botmux 2.47.0 → 2.47.1

package/dist/core/command-handler.js

@@ -2,32 +2,32 @@
  * Command handler — processes /slash commands from users.
  * Extracted from daemon.ts for modularity.
  */
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve, basename } from 'node:path';
 import { config } from '../config.js';
 import { getBot, getAllBots, getBotOpenId } from '../bot-registry.js';
 import * as sessionStore from '../services/session-store.js';
 import * as scheduleStore from '../services/schedule-store.js';
-import * as taskStore from '../services/task-store.js';
 import * as scheduler from './scheduler.js';
-import { scanMultipleProjects } from '../services/project-scanner.js';
+import { scanMultipleProjects, describeProjectDir } from '../services/project-scanner.js';
 import { buildRepoSelectCard, buildAdoptSelectCard, buildSessionClosedCard, getCliDisplayName } from '../im/lark/card-builder.js';
 import { createCliAdapterSync } from '../adapters/cli/registry.js';
-import { deleteMessage, sendMessage, replyMessage, listChatBotMembers } from '../im/lark/client.js';
+import { deleteMessage, sendMessage, listChatBotMembers, resolveUserUnionId, getChatModeStrict } from '../im/lark/client.js';
+import { claimPairing } from '../services/pairing-store.js';
 import { logger } from '../utils/logger.js';
-import { killWorker, forkWorker, forkAdoptWorker, getCurrentCliVersion } from './worker-pool.js';
+import { killWorker, forkWorker, forkAdoptWorker, getCurrentCliVersion, postFreshStreamingCard, postPrivateSnapshotCard, resolvePrivateCardAudience } from './worker-pool.js';
 import { expandHome, getSessionWorkingDir, getProjectScanDirs, rememberLastCliInput } from './session-manager.js';
 import { validateWorkingDir } from './working-dir.js';
 import { discoverAdoptableSessions, validateAdoptTarget } from './session-discovery.js';
 import { generateAuthUrl, getTokenStatus } from '../utils/user-token.js';
 import { bindOncall, unbindOncall, getOncallStatus } from '../services/oncall-store.js';
 import { invalidWorkingDirs } from '../utils/working-dir.js';
-import { resolveRoleFile, writeRoleFile, deleteRoleFile } from './role-resolver.js';
-import { addFeishuTaskAssignee, completeFeishuTask, createFeishuTask, FeishuTaskUnavailableError } from '../services/feishu-task-client.js';
+import { writeRoleFile, deleteRoleFile, resolveRole, resolveTeamRoleFile, writeTeamRoleFile, deleteTeamRoleFile } from './role-resolver.js';
+import { getBotCapability, setBotCapability, clearBotCapability } from '../services/bot-profile-store.js';
 import { sessionKey, sessionAnchorId } from './types.js';
 import { t, localeForBot } from '../i18n/index.js';
 // ─── Exported constants ──────────────────────────────────────────────────────
-export const DAEMON_COMMANDS = new Set(['/close', '/restart', '/status', '/help', '/cd', '/repo', '/skip', '/schedule', '/task', '/role', '/login', '/adopt', '/oncall', '/group', '/g']);
+export const DAEMON_COMMANDS = new Set(['/close', '/restart', '/status', '/help', '/cd', '/repo', '/schedule', '/role', '/pair', '/login', '/adopt', '/oncall', '/group', '/g', '/relay', '/card']);
 /**
  * Slash commands that are forwarded verbatim to the underlying CLI (e.g.
  * Claude Code's `/compact`, `/model`, `/usage`). The daemon does NOT handle
@@ -47,6 +47,67 @@ const MULTILINE_COMMANDS = new Set(['/schedule', '/role']);
 // `validateWorkingDir` now lives in ./working-dir.js (leaf module the CLI can
 // import without the daemon graph); re-exported here for existing callers.
 export { validateWorkingDir };
+/**
+ * Resolve a non-numeric `/repo <arg>` into a concrete repo path + display name.
+ * `arg` is either a path (absolute or relative) or a first-level project name
+ * under one of the bot's scan dirs — letting the user skip the selection card.
+ *
+ * Resolution:
+ *   1. Build candidate absolute paths — absolute / `~` taken as-is; relative or
+ *      bare names resolved against each scan dir, then the daemon cwd (mirrors
+ *      how the card's project list is rooted).
+ *   2. Prefer a candidate matching a scanned git project (carries a branch label).
+ *   3. For a bare name, also match a scanned project by basename (covers projects
+ *      nested deeper than the scan-dir top level).
+ *   4. Fall back to any existing directory — lenient like `/cd`, whose trust model
+ *      is "owner explicitly chose a dir"; the CLI already runs with full FS access.
+ * Returns null when nothing resolves to an existing directory.
+ */
+export function resolveRepoSelection(repoArg, scanDirs) {
+    const existingScanDirs = scanDirs.filter((d) => existsSync(d));
+    const projects = existingScanDirs.length > 0 ? scanMultipleProjects(existingScanDirs) : [];
+    const isExplicitPath = repoArg.startsWith('/') ||
+        repoArg.startsWith('~') ||
+        repoArg.startsWith('.') ||
+        repoArg.includes('/');
+    const candidates = [];
+    if (repoArg.startsWith('/') || repoArg.startsWith('~')) {
+        candidates.push(resolve(expandHome(repoArg)));
+    }
+    else {
+        for (const d of scanDirs)
+            candidates.push(resolve(d, repoArg));
+        candidates.push(resolve(expandHome(repoArg))); // daemon-cwd fallback (matches /cd)
+    }
+    // 1) Exact scanned-project match — preferred, gives the "name (branch)" label.
+    for (const cand of candidates) {
+        const proj = projects.find((p) => resolve(p.path) === cand);
+        if (proj)
+            return { path: proj.path, displayName: `${proj.name} (${proj.branch})` };
+    }
+    // 2) Bare name → match a scanned project by basename.
+    if (!isExplicitPath) {
+        const byName = projects.find((p) => p.name === repoArg);
+        if (byName)
+            return { path: byName.path, displayName: `${byName.name} (${byName.branch})` };
+    }
+    // 3) Lenient fallback: any existing directory. Label it with a git ref when
+    //    it's a repo (covers explicit paths outside the scan roots), else basename.
+    for (const cand of candidates) {
+        try {
+            if (!statSync(cand).isDirectory())
+                continue;
+        }
+        catch {
+            continue; // missing / not a dir — try next candidate
+        }
+        const desc = describeProjectDir(cand);
+        return desc
+            ? { path: cand, displayName: `${desc.name} (${desc.branch})` }
+            : { path: cand, displayName: basename(cand) };
+    }
+    return null;
+}
 /**
  * Parse a force-topic invocation: `/t [prompt]` or `/topic [prompt]`.
  *
@@ -159,16 +220,69 @@ function invalidConfiguredWorkingDirs(ds, larkAppId) {
     });
 }
 // ─── Schedule command ────────────────────────────────────────────────────────
-async function handleRoleCommand(args, rootId, chatId, larkAppId, deps) {
+async function handleRoleCommand(args, rootId, chatId, larkAppId, senderId, deps) {
     const sessionReply = (rid, content, msgType) => deps.sessionReply(rid, content, msgType, larkAppId);
     const trimmed = args.trim();
     const loc = localeForBot(larkAppId);
-    // /role → show current role
+    const dataDir = config.session.dataDir;
+    // /role team [...] — manage the team-level (per-bot, cross-chat) role
+    const teamMatch = trimmed.match(/^team\b([\s\S]*)$/);
+    if (teamMatch) {
+        const teamArgs = teamMatch[1].trim();
+        const teamSet = teamArgs.match(/^set\s+([\s\S]+)/);
+        if (teamSet) {
+            const content = teamSet[1].trim();
+            if (!content) {
+                await sessionReply(rootId, t('role.set_empty', undefined, loc));
+                return;
+            }
+            writeTeamRoleFile(larkAppId, content);
+            await sessionReply(rootId, t('role.team_saved', { bytes: Buffer.byteLength(content, 'utf-8'), max: 4096 }, loc));
+            return;
+        }
+        if (teamArgs === 'delete' || teamArgs === '删除') {
+            await sessionReply(rootId, deleteTeamRoleFile(larkAppId) ? t('role.team_deleted', undefined, loc) : t('role.team_nothing', undefined, loc));
+            return;
+        }
+        const content = resolveTeamRoleFile(larkAppId);
+        if (content) {
+            await sessionReply(rootId, `${t('role.team_current', undefined, loc)}\n\`\`\`markdown\n${content}\n\`\`\`\n${t('role.byte_count', { bytes: Buffer.byteLength(content, 'utf-8'), max: 4096 }, loc)}`);
+        }
+        else {
+            await sessionReply(rootId, t('role.team_empty', undefined, loc));
+        }
+        return;
+    }
+    // /role cap [...] — manage the short capability label shown in the roster
+    const capMatch = trimmed.match(/^cap\b([\s\S]*)$/);
+    if (capMatch) {
+        const capArgs = capMatch[1].trim();
+        const capSet = capArgs.match(/^set\s+([\s\S]+)/);
+        if (capSet) {
+            const label = capSet[1].trim();
+            if (!label) {
+                await sessionReply(rootId, t('role.cap_set_empty', undefined, loc));
+                return;
+            }
+            setBotCapability(dataDir, larkAppId, label, senderId);
+            await sessionReply(rootId, t('role.cap_saved', { cap: getBotCapability(dataDir, larkAppId) ?? label }, loc));
+            return;
+        }
+        if (capArgs === 'clear' || capArgs === '清除') {
+            await sessionReply(rootId, clearBotCapability(dataDir, larkAppId) ? t('role.cap_cleared', undefined, loc) : t('role.cap_empty', undefined, loc));
+            return;
+        }
+        const cap = getBotCapability(dataDir, larkAppId);
+        await sessionReply(rootId, cap ? t('role.cap_current', { cap }, loc) : t('role.cap_empty', undefined, loc));
+        return;
+    }
+    // /role → show the EFFECTIVE role + where it comes from (chat override > team > none)
     if (!trimmed) {
-        const content = resolveRoleFile(larkAppId, chatId);
+        const { content, source } = resolveRole(larkAppId, chatId);
         if (content) {
             const len = Buffer.byteLength(content, 'utf-8');
-            await sessionReply(rootId, `${t('role.current', undefined, loc)}\n\`\`\`markdown\n${content}\n\`\`\`\n${t('role.byte_count', { bytes: len, max: 4096 }, loc)}`);
+            const srcLabel = source === 'chat' ? t('role.src_chat', undefined, loc) : t('role.src_team', undefined, loc);
+            await sessionReply(rootId, `${t('role.current', undefined, loc)} ${srcLabel}\n\`\`\`markdown\n${content}\n\`\`\`\n${t('role.byte_count', { bytes: len, max: 4096 }, loc)}`);
         }
         else {
             await sessionReply(rootId, t('role.empty', undefined, loc));
@@ -311,237 +425,6 @@ async function handleScheduleCommand(args, rootId, chatId, deps, larkAppId) {
     // Unrecognized format
     await sessionReply(rootId, t('schedule.parse_failed', undefined, loc));
 }
-function taskUsage() {
-    return [
-        '用法:',
-        '/task new <name> - 登记当前 thread/chat 的任务（需要已有 session）',
-        '/task list - 列出当前群的任务',
-        '/task status <task-id> - 查看任务状态',
-        '/task close <task-id> - 关闭任务登记（不关闭 session）',
-        '/task assign <task-id> @Bot - 指派任务并显式 @目标 bot',
-    ].join('\n');
-}
-function formatTaskStatus(task) {
-    return [
-        `Task: ${task.taskId}`,
-        `Feishu Task: ${task.externalTaskId ?? '-'}`,
-        `Name: ${task.name}`,
-        `Status: ${task.status}`,
-        `Session: ${task.sessionId}`,
-        `Chat: ${task.chatId}`,
-        `Anchor: ${task.anchor}`,
-        `Bot app: ${task.larkAppId}`,
-        `Owner: ${task.ownerOpenId ? `<at id=${task.ownerOpenId}></at>` : '-'}`,
-        `Assignee: ${task.assigneeOpenId ? `<at id=${task.assigneeOpenId}></at>` : '-'}`,
-        task.externalSyncError ? `Feishu sync: ${task.externalSyncError}` : undefined,
-        `Created: ${task.createdAt}`,
-        `Updated: ${task.updatedAt}`,
-    ].filter(Boolean).join('\n');
-}
-function buildTaskHandoffPost(task, assigneeOpenId) {
-    const content = [
-        [
-            { tag: 'at', user_id: assigneeOpenId },
-            { tag: 'text', text: ` 请接手任务 ${task.taskId}：${task.name}` },
-        ],
-        [{ tag: 'text', text: `Task: ${task.taskId}` }],
-        [{ tag: 'text', text: `Feishu Task: ${task.externalTaskId ?? '-'}` }],
-        [{ tag: 'text', text: `Session: ${task.sessionId}` }],
-        [{ tag: 'text', text: `Chat: ${task.chatId}` }],
-        [{ tag: 'text', text: `Thread/anchor: ${task.anchor}` }],
-        task.ownerOpenId
-            ? [{ tag: 'text', text: 'Owner: ' }, { tag: 'at', user_id: task.ownerOpenId }]
-            : [{ tag: 'text', text: 'Owner: -' }],
-        [{ tag: 'text', text: '请基于这个 task id 和对应 thread/session 上下文继续处理；这是显式 @ 指派，不依赖 lastCaller footer。' }],
-    ];
-    return JSON.stringify({ zh_cn: { title: '', content } });
-}
-function taskSyncError(err) {
-    if (err instanceof FeishuTaskUnavailableError)
-        return err.message;
-    return err instanceof Error ? err.message : String(err);
-}
-async function tryCreateExternalTask(task) {
-    try {
-        const external = await createFeishuTask({
-            larkAppId: task.larkAppId,
-            summary: task.name,
-            localTaskId: task.taskId,
-            sessionId: task.sessionId,
-            chatId: task.chatId,
-            anchor: task.anchor,
-            ownerOpenId: task.ownerOpenId,
-        });
-        return taskStore.updateTaskFields(task.taskId, {
-            externalTaskId: external.guid,
-            externalTaskUrl: external.url,
-            externalSyncError: undefined,
-        }) ?? task;
-    }
-    catch (err) {
-        const message = taskSyncError(err);
-        logger.warn(`[task] Feishu task create failed for ${task.taskId}: ${message}`);
-        return taskStore.updateTaskFields(task.taskId, { externalSyncError: message }) ?? task;
-    }
-}
-async function tryCompleteExternalTask(task) {
-    if (!task.externalTaskId)
-        return task;
-    try {
-        await completeFeishuTask(task.larkAppId, task.externalTaskId);
-        return taskStore.updateTaskFields(task.taskId, { externalSyncError: undefined }) ?? task;
-    }
-    catch (err) {
-        const message = taskSyncError(err);
-        logger.warn(`[task] Feishu task complete failed for ${task.taskId}: ${message}`);
-        return taskStore.updateTaskFields(task.taskId, { externalSyncError: message }) ?? task;
-    }
-}
-async function tryAssignExternalTask(task, assigneeOpenId) {
-    if (!task.externalTaskId)
-        return task;
-    try {
-        await addFeishuTaskAssignee(task.larkAppId, task.externalTaskId, assigneeOpenId);
-        return taskStore.updateTaskFields(task.taskId, { externalSyncError: undefined }) ?? task;
-    }
-    catch (err) {
-        const message = taskSyncError(err);
-        logger.warn(`[task] Feishu task assign failed for ${task.taskId}: ${message}`);
-        return taskStore.updateTaskFields(task.taskId, { externalSyncError: message }) ?? task;
-    }
-}
-function mentionedOpenIds(message) {
-    return (message.mentions ?? [])
-        .map(m => m.openId)
-        .filter((id) => !!id);
-}
-function isCurrentBotMention(openId, larkAppId) {
-    if (!larkAppId)
-        return false;
-    const self = getBotOpenId(larkAppId);
-    return !!self && self === openId;
-}
-async function handleTaskCommand(args, rootId, message, deps, larkAppId) {
-    const { activeSessions } = deps;
-    const sessionReply = (rid, content, msgType) => deps.sessionReply(rid, content, msgType, larkAppId);
-    const rawDs = larkAppId ? activeSessions.get(sessionKey(rootId, larkAppId)) : undefined;
-    const isEphemeralTaskCommandSession = !!rawDs && !rawDs.hasHistory && !rawDs.worker && rawDs.session.title.trim().startsWith('/task');
-    const commandChatId = rawDs?.chatId;
-    if (isEphemeralTaskCommandSession && larkAppId) {
-        activeSessions.delete(sessionKey(rootId, larkAppId));
-        sessionStore.closeSession(rawDs.session.sessionId);
-    }
-    const ds = isEphemeralTaskCommandSession ? undefined : rawDs;
-    const [subRaw, ...rest] = args.trim().split(/\s+/).filter(Boolean);
-    const sub = subRaw?.toLowerCase();
-    if (!sub || sub === 'help' || sub === '帮助') {
-        await sessionReply(rootId, taskUsage());
-        return;
-    }
-    if (sub === 'new' || sub === '新建') {
-        const name = rest.join(' ').trim();
-        if (!name) {
-            await sessionReply(rootId, '请提供任务名称：/task new <name>');
-            return;
-        }
-        if (!ds) {
-            await sessionReply(rootId, '当前没有可绑定的 session。请先在独立话题里 @Bot 发起任务，或用 /t <任务内容> 开一个独立任务。');
-            return;
-        }
-        let task = taskStore.createTask({
-            name,
-            chatId: ds.chatId,
-            anchor: sessionAnchorId(ds),
-            sessionId: ds.session.sessionId,
-            larkAppId: ds.larkAppId,
-            ownerOpenId: message.senderId || ds.ownerOpenId || ds.session.ownerOpenId,
-        });
-        task = await tryCreateExternalTask(task);
-        const externalLine = task.externalTaskId
-            ? `Feishu Task: ${task.externalTaskId}`
-            : `Feishu Task: 未创建（${task.externalSyncError ?? 'unknown'}），已降级为本地 task`;
-        await sessionReply(rootId, `✅ 已登记任务 ${task.taskId}\n${externalLine}\nName: ${task.name}\nSession: ${task.sessionId}\nAnchor: ${task.anchor}`);
-        return;
-    }
-    if (sub === 'list' || sub === '列表') {
-        const chatId = ds?.chatId ?? commandChatId ?? (() => {
-            const all = taskStore.listTasks();
-            return all.find(t => t.anchor === rootId && t.larkAppId === larkAppId)?.chatId ?? all.find(t => t.anchor === rootId)?.chatId ?? rootId;
-        })();
-        const tasks = taskStore.listTasks({ chatId });
-        if (tasks.length === 0) {
-            await sessionReply(rootId, '当前群还没有登记 task。');
-            return;
-        }
-        const lines = tasks.map(t => `${t.taskId} [${t.status}] ${t.name}\n  feishu=${t.externalTaskId ?? '-'} session=${t.sessionId} anchor=${t.anchor} assignee=${t.assigneeOpenId ? `<at id=${t.assigneeOpenId}></at>` : '-'}`);
-        await sessionReply(rootId, `当前群任务：\n${lines.join('\n')}`);
-        return;
-    }
-    if (sub === 'status' || sub === '状态') {
-        const id = rest[0];
-        if (!id) {
-            await sessionReply(rootId, '请提供 task id：/task status <task-id>');
-            return;
-        }
-        const task = taskStore.getTask(id);
-        if (!task) {
-            await sessionReply(rootId, `未找到 task：${id}`);
-            return;
-        }
-        await sessionReply(rootId, formatTaskStatus(task));
-        return;
-    }
-    if (sub === 'close' || sub === '关闭') {
-        const id = rest[0];
-        if (!id) {
-            await sessionReply(rootId, '请提供 task id：/task close <task-id>');
-            return;
-        }
-        let task = taskStore.closeTask(id);
-        if (!task) {
-            await sessionReply(rootId, `未找到 task：${id}`);
-            return;
-        }
-        task = await tryCompleteExternalTask(task);
-        const syncLine = task.externalTaskId
-            ? (task.externalSyncError ? `\nFeishu Task 同步失败：${task.externalSyncError}` : '\nFeishu Task 已标记完成。')
-            : '';
-        await sessionReply(rootId, `✅ 已关闭任务 ${task.taskId}${syncLine}\n注意：关联 session 未关闭，如需关闭请在对应话题里使用 /close。`);
-        return;
-    }
-    if (sub === 'assign' || sub === '指派') {
-        const id = rest[0];
-        if (!id) {
-            await sessionReply(rootId, '请提供 task id：/task assign <task-id> @Bot');
-            return;
-        }
-        const candidates = mentionedOpenIds(message).filter(openId => !isCurrentBotMention(openId, larkAppId));
-        const assigneeOpenId = candidates[0];
-        if (!assigneeOpenId) {
-            await sessionReply(rootId, '请在 /task assign 命令里显式 @目标 Bot。');
-            return;
-        }
-        let task = taskStore.assignTask(id, assigneeOpenId);
-        if (!task) {
-            await sessionReply(rootId, `未找到 task：${id}`);
-            return;
-        }
-        task = await tryAssignExternalTask(task, assigneeOpenId);
-        const handoff = buildTaskHandoffPost(task, assigneeOpenId);
-        if (!larkAppId) {
-            await sessionReply(rootId, formatTaskStatus(task));
-            return;
-        }
-        if (ds?.scope === 'chat' || task.anchor.startsWith('oc_')) {
-            await sendMessage(larkAppId, task.chatId, handoff, 'post');
-        }
-        else {
-            await replyMessage(larkAppId, task.anchor, handoff, 'post', true);
-        }
-        return;
-    }
-    await sessionReply(rootId, taskUsage());
-}
 // ─── Main command handler ────────────────────────────────────────────────────
 export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
     const { activeSessions, getActiveCount, lastRepoScan } = deps;
@@ -630,38 +513,50 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
             }
             case '/repo': {
                 const repoArg = message.content.replace(/^\/repo\s*/, '').trim();
-                const repoIndex = repoArg ? parseInt(repoArg, 10) : NaN;
-                if (!isNaN(repoIndex) && ds) {
-                    const cached = lastRepoScan.get(ds.chatId);
-                    if (!cached || cached.length === 0) {
-                        await sessionReply(rootId, t('cmd.repo.no_prior_scan', undefined, loc));
-                        break;
+                // First-spawn fork: consume the buffered prompt/attachments and start the
+                // CLI in whatever workingDir is currently set on the session. Shared by
+                // `commitRepoSelection` (a repo was named) and the bare-`/repo` launch
+                // (use the default workingDir) — both only run while `pendingRepo`.
+                const forkPendingCli = async (replyText) => {
+                    const selfBot = getBot(ds.larkAppId);
+                    const botCfg = selfBot.config;
+                    ds.pendingRepo = false;
+                    const pendingPrompt = ds.pendingPrompt ?? '';
+                    // Was there an actual buffered user message to deliver? A session
+                    // launched *via* `/repo` (the command itself is the first message) has
+                    // none — so boot the CLI idle and let the user's NEXT message be the
+                    // first prompt, instead of submitting an empty/boilerplate user_message.
+                    const hasBufferedInput = pendingPrompt.trim().length > 0 ||
+                        (ds.pendingAttachments?.length ?? 0) > 0 ||
+                        (ds.pendingFollowUps?.length ?? 0) > 0;
+                    if (hasBufferedInput) {
+                        const { buildNewTopicPrompt, getAvailableBots } = await import('./session-manager.js');
+                        const prompt = buildNewTopicPrompt(pendingPrompt, ds.session.sessionId, botCfg.cliId, botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, { larkAppId, chatId: ds.chatId });
+                        rememberLastCliInput(ds, pendingPrompt, prompt);
+                        forkWorker(ds, prompt);
                     }
-                    if (repoIndex < 1 || repoIndex > cached.length) {
-                        await sessionReply(rootId, t('cmd.repo.index_out_of_range', { max: cached.length }, loc));
-                        break;
+                    else {
+                        // Empty initial prompt → worker spawns the CLI without submitting
+                        // anything (see worker.ts: the init prompt is only queued when truthy).
+                        forkWorker(ds, '', false);
                     }
-                    const project = cached[repoIndex - 1];
-                    const selectedPath = project.path;
-                    const displayName = `${project.name} (${project.branch})`;
+                    ds.pendingPrompt = undefined;
+                    ds.pendingAttachments = undefined;
+                    ds.pendingMentions = undefined;
+                    ds.pendingSender = undefined;
+                    ds.pendingFollowUps = undefined;
+                    await sessionReply(rootId, replyText);
+                };
+                // Shared commit path for an already-resolved repo: update the session's
+                // working dir, then either fork into the pending CLI (first spawn) or
+                // close + recreate the session (mid-session switch). Used by both the
+                // numeric `/repo <N>` form and the `/repo <path|name>` form.
+                const commitRepoSelection = async (selectedPath, displayName, how) => {
                     ds.workingDir = selectedPath;
                     ds.session.workingDir = selectedPath;
                     sessionStore.updateSession(ds.session);
                     if (ds.pendingRepo) {
-                        const selfBot = getBot(ds.larkAppId);
-                        const botCfg = selfBot.config;
-                        ds.pendingRepo = false;
-                        const { buildNewTopicPrompt, getAvailableBots } = await import('./session-manager.js');
-                        const pendingPrompt = ds.pendingPrompt ?? '';
-                        const prompt = buildNewTopicPrompt(pendingPrompt, ds.session.sessionId, botCfg.cliId, botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, { larkAppId, chatId: ds.chatId });
-                        rememberLastCliInput(ds, pendingPrompt, prompt);
-                        ds.pendingPrompt = undefined;
-                        ds.pendingAttachments = undefined;
-                        ds.pendingMentions = undefined;
-                        ds.pendingSender = undefined;
-                        ds.pendingFollowUps = undefined;
-                        forkWorker(ds, prompt);
-                        await sessionReply(rootId, t('cmd.repo.selected_in_pending', { name: displayName }, loc));
+                        await forkPendingCli(t('cmd.repo.selected_in_pending', { name: displayName }, loc));
                     }
                     else {
                         killWorker(ds);
@@ -681,7 +576,56 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         deleteMessage(ds.larkAppId, ds.repoCardMessageId);
                         ds.repoCardMessageId = undefined;
                     }
-                    logger.info(`[${logTag}] Repo selected via /repo ${repoIndex}: ${selectedPath}`);
+                    logger.info(`[${logTag}] Repo selected via ${how}: ${selectedPath}`);
+                };
+                // Numeric arg → pick by 1-based index from the last scan.
+                if (repoArg && ds && /^\d+$/.test(repoArg)) {
+                    const repoIndex = parseInt(repoArg, 10);
+                    const cached = lastRepoScan.get(ds.chatId);
+                    if (!cached || cached.length === 0) {
+                        await sessionReply(rootId, t('cmd.repo.no_prior_scan', undefined, loc));
+                        break;
+                    }
+                    if (repoIndex < 1 || repoIndex > cached.length) {
+                        await sessionReply(rootId, t('cmd.repo.index_out_of_range', { max: cached.length }, loc));
+                        break;
+                    }
+                    const project = cached[repoIndex - 1];
+                    await commitRepoSelection(project.path, `${project.name} (${project.branch})`, `/repo ${repoIndex}`);
+                    break;
+                }
+                // Non-numeric arg → a path (relative/absolute) or first-level project
+                // name under workingDir; resolve it directly and skip the card.
+                if (repoArg && ds) {
+                    const resolved = resolveRepoSelection(repoArg, getProjectScanDirs(ds));
+                    if (!resolved) {
+                        await sessionReply(rootId, t('cmd.repo.path_not_found', { arg: repoArg }, loc));
+                        break;
+                    }
+                    await commitRepoSelection(resolved.path, resolved.displayName, `/repo ${repoArg}`);
+                    break;
+                }
+                // Bare `/repo` while a repo card is pending → launch right away in the
+                // default workingDir. This is the text-command twin of the card's
+                // "start directly" button (and replaces the old `/skip` command).
+                // Mid-session bare `/repo` (no pending) still falls through to the card.
+                if (!repoArg && ds?.pendingRepo) {
+                    // Validate the configured workingDir before spawning — `forkWorker`
+                    // doesn't, so a dead cwd would otherwise spawn-and-fail silently. Same
+                    // guard the card path runs below. On failure we keep the pending state
+                    // so the user can recover with `/repo <valid-path>` (no card here).
+                    const invalidDirs = invalidConfiguredWorkingDirs(ds, ds.larkAppId ?? larkAppId);
+                    if (invalidDirs.length > 0) {
+                        await sessionReply(rootId, t('cmd.repo.working_dir_not_exist', { dirs: invalidDirs.map(d => `\`${d}\``).join(', ') }, loc));
+                        break;
+                    }
+                    const cwd = getSessionWorkingDir(ds);
+                    await forkPendingCli(t('cmd.skip.opened', { cwd }, loc));
+                    if (ds.repoCardMessageId) {
+                        deleteMessage(ds.larkAppId, ds.repoCardMessageId);
+                        ds.repoCardMessageId = undefined;
+                    }
+                    logger.info(`[${logTag}] Bare /repo while pending → launch in workingDir ${cwd}`);
                     break;
                 }
                 if (ds?.worker && !ds.worker.killed) {
@@ -713,34 +657,6 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 logger.info(`[${logTag}] Sent repo card with ${projects.length} project(s)`);
                 break;
             }
-            case '/skip': {
-                if (ds?.pendingRepo) {
-                    const selfBot = getBot(ds.larkAppId);
-                    const botCfg = selfBot.config;
-                    ds.pendingRepo = false;
-                    const { buildNewTopicPrompt, getAvailableBots } = await import('./session-manager.js');
-                    const pendingPrompt = ds.pendingPrompt ?? '';
-                    const prompt = buildNewTopicPrompt(pendingPrompt, ds.session.sessionId, botCfg.cliId, botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, { larkAppId, chatId: ds.chatId });
-                    rememberLastCliInput(ds, pendingPrompt, prompt);
-                    ds.pendingPrompt = undefined;
-                    ds.pendingAttachments = undefined;
-                    ds.pendingMentions = undefined;
-                    ds.pendingSender = undefined;
-                    ds.pendingFollowUps = undefined;
-                    forkWorker(ds, prompt);
-                    const cwd = getSessionWorkingDir(ds);
-                    await sessionReply(rootId, t('cmd.skip.opened', { cwd }, loc));
-                    if (ds.repoCardMessageId) {
-                        deleteMessage(ds.larkAppId, ds.repoCardMessageId);
-                        ds.repoCardMessageId = undefined;
-                    }
-                    logger.info(`[${logTag}] Skip repo via /skip, spawning CLI in ${cwd}`);
-                }
-                else {
-                    await sessionReply(rootId, t('cmd.skip.no_pending', undefined, loc));
-                }
-                break;
-            }
             case '/status': {
                 if (ds) {
                     const alive = ds.worker && !ds.worker.killed;
@@ -775,12 +691,6 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 logger.info(`[${logTag}] Schedule command handled`);
                 break;
             }
-            case '/task': {
-                const taskArgs = message.content.replace(/^\/task\s*/i, '');
-                await handleTaskCommand(taskArgs, rootId, message, deps, larkAppId);
-                logger.info(`[${logTag}] Task command handled`);
-                break;
-            }
             case '/role': {
                 const chatId = ds?.chatId;
                 if (!chatId || !larkAppId) {
@@ -788,10 +698,35 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     break;
                 }
                 const roleArgs = message.content.replace(/^\/role\s*/, '');
-                await handleRoleCommand(roleArgs, rootId, chatId, larkAppId, deps);
+                await handleRoleCommand(roleArgs, rootId, chatId, larkAppId, message.senderId, deps);
                 logger.info(`[${logTag}] Role command handled`);
                 break;
             }
+            case '/pair': {
+                const code = message.content.replace(/^\/pair\s*/, '').trim();
+                if (!larkAppId) {
+                    await sessionReply(rootId, t('role.no_chat', undefined, loc));
+                    break;
+                }
+                if (!code) {
+                    await sessionReply(rootId, t('pair.usage', undefined, loc));
+                    break;
+                }
+                // Resolve the sender's canonical union_id (best-effort) so the web
+                // session is keyed stably across apps; degrade to open_id-only.
+                const who = await resolveUserUnionId(larkAppId, message.senderId);
+                const result = claimPairing(config.session.dataDir, code, { openId: message.senderId, unionId: who.unionId, name: who.name, larkAppId });
+                if (result.ok)
+                    await sessionReply(rootId, t('pair.ok', undefined, loc));
+                else if (result.reason === 'expired')
+                    await sessionReply(rootId, t('pair.expired', undefined, loc));
+                else if (result.reason === 'already_claimed')
+                    await sessionReply(rootId, t('pair.already', undefined, loc));
+                else
+                    await sessionReply(rootId, t('pair.not_found', undefined, loc));
+                logger.info(`[${logTag}] Pair command handled: ${result.ok ? 'ok' : result.reason}`);
+                break;
+            }
             case '/login': {
                 const subCmd = message.content.replace(/^\/login\s*/, '').trim();
                 if (subCmd === 'status' || subCmd === '状态') {
@@ -1056,7 +991,10 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         transferOwnerTo: senderOpenId,
                         notifyOwnerOpenId: senderOpenId,
                     });
-                    const link = `https://applink.feishu.cn/client/chat/open?openChatId=${encodeURIComponent(result.chatId)}`;
+                    // Prefer the shareable join link (others can click to *join*); fall
+                    // back to the member-only applink URL when Lark's link API failed.
+                    const applink = `https://applink.feishu.cn/client/chat/open?openChatId=${encodeURIComponent(result.chatId)}`;
+                    const link = result.shareLink ?? applink;
                     // Partial failures are non-fatal — the chat exists; surface them as
                     // hints so the user knows whether to expect to be auto-invited.
                     const hints = [];
@@ -1066,6 +1004,12 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     else if (result.transferError) {
                         hints.push(t('cmd.group.warn_transfer_failed', { reason: result.transferError }, loc));
                     }
+                    // Share-link fetch failed → the displayed link is the member-only
+                    // applink; warn the user so they don't expect non-members to join via it.
+                    if (!result.shareLink && result.shareLinkError) {
+                        logger.warn(`[${logTag}] /group share-link unavailable, using applink: ${result.shareLinkError}`);
+                        hints.push(t('cmd.group.warn_share_link_failed', undefined, loc));
+                    }
                     // List every bot in the new group (creator included), and warn about
                     // any Feishu rejected. Names come from the chat roster (members) since
                     // getBot() only knows this process's own bot in the one-daemon-per-bot
@@ -1092,6 +1036,527 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 }
                 break;
             }
+            /**
+             * `/relay --create <群名> @bot [@bot...]` — create a new chat, invite
+             * the @-mentioned bots, then migrate every bot's session in this
+             * thread (including the leader's) into the new chat.
+             *
+             * Two-path command:
+             *   • `--create` (PR2) — implemented below; creates a new chat.
+             *   • no flag (PR3)    — picker card listing user's relayable sessions
+             *                         in OTHER chats so the user can pull one into
+             *                         the current chat. Stubbed for now.
+             *
+             * Leader election is `mentions[0]` (identical to /group). The leader
+             * is the only daemon that:
+             *   1. Creates the new chat (createGroupWithBots)
+             *   2. Sends the M1 announcement message (its message_id becomes the
+             *      shared rootMessageId for all relayed sessions — multi-bot
+             *      sessions co-anchor on the same root via different larkAppIds)
+             *   3. Transfers its own session (if any) via local transferSession()
+             *   4. POSTs /api/sessions/migrate-to-chat to every peer daemon to
+             *      ask them to transfer their own session at the same anchor
+             *   5. Aggregates results into a single reply in the source thread
+             *
+             * Owner-only: only the source session's `ownerOpenId` may invoke. Peers
+             * enforce the same check independently inside the migrate endpoint.
+             *
+             * Failure mode: best-effort, no rollback. Peers that timeout / fail /
+             * are offline simply appear in the report as "skipped". The new chat
+             * and any successful transfers stand.
+             */
+            case '/relay': {
+                const argsLine = message.content.replace(/^\/relay\s*/i, '').trim();
+                if (!/^--create\b/i.test(argsLine)) {
+                    // ── Pull picker ───────────────────────────────────────────────────
+                    // /relay (no flag) lives in the *target* chat — list the operator's
+                    // own active sessions in OTHER chats so they can pull one in.
+                    //
+                    // Filter:
+                    //   • same bot (this larkAppId)
+                    //   • session is active (has a worker / appears in activeSessions)
+                    //   • session NOT in the current chat (can't relay to yourself)
+                    //   • operator IS the session owner (owner-only access)
+                    //
+                    // The button's `target_chat_id` / `target_root_id` are the chat we're
+                    // pulling INTO (the chat hosting this command). card-handler uses
+                    // them to invoke transferSession after sending the M1 announcement.
+                    const operatorOpenId = message.senderId;
+                    if (!operatorOpenId) {
+                        await sessionReply(rootId, t('cmd.relay.no_sender', undefined, loc));
+                        break;
+                    }
+                    const myAppId = larkAppId ?? ds?.larkAppId;
+                    if (!myAppId) {
+                        await sessionReply(rootId, t('cmd.group.no_bot', undefined, loc));
+                        break;
+                    }
+                    const targetChatId = ds?.chatId;
+                    if (!targetChatId) {
+                        await sessionReply(rootId, t('cmd.relay.no_session', undefined, loc));
+                        break;
+                    }
+                    // ── Chat-type guard ───────────────────────────────────────────────
+                    // Picker mode only makes sense in regular group chats. p2p (1:1 with
+                    // bot) has no relay concept — there's no other participant to
+                    // collaborate with — and topic chats route per-thread, so a chat-
+                    // scope session pulled in would have no thread anchor.
+                    //
+                    // p2p is detectable from `ds.chatType` locally (cheap). Topic vs
+                    // regular group is NOT captured in chatType — both record 'group'
+                    // — so we hit the Lark API (getChatNameAndMode) to resolve the
+                    // mode. One API call per /relay invocation; picker is user-
+                    // triggered so latency is acceptable.
+                    if (ds?.chatType === 'p2p') {
+                        await sessionReply(rootId, t('cmd.relay.picker_p2p_unsupported', undefined, loc));
+                        break;
+                    }
+                    {
+                        const { getChatNameAndMode } = await import('../im/lark/client.js');
+                        const info = await getChatNameAndMode(myAppId, targetChatId).catch(() => null);
+                        if (info?.mode === 'p2p') {
+                            await sessionReply(rootId, t('cmd.relay.picker_p2p_unsupported', undefined, loc));
+                            break;
+                        }
+                        if (info?.mode === 'topic') {
+                            await sessionReply(rootId, t('cmd.relay.picker_topic_unsupported', undefined, loc));
+                            break;
+                        }
+                    }
+                    // ── Existing-session guard ────────────────────────────────────────
+                    // If this bot already runs a real session in the target chat, pulling
+                    // another session in would collide on sessionKey(targetChatId, larkAppId)
+                    // — Map.set would silently overwrite, orphaning the existing worker.
+                    // Refuse upfront with an actionable message.
+                    //
+                    // Scratch sessions (the placeholder a `/relay` typed in a fresh chat
+                    // gets routed through) are filtered by `!!c.worker` — they have no
+                    // worker process. We do NOT exclude `ds` by sessionId: when `/relay`
+                    // rides an EXISTING real session (daemon.ts:2034's "existing-session
+                    // DAEMON_COMMANDS" path skips the scratch and binds `ds` to the
+                    // chat's real session), `ds` itself IS the conflict — excluding it
+                    // would let the picker render and the user pick a remote session
+                    // that the eventual transferSession would have to refuse anyway.
+                    const conflict = [...activeSessions.values()].find(c => c.larkAppId === myAppId
+                        && c.chatId === targetChatId
+                        // chat-scope only: thread-scope sessions (e.g. a `/t` force-topic
+                        // session in a regular group) live at a different sessionKey
+                        // anchor (rootMessageId), so they don't collide on transfer.
+                        // transferSession's own pre-flight (worker-pool.ts) and card-
+                        // handler's confirm both filter the same way; align here so the
+                        // picker doesn't false-positive a thread-scope live session.
+                        && c.scope === 'chat'
+                        && !!c.worker // real running session, not a placeholder
+                    );
+                    if (conflict) {
+                        await sessionReply(rootId, t('cmd.relay.target_has_session', { title: conflict.session.title || conflict.session.sessionId.substring(0, 8) }, loc));
+                        break;
+                    }
+                    // Shared candidate-collection logic — used here at initial render
+                    // and again in card-handler when the user clicks a card to switch
+                    // selection (the card re-render needs the same filtered list).
+                    // Filters out: other bots / current chat / non-owned / adopt
+                    // sessions. Resolves friendly chat names + modes in parallel.
+                    const { collectRelayPickerEntries } = await import('../services/relay-picker.js');
+                    const entries = await collectRelayPickerEntries(activeSessions, myAppId, targetChatId, operatorOpenId);
+                    const { buildRelayPickerCard } = await import('../im/lark/card-builder.js');
+                    const card = buildRelayPickerCard(entries, targetChatId, rootId, operatorOpenId, loc);
+                    await sessionReply(rootId, card, 'interactive');
+                    break;
+                }
+                const afterFlag = argsLine.replace(/^--create\s*/i, '').trim();
+                const creatorAppId = larkAppId ?? ds?.larkAppId;
+                if (!creatorAppId) {
+                    await sessionReply(rootId, t('cmd.group.no_bot', undefined, loc));
+                    break;
+                }
+                const senderOpenId = message.senderId;
+                // Cross-app stable identity — peer daemons can't compare against
+                // leader's open_id directly because the same user has a different
+                // open_id in each bot's namespace. union_id is shared per tenant.
+                // We pass it through the migrate-to-chat HTTP body; peers compare
+                // against their session's `ownerUnionId` (with fallback to
+                // open_id for sessions persisted before this field existed).
+                const senderUnionId = message.senderUnionId;
+                if (!senderOpenId) {
+                    await sessionReply(rootId, t('cmd.relay.no_sender', undefined, loc));
+                    break;
+                }
+                // `--create` must be invoked inside an existing thread — the source
+                // anchor for peer transfers comes from `ds`. (Picker mode in PR3 is
+                // allowed without a session.)
+                if (!ds) {
+                    await sessionReply(rootId, t('cmd.relay.no_session', undefined, loc));
+                    break;
+                }
+                // Front-loaded guards — transferSession refuses adoptedFrom /
+                // pendingRepo too, but only after createGroupWithBots has already
+                // built a new chat. Failing here keeps relay clean and avoids
+                // orphan-chat garbage when the operation can't possibly succeed.
+                if (ds.session.adoptedFrom) {
+                    await sessionReply(rootId, t('cmd.relay.adopt_not_relayable', undefined, loc));
+                    break;
+                }
+                if (ds.pendingRepo) {
+                    await sessionReply(rootId, t('cmd.relay.not_started_yet', undefined, loc));
+                    break;
+                }
+                // ── Mention parsing & leader election (mirror of /group) ───────────
+                const mentions = message.mentions ?? [];
+                const knownBotNames = globalKnownBotNames();
+                if (knownBotNames.size === 0 && mentions.some(m => !!m.name)) {
+                    logger.warn(`[${logTag}] /relay --create: global bot registry empty; cannot elect a creator`);
+                    await sessionReply(rootId, t('cmd.relay.resolve_failed', undefined, loc));
+                    break;
+                }
+                const botMentions = mentions.filter(m => m.name && knownBotNames.has(m.name.toLowerCase()));
+                if (botMentions.length === 0) {
+                    await sessionReply(rootId, t('cmd.relay.no_mentions', undefined, loc));
+                    break;
+                }
+                // Am I `mentions[0]`?
+                const firstBot = botMentions[0];
+                const myOpenId = getBotOpenId(creatorAppId);
+                const myName = getBot(creatorAppId).botName?.toLowerCase();
+                const myNameAmbiguous = !!myName
+                    && botMentions.filter(m => m.name?.toLowerCase() === myName).length > 1;
+                const iAmFirstBot = (!!myOpenId && firstBot.openId === myOpenId) ||
+                    (!myOpenId && !!myName && !myNameAmbiguous && firstBot.name?.toLowerCase() === myName);
+                if (!iAmFirstBot) {
+                    logger.info(`[${logTag}] /relay --create: not the first @-mentioned bot, staying silent`);
+                    break;
+                }
+                // Owner-only — only the source session owner may relay this session.
+                if (ds.session.ownerOpenId && ds.session.ownerOpenId !== senderOpenId) {
+                    await sessionReply(rootId, t('cmd.relay.not_owner', undefined, loc));
+                    break;
+                }
+                // ── Resolve @-bots to larkAppIds via the source chat's bot roster ──
+                const sourceChatId = ds.chatId;
+                let members = [];
+                try {
+                    members = await listChatBotMembers(creatorAppId, sourceChatId);
+                }
+                catch (e) {
+                    logger.warn(`[${logTag}] /relay --create: failed to list source chat members: ${e?.message ?? e}`);
+                }
+                const memberByOpenId = new Map(members.map(m => [m.openId, m]));
+                const appIdToName = new Map();
+                for (const m of members) {
+                    if (m.larkAppId && m.displayName)
+                        appIdToName.set(m.larkAppId, m.displayName);
+                }
+                const mentionedBotAppIds = [];
+                const seenApp = new Set();
+                let unresolved;
+                for (const bm of botMentions) {
+                    const mem = bm.openId ? memberByOpenId.get(bm.openId) : undefined;
+                    if (!mem || !mem.larkAppId) {
+                        unresolved = bm.name;
+                        break;
+                    }
+                    if (!seenApp.has(mem.larkAppId)) {
+                        seenApp.add(mem.larkAppId);
+                        mentionedBotAppIds.push(mem.larkAppId);
+                    }
+                }
+                if (unresolved) {
+                    logger.warn(`[${logTag}] /relay --create: unresolved bot "${unresolved}"`);
+                    await sessionReply(rootId, t('cmd.relay.resolve_failed', undefined, loc));
+                    break;
+                }
+                // ── Group name extraction (mirror of /group) ───────────────────────
+                let rawArgs = afterFlag;
+                for (const m of mentions) {
+                    if (m.name)
+                        rawArgs = rawArgs.split(`@${m.name}`).join(' ');
+                }
+                const firstLine = rawArgs.split(/\r?\n/).map(s => s.trim()).find(Boolean) ?? '';
+                const MAX_NAME = 50;
+                let groupName;
+                if (firstLine) {
+                    groupName = firstLine.length > MAX_NAME ? firstLine.slice(0, MAX_NAME) + '…' : firstLine;
+                }
+                else {
+                    const now = new Date();
+                    const ts = `${String(now.getMonth() + 1).padStart(2, '0')}/${String(now.getDate()).padStart(2, '0')} ${String(now.getHours()).padStart(2, '0')}:${String(now.getMinutes()).padStart(2, '0')}`;
+                    groupName = t('cmd.relay.empty_group_name', { ts }, loc);
+                }
+                // ── Create the new chat ────────────────────────────────────────────
+                const nameOf = (id) => appIdToName.get(id) ?? botDisplayName(id);
+                let newChatId;
+                let inviteLink;
+                try {
+                    const { createGroupWithBots } = await import('../services/group-creator.js');
+                    const result = await createGroupWithBots({
+                        creatorLarkAppId: creatorAppId,
+                        larkAppIds: mentionedBotAppIds,
+                        name: groupName,
+                        userOpenIds: [senderOpenId],
+                        transferOwnerTo: senderOpenId,
+                    });
+                    newChatId = result.chatId;
+                    const applink = `https://applink.feishu.cn/client/chat/open?openChatId=${encodeURIComponent(result.chatId)}`;
+                    inviteLink = result.shareLink ?? applink;
+                }
+                catch (err) {
+                    logger.error(`[${logTag}] /relay --create: createGroup failed: ${err?.message ?? err}`);
+                    await sessionReply(rootId, t('cmd.relay.failed', { error: err?.message ?? String(err) }, loc));
+                    break;
+                }
+                // Snapshot the pre-transfer source anchor — peers locate their own
+                // session by this value, and `transferSession()` will overwrite
+                // `ds.session.rootMessageId` once it runs. Must capture BEFORE the
+                // leader transfer call (caught in review).
+                const sourceAnchor = ds.session.rootMessageId;
+                // ── M1 deferred: post the announcement AFTER all transfers settle ──
+                // Previous flow sent an optimistic "已接力" M1 before running any
+                // transfer. When leader/peers later failed, that M1 was a lie — and
+                // the --create path had no orphan-cleanup (picker path did).
+                //
+                // New flow: pass `newChatId` as a placeholder for targetRootMessageId
+                // into transferSession. Chat-scope routing ignores rootMessageId
+                // (worker-pool transferSession only stores it for audit/UX), so the
+                // placeholder doesn't break routing. Once all outcomes are in, we
+                // post the real M1 with success/failure breakdown, then patch the
+                // leader's session.rootMessageId to that final M1 id. Peer sessions
+                // keep newChatId as a cosmetic placeholder — fixing them would
+                // require another round-trip; chat-scope doesn't actually care.
+                const placeholderRootMessageId = newChatId;
+                // Resolve friendly source-chat label for the M1 body — falls back to
+                // raw chatId if Lark can't return a name. Mirrors picker-path
+                // (card-handler.ts:341) so the message reads the same in both UX
+                // entry points.
+                const { getChatName } = await import('../im/lark/client.js');
+                const sourceLabel = (await getChatName(creatorAppId, sourceChatId).catch(() => null)) ?? sourceChatId;
+                // ── Step 1: leader transfers its own session (if any) ───────────────
+                // Empty-leader handling: daemon auto-creates a placeholder ds for any
+                // DAEMON_COMMAND (worker:null + hasHistory:false). If the user typed
+                // `/relay --create` in a chat where they never actually chatted with
+                // the bot, ds IS that placeholder — there's no real session to
+                // migrate. Pre-Codex-review we'd happily transferSession the empty
+                // shell and report "已就绪：leader" as a lie. Now we detect this,
+                // skip transferSession, mark leader as `no_session`, and close the
+                // scratch so it doesn't linger as a ghost.
+                //
+                // The new chat is still created (createGroupWithBots already ran
+                // above) — that itself is a valuable product outcome since the
+                // mentioned bots were invited. Peers continue through their normal
+                // path; the final M1 template adapts to "all_fresh" when no bot
+                // actually had a session to bring along.
+                const reportLines = [];
+                const leaderName = nameOf(creatorAppId);
+                const successBotNames = [];
+                const failedBotNames = [];
+                // Use the persisted-marker predicate, not runtime ds.hasHistory:
+                // restoreActiveSessions sets hasHistory:true UNCONDITIONALLY on
+                // restart (session-manager.ts:618), so a scratch that survives a
+                // restart comes back with hasHistory:true and would defeat a
+                // naive `!!ds.worker || ds.hasHistory` check. cliId / lastCliInput
+                // are only written after a real worker started the CLI, so they
+                // survive restart correctly.
+                const { isRelayableRealSession } = await import('./worker-pool.js');
+                const leaderHasRealSession = isRelayableRealSession(ds);
+                if (leaderHasRealSession) {
+                    const { transferSession } = await import('./worker-pool.js');
+                    // Target chat was just built by createGroupWithBots — by
+                    // construction a regular group.
+                    const leaderResult = await transferSession(ds.session.sessionId, newChatId, placeholderRootMessageId, 'group');
+                    if (!leaderResult.ok) {
+                        // Real session, real failure (worker busy / unsupported target
+                        // / tmux issue). Abort the entire --create flow — the new chat
+                        // exists but is empty of any migrated session; we don't post
+                        // an M1 because there's nothing to announce.
+                        reportLines.push(t('cmd.relay.report_leader_failed', { bot: leaderName, error: leaderResult.error }, loc));
+                        await sessionReply(rootId, t('cmd.relay.created', { name: groupName, link: inviteLink, report: reportLines.join('\n') }, loc));
+                        break;
+                    }
+                    reportLines.push(t('cmd.relay.report_leader_ok', { bot: leaderName }, loc));
+                    successBotNames.push(leaderName);
+                }
+                else {
+                    // Empty leader: no real session to migrate.
+                    reportLines.push(t('cmd.relay.report_leader_no_session', { bot: leaderName }, loc));
+                    failedBotNames.push(leaderName);
+                    // Close the daemon-command scratch so it doesn't linger as a
+                    // ghost active row at the source anchor (same hygiene that
+                    // transferSession's pre-flight applies to target-chat scratches).
+                    const { closeSession } = await import('./worker-pool.js');
+                    await closeSession(ds.session.sessionId).catch(err => {
+                        logger.warn(`[${logTag}] /relay --create: failed to close empty-leader scratch: ${err instanceof Error ? err.message : err}`);
+                    });
+                }
+                // ── Step 2: coordinate peer daemons (parallel) ─────────────────────
+                const { findOnlineDaemon } = await import('../utils/daemon-discovery.js');
+                const peerAppIds = mentionedBotAppIds.filter(id => id !== creatorAppId);
+                const peerOutcomes = await Promise.all(peerAppIds.map(async (peerAppId) => {
+                    const botName = nameOf(peerAppId);
+                    const daemon = findOnlineDaemon(peerAppId);
+                    if (!daemon)
+                        return { peerAppId, botName, status: 'offline' };
+                    try {
+                        const ctrl = new AbortController();
+                        const tt = setTimeout(() => ctrl.abort(), 5000);
+                        const res = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/sessions/migrate-to-chat`, {
+                            method: 'POST',
+                            headers: { 'content-type': 'application/json' },
+                            body: JSON.stringify({
+                                sourceAnchor,
+                                targetChatId: newChatId,
+                                targetRootMessageId: placeholderRootMessageId,
+                                requesterLarkAppId: creatorAppId,
+                                requestingUserOpenId: senderOpenId,
+                                // union_id is cross-app stable within a tenant — peer
+                                // compares against its own session.ownerUnionId rather
+                                // than translating open_ids per bot. Optional for
+                                // backward compat with daemons older than this commit.
+                                requestingUserUnionId: senderUnionId,
+                            }),
+                            signal: ctrl.signal,
+                        }).finally(() => clearTimeout(tt));
+                        const body = await res.json().catch(() => ({}));
+                        if (res.ok && body.ok)
+                            return { peerAppId, botName, status: 'ok' };
+                        if (body.error === 'no_session_at_anchor')
+                            return { peerAppId, botName, status: 'no_session' };
+                        if (body.error === 'not_session_owner')
+                            return { peerAppId, botName, status: 'not_owner' };
+                        if (body.error === 'worker_busy')
+                            return { peerAppId, botName, status: 'busy' };
+                        return { peerAppId, botName, status: 'failed', error: body.error ?? `http_${res.status}` };
+                    }
+                    catch (err) {
+                        const reason = err?.name === 'AbortError' ? 'busy' : 'failed';
+                        return { peerAppId, botName, status: reason, error: err?.message ?? String(err) };
+                    }
+                }));
+                // Bucket peer outcomes for the final M1 (success / failure) AND extend the
+                // source-chat report with per-peer detail. Leader was already bucketed
+                // above (real-success → successBotNames; real-fail or empty-leader →
+                // failedBotNames), so we only iterate peers here.
+                for (const r of peerOutcomes) {
+                    if (r.status === 'ok') {
+                        successBotNames.push(r.botName);
+                        reportLines.push(t('cmd.relay.report_peer_ok', { bot: r.botName }, loc));
+                    }
+                    else {
+                        failedBotNames.push(r.botName);
+                        switch (r.status) {
+                            case 'no_session':
+                                reportLines.push(t('cmd.relay.report_peer_no_session', { bot: r.botName }, loc));
+                                break;
+                            case 'not_owner':
+                                reportLines.push(t('cmd.relay.report_peer_not_owner', { bot: r.botName }, loc));
+                                break;
+                            case 'offline':
+                                reportLines.push(t('cmd.relay.report_peer_offline', { bot: r.botName }, loc));
+                                break;
+                            case 'busy':
+                                reportLines.push(t('cmd.relay.report_peer_busy', { bot: r.botName }, loc));
+                                break;
+                            case 'failed':
+                                reportLines.push(t('cmd.relay.report_peer_failed', { bot: r.botName, error: r.error ?? 'unknown' }, loc));
+                                break;
+                        }
+                    }
+                }
+                // ── Step 3: post the real M1 with status breakdown ─────────────────
+                // Three templates:
+                //   - all_ok      : every bot migrated cleanly
+                //   - partial     : some migrated, some didn't (failed list explains)
+                //   - all_fresh   : nobody had a session to migrate (group's still
+                //                   useful — bots were invited; user just @s to start)
+                // Pass the raw text — sendMessage wraps `'text'` msgType bodies into
+                // { text: content } itself.
+                let finalM1Text;
+                if (successBotNames.length === 0) {
+                    finalM1Text = t('cmd.relay.m1_final_all_fresh', { sourceChat: sourceLabel }, loc);
+                }
+                else if (failedBotNames.length === 0) {
+                    finalM1Text = t('cmd.relay.m1_final_all_ok', {
+                        sourceChat: sourceLabel,
+                        successBots: successBotNames.join('、'),
+                    }, loc);
+                }
+                else {
+                    finalM1Text = t('cmd.relay.m1_final_partial', {
+                        sourceChat: sourceLabel,
+                        successBots: successBotNames.join('、'),
+                        failedBots: failedBotNames.join('、'),
+                    }, loc);
+                }
+                try {
+                    const finalM1Id = await sendMessage(creatorAppId, newChatId, finalM1Text, 'text');
+                    // Patch the leader's session.rootMessageId to the real M1 id, but
+                    // only if the leader was actually transferred — for the empty-
+                    // leader / all_fresh path, ds was either closed or never moved,
+                    // so we don't touch it (would write to a closed/stale record).
+                    if (leaderHasRealSession && successBotNames.includes(leaderName)) {
+                        ds.session.rootMessageId = finalM1Id;
+                        sessionStore.updateSession(ds.session);
+                    }
+                }
+                catch (err) {
+                    // Non-fatal: transfers already succeeded. The source-chat report
+                    // (sessionReply below) is the user's authoritative status.
+                    logger.warn(`[${logTag}] /relay --create: final M1 send failed: ${err?.message ?? err}`);
+                }
+                await sessionReply(rootId, t('cmd.relay.created', { name: groupName, link: inviteLink, report: reportLines.join('\n') }, loc));
+                logger.info(`[${logTag}] /relay --create completed: chat=${newChatId} leader=${creatorAppId} peers=[${peerAppIds.join(',')}]`);
+                break;
+            }
+            case '/card': {
+                if (!ds) {
+                    await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
+                    break;
+                }
+                // Private mode (`privateCard`): send a one-shot snapshot only to the
+                // explicit talk-grant audience via the ephemeral API, instead of the
+                // group-visible live card. Ephemeral cards only work in plain `group`
+                // chats and can't be patched — so no live updates, and we fail closed
+                // (never fall back to a group-visible card) since not leaking is the
+                // entire point of this mode.
+                if (getBot(ds.larkAppId).config.privateCard) {
+                    // Strict gate: only a *confirmed* plain group is safe — getChatModeStrict
+                    // returns 'unknown' on API error instead of guessing 'group', so we fail
+                    // closed (no leak) when we can't verify the chat type.
+                    const mode = await getChatModeStrict(ds.larkAppId, ds.chatId);
+                    if (mode !== 'group') {
+                        await sessionReply(rootId, t('cmd.card.private_not_group', undefined, loc));
+                        break;
+                    }
+                    const audience = resolvePrivateCardAudience(ds);
+                    if (audience.length === 0) {
+                        await sessionReply(rootId, t('cmd.card.private_no_audience', undefined, loc));
+                        break;
+                    }
+                    const r = await postPrivateSnapshotCard(ds, audience);
+                    if (r.notReady) {
+                        await sessionReply(rootId, t('cmd.card.private_not_ready', undefined, loc));
+                    }
+                    else if (r.sent === 0) {
+                        // Total failure — surface a non-sensitive error (no terminal content,
+                        // no open_id list). Most likely cause: missing send permission / bot
+                        // not in chat / topic-thread chat.
+                        await sessionReply(rootId, t('cmd.card.private_failed', undefined, loc));
+                    }
+                    else if (r.sent < r.total) {
+                        // Partial — report counts only, never the audience identities.
+                        await sessionReply(rootId, t('cmd.card.private_partial', { sent: r.sent, total: r.total }, loc));
+                    }
+                    break;
+                }
+                // Manual summon. Force the live card on for the rest of this session —
+                // even when the bot has `disableStreamingCard` set — then post a fresh
+                // card. If the worker terminal isn't up yet, the force flag still sticks
+                // so the card appears (and live-updates) as soon as the worker is ready.
+                ds.streamingCardForced = true;
+                const posted = await postFreshStreamingCard(ds, deps.sessionReply);
+                if (!posted) {
+                    await sessionReply(rootId, t('cmd.card.not_ready', undefined, loc));
+                }
+                break;
+            }
             case '/help': {
                 const botCfg = ds ? getBot(ds.larkAppId).config : getAllBots()[0]?.config;
                 const cliName = getCliDisplayName(botCfg?.cliId ?? 'claude-code');
@@ -1102,7 +1567,9 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     t('help.cd', { cliName }, loc),
                     t('help.repo_list', undefined, loc),
                     t('help.repo_n', undefined, loc),
+                    t('help.repo_path', undefined, loc),
                     t('help.status', undefined, loc),
+                    t('help.card', undefined, loc),
                     '',
                     t('help.heading_passthrough', { cliName }, loc),
                     // 直接从集合渲染，保证文案与 PASSTHROUGH_COMMANDS 不漂移
@@ -1115,10 +1582,6 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     t('help.schedule_toggle', undefined, loc),
                     t('help.schedule_run', undefined, loc),
                     '',
-                    '任务管理:',
-                    '/task new <name> — 登记当前任务',
-                    '/task list | /task status <id> | /task assign <id> @Bot | /task close <id>',
-                    '',
                     t('help.schedule_formats', undefined, loc),
                     '',
                     t('help.heading_adopt', undefined, loc),