botmux 2.111.0 → 2.112.0

package/dist/services/vc-meeting-runtime-store.js

@@ -1,7 +1,16 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { withFileLockSync } from '../utils/file-lock.js';
 import { logger } from '../utils/logger.js';
+import { normalizeVcMeetingProfileInstructions } from './vc-meeting-profile-instructions.js';
+const RUNTIME_SCHEMA_VERSION = 3;
+export const VC_MEETING_RUNTIME_LEGACY_PROFILE_ID = 'legacy-generalist';
+export const VC_MEETING_RUNTIME_LEGACY_MEMBER_ID = 'meeting_assistant';
+export const VC_MEETING_RUNTIME_LEGACY_ROLE = 'meeting_assistant';
+export const VC_MEETING_RUNTIME_LEGACY_PROFILE_HASH = `sha256:${createHash('sha256')
+    .update(JSON.stringify({ role: VC_MEETING_RUNTIME_LEGACY_ROLE, filter: 'all' }), 'utf8')
+    .digest('hex')}`;
 const FILE_NAME = 'vc-meeting-runtime-sessions.json';
 const ENDED_TOMBSTONE_FILE_NAME = 'vc-meeting-ended-tombstones.json';
 const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
@@ -22,24 +31,72 @@ function listenerAgentIndexKey(listenerChatId, selectedAgentAppId) {
 function invalidateListenerAgentIndex() {
     listenerAgentIndexCache = undefined;
 }
+function ensureLockParent(fp) {
+    const dir = dirname(fp);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+}
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function assertNoQuarantinedEvidence(fp, label) {
+    const prefix = `${basename(fp)}.corrupt.`;
+    let quarantined = false;
+    try {
+        quarantined = readdirSync(dirname(fp)).some(name => name.startsWith(prefix));
+    }
+    catch {
+        // A genuinely absent directory/store is initializable.
+    }
+    if (quarantined) {
+        throw new Error(`vc meeting ${label} store has quarantined evidence for ${fp}`);
+    }
+}
+function quarantineCorruptStore(fp, label, err) {
+    const aside = `${fp}.corrupt.${Date.now()}.${process.pid}`;
+    try {
+        renameSync(fp, aside);
+    }
+    catch { /* another process may already have quarantined it */ }
+    invalidateListenerAgentIndex();
+    logger.warn(`[vc-meeting-runtime-store] corrupt ${label} store at ${fp}, moved aside to ${aside}: `
+        + `${err instanceof Error ? err.message : String(err)}`);
+    throw new Error(`vc meeting ${label} store is corrupt: ${aside}`);
+}
 function readStore(dataDir) {
     const fp = filePath(dataDir);
-    if (!existsSync(fp))
+    if (!existsSync(fp)) {
+        assertNoQuarantinedEvidence(fp, 'runtime session');
         return {};
+    }
     try {
         const raw = JSON.parse(readFileSync(fp, 'utf-8'));
-        const out = {};
+        if (!isRecord(raw))
+            throw new Error('store root must be an object');
+        const out = Object.create(null);
         for (const [key, value] of Object.entries(raw)) {
             const record = normalizeRecord(value);
-            if (record)
-                out[key] = record;
+            if (!record)
+                throw new Error(`invalid runtime session record at ${key}`);
+            if (key !== sessionKey(record.larkAppId, record.meeting.id)) {
+                throw new Error(`runtime session key mismatch at ${key}`);
+            }
+            out[key] = record;
         }
         return out;
     }
     catch (err) {
-        logger.warn(`[vc-meeting-runtime-store] failed to read ${fp}: ${err instanceof Error ? err.message : String(err)}`);
+        return quarantineCorruptStore(fp, 'runtime session', err);
+    }
+}
+function readStoreForAccess(dataDir) {
+    const fp = filePath(dataDir);
+    if (!existsSync(fp)) {
+        assertNoQuarantinedEvidence(fp, 'runtime session');
         return {};
     }
+    ensureLockParent(fp);
+    return withFileLockSync(fp, () => readStore(dataDir));
 }
 function writeStore(dataDir, store) {
     const fp = filePath(dataDir);
@@ -53,22 +110,38 @@ function writeStore(dataDir, store) {
 }
 function readEndedTombstoneStore(dataDir) {
     const fp = endedTombstoneFilePath(dataDir);
-    if (!existsSync(fp))
+    if (!existsSync(fp)) {
+        assertNoQuarantinedEvidence(fp, 'ended tombstone');
         return {};
+    }
     try {
         const raw = JSON.parse(readFileSync(fp, 'utf-8'));
-        const out = {};
+        if (!isRecord(raw))
+            throw new Error('store root must be an object');
+        const out = Object.create(null);
         for (const [key, value] of Object.entries(raw)) {
             const record = normalizeEndedTombstoneRecord(value);
-            if (record)
-                out[key] = record;
+            if (!record)
+                throw new Error(`invalid ended tombstone record at ${key}`);
+            if (key !== sessionKey(record.larkAppId, record.meetingId)) {
+                throw new Error(`ended tombstone key mismatch at ${key}`);
+            }
+            out[key] = record;
         }
         return out;
     }
     catch (err) {
-        logger.warn(`[vc-meeting-runtime-store] failed to read ${fp}: ${err instanceof Error ? err.message : String(err)}`);
+        return quarantineCorruptStore(fp, 'ended tombstone', err);
+    }
+}
+function readEndedTombstoneStoreForAccess(dataDir) {
+    const fp = endedTombstoneFilePath(dataDir);
+    if (!existsSync(fp)) {
+        assertNoQuarantinedEvidence(fp, 'ended tombstone');
         return {};
     }
+    ensureLockParent(fp);
+    return withFileLockSync(fp, () => readEndedTombstoneStore(dataDir));
 }
 function writeEndedTombstoneStore(dataDir, store) {
     const fp = endedTombstoneFilePath(dataDir);
@@ -79,10 +152,298 @@ function writeEndedTombstoneStore(dataDir, store) {
     writeFileSync(tmp, JSON.stringify(store, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
     renameSync(tmp, fp);
 }
+const SAFE_RUNTIME_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const RESERVED_RUNTIME_IDS = new Set(['__proto__', 'prototype', 'constructor']);
+const RUNTIME_ACTIVITY_TYPES = [
+    'participant_joined',
+    'participant_left',
+    'chat_received',
+    'transcript_received',
+    'magic_share_started',
+    'magic_share_ended',
+];
+const RUNTIME_OWNED_SINKS = ['meeting_text', 'meeting_voice'];
+const RUNTIME_LISTENER_OUTPUT_CAPABILITY = 'listener.output.request';
+const DELIVERY_PROFILE_HASH_RE = /^sha256:[0-9a-f]{64}$/;
+function isSafeRuntimeId(value) {
+    return typeof value === 'string'
+        && SAFE_RUNTIME_ID_RE.test(value)
+        && !RESERVED_RUNTIME_IDS.has(value);
+}
+function normalizeUniqueStringList(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const out = [];
+    const seen = new Set();
+    for (const item of value) {
+        if (typeof item !== 'string' || !item.trim())
+            return undefined;
+        const normalized = item.trim();
+        if (seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        out.push(normalized);
+    }
+    return out;
+}
+function normalizeSelectedAgentFilter(value) {
+    if (value === undefined)
+        return { ok: true };
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return { ok: false };
+    const filter = value;
+    if (Object.keys(filter).some(key => key !== 'activityTypes'))
+        return { ok: false };
+    if (filter.activityTypes === undefined)
+        return { ok: true };
+    const activityTypes = normalizeUniqueStringList(filter.activityTypes);
+    if (!activityTypes
+        || activityTypes.some(type => !RUNTIME_ACTIVITY_TYPES.includes(type))) {
+        return { ok: false };
+    }
+    return activityTypes.length > 0
+        ? { ok: true, filter: { activityTypes: activityTypes } }
+        : { ok: true };
+}
+function normalizeSelectedAgent(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return { ok: false };
+    const agent = value;
+    const allowedKeys = new Set([
+        'profileId',
+        'memberId',
+        'agentAppId',
+        'label',
+        'role',
+        'instructions',
+        'status',
+        'activationError',
+        'filter',
+        'responseMode',
+        'capabilities',
+        'ownedSinks',
+        'deliveryProfileHash',
+    ]);
+    if (Object.keys(agent).some(key => !allowedKeys.has(key)))
+        return { ok: false };
+    if (!isSafeRuntimeId(agent.profileId) || !isSafeRuntimeId(agent.memberId))
+        return { ok: false };
+    if (typeof agent.agentAppId !== 'string' || !agent.agentAppId.trim())
+        return { ok: false };
+    if (typeof agent.role !== 'string' || !agent.role.trim())
+        return { ok: false };
+    const normalizedInstructions = normalizeVcMeetingProfileInstructions(agent.instructions);
+    if (!normalizedInstructions.ok)
+        return { ok: false };
+    if (agent.label !== undefined && (typeof agent.label !== 'string' || !agent.label.trim()))
+        return { ok: false };
+    if (agent.activationError !== undefined
+        && (typeof agent.activationError !== 'string' || !agent.activationError.trim()))
+        return { ok: false };
+    if (!['activating', 'active', 'failed', 'paused'].includes(agent.status))
+        return { ok: false };
+    if (agent.responseMode !== 'silent' && agent.responseMode !== 'listener_thread')
+        return { ok: false };
+    const capabilities = normalizeUniqueStringList(agent.capabilities);
+    const ownedSinks = normalizeUniqueStringList(agent.ownedSinks);
+    if (!capabilities || !ownedSinks)
+        return { ok: false };
+    if (ownedSinks.some(sink => !RUNTIME_OWNED_SINKS.includes(sink)))
+        return { ok: false };
+    if (ownedSinks.length > 0 && !capabilities.includes('meeting.output.request'))
+        return { ok: false };
+    const filter = normalizeSelectedAgentFilter(agent.filter);
+    if (!filter.ok)
+        return { ok: false };
+    if (agent.deliveryProfileHash !== undefined
+        && (typeof agent.deliveryProfileHash !== 'string'
+            || !DELIVERY_PROFILE_HASH_RE.test(agent.deliveryProfileHash)))
+        return { ok: false };
+    return {
+        ok: true,
+        agent: {
+            profileId: agent.profileId,
+            memberId: agent.memberId,
+            agentAppId: agent.agentAppId.trim(),
+            ...(typeof agent.label === 'string' ? { label: agent.label.trim() } : {}),
+            role: agent.role.trim(),
+            ...(normalizedInstructions.instructions
+                ? { instructions: normalizedInstructions.instructions }
+                : {}),
+            status: agent.status,
+            ...(typeof agent.activationError === 'string'
+                ? { activationError: agent.activationError.trim().slice(0, 500) }
+                : {}),
+            ...(filter.filter ? { filter: filter.filter } : {}),
+            responseMode: agent.responseMode,
+            capabilities,
+            ownedSinks: ownedSinks,
+            ...(typeof agent.deliveryProfileHash === 'string'
+                ? { deliveryProfileHash: agent.deliveryProfileHash }
+                : {}),
+        },
+    };
+}
+function normalizeSelectedAgents(value) {
+    if (!Array.isArray(value))
+        return { ok: false };
+    const agents = [];
+    const profileIds = new Set();
+    const memberIds = new Set();
+    const agentAppIds = new Set();
+    const ownedSinks = new Set();
+    let listenerThreadMemberId;
+    for (const item of value) {
+        const normalized = normalizeSelectedAgent(item);
+        if (!normalized.ok)
+            return { ok: false };
+        const agent = normalized.agent;
+        if (profileIds.has(agent.profileId)
+            || memberIds.has(agent.memberId)
+            || agentAppIds.has(agent.agentAppId))
+            return { ok: false };
+        profileIds.add(agent.profileId);
+        memberIds.add(agent.memberId);
+        agentAppIds.add(agent.agentAppId);
+        for (const sink of agent.ownedSinks) {
+            if (ownedSinks.has(sink))
+                return { ok: false };
+            ownedSinks.add(sink);
+        }
+        if (agent.responseMode === 'listener_thread') {
+            if (listenerThreadMemberId)
+                return { ok: false };
+            listenerThreadMemberId = agent.memberId;
+        }
+        agents.push(agent);
+    }
+    const legacySingleton = agents.length === 1
+        && agents[0]?.profileId === VC_MEETING_RUNTIME_LEGACY_PROFILE_ID
+        && agents[0].memberId === VC_MEETING_RUNTIME_LEGACY_MEMBER_ID
+        && agents[0].role === VC_MEETING_RUNTIME_LEGACY_ROLE;
+    for (const agent of agents) {
+        if (agent.responseMode === 'listener_thread'
+            && !legacySingleton
+            && !agent.capabilities.includes(RUNTIME_LISTENER_OUTPUT_CAPABILITY))
+            return { ok: false };
+    }
+    return { ok: true, agents };
+}
+function legacySelectedAgent(value) {
+    if (typeof value.selectedAgentAppId !== 'string' || !value.selectedAgentAppId.trim())
+        return undefined;
+    return {
+        profileId: VC_MEETING_RUNTIME_LEGACY_PROFILE_ID,
+        memberId: VC_MEETING_RUNTIME_LEGACY_MEMBER_ID,
+        agentAppId: value.selectedAgentAppId.trim(),
+        ...(typeof value.selectedAgentLabel === 'string' && value.selectedAgentLabel.trim()
+            ? { label: value.selectedAgentLabel.trim() }
+            : {}),
+        role: VC_MEETING_RUNTIME_LEGACY_ROLE,
+        status: value.consumerPaused === true ? 'paused' : 'active',
+        responseMode: 'listener_thread',
+        capabilities: ['meeting.read', 'meeting.output.request'],
+        ownedSinks: ['meeting_text', 'meeting_voice'],
+        deliveryProfileHash: VC_MEETING_RUNTIME_LEGACY_PROFILE_HASH,
+    };
+}
+function singularSelectionAliases(selectedAgents) {
+    if (selectedAgents.length !== 1)
+        return {};
+    const selected = selectedAgents[0];
+    return {
+        selectedAgentAppId: selected.agentAppId,
+        ...(selected.label ? { selectedAgentLabel: selected.label } : {}),
+        // The legacy boolean cannot represent activating/failed. Fail closed so a
+        // P0 reader never mistakes a non-active v2 member for an injectable one.
+        consumerPaused: selected.status !== 'active',
+    };
+}
+function isValidStoredTimestamp(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= 0;
+}
+function hasOwnField(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key);
+}
+function isCanonicalStoredIdList(value) {
+    if (!Array.isArray(value))
+        return false;
+    const normalized = normalizeIdList(value);
+    return normalized.length === value.length
+        && normalized.every((id, index) => id === value[index]);
+}
+function hasValidCurrentOptionalFields(r) {
+    if (hasOwnField(r, 'consumerMode')
+        && r.consumerMode !== 'pending'
+        && r.consumerMode !== 'listenOnly'
+        && r.consumerMode !== 'agent')
+        return false;
+    if (hasOwnField(r, 'consumerClosePhase')
+        && r.consumerClosePhase !== 'data_closing'
+        && r.consumerClosePhase !== 'finalizing')
+        return false;
+    if (hasOwnField(r, 'textOutputPolicy') && !isOutputPolicy(r.textOutputPolicy))
+        return false;
+    if (hasOwnField(r, 'voiceOutputPolicy') && !isOutputPolicy(r.voiceOutputPolicy))
+        return false;
+    for (const key of [
+        'consumerFinalizationDeadlineAt',
+        'consumerCloseResolutionDeadlineAt',
+        'consumerSelectionExpiresAt',
+        'listenerPresenceChangedAtMs',
+    ]) {
+        if (hasOwnField(r, key) && !isValidStoredTimestamp(r[key]))
+            return false;
+    }
+    if (hasOwnField(r, 'syncIntervalMs')
+        && (typeof r.syncIntervalMs !== 'number'
+            || !Number.isFinite(r.syncIntervalMs)
+            || r.syncIntervalMs <= 0))
+        return false;
+    if (hasOwnField(r, 'listenerPresenceStale') && typeof r.listenerPresenceStale !== 'boolean')
+        return false;
+    if (hasOwnField(r, 'listenerPresenceGeneration')
+        && (typeof r.listenerPresenceGeneration !== 'number'
+            || !Number.isInteger(r.listenerPresenceGeneration)
+            || r.listenerPresenceGeneration < 0))
+        return false;
+    for (const key of [
+        'attentionTargetOpenId',
+        'consumerCardMessageId',
+        'listenerRejoinNonce',
+        'listenerRejoinCardMessageId',
+    ]) {
+        if (hasOwnField(r, key) && (typeof r[key] !== 'string' || !r[key].trim()))
+            return false;
+    }
+    for (const key of ['temporaryInstructionOpenIds', 'temporaryInstructionUnionIds']) {
+        if (hasOwnField(r, key) && !isCanonicalStoredIdList(r[key]))
+            return false;
+    }
+    return true;
+}
+function hasValidCurrentMeetingFields(meeting) {
+    for (const key of ['meetingNo', 'topic']) {
+        if (hasOwnField(meeting, key)
+            && (typeof meeting[key] !== 'string' || !meeting[key].trim()))
+            return false;
+    }
+    return true;
+}
 function normalizeRecord(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return undefined;
     const r = value;
+    if (r.schemaVersion !== undefined
+        && r.schemaVersion !== 1
+        && r.schemaVersion !== 2
+        && r.schemaVersion !== RUNTIME_SCHEMA_VERSION) {
+        return undefined;
+    }
+    // Records written before schemaVersion was introduced have the v1 shape.
+    // Only that legacy shape may recover selection from the singular aliases;
+    // v2/v3 selectedAgents is authoritative and therefore required.
+    const sourceSchemaVersion = r.schemaVersion ?? 1;
     const meeting = r.meeting;
     if (!meeting || typeof meeting !== 'object' || Array.isArray(meeting))
         return undefined;
@@ -93,12 +454,36 @@ function normalizeRecord(value) {
         return undefined;
     if (typeof r.listenerChatId !== 'string' || !r.listenerChatId.trim())
         return undefined;
-    const createdAt = typeof r.createdAt === 'number' && Number.isFinite(r.createdAt) ? r.createdAt : Date.now();
-    const updatedAt = typeof r.updatedAt === 'number' && Number.isFinite(r.updatedAt) ? r.updatedAt : createdAt;
-    const expiresAt = typeof r.expiresAt === 'number' && Number.isFinite(r.expiresAt)
+    if (sourceSchemaVersion === RUNTIME_SCHEMA_VERSION
+        && (!isValidStoredTimestamp(r.createdAt)
+            || !isValidStoredTimestamp(r.updatedAt)
+            || !isValidStoredTimestamp(r.expiresAt)
+            || !hasValidCurrentMeetingFields(m)
+            || !hasValidCurrentOptionalFields(r))) {
+        return undefined;
+    }
+    const createdAt = isValidStoredTimestamp(r.createdAt) ? r.createdAt : Date.now();
+    const updatedAt = isValidStoredTimestamp(r.updatedAt) ? r.updatedAt : createdAt;
+    const expiresAt = isValidStoredTimestamp(r.expiresAt)
         ? r.expiresAt
         : updatedAt + DEFAULT_TTL_MS;
+    let selectedAgents;
+    if (Object.prototype.hasOwnProperty.call(r, 'selectedAgents')) {
+        const normalized = normalizeSelectedAgents(r.selectedAgents);
+        if (!normalized.ok)
+            return undefined;
+        selectedAgents = normalized.agents;
+    }
+    else if (sourceSchemaVersion === 1) {
+        const legacy = legacySelectedAgent(r);
+        selectedAgents = legacy ? [legacy] : [];
+    }
+    else {
+        return undefined;
+    }
+    const singularAliases = singularSelectionAliases(selectedAgents);
     return {
+        schemaVersion: RUNTIME_SCHEMA_VERSION,
         larkAppId: r.larkAppId.trim(),
         meeting: {
             id: m.id.trim(),
@@ -112,13 +497,21 @@ function normalizeRecord(value) {
         ...(r.consumerMode === 'pending' || r.consumerMode === 'listenOnly' || r.consumerMode === 'agent'
             ? { consumerMode: r.consumerMode }
             : {}),
-        ...(typeof r.selectedAgentAppId === 'string' && r.selectedAgentAppId.trim()
-            ? { selectedAgentAppId: r.selectedAgentAppId.trim() }
+        selectedAgents,
+        ...singularAliases,
+        ...(r.consumerClosePhase === 'data_closing' || r.consumerClosePhase === 'finalizing'
+            ? { consumerClosePhase: r.consumerClosePhase }
             : {}),
-        ...(typeof r.selectedAgentLabel === 'string' && r.selectedAgentLabel.trim()
-            ? { selectedAgentLabel: r.selectedAgentLabel.trim() }
+        ...(typeof r.consumerFinalizationDeadlineAt === 'number'
+            && Number.isFinite(r.consumerFinalizationDeadlineAt)
+            && r.consumerFinalizationDeadlineAt >= 0
+            ? { consumerFinalizationDeadlineAt: r.consumerFinalizationDeadlineAt }
+            : {}),
+        ...(typeof r.consumerCloseResolutionDeadlineAt === 'number'
+            && Number.isFinite(r.consumerCloseResolutionDeadlineAt)
+            && r.consumerCloseResolutionDeadlineAt >= 0
+            ? { consumerCloseResolutionDeadlineAt: r.consumerCloseResolutionDeadlineAt }
             : {}),
-        ...(typeof r.consumerPaused === 'boolean' ? { consumerPaused: r.consumerPaused } : {}),
         ...(isOutputPolicy(r.textOutputPolicy) ? { textOutputPolicy: r.textOutputPolicy } : {}),
         ...(isOutputPolicy(r.voiceOutputPolicy) ? { voiceOutputPolicy: r.voiceOutputPolicy } : {}),
         ...(typeof r.syncIntervalMs === 'number' && Number.isFinite(r.syncIntervalMs) && r.syncIntervalMs > 0
@@ -130,6 +523,23 @@ function normalizeRecord(value) {
         ...(typeof r.consumerCardMessageId === 'string' && r.consumerCardMessageId.trim()
             ? { consumerCardMessageId: r.consumerCardMessageId.trim() }
             : {}),
+        ...(r.listenerPresenceStale === true ? { listenerPresenceStale: true } : {}),
+        ...(typeof r.listenerPresenceChangedAtMs === 'number'
+            && Number.isFinite(r.listenerPresenceChangedAtMs)
+            && r.listenerPresenceChangedAtMs >= 0
+            ? { listenerPresenceChangedAtMs: r.listenerPresenceChangedAtMs }
+            : {}),
+        ...(typeof r.listenerPresenceGeneration === 'number'
+            && Number.isInteger(r.listenerPresenceGeneration)
+            && r.listenerPresenceGeneration >= 0
+            ? { listenerPresenceGeneration: r.listenerPresenceGeneration }
+            : {}),
+        ...(typeof r.listenerRejoinNonce === 'string' && r.listenerRejoinNonce.trim()
+            ? { listenerRejoinNonce: r.listenerRejoinNonce.trim() }
+            : {}),
+        ...(typeof r.listenerRejoinCardMessageId === 'string' && r.listenerRejoinCardMessageId.trim()
+            ? { listenerRejoinCardMessageId: r.listenerRejoinCardMessageId.trim() }
+            : {}),
         ...(Array.isArray(r.temporaryInstructionOpenIds)
             ? { temporaryInstructionOpenIds: normalizeIdList(r.temporaryInstructionOpenIds) }
             : {}),
@@ -149,15 +559,13 @@ function normalizeEndedTombstoneRecord(value) {
         return undefined;
     if (typeof r.meetingId !== 'string' || !r.meetingId.trim())
         return undefined;
-    const endedAt = typeof r.endedAt === 'number' && Number.isFinite(r.endedAt) ? r.endedAt : Date.now();
-    const expiresAt = typeof r.expiresAt === 'number' && Number.isFinite(r.expiresAt)
-        ? r.expiresAt
-        : endedAt + DEFAULT_ENDED_TOMBSTONE_TTL_MS;
+    if (!isValidStoredTimestamp(r.endedAt) || !isValidStoredTimestamp(r.expiresAt))
+        return undefined;
     return {
         larkAppId: r.larkAppId.trim(),
         meetingId: r.meetingId.trim(),
-        endedAt,
-        expiresAt,
+        endedAt: r.endedAt,
+        expiresAt: r.expiresAt,
     };
 }
 function isOutputPolicy(value) {
@@ -178,7 +586,7 @@ function normalizeIdList(value) {
     return out;
 }
 export function listVcMeetingRuntimeSessions(dataDir, larkAppId, now = Date.now()) {
-    const store = readStore(dataDir);
+    const store = readStoreForAccess(dataDir);
     const out = [];
     for (const record of Object.values(store)) {
         if (record.expiresAt <= now)
@@ -189,23 +597,27 @@ export function listVcMeetingRuntimeSessions(dataDir, larkAppId, now = Date.now(
     return out;
 }
 export function pruneExpiredVcMeetingRuntimeSessions(dataDir, now = Date.now()) {
-    const store = readStore(dataDir);
-    let removed = 0;
-    for (const [key, record] of Object.entries(store)) {
-        if (record.expiresAt > now)
-            continue;
-        delete store[key];
-        removed += 1;
-    }
-    if (removed > 0)
-        writeStore(dataDir, store);
-    return removed;
+    const fp = filePath(dataDir);
+    ensureLockParent(fp);
+    return withFileLockSync(fp, () => {
+        const store = readStore(dataDir);
+        let removed = 0;
+        for (const [key, record] of Object.entries(store)) {
+            if (record.expiresAt > now)
+                continue;
+            delete store[key];
+            removed += 1;
+        }
+        if (removed > 0)
+            writeStore(dataDir, store);
+        return removed;
+    });
 }
-export function findVcMeetingRuntimeSessionByListenerAndAgent(dataDir, input, now = Date.now()) {
+export function listVcMeetingRuntimeSessionsByListenerAndAgent(dataDir, input, now = Date.now()) {
     const listenerChatId = input.listenerChatId.trim();
-    const selectedAgentAppId = input.selectedAgentAppId.trim();
-    if (!listenerChatId || !selectedAgentAppId)
-        return undefined;
+    const agentAppId = input.agentAppId.trim();
+    if (!listenerChatId || !agentAppId)
+        return [];
     const fp = filePath(dataDir);
     let stats;
     try {
@@ -213,7 +625,8 @@ export function findVcMeetingRuntimeSessionByListenerAndAgent(dataDir, input, no
     }
     catch {
         invalidateListenerAgentIndex();
-        return undefined;
+        assertNoQuarantinedEvidence(fp, 'runtime session');
+        return [];
     }
     const cached = listenerAgentIndexCache;
     let byListenerAgent;
@@ -226,18 +639,25 @@ export function findVcMeetingRuntimeSessionByListenerAndAgent(dataDir, input, no
         byListenerAgent = cached.byListenerAgent;
     }
     else {
-        const store = readStore(dataDir);
+        const store = readStoreForAccess(dataDir);
         byListenerAgent = new Map();
         for (const record of Object.values(store)) {
-            if (record.consumerMode === 'agent'
-                && record.selectedAgentAppId
-                && record.consumerPaused !== true) {
-                const key = listenerAgentIndexKey(record.listenerChatId, record.selectedAgentAppId);
-                const prior = byListenerAgent.get(key);
-                if (!prior || record.updatedAt > prior.updatedAt)
-                    byListenerAgent.set(key, record);
+            if (record.consumerMode !== 'agent')
+                continue;
+            for (const selected of record.selectedAgents) {
+                if (selected.status !== 'active')
+                    continue;
+                const key = listenerAgentIndexKey(record.listenerChatId, selected.agentAppId);
+                const matches = byListenerAgent.get(key) ?? [];
+                matches.push(record);
+                byListenerAgent.set(key, matches);
             }
         }
+        for (const matches of byListenerAgent.values()) {
+            matches.sort((a, b) => b.updatedAt - a.updatedAt
+                || a.larkAppId.localeCompare(b.larkAppId)
+                || a.meeting.id.localeCompare(b.meeting.id));
+        }
         listenerAgentIndexCache = {
             fp,
             ino: stats.ino,
@@ -247,77 +667,134 @@ export function findVcMeetingRuntimeSessionByListenerAndAgent(dataDir, input, no
             byListenerAgent,
         };
     }
-    const record = byListenerAgent.get(listenerAgentIndexKey(listenerChatId, selectedAgentAppId));
-    if (!record)
-        return undefined;
-    if (record.expiresAt <= now) {
+    const matches = byListenerAgent.get(listenerAgentIndexKey(listenerChatId, agentAppId)) ?? [];
+    const active = matches.filter(record => record.expiresAt > now);
+    if (active.length !== matches.length) {
         invalidateListenerAgentIndex();
-        return undefined;
     }
-    return record;
+    return active;
+}
+/**
+ * @deprecated P0 compatibility wrapper. It preserves the historical
+ * latest-updated match until daemon routing is migrated to the list API.
+ */
+export function findVcMeetingRuntimeSessionByListenerAndAgent(dataDir, input, now = Date.now()) {
+    return listVcMeetingRuntimeSessionsByListenerAndAgent(dataDir, {
+        listenerChatId: input.listenerChatId,
+        agentAppId: input.selectedAgentAppId,
+    }, now)[0];
 }
 export function recordVcMeetingRuntimeSession(dataDir, input, now = Date.now()) {
-    if (!input.larkAppId.trim() || !input.meeting.id.trim() || !input.listenerChatId.trim())
+    const larkAppId = input.larkAppId.trim();
+    const meetingId = input.meeting.id.trim();
+    const listenerChatId = input.listenerChatId.trim();
+    if (!larkAppId || !meetingId || !listenerChatId)
         return;
-    const store = readStore(dataDir);
-    const key = sessionKey(input.larkAppId, input.meeting.id);
-    const prior = store[key];
-    store[key] = {
-        larkAppId: input.larkAppId,
-        meeting: {
-            id: input.meeting.id,
-            ...(input.meeting.meetingNo ? { meetingNo: input.meeting.meetingNo } : {}),
-            ...(input.meeting.topic ? { topic: input.meeting.topic } : {}),
-        },
-        listenerChatId: input.listenerChatId,
-        ...(input.attentionTargetOpenId ? { attentionTargetOpenId: input.attentionTargetOpenId } : {}),
-        ...(input.consumerMode ? { consumerMode: input.consumerMode } : {}),
-        ...(input.selectedAgentAppId ? { selectedAgentAppId: input.selectedAgentAppId } : {}),
-        ...(input.selectedAgentLabel ? { selectedAgentLabel: input.selectedAgentLabel } : {}),
-        ...(input.consumerPaused !== undefined ? { consumerPaused: input.consumerPaused } : {}),
-        ...(input.textOutputPolicy ? { textOutputPolicy: input.textOutputPolicy } : {}),
-        ...(input.voiceOutputPolicy ? { voiceOutputPolicy: input.voiceOutputPolicy } : {}),
-        ...(input.syncIntervalMs !== undefined ? { syncIntervalMs: input.syncIntervalMs } : {}),
-        ...(input.consumerSelectionExpiresAt !== undefined ? { consumerSelectionExpiresAt: input.consumerSelectionExpiresAt } : {}),
-        ...(input.consumerCardMessageId ? { consumerCardMessageId: input.consumerCardMessageId } : {}),
-        ...(input.temporaryInstructionOpenIds !== undefined
-            ? { temporaryInstructionOpenIds: normalizeIdList(input.temporaryInstructionOpenIds) }
-            : {}),
-        ...(input.temporaryInstructionUnionIds !== undefined
-            ? { temporaryInstructionUnionIds: normalizeIdList(input.temporaryInstructionUnionIds) }
-            : {}),
-        createdAt: prior?.createdAt ?? now,
-        updatedAt: now,
-        expiresAt: now + DEFAULT_TTL_MS,
-    };
-    writeStore(dataDir, store);
+    const fp = filePath(dataDir);
+    ensureLockParent(fp);
+    withFileLockSync(fp, () => {
+        const store = readStore(dataDir);
+        const key = sessionKey(larkAppId, meetingId);
+        const prior = store[key];
+        let selectedAgents;
+        if (input.selectedAgents !== undefined) {
+            const normalized = normalizeSelectedAgents(input.selectedAgents);
+            if (!normalized.ok)
+                throw new Error('invalid vc meeting runtime selectedAgents');
+            selectedAgents = normalized.agents;
+        }
+        else {
+            const legacy = legacySelectedAgent({
+                selectedAgentAppId: input.selectedAgentAppId,
+                selectedAgentLabel: input.selectedAgentLabel,
+                consumerPaused: input.consumerPaused,
+            });
+            selectedAgents = legacy ? [legacy] : [];
+        }
+        const singularAliases = singularSelectionAliases(selectedAgents);
+        store[key] = {
+            schemaVersion: RUNTIME_SCHEMA_VERSION,
+            larkAppId,
+            meeting: {
+                id: meetingId,
+                ...(input.meeting.meetingNo ? { meetingNo: input.meeting.meetingNo } : {}),
+                ...(input.meeting.topic ? { topic: input.meeting.topic } : {}),
+            },
+            listenerChatId,
+            ...(input.attentionTargetOpenId ? { attentionTargetOpenId: input.attentionTargetOpenId } : {}),
+            ...(input.consumerMode ? { consumerMode: input.consumerMode } : {}),
+            selectedAgents,
+            ...singularAliases,
+            ...(input.consumerClosePhase ? { consumerClosePhase: input.consumerClosePhase } : {}),
+            ...(input.consumerFinalizationDeadlineAt !== undefined
+                ? { consumerFinalizationDeadlineAt: input.consumerFinalizationDeadlineAt }
+                : {}),
+            ...(input.consumerCloseResolutionDeadlineAt !== undefined
+                ? { consumerCloseResolutionDeadlineAt: input.consumerCloseResolutionDeadlineAt }
+                : {}),
+            ...(input.textOutputPolicy ? { textOutputPolicy: input.textOutputPolicy } : {}),
+            ...(input.voiceOutputPolicy ? { voiceOutputPolicy: input.voiceOutputPolicy } : {}),
+            ...(input.syncIntervalMs !== undefined ? { syncIntervalMs: input.syncIntervalMs } : {}),
+            ...(input.consumerSelectionExpiresAt !== undefined ? { consumerSelectionExpiresAt: input.consumerSelectionExpiresAt } : {}),
+            ...(input.consumerCardMessageId ? { consumerCardMessageId: input.consumerCardMessageId } : {}),
+            ...(input.listenerPresenceStale === true ? { listenerPresenceStale: true } : {}),
+            ...(input.listenerPresenceChangedAtMs !== undefined
+                ? { listenerPresenceChangedAtMs: input.listenerPresenceChangedAtMs }
+                : {}),
+            ...(input.listenerPresenceGeneration !== undefined
+                ? { listenerPresenceGeneration: input.listenerPresenceGeneration }
+                : {}),
+            ...(input.listenerRejoinNonce ? { listenerRejoinNonce: input.listenerRejoinNonce } : {}),
+            ...(input.listenerRejoinCardMessageId
+                ? { listenerRejoinCardMessageId: input.listenerRejoinCardMessageId }
+                : {}),
+            ...(input.temporaryInstructionOpenIds !== undefined
+                ? { temporaryInstructionOpenIds: normalizeIdList(input.temporaryInstructionOpenIds) }
+                : {}),
+            ...(input.temporaryInstructionUnionIds !== undefined
+                ? { temporaryInstructionUnionIds: normalizeIdList(input.temporaryInstructionUnionIds) }
+                : {}),
+            createdAt: prior?.createdAt ?? now,
+            updatedAt: now,
+            expiresAt: now + DEFAULT_TTL_MS,
+        };
+        writeStore(dataDir, store);
+    });
 }
 export function removeVcMeetingRuntimeSession(dataDir, larkAppId, meetingId) {
-    const store = readStore(dataDir);
-    const key = sessionKey(larkAppId, meetingId);
-    if (!store[key])
-        return;
-    delete store[key];
-    writeStore(dataDir, store);
+    const fp = filePath(dataDir);
+    ensureLockParent(fp);
+    withFileLockSync(fp, () => {
+        const store = readStore(dataDir);
+        const key = sessionKey(larkAppId, meetingId);
+        if (!store[key])
+            return;
+        delete store[key];
+        writeStore(dataDir, store);
+    });
 }
 export function recordVcMeetingEndedTombstone(dataDir, input, now = Date.now(), ttlMs = DEFAULT_ENDED_TOMBSTONE_TTL_MS) {
     const larkAppId = input.larkAppId.trim();
     const meetingId = input.meetingId.trim();
     if (!larkAppId || !meetingId)
         return;
-    const store = readEndedTombstoneStore(dataDir);
-    const key = sessionKey(larkAppId, meetingId);
-    store[key] = {
-        larkAppId,
-        meetingId,
-        endedAt: now,
-        expiresAt: now + ttlMs,
-    };
-    for (const [itemKey, record] of Object.entries(store)) {
-        if (record.expiresAt <= now)
-            delete store[itemKey];
-    }
-    writeEndedTombstoneStore(dataDir, store);
+    const fp = endedTombstoneFilePath(dataDir);
+    ensureLockParent(fp);
+    withFileLockSync(fp, () => {
+        const store = readEndedTombstoneStore(dataDir);
+        const key = sessionKey(larkAppId, meetingId);
+        store[key] = {
+            larkAppId,
+            meetingId,
+            endedAt: now,
+            expiresAt: now + ttlMs,
+        };
+        for (const [itemKey, record] of Object.entries(store)) {
+            if (record.expiresAt <= now)
+                delete store[itemKey];
+        }
+        writeEndedTombstoneStore(dataDir, store);
+    });
 }
 export function hasVcMeetingEndedTombstone(dataDir, larkAppId, meetingId, now = Date.now()) {
     const normalizedLarkAppId = larkAppId.trim();
@@ -325,15 +802,27 @@ export function hasVcMeetingEndedTombstone(dataDir, larkAppId, meetingId, now =
     if (!normalizedLarkAppId || !normalizedMeetingId)
         return false;
     const key = sessionKey(normalizedLarkAppId, normalizedMeetingId);
-    const store = readEndedTombstoneStore(dataDir);
+    const store = readEndedTombstoneStoreForAccess(dataDir);
     const record = store[key];
     if (!record)
         return false;
-    if (record.expiresAt <= now) {
-        delete store[key];
-        writeEndedTombstoneStore(dataDir, store);
+    if (record.expiresAt > now)
+        return true;
+    // Expiry cleanup is a read-modify-write. Re-read under the shared file lock
+    // so we cannot delete a concurrently refreshed tombstone or overwrite a
+    // different daemon's newly appended meeting record.
+    const fp = endedTombstoneFilePath(dataDir);
+    ensureLockParent(fp);
+    return withFileLockSync(fp, () => {
+        const currentStore = readEndedTombstoneStore(dataDir);
+        const current = currentStore[key];
+        if (!current)
+            return false;
+        if (current.expiresAt > now)
+            return true;
+        delete currentStore[key];
+        writeEndedTombstoneStore(dataDir, currentStore);
         return false;
-    }
-    return true;
+    });
 }
 //# sourceMappingURL=vc-meeting-runtime-store.js.map