@quecue/dev-notify 0.2.4 → 0.2.6

package/CHANGELOG.en.md

@@ -2,6 +2,23 @@
 
 English | [简体中文](CHANGELOG.md)
 
+## 0.2.6 — 2026-11-07
+
+- Distinguish unavailable session verification from confirmed exit: denied access, query failures, and damaged or incomplete registries pause remote input while retaining unsubmitted queues with their original expiry. New local input still cancels old queues; submitted or unknown-result input is never requeued.
+- Hook readiness checks verify accessible Node/CLI files and POSIX Node execute permission. Status reports missing, denied, or invalid paths without claiming to prove actual hook execution or Windows execution-policy acceptance.
+- Distinguish existing settings locks, denied write access, and other filesystem failures instead of describing permission errors as stale locks.
+- When Windows denies a zero-signal process probe, use the fixed system `tasklist.exe` to confirm the exact PID read-only, avoiding false bridge unreadiness across elevation levels. No elevation or lock preemption; failed queries remain unknown, and only `ESRCH` establishes exit.
+- Report reply-button skips separately for unverifiable sessions, missing state, working sessions, unobserved input, and changed process identity, without weakening input safety checks.
+- Keep the last completed-notification button reason and channel API-acknowledgment summary locally per session so successful hook exit does not discard diagnostics. No body, token, or underlying exception is saved; diagnostic write failures do not trigger resending.
+- Windows x64 / Node 24 regression totals 276 tests: 275 passed, 0 failed, and 1 opt-in native credential test skipped. The user confirmed reply-button recovery when normal and elevated sessions share a bridge; this does not establish acceptance of every terminal-input permission combination, macOS, or the minimum Node version.
+
+## 0.2.5 — 2026-11-07
+
+- Distinguish Telegram `getMe` failures during reply-button preparation, bridge unreadiness, and notification-delivery failures. Retain bounded API error codes and report safe delivery categories and API-acknowledged part counts, without exposing underlying exceptions or server bodies. Do not infer exact send error codes discarded by the communication library.
+- Add isolated regressions for Telegram failure with successful buttonless Feishu delivery, bridge unreadiness with ordinary delivery on both channels, and recovery with buttons on both channels. No new retries, replays, or authorization.
+- Cover explicit channel rejection, unknown exceptions, and successful API delivery followed by local message-mapping failure without incorrectly claiming non-delivery or resending. Windows x64 / Node 24 totals 247 tests: 246 passed, 0 failed, and 1 opt-in native credential test skipped; not macOS real-machine acceptance.
+- This release improves diagnostics; it does not establish or fix the specific cause of historical missing notifications on any particular device.
+
 ## 0.2.4 — 2026-11-07
 
 - Recover valid bot locks belonging to confirmed exited processes so a crashed reply bridge does not permanently remove Reply to Claude buttons. Live processes, reused PIDs, unknown permissions, and damaged locks are not preempted; concurrent recovery is serialized.

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 简体中文 | [English](CHANGELOG.en.md)
 
+## 0.2.6 — 2026-11-07
+
+- 区分会话核验暂不可用与已确认退出：权限拒绝、查询失败、损坏或不完整注册表会暂停远程输入，保留尚未提交队列的原有效期；新本地输入仍取消旧队列，已提交或结果未知的输入绝不重新排队。
+- hooks 就绪检查核验绑定的 Node/CLI 是否为可访问文件，POSIX 还检查 Node 执行权限；状态查询明确报告缺失、权限拒绝和无效路径，但不声称代替真实 hook 执行或 Windows 执行策略验收。
+- 设置写入锁明确区分已有锁、写权限拒绝及其他文件系统错误，不再将权限错误提示为残留锁。
+- Windows 的零信号进程探测被权限拒绝时，使用固定系统 `tasklist.exe` 只读核验精确 PID，避免普通会话将已提权桥接误判为未就绪；不提权、不抢锁，查询失败仍保持未知，只有 `ESRCH` 认定退出。
+- 不再静默跳过回复按钮：分别记录会话无法核验、状态缺失、会话工作中、未观察到输入和进程身份变化，不放宽输入安全检查。
+- 完成通知在本地按会话独立保存最后一次按钮原因和渠道 API 确认摘要，避免 hook 成功退出后丢失排障信息；不保存正文、Token 或原始异常。摘要保存失败不会重发通知。
+- Windows x64／Node 24 回归共 276 项：275 通过、0 失败、1 项显式原生凭据测试跳过。普通权限与已提权会话共享桥接的按钮恢复已由用户实机确认；不代表实际终端输入的所有权限组合、macOS 或最低 Node 版本已完成验收。
+
+## 0.2.5 — 2026-11-07
+
+- 区分回复按钮的 Telegram `getMe` 身份查询失败、桥接未就绪与通知投递失败；保留有界 API 错误码，投递失败显示安全分类及 API 确认分段数，不输出底层异常或服务端正文。通讯库未保留的具体发送错误码不会猜测。
+- 补充 Telegram 失败而飞书成功且无按钮、桥接未就绪仍发送双渠道普通通知、恢复后双渠道带按钮的隔离回归；不新增重试、补发或授权。
+- 补充渠道明确拒绝、未知异常和 API 成功但本地消息映射失败的回归，避免误报未送达或重复发送。Windows x64／Node 24 共 247 项测试：246 通过、0 失败、1 项显式原生凭据测试跳过；不代表 macOS 实机验收。
+- 本版改进故障诊断，不代表已确认或修复某台设备历史漏发的具体根因。
+
 ## 0.2.4 — 2026-11-07
 
 - 修复回复桥接异常退出后残留 Bot 锁导致通知不再出现“回复 Claude”按钮：仅回收格式有效且已确认进程退出的锁；活进程、PID 复用、权限未知或损坏锁均不抢占，并串行化并发恢复。

package/README.en.md

@@ -176,6 +176,10 @@ Stop sends a request through a control file with a random instance identifier an
 
 Authorization is in `<notification config>.reply.json`; messages/sessions/offset/queue/interaction state in `<notification config>.reply-data/`; the bot lock in `reply-bots/` under the data directory shown by `paths`. Queued reply text, questions, tool input, and answers pending return are briefly written to local state; normal reply text is removed before submission; structured interactions are retained until completion or confirmation timeout, after which question, argument, and answer text are cleared, while result receipts and message IDs are retained briefly for feedback and for rejecting old buttons. Validity checks are logical decisions only; files are not automatically erased after shutdown. POSIX uses 0700/0600; Windows relies on account directory ACLs; other processes of the same user can still read them. Do not commit, share, or package these files (already added to ignore rules and kept out of the npm whitelist).
 
+Version 0.2.6 pauses remote input when session identity cannot temporarily be verified, without treating query failure as process exit. Unsubmitted queued replies retain their original 5-minute expiry and resume attempts only after a later lifecycle event verifies the same identity. New local input still cancels old queues; submitted or unknown-result input is never requeued. Hook readiness also checks existing readable Node/CLI files and POSIX Node execute permission. This local snapshot cannot prove Windows execution policy, project/managed policy, or actual event execution. Settings-lock permission failures are reported separately from existing locks.
+
+Version 0.2.6 saves the last completed-notification diagnostic per session at `<notification config>.reply-data/notification-diagnostics/<session ID>.json`, containing the timestamp, button reason code, and channel API-acknowledgment summaries, but no body, recipient, token, or underlying exception. It is not a historical message queue and is not used for replay. Sessions do not overwrite each other; each session retains the last written snapshot. Files are not automatically expired or deleted; clear them manually with the dedicated reply state. Windows still relies on directory ACLs.
+
 Force-kill may leave locks. Version 0.2.4 can recover a valid bot lock at startup only after confirming its PID no longer exists. Unknown permissions, PIDs reused by a live process, damaged locks, and leftover `.recover` recovery gates fail closed. Other locks such as state-write locks are not recovered automatically; confirm their owning process has exited before handling them manually. Never delete a live process's lock. `reply disable` does not delete historical state on its own; to clear it, first disable or stop, then manually delete the dedicated files after confirmation. Clearing credentials, removing hooks, and deleting reply state are three independent operations.
 
 ## System credentials and compatibility
@@ -314,9 +318,9 @@ For other CLI examples, replace `dev-notify` with `node dist/cli.js`; no global
 
 `node-src/` is TypeScript source, `dist/` is compiled output, and `test-js/` is tests. Default tests use only fake credentials and mock backends/network; the local native fake-entry round-trip test requires explicitly setting `DEV_NOTIFY_NATIVE_TEST=1`, is enabled only on Windows, uses random IDs, and cleans up afterward.
 
-For the 0.2.4 source, the package whitelist includes only this application's compiled CLI JavaScript, README, SECURITY, CHANGELOG, LICENSE and package.json. Library copies, tests, real configuration, ciphertext and dependency tarballs are excluded. npm resolves runtime dependencies separately. Published package contents depend on the corresponding version. There is no postinstall, auto-start, or self-written download script; prebuilt native dependencies are resolved by npm's platform optional packages, **do not use `--omit=optional`**. macOS x64/arm64 and Windows x64/arm64 prebuilt packages are provided by dependencies; providing packages does not mean this project has completed real-machine acceptance.
+For the 0.2.6 source, the package whitelist includes only this application's compiled CLI JavaScript, README, SECURITY, CHANGELOG, LICENSE and package.json. Library copies, tests, real configuration, ciphertext and dependency tarballs are excluded. npm resolves runtime dependencies separately. Published package contents depend on the corresponding version. There is no postinstall, auto-start, or self-written download script; prebuilt native dependencies are resolved by npm's platform optional packages, **do not use `--omit=optional`**. macOS x64/arm64 and Windows x64/arm64 prebuilt packages are provided by dependencies; providing packages does not mean this project has completed real-machine acceptance.
 
-See [CHANGELOG.en.md](CHANGELOG.en.md) for verification results of published versions. The regression record for the 0.2.4 source on Windows x64 with Node 24 is 237 tests: 236 passed, 0 failed, and 1 opt-in native credential test skipped. This record does not establish real-machine acceptance on every platform.
+See [CHANGELOG.en.md](CHANGELOG.en.md) for verification results of published versions. The regression record for the 0.2.6 source on Windows x64 with Node 24 is 276 tests: 275 passed, 0 failed, and 1 opt-in native credential test skipped. This record does not establish real-machine acceptance on every platform.
 
 Automated coverage includes temporary hooks, reply/authorization/expiry/anti-replay, single-select/multi-select/custom input, one-time permission JSON, two-sided races, feedback exceptions, and per-recipient duplicate reminder suppression. The actual CLI subprocess completes the loop of background start → PreToolUse registration → PermissionRequest → fake bot button → JSON answer → simulated PostToolUse → final feedback → notification deduplication/subsequent tool reminder → stop; this loop uses mock network and process metadata and cannot replace real-machine input verification. Automated tests for the Windows native input helper class only verify compilation/layout and do not perform a real Send.
 

package/README.md

@@ -176,6 +176,10 @@ dev-notify reply run        # 前台诊断启动/网络问题，不与 start 实
 
 授权在 `<通知配置>.reply.json`，消息/会话/offset/队列/交互状态在 `<通知配置>.reply-data/`；Bot 锁在 `paths` 所示 data 目录的 `reply-bots/`。排队回复原文、问题、工具输入和待回传答案会短暂写入本地状态；提交前会移除普通回复原文；结构化交互保留到完成或确认超时，随后清除问题、参数与答案正文，短期保留结果收据和消息 ID，用于反馈及拒绝旧按钮。有效期检查只是逻辑判断，停机后文件不会自动擦除。POSIX 使用 0700/0600，Windows 依赖账号目录 ACL；同一用户的其他进程仍然可以读取。请不要提交、共享或打包这些文件（已加入忽略规则及 npm 白名单）。
 
+0.2.6 在会话身份暂时无法核验时暂停远程输入，不把查询失败当作进程退出；尚未提交的排队回复保留原有 5 分钟有效期，仅在后续生命周期事件重新核验同一身份后恢复尝试。新的本地输入仍取消旧队列；已提交或结果未知的输入不会重新排队。hooks 就绪检查还核验 Node/CLI 文件存在、可读及 POSIX Node 执行权限；这只是本地快照，不保证 Windows 执行策略、项目/托管策略或真实事件执行成功。设置锁的权限错误与已有锁会分别报告。
+
+0.2.6 会在 `<通知配置>.reply-data/notification-diagnostics/<会话 ID>.json` 保存每个会话最后一份完成通知诊断，包含时间、按钮原因代码和渠道 API 确认摘要，不包含正文、收件人、Token 或原始异常。该记录不是历史消息队列，不用于补发；不同会话互不覆盖，同一会话保留最后写入的一份。文件不会自动过期删除，随专属回复状态一起人工清理；Windows 仍依赖目录 ACL。
+
 强杀可能留下锁。0.2.4可在启动时自动回收有效 Bot 锁，但必须先确认原 PID 已不存在；权限未知、PID 复用为活进程、坏锁及残留 `.recover` 恢复门闩一律保守拒绝。状态写入锁等其他锁不自动回收，需先确认对应进程已退出再人工处理。不能在进程运行时删除锁。`reply disable` 不会擅自删除历史状态；需要清除时，请先禁用或停止，确认后手工删除上述专属文件。清理凭据、移除 hooks 和删除回复状态是三项独立操作。
 
 ## 系统凭据与兼容性
@@ -314,9 +318,9 @@ npm pack --dry-run
 
 `node-src/` 是 TypeScript 源码，`dist/` 是编译输出，`test-js/` 是测试。默认测试只用假凭据和模拟后端/网络；本机原生假条目往返测试需显式设置 `DEV_NOTIFY_NATIVE_TEST=1`，且只在 Windows 启用，使用随机 ID，结束后清理。
 
-0.2.4 源码的 npm 白名单仅包含本应用 CLI 编译 JS、README、SECURITY、CHANGELOG、LICENSE 和 package.json；不包含通讯库副本、测试、真实配置、密文或依赖 tarball。运行时依赖由 npm 单独解析。已发布版本的包内容以对应版本为准。没有 postinstall、自动启动或自写下载脚本；预编译原生依赖由 npm 的平台 optional 包解析，**请勿使用 `--omit=optional`**。macOS x64/arm64 和 Windows x64/arm64 预编译包由依赖提供，提供包并不等同于本项目已完成实机验收。
+0.2.6 源码的 npm 白名单仅包含本应用 CLI 编译 JS、README、SECURITY、CHANGELOG、LICENSE 和 package.json；不包含通讯库副本、测试、真实配置、密文或依赖 tarball。运行时依赖由 npm 单独解析。已发布版本的包内容以对应版本为准。没有 postinstall、自动启动或自写下载脚本；预编译原生依赖由 npm 的平台 optional 包解析，**请勿使用 `--omit=optional`**。macOS x64/arm64 和 Windows x64/arm64 预编译包由依赖提供，提供包并不等同于本项目已完成实机验收。
 
-各已发布版本的验证结果见 [CHANGELOG.md](CHANGELOG.md)。0.2.4 源码在 Windows x64、Node 24 下的回归记录为 237 项：236 通过、0 失败、1 项需显式启用的原生凭据测试跳过；该记录不代表所有平台的实机验收。
+各已发布版本的验证结果见 [CHANGELOG.md](CHANGELOG.md)。0.2.6 源码在 Windows x64、Node 24 下的回归记录为 276 项：275 通过、0 失败、1 项需显式启用的原生凭据测试跳过；该记录不代表所有平台的实机验收。
 
 自动化覆盖临时 hooks、回复/授权/过期/防重放、单选/多选/自定义、单次权限 JSON、双端竞争、反馈异常及按接收人的重复提醒去重。实际 CLI 子进程完成后台 start → PreToolUse 登记 → PermissionRequest → 假 Bot 按钮 → JSON 答案 → 模拟 PostToolUse → 最终反馈 → 通知去重/后续工具提醒 → stop；该闭环使用模拟网络和进程元数据，不能替代实机输入验证。Windows 原生输入帮助类的自动化测试只做编译/布局验证，不会执行真实 Send。
 

package/SECURITY.en.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](SECURITY.md)
 
-The npm package name is `@quecue/dev-notify`, with public source at [QueCue/dev-notify](https://github.com/QueCue/dev-notify). Published versions are authoritative on the npm registry; this document describes the dependency range and security boundaries of 0.2.4, and a source version alone does not establish that an installation package has been published. This project has not completed a security audit or real-machine acceptance on both platforms.
+The npm package name is `@quecue/dev-notify`, with public source at [QueCue/dev-notify](https://github.com/QueCue/dev-notify). Published versions are authoritative on the npm registry; this document describes the dependency range and security boundaries of 0.2.6, and a source version alone does not establish that an installation package has been published. This project has not completed a security audit or real-machine acceptance on both platforms.
 
 ## Communication dependency in current source
 
@@ -54,6 +54,7 @@ Reusing a dependency does not automatically share credentials or authorization,
 
 - `reply setup` separately selects an explicit private-chat chat_id, which must be in the current notification list; group chats, non-private chats, senders whose chat_id does not match, bot messages, and unauthorized notification recipients do not gain input rights. Feishu provides only a Telegram deep link; knowing the link does not constitute authorization. `/chatid` only returns the sender's own private-chat ID and does not grant permission.
 - Authorization is bound to the bot fingerprint, random generation, current valid user, and optional permission capability. Switching the token, revoking users, or re-authorizing does not inherit old routing; authorization is re-read before operations and before submission. Revocation cannot withdraw native input that has already started, nor eliminate every race between checking and calling.
+- Version 0.2.6 also checks accessible Node/CLI hook files and POSIX Node execute permission, without executing those files as a probe. This cannot guarantee Windows execution-policy acceptance or actual loading by a running session. Unavailable session verification marks the session unverified and pauses buttons, input, and permission return without deleting unsubmitted queues; original expiry, new-local-input cancellation, explicit end, and anti-replay rules remain. Already registered submissions are not requeued after a subsequent query failure.
 - Every authorization read checks the complete hooks bound to the current notification configuration; when lifecycle events are missing, Stop is asynchronous, or user-level hooks are disabled, replies are refused. Normal input also requires actually observing the session's UserPromptSubmit. User-level file checks cannot prove project/managed policy or that a running session has loaded the hooks; confirm in `/hooks`. No promise is made to eliminate all runtime races.
 - After each segment is sent successfully, the message ID is saved to the session mapping; mapping failure reports partial failure and does not resend already-sent segments. The session must match PID/birth identifier/TTY; submission is refused on session switch, closure, or a non-unique target. Supported scope is only the Windows native claude console and macOS foreground claude with Ghostty/tmux; no routing guesses are made for WSL/SSH/VS Code terminals.
 - Normal replies are only queued while Claude is working and are attempted after Stop; they are canceled on 5-minute expiry, new local input, or a target change. A single reply is at most 4000 Unicode characters; control characters and newlines are stripped and the text is entered once; it is not shell-executed, not truncated, and not automatically split into multiple tasks. Input is refused when the console is shared and multiple claude processes exist; a local user editing or switching terminals at the same time may still race, and native input and UI activity are not atomically mutually exclusive.
@@ -72,7 +73,7 @@ Reusing a dependency does not automatically share credentials or authorization,
 ## npm and testing
 
 - Runtime has a native credential dependency, with the version and platform optional packages pinned in `package-lock.json`. Keep optional dependencies. There is no postinstall, self-written binary download, or background startup script.
-- For the 0.2.4 source, the npm whitelist includes only this application's compiled CLI JS, README, SECURITY, CHANGELOG, LICENSE and package.json. Library copies, tests, real configuration, logs, ciphertext and dependency tarballs are excluded. Published versions are governed by their actual package contents.
+- For the 0.2.6 source, the npm whitelist includes only this application's compiled CLI JS, README, SECURITY, CHANGELOG, LICENSE and package.json. Library copies, tests, real configuration, logs, ciphertext and dependency tarballs are excluded. Published versions are governed by their actual package contents.
 - Third-party native packages carry their own licenses and Rust dependency declarations. Check the supply chain and licenses for releases and dependency upgrades; pinned versions are not equivalent to a completed audit.
 - Default tests use fake credentials, temporary directories, and mock system backends/network. `DEV_NOTIFY_NATIVE_TEST=1` explicitly enables Windows native tests, creates only fake entries with random IDs for this run, cleans up afterward, and does not read the user's existing entries.
 - npm uninstall does not automatically delete user configuration or credentials. To clean up, first run the interactive cleanup command; uninstall lifecycle scripts will not secretly manipulate the user's system storage.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 简体中文 | [English](SECURITY.en.md)
 
-npm 包名为 `@quecue/dev-notify`，公开源码见 [QueCue/dev-notify](https://github.com/QueCue/dev-notify)。发布版本以 npm registry 为准，本文描述 0.2.4 的依赖范围与安全边界，不能仅依据源码版本认定安装包已发布。本项目尚未完成安全审计或双平台实机验收。
+npm 包名为 `@quecue/dev-notify`，公开源码见 [QueCue/dev-notify](https://github.com/QueCue/dev-notify)。发布版本以 npm registry 为准，本文描述 0.2.6 的依赖范围与安全边界，不能仅依据源码版本认定安装包已发布。本项目尚未完成安全审计或双平台实机验收。
 
 ## 当前源码的通讯层依赖
 
@@ -54,6 +54,7 @@ npm 包名为 `@quecue/dev-notify`，公开源码见 [QueCue/dev-notify](https:/
 
 - `reply setup` 单独选择明确的私聊 chat_id，且必须在当前通知名单中；群聊、非私聊、发送者与 chat_id 不一致、Bot 消息和未授权的通知接收人都不会获得输入权。飞书只提供 Telegram deep link，知道链接并不构成授权。`/chatid` 只返回发件人本人的私聊 ID，不授予权限。
 - 授权绑定 Bot 指纹、随机代次、当前有效用户及可选的权限能力。切换 Token、撤销用户或重新授权时，不会继承旧路由；操作前及提交前都会重读授权。撤销无法撤回已经开始的原生输入，也无法消除检查与调用之间的全部竞态。
+- 0.2.6 源码还检查 hooks 的 Node/CLI 文件可访问性及 POSIX Node 执行权限，但不执行这些文件来探测，不能保证 Windows 执行策略或运行会话实际加载。会话查询暂不可用时标记为未核验并暂停按钮、输入及权限回传，不以此删除未提交队列；原有效期、新本地输入取消、明确结束和防重放规则仍生效。已登记提交的输入即使随后查询失败也不会重新排队。
 - 每次读取授权都会检查绑定当前通知配置的完整 hooks；缺少生命周期、Stop 异步或用户级禁用时，会拒绝回复。普通输入还要求实际观察到该会话的 UserPromptSubmit。用户级文件检查无法证明项目/托管策略或运行会话已经加载，请在 `/hooks` 确认；不会承诺消除所有运行时竞态。
 - 消息每段发送成功后，会把消息 ID 保存到会话映射；映射失败会报告部分失败，不会重发已发送的段落。会话必须匹配 PID/出生标识/TTY；会话切换、关闭、目标不唯一时会拒绝。支持范围仅 Windows 原生 claude 控制台、macOS 前台 claude 的 Ghostty/tmux；不会为 WSL/SSH/VS Code 等终端猜测路由。
 - 普通回复在工作中只排队，Stop 后再尝试；5 分钟过期、本地新输入或目标变化会取消。单条最多 4000 Unicode 字符，清理控制字符/换行后一次输入；不会按 shell 执行，不会截断，也不会自动拆成多个任务。控制台共享且有多个 claude 进程时会拒绝；本地用户同时编辑或切换终端仍可能竞争，原生输入与 UI 活动并非原子互斥。
@@ -72,7 +73,7 @@ npm 包名为 `@quecue/dev-notify`，公开源码见 [QueCue/dev-notify](https:/
 ## npm 与测试
 
 - 运行时有原生凭据依赖，版本和平台 optional 包锁定于 `package-lock.json`。请保留 optional 依赖。项目没有 postinstall、自写二进制下载或后台启动脚本。
-- 0.2.4 源码的 npm 白名单仅包含本应用 CLI 编译 JS、README、SECURITY、CHANGELOG、LICENSE 和 package.json。通讯库副本、测试、真实配置、日志、密文及依赖 tarball 不进入发布包；已发布版本以实际包内容为准。
+- 0.2.6 源码的 npm 白名单仅包含本应用 CLI 编译 JS、README、SECURITY、CHANGELOG、LICENSE 和 package.json。通讯库副本、测试、真实配置、日志、密文及依赖 tarball 不进入发布包；已发布版本以实际包内容为准。
 - 第三方原生包带有其许可证与 Rust 依赖声明。发布及依赖升级时应核对供应链和许可；固定版本并不等同于完成审计。
 - 默认测试使用假凭据、临时目录和模拟系统后端、网络。`DEV_NOTIFY_NATIVE_TEST=1` 会显式开启 Windows 原生测试，只创建本次随机 ID 的假条目，结束后清理，不读取用户现有条目。
 - npm 卸载不会自动删除用户配置或凭据。需要清理时，请先运行交互清理命令；卸载生命周期脚本不会偷偷操作用户的系统存储。

package/dist/claude-code.js

@@ -1,4 +1,5 @@
-import { readFile, mkdir, open, rename, unlink } from 'node:fs/promises';
+import { readFile, mkdir, open, rename, unlink, stat, access } from 'node:fs/promises';
+import { constants } from 'node:fs';
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -62,7 +63,8 @@ function owned(hook) {
         && hook.args[4] === '--config' && typeof hook.args[5] === 'string';
 }
 function describe(file, data) {
-    const result = { file, stop: 0, notification: 0, lifecycle: 0, interaction: 0, others: 0, disabled: data.disableAllHooks === true, configs: [] };
+    const result = { file, stop: 0, notification: 0, lifecycle: 0, interaction: 0, others: 0, disabled: data.disableAllHooks === true,
+        configs: [], runtimeIssues: [] };
     for (const event of EVENTS)
         for (const group of data.hooks?.[event] ?? [])
             for (const hook of group.hooks) {
@@ -83,9 +85,48 @@ function describe(file, data) {
             }
     return result;
 }
+async function runtimeIssues(data, options, config) {
+    const issues = [], checked = new Map();
+    const platform = options.platform ?? process.platform, paths = platform === 'win32' ? path.win32 : path.posix;
+    const normalize = (file) => platform === 'win32' ? path.resolve(file).toLowerCase() : path.resolve(file);
+    for (const event of EVENTS)
+        for (const group of data.hooks?.[event] ?? [])
+            for (const hook of group.hooks) {
+                if (!owned(hook) || config !== undefined && normalize(hook.args[5]) !== normalize(config))
+                    continue;
+                for (const [kind, file] of [['node', hook.command], ['cli', hook.args[0]]]) {
+                    const key = JSON.stringify([kind, file]);
+                    if (!checked.has(key)) {
+                        let reason = null;
+                        if (typeof file !== 'string' || !paths.isAbsolute(file))
+                            reason = 'invalid';
+                        else
+                            try {
+                                if (!(await stat(file)).isFile())
+                                    reason = 'invalid';
+                                else {
+                                    await (options.runtimeAccess ?? access)(file, constants.R_OK | (kind === 'node' && platform !== 'win32' ? constants.X_OK : 0));
+                                    // Windows access() 不足以验证 ACL；仅打开后关闭，不读取文件正文或执行程序。
+                                    const handle = await open(file, 'r');
+                                    await handle.close();
+                                }
+                            }
+                            catch (error) {
+                                const code = error.code;
+                                reason = code === 'ENOENT' || code === 'ENOTDIR' ? 'missing' : code === 'EACCES' || code === 'EPERM' ? 'denied' : 'unavailable';
+                            }
+                        checked.set(key, reason);
+                    }
+                    const reason = checked.get(key);
+                    if (reason)
+                        issues.push({ event, kind, reason });
+                }
+            }
+    return issues;
+}
 export async function claudeCodeStatus(options = {}) {
-    const file = settingsFile(options);
-    return describe(file, parseSettings(await snapshot(file)));
+    const file = settingsFile(options), data = parseSettings(await snapshot(file));
+    return { ...describe(file, data), runtimeIssues: await runtimeIssues(data, options) };
 }
 export async function replyHooksReady(config, options = {}) {
     const data = parseSettings(await snapshot(settingsFile(options)));
@@ -102,7 +143,7 @@ export async function replyHooksReady(config, options = {}) {
             && group.hooks.includes(matches[0])))
             return false;
     }
-    return true;
+    return (await runtimeIssues(data, options, config)).length === 0;
 }
 function merged(data, config, runtime) {
     const target = structuredClone(data);
@@ -145,15 +186,21 @@ async function remove(file) {
             throw error;
     }
 }
-async function commit(file, before, target, prompts, replace = rename) {
-    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+async function commit(file, before, target, prompts, replace = rename, lockOpen = open) {
+    try {
+        await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    }
+    catch (error) {
+        throw new ConfigError(t(['EACCES', 'EPERM'].includes(error.code ?? '') ? 'claude.settingsWriteDenied' : 'claude.lockFailed'));
+    }
     const lockFile = file + '.dev-notify.lock';
     let lock;
     try {
-        lock = await open(lockFile, 'wx', 0o600);
+        lock = await lockOpen(lockFile, 'wx', 0o600);
     }
-    catch {
-        throw new ConfigError(t('claude.lockUnavailable'));
+    catch (error) {
+        const code = error.code;
+        throw new ConfigError(t(code === 'EEXIST' ? 'claude.lockUnavailable' : code === 'EACCES' || code === 'EPERM' ? 'claude.settingsWriteDenied' : 'claude.lockFailed'));
     }
     const temporary = path.join(path.dirname(file), `.dev-notify-${randomBytes(16).toString('hex')}.tmp`);
     let created = false;
@@ -231,7 +278,7 @@ export async function configureClaudeCode(config, action, prompts, options = {})
         prompts.out(t('claude.cancelled'));
         return false;
     }
-    await commit(file, before, target, prompts, options.replace);
+    await commit(file, before, target, prompts, options.replace, options.lockOpen);
     prompts.out(action === 'install' ? t('claude.installed') : t('claude.removed'));
     return true;
 }

package/dist/claude-hook.js

@@ -6,6 +6,7 @@ import { t } from './i18n.js';
 import { shouldNotify } from './notifications.js';
 import { transcriptEndTime } from './hook-time.js';
 import { findSessionName } from './reply-platform.js';
+import { ReplyPreparationError, safeDeliveryReason, safeFailureReason, saveNotificationDiagnostic } from './notification-diagnostics.js';
 import { lifecycleHook, interactionHook, attachReply, mapReplies, notificationCoverage } from './reply-hooks.js';
 export const MAX_HOOK_BYTES = 8 * 1024 * 1024;
 export async function readHookInput(input = process.stdin, limit = MAX_HOOK_BYTES) {
@@ -97,7 +98,9 @@ export async function dispatchClaudeHook(bytes, configFile, context) {
     const message = claudeHookMessage(bytes);
     const data = JSON.parse(decodeUtf8(bytes));
     const now = context.now?.() ?? new Date();
-    const options = { send: context.send, ...context.reply, env: context.env, err: context.err, response: context.response };
+    const diagnostic = { version: 1, updated: now.getTime(), reply: 'not-attempted', channels: {} };
+    const options = { send: context.send, ...context.reply, env: context.env, err: context.err, response: context.response,
+        replyDiagnostic: (code) => { diagnostic.reply = code; context.reply?.replyDiagnostic?.(code); } };
     try {
         await lifecycleHook(data, configFile, options);
         await interactionHook(data, configFile, options);
@@ -139,8 +142,10 @@ export async function dispatchClaudeHook(bytes, configFile, context) {
     try {
         binding = await attachReply(notification, data, configFile, options);
     }
-    catch {
-        context.err(t('hook.replyNotReady'));
+    catch (error) {
+        diagnostic.reply = error instanceof ReplyPreparationError ? 'getme-failed' : 'check-failed';
+        diagnostic.replyReason = error instanceof ReplyPreparationError ? error.message : safeFailureReason(error);
+        context.err(error instanceof ReplyPreparationError ? error.message : t('hook.replyNotReady'));
     }
     let covered = { telegram: [], feishu: false };
     try {
@@ -167,11 +172,25 @@ export async function dispatchClaudeHook(bytes, configFile, context) {
             if (binding)
                 mapReplies(plan, binding);
             const result = await context.send(plan, config);
+            diagnostic.channels[channel] = { status: result.ok ? 'complete' : 'incomplete', sent: result.sent, planned: result.planned,
+                ...(!result.ok ? { reason: safeDeliveryReason(result.error) } : {}) };
             if (!result.ok)
-                context.err(t('hook.sendIncomplete', { channel }));
+                context.err(t('hook.sendIncompleteDetail', {
+                    channel, sent: result.sent, planned: result.planned, reason: safeDeliveryReason(result.error),
+                }));
+        }
+        catch (error) {
+            diagnostic.channels[channel] = { status: 'failed', reason: safeFailureReason(error) };
+            context.err(t('hook.sendFailedDetail', { channel, reason: safeFailureReason(error) }));
+        }
+    }
+    if (data.hook_event_name === 'Stop') {
+        diagnostic.updated = Date.now();
+        try {
+            await saveNotificationDiagnostic(configFile, data.session_id, diagnostic);
         }
         catch {
-            context.err(t('hook.sendFailed', { channel }));
+            context.err(t('hook.diagnosticWriteFailed'));
         }
     }
     if (!channels)

package/dist/cli.js

@@ -16,7 +16,7 @@ import { startBridge, stopBridge, bridgeStatus, runBridge } from './reply-bridge
 import { updatePackage } from './update.js';
 import { postUpdate } from './maintenance.js';
 import { localeName, parseLocale, resolveLocale, setLocale, t } from './i18n.js';
-export const VERSION = '0.2.4';
+export const VERSION = '0.2.6';
 const helpText = () => t('cli.help', { version: VERSION });
 function rawLang(argv) {
     for (let i = 0; i < argv.length; i++) {
@@ -147,8 +147,10 @@ export async function main(argv = process.argv.slice(2), overrides = {}) {
                 context.out(t('cli.integrationStatusFile', { file: status.file }));
                 context.out(t('cli.integrationStatusCounts', { stop: status.stop, notification: status.notification,
                     lifecycle: status.lifecycle, interaction: status.interaction, others: status.others }));
+                for (const issue of status.runtimeIssues)
+                    context.out(t('cli.integrationRuntimeIssue', { event: issue.event, kind: issue.kind, reason: issue.reason }));
                 context.out(status.disabled ? t('cli.integrationDisabled') : t('cli.integrationStatusNote'));
-                return status.stop === 1 && status.notification === 1 && status.lifecycle === 3 && status.interaction === 5 && !status.disabled ? 0 : 1;
+                return status.stop === 1 && status.notification === 1 && status.lifecycle === 3 && status.interaction === 5 && !status.disabled && !status.runtimeIssues.length ? 0 : 1;
             }
             const prompts = context.prompts ?? (values.yes
                 ? { out: context.out, text: async () => '', secret: async () => '' }

package/dist/i18n.js

@@ -266,7 +266,11 @@ const zh = {
     'claude.settingsInvalidJson': 'Claude Code 设置不是合法的 UTF-8 JSON，没有覆盖。',
     'claude.settingsInvalidShape': 'Claude Code 设置或 hooks 结构无效，没有覆盖。',
     'claude.hooksInvalidShape': 'Claude Code hook 数组结构无效，没有覆盖。',
-    'claude.lockUnavailable': '暂时无法获取 Claude Code 设置写入锁。请确认没有安装进程在运行，再处理残留的 .dev-notify.lock。',
+    'claude.lockUnavailable': 'Claude Code 设置写入锁已存在。请确认没有安装进程在运行，再核实是否为残留的 .dev-notify.lock。',
+    'claude.settingsWriteDenied': '没有权限写入 Claude Code 设置目录或创建锁文件；设置未改动。请检查目录所有者和访问权限，不要据此删除锁或自动提权。',
+    'claude.lockFailed': '无法准备 Claude Code 设置写入目录或锁文件；设置未改动。请检查路径、磁盘和文件系统状态，不将此错误当作残留锁。',
+    'cli.integrationRuntimeIssue': '{event} hook 的 {kind} 入口不可用（原因代码：{reason}）；不会判为就绪，请修复安装路径或访问权限。',
+    'reply.sessionUnavailable': '暂时无法可靠核验会话（可能为权限不足或查询异常）；暂停远程输入，不将其认定为会话已退出。未提交的排队回复仅保留至原有效期，新本地输入仍会取消它。',
     'claude.changedDuringConfirm': 'Claude Code 设置在确认期间发生了变化，没有覆盖，请重试。',
     'claude.changedDuringSave': 'Claude Code 设置在保存期间发生了变化，没有覆盖，请重试。',
     'claude.tempCleanupFailed': '临时文件清理失败。安装结束后请删除 .dev-notify-*.tmp。',
@@ -305,7 +309,18 @@ const zh = {
     'hook.notificationFallback': 'Claude Code 正在等待你的确认或输入，请回到终端处理。',
     'hook.interactionFailed': 'Claude Code 的回复状态或交互处理失败。没有自动选择答案或批准权限，请在本机处理。',
     'hook.sessionNameFailed': '读取不到 Claude Code 会话名称，通知底部将省略主题。',
-    'hook.replyNotReady': '远程回复还没有就绪，仍会尝试发送普通通知。',
+    'hook.replyNotReady': '回复按钮准备失败（会话、授权、本地状态或桥接检查）；仍会尝试向各渠道发送普通通知，不代表 Telegram 已送达。',
+    'hook.replyIdentityFailed': '回复按钮准备失败：Telegram getMe 身份查询失败（{reason}）；仍会尝试发送不带按钮的普通通知。',
+    'hook.diagnosticWriteFailed': '本次通知的本地诊断摘要未能保存；不影响已发送的通知，不会因此重发。',
+    'reply.buttonSkipped': '本次通知不带回复按钮（原因代码：{reason}）；会话身份及输入跟踪检查没有放宽。',
+    'hook.sendIncompleteDetail': '{channel}：通知投递或发送后处理未全部完成（API 确认 {sent}/{planned} 段；{reason}）。整条消息不会自动重发。',
+    'hook.sendFailedDetail': '{channel}：通知发送流程失败（{reason}）。整条消息不会自动重发。',
+    'diagnostic.network': '网络请求失败或响应无效（可能为超时或连接异常，无法进一步区分）',
+    'diagnostic.rejected': '渠道明确拒绝请求（当前接口未保留具体错误码）',
+    'diagnostic.unknown': '原因未分类；为避免泄密，不显示底层错误',
+    'diagnostic.telegramCode': 'Telegram API 错误码 {code}',
+    'diagnostic.telegramUnknown': 'Telegram API 返回失败，错误码未知',
+    'diagnostic.httpCode': 'HTTP 状态码 {code}',
     'hook.coverageFailed': '没有核验到选择题通知的覆盖情况，将保留普通权限提醒。',
     'hook.sendIncomplete': '{channel}：Claude Code 通知没有完整发送。整条消息不会自动重发。',
     'hook.sendFailed': '{channel}：Claude Code 通知发送失败。请检查配置、系统凭据和网络；整条消息不会自动重发。',
@@ -314,7 +329,7 @@ const zh = {
     'reply.lockUnavailable': '无法获取回复状态写入锁。',
     'reply.lockBusy': '回复状态锁正忙。请确认相关进程已经退出，再处理残留锁。',
     'reply.invalidPolicy': '回复授权配置无效，远程输入已停用。',
-    'reply.hooksMissing': '回复所需的 hooks 缺失、时序不安全或已禁用。请重新运行 integration claude-code install，并在 /hooks 中确认加载。',
+    'reply.hooksMissing': '回复所需的 hooks 缺失、入口不可访问、时序不安全或已禁用。请重新运行 integration claude-code install，并在 /hooks 中确认加载。',
     'reply.botChanged': 'Telegram Bot 已变更或不可用，请重新运行 reply setup 授权。',
     'reply.usersRevoked': '授权用户不在当前 Telegram 接收名单中，远程输入已停用。',
     'reply.authorizationChanged': '回复授权已撤销或发生变化，没有写入旧状态。',
@@ -764,7 +779,11 @@ secrets are never written in plaintext.`,
     'claude.settingsInvalidJson': 'Claude Code settings are not valid UTF-8 JSON and were not overwritten.',
     'claude.settingsInvalidShape': 'Claude Code settings or hooks structure is invalid and was not overwritten.',
     'claude.hooksInvalidShape': 'The Claude Code hook array structure is invalid and was not overwritten.',
-    'claude.lockUnavailable': 'Could not acquire the Claude Code settings write lock. Confirm no installation process is running, then handle a leftover .dev-notify.lock.',
+    'claude.lockUnavailable': 'The Claude Code settings write lock already exists. Confirm no installation process is running, then verify whether .dev-notify.lock is stale.',
+    'claude.settingsWriteDenied': 'Permission denied writing the Claude Code settings directory or creating its lock. Settings were not changed. Check ownership and access; do not delete locks or elevate automatically.',
+    'claude.lockFailed': 'Could not prepare the Claude Code settings directory or write lock. Settings were not changed. Check paths, disk, and filesystem state; this does not establish a stale lock.',
+    'cli.integrationRuntimeIssue': 'The {event} hook {kind} entry is unavailable (reason code: {reason}); it is not ready. Repair its installation path or access permissions.',
+    'reply.sessionUnavailable': 'The session cannot currently be verified reliably (possibly permissions or a query failure). Remote input is paused; this is not considered session exit. Unsubmitted queued replies retain their original expiry and are still canceled by new local input.',
     'claude.changedDuringConfirm': 'Claude Code settings changed during confirmation and were not overwritten. Try again.',
     'claude.changedDuringSave': 'Claude Code settings changed while saving and were not overwritten. Try again.',
     'claude.tempCleanupFailed': 'Temporary file cleanup failed. Delete .dev-notify-*.tmp after installation.',
@@ -803,7 +822,18 @@ secrets are never written in plaintext.`,
     'hook.notificationFallback': 'Claude Code is waiting for your confirmation or input. Return to the terminal to handle it.',
     'hook.interactionFailed': 'Claude Code reply state or interaction handling failed. No answer or permission was selected automatically; handle it locally.',
     'hook.sessionNameFailed': 'Could not read the Claude Code session name; the topic will be omitted from the notification footer.',
-    'hook.replyNotReady': 'Remote replies are not ready yet; a normal notification will still be attempted.',
+    'hook.replyNotReady': 'Reply button preparation failed during session, authorization, local-state, or bridge checks; normal notifications will still be attempted on each channel. This does not mean Telegram delivery succeeded.',
+    'hook.replyIdentityFailed': 'Reply button preparation failed: Telegram getMe identity lookup failed ({reason}); normal notifications without buttons will still be attempted.',
+    'hook.diagnosticWriteFailed': 'Could not save the local diagnostic summary. Sent notifications are unaffected and will not be resent.',
+    'reply.buttonSkipped': 'This notification has no reply button (reason code: {reason}); session identity and input-tracking checks remain enforced.',
+    'hook.sendIncompleteDetail': '{channel}: delivery or post-send processing did not fully complete (API acknowledged {sent}/{planned} parts; {reason}). The message will not be resent automatically.',
+    'hook.sendFailedDetail': '{channel}: notification sending failed ({reason}). The message will not be resent automatically.',
+    'diagnostic.network': 'Network request failed or response was invalid (possibly a timeout or connection failure; cannot distinguish further)',
+    'diagnostic.rejected': 'The channel explicitly rejected the request (the current interface does not retain its exact error code)',
+    'diagnostic.unknown': 'Unclassified reason; underlying error withheld to protect secrets',
+    'diagnostic.telegramCode': 'Telegram API error code {code}',
+    'diagnostic.telegramUnknown': 'Telegram API failed with an unknown error code',
+    'diagnostic.httpCode': 'HTTP status {code}',
     'hook.coverageFailed': 'Could not verify question-notification coverage; the general permission reminder will be kept.',
     'hook.sendIncomplete': '{channel}: the Claude Code notification was not fully sent. The message will not be resent automatically.',
     'hook.sendFailed': '{channel}: the Claude Code notification failed to send. Check configuration, system credentials, and network; the message will not be resent automatically.',
@@ -812,7 +842,7 @@ secrets are never written in plaintext.`,
     'reply.lockUnavailable': 'Could not acquire the reply state write lock.',
     'reply.lockBusy': 'The reply state lock is busy. Confirm the relevant processes have exited, then handle the leftover lock.',
     'reply.invalidPolicy': 'The reply authorization configuration is invalid; remote input is disabled.',
-    'reply.hooksMissing': 'Required reply hooks are missing, timed unsafely, or disabled. Re-run integration claude-code install and confirm loading in /hooks.',
+    'reply.hooksMissing': 'Required reply hooks are missing, inaccessible, timed unsafely, or disabled. Re-run integration claude-code install and confirm loading in /hooks.',
     'reply.botChanged': 'The Telegram bot changed or is unavailable. Re-run reply setup to authorize again.',
     'reply.usersRevoked': 'Authorized users are no longer in the current Telegram recipient list; remote input is disabled.',
     'reply.authorizationChanged': 'Reply authorization was revoked or changed; old state was not written.',

package/dist/notification-diagnostics.js

@@ -0,0 +1,49 @@
+import { HttpError, TelegramApiError, TransportError } from '@quecue/notify-core';
+import { ConfigError } from './config.js';
+import { t } from './i18n.js';
+import path from 'node:path';
+import { atomicJson, replyDirectory } from './reply-state.js';
+export async function saveNotificationDiagnostic(file, session, value) {
+    if (typeof session !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(session))
+        return;
+    // 每会话只保留最后一份完成通知摘要；不记录正文、收件人、Token 或原始异常。
+    await atomicJson(path.join(replyDirectory(file), 'notification-diagnostics', session + '.json'), value);
+}
+// 仅保留类型和有界状态码；不输出底层异常、URL、Token 或服务端正文。
+export class TelegramRequestError extends ConfigError {
+    code;
+    constructor(code) {
+        super(t(code === 409 ? 'reply.telegramConflict' : 'reply.telegramRequestFailed'));
+        this.code = code;
+    }
+}
+export function safeFailureReason(error) {
+    if (error instanceof TelegramRequestError || error instanceof TelegramApiError) {
+        const code = error.code;
+        return Number.isSafeInteger(code) && code >= 100 && code <= 599
+            ? t('diagnostic.telegramCode', { code }) : t('diagnostic.telegramUnknown');
+    }
+    if (error instanceof HttpError) {
+        const code = error.status;
+        return Number.isSafeInteger(code) && code >= 100 && code <= 599
+            ? t('diagnostic.httpCode', { code }) : t('diagnostic.network');
+    }
+    if (error instanceof TransportError)
+        return t('diagnostic.network');
+    return t('diagnostic.unknown');
+}
+export class ReplyPreparationError extends ConfigError {
+    constructor(error) {
+        super(t('hook.replyIdentityFailed', { reason: safeFailureReason(error) }));
+    }
+}
+// 公共库目前只返回安全文本而非错误类型。仅匹配本地已知值，不转发任意字符串。
+export function safeDeliveryReason(error) {
+    for (const key of ['channels.network', 'channels.noResponse', 'channels.responseTooLarge', 'channels.notJsonObject']) {
+        if (error === t(key))
+            return t('diagnostic.network');
+    }
+    if (error === t('channels.rejected'))
+        return t('diagnostic.rejected');
+    return t('diagnostic.unknown');
+}

package/dist/reply-engine.js

@@ -3,7 +3,7 @@ import { ConfigError } from './config.js';
 import { t } from './i18n.js';
 import { digest, targetEpoch, stateTransaction, TTL } from './reply-state.js';
 import { handleInteractionCallback, handleInteractionText, showInteraction } from './reply-interactions.js';
-import { injectReply, sanitizeReply, validateTarget } from './reply-platform.js';
+import { injectReply, sanitizeReply, validateTarget, SessionLookupError } from './reply-platform.js';
 import { replyHint } from './reply-telegram.js';
 export const sessionEpoch = targetEpoch;
 export const textHash = (text) => digest(text.replace(/\s+/g, ' ').trim());
@@ -17,7 +17,7 @@ function privateUser(message, sender) {
 export async function resolveEntry(access, key, context) {
     const resolved = await stateTransaction(access, state => {
         const entry = state.entries[key], target = entry && state.sessions[entry.session];
-        return entry && target && (target.tracked === true || !!entry.request) && entry.epoch === sessionEpoch(target) && Date.now() - entry.updated < TTL ? { entry, target } : null;
+        return entry && target && target.unverified !== true && (target.tracked === true || !!entry.request) && entry.epoch === sessionEpoch(target) && Date.now() - entry.updated < TTL ? { entry, target } : null;
     });
     if (!resolved || !await (context.validate ?? (target => validateTarget(target)))(resolved.target))
         return null;
@@ -141,7 +141,7 @@ async function processAuthorizedUpdate(access, update, context) {
     const id = randomBytes(16).toString('hex');
     const queued = await stateTransaction(access, state => {
         const target = state.sessions[resolved.target.session];
-        if (!target || sessionEpoch(target) !== resolved.entry.epoch)
+        if (!target || target.unverified === true || sessionEpoch(target) !== resolved.entry.epoch)
             throw new ConfigError(t('reply.sessionChanged'));
         if (state.pending[target.session] && Date.now() - state.pending[target.session].updated < 5 * 60 * 1000)
             return null;
@@ -160,7 +160,8 @@ async function processAuthorizedUpdate(access, update, context) {
 }
 export async function drainReplies(access, context) {
     const queued = await stateTransaction(access, state => Object.entries(state.pending)
-        .filter(([session, value]) => value.phase === 'queued' && (!state.sessions[session]?.working || Date.now() - value.updated > 5 * 60 * 1000))
+        .filter(([session, value]) => value.phase === 'queued' && (Date.now() - value.updated > 5 * 60 * 1000
+        || (!state.sessions[session]?.working && state.sessions[session]?.unverified !== true)))
         .map(([session, pending]) => ({ target: state.sessions[session], pending })));
     for (const item of queued) {
         const { target, pending } = item;
@@ -177,7 +178,7 @@ export async function drainReplies(access, context) {
             const text = pending.text;
             const claimed = await stateTransaction(access, state => {
                 const actual = state.pending[target.session], active = state.sessions[target.session];
-                if (!actual || actual.id !== pending.id || actual.phase !== 'queued' || active?.working || sessionEpoch(active) !== sessionEpoch(target))
+                if (!actual || actual.id !== pending.id || actual.phase !== 'queued' || active?.working || active?.unverified === true || sessionEpoch(active) !== sessionEpoch(target))
                     return false;
                 actual.phase = 'submitted';
                 delete actual.text;
@@ -193,6 +194,18 @@ export async function drainReplies(access, context) {
             await replyHint(context.api, pending.chat, t('reply.forwardedTitle'), t('reply.forwardedBody'), pending.message);
         }
         catch (error) {
+            if (error instanceof SessionLookupError) {
+                const paused = await stateTransaction(access, state => {
+                    const value = state.pending[target.session], active = state.sessions[target.session];
+                    if (value?.id !== pending.id || value.phase !== 'queued')
+                        return false;
+                    if (active && sessionEpoch(active) === pending.epoch)
+                        active.unverified = true;
+                    return true;
+                });
+                if (paused)
+                    continue; // 未开始注入的任务保留原TTL；已提交/结果未知的任务绝不重新排队。
+            }
             await stateTransaction(access, state => {
                 const value = state.pending[target.session];
                 if (value?.id === pending.id) {

package/dist/reply-hooks.js

@@ -2,16 +2,35 @@ import { randomBytes } from 'node:crypto';
 import { ConfigError } from './config.js';
 import { t } from './i18n.js';
 import { accessReplies, botKey, digest, stateTransaction, targetEpoch } from './reply-state.js';
-import { findSession } from './reply-platform.js';
+import { lookupSession, SessionLookupError } from './reply-platform.js';
+import { processState } from './reply-lock.js';
 import { textHash } from './reply-engine.js';
 import { telegramApi, replyHint } from './reply-telegram.js';
 import { bridgeStatus, startBridge } from './reply-bridge.js';
+import { ReplyPreparationError } from './notification-diagnostics.js';
 import { createInteraction, questionsContent, showInteraction, waitInteraction } from './reply-interactions.js';
 import { makePlan, deliver } from './channels.js';
 import { completeToolCall, endSessionInteractions, finishInteraction, matchingCall, registerToolCall } from './reply-outcomes.js';
 const apiFor = (access, options) => (options.api ?? (value => telegramApi(value.config.telegram.token)))(access);
+async function inspectTarget(data, options) {
+    try {
+        if (options.sessionLookup)
+            return await options.sessionLookup(data.session_id);
+        if (options.session) {
+            const target = await options.session(data.session_id);
+            return target ? { status: 'found', target } : { status: 'missing' };
+        }
+        return await lookupSession(data.session_id, { env: options.env });
+    }
+    catch {
+        return { status: 'unavailable' };
+    }
+}
 async function getTarget(data, options) {
-    return (options.session ?? (id => findSession(id, { env: options.env })))(data.session_id);
+    const result = await inspectTarget(data, options);
+    if (result.status === 'unavailable')
+        throw new SessionLookupError();
+    return result.status === 'found' ? result.target : null;
 }
 export async function lifecycleHook(data, file, options = {}) {
     const event = data.hook_event_name;
@@ -22,15 +41,36 @@ export async function lifecycleHook(data, file, options = {}) {
         return;
     if (event === 'Stop' && data.stop_hook_active === true)
         return;
-    const target = event === 'SessionEnd' ? null : await getTarget(data, options);
+    const before = event === 'SessionEnd' ? null : await stateTransaction(access, state => state.sessions[data.session_id]);
+    const inspection = event === 'SessionEnd' ? null : await inspectTarget(data, options);
+    const target = inspection?.status === 'found' ? inspection.target : null;
+    const confirmedGone = inspection?.status === 'missing' && !!before && processState(before.pid) === 'dead';
+    if (!target && event !== 'SessionEnd')
+        options.err?.(t('reply.sessionUnavailable'));
     const receipt = await stateTransaction(access, state => {
         const previous = state.sessions[data.session_id];
-        if (event === 'SessionEnd' || !target) {
+        if (event === 'SessionEnd' || (confirmedGone && previous && before && targetEpoch(previous) === targetEpoch(before))) {
             delete state.sessions[data.session_id];
             delete state.pending[data.session_id];
             endSessionInteractions(state, data.session_id, t('reply.endSessionReason'));
             return null;
         }
+        if (!target) {
+            if (previous) {
+                previous.unverified = true;
+                previous.updated = Date.now();
+            }
+            // 观察到新的本地输入时仍取消旧排队任务，不能在恢复核验后抢先注入。
+            if (event === 'UserPromptSubmit' || event === 'SessionStart') {
+                if (state.pending[data.session_id]?.phase === 'queued')
+                    delete state.pending[data.session_id];
+                if (previous)
+                    previous.working = true;
+            }
+            if (event === 'Stop' || event === 'UserPromptSubmit' || event === 'SessionStart')
+                endSessionInteractions(state, data.session_id, t('reply.endTurnReason'));
+            return null;
+        }
         // 同进程 / 同 TTY 已切换会话时，旧映射不再允许输入。
         for (const [id, other] of Object.entries(state.sessions)) {
             if (id !== target.session && (other.pid === target.pid || (target.tty && other.tty === target.tty))) {
@@ -84,7 +124,7 @@ export async function notificationCoverage(data, file, config, options = {}) {
     return stateTransaction(access, state => {
         const target = state.sessions[data.session_id];
         const call = target?.latestCall && state.calls[target.latestCall];
-        if (!target || !call || call.session !== target.session || call.epoch !== targetEpoch(target) || call.tool !== 'AskUserQuestion'
+        if (!target || target.unverified === true || !call || call.session !== target.session || call.epoch !== targetEpoch(target) || call.tool !== 'AskUserQuestion'
             || typeof data.tool_use_id === 'string' && data.tool_use_id !== call.id
             || typeof data.tool_name === 'string' && data.tool_name !== call.tool
             || typeof data.prompt_id === 'string' && data.prompt_id !== call.prompt)
@@ -100,27 +140,53 @@ export async function notificationCoverage(data, file, config, options = {}) {
     });
 }
 export async function attachReply(message, data, file, options = {}) {
+    if (data.hook_event_name !== 'Stop')
+        return null;
     const access = await accessReplies(file, options.env);
-    if (!access || data.hook_event_name !== 'Stop')
+    if (!access) {
+        options.replyDiagnostic?.('disabled');
         return null;
+    }
+    const skip = (reason) => {
+        options.replyDiagnostic?.(reason);
+        options.err?.(t('reply.buttonSkipped', { reason }));
+        return null;
+    };
     const target = await getTarget(data, options);
     if (!target)
-        return null;
+        return skip('session-unverified');
     const saved = await stateTransaction(access, state => state.sessions[target.session]);
-    if (!saved || saved.working || !saved.tracked || targetEpoch(saved) !== targetEpoch(target))
-        return null;
+    if (!saved)
+        return skip('state-missing');
+    if (saved.unverified === true)
+        return skip('session-unverified');
+    if (saved.working)
+        return skip('session-working');
+    if (!saved.tracked)
+        return skip('input-unobserved');
+    if (targetEpoch(saved) !== targetEpoch(target))
+        return skip('identity-changed');
     const ready = options.bridge ? await options.bridge(file, options.env ?? process.env)
         : (await bridgeStatus(file)).ready || await startBridge(file, options.env);
     if (!ready) {
+        options.replyDiagnostic?.('bridge-unready');
         options.err?.(t('reply.bridgeNotReadyButton'));
         return null;
     }
-    const api = apiFor(access, options), bot = await api('getMe', {});
+    const api = apiFor(access, options);
+    let bot;
+    try {
+        bot = await api('getMe', {});
+    }
+    catch (error) {
+        throw new ReplyPreparationError(error);
+    }
     if (typeof bot?.username !== 'string' || !/^[A-Za-z0-9_]{5,64}$/.test(bot.username))
         throw new ConfigError(t('reply.botUsernameInvalid'));
     const token = randomBytes(16).toString('hex');
     await stateTransaction(access, state => { state.entries['token:' + token] = { session: target.session, epoch: targetEpoch(target), updated: Date.now() }; });
     message.reply = { token, url: `https://t.me/${bot.username}?start=${token}`, users: access.policy.users };
+    options.replyDiagnostic?.('attached');
     return { access, token };
 }
 export function mapReplies(plan, binding) {
@@ -157,7 +223,7 @@ export async function interactionHook(data, file, options = {}) {
         ? await stateTransaction(access, state => state.sessions[data.session_id]) : null;
     // 登记阶段复用生命周期元数据；真正开启远程交互时仍重新核验进程身份。
     const target = cached ?? await getTarget(data, options);
-    if (!target) {
+    if (!target || target.unverified === true) {
         options.err?.(t('reply.noSession'));
         return;
     }

package/dist/reply-interactions.js

@@ -31,7 +31,7 @@ export async function createInteraction(access, target, kind, input, call) {
         answers: {}, selected: [], index: 0, call, receipts: [], messages: [] };
     await stateTransaction(access, state => {
         const current = state.sessions[target.session];
-        if (!current || targetEpoch(current) !== value.epoch)
+        if (!current || current.unverified === true || targetEpoch(current) !== value.epoch)
             throw new ConfigError(t('reply.targetChanged'));
         if (call) {
             const bound = state.calls[call];
@@ -150,7 +150,7 @@ export async function handleInteractionCallback(access, callback, chat, api) {
     const [, id, index, operation] = match;
     const outcome = await stateTransaction(access, state => {
         const value = state.requests[id], target = value && state.sessions[value.session];
-        if (!active(value) || value.index !== Number(index) || !target || targetEpoch(target) !== value.epoch)
+        if (!active(value) || value.index !== Number(index) || !target || target.unverified === true || targetEpoch(target) !== value.epoch)
             return 'expired';
         if (operation === 'l') {
             finishInteraction(value, { kind: 'not-applied', reason: 'closed', text: t('reply.closedLocal') });
@@ -218,7 +218,7 @@ export async function handleInteractionText(access, id, chat, message, api) {
     const outcome = await stateTransaction(access, state => {
         const value = state.requests[id], target = value && state.sessions[value.session];
         const entry = state.entries[`tg:${chat}:${message.reply_to_message.message_id}`];
-        if (!active(value) || !target || targetEpoch(target) !== value.epoch || entry?.question !== value.index)
+        if (!active(value) || !target || target.unverified === true || targetEpoch(target) !== value.epoch || entry?.question !== value.index)
             return 'expired';
         const question = value.questions[value.index]?.question;
         if (value.kind === 'permission') {
@@ -248,7 +248,7 @@ export async function waitInteraction(access, value, fresh, options = {}) {
             const request = state.requests[value.id], target = state.sessions[value.session];
             if (!request || request.result || !target || targetEpoch(target) !== value.epoch || (request.call && (!state.calls[request.call] || state.calls[request.call].ended)))
                 return { ended: true };
-            if (!request.response || request.claimed || options.signal?.aborted)
+            if (target.unverified === true || !request.response || request.claimed || options.signal?.aborted)
                 return null;
             request.claimed = true;
             // 回传后等待独立的完成事件确认；不能在这里删除请求或报告成功。

package/dist/reply-lock.js

@@ -1,13 +1,38 @@
 import { open, readFile, unlink, lstat } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
 import { ConfigError } from './config.js';
 import { t } from './i18n.js';
-export function processState(pid) {
+function windowsProcessExists(pid) {
+    const executable = path.win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tasklist.exe');
+    const result = spawnSync(executable, ['/FI', `PID eq ${pid}`, '/FO', 'CSV', '/NH'], {
+        shell: false, windowsHide: true, encoding: 'utf8', timeout: 5000, maxBuffer: 65536,
+    });
+    if (result.error || result.status !== 0 || typeof result.stdout !== 'string')
+        return false;
+    // 只认可精确 PID 的 CSV 行；没有结果、权限不足或异常输出均不证明进程死亡。
+    return result.stdout.split(/\r?\n/).some(line => /^"[^"]+","(\d+)"/.exec(line.trim())?.[1] === String(pid));
+}
+export function processState(pid, options = {}) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return 'unknown';
     try {
-        process.kill(pid, 0);
+        (options.signal ?? (value => process.kill(value, 0)))(pid);
         return 'alive';
     }
     catch (error) {
-        return error.code === 'ESRCH' ? 'dead' : 'unknown';
+        const code = error.code;
+        if (code === 'ESRCH')
+            return 'dead';
+        // Windows 的 signal=0 也可能被跨提权等级权限拒绝；改用只读枚举确认存活，不提权。
+        if ((options.platform ?? process.platform) === 'win32' && (code === 'EPERM' || code === 'EACCES')) {
+            try {
+                if ((options.windowsQuery ?? windowsProcessExists)(pid))
+                    return 'alive';
+            }
+            catch { /* 仍无法确认则保守处理。 */ }
+        }
+        return 'unknown';
     }
 }
 // 只有 ESRCH 可证明进程已退出；权限不足、PID复用、坏文件都不允许抢占。

package/dist/reply-outcomes.js

@@ -1,5 +1,6 @@
 import { digest, stateTransaction, targetEpoch } from './reply-state.js';
 import { t } from './i18n.js';
+import { ConfigError } from './config.js';
 import { replyHint } from './reply-telegram.js';
 // PermissionRequest 没有 tool_use_id：只接受唯一且尚未结束的同输入调用，歧义时保留本机处理。
 function canonical(value) {
@@ -61,6 +62,8 @@ export async function registerToolCall(access, target, data) {
         if (state.calls[key])
             return;
         const previous = state.sessions[target.session];
+        if (previous?.unverified === true || target.unverified === true)
+            throw new ConfigError(t('reply.sessionUnavailable'));
         state.sessions[target.session] = { ...target, working: true, latestCall: key, tracked: previous?.tracked === true && targetEpoch(previous) === targetEpoch(target) };
         state.calls[key] = { id: data.tool_use_id, session: target.session, epoch: targetEpoch(target), tool: data.tool_name,
             fingerprint: inputFingerprint(data.tool_input), prompt: typeof data.prompt_id === 'string' ? data.prompt_id : undefined, updated: Date.now() };

package/dist/reply-platform.js

@@ -5,6 +5,15 @@ import { homedir } from 'node:os';
 import { ConfigError } from './config.js';
 import { t } from './i18n.js';
 import { claudeSettingsPath } from './claude-code.js';
+import { processState } from './reply-lock.js';
+export class SessionLookupError extends ConfigError {
+    constructor() { super(t('reply.sessionUnavailable')); }
+}
+function unavailable(strict) {
+    if (strict)
+        throw new SessionLookupError();
+    return null;
+}
 export const runCommand = (command, args, input = '') => new Promise((resolve, reject) => {
     const child = spawn(command, args, { windowsHide: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] });
     let stdout = '', overflow = false;
@@ -37,31 +46,50 @@ export function sanitizeReply(text) {
         throw new ConfigError(t('reply.emptyAfterCleanup'));
     return value;
 }
-export async function processIdentity(pid, platform = process.platform, runner = runCommand) {
+export async function processIdentity(pid, platform = process.platform, runner = runCommand, strict = false) {
     if (!Number.isSafeInteger(pid) || pid <= 0)
         return null;
     try {
         if (platform === 'win32') {
             const result = await powershell(READ_PROCESS, { pid }, runner);
+            if (result.code === 3)
+                return null; // 已明确查到的进程不是 Claude，旧绑定无效。
             if (result.code !== 0)
-                return null;
+                return processState(pid) === 'dead' ? null : unavailable(strict);
             const d = JSON.parse(result.stdout);
-            return typeof d.birth === 'string' && /^\d+$/.test(d.birth) ? { birth: d.birth, tty: '' } : null;
+            return typeof d.birth === 'string' && /^\d+$/.test(d.birth) ? { birth: d.birth, tty: '' } : unavailable(strict);
         }
         if (platform === 'darwin') {
             const result = await runner('/bin/ps', ['-p', String(pid), '-o', 'lstart=', '-o', 'tty=', '-o', 'comm=']);
             const match = result.stdout.trim().match(/^(\S+\s+\S+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+(\S+)\s+(.+)$/);
-            if (result.code !== 0 || !match || path.posix.basename(match[3]) !== 'claude' || !/^ttys\d+$/.test(match[2]))
+            if (result.code !== 0)
+                return processState(pid) === 'dead' ? null : unavailable(strict);
+            if (!match)
+                return unavailable(strict);
+            if (path.posix.basename(match[3]) !== 'claude')
                 return null;
+            if (!/^ttys\d+$/.test(match[2]))
+                return unavailable(strict);
             const groups = await runner('/bin/ps', ['-p', String(pid), '-o', 'pgid=', '-o', 'tpgid=']);
             const group = groups.stdout.trim().match(/^(\d+)\s+(\d+)$/);
             if (groups.code !== 0 || !group || group[1] !== group[2])
-                return null;
+                return unavailable(strict);
             return { birth: match[1].replace(/\s+/g, ' '), tty: '/dev/' + match[2] };
         }
     }
-    catch { /* 目标不确定时拒绝，不向任意前台终端回退。 */ }
-    return null;
+    catch {
+        return unavailable(strict);
+    }
+    return unavailable(strict);
+}
+export async function lookupSession(session, options = {}) {
+    try {
+        const target = await findSession(session, { ...options, strict: true });
+        return target ? { status: 'found', target } : { status: 'missing' };
+    }
+    catch {
+        return { status: 'unavailable' };
+    }
 }
 export async function findSession(session, options = {}) {
     if (!session || !/^[A-Za-z0-9_-]{1,128}$/.test(session))
@@ -69,28 +97,39 @@ export async function findSession(session, options = {}) {
     const directory = path.join(path.dirname(claudeSettingsPath(options.env, options.home ?? homedir())), 'sessions');
     let names;
     try {
-        names = await readdir(directory);
+        names = await (options.readDirectory ?? readdir)(directory);
     }
-    catch {
-        return null;
+    catch (error) {
+        return error.code === 'ENOENT' ? null : unavailable(options.strict === true);
     }
     const matches = [];
+    let incomplete = false;
     for (const name of names) {
         if (!/^\d+\.json$/.test(name))
             continue;
         try {
-            const bytes = await readFile(path.join(directory, name));
-            if (bytes.length > 128 * 1024)
+            const bytes = await (options.readSessionFile ?? readFile)(path.join(directory, name));
+            if (bytes.length > 128 * 1024) {
+                incomplete = true;
                 continue;
+            }
             const d = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
-            if (d.sessionId === session && d.pid === Number(name.slice(0, -5)))
+            if (!d || typeof d.sessionId !== 'string' || !Number.isSafeInteger(d.pid) || d.pid <= 0 || d.pid !== Number(name.slice(0, -5))) {
+                incomplete = true;
+                continue;
+            }
+            if (d.sessionId === session)
                 matches.push(d);
         }
-        catch { /* 其他损坏或写入中的会话文件不作为目标。 */ }
+        catch {
+            incomplete = true;
+        }
     }
-    if (matches.length !== 1)
+    if (incomplete || matches.length > 1)
+        return unavailable(options.strict === true);
+    if (!matches.length)
         return null;
-    const d = matches[0], identity = await processIdentity(d.pid, options.platform, options.runner);
+    const d = matches[0], identity = await processIdentity(d.pid, options.platform, options.runner, options.strict === true);
     if (!identity)
         return null;
     return { session, pid: d.pid, ...identity, title: typeof d.name === 'string' ? Array.from(d.name).slice(0, 60).join('') : '',
@@ -124,7 +163,9 @@ export async function findSessionName(session, options = {}) {
     return '';
 }
 export async function validateTarget(target, options = {}) {
-    const current = await findSession(target.session, options);
+    if (target.unverified === true)
+        throw new SessionLookupError();
+    const current = await findSession(target.session, { ...options, strict: true });
     return current !== null && current.pid === target.pid && current.birth === target.birth && current.tty === target.tty;
 }
 const WINDOWS_INJECT = `$ErrorActionPreference='Stop';[Console]::InputEncoding=[Text.UTF8Encoding]::new($false);$x=[Console]::In.ReadToEnd()|ConvertFrom-Json;$p=Get-Process -Id $x.pid;if($p.ProcessName -ne 'claude' -or $p.StartTime.ToUniversalTime().Ticks.ToString() -ne $x.birth){exit 3}

package/dist/reply-state.js

@@ -127,7 +127,8 @@ export async function stateTransaction(access, work) {
             }
         for (const [key, value] of Object.entries(state.sessions)) {
             if (value.session !== key || !Number.isSafeInteger(value.pid) || value.pid <= 0 || typeof value.birth !== 'string'
-                || typeof value.tty !== 'string' || typeof value.working !== 'boolean')
+                || typeof value.tty !== 'string' || typeof value.working !== 'boolean'
+                || value.unverified !== undefined && typeof value.unverified !== 'boolean')
                 delete state.sessions[key];
         }
         for (const [key, value] of Object.entries(state.entries)) {

package/dist/reply-telegram.js

@@ -2,6 +2,7 @@ import { createTelegramApi, TelegramApiError } from '@quecue/notify-core';
 import { requestJson } from './channels.js';
 import { ConfigError } from './config.js';
 import { t } from './i18n.js';
+import { TelegramRequestError } from './notification-diagnostics.js';
 export function telegramApi(token, request = requestJson) {
     const call = createTelegramApi(token, { request });
     return async (method, payload) => {
@@ -12,9 +13,7 @@ export function telegramApi(token, request = requestJson) {
         }
         catch (error) {
             if (error instanceof TelegramApiError) {
-                if (error.code === 409)
-                    throw new ConfigError(t('reply.telegramConflict'));
-                throw new ConfigError(t('reply.telegramRequestFailed'));
+                throw new TelegramRequestError(error.code);
             }
             throw error;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quecue/dev-notify",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "跨平台开发任务通知工具，支持 Telegram 与飞书",
   "license": "MIT",
   "repository": {