metame-cli 1.4.15 → 1.4.18

package/scripts/daemon-command-router.js

@@ -53,6 +53,82 @@ function createCommandRouter(deps) {
     return true;
   }
 
+  const pendingMacConfirmations = new Map();
+  const MAC_CONFIRM_TTL_MS = 2 * 60 * 1000;
+
+  function setPendingMacConfirmation(chatId, payload) {
+    pendingMacConfirmations.set(String(chatId), { ...payload, createdAt: Date.now() });
+  }
+
+  function getPendingMacConfirmation(chatId) {
+    const key = String(chatId);
+    const pending = pendingMacConfirmations.get(key);
+    if (!pending) return null;
+    if ((Date.now() - Number(pending.createdAt || 0)) > MAC_CONFIRM_TTL_MS) {
+      pendingMacConfirmations.delete(key);
+      return null;
+    }
+    return pending;
+  }
+
+  function clearPendingMacConfirmation(chatId) {
+    pendingMacConfirmations.delete(String(chatId));
+  }
+
+  function isAffirmativeConfirmation(input) {
+    return /^(确认|确认执行|执行|继续|好|好的|可以|同意|yes|y|ok|okay)$/i.test(String(input || '').trim());
+  }
+
+  function isNegativeConfirmation(input) {
+    return /^(取消|不执行|不用了|算了|停止|否|no|n)$/i.test(String(input || '').trim());
+  }
+
+  function isReadOnlyMacNaturalLanguageCommand(command) {
+    const normalized = String(command || '').trim().toLowerCase();
+    return normalized === '/mac check' || normalized === '/mac perms';
+  }
+
+  async function requestMacSideEffectConfirmation(bot, chatId, originalText, syntheticCommand, sourceTag) {
+    const label = String(originalText || '').trim().slice(0, 160);
+    setPendingMacConfirmation(chatId, { originalText: label, syntheticCommand, sourceTag });
+    await bot.sendMessage(chatId, [
+      '⚠️ 检测到可能有副作用的 macOS 操作，已暂停自动执行。',
+      `来源: ${sourceTag}`,
+      `原始请求: ${label || '(empty)'}`,
+      `拟执行命令: ${syntheticCommand}`,
+      '回复“确认”执行，回复“取消”放弃（120 秒内有效）。',
+    ].join('\n'));
+  }
+
+  async function tryResolvePendingMacConfirmation(bot, chatId, text, config, executeTaskByName) {
+    const pending = getPendingMacConfirmation(chatId);
+    if (!pending) return false;
+
+    const trimmed = String(text || '').trim();
+    if (isNegativeConfirmation(trimmed)) {
+      clearPendingMacConfirmation(chatId);
+      await bot.sendMessage(chatId, '✅ 已取消该 macOS 操作。');
+      return true;
+    }
+
+    if (isAffirmativeConfirmation(trimmed)) {
+      clearPendingMacConfirmation(chatId);
+      log('WARN', `Mac side-effect confirmed [${String(chatId).slice(-8)}] (${pending.sourceTag})`);
+      return handleExecCommand({
+        bot,
+        chatId,
+        text: pending.syntheticCommand,
+        config,
+        executeTaskByName,
+        nlIntentText: pending.originalText,
+      });
+    }
+
+    // Any unrelated message cancels stale pending intent to avoid context stickiness.
+    clearPendingMacConfirmation(chatId);
+    return false;
+  }
+
   function extractQuotedContent(input) {
     const m = String(input || '').match(/[“"'「](.+?)[”"'」]/);
     return m ? m[1].trim() : '';
@@ -119,6 +195,16 @@ function createCommandRouter(deps) {
     return fallbackName || 'workspace-agent';
   }
 
+  function projectKeyFromVirtualChatId(chatId) {
+    const v = String(chatId || '');
+    if (v.startsWith('_agent_')) return v.slice(7) || null;
+    if (v.startsWith('_scope_')) {
+      const idx = v.lastIndexOf('__');
+      if (idx > 7 && idx + 2 < v.length) return v.slice(idx + 2);
+    }
+    return null;
+  }
+
   function getBoundProjectForChat(chatId, cfg) {
     const map = {
       ...(cfg.telegram ? cfg.telegram.chat_agent_map : {}),
@@ -129,6 +215,132 @@ function createCommandRouter(deps) {
     return { key: key || null, project: proj || null };
   }
 
+  function escapeAppleScriptString(input) {
+    return String(input || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+  }
+
+  function resolveAppNameFromNaturalLanguage(rawName) {
+    if (!rawName) return null;
+    const aliasMap = {
+      '微信': 'WeChat',
+      'wechat': 'WeChat',
+      '飞书': 'Feishu',
+      'feishu': 'Feishu',
+      'finder': 'Finder',
+      '访达': 'Finder',
+      'safari': 'Safari',
+      'chrome': 'Google Chrome',
+      '谷歌浏览器': 'Google Chrome',
+      'calendar': 'Calendar',
+      '日历': 'Calendar',
+      'mail': 'Mail',
+      '邮件': 'Mail',
+      'notes': 'Notes',
+      '备忘录': 'Notes',
+      'terminal': 'Terminal',
+      'iterm': 'iTerm',
+      'iterm2': 'iTerm',
+      'system settings': 'System Settings',
+      '系统设置': 'System Settings',
+    };
+    let name = String(rawName).trim();
+    name = name.replace(/[。！？!?，,;；:：]+$/g, '').trim();
+    if (!name) return null;
+    const key = name.toLowerCase();
+    if (aliasMap[key]) return aliasMap[key];
+    if (aliasMap[name]) return aliasMap[name];
+    if (!/^[a-zA-Z0-9_\u4e00-\u9fa5 .()\-]{1,64}$/.test(name)) return null;
+    return name;
+  }
+
+  function deriveMacNaturalLanguageCommand(input) {
+    const text = String(input || '').trim();
+    if (!text) return null;
+
+    // Priority 1: explicit permission/setup intents
+    if (/(打开|进入).*(权限|隐私).*设置/.test(text) || /(权限|隐私).*(设置|页面).*(打开|进入)/.test(text)) {
+      return '/mac perms open';
+    }
+    if (/(检查|检测|体检).*(mac|权限|自动化|脚本)/i.test(text) || /(mac|权限|自动化).*(检查|检测|体检)/i.test(text)) {
+      return '/mac check';
+    }
+    if (/(权限|授权).*(怎么|如何|开启|打开|配置)/.test(text)) {
+      return '/mac perms';
+    }
+
+    // Priority 2: volume / mute
+    if (/(取消静音|解除静音|恢复声音|unmute)/i.test(text)) {
+      return '/mac osa set volume without output muted';
+    }
+    if (/(静音|mute)/i.test(text)) {
+      return '/mac osa set volume with output muted';
+    }
+    const volMatch = text.match(/(?:音量|volume)[^\d]{0,8}(\d{1,3})/i) || text.match(/调到\s*(\d{1,3})\s*(?:%|％)/);
+    if (volMatch) {
+      const v = Math.max(0, Math.min(100, Number(volMatch[1])));
+      if (Number.isFinite(v)) return `/mac osa set volume output volume ${v}`;
+    }
+
+    // Priority 3: common system actions
+    if (/(锁屏|锁定屏幕|lock\s*screen)/i.test(text)) {
+      return '/mac osa tell application "System Events" to keystroke "q" using {control down, command down}';
+    }
+    if (/(让|使|进入)?.*(电脑|系统|mac).*(睡眠|休眠)|(^睡眠$)|(^sleep$)/i.test(text)) {
+      return '/mac osa tell application "System Events" to sleep';
+    }
+
+    // Priority 4: app open/close
+    const openMatch = text.match(/(?:请|帮我|麻烦)?(?:把)?(?:打开|启动|唤起|切到)\s*([a-zA-Z0-9_\u4e00-\u9fa5 .()\-]{1,64})(?:\s*(?:应用|app))?$/i);
+    if (openMatch) {
+      const app = resolveAppNameFromNaturalLanguage(openMatch[1]);
+      if (app) return `/mac osa tell application "${escapeAppleScriptString(app)}" to activate`;
+    }
+    const closeMatch = text.match(/(?:请|帮我|麻烦)?(?:把)?(?:关闭|退出|停止)\s*([a-zA-Z0-9_\u4e00-\u9fa5 .()\-]{1,64})(?:\s*(?:应用|app))?$/i);
+    if (closeMatch) {
+      const app = resolveAppNameFromNaturalLanguage(closeMatch[1]);
+      if (app) return `/mac osa tell application "${escapeAppleScriptString(app)}" to quit`;
+    }
+
+    return null;
+  }
+
+  async function tryHandleMacNaturalLanguageIntent(bot, chatId, text, config, options = {}) {
+    if (!text || text.startsWith('/')) return false;
+    if (process.platform !== 'darwin') return false;
+    const daemonCfg = (config && config.daemon) || {};
+    if (daemonCfg.enable_nl_mac_control === false) return false;
+    const sourceTag = String(options.source || 'direct');
+    const safeOnly = !!options.safeOnly;
+    const confirmSideEffects = !!options.confirmSideEffects;
+
+    const syntheticCommand = deriveMacNaturalLanguageCommand(text);
+    if (!syntheticCommand) return false;
+    const isReadOnly = isReadOnlyMacNaturalLanguageCommand(syntheticCommand);
+
+    if (safeOnly && !isReadOnly) {
+      if (confirmSideEffects) {
+        await requestMacSideEffectConfirmation(bot, chatId, text, syntheticCommand, sourceTag);
+        return true;
+      }
+      return false;
+    }
+
+    if (confirmSideEffects && !isReadOnly) {
+      await requestMacSideEffectConfirmation(bot, chatId, text, syntheticCommand, sourceTag);
+      return true;
+    }
+
+    log('INFO', `NL mac intent [${String(chatId).slice(-8)}] (${sourceTag}): ${text.slice(0, 80)} -> ${syntheticCommand}`);
+    return handleExecCommand({
+      bot,
+      chatId,
+      text: syntheticCommand,
+      config,
+      executeTaskByName: () => ({ success: false, error: 'not available' }),
+      nlIntentText: text,
+    });
+  }
+
   async function tryHandleAgentIntent(bot, chatId, text, config) {
     if (!agentTools || !text || text.startsWith('/')) return false;
     const key = String(chatId);
@@ -267,13 +479,17 @@ function createCommandRouter(deps) {
       return;
     }
 
+    if (await tryResolvePendingMacConfirmation(bot, chatId, text, config, executeTaskByName)) {
+      return;
+    }
+
     // --- chat_agent_map: auto-switch agent based on dedicated chatId ---
     // Configure in daemon.yaml: feishu.chat_agent_map or telegram.chat_agent_map
     //   e.g.  chat_agent_map: { "oc_xxx": "personal", "oc_yyy": "metame" }
     const chatAgentMap = { ...(config.telegram ? config.telegram.chat_agent_map : {}), ...(config.feishu ? config.feishu.chat_agent_map : {}) };
     const _chatIdStr = String(chatId);
     const mappedKey = chatAgentMap[_chatIdStr] ||
-      (_chatIdStr.startsWith('_agent_') ? _chatIdStr.slice(7) : null);
+      projectKeyFromVirtualChatId(_chatIdStr);
     if (mappedKey && config.projects && config.projects[mappedKey]) {
       const proj = config.projects[mappedKey];
       const projCwd = normalizeCwd(proj.cwd);
@@ -338,8 +554,10 @@ function createCommandRouter(deps) {
         '/quit — 结束会话，重新加载 MCP/配置',
         '',
         `⚙️ /model [${currentModel}] /provider [${currentProvider}] /status /tasks /run /budget /reload`,
+        '🧩 /TeamTask create <agent> <目标> [--scope <id>] · /TeamTask · /TeamTask <id>',
         '🧠 /memory — 记忆统计 · /memory <关键词> — 搜索事实',
-        `🔧 /doctor /fix /reset /sh <cmd> /nosleep [${getNoSleepProcess() ? 'ON' : 'OFF'}]`,
+        '🧬 /skill-evo — 查看/处理技能演化队列',
+        `🔧 /doctor /fix /reset /mac /sh <cmd> /nosleep [${getNoSleepProcess() ? 'ON' : 'OFF'}]`,
         '',
         '直接打字即可对话 💬',
       ].join('\n'));
@@ -401,13 +619,34 @@ function createCommandRouter(deps) {
       return;
     }
 
+    const daemonCfg = (config && config.daemon) || {};
+    const macControlMode = String(daemonCfg.mac_control_mode || 'claude-first').trim().toLowerCase();
+    const macLocalFirst = (macControlMode === 'local-first');
+    const macFallbackEnabled = (daemonCfg.enable_nl_mac_fallback !== false);
+    const allowLocalMacControl = !readOnly && (daemonCfg.enable_nl_mac_control !== false);
+    if (macLocalFirst && allowLocalMacControl && await tryHandleMacNaturalLanguageIntent(bot, chatId, text, config, { source: 'local-first' })) {
+      return;
+    }
+
     const cd = checkCooldown(chatId);
     if (!cd.ok) { await bot.sendMessage(chatId, `${cd.wait}s`); return; }
     if (!checkBudget(loadConfig(), loadState())) {
       await bot.sendMessage(chatId, 'Daily token budget exceeded.');
       return;
     }
-    await askClaude(bot, chatId, text, config, readOnly);
+    const claudeResult = await askClaude(bot, chatId, text, config, readOnly);
+    const claudeFailed = !!(claudeResult && claudeResult.ok === false);
+    const claudeInterrupted = !!(claudeResult && claudeResult.interrupted);
+    if (claudeFailed && !claudeInterrupted && !macLocalFirst && macFallbackEnabled && allowLocalMacControl) {
+      const fallbackHandled = await tryHandleMacNaturalLanguageIntent(bot, chatId, text, config, {
+        source: 'claude-fallback',
+        safeOnly: true,
+        confirmSideEffects: true,
+      });
+      if (fallbackHandled) {
+        log('WARN', `Claude-first mac fallback handled for ${String(chatId).slice(-8)} (mode=${macControlMode})`);
+      }
+    }
   }
 
   return { handleCommand };

package/scripts/daemon-default.yaml

@@ -24,7 +24,8 @@ projects:
   #     - name: "daily-task"
   #       cwd: "~/AGI/MyProject"
   #       model: "sonnet"
-  #       interval: "24h"
+  #       at: "09:30"         # fixed local time (HH:MM)
+  #       days: "weekdays"    # optional: weekdays | weekends | [mon, tue, ...]
   #       notify: true
   #       enabled: true
   #       prompt: "..."
@@ -68,13 +69,15 @@ heartbeat:
     # Scheduled task (calls claude -p with your profile context):
     # - name: "morning-news"
     #   prompt: "抓取今天的AI领域重要新闻，整理成3条摘要，中英双语。"
-    #   interval: "24h"
+    #   at: "09:00"         # 每天本地时间 09:00
+    #   days: "weekdays"    # 可选，不填表示每天
     #   model: "haiku"
     #   notify: true
     #
     # - name: "weekly-review"
     #   prompt: "基于我的profile，生成本周个人成长回顾和下周建议。"
-    #   interval: "7d"
+    #   at: "20:30"
+    #   days: [sun]
     #   model: "haiku"
     #   notify: true
     #
@@ -94,6 +97,10 @@ heartbeat:
     #   precondition: "test -s ~/.metame/skill_signals.jsonl"
     #   notify: false
     #
+    # Scheduling:
+    # - interval: "6h"  -> run every 6 hours (legacy + fully supported)
+    # - at: "HH:MM"     -> run at fixed local time, optional days filter
+    #
     # precondition: shell command, empty output → skip (zero tokens)
     # type: "script" → runs command directly instead of claude -p
 

package/scripts/daemon-exec-commands.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { classifyTaskUsage } = require('./usage-classifier');
+
 function createExecCommandHandler(deps) {
   const {
     fs,
@@ -23,8 +25,129 @@ function createExecCommandHandler(deps) {
     loadConfig,
   } = deps;
 
+  function truncateOutput(output, maxLen = 4000) {
+    const text = (output || '').trim() || '(no output)';
+    return text.length > maxLen ? text.slice(0, maxLen) + '\n... (truncated)' : text;
+  }
+
+  function maxReplyLengthForChat(chatId, defaultLen) {
+    // Feishu text messages have a lower practical limit than Telegram.
+    return typeof chatId === 'number' ? defaultLen : Math.min(defaultLen, 1200);
+  }
+
+  async function runCommand(bin, args, options = {}) {
+    return new Promise((resolve) => {
+      let settled = false;
+      const child = spawn(bin, args, options);
+      let stdout = '';
+      let stderr = '';
+
+      const finish = (code, errorText = '') => {
+        if (settled) return;
+        settled = true;
+        const merged = `${stdout}${stderr}${errorText}`;
+        resolve({
+          code: typeof code === 'number' ? code : 1,
+          stdout,
+          stderr: `${stderr}${errorText}`,
+          output: merged.trim(),
+        });
+      };
+
+      child.stdout.on('data', d => { stdout += d; });
+      child.stderr.on('data', d => { stderr += d; });
+      child.on('close', code => finish(code));
+      child.on('error', err => finish(1, `${stderr ? '\n' : ''}${err.message}`));
+    });
+  }
+
+  async function runMacCapabilityChecksInline() {
+    const checks = [];
+    const shotPath = `/tmp/metame_gui_test_${process.pid}_${Date.now()}.png`;
+    checks.push({ name: 'osascript binary available', mode: 'pass_on_zero', cmd: 'which osascript' });
+    checks.push({ name: 'AppleScript baseline', mode: 'pass_on_zero', cmd: 'osascript -e \'return "ok"\'' });
+    checks.push({ name: 'Finder automation', mode: 'pass_on_zero', cmd: 'osascript -e \'tell application "Finder" to get name of startup disk\'' });
+    checks.push({ name: 'System Events accessibility', mode: 'pass_on_zero', cmd: 'osascript -e \'tell application "System Events" to get UI elements enabled\'' });
+    checks.push({
+      name: 'GUI app launch/control (Calculator)',
+      mode: 'pass_on_zero',
+      cmd: 'open -a Calculator >/dev/null 2>&1; sleep 1; osascript -e \'tell application "System Events" to tell process "Calculator" to return {frontmost, (count of windows)}\'; osascript -e \'tell application "Calculator" to quit\' >/dev/null 2>&1',
+    });
+    checks.push({ name: 'Screenshot capability (screencapture)', mode: 'pass_on_zero', cmd: `screencapture -x '${shotPath}' && ls -lh '${shotPath}'` });
+    checks.push({ name: 'Full Disk probe: read ~/Library/Mail', mode: 'warn_on_nonzero', cmd: "ls '$HOME/Library/Mail' | head -n 3" });
+    checks.push({ name: 'Full Disk probe: query Safari History.db', mode: 'warn_on_nonzero', cmd: "sqlite3 '$HOME/Library/Safari/History.db' 'select count(*) from history_items;'" });
+
+    const lines = [];
+    let pass = 0;
+    let warn = 0;
+    let fail = 0;
+    lines.push('MetaMe macOS control capability check');
+    lines.push(`Timestamp: ${new Date().toISOString()}`);
+    lines.push('');
+
+    for (const c of checks) {
+      const r = await runCommand('bash', ['-o', 'pipefail', '-lc', c.cmd], { timeout: 30000 });
+      let level = 'FAIL';
+      if (c.mode === 'pass_on_zero') {
+        if (r.code === 0) {
+          pass++;
+          level = 'PASS';
+        } else {
+          fail++;
+          level = 'FAIL';
+        }
+      } else {
+        if (r.code === 0) {
+          pass++;
+          level = 'PASS';
+        } else {
+          warn++;
+          level = 'WARN';
+        }
+      }
+      lines.push(`[${level}] ${c.name}`);
+      if (r.output) lines.push(`  ${r.output.split('\n').join('\n  ')}`);
+    }
+
+    await runCommand('rm', ['-f', shotPath], { timeout: 3000 });
+    lines.push('');
+    lines.push(`Summary: pass=${pass} warn=${warn} fail=${fail}`);
+    return { code: fail > 0 ? 1 : 0, output: lines.join('\n') };
+  }
+
+  function macCommandHelp() {
+    return [
+      '🍎 macOS 控制命令',
+      '/mac check — 检查 AppleScript/UI 自动化/截图/磁盘权限',
+      '/mac perms — 查看建议开启的系统权限',
+      '/mac perms open — 打开系统设置权限页',
+      '/mac osa <AppleScript> — 直接执行 AppleScript',
+      '/mac jxa <JavaScript> — 通过 osascript 执行 JXA',
+      '',
+      '示例:',
+      '/mac osa tell application "Finder" to get name of startup disk',
+    ].join('\n');
+  }
+
+  function macPermissionGuide() {
+    return [
+      '🛡 建议给 MetaMe/终端开启这些权限（系统设置 → 隐私与安全性）：',
+      '1) 辅助功能（Accessibility）',
+      '2) 自动化（Automation / Apple Events）',
+      '3) 完全磁盘访问（Full Disk Access）',
+      '4) 屏幕录制（Screen Recording）',
+      '',
+      '说明：',
+      '- 辅助功能/自动化：用于控制 Finder、System Events、GUI 应用',
+      '- 完全磁盘访问：用于读取 Mail/Safari 等受保护目录',
+      '- 屏幕录制：用于截图和视觉回传',
+      '',
+      '执行 `/mac perms open` 可尝试直接跳转到对应设置页。',
+    ].join('\n');
+  }
+
   async function handleExecCommand(ctx) {
-    const { bot, chatId, text, config, executeTaskByName } = ctx;
+    const { bot, chatId, text, config, executeTaskByName, nlIntentText } = ctx;
 
     if (text.startsWith('/run ')) {
       const cd = checkCooldown(chatId);
@@ -65,7 +188,7 @@ function createExecCommandHandler(deps) {
         await bot.sendMessage(chatId, `❌ ${taskName}: ${error}`);
       } else {
         const est = Math.ceil((fullPrompt.length + (output || '').length) / 4);
-        recordTokens(loadState(), est);
+        recordTokens(loadState(), est, { category: classifyTaskUsage({ name: taskName, type: 'manual_task' }) });
         const st = loadState();
         st.tasks[taskName] = { last_run: new Date().toISOString(), status: 'success', output_preview: (output || '').slice(0, 200) };
         saveState(st);
@@ -248,6 +371,127 @@ function createExecCommandHandler(deps) {
       return true;
     }
 
+    // /mac — macOS control helpers (AppleScript/JXA/permissions)
+    const macMatch = String(text || '').match(/^\/mac(?:\s+(.*))?$/i);
+    if (macMatch) {
+      if (process.platform !== 'darwin') {
+        await bot.sendMessage(chatId, '❌ /mac 仅支持 macOS');
+        return true;
+      }
+
+      const argRaw = (macMatch[1] || '').trim();
+      const arg = argRaw.toLowerCase();
+      if (!argRaw || arg === 'help') {
+        if (bot.sendButtons) {
+          await bot.sendButtons(chatId, macCommandHelp(), [
+            [{ text: '✅ /mac check', callback_data: '/mac check' }],
+            [{ text: '🛡 /mac perms', callback_data: '/mac perms' }],
+            [{ text: '⚙️ /mac perms open', callback_data: '/mac perms open' }],
+          ]);
+        } else {
+          await bot.sendMessage(chatId, macCommandHelp());
+        }
+        return true;
+      }
+
+      if (arg === 'check') {
+        const checkScript = path.join(__dirname, 'check-macos-control-capabilities.sh');
+        await bot.sendMessage(chatId, '🔍 正在检查 macOS 控制能力...');
+        let result;
+        if (fs.existsSync(checkScript)) {
+          result = await runCommand('bash', [checkScript], { timeout: 120000 });
+        } else {
+          await bot.sendMessage(chatId, '⚠️ 检测脚本缺失，已切换为内置检查模式。');
+          result = await runMacCapabilityChecksInline();
+        }
+        const out = truncateOutput(result.output, maxReplyLengthForChat(chatId, 3600));
+        if (result.code === 0) {
+          await bot.sendMessage(chatId, `✅ macOS 能力检查完成\n\n${out}`);
+        } else {
+          await bot.sendMessage(chatId, `⚠️ 检查未全部通过\n\n${out}`);
+        }
+        return true;
+      }
+
+      if (arg === 'perms' || arg === 'permissions') {
+        await bot.sendMessage(chatId, macPermissionGuide());
+        return true;
+      }
+
+      if (arg === 'perms open' || arg === 'permissions open') {
+        const panes = [
+          'x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility',
+          'x-apple.systempreferences:com.apple.preference.security?Privacy_Automation',
+          'x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles',
+          'x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture',
+        ];
+        let ok = 0;
+        for (const pane of panes) {
+          const r = await runCommand('open', [pane], { timeout: 5000 });
+          if (r.code === 0) ok++;
+        }
+        await bot.sendMessage(chatId, `⚙️ 已尝试打开 ${ok}/${panes.length} 个权限设置页。\n若未跳转，请手动进入“系统设置 → 隐私与安全性”。`);
+        return true;
+      }
+
+      if (/^osa(?:\s+|$)/i.test(argRaw)) {
+        const script = argRaw.replace(/^osa(?:\s+|$)/i, '').trim();
+        if (!script) {
+          await bot.sendMessage(chatId, '用法: /mac osa <AppleScript>');
+          return true;
+        }
+        const result = await runCommand('osascript', ['-e', script], { timeout: 45000 });
+        const out = (result.output || '').trim();
+        if (result.code !== 0) {
+          await bot.sendMessage(chatId, `❌ AppleScript 执行失败\n${truncateOutput(out, maxReplyLengthForChat(chatId, 3000))}`);
+        } else if (nlIntentText) {
+          const label = String(nlIntentText).trim().slice(0, 120);
+          if (out) {
+            await bot.sendMessage(chatId, `✅ 已执行：${label}\n${truncateOutput(out, maxReplyLengthForChat(chatId, 1200))}`);
+          } else {
+            await bot.sendMessage(chatId, `✅ 已执行：${label}`);
+          }
+        } else {
+          if (out) {
+            await bot.sendMessage(chatId, `🍎 AppleScript 结果\n${truncateOutput(out, maxReplyLengthForChat(chatId, 3000))}`);
+          } else {
+            await bot.sendMessage(chatId, '✅ AppleScript 已执行（无返回值）');
+          }
+        }
+        return true;
+      }
+
+      if (/^jxa(?:\s+|$)/i.test(argRaw)) {
+        const script = argRaw.replace(/^jxa(?:\s+|$)/i, '').trim();
+        if (!script) {
+          await bot.sendMessage(chatId, '用法: /mac jxa <JavaScript>');
+          return true;
+        }
+        const result = await runCommand('osascript', ['-l', 'JavaScript', '-e', script], { timeout: 45000 });
+        const out = (result.output || '').trim();
+        if (result.code !== 0) {
+          await bot.sendMessage(chatId, `❌ JXA 执行失败\n${truncateOutput(out, maxReplyLengthForChat(chatId, 3000))}`);
+        } else if (nlIntentText) {
+          const label = String(nlIntentText).trim().slice(0, 120);
+          if (out) {
+            await bot.sendMessage(chatId, `✅ 已执行：${label}\n${truncateOutput(out, maxReplyLengthForChat(chatId, 1200))}`);
+          } else {
+            await bot.sendMessage(chatId, `✅ 已执行：${label}`);
+          }
+        } else {
+          if (out) {
+            await bot.sendMessage(chatId, `🍎 JXA 结果\n${truncateOutput(out, maxReplyLengthForChat(chatId, 3000))}`);
+          } else {
+            await bot.sendMessage(chatId, '✅ JXA 已执行（无返回值）');
+          }
+        }
+        return true;
+      }
+
+      await bot.sendMessage(chatId, macCommandHelp());
+      return true;
+    }
+
     // /sh [command] — direct shell execution (emergency lifeline)
     if (text === '/sh' || text.startsWith('/sh ')) {
       const command = text.slice(3).trim();
@@ -263,17 +507,8 @@ function createExecCommandHandler(deps) {
         return true;
       }
       try {
-        const child = spawn('sh', ['-c', command], { timeout: 30000 });
-        let stdout = '';
-        let stderr = '';
-        child.stdout.on('data', d => { stdout += d; });
-        child.stderr.on('data', d => { stderr += d; });
-        await new Promise((resolve) => {
-          child.on('close', resolve);
-          child.on('error', resolve);
-        });
-        let output = (stdout + stderr).trim() || '(no output)';
-        if (output.length > 4000) output = output.slice(0, 4000) + '\n... (truncated)';
+        const result = await runCommand('sh', ['-c', command], { timeout: 30000 });
+        const output = truncateOutput(result.output, maxReplyLengthForChat(chatId, 4000));
         await bot.sendMessage(chatId, `💻 $ ${command}\n${output}`);
       } catch (e) {
         await bot.sendMessage(chatId, `❌ ${e.message}`);