retrofit模式开发完毕

AGENT.md

@@ -1,6 +1,43 @@
-# Code2Lark (Lark-deployer)
+# Code2Lark
 
-Code2Lark is a build-time generator. It analyzes an existing service and produces reviewable Feishu/Lark adapter packages. It builds and verifies integration artifacts; it does not own the target service lifecycle.
+Code2Lark is the official project name. Older package, CLI, folder, and document references may still say `lark-deployer` or `Lark-deployer`; treat those as legacy implementation names, not product positioning.
+
+Code2Lark is a build-time generator and future skill-first delivery tool. It analyzes an existing service and produces reviewable Feishu/Lark adapter packages. It builds and verifies integration artifacts; it does not own the target service lifecycle.
+
+## Product Direction
+
+The intended product shape is **skill-first experience, reusable core underneath**.
+
+- The skill is the future user-facing product entry. It should orchestrate project understanding, business clarification, Mode A/B selection, Lark workflow design, dry-run review, real Feishu demo guidance, and sanitized evidence packaging.
+- The existing CLI is not sacred as the product surface. Keep it only as a repeatable execution layer, CI harness, or temporary developer interface while it remains useful.
+- If the execution layer becomes easier to maintain as a library, MCP/tool, or direct skill capability, it may replace or subsume CLI commands.
+- Do not describe Code2Lark externally as CLI-first anymore. The current direction is skill-first with a verifiable core.
+
+External code-understanding skills should be reused and adapted instead of rebuilding generic project analysis from scratch. Code2Lark should focus on converting project capabilities into safe, operable, auditable Lark workflows.
+
+Recommended ownership split:
+
+```text
+codegraph / understand-anything / project-analysis skills
+  -> project facts: files, entrypoints, routes, commands, dependencies, env, side effects
+
+Code2Lark
+  -> business mapping, Lark card/workflow design, safety policy, Mode A/B delivery, install/verify/handoff evidence
+```
+
+When adapting an external analysis skill, require structured output suitable for generation: entrypoints, routes, commands, side-effect labels, required env, candidate operations, risk level, and clarification questions.
+
+## Naming And Workspace Migration
+
+The repository folder may still be `C:\works\Lark-deployer` during active sessions. A future local rename to `C:\works\code2lark` is acceptable, but do it deliberately:
+
+1. Preserve or commit important current changes first.
+2. Create a session handoff or record the session id before renaming, because project-path based session discovery may not automatically find old sessions from the new path.
+3. Rename the folder outside active commands.
+4. Update legacy references in `package.json`, README, docs, scripts, and generated examples as a separate verified change.
+5. Run `npm run build` and `npm test` after internal name changes.
+
+Do not mix directory/package renaming with feature work or artifact cleanup.
 
 ## Architecture
 
@@ -45,6 +82,8 @@ codegraph query route --kind route --path <repo> --json
 
 Code2Lark must never install codegraph or run codegraph `init`, `sync`, reindex, or index-rebuild operations. External results are normalized at the boundary; profile and downstream code must not depend on the external schema.
 
+Longer term, `analyze` should be treated as the most replaceable part of the old CLI. Prefer cherry-picking, forking, or wrapping proven open-source project-analysis skills when they can produce the structured facts Code2Lark needs. Keep Code2Lark-specific analysis only where it maps facts into Lark workflows, safety controls, and delivery contracts.
+
 ## Interaction Profiles
 
 Target-specific mapping lives in `src/profiles/`:
@@ -77,6 +116,16 @@ The current calendar correction contract is strict:
 
 The generated package remains the source of truth. Do not replace generated directories manually; use the `install` command.
 
+Current useful external replay for calendar demonstration and regression:
+
+```text
+C:\works\calendar-stock-updater-code2lark-replay-20260716-211227
+```
+
+This replay contains the current `integrations/lark` module, local private `.env`, and debug evidence. Do not delete or rewrite it without explicit approval.
+
+Older calendar replay copies such as `calendar-stock-updater-c2l-replay`, `calendar-stock-updater-mode-b-corrected-replay`, and `calendar-stock-updater-mode-b-replay` are cleanup candidates only after confirming they contain no unique `.env`, evidence, or comparison value.
+
 ```powershell
 node dist/index.js generate <analysis-workspace> --out <generated-package> --mode embedded-adapter --host-mode embedded-long-connection
 node dist/index.js verify <generated-package> --mode embedded-adapter --host-mode embedded-long-connection --strict
@@ -107,7 +156,7 @@ Card payloads use JSON 2.0 (`schema: "2.0"`, `body.elements`, callback behaviors
 - `docs/calendar-stock-updater-mode-b-correction-task-book.md`: current calendar Mode B correction contract.
 - `docs/capability-validation-matrix.md`: validation fact matrix.
 - `docs/project-status.md`: current project status and evidence summary.
-- `docs/calendar-stock-updater-mode-b-long-connection-task-book.md`: superseded historical plan; do not use it as the active contract.
+- `docs/archive/calendar-stock-updater-mode-b-long-connection-task-book.md`: superseded historical plan; do not use it as the active contract.
 
 When documents conflict, follow the two current correction taskbooks above.
 

README.md

@@ -117,15 +117,16 @@ node dist/index.js install generated\calendar-stock-updater-lark --target C:\pat
 
 #### calendar-stock-updater 当前状态
 
-当前 calendar Mode B 路线已经完成本地工程闭环：
+当前 calendar Mode B 路线已经完成本地工程闭环和真实飞书演示链路验证：
 
 - 原始 `calendar-stock-updater` 项目保持只读，没有修改根 `package.json`、启动脚本、Docker、业务代码或 Web UI；
 - 安装验证使用独立 replay，只通过 `install --apply` 写入 `integrations/lark/**`；
 - 目标调用仍严格限制为 `GET /api/state`、`POST /api/run` 和 `POST /api/stop`；
 - strict verify 为 32 PASS / 0 WARN / 0 FAIL；Code2Lark 完整测试 41/41、replay 根测试 49/49、安装模块测试 8/8；
-- 真实飞书长连接已成功建立并发送起始卡，真实 `card.action.trigger` 也已到达宿主；
-- 当前真实联调阻塞在 `ALLOWED_OPERATOR_OPEN_IDS`：配置值与回调中的当前应用维度 `operator.open_id` 不一致，因此安全门禁按预期拒绝了操作；
-- 真实 Level 2 尚未完成，仍需修正白名单后重新验证刷新、普通预演、停止流程，并补齐截图、message ID、脱敏日志和签字证据。
+- 真实飞书长连接已成功建立并发送起始卡，真实 `card.action.trigger` 已到达宿主；
+- `ALLOWED_OPERATOR_OPEN_IDS` 已在本地私密配置中按当前应用维度 open_id 修正；
+- 真实飞书点击已验证刷新、普通预演、停止准备和停止确认链路，宿主审计日志记录 `calendar.status.refresh`、`calendar.task.dry-run`、`calendar.task.stop.prepare`、`calendar.task.stop.confirm` received/succeeded，目标最终状态为 `stopped`；
+- 当前剩余项是整理可分享的脱敏截图、message ID 和签字证据；真实 `.env`、open_id、chat id 和日志原文不得提交。
 
 安装模块的本地配置位于目标 replay 的 `integrations/lark/.env`。不要把真实值提交到 Git：
 

SKILL.md

@@ -0,0 +1,78 @@
+# Code2Lark Skill
+
+Code2Lark is a skill-first workflow for adding reviewed Feishu/Lark entrypoints to software projects. It supports two modes:
+
+- **Retrofit**: add Lark entrypoints to an existing project.
+- **Co-Build**: design a new business capability and its Lark entrypoint together while another agent or developer owns the business code.
+
+Use this skill when the user asks to connect a project, feature, API, job, workflow, internal tool, or business operation to Feishu/Lark. Do not activate when the user only asks for generic coding help without Lark/Feishu intent.
+
+## Core Principle
+
+Code2Lark is the orchestrator and safety boundary. The existing Code2Lark CLI remains the execution layer; external analysis tools are optional enrichment; `lark-card-designer` owns card information architecture and interaction design.
+
+## Mandatory Routing
+
+1. If the target project already exists and the user wants Lark access added, read `references/retrofit-workflow.md`.
+2. If the user is building a new capability and wants Lark access as part of the work, read `references/cobuild-workflow.md`.
+3. Before relying on code analysis or external tools, read `references/analyzer-boundary.md`.
+4. Before asking, generating, installing, or enabling actions, read `references/confirmation-policy.md` and `references/safety-and-secrets.md`.
+5. Before card layout or interaction-state decisions, delegate or reference `embedded-skills/lark-card-designer/SKILL.md`; do not duplicate its design rules here.
+6. Before reporting completion, read `references/evidence-handoff.md`.
+
+## CLI Reuse Model
+
+The skill should hide command complexity from the user while reusing the existing CLI as the stable execution layer.
+
+| Layer | Responsibility | Examples |
+|---|---|---|
+| Code2Lark Skill | Decide mode, ask questions, control risk, orchestrate commands, summarize evidence. | Retrofit/Co-Build routing, confirmation gates, handoff. |
+| Code2Lark CLI | Execute repeatable operations. | `analyze`, `plan`, `generate`, `install`, `verify`, `doctor`, `evidence`, `handoff`. |
+| External analyzers | Produce optional structural facts. | CodeGraph, dependency-cruiser, ast-grep, ts-morph. |
+| lark-card-designer | Design card structure and interaction states. | Candidate, dry-run, running, success, failure, dangerous-action cards. |
+
+## Package Layout
+
+```text
+code2lark/
+  SKILL.md
+  references/
+  embedded-skills/
+    lark-card-designer/
+  tools/
+  src/
+```
+
+`SKILL.md` is the only public skill entrypoint. `references/` holds process rules. `embedded-skills/lark-card-designer/` is the bundled card-design capability. `tools/` documents executable reuse and local integration plans. The repository's existing `src/` is the real Code2Lark CLI/core implementation that the skill package will progressively wrap and factor into reusable APIs.
+
+## Red Lines
+
+- Do not commit, publish, send cards, delete files, or apply target-project writes without explicit user instruction.
+- Do not print or commit secrets, app secrets, open IDs, chat IDs, message IDs, raw tenant logs, or real `.env` values.
+- Do not expose destructive or privileged actions without dry-run or prepare/confirm separation.
+- Do not assume static analysis knows business intent; turn uncertainty into questions or disabled candidates.
+- Do not let Code2Lark take over business code in Co-Build mode.
+
+## Default Output
+
+When planning or reporting, summarize in this shape:
+
+```text
+mode:
+- retrofit | cobuild
+
+what_was_discovered:
+- source evidence and confidence
+
+recommended_lark_entrypoints:
+- action, risk, required confirmation
+
+cli_execution_plan:
+- commands to run or commands already run
+
+card_design_dependency:
+- when/how lark-card-designer is used
+
+verification_and_handoff:
+- checks, evidence, remaining manual steps
+```

docs/archive/README.md

@@ -0,0 +1,32 @@
+# Documentation Archive
+
+This directory holds historical plans, audits, and superseded design notes that remain useful for project history but are not current operating contracts.
+
+Use these active sources first:
+
+- `AGENT.md`
+- `README.md`
+- `docs/project-status.md`
+- `docs/product-shape-decision.md`
+- `docs/capability-validation-matrix.md`
+- `docs/development-charter.md`
+- `docs/codegraph-structural-backend-correction-task-book.md`
+- `docs/calendar-stock-updater-mode-b-correction-task-book.md`
+- `docs/mode-b-embedding-guide.md`
+- `docs/host-delivery-mode-selection.md`
+- `docs/feishu-official/`
+
+## Archived Files
+
+| File | Reason |
+| --- | --- |
+| `acceptance-audit-2026-07-02.md` | Point-in-time baseline audit. Its findings are historical, not a current contract. |
+| `adapter-first-fix-plan.md` | Completed corrective plan superseded by the current charter and validation records. |
+| `calendar-stock-updater-mode-b-long-connection-task-book.md` | Explicitly superseded by the current calendar Mode B correction taskbook. |
+| `current-roadmap-task-book.md` | Completed roadmap retained for implementation history. Current status belongs in `docs/project-status.md`. |
+| `current-roadmap-verification-record.md` | Completed verification record for the archived roadmap. |
+| `development-direction.md` | Early direction note superseded by the charter and current product-shape decision. |
+| `development-direction-v2-adapter-first.md` | Early adapter-first design note superseded by the charter and current delivery guides. |
+| `second-target-validation-plan.md` | Explicitly marked as a historical Mode A baseline. The current calendar correction taskbook is authoritative. |
+
+No generated, handoff, replay, secret-bearing, official Feishu, or regression-evidence directories are archived here.

docs/calendar-stock-updater-mode-b-long-connection-task-book.md → docs/archive/calendar-stock-updater-mode-b-long-connection-task-book.md

@@ -711,4 +711,4 @@ level2_verification_record.md
 ```
 
 这份任务书的核心区别是：**cal 的新 Mode B 成功标准不再是“生成 adapter”，而是“用户填一次 `.env`，启动一次，就获得可运行的飞书长连接服务”。**
-```</|DELIM_DA4Ek|>numerusformRGCTXDataന്റjson
+```</|DELIM_DA4Ek|>numerusformRGCTXDataന്റjson

docs/capability-validation-matrix.md

@@ -7,4 +7,4 @@ This matrix is the current human-readable fact source for target profile, delive
 | image-agent-web | Mode A | self-hosted / long connection | yes | yes | verified sample baseline |
 | image-agent-web | Mode B | embedded host module | yes | yes | verified sample baseline |
 | calendar-stock-updater | Mode A | embedded-adapter / embedded-long-connection | yes | package and host contract verified; real Feishu pending | dedicated calendar Profile and `handleCardAction()` facade; formal Feishu ingress is `card.action.trigger`; exact target calls remain `GET /api/state`, `POST /api/run`, and `POST /api/stop` |
-| calendar-stock-updater | Mode B | isolated Node module / long connection | yes | replay install verified; real WebSocket, start card, and callback receipt observed; authorized Level 2 pending | `auto` safely fell back to internal without a maintained index; strict generated TypeScript without suppressions; target-controlled status/log/failure text is bounded and redacted; dry-run-first install writes only `integrations/lark`; strict verify `32/0/0`; module `8/8`, replay `49/49`, zero-vulnerability audits, offline/conflict gates, and root/hash integrity passed; current app-scoped operator open_id must be aligned with `ALLOWED_OPERATOR_OPEN_IDS` before authorized refresh/dry-run evidence |
+| calendar-stock-updater | Mode B | isolated Node module / long connection | yes | replay install verified; real WebSocket, start card, authorized dry-run, stop, and refresh verified | `auto` safely fell back to internal without a maintained index; strict generated TypeScript without suppressions; target-controlled status/log/failure text is bounded and redacted; dry-run-first install writes only `integrations/lark`; strict verify `32/0/0`; module `8/8`, replay `49/49`, zero-vulnerability audits, offline/conflict gates, and root/hash integrity passed; app-scoped operator open_id allowlist was corrected locally; target ended in `stopped`; shareable screenshot/message-id/sign-off evidence still needs packaging without secrets |