controlmesh 0.31.2__tar.gz → 0.32.3__tar.gz

{controlmesh-0.31.2 → controlmesh-0.32.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: controlmesh
-Version: 0.31.2
+Version: 0.32.3
 Summary: ControlMesh brings official coding CLIs into Telegram, Matrix, and Feishu with persistent workspaces, long-running jobs, and production-friendly bot operations.
 Project-URL: Homepage, https://github.com/muqiao215/ControlMesh
 Project-URL: Repository, https://github.com/muqiao215/ControlMesh
@@ -97,7 +97,7 @@ Gemini 等官方编码 CLI 接进飞书、Telegram 和微信，让它们像长
 
 | 能力 | 说明 |
 |---|---|
-| Feishu Native Runtime | 内置 `feishu-auth-kit` 插件，提供扫码创建机器人、CardKit 单卡、权限引导、原生 OAPI 工具 |
+| Feishu Native Runtime | 内置 `feishu-auth-kit` 第一方模块快照，提供扫码创建机器人、CardKit 单卡、权限引导、原生 OAPI 工具 |
 | 后台任务闭环 | `/tasks/create`、`tell`、`ask_parent`、`resume`、`list` 构成可演示任务 runtime |
 | 官方 CLI worker | 复用 Claude、Codex、Gemini 等官方命令行工具执行任务 |
 | 记忆层 | `MEMORY.md` 作为持久权威记忆，配合 `memory/YYYY-MM-DD.md`、`DREAMS.md` 和确定性 promotion/search |
@@ -127,8 +127,8 @@ ControlMesh 当前公开主线是 Feishu Native 模式。
 最小闭环：
 
 - `controlmesh feishu native bootstrap` 进入友好的飞书原生启动入口。
-- 内置 [`feishu-auth-kit`](https://github.com/muqiao215/feishu-auth-kit) 作为 Feishu native plugin，完成扫码创建、凭证写回、权限引导、消息上下文、CardKit 和 retry contract。
-- `feishu-auth-kit` 的公开仓库是上游元能力仓库；ControlMesh 发布包必须包含这套插件，外部 CLI 只作为开发覆盖或故障 fallback。
+- 内置 [`feishu-auth-kit`](https://github.com/muqiao215/feishu-auth-kit) 作为从 ControlMesh 抽取出来的 Feishu 第一方模块，完成扫码创建、凭证写回、权限引导、消息上下文、CardKit 和 retry contract。
+- `feishu-auth-kit` 的公开仓库是这套第一方模块的独立同步形态；ControlMesh 发布包必须包含这套模块，外部 CLI 只作为开发覆盖或故障 fallback。
 - 当 Feishu native 使用 Codex provider 时，agent turn 主路径直接消费内置 plugin 的 `CodexCliRunner`、`AgentEvent` 和 `SingleCardRun`，再由 ControlMesh 负责飞书发送与卡片更新。
 - Feishu 卡片展示任务状态、工具步骤和最终结果。
 - 长任务通过 task runtime 后台执行，缺信息时走 `/tasks/ask_parent`，父会话再 `/tasks/resume`。
@@ -220,6 +220,26 @@ controlmesh auth feishu doctor
 controlmesh auth feishu probe
 ```
 
+Feishu-only 安装是支持的，不需要 Telegram 或 Matrix。最短路径是：
+
+```bash
+pipx install controlmesh
+npm install -g @anthropic-ai/claude-code
+claude auth
+
+controlmesh feishu native bootstrap
+controlmesh auth feishu register-begin
+controlmesh auth feishu register-poll --device-code "<device_code>" --interval 5 --expires-in 600
+controlmesh service install
+```
+
+这条路径里：
+
+- 聊天入口只有 Feishu
+- 不需要 `telegram_token`
+- 不需要 Matrix 配置
+- Claude Code / Codex / Gemini / OpenCode 负责模型 runtime，Feishu 负责聊天入口
+
 任务 runtime：
 
 ```bash
@@ -326,7 +346,7 @@ compatibility transport.
 
 | Feature | Description |
 |---|---|
-| Feishu Native Runtime | Bundled `feishu-auth-kit` plugin for scan-created bots, CardKit cards, permission onboarding, and native OAPI tools |
+| Feishu Native Runtime | Bundled first-party `feishu-auth-kit` snapshot for scan-created bots, CardKit cards, permission onboarding, and native OAPI tools |
 | Background task loop | `/tasks/create`, `ask_parent`, `resume`, and `list` form the runtime loop |
 | Official CLI workers | Run Claude, Codex, Gemini, and other local CLI agents |
 | Memory layer | `MEMORY.md` as durable authority, plus `memory/YYYY-MM-DD.md`, `DREAMS.md`, and deterministic promotion/search |
@@ -355,11 +375,13 @@ ControlMesh is no longer just a chat wrapper with a little persistence:
 
 - `controlmesh feishu native bootstrap` is the product-friendly entrypoint.
 - Bundles [`feishu-auth-kit`](https://github.com/muqiao215/feishu-auth-kit)
-  as the Feishu native plugin for scan-to-create onboarding, credential
-  write-back, permission flows, message context, CardKit, and retry contracts.
-- The standalone `feishu-auth-kit` repo is the upstream reusable capability
-  source. ControlMesh includes a vendored plugin copy; external CLI resolution
-  is a development override or fallback, not the product dependency.
+  as a first-party Feishu module extracted from ControlMesh for scan-to-create
+  onboarding, credential write-back, permission flows, message context,
+  CardKit, and retry contracts.
+- The standalone `feishu-auth-kit` repo is the synced reusable form of the
+  same first-party module. ControlMesh includes a vendored snapshot; external
+  CLI resolution is a development override or fallback, not the product
+  dependency.
 - Shows status, tool steps, and final output in a single Feishu card.
 - Provides `/feishu_auth_all` for guided authorization of the current MVP tools.
 - Includes first read-only native tools for contacts, users, group messages, and Drive files.
@@ -445,6 +467,28 @@ controlmesh auth feishu doctor
 controlmesh auth feishu probe
 ```
 
+Feishu-only is a first-class path. You do not need Telegram or Matrix if your
+deployment only uses Feishu. The shortest setup is:
+
+```bash
+pipx install controlmesh
+npm install -g @anthropic-ai/claude-code
+claude auth
+
+controlmesh feishu native bootstrap
+controlmesh auth feishu register-begin
+controlmesh auth feishu register-poll --device-code "<device_code>" --interval 5 --expires-in 600
+controlmesh service install
+```
+
+In that setup:
+
+- Feishu is the only chat surface
+- Telegram is not required
+- Matrix is not required
+- Claude Code / Codex / Gemini / OpenCode provide the model runtime behind the
+  Feishu transport
+
 Task runtime:
 
 ```bash

{controlmesh-0.31.2 → controlmesh-0.32.3}/README.md

@@ -29,7 +29,7 @@ Gemini 等官方编码 CLI 接进飞书、Telegram 和微信，让它们像长
 
 | 能力 | 说明 |
 |---|---|
-| Feishu Native Runtime | 内置 `feishu-auth-kit` 插件，提供扫码创建机器人、CardKit 单卡、权限引导、原生 OAPI 工具 |
+| Feishu Native Runtime | 内置 `feishu-auth-kit` 第一方模块快照，提供扫码创建机器人、CardKit 单卡、权限引导、原生 OAPI 工具 |
 | 后台任务闭环 | `/tasks/create`、`tell`、`ask_parent`、`resume`、`list` 构成可演示任务 runtime |
 | 官方 CLI worker | 复用 Claude、Codex、Gemini 等官方命令行工具执行任务 |
 | 记忆层 | `MEMORY.md` 作为持久权威记忆，配合 `memory/YYYY-MM-DD.md`、`DREAMS.md` 和确定性 promotion/search |
@@ -59,8 +59,8 @@ ControlMesh 当前公开主线是 Feishu Native 模式。
 最小闭环：
 
 - `controlmesh feishu native bootstrap` 进入友好的飞书原生启动入口。
-- 内置 [`feishu-auth-kit`](https://github.com/muqiao215/feishu-auth-kit) 作为 Feishu native plugin，完成扫码创建、凭证写回、权限引导、消息上下文、CardKit 和 retry contract。
-- `feishu-auth-kit` 的公开仓库是上游元能力仓库；ControlMesh 发布包必须包含这套插件，外部 CLI 只作为开发覆盖或故障 fallback。
+- 内置 [`feishu-auth-kit`](https://github.com/muqiao215/feishu-auth-kit) 作为从 ControlMesh 抽取出来的 Feishu 第一方模块，完成扫码创建、凭证写回、权限引导、消息上下文、CardKit 和 retry contract。
+- `feishu-auth-kit` 的公开仓库是这套第一方模块的独立同步形态；ControlMesh 发布包必须包含这套模块，外部 CLI 只作为开发覆盖或故障 fallback。
 - 当 Feishu native 使用 Codex provider 时，agent turn 主路径直接消费内置 plugin 的 `CodexCliRunner`、`AgentEvent` 和 `SingleCardRun`，再由 ControlMesh 负责飞书发送与卡片更新。
 - Feishu 卡片展示任务状态、工具步骤和最终结果。
 - 长任务通过 task runtime 后台执行，缺信息时走 `/tasks/ask_parent`，父会话再 `/tasks/resume`。
@@ -152,6 +152,26 @@ controlmesh auth feishu doctor
 controlmesh auth feishu probe
 ```
 
+Feishu-only 安装是支持的，不需要 Telegram 或 Matrix。最短路径是：
+
+```bash
+pipx install controlmesh
+npm install -g @anthropic-ai/claude-code
+claude auth
+
+controlmesh feishu native bootstrap
+controlmesh auth feishu register-begin
+controlmesh auth feishu register-poll --device-code "<device_code>" --interval 5 --expires-in 600
+controlmesh service install
+```
+
+这条路径里：
+
+- 聊天入口只有 Feishu
+- 不需要 `telegram_token`
+- 不需要 Matrix 配置
+- Claude Code / Codex / Gemini / OpenCode 负责模型 runtime，Feishu 负责聊天入口
+
 任务 runtime：
 
 ```bash
@@ -258,7 +278,7 @@ compatibility transport.
 
 | Feature | Description |
 |---|---|
-| Feishu Native Runtime | Bundled `feishu-auth-kit` plugin for scan-created bots, CardKit cards, permission onboarding, and native OAPI tools |
+| Feishu Native Runtime | Bundled first-party `feishu-auth-kit` snapshot for scan-created bots, CardKit cards, permission onboarding, and native OAPI tools |
 | Background task loop | `/tasks/create`, `ask_parent`, `resume`, and `list` form the runtime loop |
 | Official CLI workers | Run Claude, Codex, Gemini, and other local CLI agents |
 | Memory layer | `MEMORY.md` as durable authority, plus `memory/YYYY-MM-DD.md`, `DREAMS.md`, and deterministic promotion/search |
@@ -287,11 +307,13 @@ ControlMesh is no longer just a chat wrapper with a little persistence:
 
 - `controlmesh feishu native bootstrap` is the product-friendly entrypoint.
 - Bundles [`feishu-auth-kit`](https://github.com/muqiao215/feishu-auth-kit)
-  as the Feishu native plugin for scan-to-create onboarding, credential
-  write-back, permission flows, message context, CardKit, and retry contracts.
-- The standalone `feishu-auth-kit` repo is the upstream reusable capability
-  source. ControlMesh includes a vendored plugin copy; external CLI resolution
-  is a development override or fallback, not the product dependency.
+  as a first-party Feishu module extracted from ControlMesh for scan-to-create
+  onboarding, credential write-back, permission flows, message context,
+  CardKit, and retry contracts.
+- The standalone `feishu-auth-kit` repo is the synced reusable form of the
+  same first-party module. ControlMesh includes a vendored snapshot; external
+  CLI resolution is a development override or fallback, not the product
+  dependency.
 - Shows status, tool steps, and final output in a single Feishu card.
 - Provides `/feishu_auth_all` for guided authorization of the current MVP tools.
 - Includes first read-only native tools for contacts, users, group messages, and Drive files.
@@ -377,6 +399,28 @@ controlmesh auth feishu doctor
 controlmesh auth feishu probe
 ```
 
+Feishu-only is a first-class path. You do not need Telegram or Matrix if your
+deployment only uses Feishu. The shortest setup is:
+
+```bash
+pipx install controlmesh
+npm install -g @anthropic-ai/claude-code
+claude auth
+
+controlmesh feishu native bootstrap
+controlmesh auth feishu register-begin
+controlmesh auth feishu register-poll --device-code "<device_code>" --interval 5 --expires-in 600
+controlmesh service install
+```
+
+In that setup:
+
+- Feishu is the only chat surface
+- Telegram is not required
+- Matrix is not required
+- Claude Code / Codex / Gemini / OpenCode provide the model runtime behind the
+  Feishu transport
+
 Task runtime:
 
 ```bash

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/__init__.py

@@ -1,3 +1,3 @@
 """ControlMesh public package and CLI entrypoint surface."""
 
-__version__ = "0.31.2"
+__version__ = "0.32.3"

controlmesh-0.32.3/controlmesh/_home_defaults/workspace/cron_tasks/release-ci-monitor-template/RULES-template.md

@@ -0,0 +1,28 @@
+# Your Mission
+
+You are a **temporary release-phase monitor agent**.
+
+This task exists to watch a specific CI or publish step at high frequency for a short bounded period, then return control to the main release conversation.
+
+## Workflow
+
+1. Read the whole `TASK_DESCRIPTION.md`.
+2. Read any task-local memory file if present.
+3. Read the injected release context carefully.
+4. Poll only the specific target you were assigned.
+5. Stop yourself as soon as the target reaches a useful terminal state.
+6. On success: resume or hand back the exact next release step.
+7. On failure: prefer direct narrow repair first, then resume or hand back the result.
+
+## Rules
+
+- Do not behave like a permanent cron job.
+- Do not drift into unrelated repo work.
+- Do not keep polling after a clear terminal state.
+- Do not wait for a human if the failure has an obvious narrow repair inside the current boundary.
+- Keep the final handoff concise and operational.
+
+## Important
+
+This monitor is meant to replace foreground watch loops during release waiting phases.
+It should be fast to trigger, fast to stop, and explicit about what resumes next.

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/_home_defaults/workspace/tools/cron_tools/cron_monitor.py

@@ -21,6 +21,7 @@ from _shared import CRON_TASKS_DIR, JOBS_PATH, load_jobs_or_default, save_jobs
 _TEMPLATE_DIR = (
     Path(__file__).resolve().parents[2] / "cron_tasks" / "release-ci-monitor-template"
 )
+_RULES_TEMPLATE = "RULES-template.md"
 _TUTORIAL = """\
 CRON MONITOR -- Create a short-lived release/CI monitor.
 
@@ -81,7 +82,7 @@ def _parser() -> argparse.ArgumentParser:
 
 
 def _apply_monitor_template(task_dir: Path, *, description: str, schedule: str) -> None:
-    rules_source = (_TEMPLATE_DIR / "AGENTS.md").read_text(encoding="utf-8")
+    rules_source = (_TEMPLATE_DIR / _RULES_TEMPLATE).read_text(encoding="utf-8")
     for name in ("CLAUDE.md", "AGENTS.md", "GEMINI.md"):
         path = task_dir / name
         if path.exists():

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/_home_defaults/workspace/tools/task_tools/create_task.py

@@ -24,6 +24,7 @@ Options:
     --evaluator NAME   Evaluator hint, e.g. foreground
     --plan-id ID       PlanFiles plan id
     --plan-file PATH   Read PLAN.md content from file
+    --prompt-file PATH Read the task prompt from file
     --phase-id ID      PlanFiles phase id
     --phase-title TXT  PlanFiles phase title
 
@@ -89,6 +90,7 @@ def main() -> None:
     evaluator = ""
     plan_id = ""
     plan_file = ""
+    prompt_file = ""
     phase_id = ""
     phase_title = ""
 
@@ -139,6 +141,9 @@ def main() -> None:
         elif args[0] == "--plan-file" and len(args) >= 2:
             plan_file = args[1]
             args = args[2:]
+        elif args[0] == "--prompt-file" and len(args) >= 2:
+            prompt_file = args[1]
+            args = args[2:]
         elif args[0] == "--phase-id" and len(args) >= 2:
             phase_id = args[1]
             args = args[2:]
@@ -148,7 +153,7 @@ def main() -> None:
         else:
             break
 
-    if not args:
+    if not prompt_file and not args:
         print(
             'Usage: python3 create_task.py [--name NAME] [--slot SLOT] [--provider P] '
             '[--model M] [--thinking L] [--route auto] [--kind KIND] "prompt"',
@@ -156,7 +161,11 @@ def main() -> None:
         )
         sys.exit(1)
 
-    prompt = args[0]
+    if prompt_file:
+        with open(prompt_file, encoding="utf-8") as handle:
+            prompt = handle.read()
+    else:
+        prompt = args[0]
     sender = detect_agent_name()
 
     url = get_api_url("/tasks/create")

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/_home_defaults/workspace/tools/task_tools/release_task.py

@@ -6,6 +6,10 @@ default phases, then submits each phase as a background task using plan_id/
 phase_id metadata. Publish phases are tagged with ``evaluator=foreground`` so
 the foreground controller can review and approve before external side effects.
 
+This is the preferred ControlMesh release path. Local preflight work such as
+pytest/build runs inside the background release workflow; short-lived release
+monitor cron jobs are only armed after publish-side remote waits exist.
+
 Usage:
     python3 release_task.py [options] "Release description"
 
@@ -46,6 +50,7 @@ import os
 import sys
 from datetime import datetime
 from pathlib import Path
+from urllib.parse import urlparse
 
 
 _HELP_FLAGS = {"--help", "-h"}
@@ -180,6 +185,8 @@ def _build_plan_markdown(
         "",
         "- The `publish` phase (and any `github_release` phases) require explicit "
         "foreground approval before external side effects.",
+        "- Local preflight stays inside background release phases; the release "
+        "monitor cron is only used for remote CI/PyPI waits after push/tag.",
         "- Use `python3 tools/task_tools/list_tasks.py` to monitor phase progress.",
         "- Approve publish-side host steps from the foreground controller with `/mesh approve <plan-id>`.",
         "- Use `python3 tools/task_tools/cancel_task.py TASK_ID` to abort a phase.",
@@ -226,6 +233,30 @@ def _host_job_metadata(repo_url: str, version: str) -> dict[str, object]:
     }
 
 
+def _resolve_repo_root(repo_url: str) -> str:
+    """Best-effort local checkout path for a repository URL."""
+    normalized = str(repo_url or "").strip()
+    if not normalized:
+        return ""
+    parsed = urlparse(normalized)
+    repo_name = Path(parsed.path.rstrip("/")).name
+    if repo_name.endswith(".git"):
+        repo_name = repo_name[:-4]
+    if not repo_name:
+        return ""
+    candidates = (
+        Path("/root/.controlmesh/dev") / repo_name,
+        Path.home() / repo_name,
+    )
+    for candidate in candidates:
+        try:
+            if (candidate / ".git").exists():
+                return str(candidate)
+        except PermissionError:
+            continue
+    return ""
+
+
 def _submit_phase(
     post_json: object,
     get_api_url: object,
@@ -409,6 +440,7 @@ def main() -> None:
     # Submit only the first phase. The foreground-controlled plan loop is
     # responsible for advancing later phases one at a time.
     sender = detect_agent_name()
+    repo_root = _resolve_repo_root(repo_url)
 
     # Propagate sender context
     chat_id_str = os.environ.get("CONTROLMESH_CHAT_ID", "")
@@ -430,12 +462,20 @@ def main() -> None:
         "phase_id": first_phase["id"],
         "phase_title": first_phase["title"],
     }
-    if provider:
+    first_phase_provider = str(first_phase.get("provider") or "").strip()
+    first_phase_model = str(first_phase.get("model") or "").strip()
+    if first_phase_provider:
+        first_body["provider"] = first_phase_provider
+    elif provider:
         first_body["provider"] = provider
-    if model:
+    if first_phase_model:
+        first_body["model"] = first_phase_model
+    elif model:
         first_body["model"] = model
     if first_phase["evaluator"]:
         first_body["evaluator"] = first_phase["evaluator"]
+    if repo_root:
+        first_body["repo_root"] = repo_root
     if chat_id:
         first_body["chat_id"] = chat_id
     if topic_id:
@@ -454,6 +494,7 @@ def main() -> None:
     print()
     print(f"Release workflow '{plan_id}' submitted.")
     print("Later phases will be started by the foreground-controlled review loop, one at a time.")
+    print("Local preflight runs in background release phases; monitor cron is reserved for remote CI/PyPI waits.")
     print("Use `python3 tools/task_tools/list_tasks.py` to monitor progress.")
     print()
     print("PlanFiles artifacts:")

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/cli/base.py

@@ -85,8 +85,8 @@ class CLIConfig:
     allowed_tools: list[str] = field(default_factory=list)
     disallowed_tools: list[str] = field(default_factory=list)
     permission_mode: str = "bypassPermissions"
-    claude_root_permission_mode: str = "dontAsk"
-    claude_root_force_bypass_via_is_sandbox: bool = False
+    claude_root_permission_mode: str = "bypassPermissions"
+    claude_root_force_bypass_via_is_sandbox: bool = True
     docker_container: str = ""
     # Codex-specific fields (ignored by Claude provider):
     sandbox_mode: str = "read-only"

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/cli/codex_provider.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import logging
 import time
 from collections.abc import AsyncGenerator
@@ -276,9 +277,17 @@ class CodexCLI(BaseCLI):
 
         is_error = returncode != 0
         result_text, thread_id, usage = parse_codex_jsonl(raw)
+        structured_event_only = _looks_like_codex_event_stream(raw) and not result_text
         response = CLIResponse(
             session_id=thread_id,
-            result=result_text or raw,
+            result=(
+                result_text
+                or (
+                    "Codex returned structured event output without a final assistant message."
+                    if structured_event_only
+                    else raw
+                )
+            ),
             is_error=is_error or not result_text,
             returncode=returncode,
             stderr=stderr_text,
@@ -333,3 +342,27 @@ def _log_cmd(cmd: list[str], *, streaming: bool = False) -> None:
     safe_cmd = [(c[:80] + "...") if len(c) > 80 else c for c in cmd]
     prefix = "Codex stream cmd" if streaming else "Codex cmd"
     logger.info("%s: %s", prefix, " ".join(safe_cmd))
+
+
+def _looks_like_codex_event_stream(raw: str) -> bool:
+    """Return True when *raw* looks like Codex JSONL event output."""
+    saw_event = False
+    for line in raw.splitlines():
+        stripped = line.strip()
+        if not stripped:
+            continue
+        try:
+            data = json.loads(stripped)
+        except json.JSONDecodeError:
+            return False
+        if not isinstance(data, dict):
+            return False
+        event_type = str(data.get("type") or "")
+        if event_type.startswith(("thread.", "turn.", "item.", "message")):
+            saw_event = True
+            continue
+        if isinstance(data.get("item"), dict):
+            saw_event = True
+            continue
+        return False
+    return saw_event

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/cli/param_resolver.py

@@ -56,8 +56,8 @@ class TaskExecutionConfig:
     permission_mode: str
     working_dir: str
     file_access: str
-    claude_root_permission_mode: str = "dontAsk"
-    claude_root_force_bypass_via_is_sandbox: bool = False
+    claude_root_permission_mode: str = "bypassPermissions"
+    claude_root_force_bypass_via_is_sandbox: bool = True
 
 
 def resolve_cli_config(

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/cli/service.py

@@ -118,8 +118,8 @@ class CLIServiceConfig:
     max_turns: int | None
     max_budget_usd: float | None
     permission_mode: str
-    claude_root_permission_mode: str = "dontAsk"
-    claude_root_force_bypass_via_is_sandbox: bool = False
+    claude_root_permission_mode: str = "bypassPermissions"
+    claude_root_force_bypass_via_is_sandbox: bool = True
     reasoning_effort: str = "medium"
     gemini_api_key: str | None = None
     docker_container: str = ""
@@ -532,6 +532,8 @@ class CLIService:
                 append_system_prompt=request.append_system_prompt,
                 max_turns=self._config.max_turns,
                 max_budget_usd=self._config.max_budget_usd,
+                allowed_tools=list(request.allowed_tools),
+                disallowed_tools=list(request.disallowed_tools),
                 permission_mode=self._config.permission_mode,
                 claude_root_permission_mode=self._config.claude_root_permission_mode,
                 claude_root_force_bypass_via_is_sandbox=self._config.claude_root_force_bypass_via_is_sandbox,

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/cli/types.py

@@ -56,6 +56,8 @@ class AgentRequest:
     chat_id: int = 0
     topic_id: int | None = None
     process_label: str = "main"
+    allowed_tools: tuple[str, ...] = ()
+    disallowed_tools: tuple[str, ...] = ()
     resume_session: str | None = None
     continue_session: bool = False
     timeout_seconds: float | None = None

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/config.py

@@ -534,8 +534,8 @@ class AgentConfig(BaseModel):
     max_turns: int | None = None
     max_session_messages: int | None = None
     permission_mode: str = "bypassPermissions"
-    claude_root_permission_mode: str = "dontAsk"
-    claude_root_force_bypass_via_is_sandbox: bool = False
+    claude_root_permission_mode: str = "bypassPermissions"
+    claude_root_force_bypass_via_is_sandbox: bool = True
     cli_timeout: float = 1800.0
     reasoning_effort: str = "medium"
     file_access: str = "all"

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/integrations/feishu_auth_kit.py

@@ -1,4 +1,4 @@
-"""Adapter for ControlMesh's bundled Feishu native plugin."""
+"""Adapter for ControlMesh's bundled first-party Feishu module snapshot."""
 
 from __future__ import annotations
 
@@ -24,7 +24,7 @@ def _sibling_repo_root() -> Path:
 
 
 def resolve_feishu_auth_kit_command() -> tuple[list[str], Path | None]:
-    """Resolve the command used to invoke ControlMesh's Feishu native plugin."""
+    """Resolve the command used to invoke ControlMesh's Feishu module snapshot."""
     configured = os.getenv("CONTROLMESH_FEISHU_AUTH_KIT_BIN", "").strip()
     if configured:
         configured_command = shlex.split(configured)
@@ -48,8 +48,8 @@ def resolve_feishu_auth_kit_command() -> tuple[list[str], Path | None]:
         return [uv_bin, "run", "feishu-auth-kit"], sibling_repo
 
     msg = (
-        "feishu-auth-kit plugin not found. ControlMesh should include its bundled "
-        "Feishu native plugin; otherwise set CONTROLMESH_FEISHU_AUTH_KIT_BIN, "
+        "feishu-auth-kit module not found. ControlMesh should include its bundled "
+        "first-party Feishu module snapshot; otherwise set CONTROLMESH_FEISHU_AUTH_KIT_BIN, "
         "install feishu-auth-kit in PATH, or keep the sibling repo with uv available."
     )
     raise FileNotFoundError(msg)

{controlmesh-0.31.2 → controlmesh-0.32.3}/controlmesh/messenger/feishu/progress_preview.py

@@ -3,7 +3,8 @@
 from __future__ import annotations
 
 import asyncio
-from typing import Protocol
+from collections.abc import Mapping
+from typing import Any, Protocol
 
 _SYSTEM_LABELS: dict[str, str] = {
     "thinking": "处理中...",
@@ -30,6 +31,9 @@ _STATUS_TEMPLATES: dict[str, str] = {
     "failed": "red",
 }
 
+_KIT_SUCCESS_STATES = {"completed", "success", "succeeded", "done"}
+_KIT_FAILED_STATES = {"failed", "failure", "error", "cancelled"}
+
 
 class _FeishuCardPreviewTransport(Protocol):
     async def _send_card_to_chat_ref(
@@ -75,6 +79,7 @@ class FeishuCardPreviewReporter:
         self._progress_count = 0
         self._start_task: asyncio.Task[None] | None = None
         self._preview_unavailable = False
+        self._terminal = False
 
     @property
     def handles_final_response(self) -> bool:
@@ -104,16 +109,54 @@ class FeishuCardPreviewReporter:
     async def on_text_delta(self, _text: str) -> None:
         return None
 
+    async def on_agent_event(self, event: Mapping[str, Any]) -> None:
+        kind = str(event.get("kind") or "")
+        if kind == "tool_call":
+            await self.on_tool(str(event.get("tool_name") or "unknown"))
+            return
+        if kind == "assistant_message":
+            text = event.get("text")
+            if isinstance(text, str) and text:
+                await self._set_body(text, status="running")
+            return
+        if kind in {"running", "start", "status"}:
+            text = event.get("text")
+            if isinstance(text, str) and text:
+                await self._set_body(text, status="running")
+
+    async def finish_with_single_card_run(self, run: Mapping[str, Any]) -> None:
+        status = str(run.get("status") or "")
+        body = str(
+            run.get("final_text")
+            or run.get("output_text")
+            or run.get("answer")
+            or run.get("summary")
+            or ""
+        ).strip()
+        if status in _KIT_SUCCESS_STATES:
+            await self.finish_success(body or "_No output._")
+            return
+        if status in _KIT_FAILED_STATES:
+            await self.finish_failure(body or "处理失败")
+            return
+        await self._set_body(body or "处理中...", status="running")
+
     async def finish_success(self, text: str) -> None:
+        self._terminal = True
         await self._set_body(text or "_No output._", status="complete")
 
     async def finish_failure(self, error_text: str) -> None:
+        self._terminal = True
         await self._set_body(error_text or "处理失败", status="failed")
 
     async def _emit_initial_preview(self) -> None:
+        if self._message_id is not None or self._preview_unavailable or self._terminal:
+            return
         await self._emit("处理中...")
 
     async def _emit(self, label: str) -> None:
+        if self._terminal:
+            return
         if not label or label in self._sent_labels:
             return
         if self._progress_count >= self._max_messages: