@modesto_ma/dsh-channels 0.1.0 → 0.3.0

package/src/service.ts

@@ -6,6 +6,10 @@
  *  - p2p:   one workspace per (bot, user), all of that user's sessions inside;
  *  - group: one workspace per (chat, user), sessions grouped per user.
  *
+ * Every topic's Session works in its own directory inside that workspace
+ * (`topics/<token>` or a Git worktree), so topics never mix files while the
+ * workspace list grows with users instead of conversations.
+ *
  * Routing model:
  *  - `thread_id` → bound session (no @ needed inside an owned topic);
  *  - degraded chat-scoped keys when Feishu refuses topic replies;
@@ -45,11 +49,11 @@ import type { EffortCommandAction, ParsedSlashCommand } from './commands.ts'
 import { commandSpec } from './commands/registry.ts'
 import type { ChannelCommandSpec } from './commands/registry.ts'
 import type { PermissionPresets, SessionQuery } from './dsh-types.ts'
-import { feishuDomain } from './domain.ts'
+import { feishuDomain, sessionDirOf } from './domain.ts'
 import {
   applyWorkspaceCleanup, isPathInside, planWorkspaceCleanup, retentionMs,
 } from './cleanup.ts'
-import type { CleanupDeps, WorkspaceStats } from './cleanup.ts'
+import type { CleanupDeps, CleanupRoute, CleanupTombstone, ScannedSessionDir, WorkspaceStats } from './cleanup.ts'
 import type {
   AccessGroupRecord, AccessRequestRecord, AccessUserRecord,
   ExpiredRouteRecord, FeishuDomainGlobal, FeishuDomainHandle, InflightSnapshot, ProcessedRecord, RawDomainHandle,
@@ -83,6 +87,7 @@ import type {
   AccessMutationResponse, AccessRequestWire, AccessWire,
 } from './settings/contract.ts'
 import type { OverlayStore } from './settings/overlay.ts'
+import { legacyTopicWorkspaceRoot } from './workspaces.ts'
 
 /** Periodic route-GC sweep cadence (a long-running instance also accumulates
  *  dead records; TTL semantics make 6 h granularity more than sufficient). */
@@ -281,13 +286,21 @@ export class FeishuService {
   private started = false
   /** Epoch ms when `start()` completed (uptime for `/status`). */
   private startedAt: number | undefined
-  /** Last failed `boot()` message, surfaced in the Web settings panel. */
+  /** Last failed connection attempt, surfaced in the Web settings panel. */
   private lastStartError: string | undefined
+  /** Whether both Feishu application credentials currently resolve. */
+  private configured = false
+  /** Names of the missing credential references (never their values). */
+  private missingConfigItems: string[] = []
+  /** Guards the panel's explicit connect action (distinct from a restart). */
+  private connecting = false
   /** Effective config captured at the last successful connect (restart-pending diff). */
   private runningConfig: FeishuConfig | undefined
   /** Guards overlapping panel-triggered reconnects. */
   private restarting = false
   private unlisten: (() => void) | undefined
+  /** Disposers for host-scoped listeners registered by `start()`. */
+  private readonly unlistenHost: Array<() => boolean> = []
   /** Periodic route-GC timer (unref'd; only armed when `routeTtlMs > 0`). */
   private gcTimer: ReturnType<typeof setInterval> | undefined
   /** Periodic workspace-retention timer (only armed when auto cleanup is on). */
@@ -396,27 +409,105 @@ export class FeishuService {
   // ---- lifecycle / Web settings panel ----------------------------------
 
   /**
-   * Load the Web overlay, then open the channel. Startup errors are recorded
-   * for the settings panel and the partial service is torn down before the
-   * error is rethrown (the plugin fiber still fails the same way).
+   * Load the Web overlay and open the long connection when — and only when —
+   * the Feishu application credentials are complete.
+   *
+   * An incomplete configuration is a normal state, not an error: the plugin
+   * stays loaded so the Web settings panel can guide the user through the
+   * credentials form, and no connection is attempted. A failed connection
+   * attempt is recorded for the panel instead of failing the plugin fiber.
    */
   async boot(): Promise<void> {
+    if (this.connecting || this.restarting) return
+    // Acquire the lifecycle lock before the first await so a panel action can
+    // never interleave with the boot sequence.
+    this.connecting = true
     try {
       await this.loadOverlay()
+      await this.refreshReadiness()
+      if (!this.configured) {
+        this.lastStartError = undefined
+        this.runningConfig = undefined
+        this.ctx.logger?.info?.(
+          'dsh-channels: 飞书应用凭据未配置完整（缺少 %s），本次不连接飞书；'
+          + '请在 Web 设置面板 → 飞书渠道中配置，保存后会自动连接',
+          this.missingConfigItems.join('、'),
+        )
+        return
+      }
+      await this.openConnection()
+    } catch {
+      // Recorded in `lastStartError`; the plugin itself stays loaded.
+    } finally {
+      this.connecting = false
+    }
+  }
+
+  /**
+   * Refresh the cached configuration readiness from the credentials seam.
+   * Only presence is checked (describe/resolve), never values; the secrets
+   * themselves are resolved by `start()` when a connection is opened.
+   */
+  async refreshReadiness(): Promise<void> {
+    const states = await this.credentialStates()
+    const missing: string[] = []
+    if (!states.appId.configured) missing.push(`${this.config.appId}（飞书 App ID）`)
+    if (!states.appSecret.configured) missing.push(`${this.config.appSecret}（飞书 App Secret）`)
+    this.missingConfigItems = missing
+    this.configured = missing.length === 0
+  }
+
+  /**
+   * Open the connection with the live config. A failure tears the partial
+   * service down and records the reason for the panel before rethrowing it to
+   * the caller; the plugin fiber is never failed by a connection problem.
+   */
+  private async openConnection(): Promise<void> {
+    try {
       await this.start()
       this.lastStartError = undefined
       this.runningConfig = { ...this.config }
     } catch (error) {
       this.lastStartError = messageOf(error)
+      this.ctx.logger?.error?.('dsh-channels: 飞书连接失败：%s', String(error))
+      // Headless profiles have no settings panel; keep the failure visible on
+      // the console, symmetric with the success line at the end of `start()`.
+      console.error('[dsh-channels] feishu connection failed:', error)
       try {
         await this.shutdown()
       } catch {
-        // The original startup error is the useful one.
+        // The connection error is the useful one.
       }
       throw error
     }
   }
 
+  /**
+   * Panel action: open the long connection when the channel is stopped.
+   * Credentials are re-checked first — an incomplete pair throws a message the
+   * panel shows next to the credentials form instead of attempting a connect.
+   */
+  async connect(): Promise<void> {
+    if (this.started) return
+    // Boot, an explicit connect and a restart all drive the same connection
+    // wiring; serialize them instead of racing two `start()` bodies. The lock
+    // is acquired synchronously, before any await.
+    if (this.connecting || this.restarting) throw new Error('飞书连接正在连接或重启，请稍候再试')
+    this.connecting = true
+    try {
+      // A stopped channel may have been edited on disk (the overlay file is
+      // writable by hand); connecting re-reads it like a restart does.
+      await this.loadOverlay()
+      await this.refreshReadiness()
+      if (!this.configured) {
+        throw new Error(`飞书应用凭据尚未配置完整：缺少 ${this.missingConfigItems.join('、')}`)
+      }
+      await this.openConnection()
+    } finally {
+      this.connecting = false
+    }
+  }
+
   /** Re-read the Web overlay over the profile config (no channel touch). */
   private async loadOverlay(): Promise<void> {
     const overlay = this.overlay === undefined ? {} : await this.overlay.load()
@@ -444,26 +535,24 @@ export class FeishuService {
     this.refreshRetentionTimer()
   }
 
-  /** Tear the connection down and bring it back with the latest config. */
+  /**
+   * Tear the connection down and bring it back with the latest config. When the
+   * credentials are no longer complete the channel simply stays stopped (no
+   * error): the panel then shows the configuration guide instead of a failure.
+   */
   async restart(): Promise<void> {
-    if (this.restarting) throw new Error('飞书连接正在重启，请稍候再试')
+    if (this.restarting || this.connecting) throw new Error('飞书连接正在连接或重启，请稍候再试')
     this.restarting = true
     try {
       await this.shutdown()
       await this.loadOverlay()
-      await this.start()
-      this.lastStartError = undefined
-      this.runningConfig = { ...this.config }
-    } catch (error) {
-      this.lastStartError = messageOf(error)
-      // `start()` flips `started` before wiring; a failed reconnect must not
-      // leave the panel claiming a live connection.
-      try {
-        await this.shutdown()
-      } catch {
-        // The restart error is the useful one.
+      await this.refreshReadiness()
+      if (!this.configured) {
+        this.lastStartError = undefined
+        this.runningConfig = undefined
+        return
       }
-      throw error
+      await this.openConnection()
     } finally {
       this.restarting = false
     }
@@ -471,6 +560,12 @@ export class FeishuService {
 
   isRunning(): boolean { return this.started }
   isRestarting(): boolean { return this.restarting }
+  /** True while the panel's explicit connect action is in flight. */
+  isConnecting(): boolean { return this.connecting }
+  /** Whether both Feishu application credentials currently resolve. */
+  isConfigured(): boolean { return this.configured }
+  /** Names of the missing configuration items (never values). */
+  missingConfig(): readonly string[] { return this.missingConfigItems }
   startedAtMs(): number | undefined { return this.startedAt }
   uptimeMs(): number | undefined {
     return this.startedAt === undefined || !this.started ? undefined : Math.max(0, Date.now() - this.startedAt)
@@ -489,6 +584,9 @@ export class FeishuService {
     const admin = this.config.adminOpenId
     return {
       mode: this.config.accessMode,
+      // Whitelists live in the storage domain, which is only open while the
+      // channel runs; an unconnected panel must not present them as empty.
+      loaded: this.domain !== undefined,
       admin: {
         ...(admin === undefined ? {} : { openId: admin }),
         configured: admin !== undefined,
@@ -529,7 +627,7 @@ export class FeishuService {
     const id = this.cleanAccessTargetId(chatId)
     if (id === undefined) return { ok: false, error: 'chat_id 不合法（应为 oc_ 开头的群 ID）' }
     const admin = this.config.adminOpenId
-    if (admin === undefined) return { ok: false, error: '请先在常用配置中设置管理员 open_id' }
+    if (admin === undefined) return { ok: false, error: '请先在「访问授权」标签页设置管理员 open_id' }
     try {
       if (!this.accessStore.hasGroup(id)) {
         await this.accessStore.addGroup({
@@ -563,7 +661,7 @@ export class FeishuService {
     const id = this.cleanAccessUserId(openId)
     if (id === undefined) return { ok: false, error: 'open_id 不合法（应以 ou_ 开头）' }
     const admin = this.config.adminOpenId
-    if (admin === undefined) return { ok: false, error: '请先在常用配置中设置管理员 open_id' }
+    if (admin === undefined) return { ok: false, error: '请先在「访问授权」标签页设置管理员 open_id' }
     try {
       if (!this.accessStore.hasUser(id)) {
         await this.accessStore.addUser({
@@ -597,7 +695,7 @@ export class FeishuService {
     const requests = this.accessRequests
     if (requests === undefined) return { ok: false, error: '授权服务尚未启动' }
     const actor = this.config.adminOpenId
-    if (actor === undefined) return { ok: false, error: '请先配置管理员 open_id' }
+    if (actor === undefined) return { ok: false, error: '请先在「访问授权」标签页配置管理员 open_id' }
     try {
       const result = await requests.resolve(token, decision, actor)
       if (!result.ok) return { ok: false, error: result.error }
@@ -623,12 +721,12 @@ export class FeishuService {
     return value
   }
 
-  // ---- workspace retention cleanup -------------------------------------
+  // ---- retention cleanup ------------------------------------------------
 
   /**
-   * Workspace-retention preview for the Web panel: how many plugin-created
-   * workspaces exist, how many are past the configured window, and their
-   * measured footprint. Never deletes anything.
+   * Retention preview for the Web panel: how many plugin workspaces exist,
+   * how many directories are past the configured window, and their measured
+   * footprint. Never deletes anything.
    */
   async cleanupPreview(): Promise<{
     retention: string
@@ -646,6 +744,17 @@ export class FeishuService {
       ...(window === undefined ? {} : { thresholdMs: window }),
       auto: this.config.workspaceRetentionAuto,
     }
+    if (this.domain === undefined) {
+      // No connection: routes live in the closed storage domain, so a preview
+      // would mistake every directory for a candidate. Report why instead.
+      return {
+        ...base,
+        workspaces: 0,
+        candidates: 0,
+        candidateBytes: 0,
+        error: '飞书连接建立后即可预览和清理工作区',
+      }
+    }
     try {
       const workspaces = this.ctx.workspaceRegistry.list().filter(workspace => this.isPluginWorkspace(workspace))
       const plan = await planWorkspaceCleanup(this.cleanupDeps())
@@ -661,37 +770,57 @@ export class FeishuService {
   }
 
   /**
-   * Delete every stale plugin workspace the configured retention allows.
-   * Routes bound to a removed workspace are retired first (thread routes leave
-   * a tombstone), so an old topic fails with the explicit expired card instead
-   * of resuming into a missing directory. DSH Session logs are not touched.
+   * Delete every stale plugin directory the configured retention allows: the
+   * per-topic working directories of current conversations and the legacy
+   * one-workspace-per-topic directories of older versions. User workspaces are
+   * never deleted.
+   *
+   * Active routes bound to a removed directory are retired first (thread
+   * routes leave a tombstone), so an old topic fails with the explicit expired
+   * card instead of resuming into a missing directory. DSH Session logs are not
+   * touched.
    */
   async runWorkspaceCleanup(): Promise<{
     ok: boolean
     deletedWorkspaces: number
+    deletedSessionDirs: number
     retiredRoutes: number
     freedBytes: number
     failures: string[]
     error?: string
   }> {
-    const empty = { ok: false, deletedWorkspaces: 0, retiredRoutes: 0, freedBytes: 0, failures: [] as string[] }
+    const empty = {
+      ok: false,
+      deletedWorkspaces: 0,
+      deletedSessionDirs: 0,
+      retiredRoutes: 0,
+      freedBytes: 0,
+      failures: [] as string[],
+    }
+    if (this.domain === undefined) {
+      // Without the storage domain the route table is unreadable, so a cleanup
+      // could mistake live directories for candidates and fail to retire their
+      // routes. Refuse rather than rely on the panel disabling the button.
+      return { ...empty, error: '飞书连接建立后才能清理工作区' }
+    }
     if (retentionMs(this.config.workspaceRetention) === undefined) {
-      return { ...empty, error: '未启用工作区清理阈值（workspaceRetention 为 off）' }
+      return { ...empty, error: '未启用目录清理阈值（workspaceRetention 为 off）' }
     }
-    if (this.cleanupRunning) return { ...empty, error: '工作区清理正在进行中，请稍候' }
+    if (this.cleanupRunning) return { ...empty, error: '目录清理正在进行中，请稍候' }
     this.cleanupRunning = true
     try {
       const deps = this.cleanupDeps()
       const plan = await planWorkspaceCleanup(deps)
-      if (plan === undefined) return { ...empty, error: '工作区清理不可用：baseDir 配置无效' }
+      if (plan === undefined) return { ...empty, error: '目录清理不可用：baseDir 配置无效' }
       const outcome = await applyWorkspaceCleanup(deps, plan)
       this.ctx.logger?.info?.(
-        'dsh-channels: workspace cleanup removed %d workspace(s), retired %d route(s), freed %d bytes',
-        outcome.deletedWorkspaces, outcome.retiredRoutes, outcome.freedBytes,
+        'dsh-channels: retention cleanup removed %d legacy workspace(s) and %d topic dir(s), retired %d route(s), freed %d bytes',
+        outcome.deletedWorkspaces, outcome.deletedSessionDirs, outcome.retiredRoutes, outcome.freedBytes,
       )
       return {
         ok: true,
         deletedWorkspaces: outcome.deletedWorkspaces,
+        deletedSessionDirs: outcome.deletedSessionDirs,
         retiredRoutes: outcome.retiredRoutes,
         freedBytes: outcome.freedBytes,
         failures: outcome.failures.map(failure => `${failure.path}: ${failure.message}`),
@@ -716,39 +845,27 @@ export class FeishuService {
       baseDir,
       retention: this.config.workspaceRetention,
       listWorkspaces: () => this.ctx.workspaceRegistry.list(),
-      activeRoutes: () => [...(this.domain?.routes.entries() ?? [])].map(([key, record]) => ({
+      listSessionDirs: () => this.listCleanableSessionDirs(baseDir),
+      activeRoutes: () => [...(this.domain?.routes.entries() ?? [])].map(([key, record]): CleanupRoute => ({
         key,
         kind: record.kind,
         workspacePath: record.workspacePath,
+        ...(record.sessionDir === undefined ? {} : { sessionDir: record.sessionDir }),
         sessionId: record.sessionId,
         lastActivityAt: record.lastActivityAt,
       })),
-      tombstones: () => [...(this.domain?.expiredRoutes.entries() ?? [])].map(([key, record]) => ({
+      tombstones: () => [...(this.domain?.expiredRoutes.entries() ?? [])].map(([key, record]): CleanupTombstone => ({
         key,
         ...(record.workspacePath === undefined ? {} : { workspacePath: record.workspacePath }),
+        ...(record.sessionDir === undefined ? {} : { sessionDir: record.sessionDir }),
         expiredAt: record.expiredAt,
         ...(record.lastActivityAt === undefined ? {} : { lastActivityAt: record.lastActivityAt }),
       })),
       isLive: sessionId => this.sessions.get(sessionId) !== undefined
         || this.ctx.agents.get(sessionId as SessionId) !== undefined,
-      statWorkspace: workspacePath => measureWorkspace(workspacePath),
+      statWorkspace: directory => measureWorkspace(directory),
       removeWorkspace: async workspace => {
-        const target = path.resolve(workspace.path)
-        if (!isPathInside(baseDir, target)) {
-          throw new Error(`refusing to delete a path outside baseDir (${target})`)
-        }
-        // Re-verify the physical path: a symlinked ancestor inside baseDir
-        // must not let the recursive delete escape it.
-        try {
-          const [physicalBase, physicalTarget] = await Promise.all([realpath(baseDir), realpath(target)])
-          if (!isPathInside(physicalBase, physicalTarget)) {
-            throw new Error(`refusing to delete a symlink escape outside baseDir (${physicalTarget})`)
-          }
-        } catch (error) {
-          if (error instanceof Error && error.message.startsWith('refusing to delete a symlink escape')) throw error
-          // A missing workspace is already effectively removed (rm is idempotent).
-        }
-        await rm(target, { recursive: true, force: true })
+        await this.deleteDirectoryInsideBase(baseDir, workspace.path)
         try {
           await this.ctx.workspaceRegistry.delete(workspace.id)
         } catch (error) {
@@ -757,6 +874,9 @@ export class FeishuService {
           )
         }
       },
+      removeSessionDir: async directory => {
+        await this.deleteDirectoryInsideBase(baseDir, directory)
+      },
       retireRoute: async route => {
         if (route.kind === 'thread') await this.routes.retire(route.key)
         else await this.routes.remove(route.key)
@@ -765,6 +885,71 @@ export class FeishuService {
     }
   }
 
+  /**
+   * Scan the live user workspaces for per-topic working directories that no
+   * route record points at anymore (for example the old route of a degraded
+   * chat conversation was deleted by TTL retirement). Route/tombstone evidence
+   * wins for age; the scan mtime only covers true orphans.
+   */
+  private async listCleanableSessionDirs(baseDir: string): Promise<ScannedSessionDir[]> {
+    const legacyRoot = legacyTopicWorkspaceRoot(baseDir)
+    const roots: string[] = []
+    for (const workspace of this.ctx.workspaceRegistry.list()) {
+      if (!this.isPluginWorkspace(workspace)) continue
+      const resolved = path.resolve(workspace.path)
+      // Legacy per-topic workspaces are cleaned as workspaces, not scanned here.
+      if (isPathInside(legacyRoot, resolved)) continue
+      roots.push(resolved)
+    }
+    const scanned: ScannedSessionDir[] = []
+    for (const root of roots) {
+      for (const relative of ['topics', path.join('.agents', 'worktrees')]) {
+        const directory = path.join(root, relative)
+        let entries
+        try {
+          entries = await readdir(directory, { withFileTypes: true })
+        } catch {
+          continue
+        }
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue
+          const candidate = path.join(directory, entry.name)
+          try {
+            const info = await lstat(candidate)
+            if (info.isDirectory()) scanned.push({ path: candidate, mtimeMs: info.mtimeMs })
+          } catch {
+            // Removed or unreadable between readdir and lstat; skip it.
+          }
+        }
+      }
+    }
+    return scanned
+  }
+
+  /**
+   * Recursively delete one plugin directory below `baseDir`.
+   *
+   * The lexical check refuses paths outside `baseDir`; the realpath check then
+   * refuses a symlinked ancestor that would let the recursive delete escape
+   * the plugin root. A missing directory is already effectively removed.
+   */
+  private async deleteDirectoryInsideBase(baseDir: string, target: string): Promise<void> {
+    const resolved = path.resolve(target)
+    if (!isPathInside(baseDir, resolved)) {
+      throw new Error(`refusing to delete a path outside baseDir (${resolved})`)
+    }
+    try {
+      const [physicalBase, physicalTarget] = await Promise.all([realpath(baseDir), realpath(resolved)])
+      if (!isPathInside(physicalBase, physicalTarget)) {
+        throw new Error(`refusing to delete a symlink escape outside baseDir (${physicalTarget})`)
+      }
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith('refusing to delete a symlink escape')) throw error
+      // A missing directory is already effectively removed (rm is idempotent).
+    }
+    await rm(resolved, { recursive: true, force: true })
+  }
+
   /**
    * (Re)arm the daily retention timer to match the live config. `runNow`
    * performs one pass immediately; it is only used at startup so saving any
@@ -780,7 +965,7 @@ export class FeishuService {
       || retentionMs(this.config.workspaceRetention) === undefined) return
     const sweep = (): void => {
       void this.runWorkspaceCleanup().then(result => {
-        if (!result.ok && result.error !== '工作区清理正在进行中，请稍候') {
+        if (!result.ok && result.error !== '目录清理正在进行中，请稍候') {
           this.ctx.logger?.warn?.('dsh-channels: automatic workspace cleanup failed: %s', result.error)
         }
       })
@@ -840,6 +1025,7 @@ export class FeishuService {
     } catch (error) {
       throw new Error(`写入凭据引用 ${ref} 失败：${messageOf(error)}`)
     }
+    await this.refreshReadiness()
   }
 
   /** Remove the stored value of one Feishu credential reference. */
@@ -854,6 +1040,7 @@ export class FeishuService {
     } catch (error) {
       throw new Error(`移除凭据引用 ${ref} 失败：${messageOf(error)}`)
     }
+    await this.refreshReadiness()
   }
 
   /** The overlay-independent ref name backing one editable credential slot. */
@@ -957,14 +1144,14 @@ export class FeishuService {
       questions.onCardAction(event)
     })
 
-    this.ctx.on('session/event', (session, event) => {
+    this.unlistenHost.push(this.ctx.on('session/event', (session, event) => {
       this.streamer?.onSessionEvent(session, event)
-    })
+    }))
     // DSH removed the durable `assistant/chunk` event (format v2 embeds the
     // stream in the settlement); the live deltas arrive here instead.
-    this.ctx.on('agent/assistant-stream', ({ agent, frame }) => {
+    this.unlistenHost.push(this.ctx.on('agent/assistant-stream', ({ agent, frame }) => {
       this.streamer?.onAssistantFrame(agent.session, frame)
-    })
+    }))
     this.unlisten = channel.onMessage(message => {
       void this.inbound.handle(message).catch((error: unknown) => {
         this.ctx.logger?.warn?.('dsh-channels inbound error: %s', String(error))
@@ -1053,6 +1240,10 @@ export class FeishuService {
     this.unlistenApproval = undefined
     this.unlistenQuestions?.()
     this.unlistenQuestions = undefined
+    // Host-scoped listeners must be released on every teardown: a failed
+    // connect retry or a reconnect calls `start()` again, and a leaked pair
+    // would feed the same session events into the streamer twice.
+    for (const dispose of this.unlistenHost.splice(0)) dispose()
     // Withdraw in-flight approval questions (the host settles them cancelled).
     this.approvalAnswerer?.dispose()
     this.approvalAnswerer = undefined
@@ -1608,7 +1799,7 @@ export class FeishuService {
       await this.delivery.standaloneReply(msg, buildRenewCard({
         previousSessionId: renewAdmission.commit.previous.sessionId,
         currentSessionId: renewAdmission.commit.current.sessionId,
-        workspacePath: renewAdmission.commit.current.workspacePath,
+        sessionDir: sessionDirOf(renewAdmission.commit.current),
       }))
       return
     }
@@ -1628,7 +1819,7 @@ export class FeishuService {
         context,
         extras: {
           permissionPreset: this.permissionPresetOf(session),
-          workspacePath: current.workspacePath,
+          sessionDir: sessionDirOf(current),
           uptimeMs: this.startedAt === undefined ? undefined : Date.now() - this.startedAt,
           liveAgents: this.sessions.liveCount(),
           routeCount: this.routes.size(),
@@ -1637,7 +1828,10 @@ export class FeishuService {
       return
     }
     if (spec.name === 'workspace' && result.kind === 'success') {
-      const resolved = resolveWorkDir(live.agent.session.header.cwd, current.workspacePath)
+      const resolved = resolveWorkDir(live.agent.session.header.cwd, {
+        workspacePath: current.workspacePath,
+        ...(current.sessionDir === undefined ? {} : { sessionDir: current.sessionDir }),
+      })
       if (resolved.kind === 'success') {
         await this.delivery.standaloneReply(msg, buildWorkDirCard(current.sessionId, resolved.path))
         return