botmux 2.111.0 → 2.112.0

package/dist/cli.js

@@ -5,13 +5,13 @@
  * Usage:
  *   botmux setup          — interactive first-time configuration
  *   botmux setup --no-open-platform-auto — skip Feishu Open Platform automation
- *   botmux setup list|add|edit|remove — scripted (non-TUI) bot management, see `botmux setup help`
+ *   botmux setup list|add|configure|edit|remove — scripted (non-TUI) bot management, see `botmux setup help`
  *   botmux start          — start daemon and auto plugin services
  *   botmux stop [--with-plugin] — stop daemon (optionally stop auto plugin services)
  *   botmux restart [--include-pm2] [--with-plugin] — restart daemon, then ensure auto plugin services
  *   botmux logs [--lines] — view daemon logs
  *   botmux status         — show daemon status
- *   botmux upgrade        — upgrade to latest version
+ *   botmux upgrade|update — upgrade to latest version
  *   botmux list           — interactive session picker (TUI), attach to tmux
  *   botmux list --plain   — plain table output (for piping / scripts)
  *   botmux delete <id>    — close a session by ID prefix
@@ -27,9 +27,11 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { createInterface } from 'node:readline';
 import { createRequire } from 'node:module';
-import { createHmac, randomBytes } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 import { validateWorkingDir } from './core/working-dir.js';
 import { resolveSessionContext } from './core/session-marker.js';
+import { resolveBotmuxDataDir } from './core/data-dir.js';
+import { dashboardSecretPath } from './core/dashboard-secret.js';
 import { parseDispatchBotSpec, buildDispatchMessages, buildRepoPrimeText, buildReportContent, eligibleAutoMentionAliases, offTopicSubBotTopic, resolveReportTarget, resolveSendTarget } from './core/dispatch.js';
 import { enableAutostart, disableAutostart, autostartStatus, refreshAutostart } from './autostart.js';
 import { tmuxEnv } from './setup/ensure-tmux.js';
@@ -38,6 +40,7 @@ import { applyBotConfigEdits, assertUniqueBotProcessNames, botProcessName, norma
 import { resolveCliSelection, selectionKeyForBot } from './setup/cli-selection.js';
 import { checkCliAvailability, hasAgentLaunchConfigChanged } from './setup/cli-availability.js';
 import { resolveSetupAppName } from './setup/app-name.js';
+import { blocksSetupBotStart, classifySetupOpenPlatformOutcome, scriptedSetupOpenPlatformReuseOnly, setupOpenPlatformOutcomeJson, setupOpenPlatformRetryCommand, } from './setup/open-platform-outcome.js';
 import { buildBotFromAddFlags, editInputFromFlags, isScriptedSetupInvocation, maskAppSecret, parseSetupCommand, SETUP_CLI_USAGE, } from './setup/setup-args.js';
 import { interactiveSelect, pickChoice, pickCliSelection } from './setup/interactive-select.js';
 import { buildPreset, serializePreset, presetFilename } from './setup/agent-preset.js';
@@ -52,6 +55,10 @@ import { callDashboard } from './cli/dashboard-endpoint.js';
 import { installLatestBotmuxSync } from './core/maintenance.js';
 import { formatGlobalInstallCommand, resolveGlobalInstallPlan, UnsupportedGlobalInstallError, } from './utils/global-install.js';
 import { loadDashboardSecret } from './dashboard/auth.js';
+import { postWorkflowDaemonMutation, } from './workflows/v3/daemon-ipc-client.js';
+import { postWorkflowSessionRunMutation, readWorkflowSessionRelayContext, } from './workflows/v3/session-relay-client.js';
+import { fetchDaemonIpc, loadDaemonIpcSecret } from './core/daemon-ipc-auth.js';
+import { readManagedOriginCapability } from './core/managed-origin-capability.js';
 import { rejectLikelyWindowsStdinMojibake, decodeStdinBytes } from './cli/stdin-encoding.js';
 import { formatBotInfoEntriesForCli, formatChatBotsForCli, } from './cli/bots-list-output.js';
 import { buildFooterAddressing, hasKnownBotMention, knownBotOpenIdsFromCrossRef, orderedFooterRecipients, stripCodeSpans, } from './utils/bot-routing.js';
@@ -62,9 +69,13 @@ import { createWhiteboard, ensureDefaultWhiteboard, getWhiteboard, listWhiteboar
 import { buildBridgeSendMarkerContent } from './services/bridge-fallback-gate.js';
 import { writeManualIntentIfAbsentTo } from './services/restart-intent-store.js';
 import { stripLegacyPendingCardFields } from './services/session-store.js';
+import { evaluateVcMeetingManagedSend, isTrustedVcMeetingHostRelayParent, resolveVcMeetingImTurnOrigin, } from './services/vc-meeting-send-policy.js';
+import { finishVcMeetingImReply, prepareVcMeetingDeliveryReply, prepareVcMeetingImReply, } from './services/vc-meeting-im-reply.js';
+import { recordVcMeetingListenerMessage } from './services/vc-meeting-listener-message-store.js';
 import { isValidPluginId, normalizePluginIdList } from './core/plugins/ids.js';
 import { resolveEffectivePluginIds, updateBotPluginOverride } from './core/plugins/effective.js';
 import { assertPluginBindingTransition, describePluginDependencyError, enabledPluginDependents, } from './core/plugins/dependencies.js';
+import { authorizeV3DaemonCommand } from './workflows/v3/cli-daemon-command-authority.js';
 // Resolve the CLI's UI locale once from the global config file, so subsequent
 // CLI output (and any t() callers that don't pass an explicit locale) honour
 // the user's chosen language. Daemon entrypoint sets this separately for the
@@ -521,19 +532,23 @@ async function finishOpenPlatformSetup(appId, brand, options = {}) {
         say('\n已跳过开放平台自动配置 (--no-open-platform-auto)。');
         if (!options.quiet)
             printRemainingSteps(appId, brand);
-        return;
+        return { status: 'skipped' };
     }
     say('\n── 开放平台自动配置 ──\n');
-    say(options.reuseOnly
-        ? '将复用创建应用时的 Feishu Web session，自动导入权限、配置 redirect URL 并创建/发布版本；本路径不会再显示二维码。'
-        : '将获取或复用 Feishu Web session，自动导入权限、配置 redirect URL 并创建/发布版本。');
+    say(options.forceQrLogin
+        ? '将按 --switch-account 明确重新扫码，自动导入权限、配置 redirect URL 并创建/发布版本。'
+        : options.reuseOnly
+            ? '将复用创建应用时的 Feishu Web session，自动导入权限、配置 redirect URL 并创建/发布版本；本路径不会再显示二维码。'
+            : '将获取或复用 Feishu Web session，自动导入权限、配置 redirect URL 并创建/发布版本。');
     say('如失败会自动回退到手动步骤提示，不影响已写入的 botmux 配置。\n');
     const result = await automateOpenPlatformSetup({
         appId,
         brand,
+        forceQrLogin: options.forceQrLogin,
         disableQrLogin: options.reuseOnly,
-        disableBytedcliFallback: options.reuseOnly,
+        disableBytedcliFallback: options.reuseOnly || options.forceQrLogin,
     });
+    const outcome = classifySetupOpenPlatformOutcome(result);
     if (result.ok) {
         say('✅ 开放平台自动配置完成');
         say(`   Session 来源: ${result.sessionSource}`);
@@ -552,14 +567,15 @@ async function finishOpenPlatformSetup(appId, brand, options = {}) {
         else
             say('   已创建版本；未从响应中解析到 versionId，请到开放平台确认是否需要手动发布。');
         say('');
-        return;
+        return outcome;
     }
-    say(`⚠️  开放平台自动配置失败 (${result.reason}): ${result.message}`);
+    say(`${outcome.status === 'manual' ? 'ℹ️ ' : '⚠️ '} 开放平台自动配置${outcome.status === 'manual' ? '需要手动完成' : '失败'} (${result.reason}): ${result.message}`);
     if (result.sessionFile)
         say(`   botmux session 文件: ${result.sessionFile}`);
     say('   请按下面的手动步骤继续完成开放平台配置。');
     if (!options.quiet)
         printRemainingSteps(appId, brand);
+    return outcome;
 }
 /**
  * 「选择已有应用」路径：复用/扫码飞书 Web 登录态 → 拉当前账号可见的自建应用
@@ -1265,7 +1281,7 @@ function botJsonView(bot, index) {
     };
 }
 /**
- * `botmux setup list|add|edit|remove` — 脚本化（非 TUI）bot 管理。
+ * `botmux setup list|add|configure|edit|remove` — 脚本化（非 TUI）bot 管理。
  * 给 coding agent / 脚本一个字段级稳定接口，不依赖交互问答顺序（管道喂数字
  * 的老姿势在问题序列变化时会静默错位）。校验口径与 TUI 一致：目录存在性、
  * owner 必填、凭证变更时的 tenant_access_token 校验，任一失败不写盘。
@@ -1299,6 +1315,60 @@ async function cmdSetupScripted(argv) {
         }
         return;
     }
+    if (cmd.action === 'configure') {
+        const index = parseBotSelection(cmd.selector, bots);
+        if (index === undefined) {
+            failSetupScripted(cmd.json, `找不到机器人 "${cmd.selector}"（接受进程名 botmux-N 或 AppID，botmux setup list 可查）。`);
+            return;
+        }
+        const bot = bots[index];
+        const processName = botProcessName(bot, index, PM2_NAME);
+        const openPlatform = await finishOpenPlatformSetup(bot.larkAppId, botBrand(bot), {
+            // Machine-readable callers must never be surprised by an interactive QR.
+            reuseOnly: cmd.json && !cmd.switchAccount,
+            forceQrLogin: cmd.switchAccount,
+            quiet: cmd.json,
+        });
+        if (openPlatform.status === 'failed' || openPlatform.status === 'manual') {
+            const continueCommand = setupOpenPlatformRetryCommand(bot.larkAppId, openPlatform);
+            const next = continueCommand ?? 'manual_open_platform_setup';
+            failSetupScripted(cmd.json, openPlatform.status === 'manual'
+                ? '该租户不支持自动配置，请按开放平台手动步骤完成。'
+                : `开放平台自动配置未完成；机器人配置保留，未自动上线。请修复后重试 ${continueCommand}。`, {
+                partial: true,
+                action: 'configure',
+                bot: botJsonView(bot, index),
+                appId: bot.larkAppId,
+                openPlatform: setupOpenPlatformOutcomeJson(openPlatform),
+                ...(continueCommand ? { continueCommand } : {}),
+                next,
+            });
+            return;
+        }
+        const live = ensureBotDaemonStarted(bot.larkAppId, { quiet: cmd.json });
+        const next = live.ok ? 'live' : (live.reason === 'fleet_down' ? 'botmux start' : 'botmux restart');
+        if (cmd.json) {
+            console.log(JSON.stringify({
+                ok: true,
+                action: 'configure',
+                bot: botJsonView(bot, index),
+                appId: bot.larkAppId,
+                openPlatform: setupOpenPlatformOutcomeJson(openPlatform),
+                live,
+                next,
+            }, null, 2));
+        }
+        else {
+            console.log(`✅ 已完成 ${processName} (${bot.larkAppId}) 的开放平台配置`);
+            if (live.ok)
+                console.log(`✅ 已自动上线（${live.processName}）`);
+            else if (live.reason === 'fleet_down')
+                console.log('下一步: botmux start（daemon 尚未运行）');
+            else
+                console.log(`⚠️  自动上线失败（${live.message}）。下一步: botmux restart`);
+        }
+        return;
+    }
     if (cmd.action === 'add') {
         // 单机器人 .env 老配置：与 TUI「添加新机器人」一致，先迁移进 bots.json 再追加。
         let existing = bots;
@@ -1487,13 +1557,40 @@ async function cmdSetupScripted(argv) {
             }
         }
         // 已有凭证模式默认跳过；--create-app 默认开启并复用刚才的 Web session。
+        let openPlatform = { status: 'skipped' };
         if (cmd.openPlatformAuto) {
-            await finishOpenPlatformSetup(bot.larkAppId, botBrand(bot), {
-                reuseOnly: cmd.createApp && !cmd.compatibilityMode && botBrand(bot) === 'feishu',
+            openPlatform = await finishOpenPlatformSetup(bot.larkAppId, botBrand(bot), {
+                reuseOnly: scriptedSetupOpenPlatformReuseOnly({
+                    json: cmd.json,
+                    createApp: cmd.createApp,
+                    compatibilityMode: cmd.compatibilityMode,
+                    brand: botBrand(bot),
+                }),
                 quiet: cmd.json,
             });
         }
         const index = existing.length;
+        if (blocksSetupBotStart(openPlatform)) {
+            const continueCommand = setupOpenPlatformRetryCommand(bot.larkAppId, openPlatform);
+            failSetupScripted(cmd.json, `机器人配置已写入，但开放平台自动配置未完成，未自动上线。修复后运行 ${continueCommand}；不会重复创建应用。`, {
+                partial: true,
+                action: 'add',
+                bot: botJsonView(bot, index),
+                appId: bot.larkAppId,
+                ...(createdAppName ? { appName: createdAppName } : {}),
+                botsFile: BOTS_JSON_FILE,
+                envMigrated: migratedEnv || undefined,
+                openPlatform: setupOpenPlatformOutcomeJson(openPlatform),
+                continueCommand,
+                live: {
+                    ok: false,
+                    reason: 'open_platform_incomplete',
+                    message: '开放平台关键配置未完成，未启动新机器人',
+                },
+                next: continueCommand,
+            });
+            return;
+        }
         // daemon 在跑就直接把新 bot 那一个进程拉起来，免整组 botmux restart。
         const live = ensureBotDaemonStarted(bot.larkAppId, { quiet: cmd.json });
         const next = live.ok ? 'live' : (live.reason === 'fleet_down' ? 'botmux start' : 'botmux restart');
@@ -1506,7 +1603,7 @@ async function cmdSetupScripted(argv) {
                 ...(cmd.createApp && botBrand(bot) === 'feishu' && !cmd.compatibilityMode ? { appName: resolveSetupAppName(cmd.flags.appName, index) } : {}),
                 botsFile: BOTS_JSON_FILE,
                 envMigrated: migratedEnv || undefined,
-                openPlatform: cmd.openPlatformAuto ? 'attempted' : 'skipped',
+                openPlatform: setupOpenPlatformOutcomeJson(openPlatform),
                 live,
                 next,
             }, null, 2));
@@ -2021,7 +2118,7 @@ async function cmdStart() {
  * the pm2 zombie-cleanup flow so the dashboard registry stays consistent.
  */
 function cleanupStaleDaemonDescriptors() {
-    const regDir = join(DATA_DIR, 'dashboard-daemons');
+    const regDir = join(resolveDataDir(), 'dashboard-daemons');
     if (!existsSync(regDir))
         return;
     for (const f of readdirSync(regDir)) {
@@ -2598,28 +2695,7 @@ async function cmdDashboard() {
  * Priority: SESSION_DATA_DIR env > daemon breadcrumb (~/.botmux/.data-dir) > default (~/.botmux/data)
  */
 function resolveDataDir() {
-    if (process.env.SESSION_DATA_DIR)
-        return process.env.SESSION_DATA_DIR;
-    // Read breadcrumb written by the daemon at startup
-    const breadcrumb = join(CONFIG_DIR, '.data-dir');
-    if (existsSync(breadcrumb)) {
-        try {
-            const dir = readFileSync(breadcrumb, 'utf-8').trim();
-            if (dir && existsSync(dir)) {
-                // Check for any session file (legacy or per-bot)
-                if (existsSync(join(dir, 'sessions.json')))
-                    return dir;
-                try {
-                    const files = readdirSync(dir);
-                    if (files.some(f => f.startsWith('sessions-') && f.endsWith('.json')))
-                        return dir;
-                }
-                catch { /* ignore */ }
-            }
-        }
-        catch { /* ignore */ }
-    }
-    return DATA_DIR;
+    return resolveBotmuxDataDir();
 }
 /** Load sessions from all session files (legacy + per-bot). */
 function loadSessions() {
@@ -3393,7 +3469,7 @@ async function cmdSuspend() {
             continue;
         }
         try {
-            const res = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/sessions/${encodeURIComponent(s.sessionId)}/suspend`, { method: 'POST' });
+            const res = await fetchDaemonIpc(daemon.ipcPort, `/api/sessions/${encodeURIComponent(s.sessionId)}/suspend`, { method: 'POST' });
             const body = await res.json().catch(() => ({}));
             if (res.ok && body?.ok) {
                 if (body.suspended) {
@@ -3424,6 +3500,120 @@ async function cmdSuspend() {
     if (failed > 0)
         process.exitCode = 1;
 }
+/** 会话级 CLI IPC（slash/cd）的 POST：与 postAsk 同款双路径——能读 host secret
+ *  （非隔离进程）走 trusted-host HMAC 签名；读不到（沙箱 BOTMUX_SEND_RELAY /
+ *  macOS 读隔离 carve-out）改带本会话当前轮换的 origin capability，由 daemon
+ *  handler 与活跃记录比对。两条路都不读 bots.json。 */
+async function postSessionCliIpc(ipcPort, sessionId, route, payload) {
+    const requestBody = { ...payload };
+    let hostSecret;
+    if (!process.env.BOTMUX_SEND_RELAY) {
+        try {
+            hostSecret = loadDaemonIpcSecret();
+        }
+        catch { /* sandboxed/read-isolated: capability fallback below */ }
+    }
+    if (!hostSecret) {
+        const claim = readManagedOriginCapability(resolveDataDir(), sessionId, process.env.BOTMUX_SEND_RELAY);
+        if (claim) {
+            requestBody.originCapability = claim.capability;
+            if (claim.turnId)
+                requestBody.originTurnId = claim.turnId;
+            if (claim.dispatchAttempt !== undefined)
+                requestBody.originDispatchAttempt = claim.dispatchAttempt;
+        }
+    }
+    const path = `/api/sessions/${encodeURIComponent(sessionId)}/${route}`;
+    const init = {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(requestBody),
+    };
+    return hostSecret
+        ? fetchDaemonIpc(ipcPort, path, init, hostSecret)
+        : fetch(`http://127.0.0.1:${ipcPort}${path}`, init);
+}
+/** botmux slash "<斜杠命令>"：请求 daemon 在本会话 idle 后把命令敲入自己的 CLI。
+ *  自识别当前会话（pid marker → BOTMUX_SESSION_ID env），allowlist 由 daemon 侧校验。 */
+async function cmdSlash() {
+    const argv = process.argv.slice(3);
+    const sIdx = argv.indexOf('--session');
+    const explicitSid = sIdx >= 0 ? argv[sIdx + 1] : undefined;
+    // 所有非 flag 位置参数 join(' ')，而不是只取第一个——未加引号的命令若含空格
+    // （如 `botmux slash /model opus`）此前会被截断成 `/model`。
+    const command = argv.filter((a, i) => !a.startsWith('--') && !(sIdx >= 0 && i === sIdx + 1)).join(' ');
+    if (!command) {
+        console.error('用法: botmux slash "/compact" [--session <id>]');
+        process.exit(1);
+    }
+    const ctx = explicitSid ? null : findAncestorSessionContext();
+    const sid = explicitSid ?? ctx?.sessionId;
+    if (!sid) {
+        console.error('❌ 无法定位当前会话（需在 bot 会话内执行，或用 --session 指定）');
+        process.exit(1);
+    }
+    const sessions = loadSessions();
+    const s = [...sessions.values()].find(x => x.sessionId === sid || x.sessionId.startsWith(sid));
+    if (!s) {
+        console.error(`❌ 未找到 session ${sid}`);
+        process.exit(1);
+    }
+    const daemon = findDaemon(s.larkAppId);
+    if (!daemon) {
+        console.error('❌ daemon 不在线');
+        process.exit(1);
+    }
+    const res = await postSessionCliIpc(daemon.ipcPort, s.sessionId, 'slash', { command });
+    const body = await res.json().catch(() => ({}));
+    if (res.ok && body?.ok) {
+        console.log(`✓ 已排队注入: ${body.queued}（会话空闲时执行；CLI 进程若在执行前重启则丢弃）`);
+        return;
+    }
+    console.error(`✗ 被拒绝: ${body?.error ?? `HTTP ${res.status}`}`);
+    process.exit(1);
+}
+/** botmux cd <角色目录>：请求 daemon 重钉本话题工作目录（角色切换）。
+ *  daemon 侧校验目录必须在 ~/botmux-roles 下；Claude 家族 idle 注入 /cd 不重启，
+ *  其余 CLI 杀进程冷启动。协议要求本命令是该轮最后一个动作。 */
+async function cmdCd() {
+    const argv = process.argv.slice(3);
+    const sIdx = argv.indexOf('--session');
+    const explicitSid = sIdx >= 0 ? argv[sIdx + 1] : undefined;
+    // 所有非 flag 位置参数 join(' ')，而不是只取第一个——路径含空格且未加引号时
+    // （如 `botmux cd ~/botmux-roles/我的 角色`）此前会被截断。
+    const dir = argv.filter((a, i) => !a.startsWith('--') && !(sIdx >= 0 && i === sIdx + 1)).join(' ');
+    if (!dir) {
+        console.error('用法: botmux cd <目标目录（含空格建议加引号）> [--session <id>]');
+        process.exit(1);
+    }
+    const ctx = explicitSid ? null : findAncestorSessionContext();
+    const sid = explicitSid ?? ctx?.sessionId;
+    if (!sid) {
+        console.error('❌ 无法定位当前会话（需在 bot 会话内执行，或用 --session 指定）');
+        process.exit(1);
+    }
+    const sessions = loadSessions();
+    const s = [...sessions.values()].find(x => x.sessionId === sid || x.sessionId.startsWith(sid));
+    if (!s) {
+        console.error(`❌ 未找到 session ${sid}`);
+        process.exit(1);
+    }
+    const daemon = findDaemon(s.larkAppId);
+    if (!daemon) {
+        console.error('❌ daemon 不在线');
+        process.exit(1);
+    }
+    const res = await postSessionCliIpc(daemon.ipcPort, s.sessionId, 'cd', { dir });
+    const body = await res.json().catch(() => ({}));
+    if (res.ok && body?.ok) {
+        console.log(body.mode === 'inject'
+            ? `✓ 已切换到 ${body.dir}（会话空闲时生效，进程不重启）`
+            : `✓ 已切换到 ${body.dir}（下条消息在新目录冷启动）`);
+        return;
+    }
+    console.error(`✗ 切换被拒绝: ${body?.error ?? `HTTP ${res.status}`}`);
+    process.exit(1);
+}
 /**
  * Discover online daemons. Mirrors the staleness rule used by
  * dashboard/registry.ts (90s heartbeat) so we don't try to talk to a daemon
@@ -3454,7 +3644,17 @@ function listOnlineDaemons() {
                 continue;
             if (now - (d.lastHeartbeat ?? 0) > STALE_MS)
                 continue;
-            all.push({ ipcPort: d.ipcPort, larkAppId: d.larkAppId, lastHeartbeat: d.lastHeartbeat });
+            all.push({
+                ipcPort: d.ipcPort,
+                larkAppId: d.larkAppId,
+                ...(typeof d.bootInstanceId === 'string' && d.bootInstanceId
+                    ? { bootInstanceId: d.bootInstanceId }
+                    : {}),
+                ...(typeof d.workflowIpcProtocol === 'string' && d.workflowIpcProtocol
+                    ? { workflowIpcProtocol: d.workflowIpcProtocol }
+                    : {}),
+                lastHeartbeat: d.lastHeartbeat,
+            });
         }
         catch { /* skip malformed */ }
     }
@@ -3466,74 +3666,245 @@ function findDaemon(larkAppId) {
         return all.find(d => d.larkAppId === larkAppId) ?? null;
     return all[0] ?? null;
 }
-/** `botmux workflow start <runId>` — POST the daemon's v3 start IPC so the run
- *  is daemon-driven (humanGate → 飞书审批卡).  The grill skill calls this after
- *  approve-dag instead of the standalone `botmux v3 run` (which has no card
- *  layer).  Defaults the bot to the grill worker's BOTMUX_LARK_APP_ID env. */
-async function cmdWorkflowStart(runId, rest) {
+/**
+ * Authenticate the human who opened this exact turn against the target run,
+ * then return the only daemon app that may receive the mutation. Inherited
+ * BOTMUX_LARK_APP_ID is deliberately not an authority (long-lived sessions
+ * keep it even when a different human opens a later turn).
+ */
+function authorizeWorkflowDaemonCommand(runId, rest) {
+    return authorizeV3DaemonCommand({
+        runId,
+        dataDir: resolveDataDir(),
+        envSessionId: process.env.BOTMUX_SESSION_ID,
+        requestedLarkAppId: argValue(rest, '--bot'),
+    }).larkAppId;
+}
+/**
+ * Isolated-session fallback for workflow daemon mutations. Inside a Linux
+ * bwrap sandbox or a macOS read-isolated session every leg of the host path
+ * above is masked by design (process-tree marker, run directory,
+ * `.dashboard-secret`), so the CLI instead presents its per-turn rotating
+ * capability and lets the daemon re-derive the caller/chat/bot tuple from its
+ * own live session record (workflows/v3/session-relay.ts). Detection is
+ * marker-first (a visible live process marker → host path, so a stale
+ * capability file can never hijack a healthy host session), then falls back
+ * to the worker-published capability file that only isolated sessions have.
+ * `--bot` is meaningless here — the run must be bound to this very session's
+ * chat tuple, which pins the daemon.
+ */
+async function tryWorkflowSessionRelayMutation(runId, mutation, body) {
+    const context = readWorkflowSessionRelayContext({
+        env: process.env,
+        dataDir: resolveDataDir(),
+    });
+    if (!context)
+        return null;
+    try {
+        return await postWorkflowSessionRunMutation({
+            context,
+            runId,
+            mutation,
+            ...(body ? { body } : {}),
+            resolveIpcPort: (larkAppId) => {
+                // Daemon discovery is host state — masked in-sandbox, best-effort under
+                // read isolation. The BOTMUX_DAEMON_IPC_PORT fallback inside the client
+                // covers the masked case.
+                try {
+                    return larkAppId ? findDaemon(larkAppId)?.ipcPort : undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            },
+        });
+    }
+    catch (err) {
+        console.error(`❌ ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+}
+/** `botmux workflow cancel <runId>` — authenticate the exact current caller
+ * against the immutable run binding, then ask the owning daemon to durably
+ * record cancellation before interrupting workers. */
+async function cmdWorkflowCancelV3(runId, rest) {
     if (!runId) {
-        console.error('用法: botmux workflow start <runId> [--bot <larkAppId>]');
+        console.error('用法: botmux workflow cancel <runId> [--reason <text>] [--bot <larkAppId>]');
         process.exit(1);
     }
-    const larkAppId = argValue(rest, '--bot') ?? process.env.BOTMUX_LARK_APP_ID;
-    const daemon = findDaemon(larkAppId);
+    const { formatV3RunCancelCliSuccess, parseV3RunCancelCliOptions, parseV3RunCancelDaemonResponse, } = await import('./cli/v3-run-cancel.js');
+    const parsed = parseV3RunCancelCliOptions(rest);
+    if (!parsed.ok) {
+        console.error(`❌ ${parsed.error}`);
+        console.error('用法: botmux workflow cancel <runId> [--reason <text>] [--bot <larkAppId>]');
+        process.exit(1);
+    }
+    const reason = parsed.reason;
+    // An isolated session can only cancel a daemon-bound chat run (a standalone
+    // manual_cli run lives on masked host disk anyway), so relay short-circuits
+    // ahead of the host authority/standalone branching.
+    const relayed = await tryWorkflowSessionRelayMutation(runId, 'cancel', reason ? { reason } : {});
+    if (relayed) {
+        try {
+            console.log(formatV3RunCancelCliSuccess(parseV3RunCancelDaemonResponse(relayed)));
+        }
+        catch (err) {
+            console.error(`❌ ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        }
+        return;
+    }
+    const authority = authorizeV3DaemonCommand({
+        runId,
+        dataDir: resolveDataDir(),
+        envSessionId: process.env.BOTMUX_SESSION_ID,
+        requestedLarkAppId: parsed.larkAppId,
+        allowStandaloneLocal: true,
+    });
+    if (authority.mode === 'standalone') {
+        // A manual_cli run is owned by its foreground/local runtime, not a daemon.
+        // Persisting the shared journal intent is sufficient: runWorkflow polls the
+        // durable cut while a worker is active and aborts it within one tick.
+        const { requestV3RunCancel } = await import('./workflows/v3/daemon-run.js');
+        let outcome;
+        try {
+            outcome = requestV3RunCancel(dirname(authority.runDir), runId, {
+                by: 'standalone-cli',
+                ...(reason ? { reason } : {}),
+            });
+        }
+        catch (err) {
+            console.error(`❌ ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        }
+        if (outcome.kind === 'stale-run')
+            throw new Error(`找不到 v3 run ${runId}`);
+        if (outcome.kind === 'already-terminal') {
+            console.log(formatV3RunCancelCliSuccess({
+                ok: true, runId, status: outcome.status, alreadyTerminal: true,
+            }));
+            return;
+        }
+        if (outcome.kind === 'already-cancelled') {
+            console.log(formatV3RunCancelCliSuccess({
+                ok: true, runId, status: 'cancelled', alreadyTerminal: true,
+                ...(outcome.cancelRequestId ? { cancelRequestId: outcome.cancelRequestId } : {}),
+            }));
+            return;
+        }
+        console.log(formatV3RunCancelCliSuccess({
+            ok: true,
+            runId,
+            status: 'cancelling',
+            cancelRequestId: outcome.cancelRequestId,
+            alreadyRequested: outcome.kind === 'already-requested',
+        }));
+        return;
+    }
+    const daemon = findDaemon(authority.larkAppId);
     if (!daemon) {
-        console.error('❌ 没有在线 daemon；v3 humanGate run 需要 daemon 驱动（审批卡是 daemon 的活）。');
+        console.error('❌ 没有在线的目标 daemon；v3 run 取消需要由所属 daemon 持久化并中断节点。');
         process.exit(1);
     }
-    let res;
+    let secret = null;
     try {
-        res = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/v3/runs/${encodeURIComponent(runId)}/start`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: '{}',
+        secret = loadDashboardSecret(dashboardSecretPath());
+    }
+    catch (err) {
+        console.error(`❌ 无法读取 .dashboard-secret：${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    if (!secret) {
+        console.error('❌ 缺少 .dashboard-secret，无法认证 v3 cancel daemon 请求；请先重启 botmux 初始化。');
+        process.exit(1);
+    }
+    try {
+        const { postV3RunCancel } = await import('./cli/v3-run-cancel.js');
+        const result = await postV3RunCancel({
+            daemon,
+            runId,
+            secret,
+            ...(reason ? { reason } : {}),
         });
+        console.log(formatV3RunCancelCliSuccess(result));
     }
     catch (err) {
-        console.error(`❌ 无法连接 daemon (port=${daemon.ipcPort}): ${err?.message ?? err}`);
+        console.error(`❌ ${err instanceof Error ? err.message : String(err)}`);
         process.exit(1);
     }
-    const txt = await res.text();
-    if (!res.ok) {
-        console.error(`❌ start 失败 (HTTP ${res.status}): ${txt}`);
+}
+/** `botmux workflow start <runId>` — POST the daemon's v3 start IPC so the run
+ *  is daemon-driven (humanGate → 飞书审批卡).  The grill skill calls this after
+ *  approve-dag instead of the standalone `botmux v3 run` (which has no card
+ *  layer).  The daemon is selected from the authenticated run/current-turn
+ *  binding, never from the worker's static BOTMUX_LARK_APP_ID env. */
+async function cmdWorkflowStart(runId, rest) {
+    if (!runId) {
+        console.error('用法: botmux workflow start <runId> [--bot <larkAppId>]');
+        process.exit(1);
+    }
+    let response = await tryWorkflowSessionRelayMutation(runId, 'start');
+    if (!response) {
+        const larkAppId = authorizeWorkflowDaemonCommand(runId, rest);
+        const daemon = findDaemon(larkAppId);
+        if (!daemon) {
+            console.error('❌ 没有在线 daemon；v3 humanGate run 需要 daemon 驱动（审批卡是 daemon 的活）。');
+            process.exit(1);
+        }
+        try {
+            response = await postWorkflowDaemonMutation({
+                daemon,
+                runId,
+                mutation: 'start',
+            });
+        }
+        catch (err) {
+            console.error(`❌ ${err?.message ?? err}`);
+            process.exit(1);
+        }
+    }
+    if (!response.ok) {
+        console.error(`❌ start 失败 (HTTP ${response.status}): ${response.bodyRaw}`);
         process.exit(1);
     }
     console.log(`✅ v3 run "${runId}" 已交 daemon 驱动；humanGate 会在话题里弹审批卡，点了才继续。`);
 }
 /** `botmux workflow retry <runId> [--node <id>]` — blocked 节点重试入口（CLI 侧）。
  *  走 daemon 的 retry IPC（journal 写入留在 daemon 进程内，单写者），daemon append
- *  `nodeRetryRequested` 后以新 attempt 重驱动。`resume` 动词归 v0.2，v3 用 retry 避撞。 */
+ *  `nodeRetryRequested` 后以新 attempt 重驱动；已退休的 v2 `resume` 不再参与分发。 */
 async function cmdWorkflowRetry(runId, rest) {
     if (!runId) {
         console.error('用法: botmux workflow retry <runId> [--node <nodeId>] [--bot <larkAppId>]');
         process.exit(1);
     }
-    const larkAppId = argValue(rest, '--bot') ?? process.env.BOTMUX_LARK_APP_ID;
     const nodeId = argValue(rest, '--node');
-    const daemon = findDaemon(larkAppId);
-    if (!daemon) {
-        console.error('❌ 没有在线 daemon；blocked 重试需要 daemon 驱动。');
-        process.exit(1);
-    }
-    let res;
-    try {
-        res = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/v3/runs/${encodeURIComponent(runId)}/retry`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(nodeId ? { nodeId } : {}),
-        });
-    }
-    catch (err) {
-        console.error(`❌ 无法连接 daemon (port=${daemon.ipcPort}): ${err?.message ?? err}`);
-        process.exit(1);
+    let response = await tryWorkflowSessionRelayMutation(runId, 'retry', nodeId ? { nodeId } : {});
+    if (!response) {
+        const larkAppId = authorizeWorkflowDaemonCommand(runId, rest);
+        const daemon = findDaemon(larkAppId);
+        if (!daemon) {
+            console.error('❌ 没有在线 daemon；blocked 重试需要 daemon 驱动。');
+            process.exit(1);
+        }
+        try {
+            response = await postWorkflowDaemonMutation({
+                daemon,
+                runId,
+                mutation: 'retry',
+                body: nodeId ? { nodeId } : {},
+            });
+        }
+        catch (err) {
+            console.error(`❌ ${err?.message ?? err}`);
+            process.exit(1);
+        }
     }
-    const txt = await res.text();
-    if (!res.ok) {
-        if (txt.includes('loop_node_use_grant')) {
+    if (!response.ok) {
+        if (response.bodyRaw.includes('loop_node_use_grant')) {
             console.error(`❌ 该受阻的是一个 loop（轮数耗尽），不是节点 attempt——用 \`botmux workflow grant ${runId}\` 追加一轮。`);
         }
         else {
-            console.error(`❌ retry 失败 (HTTP ${res.status}): ${txt}`);
+            console.error(`❌ retry 失败 (HTTP ${response.status}): ${response.bodyRaw}`);
         }
         process.exit(1);
     }
@@ -3547,28 +3918,30 @@ async function cmdWorkflowGrant(runId, rest) {
         console.error('用法: botmux workflow grant <runId> [--loop <loopId>] [--bot <larkAppId>]');
         process.exit(1);
     }
-    const larkAppId = argValue(rest, '--bot') ?? process.env.BOTMUX_LARK_APP_ID;
     const loopId = argValue(rest, '--loop');
-    const daemon = findDaemon(larkAppId);
-    if (!daemon) {
-        console.error('❌ 没有在线 daemon；loop 追加需要 daemon 驱动。');
-        process.exit(1);
-    }
-    let res;
-    try {
-        res = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/v3/runs/${encodeURIComponent(runId)}/grant`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(loopId ? { loopId } : {}),
-        });
-    }
-    catch (err) {
-        console.error(`❌ 无法连接 daemon (port=${daemon.ipcPort}): ${err?.message ?? err}`);
-        process.exit(1);
+    let response = await tryWorkflowSessionRelayMutation(runId, 'grant', loopId ? { loopId } : {});
+    if (!response) {
+        const larkAppId = authorizeWorkflowDaemonCommand(runId, rest);
+        const daemon = findDaemon(larkAppId);
+        if (!daemon) {
+            console.error('❌ 没有在线 daemon；loop 追加需要 daemon 驱动。');
+            process.exit(1);
+        }
+        try {
+            response = await postWorkflowDaemonMutation({
+                daemon,
+                runId,
+                mutation: 'grant',
+                body: loopId ? { loopId } : {},
+            });
+        }
+        catch (err) {
+            console.error(`❌ ${err?.message ?? err}`);
+            process.exit(1);
+        }
     }
-    const txt = await res.text();
-    if (!res.ok) {
-        console.error(`❌ grant 失败 (HTTP ${res.status}): ${txt}`);
+    if (!response.ok) {
+        console.error(`❌ grant 失败 (HTTP ${response.status}): ${response.bodyRaw}`);
         process.exit(1);
     }
     console.log(`➕ v3 run "${runId}" 已追加一轮，loop 将带上一轮反馈重跑。`);
@@ -3628,7 +4001,7 @@ async function cmdResume() {
     }
     let res;
     try {
-        res = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/sessions/${encodeURIComponent(session.sessionId)}/resume`, { method: 'POST' });
+        res = await fetchDaemonIpc(daemon.ipcPort, `/api/sessions/${encodeURIComponent(session.sessionId)}/resume`, { method: 'POST' });
     }
     catch (err) {
         console.error(`❌ 无法连接到 daemon (port=${daemon.ipcPort}): ${err?.message ?? err}`);
@@ -3727,25 +4100,9 @@ async function cmdTermLink(rest) {
         console.error('❌ 未找到在线 daemon。请确认 daemon 正在运行：botmux status');
         process.exit(1);
     }
-    const SECRET_PATH = join(CONFIG_DIR, '.dashboard-secret');
-    let secret;
-    try {
-        secret = loadDashboardSecret(SECRET_PATH);
-    }
-    catch (e) {
-        console.error(`❌ 无法读取 .dashboard-secret：${e.message}`);
-        process.exit(1);
-    }
-    if (!secret) {
-        console.error('❌ 缺少或为空 .dashboard-secret（daemon 未初始化）。先 `botmux restart`。');
-        process.exit(1);
-    }
-    const ts = Math.floor(Date.now() / 1000).toString();
-    const nonce = randomBytes(8).toString('hex');
-    const sig = createHmac('sha256', secret).update(`${ts}:${nonce}`).digest('base64url');
     let res;
     try {
-        res = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/sessions/${encodeURIComponent(session.sessionId)}/write-link-card`, { method: 'POST', headers: { 'X-Botmux-Cli-Ts': ts, 'X-Botmux-Cli-Nonce': nonce, 'X-Botmux-Cli-Auth': sig } });
+        res = await fetchDaemonIpc(daemon.ipcPort, `/api/sessions/${encodeURIComponent(session.sessionId)}/write-link-card`, { method: 'POST' });
     }
     catch (err) {
         console.error(`❌ 无法连接到 daemon (port=${daemon.ipcPort}): ${err?.message ?? err}`);
@@ -3799,7 +4156,7 @@ botmux v${getVersion()} — IM ↔ AI 编程 CLI 桥接
   restart     重启 daemon（默认不停止插件 service，core 启动后确保 mode=auto 正在运行；--with-plugin 显式先停再启动 auto service；--include-pm2 同时重启 PM2 God）
   logs        查看 daemon 日志（--lines N, --bot <0-based-index|pm2-name|appId>）
   status      查看 daemon 状态
-  upgrade     升级到最新版本
+  upgrade     升级到最新版本（别名：update）
   dashboard   打印新的 Web Dashboard 一次性登录 URL（旧 token 同时失效）
   list        列出活跃会话（交互式选择并连接 tmux）
               --plain  纯文本表格输出（管道/脚本场景）
@@ -3812,6 +4169,9 @@ botmux v${getVersion()} — IM ↔ AI 编程 CLI 桥接
        --bot <appId>   挂起该 bot 的全部活跃会话
        --isolated      挂起所有读隔离 bot（凭证轮换后用；下次冷启动自动同步最新凭证）
        --dry-run       只列出目标，不执行
+  slash "<斜杠命令>"   会话空闲后向本会话 CLI 注入一条原生斜杠命令（需 bots.json 配 tuiSlashAllow；/cd 恒被拒）
+  cd <目录>        （会话内）切换本话题工作目录到角色库内的目录——角色切换用；
+                   目录必须位于 ~/botmux-roles 之下
   term-link [id]   获取活跃会话的「可操作终端」（带写 token）。不回显链接，改由
                    daemon 把可操作卡片私密发给 owner（群内仅你可见，话题/单聊回退 DM）。
                    单个活跃会话可省略 id
@@ -3891,9 +4251,23 @@ botmux v${getVersion()} — IM ↔ AI 编程 CLI 桥接
   skill list                           列出本会话可用的技能（用户自定义 + botmux 内置）及其描述
   skill show <name>                    读取某技能的完整 SKILL.md 说明（prompt 注入模式下按需拉取内置技能全文）
 
-编排 / workflow（进阶，多为 v3/多话题协作场景）:
-  workflow <run|resume|cancel|ls|tail|validate|show> [...]
-                                       运行 / 管理 workflow（详见 \`botmux workflow help\`）
+编排 / workflow（v3）:
+  workflow save [last|runId] [名称]
+                                       把成功 run 固化为 chat scope Saved Workflow；
+                                       发布当前 Bot 全局版本 / 确认 unsafe lint 请由用户在飞书显式发送 /workflow save ...
+  workflow run <名称|workflowId> [--param key=value ...]
+  workflow list [--json] | show <名称|workflowId>
+                                       运行 / 查看 Saved Workflow
+  workflow new|spec-finalize|approve-spec|revise-spec|architect|revise-dag [...]
+  workflow approve-dag|start [...]     创建、修订并运行一次性即兴 Workflow
+  workflow cancel <runId> [--reason <text>] [--bot <larkAppId>]
+                                       持久化取消 v3 run 并中断活动节点
+  workflow retry|grant [...]           处理受阻节点 / loop
+  template migrate-v3 [id|path ...] [--all] [--commit ...]
+                                       v2 定义迁移：默认 dry-run，写入需显式 owner/app/scope
+  template archive-runs [--commit|--verify <archive>|--retire <archive> --ack-daemon-stopped]
+                                       v2 历史 run 私有静态归档；retire 在维护窗双验后原子迁入 quarantine
+  （完整参数见 \`botmux workflow help\` / \`botmux template help\`）
   dispatch --bot <name> [...]          多话题编排：开子话题并把 bot 派进去（详见 \`botmux dispatch --help\`）
   report [...]                         v3/编排场景向上汇报进度或结果（详见 \`botmux report --help\`）
 
@@ -3930,7 +4304,17 @@ botmux skills 注入方式（仅影响 codex/gemini/opencode 等只支持全局
  * the env fallback is safe.
  */
 function findAncestorSessionContext() {
-    return resolveSessionContext(resolveDataDir(), process.env.BOTMUX_SESSION_ID);
+    const resolved = resolveSessionContext(resolveDataDir(), process.env.BOTMUX_SESSION_ID);
+    if (!resolved)
+        return null;
+    const envAttempt = Number(process.env.BOTMUX_DISPATCH_ATTEMPT);
+    const dispatchAttempt = resolved.dispatchAttempt
+        ?? (Number.isSafeInteger(envAttempt) && envAttempt > 0 ? envAttempt : undefined);
+    return {
+        ...resolved,
+        turnId: resolved.turnId ?? process.env.BOTMUX_TURN_ID,
+        ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
+    };
 }
 function findAncestorSessionId() {
     return findAncestorSessionContext()?.sessionId ?? null;
@@ -4747,9 +5131,10 @@ function withCustomCardMentionFooter(card, mentionOpenIds, sentToLabel) {
 // keeps using `buildImageCardElements` from there.
 import { buildImageCardElements, brandFooterSegment, prepareCardMarkdown } from './im/lark/md-card.js';
 import { applyInlineMentions } from './im/lark/inline-mentions.js';
+import { renderBrandTemplate } from './im/lark/brand-template.js';
 import { resolveBrandLabel } from './bot-registry.js';
 import { config } from './config.js';
-import { resolveQuoteTarget, validateMentionDecision, parseAttentionFlag, attentionUsageError } from './services/send-policy.js';
+import { resolveQuoteTarget, validateMentionDecision, parseAttentionFlag, attentionUsageError, managedVcQuoteError, managedVcCustomCardError, managedVcSendControlError, managedVcSendPayloadError, containsLarkAtTag, } from './services/send-policy.js';
 /**
  * Sandbox relay mode for `botmux send`. Inside a file-sandbox the CLI cannot
  * read bots.json or reach Lark directly (creds are deliberately absent), so we
@@ -4803,6 +5188,7 @@ async function relaySend(rest, relayDir) {
         ? prepareCardMarkdown(extractCardText(content), process.cwd(), 'filesystem')
         : undefined;
     const id = randomBytes(8).toString('hex');
+    const originCapability = readManagedOriginCapability(resolveDataDir(), sid, relayDir)?.capability;
     // Structured request: the daemon-side watcher rebuilds the argv from these
     // validated fields (it NEVER executes raw argv — see buildRelayHostArgs).
     // Content + attachments are written into the shared outbox as plain
@@ -4873,6 +5259,7 @@ async function relaySend(rest, relayDir) {
         videos,
         videoCovers,
         flags,
+        ...(originCapability ? { originCapability } : {}),
     }));
     const resPath = join(relayDir, `${id}.res.json`);
     const deadlineMs = Date.now() + 120_000;
@@ -5017,18 +5404,11 @@ function riffModeSession(opts = {}) {
     return { session, botConfig };
 }
 async function cmdSend(rest) {
-    // Sandbox relay: a file-sandboxed session has no creds/bots.json, so route
-    // the send through the daemon-side outbox instead of delivering directly.
-    const relayDir = process.env.BOTMUX_SEND_RELAY;
-    if (relayDir) {
-        await relaySend(rest, relayDir);
-        return;
-    }
-    // Safety gate: a CLI agent running inside a workflow subagent (Slice F)
-    // must not chat-post directly — chat-facing side effects are reserved
-    // for `hostExecutor` activities so they can be tracked via
-    // `effectAttempted` + reconciled across retries / resumes.  Refuse loud
-    // so the agent (and any human reviewing logs) sees the boundary.
+    const ancestorCtx = findAncestorSessionContext();
+    // Workflow subagents cannot own chat-facing effects: those belong to a
+    // hostExecutor so retries/resumes can reconcile them. Keep this gate ahead
+    // of both the sandbox relay and VC-origin store reads; neither path may turn
+    // a forbidden workflow send into an observable side effect.
     if (process.env.BOTMUX_WORKFLOW === '1') {
         const runId = process.env.BOTMUX_WORKFLOW_RUN_ID ?? '?';
         const nodeId = process.env.BOTMUX_WORKFLOW_NODE_ID ?? '?';
@@ -5037,11 +5417,106 @@ async function cmdSend(rest) {
             `chat-facing side effects belong in a hostExecutor activity, not a subagent.`);
         process.exit(2);
     }
+    // Managed output attribution must come from the live process-tree marker,
+    // whose turn/attempt is refreshed by the worker. BOTMUX_TURN_ID is a
+    // spawn-time fallback and can be stale in a detached child after a later
+    // delivery starts, so it is never authority for receiver policy.
+    const liveMarkerCtx = resolveSessionContext(resolveDataDir(), process.env.BOTMUX_SESSION_ID);
+    const trustedHostRelay = process.env.BOTMUX_HOST_RELAY_AUTHORIZED === '1';
+    const trustedRelayAttemptRaw = Number(process.env.BOTMUX_DISPATCH_ATTEMPT);
+    const trustedRelayCandidate = trustedHostRelay && process.env.BOTMUX_SESSION_ID
+        ? {
+            sessionId: process.env.BOTMUX_SESSION_ID,
+            turnId: process.env.BOTMUX_TURN_ID,
+            dispatchAttempt: Number.isSafeInteger(trustedRelayAttemptRaw) && trustedRelayAttemptRaw > 0
+                ? trustedRelayAttemptRaw
+                : undefined,
+        }
+        : undefined;
+    const sessionIdArg = argValue(rest, '--session-id');
+    // Inside bwrap the PID namespace makes host marker traversal impossible.
+    // The relay watcher therefore binds a short-lived host-issued capability to
+    // the worker's live turn and performs the authoritative policy check.
+    const relayDir = process.env.BOTMUX_SEND_RELAY;
+    if (relayDir) {
+        await relaySend(rest, relayDir);
+        return;
+    }
+    // Silent is an execution policy, not a prompt suggestion. During a durable
+    // meeting turn, refuse botmux-mediated sends before either the direct-Lark or
+    // sandbox-relay path can run. Explicit human IM turns have no dispatchAttempt
+    // and therefore retain the normal reply path in the same receiver session.
+    const sessionsForOrigin = loadSessions();
+    const trustedRelaySession = trustedRelayCandidate
+        ? sessionsForOrigin.get(trustedRelayCandidate.sessionId)
+        : undefined;
+    // The env marker is not authority by itself. A genuine host relay CLI is a
+    // direct child of the session's durably recorded worker pid; sandboxed or
+    // semi-trusted descendants cannot satisfy that parent binding.
+    const trustedRelayCtx = trustedRelayCandidate && isTrustedVcMeetingHostRelayParent(trustedHostRelay, trustedRelaySession?.pid, process.ppid)
+        ? trustedRelayCandidate
+        : undefined;
+    const originSessionId = trustedRelayCtx?.sessionId
+        || liveMarkerCtx?.sessionId
+        || ancestorCtx?.sessionId
+        || sessionIdArg;
+    let explicitVcMeetingImOrigin;
+    let vcMeetingListenerOutputOwner;
+    let vcMeetingManagedSendOrigin;
+    let vcMeetingDeliveryReplyOrigin;
+    if (originSessionId) {
+        const originSession = sessionsForOrigin.get(originSessionId);
+        const originTurnId = trustedRelayCtx?.turnId ?? liveMarkerCtx?.turnId;
+        const imOrigin = resolveVcMeetingImTurnOrigin(originSession, originTurnId);
+        const managedOrigin = {
+            receiverSessionId: originSessionId,
+            receiverSession: !!originSession?.vcMeetingReceiver,
+            turnId: originTurnId,
+            dispatchAttempt: trustedRelayCtx?.dispatchAttempt ?? liveMarkerCtx?.dispatchAttempt,
+            currentImTurnOrigin: imOrigin,
+        };
+        const decision = evaluateVcMeetingManagedSend(resolveDataDir(), managedOrigin);
+        if (!decision.ok) {
+            console.error(`botmux send refused by VC managed-output policy (${decision.errorCode}): ${decision.error}`);
+            process.exit(2);
+        }
+        if (decision.kind === 'listener_thread') {
+            vcMeetingListenerOutputOwner = decision.meetingOwner;
+            vcMeetingManagedSendOrigin = managedOrigin;
+            if (managedOrigin.turnId && managedOrigin.dispatchAttempt !== undefined) {
+                vcMeetingDeliveryReplyOrigin = {
+                    receiverSessionId: originSessionId,
+                    stableTurnId: managedOrigin.turnId,
+                    dispatchAttempt: managedOrigin.dispatchAttempt,
+                };
+            }
+        }
+        if (decision.kind === 'listener_thread'
+            && (trustedRelayCtx?.dispatchAttempt ?? liveMarkerCtx?.dispatchAttempt) === undefined) {
+            explicitVcMeetingImOrigin = imOrigin;
+        }
+    }
+    const revalidateVcMeetingManagedSend = () => {
+        if (!vcMeetingManagedSendOrigin)
+            return;
+        const decision = evaluateVcMeetingManagedSend(resolveDataDir(), vcMeetingManagedSendOrigin);
+        if (!decision.ok) {
+            throw new Error(`VC managed-output authority expired (${decision.errorCode}): ${decision.error}`);
+        }
+        if (decision.kind !== 'listener_thread') {
+            throw new Error('VC managed-output authority no longer targets the listener thread');
+        }
+        vcMeetingListenerOutputOwner = decision.meetingOwner;
+    };
+    const prepareVcMeetingListenerReply = (proposedOutput) => explicitVcMeetingImOrigin
+        ? prepareVcMeetingImReply(resolveDataDir(), explicitVcMeetingImOrigin, proposedOutput)
+        : vcMeetingDeliveryReplyOrigin
+            ? prepareVcMeetingDeliveryReply(resolveDataDir(), vcMeetingDeliveryReplyOrigin, proposedOutput)
+            : undefined;
     process.env.SESSION_DATA_DIR ??= resolveDataDir();
     // Read isolation: the sandboxed CLI is denied bots.json → register this bot
     // from its own worker-written cred file instead (see registerSelfFromCredFile).
     await registerSelfFromCredFile();
-    const sessionIdArg = argValue(rest, '--session-id');
     for (const flag of ['--video', '--videos', '--video-cover', '--video-covers']) {
         if (flagPresentButValueMissing(rest, flag, true)) {
             console.error(`botmux send: ${flag} 需要路径参数`);
@@ -5059,6 +5534,11 @@ async function cmdSend(rest) {
     const cardJsonArg = argValue(rest, '--card-json');
     const cardFile = argValue(rest, '--card-file');
     const customCardRequested = cardJsonArg !== undefined || cardFile !== undefined;
+    const managedCustomCardError = managedVcCustomCardError(!!vcMeetingManagedSendOrigin, customCardRequested);
+    if (managedCustomCardError) {
+        console.error(`botmux send refused for a managed VC turn: ${managedCustomCardError}`);
+        process.exit(2);
+    }
     if (cardJsonArg !== undefined && cardFile !== undefined) {
         console.error('botmux send: --card-json 与 --card-file 不能同时使用');
         process.exit(2);
@@ -5113,6 +5593,16 @@ async function cmdSend(rest) {
     // Quote chain (chat scope): --quote <message_id> overrides the auto target,
     // --no-quote forces a plain (un-quoted) send.
     const explicitQuote = argValue(rest, '--quote');
+    const managedQuoteError = managedVcQuoteError({
+        managed: !!vcMeetingManagedSendOrigin,
+        durableDelivery: !!vcMeetingDeliveryReplyOrigin,
+        explicitImMessageId: explicitVcMeetingImOrigin?.larkMessageId,
+        explicitQuote,
+    });
+    if (managedQuoteError) {
+        console.error(`botmux send refused for a managed VC turn: ${managedQuoteError}`);
+        process.exit(2);
+    }
     const noQuote = rest.includes('--no-quote');
     // @ hard-gate: every reply must explicitly choose one of these.
     const mentionBack = rest.includes('--mention-back');
@@ -5121,11 +5611,24 @@ async function cmdSend(rest) {
     // needs-you column for this session. Parsed specially (not argValue) so a bare
     // `--attention "我卡住了"` doesn't eat the message as the flag value.
     const attention = parseAttentionFlag(rest);
+    const managedControlError = managedVcSendControlError({
+        managed: !!vcMeetingManagedSendOrigin,
+        sendTopLevel,
+        overrideChatId,
+        sendInto,
+        attentionRequested: attention.requested,
+        explicitMentionCount: mentionArgs.length,
+        mentionBack,
+        noMention,
+    });
+    if (managedControlError) {
+        console.error(`botmux send refused for a managed VC turn: ${managedControlError}`);
+        process.exit(2);
+    }
     if (customCardRequested && asVoice) {
         console.error('botmux send: --card-file/--card-json 不能与 --voice 混用');
         process.exit(2);
     }
-    const ancestorCtx = findAncestorSessionContext();
     const sid = sessionIdArg ?? ancestorCtx?.sessionId ?? process.env.BOTMUX_SESSION_ID ?? null;
     if (!sid) {
         console.error('无法推断 session-id。请在 Lark 话题内的 CLI 会话中运行，或传 --session-id <id>。');
@@ -5209,6 +5712,19 @@ async function cmdSend(rest) {
     }
     if (!contentFile && !customCardRequested)
         rejectLikelyWindowsStdinMojibake(content);
+    const managedPayloadError = managedVcSendPayloadError({
+        managed: !!vcMeetingManagedSendOrigin,
+        asVoice,
+        hasBodyText: !!content.trim(),
+        imageCount: images.length,
+        fileCount: files.length,
+        videoCount: videoAttachments.length,
+        containsNativeAtTag: containsLarkAtTag(content),
+    });
+    if (managedPayloadError) {
+        console.error(`botmux send refused for a managed VC turn: ${managedPayloadError}`);
+        process.exit(2);
+    }
     if (!customCard && !content.trim() && images.length === 0 && files.length === 0 && videoAttachments.length === 0) {
         console.error('没有内容可发送。用法:\n  echo "消息" | botmux send\n  botmux send "消息"\n  botmux send --content-file /tmp/msg.md --images /tmp/chart.png\n  botmux send --videos /tmp/replay.mp4 --video-covers /tmp/cover.png --no-mention "视频预览"');
         process.exit(1);
@@ -5227,6 +5743,25 @@ async function cmdSend(rest) {
         console.error(`botmux send: ${attentionErr}`);
         process.exit(2);
     }
+    const recordVcMeetingPrimaryOutput = (messageId, outputChatId) => {
+        if (!vcMeetingListenerOutputOwner || sendInto)
+            return;
+        try {
+            const recorded = recordVcMeetingListenerMessage(resolveDataDir(), {
+                ...vcMeetingListenerOutputOwner,
+                targetChatId: outputChatId,
+                messageId,
+            });
+            if (!recorded.ok) {
+                console.error(`⚠️ VC 监听消息索引拒绝记录 ${messageId}（${recorded.reason}）`);
+            }
+        }
+        catch (error) {
+            // The primary message already exists at Lark. Index failure must never
+            // turn a successful send into exit!=0 (which would invite a duplicate).
+            console.error(`⚠️ 消息已发送，但 VC 监听消息索引写入失败：${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
     // ── Voice mode ──────────────────────────────────────────────────────────
     // Synthesize the (already-condensed, colloquial) content into a Feishu voice
     // bubble and return. Deliberately bypasses the text/card path's mentions,
@@ -5254,17 +5789,53 @@ async function cmdSend(rest) {
         const { rmSync } = await import('node:fs');
         const appId = s.larkAppId;
         const targetChatId = overrideChatId ?? s.chatId;
-        const target = resolveSendTarget({ into: sendInto, topLevel: sendTopLevel, chatScope: s.scope === 'chat', chatId: targetChatId, rootMessageId: s.rootMessageId, replyTargetRootId: s.currentReplyTarget?.rootMessageId, replyTargetTurnId: s.currentReplyTarget?.turnId, currentTurnId });
-        const sendAudio = (fileKey) => target.mode === 'plain'
-            ? sendMessage(appId, target.chatId, JSON.stringify({ file_key: fileKey }), 'audio')
-            : replyMessage(appId, target.rootMessageId, JSON.stringify({ file_key: fileKey }), 'audio', true);
         let dir;
         try {
             const out = await synthesizeVoiceOpus(appId, content);
             dir = out.dir;
             const fileKey = await uploadFile(appId, out.path, { duration: out.durationMs });
             const sentAtMs = Date.now();
-            const messageId = await sendAudio(fileKey);
+            const proposedOutput = {
+                targetChatId,
+                msgType: 'audio',
+                content: JSON.stringify({ file_key: fileKey }),
+            };
+            const prepared = prepareVcMeetingListenerReply(proposedOutput);
+            if (prepared?.kind === 'conflict') {
+                throw new Error(`VC listener assistant reply refused (${prepared.reason}): ${prepared.detail}`);
+            }
+            const canonicalOutput = prepared?.canonicalOutput ?? proposedOutput;
+            if (prepared?.outputMismatch) {
+                console.error(`⚠️ VC listener voice reply output_mismatch action=${prepared.ref.actionId}; `
+                    + 'reusing first canonical output');
+            }
+            let messageId;
+            if (prepared?.kind === 'succeeded' && prepared.messageId) {
+                messageId = prepared.messageId;
+            }
+            else {
+                revalidateVcMeetingManagedSend();
+                const canonicalTarget = resolveSendTarget({
+                    into: sendInto,
+                    topLevel: sendTopLevel,
+                    chatScope: s.scope === 'chat',
+                    chatId: canonicalOutput.targetChatId,
+                    rootMessageId: s.rootMessageId,
+                    replyTargetRootId: s.currentReplyTarget?.rootMessageId,
+                    replyTargetTurnId: s.currentReplyTarget?.turnId,
+                    currentTurnId,
+                });
+                const managedProviderOptions = prepared
+                    ? { suppressHook: true }
+                    : undefined;
+                messageId = canonicalTarget.mode === 'plain'
+                    ? await sendMessage(appId, canonicalTarget.chatId, canonicalOutput.content, canonicalOutput.msgType, prepared?.providerKey, undefined, managedProviderOptions)
+                    : await replyMessage(appId, canonicalTarget.rootMessageId, canonicalOutput.content, canonicalOutput.msgType, true, prepared?.providerKey, undefined, managedProviderOptions);
+                if (prepared?.kind === 'send' || prepared?.kind === 'succeeded') {
+                    finishVcMeetingImReply(resolveDataDir(), prepared.ref, messageId);
+                }
+            }
+            recordVcMeetingPrimaryOutput(messageId, canonicalOutput.targetChatId);
             // 语音也是一次回复：写 bridge fallback marker，否则本轮会被判为"没发 botmux send"
             // 而触发兜底，多补一张文本卡。与文本/卡片路径同口径：仅同话题回复才记。
             if (!sendTopLevel && !overrideChatId && !sendInto) {
@@ -5383,6 +5954,8 @@ async function cmdSend(rest) {
             mentions.push({ open_id: m.trim(), name: '' });
         }
     }
+    const replyTargetSenderOpenId = explicitVcMeetingImOrigin?.replyTargetSenderOpenId
+        ?? s.quoteTargetSenderOpenId;
     // @ hard-gate (config.send.requireMentionDecision, default on): force the
     // model to make an explicit @ decision before sending. --top-level publish
     // is exempt. The error text adapts to who is being replied to (人 / bot).
@@ -5392,7 +5965,7 @@ async function cmdSend(rest) {
         hasMentionArgs: mentionArgs.length > 0,
         mentionBack,
         noMention,
-        hasQuoteTargetSender: !!s.quoteTargetSenderOpenId,
+        hasQuoteTargetSender: !!replyTargetSenderOpenId,
     });
     if (!mentionGate.ok) {
         console.error(mentionGate.error);
@@ -5401,9 +5974,9 @@ async function cmdSend(rest) {
     // --mention-back: @ the sender of the message this turn is replying to
     // (open_id from the session — model needn't know it). Bare-name form so it
     // renders as a trailing <at>.
-    if (mentionBack && s.quoteTargetSenderOpenId
-        && !mentions.some(m => m.open_id === s.quoteTargetSenderOpenId)) {
-        mentions.push({ open_id: s.quoteTargetSenderOpenId, name: '' });
+    if (mentionBack && replyTargetSenderOpenId
+        && !mentions.some(m => m.open_id === replyTargetSenderOpenId)) {
+        mentions.push({ open_id: replyTargetSenderOpenId, name: '' });
     }
     // Validate file paths
     for (const p of [...images, ...files, ...videos, ...videoCovers]) {
@@ -5463,7 +6036,7 @@ async function cmdSend(rest) {
     // Sub-topic seed if `openId` is a dispatched sub-bot in an active topic that is
     // NOT reachable in the current conversation; else null. The bot I'm replying to
     // here (quoteTargetSenderOpenId) is reachable, so it's never treated as off-topic.
-    const offTopicSubBotSeed = (openId) => offTopicSubBotTopic({ mentionOpenId: openId, quoteTargetSenderOpenId: s.quoteTargetSenderOpenId, chatId: targetChatId, registry: dispatchReg, activeSeeds: dispatchActiveSeeds });
+    const offTopicSubBotSeed = (openId) => offTopicSubBotTopic({ mentionOpenId: openId, quoteTargetSenderOpenId: replyTargetSenderOpenId, chatId: targetChatId, registry: dispatchReg, activeSeeds: dispatchActiveSeeds });
     // Explicit --mention / --mention-back of an off-topic sub-bot → block + point to
     // the right command (--anyway overrides). Prose @Name injection is filtered
     // (dropped, not blocked) at its own site below.
@@ -5494,9 +6067,14 @@ async function cmdSend(rest) {
     // Dispatch helper: top-level / chat-scope send vs reply-in-thread, single
     // decision point. Used for file attachments (always plain in chat scope).
     const sendTarget = resolveSendTarget({ into: sendInto, topLevel: sendTopLevel, chatScope: isChatScope, chatId: targetChatId, rootMessageId: s.rootMessageId, replyTargetRootId: s.currentReplyTarget?.rootMessageId, replyTargetTurnId: s.currentReplyTarget?.turnId, currentTurnId });
-    const dispatch = (content, msgType) => sendTarget.mode === 'plain'
-        ? sendMessage(appId, sendTarget.chatId, content, msgType, undefined, hookContext)
-        : replyMessage(appId, sendTarget.rootMessageId, content, msgType, true, undefined, hookContext);
+    const dispatch = (content, msgType, uuid, suppressHook) => {
+        // This closure also carries attachments, so every Lark call re-checks the
+        // exact durable attempt/member instead of inheriting the early cmd gate.
+        revalidateVcMeetingManagedSend();
+        return sendTarget.mode === 'plain'
+            ? sendMessage(appId, sendTarget.chatId, content, msgType, uuid, hookContext, suppressHook ? { suppressHook: true } : undefined)
+            : replyMessage(appId, sendTarget.rootMessageId, content, msgType, true, uuid, hookContext, suppressHook ? { suppressHook: true } : undefined);
+    };
     const recordBridgeSendMarker = (sentAtMs, messageId, sentContent) => {
         try {
             const markerDir = join(resolveDataDir(), 'turn-sends');
@@ -5515,33 +6093,83 @@ async function cmdSend(rest) {
     // scope and --top-level never quote. Withdrawn target → fall back to plain.
     const quoteTargetId = sendInto || sendTarget.mode === 'thread' ? undefined : resolveQuoteTarget({
         isChatScope, sendTopLevel, noQuote, explicitQuote,
-        sessionQuoteTargetId: s.quoteTargetId,
+        // A durable meeting delivery has no Lark-authored trigger message. Never
+        // inherit the receiver session's latest human quote target: that state can
+        // belong to another queued IM turn and is not part of the delivery action.
+        sessionQuoteTargetId: vcMeetingDeliveryReplyOrigin
+            ? undefined
+            : explicitVcMeetingImOrigin?.larkMessageId ?? s.quoteTargetId,
     });
     let primaryQuotedId = null;
+    let vcMeetingListenerReplyReplay = false;
     const dispatchPrimary = async (content, msgType) => {
-        const result = await dispatchPrimaryMessage({ sendMessage, replyMessage }, {
-            appId,
+        // `dispatchPrimaryMessage` may call replyMessage directly for a quote, so
+        // fence immediately before preparing/performing that primary effect too.
+        revalidateVcMeetingManagedSend();
+        const proposedOutput = {
             targetChatId,
-            quoteTargetId,
-            content,
+            ...(quoteTargetId ? { quoteTargetId } : {}),
             msgType,
+            content,
+        };
+        const prepared = prepareVcMeetingListenerReply(proposedOutput);
+        if (prepared?.kind === 'conflict') {
+            throw new Error(`VC listener assistant reply refused (${prepared.reason}): ${prepared.detail}`);
+        }
+        const canonicalOutput = prepared?.canonicalOutput ?? proposedOutput;
+        if (prepared?.outputMismatch) {
+            console.error(`⚠️ VC listener reply output_mismatch action=${prepared.ref.actionId} `
+                + `turn=${explicitVcMeetingImOrigin?.larkMessageId ?? vcMeetingDeliveryReplyOrigin?.stableTurnId}; `
+                + 'reusing first canonical output');
+        }
+        if (prepared?.kind === 'succeeded' && prepared.messageId) {
+            vcMeetingListenerReplyReplay = true;
+            primaryQuotedId = canonicalOutput.quoteTargetId ?? null;
+            recordVcMeetingPrimaryOutput(prepared.messageId, canonicalOutput.targetChatId);
+            return prepared.messageId;
+        }
+        if (prepared?.kind === 'succeeded') {
+            // A legacy/incomplete terminal record without the provider message id is
+            // still safe to reconcile through the same stable UUID.
+            vcMeetingListenerReplyReplay = true;
+        }
+        else if (prepared?.kind === 'send') {
+            vcMeetingListenerReplyReplay = prepared.replay;
+        }
+        const result = await dispatchPrimaryMessage({ sendMessage, replyMessage }, {
+            appId,
+            targetChatId: canonicalOutput.targetChatId,
+            quoteTargetId: canonicalOutput.quoteTargetId,
+            content: canonicalOutput.content,
+            msgType: canonicalOutput.msgType,
+            ...(prepared ? { uuid: prepared.providerKey } : {}),
+            // Managed meeting output must never fan out through user-configured
+            // outbound hooks, including its first provider attempt.
+            ...(prepared ? { suppressHook: true } : {}),
             hookContext,
             MessageWithdrawnError,
-            dispatch,
+            // Explicit VC IM --into is rejected above, so an unquoted first send
+            // retains the normal chat-scope dispatch semantics. On a mismatch the
+            // frozen canonical target remains authoritative.
+            dispatch: prepared?.outputMismatch
+                ? (body, type, uuid, suppressHook) => {
+                    revalidateVcMeetingManagedSend();
+                    return sendMessage(appId, canonicalOutput.targetChatId, body, type, uuid, hookContext, suppressHook ? { suppressHook: true } : undefined);
+                }
+                : dispatch,
+            beforeQuoteFallback: revalidateVcMeetingManagedSend,
             onQuoteWithdrawn: (id) => {
                 console.error(`引用目标 ${id} 已撤回，改为普通发送`);
             },
         });
         primaryQuotedId = result.primaryQuotedId;
+        if (prepared?.kind === 'send' || prepared?.kind === 'succeeded') {
+            finishVcMeetingImReply(resolveDataDir(), prepared.ref, result.messageId);
+        }
+        recordVcMeetingPrimaryOutput(result.messageId, canonicalOutput.targetChatId);
         return result.messageId;
     };
     try {
-        // Upload images in parallel
-        const imageKeys = [];
-        if (images.length > 0) {
-            const results = await Promise.all(images.map(p => uploadImage(appId, p)));
-            imageKeys.push(...results);
-        }
         // A file-sandbox relay supplies a host-private copy normalized inside the
         // sandbox namespace. Voice/doc-comment paths returned above and therefore
         // continue using the untouched raw content.
@@ -5553,6 +6181,31 @@ async function cmdSend(rest) {
             }
             catch { /* fall back safely below */ }
         }
+        // `preparedContentFile` is presentation data produced inside an untrusted
+        // sandbox and only TOCTOU-materialized by the host watcher. It is not an
+        // authorization proof. Re-check the exact body/attachment shape that will
+        // reach Lark after JSON extraction and prepared-content substitution, and
+        // do so before even an image upload creates a provider-side effect.
+        const managedRenderedPayloadError = managedVcSendPayloadError({
+            managed: !!vcMeetingManagedSendOrigin,
+            asVoice: false,
+            hasBodyText: !!text.trim(),
+            imageCount: images.length,
+            fileCount: files.length,
+            videoCount: videoAttachments.length,
+            containsNativeAtTag: containsLarkAtTag(text),
+        });
+        if (managedRenderedPayloadError) {
+            console.error(`botmux send refused for a managed VC turn: ${managedRenderedPayloadError}`);
+            process.exit(2);
+        }
+        // Upload images only after the final rendered payload has passed the
+        // managed side-effect gate above.
+        const imageKeys = [];
+        if (images.length > 0) {
+            const results = await Promise.all(images.map(p => uploadImage(appId, p)));
+            imageKeys.push(...results);
+        }
         // Auto-detect @BotName in text and inject as mentions, using the sender
         // app's cross-ref file for per-app-scoped open_ids. Without this, a plain
         // "@Claude" in text only triggers IPC routing but Lark UI shows it as
@@ -5577,7 +6230,7 @@ async function cmdSend(rest) {
             // --no-mention 显式不 @ 任何人：跳过正文 @BotName 的自动注入，否则正文里
             // 出现的 @名字 仍会被注入成 <at>，破坏 --no-mention 语义、还可能误触发对方
             // bot（正是要避免的循环 @）。botEntries/crossRef 仍需加载供 footer 寻址用。
-            if (!noMention) {
+            if (!noMention && !vcMeetingManagedSendOrigin) {
                 const alreadyMentioned = new Set(mentions.map(m => m.open_id));
                 // Scan a code-span-stripped copy so a bot name quoted inside backticks or a
                 // fenced block (e.g. an example `botmux send --mention @Bot …` or an
@@ -5658,7 +6311,9 @@ async function cmdSend(rest) {
         // （Codex review P2）。--top-level 同样无特定收件人。
         const footerAddressing = (sendTopLevel || noMention)
             ? { sendTo: undefined, cc: [] }
-            : buildFooterAddressing(s, {
+            : buildFooterAddressing(explicitVcMeetingImOrigin?.replyTargetSenderOpenId
+                ? { ...s, lastCallerOpenId: explicitVcMeetingImOrigin.replyTargetSenderOpenId }
+                : s, {
                 isOncall: !!oncallEntry,
                 hasExplicitBotMention: explicitKnownBotMention,
                 knownBotOpenIds,
@@ -5711,7 +6366,13 @@ async function cmdSend(rest) {
             // and updates primaryQuotedId). Otherwise a bare `--videos … --no-mention`
             // reply in a 普通群 lands as a standalone message that doesn't quote the
             // trigger — unlike file-only/image-only sends whose primary card quotes.
-            const videoResult = await sendVideoAttachments({ uploadFile, uploadImage, dispatch, primaryDispatch: dispatchPrimary }, appId, videoAttachments);
+            const videoResult = await sendVideoAttachments({
+                uploadFile,
+                uploadImage,
+                dispatch,
+                primaryDispatch: dispatchPrimary,
+                ...(vcMeetingManagedSendOrigin ? { maxMessages: 1 } : {}),
+            }, appId, videoAttachments);
             failedVideoAttachments = videoResult.failed;
             if (videoResult.sent.length === 0) {
                 const first = failedVideoAttachments[0]?.error ?? 'unknown error';
@@ -5754,7 +6415,7 @@ async function cmdSend(rest) {
             // default botmux, '' → suppressed, else custom). Same resolver/rule as
             // the daemon's card builders so both send paths render identically.
             const footerParts = [];
-            const brandSeg = brandFooterSegment(resolveBrandLabel(appId));
+            const brandSeg = brandFooterSegment(renderBrandTemplate(resolveBrandLabel(appId), s.workingDir));
             if (brandSeg)
                 footerParts.push(brandSeg);
             // All real mentions land on one footer line: human addressee first, then
@@ -5776,7 +6437,9 @@ async function cmdSend(rest) {
             // v2 cards put buttons inside column_set/column — never the 1.x
             // `tag:'action'` container (Feishu rejects it, error 200861).
             let voiceOn = false;
-            if (!sendTopLevel) {
+            // A managed receiver card has no callback controls: a voice-summary
+            // button would open a second, unledgered model/output action when clicked.
+            if (!sendTopLevel && !vcMeetingManagedSendOrigin) {
                 try {
                     const { isVoiceConfigured } = await import('./services/voice/index.js');
                     voiceOn = isVoiceConfigured(appId);
@@ -5842,7 +6505,7 @@ async function cmdSend(rest) {
         // the success JSON. Pure-video sends have no text/card primary, so the media
         // message above is the primary and failures before any media is sent still
         // surface as command failure.
-        if (!pureVideoSend) {
+        if (!pureVideoSend && !vcMeetingListenerReplyReplay) {
             ({ failed: failedAttachments } = await sendFileAttachments({ uploadFile, dispatch }, appId, files));
             const videoResult = await sendVideoAttachments({ uploadFile, uploadImage, dispatch }, appId, videoAttachments);
             failedVideoAttachments = videoResult.failed;
@@ -5874,11 +6537,29 @@ async function cmdSend(rest) {
                 const daemon = findDaemon(appId);
                 if (!daemon)
                     throw new Error(`找不到 daemon (larkAppId=${appId})`);
-                const res = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/attention`, {
+                const originCapability = readManagedOriginCapability(resolveDataDir(), sid, process.env.BOTMUX_SEND_RELAY)?.capability;
+                const request = {
                     method: 'POST',
                     headers: { 'content-type': 'application/json' },
-                    body: JSON.stringify({ sessionId: sid, larkAppId: appId, action: 'raise', kind: attention.kind, reason: text.trim() }),
-                });
+                    body: JSON.stringify({
+                        sessionId: sid,
+                        larkAppId: appId,
+                        action: 'raise',
+                        kind: attention.kind,
+                        reason: text.trim(),
+                        originCapability,
+                        originTurnId: liveMarkerCtx?.turnId,
+                        originDispatchAttempt: liveMarkerCtx?.dispatchAttempt,
+                    }),
+                };
+                let secret;
+                try {
+                    secret = loadDaemonIpcSecret();
+                }
+                catch { /* Seatbelt/read-isolated CLI */ }
+                const res = secret
+                    ? await fetchDaemonIpc(daemon.ipcPort, '/api/attention', request, secret)
+                    : await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/attention`, request);
                 if (!res.ok)
                     throw new Error(`daemon HTTP ${res.status}`);
                 attentionRaised = true;
@@ -6443,13 +7124,32 @@ async function postAsk(body) {
     }
     let res;
     try {
-        res = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/asks`, {
+        const requestBody = { ...body };
+        if (typeof requestBody.originCapability !== 'string') {
+            const sessionId = typeof requestBody.sessionId === 'string'
+                ? requestBody.sessionId
+                : undefined;
+            const claim = readManagedOriginCapability(resolveDataDir(), sessionId, process.env.BOTMUX_SEND_RELAY);
+            if (claim)
+                requestBody.originCapability = claim.capability;
+        }
+        const init = {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(body),
+            body: JSON.stringify(requestBody),
             // No client-side timeout — broker enforces `timeoutMs` and will respond
             // with `kind:'timedOut'` so this fetch always settles.
-        });
+        };
+        let hostSecret;
+        if (!process.env.BOTMUX_SEND_RELAY) {
+            try {
+                hostSecret = loadDaemonIpcSecret();
+            }
+            catch { /* read-isolated CLI uses live marker auth */ }
+        }
+        res = hostSecret
+            ? await fetchDaemonIpc(daemon.ipcPort, '/api/asks', init, hostSecret)
+            : await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/asks`, init);
     }
     catch (fetchErr) {
         const msg = fetchErr instanceof Error ? fetchErr.message : String(fetchErr);
@@ -6528,14 +7228,23 @@ async function cmdAsk(sub, rest) {
         process.exit(2);
     }
     const larkAppId = process.env.BOTMUX_LARK_APP_ID;
+    const askSessionId = process.env.BOTMUX_SESSION_ID;
+    const liveAskOrigin = resolveSessionContext(resolveDataDir(), askSessionId);
+    const askRelayDir = process.env.BOTMUX_SEND_RELAY;
+    const askOriginCapability = readManagedOriginCapability(resolveDataDir(), askSessionId, askRelayDir)?.capability;
     const body = {
-        sessionId: process.env.BOTMUX_SESSION_ID,
+        sessionId: askSessionId,
         chatId: process.env.BOTMUX_CHAT_ID,
         larkAppId,
         rootMessageId: process.env.BOTMUX_ROOT_MESSAGE_ID || null,
         options,
         prompt,
         timeoutMs,
+        ...(liveAskOrigin?.turnId ? { originTurnId: liveAskOrigin.turnId } : {}),
+        ...(liveAskOrigin?.dispatchAttempt !== undefined
+            ? { originDispatchAttempt: liveAskOrigin.dispatchAttempt }
+            : {}),
+        ...(askOriginCapability ? { originCapability: askOriginCapability } : {}),
     };
     let result;
     try {
@@ -6758,11 +7467,37 @@ async function cmdSessionReady() {
     const daemon = findDaemon(larkAppId);
     if (daemon) {
         try {
-            await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/session-ready`, {
+            const relayDir = process.env.BOTMUX_SEND_RELAY;
+            const originCapability = readManagedOriginCapability(resolveDataDir(), sessionId, relayDir)?.capability;
+            const liveOrigin = resolveSessionContext(resolveDataDir(), sessionId);
+            const envAttempt = Number(process.env.BOTMUX_DISPATCH_ATTEMPT);
+            const originTurnId = liveOrigin?.turnId ?? process.env.BOTMUX_TURN_ID;
+            const originDispatchAttempt = liveOrigin?.dispatchAttempt
+                ?? (Number.isSafeInteger(envAttempt) && envAttempt > 0 ? envAttempt : undefined);
+            const init = {
                 method: 'POST',
                 headers: { 'content-type': 'application/json' },
-                body: JSON.stringify({ sessionId, source }),
-            });
+                body: JSON.stringify({
+                    sessionId,
+                    source,
+                    originCapability,
+                    originTurnId,
+                    originDispatchAttempt,
+                }),
+            };
+            let hostSecret;
+            if (!relayDir) {
+                try {
+                    hostSecret = loadDaemonIpcSecret();
+                }
+                catch { /* Seatbelt/read-isolated CLI */ }
+            }
+            if (!hostSecret) {
+                await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/session-ready`, init);
+            }
+            else {
+                await fetchDaemonIpc(daemon.ipcPort, '/api/session-ready', init, hostSecret);
+            }
         }
         catch { /* daemon 不可达 → 放弃，worker 走超时兜底 */ }
     }
@@ -6813,7 +7548,7 @@ async function notifyDaemonsReloadLocale() {
     let failed = 0;
     await Promise.all(daemons.map(async (d) => {
         try {
-            const r = await fetch(`http://127.0.0.1:${d.ipcPort}/api/locale/reload`, { method: 'POST' });
+            const r = await fetchDaemonIpc(d.ipcPort, '/api/locale/reload', { method: 'POST' });
             if (r.ok)
                 notified++;
             else
@@ -7102,13 +7837,44 @@ function getVersion() {
 }
 const command = process.argv[2];
 // Workflow safety gate (Slice C0): a CLI invoked inside a workflow
-// subagent worker (BOTMUX_WORKFLOW=1, set by daemon-spawn) must not
-// trigger chat-facing or schedule-mutation side effects.  Those belong
-// in `hostExecutor` activities so they get `effectAttempted` tracking +
-// reconcile.  Read-only commands (history, quoted, bots list, etc.)
-// stay allowed because they're useful for agents to introspect.
+// subagent worker (BOTMUX_WORKFLOW=1, set by v3/ephemeral-pool) must not
+// trigger chat-facing effects, schedule mutations, or recursively authorize /
+// mutate workflows.  Side effects belong in `hostExecutor` activities so they
+// get `effectAttempted` tracking + reconcile; workflow authorization belongs
+// to the host/user. Read-only commands stay allowed for introspection.
 if (process.env.BOTMUX_WORKFLOW === '1') {
-    const blockedRoot = new Set(['send', 'create-group', 'setup']);
+    // Default-deny the root command surface. New botmux commands otherwise
+    // silently become available to a bypass-permission workflow worker until
+    // someone remembers to extend a blacklist. Keep only explicit read-only
+    // introspection plus CLI startup plumbing; mutating subcommands under
+    // schedule/workflow/template/v3 are filtered again below. `mcp serve` is
+    // the stable, botmux-owned Plugin gateway configured for the parent CLI —
+    // it must start inside workflow workers, while every other/future `mcp`
+    // subcommand remains default-denied here.
+    const allowedRoot = new Set([
+        undefined,
+        '--help',
+        '-h',
+        'help',
+        '--version',
+        '-v',
+        'status',
+        'history',
+        'quoted',
+        'bots',
+        'skill',
+        'hook',
+        'session-ready',
+        'mcp',
+        'ask', // dedicated cmdAsk guard emits the humanGate-specific guidance
+        'schedule',
+        'workflow',
+        'template',
+        'v3',
+    ]);
+    const rootDenied = !allowedRoot.has(command);
+    const mcpSub = command === 'mcp' ? (process.argv[3] ?? '') : '';
+    const mcpDenied = command === 'mcp' && mcpSub !== 'serve';
     const isSchedule = command === 'schedule';
     const scheduleSub = isSchedule ? (process.argv[3] ?? '') : '';
     const blockedScheduleSub = new Set([
@@ -7123,12 +7889,56 @@ if (process.env.BOTMUX_WORKFLOW === '1') {
         'enable',
         'run',
     ]);
-    if (blockedRoot.has(command) || (isSchedule && blockedScheduleSub.has(scheduleSub))) {
+    const workflowSub = command === 'workflow' ? (process.argv[3] ?? '') : '';
+    const blockedWorkflowSub = new Set([
+        // v3 grill / authorization state changes.
+        'new',
+        'spec-finalize',
+        'approve-spec',
+        'revise-spec',
+        'architect',
+        'revise-dag',
+        'approve-dag',
+        // Saved Workflow creation / execution and live-run mutations.
+        'save',
+        'run',
+        'start',
+        'retry',
+        'grant',
+        'cancel',
+    ]);
+    const templateSub = command === 'template' ? (process.argv[3] ?? '') : '';
+    const blockedTemplateSub = new Set(['migrate-v3', 'archive-runs']);
+    const v3Sub = command === 'v3' ? (process.argv[3] ?? '') : '';
+    const workflowMutation = (command === 'workflow' && blockedWorkflowSub.has(workflowSub)) ||
+        (command === 'template' && blockedTemplateSub.has(templateSub)) ||
+        (command === 'v3' && v3Sub === 'run');
+    if (rootDenied ||
+        mcpDenied ||
+        (isSchedule && blockedScheduleSub.has(scheduleSub)) ||
+        workflowMutation) {
         const runId = process.env.BOTMUX_WORKFLOW_RUN_ID ?? '?';
         const nodeId = process.env.BOTMUX_WORKFLOW_NODE_ID ?? '?';
-        console.error(`botmux ${command}${isSchedule ? ` ${scheduleSub}` : ''} refused inside workflow ` +
-            `subagent (run=${runId} node=${nodeId}).  Chat-facing or schedule-mutating ` +
-            `effects belong in a hostExecutor activity, not a subagent.`);
+        const sub = isSchedule
+            ? scheduleSub
+            : command === 'mcp'
+                ? mcpSub
+                : command === 'workflow'
+                    ? workflowSub
+                    : command === 'template'
+                        ? templateSub
+                        : command === 'v3'
+                            ? v3Sub
+                            : '';
+        const guidance = mcpDenied
+            ? 'Only the botmux-owned Plugin MCP gateway bootstrap (`mcp serve`) is available inside a workflow subagent.'
+            : workflowMutation
+                ? 'Workflow authorization and run mutations must be initiated by the host/user, not a subagent.'
+                : rootDenied
+                    ? 'This root command is not in the workflow read-only allowlist; chat-facing effects belong in a hostExecutor activity.'
+                    : 'Chat-facing or schedule-mutating effects belong in a hostExecutor activity, not a subagent.';
+        console.error(`botmux ${command}${sub ? ` ${sub}` : ''} refused inside workflow ` +
+            `subagent (run=${runId} node=${nodeId}).  ${guidance}`);
         process.exit(2);
     }
 }
@@ -7650,7 +8460,7 @@ switch (command) {
         console.log(getVersion());
         break;
     case 'setup': {
-        // 带子命令（list/add/edit/remove/help）走脚本化非 TUI 模式；空参数 / 纯
+        // 带子命令（list/add/configure/edit/remove/help）走脚本化非 TUI 模式；空参数 / 纯
         // flag（如 --no-open-platform-auto）保持原交互 TUI，向后兼容。
         const setupArgs = process.argv.slice(3);
         if (isScriptedSetupInvocation(setupArgs))
@@ -7678,6 +8488,7 @@ switch (command) {
         cmdStatus();
         break;
     case 'upgrade':
+    case 'update':
         cmdUpgrade();
         break;
     case 'dashboard':
@@ -7704,6 +8515,12 @@ switch (command) {
     case 'suspend':
         await cmdSuspend();
         break;
+    case 'slash':
+        await cmdSlash();
+        break;
+    case 'cd':
+        await cmdCd();
+        break;
     case 'term-link':
         await cmdTermLink(process.argv.slice(3));
         break;
@@ -7763,6 +8580,11 @@ switch (command) {
     }
     case 'workflow': {
         const wfSub = process.argv[3] ?? '';
+        if (wfSub === 'cancel') {
+            // Durable v3 run cancellation. The v2 runtime is retired.
+            await cmdWorkflowCancelV3(process.argv[4], process.argv.slice(5));
+            break;
+        }
         if (wfSub === 'start') {
             // `botmux workflow start <runId>` — kick a daemon-driven v3 run (so
             // humanGate posts approval cards).  Needs a live daemon; findDaemon is
@@ -7771,7 +8593,7 @@ switch (command) {
             break;
         }
         if (wfSub === 'retry') {
-            // v3 blocked-node retry (the `resume` verb belongs to v0.2).
+            // v3 blocked-node retry; the former v2 `resume` verb is retired.
             await cmdWorkflowRetry(process.argv[4], process.argv.slice(5));
             break;
         }
@@ -7784,6 +8606,11 @@ switch (command) {
         await cmdWorkflow(wfSub, process.argv.slice(4));
         break;
     }
+    case 'template': {
+        const { cmdTemplate } = await import('./cli/workflow.js');
+        await cmdTemplate(process.argv[3] ?? '', process.argv.slice(4));
+        break;
+    }
     case 'v3': {
         // `botmux v3 run <dag.json>` — run a hand-written next-gen (v3) DAG on the
         // real ephemeral worker pool, daemon-independent (dogfood path).