bothouse-dsh 0.1.0 → 0.1.41

package/collab/cloudweb.mjs

@@ -6,7 +6,10 @@ import { exitTarget } from './team-exit.mjs';
 // Rooms are addressed as "room-<id>", messages as "hub-<id>".
 import { forDisplay, forMember, mentions, nameCalled } from './mentions.mjs';
 import { checkAvatar } from './avatars.mjs';
-import { CollabError, MAX_TEXT, publicMessage, quotePrefix } from './store.mjs';
+import { CollabError, MAX_TEXT, messageAttachments, publicMessage, quotePrefix } from './store.mjs';
+import { ChannelApprovals, parseCard, textDecision } from './approvals.mjs';
+
+export { textDecision };
 
 export const WS_PATH = '/cloud-web/ws';
 // Declared to cc-connect. 'buttons' is declared so permission prompts arrive as
@@ -24,21 +27,27 @@ export const CAPABILITIES = ['text', 'reconstruct_reply', 'typing', 'preview', '
  */
 export const CAP_TEAM_WORKSPACE = 'team_workspace';
 export function supportsWorkspaces(store) { return typeof store?.createWorkspace === 'function'; }
+/**
+ * Bot -> channel images, files and voice clips (bridge platform/cloud-web SendImage /
+ * SendFile / SendAudio). Advertised only when the gateway has an attachment store; the
+ * bytes are saved there and shown in the Channel page like an uploaded attachment.
+ */
+export const MEDIA_CAPABILITIES = ['image', 'file', 'audio'];
+// `format` of an audio frame (cc-connect audioFormatHint: file extension or mime subtype)
+// -> mime type the page's <audio> element can play.
+const AUDIO_MIME = { mp3: 'audio/mpeg', mpeg: 'audio/mpeg', wav: 'audio/wav', ogg: 'audio/ogg', opus: 'audio/ogg', oga: 'audio/ogg',
+  m4a: 'audio/mp4', mp4: 'audio/mp4', aac: 'audio/aac', flac: 'audio/flac', webm: 'audio/webm', amr: 'audio/amr', silk: 'audio/silk' };
+export function audioMime(format) {
+  const f = String(format ?? '').toLowerCase().replace(/^\./, '').replace(/^audio\//, '');
+  return AUDIO_MIME[f] ?? (f ? `audio/${f.replace(/[^a-z0-9.+-]/g, '')}` : 'audio/mpeg');
+}
 
 export const PERM_DECISIONS = { allow: 'perm:allow', deny: 'perm:deny', allow_all: 'perm:allow_all' };
-const PERM_STATES = { allow: 'allowed', deny: 'denied', allow_all: 'allowed_all' };
-// Same vocabularies and order as bridge core/engine.go approveAllPhrases /
-// approveAllSingleTokens / allowKeywords / denyKeywords, so a text reply and a
-// button click resolve to the same decision.
-const APPROVE_ALL_PHRASES = ['allow all', 'approve all', 'yes all'];
-const APPROVE_ALL_TOKENS = ['allowall', '允许所有', '允许全部', '全部允许', '所有允许', '都允许', '全部同意'];
-const ALLOW_TOKENS = ['allow', 'yes', 'y', 'ok', 'approve', '允许', '同意', '可以', '好', '好的', '是', '确认'];
-const DENY_TOKENS = ['deny', 'no', 'n', 'reject', 'cancel', '拒绝', '不允许', '不行', '不', '否', '取消'];
 const REGISTER_TIMEOUT_MS = 10_000;
 const WS_BAD_REGISTER = 4002;
 const WS_REPLACED = 4003;
 // cc-connect status notices that teammates never see (discord.go isBotNotice).
-const NOTICE_PREFIXES = ['📬', '✅', '↪', '⏳', '🔄', '⏹', '⏸'];
+export const NOTICE_PREFIXES = ['📬', '✅', '↪', '⏳', '🔄', '⏹', '⏸'];
 // "model · usage" footer cc-connect appends (discord.go botFooter).
 const FOOTER = /(?:^|\n+)\*[^*\n]*·[^*]*\*\s*$/s;
 const BARE_MENTION = '（只 @ 了你，没写内容：看上面的频道消息判断要你做什么；看不出来就问）';
@@ -67,6 +76,14 @@ export function progressCard(content) {
   let p;
   try { p = JSON.parse(content.slice(PROGRESS_PREFIX.length)); } catch { return undefined; }
   if (p === null || typeof p !== 'object') return undefined;
+  return progressCardOf(p);
+}
+
+/**
+ * Progress card payload object ({ agent, state, steps, elapsed_sec, items }) → { text, card }.
+ * Shared by bridge cards above and DSH/CLI member turns (dsh-member.mjs), so both render alike.
+ */
+export function progressCardOf(p) {
   const state = p.state in CARD_STATES ? p.state : 'running';
   const steps = Number.isInteger(p.steps) ? p.steps : 0;
   const sec = Number.isInteger(p.elapsed_sec) ? p.elapsed_sec : 0;
@@ -80,7 +97,9 @@ export function progressCard(content) {
   }
   const agent = String(p.agent ?? 'Agent').trim() || 'Agent';
   const brief = [lines[0], ...briefSteps(items, state)].join('\n');
-  return { text: lines.join('\n'), card: JSON.stringify({ title: `${agent} · ${CARD_STATES[state]}`, state, steps, elapsed_sec: sec, brief }) };
+  const card = { text: lines.join('\n'), card: JSON.stringify({ title: `${agent} · ${CARD_STATES[state]}`, state, steps, elapsed_sec: sec, brief }) };
+  // Bridge task card (cloud-web public_progress.go): its members feed the task board (tasks.mjs fromCard).
+  return Array.isArray(p.task_members) ? { ...card, members: p.task_members } : card;
 }
 
 /**
@@ -118,19 +137,28 @@ function briefSteps(items, state) {
   });
 }
 
+/** reply_to_* frame fields for a reply (store.quote result); {} for a plain message. */
+function replyToFields(quoted, store) {
+  if (quoted === undefined) return {};
+  if (quoted.deleted) return { reply_to_id: String(quoted.id) };
+  return { reply_to_id: String(quoted.id), reply_to_author: quoted.name, reply_to_text: store.message(quoted.id)?.text ?? quoted.text };
+}
+
 export class CloudWebGateway {
   /**
    * @param hub - Hub instance.
    * @param options - { token: shared bot token (empty disables the gateway), logger }.
    */
-  constructor(hub, { token, logger }) {
+  constructor(hub, { token, logger, files }) {
     this.hub = hub;
+    /** #144: Attachments store; its wire() adds images/files to a forwarded message. */
+    this.files = files;
     this.token = token;
     this.logger = logger;
     /** member id -> { ws, member } */
     this.bots = new Map();
-    /** permission prompt message id -> { bot, room, sessionKey, replyCtx } while undecided */
-    this.pendingPerms = new Map();
+    /** #120: permission cards, shared with DSH members (approvals.mjs); meta = { gateway, bot, sessionKey } */
+    this.approvals = ChannelApprovals.of(hub);
     /** Tasks (#139 B), set by the plugin; `task` frames act through it. */
     this.tasks = undefined;
     hub.onMessage(message => this.onNew(message));
@@ -184,9 +212,17 @@ export class CloudWebGateway {
       ws.close(WS_BAD_REGISTER, 'bad register');
       return undefined;
     }
+    const roomParam = url.searchParams.get('room');
+    const roomId = roomParam === null ? undefined : Number(roomParam.replace(/^room-/, ''));
+    if (roomId !== undefined && (!Number.isSafeInteger(roomId) || this.hub.store.room(roomId) === undefined)) {
+      send(ws, { type: 'register_ack', ok: false, error: 'unknown room' });
+      ws.close(WS_BAD_REGISTER, 'unknown room');
+      return undefined;
+    }
+    const rooms = roomId === undefined ? [] : [this.hub.store.settingsRoom(roomId)];
     const name = clean(url.searchParams.get('name') ?? '').slice(0, MAX_NAME) || existing?.name || id;
     // @-mentions resolve by name, so a bot may not reuse another member's name.
-    if (this.hub.memberList().some(m => m.id !== id && m.name.toLowerCase() === name.toLowerCase())) {
+    if (this.hub.memberList().some(m => m.id !== id && (!rooms.length || !m.rooms?.length || rooms.some(r => m.rooms.includes(r))) && m.name.toLowerCase() === name.toLowerCase())) {
       send(ws, { type: 'register_ack', ok: false, error: `name ${name} is already used by another member` });
       ws.close(WS_BAD_REGISTER, 'name taken');
       return undefined;
@@ -195,12 +231,12 @@ export class CloudWebGateway {
     // avatar=<built-in slug> or an http(s) image URL (cc-connect's own library); anything else falls back to the initial badge.
     let avatar = '';
     try { avatar = checkAvatar(url.searchParams.get('avatar'), { allowUrl: true }); } catch { avatar = ''; }
-    const member = { id, name, kind: 'bot', mentionId: /^\d+$/.test(mentionId) ? mentionId : '', online: true, ...(avatar ? { avatar } : {}) };
+    const member = { id, name, rooms, kind: 'bot', mentionId: /^\d+$/.test(mentionId) ? mentionId : '', online: true, ...(avatar ? { avatar } : {}) };
     const bot = { ws, member };
     const old = this.bots.get(id);
     this.bots.set(id, bot);
     if (old !== undefined) old.ws.close(WS_REPLACED, 'replaced by new connection');
-    const capabilities = supportsWorkspaces(this.hub.store) ? [...CAPABILITIES, CAP_TEAM_WORKSPACE] : CAPABILITIES;
+    const capabilities = [...CAPABILITIES, ...(this.files ? MEDIA_CAPABILITIES : []), ...(supportsWorkspaces(this.hub.store) ? [CAP_TEAM_WORKSPACE] : [])];
     send(ws, { type: 'register_ack', ok: true, capabilities, server: { name: 'conest-dsh-collab' } });
     this.hub.setMember(member);
     // A reconnect means a restarted cc-connect; its last typing_stop may be lost.
@@ -208,7 +244,7 @@ export class CloudWebGateway {
     // ...and its half-streamed text previews (also those left by a hub restart) will never be committed.
     this.hub.dropDrafts('role', id);
     // ...and its pending permission requests are gone with the old process.
-    for (const [msgId, p] of this.pendingPerms) if (p.bot === id) this.closePerm(msgId, 'expired');
+    this.approvals.expireWhere(p => p.meta?.gateway === this && p.meta.bot === id);
     return bot;
   }
 
@@ -218,20 +254,27 @@ export class CloudWebGateway {
     const target = exitTarget(msg);
     const fromAgent = msg.author_kind === 'role';
     // The owner's text reply to a pending permission prompt goes the same way as a button click.
-    const answered = msg.author_kind === 'user' ? this.answerByText(msg) : new Set();
+    const answered = this.approvals.answerByText(msg);
     let text = msg.text;
     if (fromAgent) {
       if (NOTICE_PREFIXES.some(p => text.trimStart().startsWith(p))) return;
       text = text.replace(FOOTER, '').trim();
       if (!text) return;
     }
-    const members = this.hub.routable();
+    const members = this.hub.routableIn(msg.room_id);
     const mentioned = mentions(text, members);
     const room = this.hub.store.room(msg.room_id);
     const author = this.hub.members.get(msg.author);
     const only = this.hub.replyRoute(msg);
-    const quote = quotePrefix(this.hub.store.quote(msg));
+    const metas = messageAttachments(msg);
+    const attached = metas.length && this.files ? this.files.wire(metas) : {};
+    const quoted = this.hub.store.quote(msg);
+    const quote = quotePrefix(quoted);
+    // The replied-to row's id (same id space as a task card's preview_handle and a reply_ack),
+    // so the bridge can find the work it belongs to (core.Message.Reference, reply_task.go).
+    const replyTo = replyToFields(quoted, this.hub.store);
     for (const { ws, member } of this.bots.values()) {
+      if (!members.some(m => m.id === member.id)) continue;
       if ((target && target !== member.id) || (fromAgent && msg.author === member.id)) continue;
       if (answered.has(member.id)) continue;
       // A reply addressed to other bots is not this bot's to take (reply_routing.go accept=false).
@@ -244,8 +287,8 @@ export class CloudWebGateway {
       else content = quote + content;
       const frame = {
         type: 'message', msg_id: `hub-${msg.id}`, chat_id: roomKey(msg.room_id), chat_type: 'group',
-        user_id: msg.author, user_name: msg.name, content, reply_ctx: roomKey(msg.room_id),
-        mentioned: hit, from_bot: fromAgent,
+        user_id: msg.author, user_name: msg.name, content: content + (hit ? (this.later?.instructions(member.id, msg.room_id) ?? '') : ''), reply_ctx: roomKey(msg.room_id),
+        mentioned: hit, from_bot: fromAgent, ...attached, ...replyTo,
       };
       if (room !== undefined) frame.chat_name = room.name.replace(/\s+/g, ' ');
       if (author?.mentionId) frame.user_mention_id = author.mentionId;
@@ -258,9 +301,10 @@ export class CloudWebGateway {
    * reminder); onNew never forwards system rows. False when the bot is offline.
    */
   nudge(memberId, msg) {
+    if (this.hub.quota?.cooling(memberId)) return false;
     const bot = this.bots.get(memberId);
-    if (bot === undefined) return false;
-    const members = this.hub.routable();
+    if (bot === undefined || !this.hub.routableIn(msg.room_id).some(m => m.id === memberId)) return false;
+    const members = this.hub.routableIn(msg.room_id);
     const room = this.hub.store.room(msg.room_id);
     const frame = {
       type: 'message', msg_id: `hub-${msg.id}`, chat_id: roomKey(msg.room_id), chat_type: 'group',
@@ -292,6 +336,7 @@ export class CloudWebGateway {
             ...view(r), parent_id: r.parent_id == null ? '' : roomKey(r.parent_id),
             owner: owner == null ? '' : roomKey(owner),
             active: this.tasks?.countActive(r.id) ?? 0,
+            paused: this.tasks?.countPaused?.(r.id) ?? 0,
           };
         });
         return { ok: true, self: view(self), rooms };
@@ -312,7 +357,9 @@ export class CloudWebGateway {
         // stale-claim) when d.claim names an earlier claim than the current one.
         if (self.kind !== 'workspace') return { ok: false, error: 'not-workspace' };
         const claim = d.claim == null || d.claim === '' ? null : String(d.claim);
-        const released = this.tasks ? this.tasks.release(id, claim) : store.releaseWorkspace(id, claim);
+        // park (core ParkTeamWorkspace): its tasks are paused, not finished; they stop counting first.
+        const released = !this.tasks ? store.releaseWorkspace(id, claim)
+          : d.park ? this.tasks.park(id, claim) : this.tasks.release(id, claim);
         if (released) this.hub.emit({ type: 'rooms', rooms: store.roomsView() });
         return { ok: true, room: view(self) };
       }
@@ -328,16 +375,42 @@ export class CloudWebGateway {
     return { ok: false, error: 'bad-op' };
   }
 
+  /**
+   * Retry a previous trigger for a connected bot (#146). Clears error and delivers the message.
+   */
+  retry(memberId, msg) {
+    const bot = this.bots.get(memberId);
+    if (bot === undefined) return false;
+    this.hub.setError(memberId, undefined);
+    return this.nudge(memberId, msg);
+  }
+
+  /**
+   * #148: the owner withdrew a message. Every connected bot gets a recall for
+   * it; a bridge stops the turn that message started, or drops it from its
+   * queue, and ignores it otherwise (core/engine.go handleMessageRecall).
+   * Returns the ids of the bots told.
+   */
+  recall(msgId) {
+    const told = [];
+    for (const [id, { ws }] of this.bots) {
+      send(ws, { type: 'message_recall', msg_id: `hub-${msgId}` });
+      told.push(id);
+    }
+    return told;
+  }
+
   async fromBot(bot, d) {
     const { member } = bot;
     switch (d.type) {
       case 'ping': send(bot.ws, { type: 'pong' }); return;
       case 'task': {
         // #139 B: the socket says which bot this is, so the action is verified as it.
+        // The frame's `ref` is the ack correlation id, so its task field ref (#574) travels as task_ref.
         const ack = r => send(bot.ws, { type: 'task_ack', ref: d.ref, ...r });
         if (this.tasks === undefined) { ack({ ok: false, error: 'tasks are not enabled' }); return; }
         try {
-          const task = this.tasks.perform(String(d.action ?? ''), { id: Number(d.task_id), roomId: roomOf(d, this.hub.store), body: d }, { actor: member.id, verified: true });
+          const task = this.tasks.perform(String(d.action ?? ''), { id: Number(d.task_id), roomId: roomOf(d, this.hub.store), body: { ...d, ref: d.task_ref } }, { actor: member.id, verified: true });
           ack({ ok: true, task });
         } catch (error) {
           ack({ ok: false, error: error?.message ?? String(error), code: error?.code });
@@ -351,9 +424,15 @@ export class CloudWebGateway {
         const text = forDisplay(content, this.hub.routable()).trim();
         if (!text || text.length > MAX_TEXT) return;
         // reply_in_place (#121): the streamed preview becomes this reply; fall back to a new row if it is gone.
+        // A frame with ref_id asks for the posted row's id back (bridge SentMessageRecorder).
+        const ack = id => { if (typeof d.ref_id === 'string' && d.ref_id) send(bot.ws, { type: 'preview_ack', ref_id: d.ref_id, preview_handle: String(id) }); };
         const h = d.preview_handle;
-        if (typeof h === 'string' && /^\d+$/.test(h) && this.hub.commit(Number(h), 'role', member.id, text, d.agent === true) !== undefined) return;
-        this.hub.post(room, { authorKind: 'role', author: member.id, name: member.name, text, fromTurn: d.agent === true });
+        if (typeof h === 'string' && /^\d+$/.test(h)) {
+          const row = this.hub.commit(Number(h), 'role', member.id, text, d.agent === true);
+          if (row !== undefined) { ack(row.id); return; }
+        }
+        const { message } = this.hub.post(room, { authorKind: 'role', author: member.id, name: member.name, text, fromTurn: d.agent === true });
+        ack(message.id);
         return;
       }
       case 'buttons': {
@@ -371,13 +450,40 @@ export class CloudWebGateway {
           return;
         }
         // cc-connect keeps one pending permission per session: a new prompt supersedes older ones.
-        for (const [msgId, p] of this.pendingPerms) if (p.bot === member.id && p.sessionKey === d.session_key) this.closePerm(msgId, 'expired');
-        const card = {
-          kind: 'permission', title: '权限请求', state: 'pending',
+        this.approvals.expireWhere(p => p.meta?.gateway === this && p.meta.bot === member.id && p.meta.sessionKey === d.session_key);
+        const sessionKey = d.session_key;
+        const replyCtx = typeof d.reply_ctx === 'string' ? d.reply_ctx : roomKey(room);
+        this.approvals.open({
+          room, author: member, text,
           actions: decisions.map(([decision, data]) => ({ decision, label: buttons.find(b => b.data === data).label })),
-        };
-        const { message } = this.hub.post(room, { authorKind: 'role', author: member.id, name: member.name, text, card: JSON.stringify(card) });
-        this.pendingPerms.set(message.id, { bot: member.id, room, sessionKey: d.session_key, replyCtx: typeof d.reply_ctx === 'string' ? d.reply_ctx : roomKey(room) });
+          meta: { gateway: this, bot: member.id, sessionKey },
+          check: () => {
+            if (!this.bots.has(member.id)) throw new CollabError('offline', `${member.name} 已断线，权限请求还在等待，重连后会失效`);
+          },
+          onDecide: (decision) => {
+            const bot = this.bots.get(member.id);
+            if (bot !== undefined) send(bot.ws, { type: 'card_action', session_key: sessionKey, reply_ctx: replyCtx, action: PERM_DECISIONS[decision] });
+          },
+        });
+        return;
+      }
+      case 'image':
+      case 'file':
+      case 'audio': {
+        const room = roomOf(d, this.hub.store);
+        if (room === undefined || this.files === undefined || typeof d.data !== 'string' || !d.data) return;
+        const ext = String(d.format ?? '').toLowerCase().replace(/^\./, '').replace(/^audio\//, '').replace(/[^a-z0-9]/g, '');
+        const mime = d.type === 'audio' ? audioMime(d.format) : (typeof d.mime_type === 'string' && d.mime_type) || 'application/octet-stream';
+        const name = typeof d.file_name === 'string' && d.file_name ? d.file_name
+          : d.type === 'audio' ? `voice.${ext || 'mp3'}` : d.type === 'image' ? `image.${mime.split('/')[1] ?? 'png'}` : 'file';
+        let attachments;
+        try {
+          attachments = this.files.save([{ name, mime, data: d.data }]);
+        } catch (error) {
+          this.logger.warn('collab: cloud-web %s frame from %s dropped: %s', d.type, member.id, error?.message ?? error);
+          return;
+        }
+        this.hub.post(room, { authorKind: 'role', author: member.id, name: member.name, text: '', attachments });
         return;
       }
       case 'typing_start':
@@ -389,14 +495,21 @@ export class CloudWebGateway {
       case 'preview_start': {
         if (typeof d.ref_id !== 'string') return;
         const room = roomOf(d, this.hub.store);
-        const body = this.body(d.content);
+        const seq = cardSeq(d);
+        const body = withSeq(this.body(d.content), seq);
         let handle = '';
         if (room !== undefined && body.text) {
-          const { message } = this.hub.draft(room, {
+          const { message, created } = this.hub.draft(room, {
             authorKind: 'role', author: member.id, name: member.name, text: body.text, card: body.card,
             clientKey: `preview:${member.id}:${d.ref_id}`,
           });
+          // #119: a task card create retried after a lost ack finds the row it
+          // made before; show the newer content instead of the first one.
+          const fresh = created || newerSeq(message, seq);
+          if (!created && fresh) this.hub.edit(message.id, 'role', member.id, body.text, body.card);
           handle = String(message.id);
+          // A late older frame must not reopen tasks the newer card already handed back.
+          if (fresh && body.members) this.tasks?.fromCard(room, member.id, message.id, body.members);
         }
         // Always ack, or cc-connect waits out its 10 s timeout.
         send(bot.ws, { type: 'preview_ack', ref_id: d.ref_id, preview_handle: handle });
@@ -412,75 +525,22 @@ export class CloudWebGateway {
         const h = d.preview_handle;
         if (typeof h !== 'string' || !/^\d+$/.test(h)) return;
         if (d.type === 'delete_message') { this.hub.remove(Number(h), 'role', member.id); return; }
-        const body = this.body(d.content);
-        if (body.text) this.hub.edit(Number(h), 'role', member.id, body.text, body.card);
+        const seq = cardSeq(d);
+        // #119: a delayed older task card frame must not roll the card back.
+        if (seq !== undefined && !newerSeq(this.hub.store.message(Number(h)), seq)) return;
+        const body = withSeq(this.body(d.content), seq);
+        if (!body.text) return;
+        const row = this.hub.edit(Number(h), 'role', member.id, body.text, body.card);
+        if (row !== undefined && body.members) this.tasks?.fromCard(row.room_id, member.id, row.id, body.members);
         return;
       }
       default:
     }
   }
 
-  /**
-   * Resolve permission prompt `msgId` with `decision` (a PERM_DECISIONS key) on
-   * behalf of the Channel owner (callers check that). Throws CollabError when the
-   * prompt is not a permission request, already decided, expired, or its bot is offline.
-   */
+  /** #120: the owner's decision on permission card `msgId` (approvals.mjs decide). */
   decidePermission(msgId, decision, by = 'button') {
-    if (!Object.hasOwn(PERM_DECISIONS, decision)) throw new CollabError('invalid', `unknown decision ${decision}`);
-    const row = this.hub.store.message(msgId);
-    const card = row === undefined ? undefined : parseCard(row.card);
-    if (card?.kind !== 'permission') throw new CollabError('not-permission', '这条消息不是权限请求');
-    if (card.state !== 'pending') throw new CollabError('conflict', card.state === 'expired' ? '这个权限请求已过期' : '这个权限请求已经处理过了');
-    const p = this.pendingPerms.get(msgId);
-    if (p === undefined) {
-      // Pending in the store but not in memory: collab restarted, cc-connect's side is unknown.
-      this.closePerm(msgId, 'expired', row);
-      throw new CollabError('conflict', '这个权限请求已过期');
-    }
-    const bot = this.bots.get(p.bot);
-    if (bot === undefined) throw new CollabError('offline', `${row.name} 已断线，权限请求还在等待，重连后会失效`);
-    this.closePerm(msgId, PERM_STATES[decision], row, by);
-    send(bot.ws, { type: 'card_action', session_key: p.sessionKey, reply_ctx: p.replyCtx, action: PERM_DECISIONS[decision] });
-    return publicMessage(this.hub.store.message(msgId), this.hub.store);
-  }
-
-  /** Mark a permission prompt decided/expired and update it for browsers. */
-  closePerm(msgId, state, row = this.hub.store.message(msgId), by) {
-    this.pendingPerms.delete(msgId);
-    const card = row === undefined ? undefined : parseCard(row.card);
-    if (card?.kind !== 'permission' || card.state !== 'pending') return;
-    const next = { ...card, state, ...(by ? { decided_by: by } : {}), decided_at: Math.floor(Date.now() / 1000) };
-    this.hub.edit(row.id, 'role', row.author, row.text, JSON.stringify(next));
-  }
-
-  /**
-   * Owner text reply → decision on the room's pending prompts; returns the ids of the
-   * bots that must not also get the text (prompt answered, or withheld from them).
-   *
-   * cc-connect checks a pending permission before its gate and before any mention rule
-   * (bridge core/engine.go handleMessage → handlePendingPermission, ahead of applyGate),
-   * and hub bots run with group_reply_all (core/setup_wizard.go), so every bot with a
-   * pending prompt that receives an allow/deny word acts on it. Hence: no @ → the
-   * decision applies to every pending prompt in the room; an @ → only the @'d bots', and
-   * the other pending bots are not sent the text so their prompts stay open.
-   */
-  answerByText(msg) {
-    const answered = new Set();
-    const members = this.hub.routable();
-    const inRoom = [...this.pendingPerms].filter(([, p]) => p.room === msg.room_id && this.bots.has(p.bot));
-    if (inRoom.length === 0) return answered;
-    const mentioned = mentions(msg.text, members);
-    for (const [msgId, p] of inRoom) {
-      const decision = textDecision(forMember(msg.text, this.bots.get(p.bot).member, members));
-      if (decision === undefined) continue;
-      if (mentioned.size > 0 && !mentioned.has(p.bot)) {
-        answered.add(p.bot); // addressed to someone else: withhold it so this bot's bridge doesn't approve
-        continue;
-      }
-      try { this.decidePermission(msgId, decision, 'text'); } catch { continue; }
-      answered.add(p.bot);
-    }
-    return answered;
+    return this.approvals.decide(msgId, decision, by);
   }
 
   body(content) {
@@ -495,24 +555,23 @@ export class CloudWebGateway {
   }
 }
 
-function parseCard(raw) {
-  if (typeof raw !== 'string') return undefined;
-  try { return JSON.parse(raw); } catch { return undefined; }
+/** The task card sequence a frame carries (bridge cloud-web EnsureTaskCard), or undefined. */
+function cardSeq(d) {
+  return Number.isSafeInteger(d.seq) && d.seq >= 0 ? d.seq : undefined;
 }
 
-// Same rune set as bridge core/engine.go permissionTokenSeparator (whitespace plus these).
-const PERM_TOKEN_SEPARATORS = /[\s@＠,，.。!！?？:：;；()（）[\]【】"'“”‘’、·]+/u;
+/** Record seq in the stored card so later frames can be compared with it. */
+function withSeq(body, seq) {
+  if (seq === undefined || body.card == null) return body;
+  const card = parseCard(body.card);
+  return card === undefined ? body : { ...body, card: JSON.stringify({ ...card, seq }) };
+}
 
-/** Port of bridge core/engine.go isApproveAllResponse / isAllowResponse / isDenyResponse (checked in that order). */
-export function textDecision(text) {
-  const tokens = String(text).toLowerCase().trim().split(PERM_TOKEN_SEPARATORS).filter(Boolean);
-  if (tokens.length === 0) return undefined;
-  const joined = tokens.join(' ');
-  if (APPROVE_ALL_PHRASES.some(ph => joined === ph || ` ${joined} `.includes(` ${ph} `))) return 'allow_all';
-  if (tokens.some(t => APPROVE_ALL_TOKENS.includes(t))) return 'allow_all';
-  if (tokens.some(t => ALLOW_TOKENS.includes(t))) return 'allow';
-  if (tokens.some(t => DENY_TOKENS.includes(t))) return 'deny';
-  return undefined;
+/** True when seq is newer than what row's card was last written with (rows without one count as older). */
+function newerSeq(row, seq) {
+  if (row === undefined || seq === undefined) return false;
+  const stored = parseCard(row.card)?.seq;
+  return !Number.isSafeInteger(stored) || seq > stored;
 }
 
 function send(ws, frame) {