@vibe-lark/larkpal 0.1.72 → 0.1.74

package/dist/main.mjs

@@ -3,7 +3,7 @@ import { n as getLarkRuntime, r as setLarkRuntime, t as larkLogger } from "./lar
 import * as fs from "node:fs";
 import { createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import * as path$2 from "node:path";
-import path, { basename, dirname, extname, join, resolve } from "node:path";
+import path, { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import "dotenv/config";
 import { access, copyFile, lstat, mkdir, open, readFile, readdir, readlink, rename, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
@@ -782,7 +782,10 @@ function getToolDisplayName(toolName) {
 * - parseError(error, rawLine)       — 解析错误（不中断流）
 */
 const log$36 = larkLogger("cc-runtime/stream-parser");
+const MAX_TOOL_RESULT_CONTENT_CHARS = 8e3;
 var CCStreamParser = class extends EventEmitter {
+	toolNamesById = /* @__PURE__ */ new Map();
+	declaredTools = null;
 	/**
 	* 解析一行 NDJSON 文本
 	*
@@ -830,6 +833,7 @@ var CCStreamParser = class extends EventEmitter {
 					subtype: msg.subtype,
 					detail: JSON.stringify(msg).slice(0, 500)
 				});
+				this.handleSystem(msg);
 				this.emit("system", msg);
 				break;
 			default:
@@ -858,6 +862,7 @@ var CCStreamParser = class extends EventEmitter {
 					toolUseId: block?.id
 				});
 				if (block?.type === "tool_use" && block.name) {
+					this.recordToolUse(block.name, block.id);
 					log$36.info("工具调用开始", {
 						toolName: block.name,
 						displayName: getToolDisplayName(block.name),
@@ -905,6 +910,7 @@ var CCStreamParser = class extends EventEmitter {
 		});
 		if (Array.isArray(content)) {
 			for (const block of content) if (block.type === "tool_use" && block.name) {
+				this.recordToolUse(block.name, block.id);
 				log$36.info("从 assistant 消息提取工具调用", {
 					toolName: block.name,
 					displayName: getToolDisplayName(block.name),
@@ -924,10 +930,46 @@ var CCStreamParser = class extends EventEmitter {
 		const content = msg.message?.content;
 		if (!Array.isArray(content)) return;
 		for (const item of content) if (item.type === "tool_result" && item.tool_use_id) {
-			log$36.debug("工具结果返回", { toolUseId: item.tool_use_id });
-			this.emit("toolResult", item.tool_use_id);
+			const result = this.buildToolResultSummary(item, msg.toolUseResult);
+			log$36.debug("工具结果返回", {
+				toolUseId: item.tool_use_id,
+				toolName: result.toolName,
+				isError: result.isError,
+				truncated: result.truncated
+			});
+			this.emit("toolResult", item.tool_use_id, result);
+		}
+	}
+	handleSystem(msg) {
+		if (msg.subtype !== "init" || !Array.isArray(msg.tools)) return;
+		this.declaredTools = new Set(msg.tools);
+	}
+	recordToolUse(toolName, toolUseId) {
+		if (toolUseId) this.toolNamesById.set(toolUseId, toolName);
+		if (this.declaredTools && !this.declaredTools.has(toolName)) {
+			log$36.warn("模型请求了未声明工具", {
+				toolName,
+				toolUseId
+			});
+			this.emit("unknownToolUse", toolName, toolUseId);
 		}
 	}
+	buildToolResultSummary(item, toolUseResult) {
+		const serializedContent = serializeToolResultContent(item.content);
+		const truncatedContent = truncateToolResultContent(serializedContent);
+		const toolUseResultSummary = summarizeToolUseResult(toolUseResult);
+		return {
+			toolCallId: item.tool_use_id,
+			toolName: this.toolNamesById.get(item.tool_use_id),
+			rawType: "tool_result",
+			isError: item.is_error,
+			content: truncatedContent.content,
+			resultSummary: extractToolResultSummary(serializedContent, toolUseResultSummary),
+			truncated: truncatedContent.truncated || toolUseResultSummary.truncated,
+			originalSize: Math.max(serializedContent.length, toolUseResultSummary.originalSize),
+			toolUseResult: toolUseResultSummary.summary
+		};
+	}
 	/**
 	* 处理 tool_progress 消息 — 工具执行进度
 	*/
@@ -959,6 +1001,52 @@ var CCStreamParser = class extends EventEmitter {
 		});
 	}
 };
+function serializeToolResultContent(content) {
+	if (typeof content === "string") return content;
+	return safeJsonStringify(content);
+}
+function summarizeToolUseResult(value) {
+	if (value === void 0) return {
+		originalSize: 0,
+		truncated: false
+	};
+	const serialized = typeof value === "string" ? value : safeJsonStringify(value);
+	const truncated = truncateToolResultContent(serialized);
+	return {
+		summary: typeof value === "string" ? truncated.content : tryParseJson$1(truncated.content) ?? truncated.content,
+		originalSize: serialized.length,
+		truncated: truncated.truncated
+	};
+}
+function truncateToolResultContent(content) {
+	if (content.length <= MAX_TOOL_RESULT_CONTENT_CHARS) return {
+		content,
+		truncated: false
+	};
+	return {
+		content: content.slice(0, MAX_TOOL_RESULT_CONTENT_CHARS),
+		truncated: true
+	};
+}
+function extractToolResultSummary(content, toolUseResult) {
+	const text = (typeof toolUseResult.summary === "string" ? toolUseResult.summary : toolUseResult.summary === void 0 ? void 0 : safeJsonStringify(toolUseResult.summary)) || content;
+	const summary = (text.match(/<tool_use_error>([\s\S]*?)<\/tool_use_error>/)?.[1] || text).trim();
+	return summary ? truncateToolResultContent(summary).content : void 0;
+}
+function safeJsonStringify(value) {
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return String(value);
+	}
+}
+function tryParseJson$1(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
 //#endregion
 //#region src/cc-runtime/process-manager.ts
 /**
@@ -1416,8 +1504,11 @@ var SessionProcessManager = class {
 		parser.on("toolUseStart", (toolName, toolInput) => {
 			getCallbacks()?.onToolUseStart?.(toolName, toolInput);
 		});
-		parser.on("toolResult", (toolUseId) => {
-			getCallbacks()?.onToolResult?.(toolUseId);
+		parser.on("toolResult", (toolUseId, result) => {
+			getCallbacks()?.onToolResult?.(toolUseId, result);
+		});
+		parser.on("unknownToolUse", (toolName, toolUseId) => {
+			getCallbacks()?.onUnknownToolUse?.(toolName, toolUseId);
 		});
 		parser.on("toolProgress", (toolName, elapsedSeconds) => {
 			getCallbacks()?.onToolProgress?.(toolName, elapsedSeconds);
@@ -3679,6 +3770,13 @@ function summarizeString(value) {
 *   DELETE /api/chat/sessions/:id     — 删除会话
 */
 const log$30 = larkLogger("chat/stream");
+var SessionFileUploadError = class extends Error {
+	constructor(message, statusCode = 400) {
+		super(message);
+		this.statusCode = statusCode;
+		this.name = "SessionFileUploadError";
+	}
+};
 const chatRunsBySession = /* @__PURE__ */ new Map();
 const DEFAULT_STALE_RUN_IDLE_MS = 1800 * 1e3;
 /** 统一写 SSE 格式数据到响应流 */
@@ -3725,6 +3823,9 @@ function serializeChatRun(run) {
 		lastEventAt: run.lastEventAt,
 		lastEventType: run.lastEventType,
 		lastToolName: run.lastToolName,
+		lastToolError: run.lastToolError,
+		unknownToolCallCount: run.unknownToolCallCount,
+		lastUnknownToolName: run.lastUnknownToolName,
 		idleSeconds,
 		adapterBusy: run.status === "running" ? run.adapterBusy : false,
 		processStatus,
@@ -3771,6 +3872,31 @@ function getRuntimeEventDedupeKey(event) {
 function isRunVisibleToUser(run, params) {
 	return run.tenantKey === params.tenantKey && run.openId === params.openId;
 }
+function getSessionOwner(chatUser) {
+	return {
+		tenantKey: chatUser.tenantKey,
+		openId: chatUser.openId
+	};
+}
+function isSessionOwnedBy$1(session, owner) {
+	return session.tenantKey === owner.tenantKey && session.userId === owner.openId;
+}
+async function getOwnedSession(messageStore, sessionId, chatUser) {
+	return await messageStore.getSessionForOwner(sessionId, getSessionOwner(chatUser));
+}
+function logSessionDecision(params) {
+	log$30.info("[session-audit] chat session access decision", {
+		action: params.action,
+		decision: params.decision,
+		tenantKey: params.chatUser.tenantKey,
+		userId: params.chatUser.userId,
+		openId: params.chatUser.openId,
+		sessionId: params.sessionId,
+		requestId: params.requestId,
+		traceId: params.traceId,
+		reason: params.reason
+	});
+}
 function addRunClient(req, res, run) {
 	run.clients.add(res);
 	req.on("close", () => {
@@ -4009,6 +4135,232 @@ function buildRuntimeEventMessageMetadata(event, runtimeConfig) {
 		finalStatus: event.finalStatus
 	};
 }
+async function handleSessionFileUpload(req, res, messageStore) {
+	const chatUser = res.locals.chatUser;
+	const sessionId = String(req.params.id);
+	const requestId = getGatewayRequestId(req.headers);
+	const traceId = getGatewayTraceId(req.headers, requestId);
+	if (!await getOwnedSession(messageStore, sessionId, chatUser)) {
+		logSessionDecision({
+			action: "attach",
+			decision: "denied",
+			chatUser,
+			sessionId,
+			requestId,
+			traceId,
+			reason: "session_not_owned"
+		});
+		res.status(404).json({ error: "Session not found" });
+		return;
+	}
+	logSessionDecision({
+		action: "attach",
+		decision: "allowed",
+		chatUser,
+		sessionId,
+		requestId,
+		traceId
+	});
+	if (!req.headers["content-type"]?.includes("multipart/form-data")) {
+		res.status(415).json({ error: "Content-Type must be multipart/form-data" });
+		return;
+	}
+	try {
+		const file = await parseSessionFileUpload(req, sessionId);
+		await messageStore.appendMessage({
+			sessionId,
+			role: "tool",
+			content: JSON.stringify({
+				runtimeEventType: "session-file-attached",
+				file
+			}),
+			channel: "web",
+			metadata: {
+				requestId,
+				traceId,
+				runtimeEventType: "session-file-attached",
+				fileName: file.fileName,
+				relativePath: file.relativePath,
+				mimeType: file.mimeType,
+				size: file.size,
+				attachments: [file]
+			}
+		});
+		res.status(201).json({
+			file,
+			files: [file]
+		});
+	} catch (err) {
+		const statusCode = err instanceof SessionFileUploadError ? err.statusCode : 500;
+		const message = err instanceof Error ? err.message : String(err);
+		log$30.warn("[sessions] session file upload failed", {
+			tenantKey: chatUser.tenantKey,
+			userId: chatUser.userId,
+			openId: chatUser.openId,
+			sessionId,
+			requestId,
+			traceId,
+			statusCode,
+			message
+		});
+		res.status(statusCode).json({ error: message });
+	}
+}
+function parseSessionFileUpload(req, sessionId) {
+	return new Promise((resolvePromise, rejectPromise) => {
+		const busboy = Busboy({
+			headers: req.headers,
+			limits: {
+				fileSize: getSessionFileUploadMaxBytes(),
+				files: 1
+			}
+		});
+		let metadata;
+		let uploadPromise;
+		let fileSeen = false;
+		let settled = false;
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			rejectPromise(error);
+		};
+		busboy.on("field", (name, value) => {
+			if (name !== "metadata") return;
+			if (!value.trim()) return;
+			try {
+				const parsed = JSON.parse(value);
+				if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+					metadata = parsed;
+					return;
+				}
+				fail(new SessionFileUploadError("metadata must be a JSON object"));
+			} catch (err) {
+				fail(new SessionFileUploadError(`metadata is not valid JSON: ${err instanceof Error ? err.message : String(err)}`));
+			}
+		});
+		busboy.on("file", (_name, file, info) => {
+			if (fileSeen) {
+				file.resume();
+				fail(new SessionFileUploadError("Only one file is supported per upload"));
+				return;
+			}
+			fileSeen = true;
+			uploadPromise = writeSessionFile(sessionId, {
+				file,
+				originalName: info.filename || "upload.bin",
+				mimeType: info.mimeType || "application/octet-stream",
+				metadata
+			});
+		});
+		busboy.on("filesLimit", () => fail(new SessionFileUploadError("Only one file is supported per upload")));
+		busboy.on("error", fail);
+		busboy.on("finish", () => {
+			if (settled) return;
+			if (!fileSeen || !uploadPromise) {
+				fail(new SessionFileUploadError("file is required"));
+				return;
+			}
+			uploadPromise.then((file) => {
+				if (settled) return;
+				settled = true;
+				resolvePromise(file);
+			}, fail);
+		});
+		req.pipe(busboy);
+	});
+}
+function writeSessionFile(sessionId, params) {
+	return new Promise((resolvePromise, rejectPromise) => {
+		const uploadsDir = resolve(resolveAgentCwd(sessionId), "uploads");
+		const fileName = buildSafeUploadFileName(params.originalName);
+		const destination = resolve(uploadsDir, fileName);
+		const relativePath = `uploads/${fileName}`;
+		const maxBytes = getSessionFileUploadMaxBytes();
+		let size = 0;
+		let settled = false;
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			rejectPromise(error);
+		};
+		if (!isPathInside(uploadsDir, destination)) {
+			fail(new SessionFileUploadError("Invalid upload path"));
+			params.file.resume();
+			return;
+		}
+		mkdir(uploadsDir, { recursive: true }).then(() => {
+			const output = createWriteStream(destination, { flags: "wx" });
+			params.file.on("data", (chunk) => {
+				size += chunk.length;
+				if (size > maxBytes) {
+					output.destroy();
+					fail(new SessionFileUploadError(`File exceeds maximum upload size of ${maxBytes} bytes`, 413));
+				}
+			});
+			params.file.on("limit", () => {
+				output.destroy();
+				fail(new SessionFileUploadError(`File exceeds maximum upload size of ${maxBytes} bytes`, 413));
+			});
+			params.file.on("error", fail);
+			output.on("error", fail);
+			output.on("finish", () => {
+				if (settled) return;
+				settled = true;
+				resolvePromise({
+					sessionId,
+					kind: "session-file",
+					fileName,
+					relativePath,
+					uri: `session-file://${relativePath}`,
+					mimeType: params.mimeType,
+					size,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+					metadata: params.metadata
+				});
+			});
+			params.file.pipe(output);
+		}, fail);
+	});
+}
+function getSessionFileUploadMaxBytes() {
+	const raw = process.env.LARKPAL_SESSION_FILE_MAX_UPLOAD_BYTES || process.env.LARKPAL_ARTIFACT_MAX_UPLOAD_BYTES;
+	if (!raw) return 50 * 1024 * 1024;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : 50 * 1024 * 1024;
+}
+function buildSafeUploadFileName(originalName) {
+	const base = basename(originalName).replace(/[\0\r\n\\/]/g, "_");
+	const extension = extname(base).replace(/[^A-Za-z0-9.]/g, "").slice(0, 32);
+	const stem = basename(base, extname(base)).replace(/[^A-Za-z0-9._-]/g, "_").replace(/^\.+$/, "").slice(0, 80) || "upload";
+	return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}-${stem}${extension}`;
+}
+function isPathInside(parent, child) {
+	const path = relative(parent, child);
+	return path !== "" && !path.startsWith("..") && !isAbsolute(path);
+}
+function buildToolResultPayload(result, resultSummary) {
+	if (!result || typeof result !== "object" || Array.isArray(result)) return { result: resultSummary };
+	const record = result;
+	return {
+		rawType: record.rawType,
+		isError: record.isError,
+		content: record.content,
+		resultSummary: record.resultSummary ?? resultSummary,
+		truncated: record.truncated,
+		originalSize: record.originalSize,
+		result: resultSummary
+	};
+}
+function readStringField(value, key) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const field = value[key];
+	return typeof field === "string" ? field : void 0;
+}
+function readBooleanField(value, key) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const field = value[key];
+	return typeof field === "boolean" ? field : void 0;
+}
 /**
 * 创建 Chat 流式对话 + 历史查询路由
 *
@@ -4025,7 +4377,8 @@ function createChatRouter(config) {
 	const router = Router();
 	const { processManager, messageStore } = config;
 	router.post("/api/chat/stream", chatAuthMiddleware, async (req, res) => {
-		const { userId, openId, tenantKey } = res.locals.chatUser;
+		const chatUser = res.locals.chatUser;
+		const { userId, openId, tenantKey } = chatUser;
 		const body = req.body;
 		if (!tenantKey || !userId || !openId) {
 			res.status(401).json({ error: "Missing required chat identity: tenantKey, userId, openId" });
@@ -4034,7 +4387,48 @@ function createChatRouter(config) {
 		const requestId = getGatewayRequestId(req.headers);
 		const traceId = getGatewayTraceId(req.headers, requestId);
 		let sessionId = body.session_id;
+		let streamSession = null;
 		const activeRun = sessionId ? getActiveChatRun(sessionId) : void 0;
+		if (sessionId) {
+			streamSession = await messageStore.getSession(sessionId);
+			if (streamSession && !isSessionOwnedBy$1(streamSession, getSessionOwner(chatUser))) {
+				logSessionDecision({
+					action: "stream",
+					decision: "denied",
+					chatUser,
+					sessionId,
+					requestId,
+					traceId,
+					reason: "session_not_owned"
+				});
+				res.status(404).json({ error: "Session not found" });
+				return;
+			}
+			if (!streamSession && activeRun && !isRunVisibleToUser(activeRun, {
+				tenantKey,
+				openId
+			})) {
+				logSessionDecision({
+					action: "stream",
+					decision: "denied",
+					chatUser,
+					sessionId,
+					requestId,
+					traceId,
+					reason: "active_run_not_owned"
+				});
+				res.status(404).json({ error: "Session not found" });
+				return;
+			}
+			if (streamSession || activeRun) logSessionDecision({
+				action: "stream",
+				decision: "allowed",
+				chatUser,
+				sessionId,
+				requestId,
+				traceId
+			});
+		}
 		if (activeRun) {
 			if (!isRunVisibleToUser(activeRun, {
 				tenantKey,
@@ -4057,6 +4451,22 @@ function createChatRouter(config) {
 			res.status(400).json({ error: "prompt is required and must be a string" });
 			return;
 		}
+		if (sessionId && !streamSession) {
+			await messageStore.createSession({
+				id: sessionId,
+				userId: openId,
+				tenantKey,
+				channel: "web"
+			});
+			logSessionDecision({
+				action: "stream",
+				decision: "allowed",
+				chatUser,
+				sessionId,
+				requestId,
+				traceId
+			});
+		}
 		const scenarioId = getScenarioId(body.options?.scenarioId, body.options?.metadata);
 		const attachments = getRunInputValue(body.attachments, body.options?.attachments, body.options?.metadata?.attachments);
 		const sourceArtifacts = getRunInputValue(body.sourceArtifacts, body.source_artifacts, body.options?.sourceArtifacts, body.options?.source_artifacts, body.options?.metadata?.sourceArtifacts, body.options?.metadata?.source_artifacts);
@@ -4077,6 +4487,14 @@ function createChatRouter(config) {
 				tenantKey,
 				channel: "web"
 			})).id;
+			logSessionDecision({
+				action: "create",
+				decision: "allowed",
+				chatUser,
+				sessionId,
+				requestId,
+				traceId
+			});
 			log$30.info("[stream] 自动创建新会话", {
 				userId: openId,
 				sessionId
@@ -4293,8 +4711,12 @@ function createChatRouter(config) {
 				if (run.status !== "running") return;
 				recordRunEvent(run, "tool-result");
 				const resultSummary = summarizeForAudit(result);
+				const toolName = readStringField(result, "toolName") || run.lastToolName;
+				const isError = readBooleanField(result, "isError");
+				if (isError) run.lastToolError = resultSummary;
 				if (runtimeConfig.requestContext) logChatAudit(buildAuditEvent(runtimeConfig.requestContext, "tool_call_finished", {
 					toolCallId: toolUseId,
+					toolName,
 					resultSummary,
 					metadata: buildToolResultAuditMetadata(result)
 				}));
@@ -4303,7 +4725,8 @@ function createChatRouter(config) {
 					role: "tool",
 					content: JSON.stringify({
 						toolUseId,
-						result: resultSummary
+						toolName,
+						...buildToolResultPayload(result, resultSummary)
 					}),
 					channel: "web",
 					metadata: {
@@ -4313,12 +4736,33 @@ function createChatRouter(config) {
 						scenarioId,
 						runtimeEventType: "tool-result",
 						toolCallId: toolUseId,
-						toolResult: resultSummary
+						toolName,
+						toolResult: resultSummary,
+						isError
 					}
 				}, "[stream] 保存 tool result 消息失败");
 				broadcastRunEvent(run, "tool-result", {
 					toolUseId,
-					result: resultSummary
+					toolName,
+					...buildToolResultPayload(result, resultSummary)
+				});
+			},
+			onUnknownToolUse: (toolName, toolUseId) => {
+				if (run.status !== "running") return;
+				run.unknownToolCallCount = (run.unknownToolCallCount ?? 0) + 1;
+				run.lastUnknownToolName = toolName;
+				run.lastToolError = {
+					isError: true,
+					reasonCode: "UNKNOWN_TOOL_CALL",
+					toolName,
+					toolCallId: toolUseId
+				};
+				recordRunEvent(run, "unknown-tool-use", { toolName });
+				broadcastRunEvent(run, "runtime-event", {
+					type: "unknown-tool-use",
+					toolName,
+					toolUseId,
+					unknownToolCallCount: run.unknownToolCallCount
 				});
 			},
 			onToolProgress: (toolName, elapsedSeconds) => {
@@ -4559,6 +5003,29 @@ function createChatRouter(config) {
 	router.post("/api/chat/sessions/:id/cancel-active-run", chatAuthMiddleware, async (req, res) => {
 		const chatUser = res.locals.chatUser;
 		const sessionId = String(req.params.id);
+		const requestId = getGatewayRequestId(req.headers);
+		const traceId = getGatewayTraceId(req.headers, requestId);
+		if (!await getOwnedSession(messageStore, sessionId, chatUser)) {
+			logSessionDecision({
+				action: "cancel",
+				decision: "denied",
+				chatUser,
+				sessionId,
+				requestId,
+				traceId,
+				reason: "session_not_owned"
+			});
+			res.status(404).json({ error: "Session not found" });
+			return;
+		}
+		logSessionDecision({
+			action: "cancel",
+			decision: "allowed",
+			chatUser,
+			sessionId,
+			requestId,
+			traceId
+		});
 		const run = chatRunsBySession.get(sessionId);
 		if (!run) {
 			res.json({
@@ -4596,6 +5063,9 @@ function createChatRouter(config) {
 			});
 		}
 	});
+	router.post("/api/chat/sessions/:id/files", chatAuthMiddleware, async (req, res) => {
+		await handleSessionFileUpload(req, res, messageStore);
+	});
 	router.get("/api/chat/history", chatAuthMiddleware, async (req, res) => {
 		const chatUser = res.locals.chatUser;
 		const sessionId = req.query.session_id;
@@ -4605,6 +5075,8 @@ function createChatRouter(config) {
 		}
 		const cursor = req.query.cursor;
 		const limit = parseInt(req.query.limit, 10) || 50;
+		const requestId = getGatewayRequestId(req.headers);
+		const traceId = getGatewayTraceId(req.headers, requestId);
 		log$30.info("[history] 查询会话历史", {
 			userId: chatUser.userId,
 			sessionId,
@@ -4612,6 +5084,27 @@ function createChatRouter(config) {
 			limit
 		});
 		try {
+			if (!await getOwnedSession(messageStore, sessionId, chatUser)) {
+				logSessionDecision({
+					action: "history",
+					decision: "denied",
+					chatUser,
+					sessionId,
+					requestId,
+					traceId,
+					reason: "session_not_owned"
+				});
+				res.status(404).json({ error: "Session not found" });
+				return;
+			}
+			logSessionDecision({
+				action: "history",
+				decision: "allowed",
+				chatUser,
+				sessionId,
+				requestId,
+				traceId
+			});
 			const result = await messageStore.getMessages(sessionId, {
 				cursor,
 				limit
@@ -4647,6 +5140,29 @@ function createChatRouter(config) {
 			res.status(400).json({ error: "session_id is required" });
 			return;
 		}
+		const requestId = getGatewayRequestId(req.headers);
+		const traceId = getGatewayTraceId(req.headers, requestId);
+		if (!await getOwnedSession(messageStore, sessionId, chatUser)) {
+			logSessionDecision({
+				action: "runs",
+				decision: "denied",
+				chatUser,
+				sessionId,
+				requestId,
+				traceId,
+				reason: "session_not_owned"
+			});
+			res.status(404).json({ error: "Session not found" });
+			return;
+		}
+		logSessionDecision({
+			action: "runs",
+			decision: "allowed",
+			chatUser,
+			sessionId,
+			requestId,
+			traceId
+		});
 		const run = chatRunsBySession.get(sessionId);
 		if (!run || !isRunVisibleToUser(run, {
 			tenantKey: chatUser.tenantKey,
@@ -4673,7 +5189,7 @@ function createChatRouter(config) {
 		const chatUser = res.locals.chatUser;
 		log$30.info("[sessions] 列出用户会话", { userId: chatUser.userId });
 		try {
-			const sessions = await messageStore.listSessions(chatUser.openId);
+			const sessions = await messageStore.listSessions(chatUser.openId, chatUser.tenantKey);
 			res.json({ sessions });
 		} catch (err) {
 			const errorMessage = err instanceof Error ? err.message : String(err);
@@ -4717,7 +5233,29 @@ function createChatRouter(config) {
 			sessionId
 		});
 		try {
-			await messageStore.deleteSession(sessionId);
+			const requestId = getGatewayRequestId(req.headers);
+			const traceId = getGatewayTraceId(req.headers, requestId);
+			if (!await messageStore.deleteSessionForOwner(sessionId, getSessionOwner(chatUser))) {
+				logSessionDecision({
+					action: "delete",
+					decision: "denied",
+					chatUser,
+					sessionId,
+					requestId,
+					traceId,
+					reason: "session_not_owned"
+				});
+				res.status(404).json({ error: "Session not found" });
+				return;
+			}
+			logSessionDecision({
+				action: "delete",
+				decision: "allowed",
+				chatUser,
+				sessionId,
+				requestId,
+				traceId
+			});
 			chatRunsBySession.delete(sessionId);
 			res.json({ success: true });
 		} catch (err) {
@@ -7935,6 +8473,11 @@ var SessionMessageStore = class {
 	* 创建新会话
 	*/
 	async createSession(session) {
+		const existing = await this.getSession(session.id);
+		if (existing) {
+			if (existing.userId === session.userId && existing.tenantKey === session.tenantKey) return existing;
+			throw new Error(`Session ${session.id} already exists for a different owner`);
+		}
 		const now = Date.now();
 		const fullSession = {
 			...session,
@@ -7946,9 +8489,9 @@ var SessionMessageStore = class {
 			sessionId: fullSession.id,
 			userId: fullSession.userId
 		});
-		const sessions = await this.readUserSessions(fullSession.userId);
+		const sessions = await this.readUserSessions(fullSession.userId, fullSession.tenantKey);
 		sessions.push(fullSession);
-		await this.writeUserSessions(fullSession.userId, sessions);
+		await this.writeUserSessions(fullSession.userId, sessions, fullSession.tenantKey);
 		return fullSession;
 	}
 	/**
@@ -7975,9 +8518,21 @@ var SessionMessageStore = class {
 	/**
 	* 列出指定用户的所有会话
 	*/
-	async listSessions(userId) {
-		log$24.debug("列出用户会话", { userId });
-		return await this.readUserSessions(userId);
+	async listSessions(userId, tenantKey) {
+		log$24.debug("列出用户会话", {
+			userId,
+			tenantKey
+		});
+		const sessions = await this.readUserSessions(userId, tenantKey);
+		if (!tenantKey) return sessions;
+		const ownedLegacySessions = (await this.readUserSessions(userId)).filter((session) => session.userId === userId && session.tenantKey === tenantKey);
+		const seen = new Set(sessions.map((session) => session.id));
+		return [...sessions, ...ownedLegacySessions.filter((session) => !seen.has(session.id))];
+	}
+	async getSessionForOwner(sessionId, owner) {
+		const session = await this.getSession(sessionId);
+		if (!session) return null;
+		return isSessionOwnedBy(session, owner) ? session : null;
 	}
 	/**
 	* 删除指定会话（同时删除消息文件）
@@ -8007,6 +8562,12 @@ var SessionMessageStore = class {
 			throw err;
 		}
 	}
+	async deleteSessionForOwner(sessionId, owner) {
+		const session = await this.getSession(sessionId);
+		if (!session || !isSessionOwnedBy(session, owner)) return false;
+		await this.deleteSession(sessionId);
+		return true;
+	}
 	/**
 	* 追加消息到会话
 	* 同时更新会话的 updatedAt 和 messageCount
@@ -8096,21 +8657,21 @@ var SessionMessageStore = class {
 	/**
 	* 获取用户会话索引文件路径
 	*/
-	getUserSessionFilePath(userId) {
-		return join(this.sessionsDir, `${userId}.json`);
+	getUserSessionFilePath(userId, tenantKey) {
+		return join(this.sessionsDir, `${buildOwnerKey(userId, tenantKey)}.json`);
 	}
 	/**
 	* 读取用户的会话列表
 	*/
-	async readUserSessions(userId) {
-		const filePath = this.getUserSessionFilePath(userId);
+	async readUserSessions(userId, tenantKey) {
+		const filePath = this.getUserSessionFilePath(userId, tenantKey);
 		return await this.readJsonFile(filePath) || [];
 	}
 	/**
 	* 写入用户的会话列表
 	*/
-	async writeUserSessions(userId, sessions) {
-		const filePath = this.getUserSessionFilePath(userId);
+	async writeUserSessions(userId, sessions, tenantKey) {
+		const filePath = this.getUserSessionFilePath(userId, tenantKey);
 		await this.writeJsonFile(filePath, sessions);
 	}
 	/**
@@ -8210,6 +8771,12 @@ var SessionMessageStore = class {
 		} catch {}
 	}
 };
+function isSessionOwnedBy(session, owner) {
+	return session.userId === owner.openId && session.tenantKey === owner.tenantKey;
+}
+function buildOwnerKey(userId, tenantKey) {
+	return (tenantKey ? `${tenantKey}__${userId}` : userId).replace(/[^A-Za-z0-9_.:-]/g, "_");
+}
 //#endregion
 //#region src/messaging/inbound/user-name-cache-store.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-lark/larkpal",
-  "version": "0.1.72",
+  "version": "0.1.74",
   "description": "LarkPal - Lark/Feishu bot service",
   "type": "module",
   "main": "./dist/main.mjs",