.ts
-import { execSync } from "node:child_process";
 import { mkdirSync } from "node:fs";
 import path13 from "node:path";
 
@@ -111527,20 +111526,6 @@ var ChatEntry = external_exports.object({
   purpose: external_exports.enum(["production", "test", "staging"]).default("production"),
   description: external_exports.string().optional()
 });
-var CentralConfig = external_exports.object({
-  /**
-   * Git URL or local path of the central config repo (where `bots/` lives).
-   * e.g. "git@gitlab.company.com:ops/larkway-bots.git" or a bare repo path.
-   */
-  repo: external_exports.string().min(1, "centralConfig.repo is required (git url or path)"),
-  /** Branch to track on the central repo. @default "main" */
-  branch: external_exports.string().min(1).default("main"),
-  /**
-   * Path INSIDE the central repo that holds the bot files (<id>.yaml +
-   * <id>.memory.md). @default "bots"
-   */
-  path: external_exports.string().min(1).default("bots")
-});
 var ConfigJson = external_exports.object({
   conventions: ConventionsConfig,
   permissions: PermissionsConfig,
@@ -111548,12 +111533,7 @@ var ConfigJson = external_exports.object({
    * List of allowed chats with labels. If empty/missing, bridge falls back
    * to the legacy `LARK_ALLOWED_CHAT_IDS` env var (deprecated).
    */
-  chats: external_exports.array(ChatEntry).default([]),
-  /**
-   * Central config repo (V2.2 §7 A.2). Optional — when present, `larkway sync`
-   * pulls bots/ from it. Absent = local self-management.
-   */
-  centralConfig: CentralConfig.optional()
+  chats: external_exports.array(ChatEntry).default([])
 });
 var DEFAULT_CONFIG_PATH = path2.join(larkwayHome(), "config.json");
 function getLanIp() {
@@ -111577,8 +111557,7 @@ function defaultConfigJson() {
       portRangeEnd: 3050
     },
     permissions: { allowExtra: [] },
-    chats: [],
-    centralConfig: void 0
+    chats: []
   };
 }
 async function loadConfigJson(configPath = DEFAULT_CONFIG_PATH) {
@@ -112549,9 +112528,11 @@ ${recent.join("\n")}` : recent.join("\n");
     });
     elements.push({ tag: "hr" });
   }
+  const mentionPrefix = atMentionMarkdown(opts.mentionOpenId);
   const cleanBody = opts.bodyText ? stripLeakedToolMarkup(opts.bodyText) : "";
-  if (cleanBody) {
-    const chunks = chunkMarkdown(cleanBody);
+  const bodyWithMention = [mentionPrefix, cleanBody].filter(Boolean).join("\n\n");
+  if (bodyWithMention) {
+    const chunks = chunkMarkdown(bodyWithMention);
     for (let i = 0; i < chunks.length; i++) {
       elements.push({
         tag: "markdown",
@@ -112593,6 +112574,11 @@ ${chunks[i]}`
   };
   return JSON.stringify(card);
 }
+function atMentionMarkdown(userId) {
+  if (!userId) return "";
+  if (!/^[A-Za-z0-9_:-]+$/.test(userId)) return "";
+  return `<at id=${userId}></at>`;
+}
 var CardHandleImpl = class {
   messageId;
   /** Transport for the leaf PATCH network call (default = lark-cli). */
@@ -112644,6 +112630,7 @@ var CardHandleImpl = class {
       showToolSummary: this.showToolSummary,
       status: cardStatus,
       failureReason: opts.failureReason,
+      mentionOpenId: opts.mentionOpenId,
       // V2 dynamic-choice buttons — agent-declared, only on finalize.
       choices: opts.choices,
       choicePrompt: opts.choicePrompt,
@@ -113373,6 +113360,33 @@ function renderTurnTakingHint(limit) {
     "</turn-taking>"
   ];
 }
+function renderRuntimeWarningsBlock(warnings) {
+  if (warnings.length === 0) return [];
+  const hasMissingLarkCli = warnings.some((warning) => warning.command === "lark-cli");
+  return [
+    "<runtime-warnings>",
+    "Bridge \u68C0\u6D4B\u5230\u4EE5\u4E0B\u672C\u673A\u80FD\u529B\u6682\u4E0D\u53EF\u7528\u3002\u8FD9\u662F\u63D0\u793A,\u4E0D\u662F\u5F3A\u5236\u505C\u6B62\u6761\u4EF6:",
+    ...warnings.map((warning) => {
+      const name = warning.command ? `${warning.label} (${warning.command})` : warning.label;
+      const reason = warning.reason ? `: ${warning.reason}` : "";
+      const installHint = warning.installHint ? ` Fix hint: ${warning.installHint}` : "";
+      return `- ${name}${reason}${installHint}`;
+    }),
+    "",
+    "\u5904\u7406\u539F\u5219:",
+    "- \u80FD\u4EC5\u51ED\u5F53\u524D\u6D88\u606F\u7EE7\u7EED\u7684\u4EFB\u52A1,\u7EE7\u7EED\u5904\u7406,\u4E0D\u8981\u56E0\u4E3A warning \u76F4\u63A5\u62D2\u7EDD\u3002",
+    "- \u53EA\u6709\u5F53\u4EFB\u52A1\u786E\u5B9E\u9700\u8981\u7F3A\u5931\u80FD\u529B\u65F6,\u518D\u5728 last_message \u91CC\u7528\u4EA7\u54C1\u5316\u8BED\u8A00\u544A\u8BC9\u7528\u6237\u7F3A\u4EC0\u4E48\u3001\u4F1A\u5F71\u54CD\u4EC0\u4E48\u3001\u5982\u4F55\u7EE7\u7EED\u3002",
+    ...hasMissingLarkCli ? [
+      "- \u5BF9\u7F3A\u5C11 lark-cli \u7684\u60C5\u51B5:\u4E0D\u8981\u989D\u5916 @ \u7528\u6237;\u5728\u5361\u7247\u91CC\u8F7B\u91CF\u8BF4\u660E\u5F53\u524D\u65E0\u6CD5\u81EA\u52A8\u8BFB\u53D6\u98DE\u4E66\u8BDD\u9898\u5386\u53F2\u3001\u9644\u4EF6\u6216\u6587\u6863\u5373\u53EF\u3002",
+      '- \u5982\u679C\u5F53\u524D\u4EFB\u52A1\u9700\u8981\u8FD9\u4E9B\u4E0A\u4E0B\u6587,\u7528 choices \u95EE\u662F\u5426\u5141\u8BB8\u5B89\u88C5\u6700\u65B0\u7248\u98DE\u4E66 CLI\u3002\u5EFA\u8BAE: `choice_prompt: "\u8BFB\u53D6\u98DE\u4E66\u5386\u53F2\u9700\u8981\u672C\u673A\u5B89\u88C5\u6700\u65B0\u7248\u98DE\u4E66 CLI,\u662F\u5426\u5141\u8BB8\u6211\u5C1D\u8BD5\u5B89\u88C5?"`, `choices: [{label:"\u5141\u8BB8\u5B89\u88C5", value:"\u5141\u8BB8\u5B89\u88C5 lark-cli"}, {label:"\u5148\u4E0D\u5B89\u88C5", value:"\u5148\u4E0D\u5B89\u88C5 lark-cli,\u6211\u4F1A\u628A\u8981\u5904\u7406\u7684\u5185\u5BB9\u8D34\u5230\u8BDD\u9898\u91CC"}]`\u3002',
+      "- \u7528\u6237\u660E\u786E\u9009\u62E9/\u56DE\u590D\u5141\u8BB8\u5B89\u88C5\u540E,\u518D\u5C1D\u8BD5\u5B89\u88C5;\u4E0D\u8981\u5728\u672A\u786E\u8BA4\u524D\u6539\u5BBF\u4E3B\u673A\u5168\u5C40\u73AF\u5883\u3002",
+      "- \u63A8\u8350\u5B89\u88C5\u547D\u4EE4: `npx -y @larksuite/cli@latest install`,\u7136\u540E\u8FD0\u884C `lark-cli --version` \u9A8C\u8BC1\u3002",
+      '- \u5982\u9047 npm \u5168\u5C40\u76EE\u5F55\u6743\u9650\u9519\u8BEF(EACCES/permission denied),\u4F7F\u7528\u7528\u6237\u7EA7 prefix \u540E\u91CD\u8BD5: `mkdir -p ~/.npm-global && npm config set prefix "$HOME/.npm-global" && export PATH="$HOME/.npm-global/bin:$PATH" && npx -y @larksuite/cli@latest install`\u3002\u4E0D\u8981\u9ED8\u8BA4\u8981\u6C42 sudo\u3002',
+      "- \u5B89\u88C5\u6210\u529F\u540E,\u5982\u679C\u672C\u8F6E\u9700\u8981\u7ACB\u5373\u8BFB\u53D6\u98DE\u4E66\u4E0A\u4E0B\u6587,\u53EF\u5728\u5F53\u524D shell \u4E2D\u5E26\u4E0A\u4FEE\u590D\u540E\u7684 PATH \u7EE7\u7EED\u5C1D\u8BD5;\u82E5\u9700\u8981 bridge \u540E\u7EED\u8F6E\u6B21\u7A33\u5B9A\u4F7F\u7528,\u8BF7\u63D0\u793A owner \u91CD\u542F Larkway\u3002"
+    ] : [],
+    "</runtime-warnings>"
+  ];
+}
 function renderWorkspaceBlock(primarySlug, primaryCachePath, defaultBranch, extraRepos) {
   const lines = [
     "<workspace>",
@@ -113443,7 +113457,17 @@ function sceneFacts(parsed, isNewThread) {
   };
 }
 function renderPrompt(input) {
-  const { parsed, isNewThread, conventions, peers, turn_taking_limit, agentMemory, extraRepoPaths, larkCliProfile } = input;
+  const {
+    parsed,
+    isNewThread,
+    conventions,
+    peers,
+    turn_taking_limit,
+    agentMemory,
+    extraRepoPaths,
+    larkCliProfile,
+    runtimeWarnings = []
+  } = input;
   const backend = input.backend ?? "claude";
   const profileFlag = larkCliProfile ? ` --profile ${larkCliProfile}` : "";
   const attachmentKeys = parsed.attachments.map((a) => a.fileKey);
@@ -113456,6 +113480,7 @@ function renderPrompt(input) {
   const stateContract = renderStateContract(conventions.stateFilePath);
   const peersBlock = peers && peers.length > 0 ? renderPeersBlock(peers) : [];
   const turnTakingBlock = turn_taking_limit && turn_taking_limit > 0 ? renderTurnTakingHint(turn_taking_limit) : [];
+  const runtimeWarningsBlock = renderRuntimeWarningsBlock(runtimeWarnings);
   const extraRepos = extraRepoPaths ?? conventions.extraRepoPaths ?? [];
   const workspaceBlock = isAgentWorkspace ? renderAgentWorkspaceBlock(conventions, extraRepos) : hasRepo ? renderWorkspaceBlock(
     conventions.defaultProjectSlug ?? "repo",
@@ -113511,6 +113536,7 @@ function renderPrompt(input) {
       "",
       ...agentMemoryBlock,
       ...skillIntroNew,
+      ...runtimeWarningsBlock.length > 0 ? [...runtimeWarningsBlock, ""] : [],
       "<thread-context>",
       `thread_id:        ${parsed.threadId}`,
       `message_id:       ${parsed.messageId}`,
@@ -113555,7 +113581,7 @@ function renderPrompt(input) {
       `    lark-cli docs +get <doc-url>${profileFlag}`,
       "- \u53D6\u672C\u6761\u6D88\u606F\u7684\u9644\u4EF6/\u5185\u8054\u56FE(post \u5185\u8054\u56FE\u4E0D\u5728\u4E0A\u9762 attachments/images \u91CC)\u3001\u62C9\u8BDD\u9898\u5386\u53F2:",
       attachmentHelpLine,
-      "- glab / git / gitlab API",
+      "- glab / gh / git API",
       "- pnpm / npm",
       "",
       "**\u91CD\u8981**:`thread_id` \u5C31\u662F\u8BDD\u9898\u9996\u697C\u7684 message_id\u3002\u5982\u679C\u5F53\u524D\u6D88\u606F attachments/feishu_doc_links \u4E3A\u7A7A,\u8BF4\u660E\u8FD0\u8425\u628A\u7D20\u6750\u653E\u5728\u9996\u697C,**\u5148\u62C9\u9996\u697C\u770B\u8FD0\u8425\u539F\u59CB\u9700\u6C42**,\u518D\u51B3\u5B9A\u4E0B\u4E00\u6B65\u3002",
@@ -113578,6 +113604,7 @@ function renderPrompt(input) {
   return [
     ...agentMemoryBlock,
     ...skillIntroCont,
+    ...runtimeWarningsBlock.length > 0 ? [...runtimeWarningsBlock, ""] : [],
     "<thread-context>",
     `thread_id:        ${parsed.threadId}`,
     `message_id:       ${parsed.messageId}`,
@@ -113850,7 +113877,7 @@ function renderPermissionsRequest(input) {
     "## Repo Pointers",
     "",
     ...repoLines,
-    input.bot.gitlab_token_env ? `- GitLab token env name available after human setup: ${input.bot.gitlab_token_env}` : "- GitLab token env name: pending human confirmation",
+    input.bot.gitlab_token_env ? `- Git token env name available after human setup: ${input.bot.gitlab_token_env}` : "- Git token env name: pending human confirmation",
     "",
     "## Human Gate",
     "",
@@ -113876,11 +113903,11 @@ function defaultWorkspacePermissionItems(input) {
   }
   if (input.repos && input.repos.length > 0) {
     for (const repo of input.repos) {
-      capabilities.push(`GitLab repo pointer: ${repo.slug} (${repo.branch ?? "master"})`);
+      capabilities.push(`Git repo pointer: ${repo.slug} (${repo.branch ?? "master"})`);
     }
   }
   if (input.bot.gitlab_token_env) {
-    capabilities.push(`GitLab token env name: ${input.bot.gitlab_token_env}`);
+    capabilities.push(`Git token env name: ${input.bot.gitlab_token_env}`);
   }
   capabilities.push("Local shell inside the Agent Workspace for task execution and verification");
   return permissionItemsFromCapabilities(capabilities);
@@ -113936,10 +113963,10 @@ function renderDefaultPermissionGrantLines(input) {
     lines.push(`- type=read Feishu chat allowlist: ${chats.join(", ")} source=saved-agent-config`);
   }
   for (const repo of input.repos ?? []) {
-    lines.push(`- type=read GitLab repo pointer: ${repo.slug} (${repo.branch ?? "master"}) source=saved-agent-config`);
+    lines.push(`- type=read Git repo pointer: ${repo.slug} (${repo.branch ?? "master"}) source=saved-agent-config`);
   }
   if (input.bot.gitlab_token_env) {
-    lines.push(`- type=write GitLab write/MR env=${input.bot.gitlab_token_env} source=saved-agent-config`);
+    lines.push(`- type=write Git write/MR env=${input.bot.gitlab_token_env} source=saved-agent-config`);
   }
   const humanGates = input.humanGates && input.humanGates.length > 0 ? input.humanGates : ["Deploy/restart and production-impact actions require explicit human confirmation."];
   for (const gate of humanGates) {
@@ -114461,6 +114488,11 @@ var BridgeHandler = class {
   constructor(deps) {
     this.deps = deps;
   }
+  runtimeWarnings() {
+    return (this.deps.runtimeRequirements ?? []).filter(
+      (req) => !req.ok && (req.severity === "required" || req.kind === "secret")
+    );
+  }
   /**
    * Enter the main loop: for-await over client.events(), per-thread concurrent dispatch.
    *
@@ -114596,7 +114628,7 @@ var BridgeHandler = class {
           bot: {
             name: this.deps.botConfig?.name ?? "Larkway Agent",
             description: this.deps.botConfig?.description ?? "Local agent served through Larkway.",
-            gitlab_token_env: this.deps.botConfig?.gitlab_token_env
+            gitlab_token_env: this.deps.botConfig?.git_token_env ?? this.deps.botConfig?.gitlab_token_env
           },
           agentMemory: this.deps.agentMemory,
           repos: [
@@ -114762,7 +114794,8 @@ var BridgeHandler = class {
           botName: this.deps.botConfig?.name,
           backend: this.deps.botConfig?.backend,
           agentMemory: this.deps.agentMemory,
-          larkCliProfile: this.deps.larkCliProfile
+          larkCliProfile: this.deps.larkCliProfile,
+          runtimeWarnings: this.runtimeWarnings()
         });
         const backend = this.deps.botConfig?.backend ?? "claude";
         const permissionMode = this.deps.permissionMode ?? (isAgentWorkspace ? "acceptEdits" : "bypassPermissions");
@@ -117872,6 +117905,14 @@ var GitIdentitySchema = external_exports.object({
   name: external_exports.string().min(1),
   email: external_exports.string().email()
 });
+var GitCloneUrlSchema = external_exports.string().min(1).refine(
+  (value) => {
+    if (/^https?:\/\/\S+$/i.test(value)) return true;
+    if (/^ssh:\/\/\S+$/i.test(value)) return true;
+    return /^[A-Za-z0-9_.-]+@[^:\s]+:[^ \t\r\n]+$/.test(value);
+  },
+  "url must be an http(s), ssh://, or scp-like Git clone URL"
+);
 var BotConfigSchema = external_exports.object({
   /** Unique identifier, kebab-case. Used as key in sessionStore. */
   id: external_exports.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "id must be kebab-case"),
@@ -117946,7 +117987,7 @@ var BotConfigSchema = external_exports.object({
        * Agent workspace runtime: URL is a pointer only; the Agent decides clone
        * timing and destination.
        */
-      url: external_exports.string().url().optional()
+      url: GitCloneUrlSchema.optional()
     })
   ).default([]),
   /**
@@ -117977,13 +118018,23 @@ var BotConfigSchema = external_exports.object({
    */
   lark_cli_profile: external_exports.string().min(1).optional(),
   /**
-   * Env-var *name* (not value) that holds this bot's GitLab PAT.
+   * Env-var *name* (not value) that holds this bot's Git PAT.
    * Read from process.env at startup and injected as GITLAB_TOKEN into the
-   * claude subprocess env, so MRs/git ops use the bot's own GitLab account.
-   * When absent, the claude subprocess inherits process.env.GITLAB_TOKEN
+   * agent subprocess env, so MRs/git ops use the bot's own account.
+   * When absent, the subprocess inherits process.env.GITLAB_TOKEN
    * (V1 single-bot behavior — one global token).
+   *
+   * Preferred field name; `gitlab_token_env` below is the backward-compat alias.
+   */
+  git_token_env: external_exports.string().min(1).optional(),
+  // preferred: generic git PAT env-var name
+  /**
+   * @deprecated Backward-compat alias for `git_token_env`. If both are present,
+   * main.ts prefers `git_token_env`. Old bot yamls with this field continue to
+   * work without changes.
    */
   gitlab_token_env: external_exports.string().min(1).optional(),
+  // compat alias (legacy)
   /**
    * L2 Agent Memory (职能定义) — filename relative to the bots/ directory,
    * pointing at this bot's `*.memory.md`. Loaded at startup and injected into
@@ -118294,12 +118345,12 @@ var SIGKILL_GRACE_MS = 5e3;
 function buildEnv(botGitIdentity, gitlabToken) {
   const env = { ...process.env };
   delete env["ANTHROPIC_API_KEY"];
-  const name = botGitIdentity?.name ?? "larkway-bot";
-  const email = botGitIdentity?.email ?? "bot@larkway.local";
-  env["GIT_AUTHOR_NAME"] = name;
-  env["GIT_AUTHOR_EMAIL"] = email;
-  env["GIT_COMMITTER_NAME"] = name;
-  env["GIT_COMMITTER_EMAIL"] = email;
+  if (botGitIdentity) {
+    env["GIT_AUTHOR_NAME"] = botGitIdentity.name;
+    env["GIT_AUTHOR_EMAIL"] = botGitIdentity.email;
+    env["GIT_COMMITTER_NAME"] = botGitIdentity.name;
+    env["GIT_COMMITTER_EMAIL"] = botGitIdentity.email;
+  }
   if (gitlabToken !== void 0) {
     env["GITLAB_TOKEN"] = gitlabToken;
   }
@@ -118608,12 +118659,12 @@ function buildCodexEnv(botGitIdentity, gitlabToken) {
   const env = { ...process.env };
   delete env["OPENAI_API_KEY"];
   delete env["ANTHROPIC_API_KEY"];
-  const name = botGitIdentity?.name ?? "larkway-bot";
-  const email = botGitIdentity?.email ?? "bot@larkway.local";
-  env["GIT_AUTHOR_NAME"] = name;
-  env["GIT_AUTHOR_EMAIL"] = email;
-  env["GIT_COMMITTER_NAME"] = name;
-  env["GIT_COMMITTER_EMAIL"] = email;
+  if (botGitIdentity) {
+    env["GIT_AUTHOR_NAME"] = botGitIdentity.name;
+    env["GIT_AUTHOR_EMAIL"] = botGitIdentity.email;
+    env["GIT_COMMITTER_NAME"] = botGitIdentity.name;
+    env["GIT_COMMITTER_EMAIL"] = botGitIdentity.email;
+  }
   if (gitlabToken !== void 0) {
     env["GITLAB_TOKEN"] = gitlabToken;
   }
@@ -118999,33 +119050,144 @@ function checkGrantMatchesBot(normalizedGrantText, bot) {
   return { ok: true };
 }
 
-// src/main.ts
-var STATUS_WRITE_INTERVAL_MS = 3e4;
-var VERSION = resolveLarkwayVersion(import.meta.url);
-function checkCli(name) {
+// src/runtimeRequirements.ts
+import { execFileSync } from "node:child_process";
+function checkCli(command) {
+  try {
+    execFileSync("which", [command], { stdio: ["pipe", "pipe", "pipe"] });
+  } catch {
+    return { ok: false };
+  }
   try {
-    const p = execSync(`which ${name}`, { stdio: ["pipe", "pipe", "pipe"] }).toString().trim();
-    if (!p) return { ok: false, version: "" };
-    const version = execSync(`${name} --version`, {
-      stdio: ["pipe", "pipe", "pipe"]
-    }).toString().trim().split("\n")[0] ?? "";
-    return { ok: true, version };
+    const version = execFileSync(command, ["--version"], { stdio: ["pipe", "pipe", "pipe"] }).toString().trim().split("\n")[0];
+    return { ok: true, ...version ? { version } : {} };
   } catch {
-    return { ok: false, version: "" };
+    return { ok: true };
   }
 }
-function externalClisForBots(bots) {
-  const backendBins = bots.map((bot) => bot.backend ?? "claude");
-  return Array.from(/* @__PURE__ */ new Set(["lark-cli", ...backendBins, "glab"]));
+function repoLooksGitLab(urlOrSlug) {
+  return /(^|[./:@-])gitlab([./:@-]|$)/i.test(urlOrSlug);
 }
+function botUsesGitLab(bot) {
+  return bot.repos.some((repo) => repoLooksGitLab(repo.url ?? repo.slug));
+}
+function addCliRequirement(requirements, input) {
+  const existing = requirements.get(`cli:${input.command}`);
+  if (existing) {
+    existing.botIds = Array.from(/* @__PURE__ */ new Set([...existing.botIds, ...input.botIds])).sort();
+    if (existing.severity === "optional" && input.severity === "required") {
+      existing.severity = "required";
+    }
+    return;
+  }
+  const probe = checkCli(input.command);
+  requirements.set(`cli:${input.command}`, {
+    id: `cli:${input.command}`,
+    label: input.label ?? input.command,
+    command: input.command,
+    kind: "cli",
+    severity: input.severity,
+    ok: probe.ok,
+    ...probe.version ? { version: probe.version } : {},
+    reason: input.reason,
+    ...input.installHint ? { installHint: input.installHint } : {},
+    botIds: Array.from(new Set(input.botIds)).sort()
+  });
+}
+function addSecretRequirement(requirements, input) {
+  const id = `secret:${input.envName}`;
+  const existing = requirements.get(id);
+  if (existing) {
+    existing.botIds = Array.from(/* @__PURE__ */ new Set([...existing.botIds, ...input.botIds])).sort();
+    return;
+  }
+  const value = process.env[input.envName];
+  requirements.set(id, {
+    id,
+    label: input.envName,
+    kind: "secret",
+    severity: input.severity ?? "required",
+    ok: value != null && value !== "",
+    reason: input.reason,
+    installHint: `Set ${input.envName} in ~/.larkway/.env and restart Larkway.`,
+    botIds: Array.from(new Set(input.botIds)).sort()
+  });
+}
+function runtimeRequirementsForBots(bots) {
+  const requirements = /* @__PURE__ */ new Map();
+  if (bots.length > 0) {
+    addCliRequirement(requirements, {
+      command: "lark-cli",
+      label: "Feishu CLI",
+      severity: "required",
+      botIds: bots.map((bot) => bot.id),
+      reason: "Required for agents to read Feishu topic history, attachments, docs, and other context.",
+      installHint: "Install and configure lark-cli, then restart Larkway."
+    });
+  }
+  for (const bot of bots) {
+    addCliRequirement(requirements, {
+      command: bot.backend ?? "claude",
+      severity: "required",
+      botIds: [bot.id],
+      reason: `Required to run this bot's ${bot.backend ?? "claude"} backend.`
+    });
+    if (bot.runtime === "agent_workspace" && bot.repos.length > 0) {
+      const tokenEnvName = bot.git_token_env ?? bot.gitlab_token_env;
+      if (tokenEnvName) {
+        addSecretRequirement(requirements, {
+          envName: tokenEnvName,
+          botIds: [bot.id],
+          severity: "optional",
+          reason: "Optional Git identity material. When absent, agents use the host's normal Git auth."
+        });
+      } else {
+        requirements.set(`secret:missing-git-token:${bot.id}`, {
+          id: `secret:missing-git-token:${bot.id}`,
+          label: "Git access token env",
+          kind: "secret",
+          severity: "optional",
+          ok: false,
+          reason: `Bot "${bot.id}" has repo pointers but no git_token_env. It will use the host's normal Git auth.`,
+          installHint: "Add a Git access token only when you want this agent to use a specific GitHub/GitLab identity.",
+          botIds: [bot.id]
+        });
+      }
+    }
+    if (botUsesGitLab(bot)) {
+      addCliRequirement(requirements, {
+        command: "glab",
+        label: "GitLab CLI",
+        severity: "optional",
+        botIds: [bot.id],
+        reason: "Only needed when an agent uses GitLab-specific actions such as MRs, pipelines, or releases.",
+        installHint: "Install glab only for bots that need GitLab-specific workflow commands."
+      });
+    }
+  }
+  return [...requirements.values()].sort((a, b) => {
+    if (a.severity !== b.severity) return a.severity === "required" ? -1 : 1;
+    if (a.kind !== b.kind) return a.kind === "cli" ? -1 : 1;
+    return a.label.localeCompare(b.label);
+  });
+}
+
+// src/main.ts
+var STATUS_WRITE_INTERVAL_MS = 3e4;
+var VERSION = resolveLarkwayVersion(import.meta.url);
 function printExternalCliProbe(bots) {
-  console.log("External CLIs:");
-  for (const name of externalClisForBots(bots)) {
-    const { ok, version } = checkCli(name);
-    if (ok) {
-      console.log(`  ${name.padEnd(10)}  \u2713  ${version}`);
+  console.log("Runtime requirements:");
+  for (const req of runtimeRequirementsForBots(bots)) {
+    const icon = req.ok ? "\u2713" : "\u2717";
+    const tag = req.severity === "optional" ? "optional" : "required";
+    const target = req.command ?? req.label;
+    const botScope = req.botIds.length > 0 ? ` [${req.botIds.join(", ")}]` : "";
+    if (req.ok) {
+      console.log(`  ${target.padEnd(14)} ${icon}  ${req.version ?? tag}${botScope}`);
     } else {
-      console.warn(`  ${name.padEnd(10)}  \u2717  (not found \u2014 install before running bots that use it)`);
+      const message = req.kind === "secret" ? req.reason : `not found \u2014 ${req.reason}`;
+      console.warn(`  ${target.padEnd(14)} ${icon}  (${tag}) ${message}${botScope}`);
+      if (req.installHint) console.warn(`  ${"".padEnd(14)}    ${req.installHint}`);
     }
   }
 }
@@ -119057,19 +119219,18 @@ async function runV2Mode({
       continue;
     }
     if (bot.runtime === "agent_workspace") {
-      if (bot.repos.length > 0 && !bot.gitlab_token_env) {
-        console.error(
-          `[larkway] SKIPPING bot "${bot.id}": runtime=agent_workspace has repo pointers but no gitlab_token_env. v0.3 workspace repo bots must reference an explicit per-agent token env name; they do not inherit global GITLAB_TOKEN.`
+      const _agentTokenEnvName = bot.git_token_env ?? bot.gitlab_token_env;
+      if (bot.repos.length > 0 && !_agentTokenEnvName) {
+        console.warn(
+          `[larkway] bot "${bot.id}": runtime=agent_workspace has repo pointers but no git_token_env. Starting anyway; the agent will use the host's normal Git identity/auth.`
         );
-        continue;
       }
-      if (bot.gitlab_token_env) {
-        const gitlabToken = process.env[bot.gitlab_token_env];
-        if (gitlabToken == null || gitlabToken === "") {
-          console.error(
-            `[larkway] SKIPPING bot "${bot.id}": runtime=agent_workspace declares gitlab_token_env="${bot.gitlab_token_env}", but that env var is unset/empty. Set the real token in ~/.larkway/.env; v0.3 workspace bots do not fall back to global GITLAB_TOKEN.`
+      if (_agentTokenEnvName) {
+        const agentToken = process.env[_agentTokenEnvName];
+        if (agentToken == null || agentToken === "") {
+          console.warn(
+            `[larkway] bot "${bot.id}": runtime=agent_workspace declares token env "${_agentTokenEnvName}", but that env var is unset/empty. Starting anyway; the agent will use the host's normal Git identity/auth.`
           );
-          continue;
         }
       }
       const permissionGate = await checkWorkspacePermissionGrant(resolveAgentWorkspacePath(bot.id), bot);
@@ -119096,10 +119257,11 @@ async function runV2Mode({
   const instances = [];
   for (const bot of healthyBots) {
     const appSecret = process.env[bot.app_secret_env];
-    const gitlabToken = bot.gitlab_token_env != null ? process.env[bot.gitlab_token_env] : void 0;
-    if (bot.gitlab_token_env != null && (gitlabToken == null || gitlabToken === "")) {
+    const tokenEnvName = bot.git_token_env ?? bot.gitlab_token_env;
+    const gitlabToken = tokenEnvName != null ? process.env[tokenEnvName] : void 0;
+    if (tokenEnvName != null && (gitlabToken == null || gitlabToken === "")) {
       console.warn(
-        `[larkway] bot "${bot.id}" declares gitlab_token_env="${bot.gitlab_token_env}" but that env var is unset/empty \u2014 falling back to global GITLAB_TOKEN.`
+        `[larkway] bot "${bot.id}" declares token env "${tokenEnvName}" but that env var is unset/empty \u2014 leaving the host Git auth environment unchanged.`
       );
     }
     const larkCliProfile = deriveLarkCliProfile(bot.lark_cli_profile, bot.app_id);
@@ -119168,9 +119330,9 @@ async function runV2Mode({
       portRangeStart: configJson.conventions.portRangeStart,
       portRangeEnd: configJson.conventions.portRangeEnd,
       readOnly: bot.read_only,
-      gitlabTokenEnvName: bot.gitlab_token_env
+      gitlabTokenEnvName: tokenEnvName
     };
-    const effectiveGitlabToken = bot.runtime === "agent_workspace" ? gitlabToken ?? "" : gitlabToken;
+    const effectiveGitlabToken = gitlabToken;
     const resolvedPeers = bot.peers.flatMap((peerId) => {
       const peer = bots.find((b) => b.id === peerId);
       if (!peer) return [];
@@ -119191,11 +119353,13 @@ async function runV2Mode({
         git_identity: bot.git_identity,
         backend: bot.backend,
         runtime: bot.runtime,
+        git_token_env: bot.git_token_env,
         gitlab_token_env: bot.gitlab_token_env
       },
       gitlabToken: effectiveGitlabToken,
       agentMemory: bot.agent_memory,
       larkCliProfile,
+      runtimeRequirements: runtimeRequirementsForBots([bot]),
       recordRuntimeEvent: async (patch) => {
         await upsertRuntimeEvent(larkwayHome(), bot.id, patch);
       }