botmux 2.47.0 → 2.47.2

package/dist/core/worker-pool.js

@@ -7,13 +7,15 @@ import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { readFileSync, writeFileSync, mkdirSync, existsSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { ensureSkills } from '../skills/installer.js';
+import { ensureSkills, ensureAskSkill, ensurePluginSkills, removeGlobalBotmuxSkills } from '../skills/installer.js';
+import { installHook } from '../adapters/hook-installer.js';
+import { hookCommandFor } from '../adapters/hook-command.js';
 import { randomBytes } from 'node:crypto';
 import { config } from '../config.js';
 import * as sessionStore from '../services/session-store.js';
 import { persistStreamCardState } from './session-manager.js';
-import { updateMessage, deleteMessage, MessageWithdrawnError } from '../im/lark/client.js';
-import { buildStreamingCard, buildSessionCard, buildTuiPromptCard, buildTuiPromptResolvedCard, getCliDisplayName } from '../im/lark/card-builder.js';
+import { updateMessage, deleteMessage, sendEphemeralCard, MessageWithdrawnError } from '../im/lark/client.js';
+import { buildStreamingCard, buildPrivateSnapshotCard, buildSessionCard, buildTuiPromptCard, buildTuiPromptResolvedCard, buildRelayedFrozenCard, getCliDisplayName } from '../im/lark/card-builder.js';
 import { loadFrozenCards, saveFrozenCards } from '../services/frozen-card-store.js';
 import { logger } from '../utils/logger.js';
 import { createCliAdapterSync } from '../adapters/cli/registry.js';
@@ -21,9 +23,10 @@ import { botLocale, localeForBot, t as tr } from '../i18n/index.js';
 import { claudeJsonlPathForSession } from '../adapters/cli/claude-code.js';
 import { buildMarkdownCard, buildContextualReplyCard } from '../im/lark/md-card.js';
 import { TmuxBackend } from '../adapters/backend/tmux-backend.js';
-import { getBot, getAllBots } from '../bot-registry.js';
+import { getBot, getAllBots, resolveBrandLabel } from '../bot-registry.js';
 import { dashboardEventBus } from './dashboard-events.js';
 import { composeRowFromActive } from './dashboard-rows.js';
+import { knownBotOpenIdsFromCrossRef } from '../utils/bot-routing.js';
 import { sessionKey, sessionAnchorId } from './types.js';
 import { usageLimitStateKey } from '../utils/cli-usage-limit.js';
 const __filename = fileURLToPath(import.meta.url);
@@ -71,6 +74,84 @@ export function findActiveBySessionId(sessionId) {
 export function getActiveSessionsRegistry() {
     return activeSessionsRegistry;
 }
+// ─── "Real relayable session" predicate ─────────────────────────────────────
+/**
+ * True iff this DaemonSession represents a real CLI-backed conversation
+ * that's safe to migrate via /relay. Returns false for daemon-command
+ * scratch placeholders (the `worker:null + hasHistory:false` records that
+ * daemon.ts creates for /help, an unfinished picker /relay, etc.) — those
+ * have no CLI history, no tmux, and migrating them yields an empty shell
+ * in the target chat with a fake "已就绪" M1.
+ *
+ * Why not just `!!ds.worker || ds.hasHistory`:
+ *   - `ds.worker` is runtime-only; null after daemon restart until
+ *     forkWorker re-attaches.
+ *   - `ds.hasHistory` is a runtime field too — restoreActiveSessions sets
+ *     it `true` UNCONDITIONALLY for any persisted non-adopt session
+ *     (session-manager.ts:618). A scratch that survived a restart comes
+ *     back with hasHistory:true, defeating the guard.
+ *
+ * Use persisted markers instead: `ds.session.cliId` and
+ * `ds.session.lastCliInput` are written ONLY after a real worker started
+ * the CLI (worker-pool's fork path stamps cliId; rememberLastCliInput
+ * writes lastCliInput on every input). Daemon-command scratches never set
+ * either, so the predicate survives restart and is robust across paths.
+ *
+ * Apply at every relay surface that consumes a candidate `ds`:
+ *   - relay-picker.ts collectRelayPickerEntries (don't list scratches)
+ *   - card-handler.ts relay_confirm preflight (don't M1 + transferSession a scratch)
+ *   - this file's transferSession depth defense (catch any caller that bypassed both upstream guards)
+ *   - command-handler.ts /relay --create leader guard
+ */
+export function isRelayableRealSession(ds) {
+    if (ds.worker)
+        return true;
+    if (ds.session.cliId)
+        return true;
+    if (ds.session.lastCliInput)
+        return true;
+    return false;
+}
+// ─── Terminal URL helpers ──────────────────────────────────────────────────
+// config.web.externalHost is a live getter (re-resolves the LAN IP each read
+// when WEB_EXTERNAL_HOST is unset), so building the URL fresh at every card
+// render/patch is enough to keep links pointing at the current network.
+function terminalReadUrl(port) {
+    return `http://${config.web.externalHost}:${port}`;
+}
+function terminalWriteUrl(port, token) {
+    return `${terminalReadUrl(port)}?token=${encodeURIComponent(token)}`;
+}
+// Per-bot opt-out: when true, botmux never posts/patches the live streaming
+// session card. Read fresh from the in-memory registry so a dashboard toggle
+// takes effect without a daemon restart. The `/card` command can override it
+// per-session via `ds.streamingCardForced` (manually summon a live card).
+function streamingCardDisabled(ds) {
+    if (ds.streamingCardForced)
+        return false;
+    try {
+        return getBot(ds.larkAppId).config.disableStreamingCard === true;
+    }
+    catch {
+        return false;
+    }
+}
+// Per-bot opt-in: the writable terminal link to embed directly in the streaming
+// card body (token included). Returns undefined unless the bot enabled it AND
+// the worker port/token are known. Exported for card-handler's re-renders so the
+// link stays put across button-driven card updates.
+export function writableTerminalLinkFor(ds) {
+    try {
+        if (getBot(ds.larkAppId).config.writableTerminalLinkInCard !== true)
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    if (!ds.workerPort || !ds.workerToken)
+        return undefined;
+    return terminalWriteUrl(ds.workerPort, ds.workerToken);
+}
 // ─── Helpers ────────────────────────────────────────────────────────────────
 function tag(ds) {
     return ds.session.sessionId.substring(0, 8);
@@ -78,6 +159,36 @@ function tag(ds) {
 function sessionCliId(ds, botCfg) {
     return ds.session.cliId ?? botCfg.cliId;
 }
+function loadKnownBotOpenIdsForApp(larkAppId) {
+    const dataDir = config.session.dataDir;
+    let crossRef = {};
+    const crossRefPath = join(dataDir, `bot-openids-${larkAppId}.json`);
+    if (existsSync(crossRefPath)) {
+        const parsed = JSON.parse(readFileSync(crossRefPath, 'utf-8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            crossRef = parsed;
+        }
+    }
+    let botEntries = [];
+    const botInfoPath = join(dataDir, 'bots-info.json');
+    if (existsSync(botInfoPath)) {
+        const parsed = JSON.parse(readFileSync(botInfoPath, 'utf-8'));
+        if (Array.isArray(parsed))
+            botEntries = parsed;
+    }
+    return knownBotOpenIdsFromCrossRef(crossRef, botEntries, larkAppId);
+}
+function daemonCardFooterRecipientOpenId(ds) {
+    const owner = ds.session.ownerOpenId;
+    if (!owner)
+        return undefined;
+    try {
+        return loadKnownBotOpenIdsForApp(ds.larkAppId).has(owner) ? undefined : owner;
+    }
+    catch {
+        return owner;
+    }
+}
 export function clearUsageLimitState(ds) {
     if (ds.usageLimitRetryTimer) {
         clearTimeout(ds.usageLimitRetryTimer);
@@ -97,9 +208,9 @@ function scheduleUsageLimitCardPatch(ds) {
         return;
     const bot = getBot(ds.larkAppId);
     const effectiveCliId = sessionCliId(ds, bot.config);
-    const readUrl = `http://${config.web.externalHost}:${port}`;
+    const readUrl = terminalReadUrl(port);
     const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'limited', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), ds.usageLimit);
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'limited', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), ds.usageLimit, writableTerminalLinkFor(ds));
     scheduleCardPatch(ds, cardJson);
 }
 function armUsageLimitRetryTimer(ds, previous) {
@@ -232,6 +343,110 @@ export function recallFrozenCards(ds) {
     }
     logger.info(`[${tag(ds)}] Recalled ${targets.length} previous streaming card(s)`);
 }
+/**
+ * Force-post a fresh streaming card for `ds`, bypassing the per-bot
+ * `disableStreamingCard` opt-out. Backs the `/card` command: a user can
+ * manually summon a live card in an otherwise-quiet session. Parks the current
+ * card (if any) first so `recallFrozenCards` withdraws it once the fresh one
+ * lands — the thread ends up with a single live card. Returns false when the
+ * worker terminal isn't ready yet (no port), so the caller can surface a
+ * friendly "not ready" message.
+ *
+ * Note: this does NOT itself flip `ds.streamingCardForced` — the caller sets
+ * that so the card keeps live-patching afterwards even when the bot opted out.
+ */
+export async function postFreshStreamingCard(ds, sessionReply) {
+    const port = ds.workerPort ?? ds.session.webPort;
+    if (!port)
+        return false;
+    const botCfg = getBot(ds.larkAppId).config;
+    const effectiveCliId = sessionCliId(ds, botCfg);
+    const readUrl = terminalReadUrl(port);
+    const title = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
+    const status = ds.lastScreenStatus ?? 'idle';
+    // Park the current card (no-op when there's none) so the fresh one replaces
+    // rather than duplicates it.
+    parkStreamCard(ds);
+    // Snapshot prior identity for rollback on POST failure (restore all three
+    // together so a failed /card leaves no orphaned nonce/pending state).
+    const prevCardId = ds.streamCardId;
+    const prevNonce = ds.streamCardNonce;
+    const prevPending = ds.streamCardPending;
+    ds.streamCardNonce = randomBytes(4).toString('hex');
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, title, ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds));
+    ds.streamCardId = CARD_POSTING_SENTINEL;
+    try {
+        ds.streamCardId = await sessionReply(sessionAnchorId(ds), cardJson, 'interactive', ds.larkAppId);
+        // This card is now the live one for the current turn. Clear the new-turn
+        // pending flag so the next screen_update PATCHes it instead of POSTing a
+        // duplicate (the gate above only suppresses cards when disabled+unforced;
+        // /card forces them on, so a stale pending flag would otherwise re-POST).
+        ds.streamCardPending = false;
+        persistStreamCardState(ds);
+        recallFrozenCards(ds);
+        logger.info(`[${tag(ds)}] Posted streaming card via /card`);
+        return true;
+    }
+    catch (err) {
+        ds.streamCardId = prevCardId;
+        ds.streamCardNonce = prevNonce;
+        ds.streamCardPending = prevPending;
+        logger.warn(`[${tag(ds)}] /card POST failed: ${err}`);
+        return false;
+    }
+}
+/**
+ * Audience for a private `/card`: the bot's `allowedUsers` (the canOperate set —
+ * owner & co-owners), deduped, `ou_` only. Talk-only grants (`globalGrants` /
+ * `chatGrants`) and a bare triggerer are intentionally NOT included: the private
+ * card is owner-only. A grant-authorized user who runs `/card` therefore does
+ * not receive a card (matches the "授权人不发" rule). Empty when the bot has no
+ * `allowedUsers` (fully-open mode → no owner to send to).
+ */
+export function resolvePrivateCardAudience(ds) {
+    const bot = getBot(ds.larkAppId);
+    const set = new Set();
+    for (const u of bot.resolvedAllowedUsers)
+        if (u.startsWith('ou_'))
+            set.add(u);
+    return [...set];
+}
+/**
+ * Private `/card`: build a one-shot snapshot of the current terminal and send it
+ * as an ephemeral (visible-to-one) card to each open_id in `audience`, one API
+ * call each (concurrency-capped). Never posts a group-visible card and never
+ * patches — privacy is the whole point, so there is deliberately no fallback.
+ * Returns per-recipient counts so the caller can report progress without leaking
+ * the audience list into the chat.
+ */
+export async function postPrivateSnapshotCard(ds, audience) {
+    const port = ds.workerPort ?? ds.session.webPort;
+    if (!port)
+        return { sent: 0, total: audience.length, notReady: true };
+    const botCfg = getBot(ds.larkAppId).config;
+    const effectiveCliId = sessionCliId(ds, botCfg);
+    const readUrl = terminalReadUrl(port);
+    const title = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
+    const status = ds.lastScreenStatus ?? 'idle';
+    const cardJson = buildPrivateSnapshotCard(readUrl, title, status, effectiveCliId, ds.currentImageKey, ds.lastScreenContent ?? '', ds.session.sessionId, sessionAnchorId(ds), localeForBot(ds.larkAppId), cardUsageLimit(ds));
+    let sent = 0;
+    // Cap concurrency: Feishu per-chat ~40 QPS, ephemeral total 50/s.
+    const CONCURRENCY = 5;
+    for (let i = 0; i < audience.length; i += CONCURRENCY) {
+        const batch = audience.slice(i, i + CONCURRENCY);
+        await Promise.all(batch.map(async (openId) => {
+            try {
+                await sendEphemeralCard(ds.larkAppId, ds.chatId, openId, cardJson);
+                sent++;
+            }
+            catch (err) {
+                logger.warn(`[${tag(ds)}] private /card ephemeral send to ${openId.substring(0, 8)}… failed: ${err}`);
+            }
+        }));
+    }
+    logger.info(`[${tag(ds)}] private /card: ephemeral sent ${sent}/${audience.length}`);
+    return { sent, total: audience.length, notReady: false };
+}
 // ─── Card PATCH serialization queue ─────────────────────────────────────────
 // Only one PATCH in-flight at a time per session. New PATCHes queue on
 // ds.pendingCardJson (latest wins). When the in-flight PATCH completes,
@@ -244,6 +459,9 @@ export function recallFrozenCards(ds) {
  * any previously queued value — only the latest state matters).
  */
 export function scheduleCardPatch(ds, cardJson) {
+    // Bot opted out of the streaming card — never patch one into existence.
+    if (streamingCardDisabled(ds))
+        return;
     ds.pendingCardJson = cardJson;
     // Capture the card ID now — by the time flushCardPatch runs, ds.streamCardId
     // may have been overwritten by a new turn's card (CARD_POSTING_SENTINEL).
@@ -305,7 +523,32 @@ export function ensureCliSkills(cliId, cliPathOverride) {
     if (skillsInstalledCliIds.has(cliId))
         return;
     const adapter = createCliAdapterSync(cliId, cliPathOverride);
-    ensureSkills(cliId, adapter.skillsDir);
+    if (adapter.pluginDir) {
+        // 动态注入：skill 写进插件目录，spawn 时用 --plugin-dir 注入，仅本次会话可见。
+        // 不再写全局 skillsDir。（全局 ~/.claude/skills 的历史残留清理改由
+        // cleanupGlobalBotmuxSkillsOnce 在启动时独立于 cliId 执行。）
+        ensurePluginSkills(cliId, adapter.pluginDir);
+    }
+    else {
+        ensureSkills(cliId, adapter.skillsDir);
+    }
+    // askUserQuestion 接管策略：hook 优先 + 非 hook CLI 用 skill 兜底。
+    // - asksViaHook=true（Claude/OpenCode）：通过 hook 拦截原生 AskUserQuestion，删掉
+    //   botmux-ask skill，避免 skill 与 hook 双重弹卡。
+    //   Claude 走 --settings 进程级注入；OpenCode 走 hookInstall 插件写文件。
+    // - asksViaHook 未设（Codex/Cursor/尚未接 hook 的终端原生 CLI）：保留 botmux-ask
+    //   skill 作兜底，让 agent 仍可用 `botmux ask` 把选择题引到飞书。
+    if (adapter.hookInstall) {
+        try {
+            installHook(cliId, adapter.hookInstall, hookCommandFor(cliId));
+        }
+        catch (err) {
+            logger.warn(`[hook] install failed for ${cliId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // botmux-ask 落在与其它 skill 同一目录：plugin 模式下是 {pluginDir}/skills。
+    const askSkillsDir = adapter.pluginDir ? join(adapter.pluginDir, 'skills') : adapter.skillsDir;
+    ensureAskSkill(cliId, askSkillsDir, !adapter.asksViaHook);
     skillsInstalledCliIds.add(cliId);
 }
 // ─── Legacy MCP config cleanup ──────────────────────────────────────────────
@@ -381,9 +624,11 @@ export function cleanupLegacyMcpConfig(cliId) {
                 }
                 break;
             }
-            case 'opencode': {
-                // ~/.config/opencode/opencode.json → { mcp: { botmux } } or { mcpServers: { botmux } }
-                const p = join(home, '.config', 'opencode', 'opencode.json');
+            case 'opencode':
+            case 'mtr': {
+                // ~/.config/opencode/{opencode,mtr}.json → { mcp: { botmux } } or { mcpServers: { botmux } }
+                const file = cliId === 'mtr' ? 'mtr.json' : 'opencode.json';
+                const p = join(home, '.config', 'opencode', file);
                 const removed = removeJsonKey(p, ['mcp'], 'botmux') ||
                     removeJsonKey(p, ['mcpServers'], 'botmux') ||
                     removeJsonKey(p, ['mcp', 'servers'], 'botmux');
@@ -413,9 +658,23 @@ export function cleanupLegacyMcpConfig(cliId) {
  * Both steps are idempotent and best-effort.
  */
 export function ensureCliEnv(cliId, cliPathOverride) {
+    cleanupGlobalBotmuxSkillsOnce();
     ensureCliSkills(cliId, cliPathOverride);
     cleanupLegacyMcpConfig(cliId);
 }
+let globalBotmuxSkillsCleaned = false;
+/** One-time, CLI-independent cleanup of botmux skills that older versions
+ *  installed into the global `~/.claude/skills`. Claude now injects skills via
+ *  `--plugin-dir`, so any leftover `botmux-*` there leaks into the user's
+ *  standalone `claude` regardless of which CLI THIS daemon's bot uses — so the
+ *  cleanup must NOT be gated on `adapter.pluginDir` (which only fires for a
+ *  Claude bot). Runs at daemon startup via ensureCliEnv. */
+function cleanupGlobalBotmuxSkillsOnce() {
+    if (globalBotmuxSkillsCleaned)
+        return;
+    globalBotmuxSkillsCleaned = true;
+    removeGlobalBotmuxSkills('~/.claude/skills');
+}
 // ─── Claude Code folder-trust pre-acceptance ─────────────────────────────────
 //
 // A freshly spawned `claude` in a workingDir that has never been trusted blocks
@@ -549,6 +808,234 @@ export async function closeSession(sessionId) {
     const alreadyClosed = !killedLive && !wasOpen;
     return { ok: true, alreadyClosed };
 }
+/**
+ * Set an entry on an active-sessions Map, but if the key is already occupied
+ * by a DIFFERENT DaemonSession, close that occupant first. Replaces bare
+ * `activeSessions.set(key, ds)` at sites where a silent overwrite would leak
+ * the prior entry's worker + leave its store row stuck in `status='active'`.
+ *
+ * The Map is passed explicitly so callers operate on the same instance they
+ * already hold (restoreActiveSessions takes the daemon's Map as a parameter;
+ * transferSession reaches it through `activeSessionsRegistry`). In production
+ * both refer to the same object — the daemon registers its Map at boot — but
+ * decoupling avoids module-state assumptions in tests.
+ *
+ * Canonical collision case: restoreActiveSessions at daemon boot iterating
+ * two on-disk active sessions that resolve to the same chat-scope key (e.g.
+ * a /relay command's scratch session + the real session that was transferred
+ * into the same chat by a prior daemon run). Without this helper the later
+ * iterated entry silently wins, the earlier one becomes a ghost-active.
+ *
+ * Setting the same `ds` at its own key is a no-op (no close).
+ */
+export async function setActiveSessionSafe(map, key, ds) {
+    const prev = map.get(key);
+    if (prev && prev !== ds) {
+        logger.warn(`[setActiveSessionSafe] key already occupied by ${prev.session.sessionId.substring(0, 8)} ` +
+            `(worker=${prev.worker ? 'live' : 'null'}); closing it before set`);
+        await closeSession(prev.session.sessionId);
+    }
+    map.set(key, ds);
+}
+// ─── Session transfer (cross-chat relay) ────────────────────────────────────
+/**
+ * Transfer an active session from its current chat to a new chat. The CLI
+ * process keeps running inside its tmux session — only the routing fields
+ * (chatId, rootMessageId, scope) and activeSessions key are rewritten. After
+ * the rewrite, forkWorker spawns a new worker that re-attaches to the same
+ * `bmx-<sessionId>` tmux, so the AI's transcript continues without break.
+ *
+ * Visible side effects:
+ *   - Lark messages in the *source* chat remain where they were — we have no
+ *     API to move them. Only the worker's *routing* moves; the AI's memory
+ *     follows via the CLI's persistent jsonl on disk.
+ *   - Cards posted by the prior worker stay in the source chat. We clear
+ *     streamCardId/Nonce/imageKey so the new worker posts fresh cards in the
+ *     target chat instead of trying to PATCH unreachable old ones.
+ *
+ * Pre-conditions (entry guards, all checked synchronously up-front — no
+ * idle-wait loop; busy workers are refused immediately so the caller can
+ * report a deterministic outcome and the user retries when the worker
+ * quiets):
+ *   - Session must be currently active (live worker + activeSessions entry)
+ *   - Source must not be a pendingRepo placeholder (no CLI ever started)
+ *   - Source must not be an adopted external-tmux session
+ *   - Source worker must be in idle/limited (or already dead) — otherwise
+ *     refuse with `worker_busy`
+ *   - Target chat must not already host a real chat-scope session for the
+ *     same bot (`target_chat_has_session`). Scratch (worker:null) occupants
+ *     are NOT a conflict — they're command-time placeholders and we close
+ *     them in-line to free the slot before continuing.
+ *
+ * Idempotent for `same_chat`: returns error without side effects when the
+ * source chat equals the target chat.
+ */
+export async function transferSession(sessionId, targetChatId, targetRootMessageId, 
+/**
+ * Target chat type — narrowed to `'group'` at the type level. The picker-
+ * mode entry guard in command-handler.ts refuses p2p and topic chats
+ * upfront; `/relay --create` builds the target by createGroupWithBots so
+ * it's a regular group by construction; the cross-daemon migrate-to-chat
+ * IPC inherits the same target. Every call site can vouch — TS prevents
+ * any non-'group' literal from reaching here, and the runtime check just
+ * below catches mock data / future bypasses.
+ */
+targetChatType, opts) {
+    // Depth defense — unreachable per TS narrowing above, but guards against
+    // raw-string casting at module boundaries (mocks, HTTP body parses, etc.).
+    if (targetChatType !== 'group') {
+        return { ok: false, error: 'target_chat_type_unsupported' };
+    }
+    const ds = findActiveBySessionId(sessionId);
+    if (!ds)
+        return { ok: false, error: 'session_not_active' };
+    if (targetChatId === ds.chatId)
+        return { ok: false, error: 'same_chat' };
+    // pendingRepo: the user created a session via M0 but hasn't picked a repo
+    // yet, so worker is null and the CLI has never run. Relaying produces an
+    // empty new-chat session with no AI memory — refuse so the user finishes
+    // setup in the original chat first.
+    if (ds.pendingRepo)
+        return { ok: false, error: 'not_started_yet' };
+    // Depth defense: daemon-command scratch (worker:null + no persisted CLI
+    // markers) must not be migrated. Upstream paths (picker filter, card-
+    // handler confirm preflight, /relay --create leader guard) should already
+    // refuse these — this catches any caller that bypassed all three (e.g.
+    // a future code path, a direct dashboard IPC, a test reaching in
+    // manually). Using `isRelayableRealSession` instead of `ds.hasHistory`
+    // makes the predicate survive restoreActiveSessions which currently sets
+    // hasHistory:true unconditionally (session-manager.ts:618).
+    if (!isRelayableRealSession(ds))
+        return { ok: false, error: 'not_started_yet' };
+    // Adopt sessions wrap a CLI process that botmux didn't spawn — the user
+    // owns it inside their own tmux pane, so moving routing here would be
+    // surprising and we don't control the tmux session's lifecycle. Refuse.
+    if (ds.session.adoptedFrom)
+        return { ok: false, error: 'adopt_not_relayable' };
+    // Busy worker: refuse immediately rather than waiting. An idle-wait loop
+    // (previously 60s) created an asymmetry with the peer-dispatch HTTP
+    // timeout (5s) — peer's transferSession was still polling while the
+    // leader had already abort+report 'busy', producing reports that
+    // disagreed with reality. Cleaner contract: refuse on first miss, let
+    // the user retry when the turn settles.
+    const st = ds.lastScreenStatus;
+    if (ds.worker && !ds.worker.killed && st !== 'idle' && st !== 'limited') {
+        return { ok: false, error: 'worker_busy' };
+    }
+    // Existing-session guard: a chat-scope session at the target chatId would
+    // collide on sessionKey(targetChatId, larkAppId) after the rewrite, and
+    // Map.set would silently orphan the prior entry's worker. We split the
+    // collision predicate two ways:
+    //   - real session (worker !== null): refuse the transfer
+    //   - scratch session (worker === null): a daemon-command placeholder
+    //     (e.g. the /relay command itself created one when typed in this
+    //     chat); the slot is logically free, but the placeholder lingers in
+    //     the store with status='active'. Collect and close it so the post-
+    //     transfer Map.set doesn't silently overwrite it (which leaves the
+    //     scratch as a ghost-active on next daemon restart — exact bug we're
+    //     fixing).
+    // We only check chat-scope entries — thread-scope sessions in the same
+    // chat are keyed by rootMessageId, so they don't collide.
+    const scratchesToClose = [];
+    if (activeSessionsRegistry) {
+        for (const existing of activeSessionsRegistry.values()) {
+            if (existing === ds)
+                continue;
+            if (existing.larkAppId !== ds.larkAppId)
+                continue;
+            if (existing.chatId !== targetChatId)
+                continue;
+            if (existing.scope !== 'chat')
+                continue;
+            if (!existing.worker) {
+                scratchesToClose.push(existing.session.sessionId);
+                continue;
+            }
+            return { ok: false, error: 'target_chat_has_session' };
+        }
+    }
+    for (const sid of scratchesToClose) {
+        await closeSession(sid);
+    }
+    const fkw = opts?.forkWorkerImpl ?? forkWorker;
+    const kw = opts?.killWorkerImpl ?? killWorker;
+    const tagPrefix = sessionId.substring(0, 8);
+    const oldAnchor = sessionAnchorId(ds);
+    const oldChatId = ds.chatId;
+    // Freeze the source-chat streaming card BEFORE we kill the worker (and
+    // before we clear streamCardId below). The live card's action buttons
+    // (close / toggle / get write link) carry `session_id` in their value, so
+    // clicks AFTER relay still reach the now-relocated session — closing it,
+    // toggling its display mode, etc. — with feedback landing on the NEW
+    // card in the target chat. PATCH the source-chat card to an inert
+    // snapshot so the user sees clearly it's historical, and so the buttons
+    // are gone. Best-effort: on PATCH failure (card withdrawn, expired) we
+    // log and continue; the relay itself must not depend on this.
+    if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL) {
+        try {
+            const cliId = ds.session.cliId
+                ?? (() => { try {
+                    return getBot(ds.larkAppId).config.cliId;
+                }
+                catch {
+                    return undefined;
+                } })();
+            const frozenJson = buildRelayedFrozenCard(ds.currentTurnTitle || ds.session.title || '', cliId, ds.currentImageKey, localeForBot(ds.larkAppId));
+            await updateMessage(ds.larkAppId, ds.streamCardId, frozenJson);
+        }
+        catch (err) {
+            logger.warn(`[${tagPrefix}] freeze source-chat card failed: ${err instanceof Error ? err.message : err}`);
+        }
+    }
+    // Detach worker — TmuxBackend.kill() does NOT destroy the tmux session, so
+    // the CLI process and its rolling jsonl continue running.
+    kw(ds);
+    activeSessionsRegistry?.delete(sessionKey(oldAnchor, ds.larkAppId));
+    // Rewrite routing fields. Target chat is always chat-scope: leader posts a
+    // notification message (M1) used as `targetRootMessageId` for trace, but
+    // chat-scope routes by chatId anyway, so M1 is purely audit/UX.
+    ds.session.chatId = targetChatId;
+    ds.session.rootMessageId = targetRootMessageId;
+    ds.session.scope = 'chat';
+    ds.session.chatType = targetChatType;
+    ds.session.lastMessageAt = new Date().toISOString();
+    // Card state was pinned to the source chat — clear so the new worker posts
+    // a fresh card in the target chat instead of trying to PATCH a message that
+    // lives in another chat entirely (the source card was just frozen above).
+    ds.session.streamCardId = undefined;
+    ds.session.streamCardNonce = undefined;
+    ds.session.currentImageKey = undefined;
+    // Mirror onto runtime DaemonSession.
+    ds.chatId = targetChatId;
+    ds.chatType = targetChatType;
+    ds.scope = 'chat';
+    ds.streamCardId = undefined;
+    ds.streamCardNonce = undefined;
+    ds.currentImageKey = undefined;
+    sessionStore.updateSession(ds.session);
+    const newAnchor = sessionAnchorId(ds);
+    if (activeSessionsRegistry) {
+        await setActiveSessionSafe(activeSessionsRegistry, sessionKey(newAnchor, ds.larkAppId), ds);
+    }
+    dashboardEventBus.publish({
+        type: 'session.update',
+        body: {
+            sessionId,
+            patch: {
+                chatId: targetChatId,
+                rootMessageId: targetRootMessageId,
+                scope: 'chat',
+                chatType: targetChatType,
+            },
+        },
+    });
+    // forkWorker with resume=true — TmuxBackend.spawn detects the surviving
+    // `bmx-<sessionId>` session and re-attaches instead of creating a new one.
+    fkw(ds, '', /*resume*/ true);
+    logger.info(`[${tagPrefix}] transferred ${oldChatId} → ${targetChatId} ` +
+        `(anchor ${oldAnchor.substring(0, 8)} → ${newAnchor.substring(0, 8)})`);
+    return { ok: true };
+}
 // ─── Fork worker ────────────────────────────────────────────────────────────
 export function forkWorker(ds, prompt, resume = false) {
     const cb = requireCallbacks();
@@ -622,6 +1109,7 @@ export function forkWorker(ds, prompt, resume = false) {
         workingDir: cwd,
         cliId: botCfg.cliId,
         cliPathOverride: botCfg.cliPathOverride,
+        model: botCfg.model,
         backendType: botCfg.backendType ?? config.daemon.backendType,
         prompt,
         resume,
@@ -680,8 +1168,8 @@ function setupWorkerHandlers(ds, worker) {
                 // Persist port so it can be reused after daemon restart
                 ds.session.webPort = msg.port;
                 sessionStore.updateSession(ds.session);
-                const readOnlyUrl = `http://${config.web.externalHost}:${msg.port}`;
-                const writeUrl = `${readOnlyUrl}?token=${msg.token}`;
+                const readOnlyUrl = terminalReadUrl(msg.port);
+                const writeUrl = terminalWriteUrl(msg.port, msg.token);
                 logger.info(`[${t}] Worker ready, terminal at ${readOnlyUrl}`);
                 if (ds.usageLimit) {
                     ds.lastScreenStatus = 'limited';
@@ -695,6 +1183,14 @@ function setupWorkerHandlers(ds, worker) {
                         patch: { webPort: msg.port },
                     },
                 });
+                // Bot opted out of the streaming card: the terminal is up and the
+                // final answer will still arrive via `botmux send`; just don't post the
+                // live status card. (workerPort/token above are still set so the web
+                // terminal + dashboard keep working.)
+                if (streamingCardDisabled(ds)) {
+                    logger.info(`[${t}] Streaming card disabled for this bot — skipping card post`);
+                    break;
+                }
                 // If a previous streaming card survived (e.g. daemon restart), try to
                 // PATCH it with the new "starting" state instead of POSTing a fresh card.
                 // ds.streamCardPending forces a new card (e.g. mid-session repo switch
@@ -708,8 +1204,14 @@ function setupWorkerHandlers(ds, worker) {
                         // Reuse persisted nonce so existing card buttons (toggle/etc) keep working.
                         if (!ds.streamCardNonce)
                             ds.streamCardNonce = randomBytes(4).toString('hex');
-                        const initStatus = ds.usageLimit ? 'limited' : 'starting';
-                        const streamCardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readOnlyUrl, initTitle, ds.lastScreenContent ?? '', initStatus, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, initStatus === 'limited' ? ds.usageLimit : undefined);
+                        // Prefer the last-known screen status when we have one — for /relay
+                        // resume the worker was idle/limited at transfer time and the
+                        // CLI didn't actually stop, so showing "starting" right after
+                        // the M1 "已接力" announcement is misleading. Fresh-spawn worker
+                        // and post-daemon-restart paths still see lastScreenStatus
+                        // undefined and fall back to 'starting' (unchanged behavior).
+                        const initStatus = ds.usageLimit ? 'limited' : (ds.lastScreenStatus ?? 'starting');
+                        const streamCardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readOnlyUrl, initTitle, ds.lastScreenContent ?? '', initStatus, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, initStatus === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds));
                         await updateMessage(ds.larkAppId, restoredCardId, streamCardJson);
                         persistStreamCardState(ds);
                         // Re-sync worker's display mode (it starts fresh in 'hidden')
@@ -737,8 +1239,16 @@ function setupWorkerHandlers(ds, worker) {
                 try {
                     ds.streamCardNonce = randomBytes(4).toString('hex');
                     const initTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                    const initStatus = ds.usageLimit ? 'limited' : 'starting';
-                    const streamCardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readOnlyUrl, initTitle, '', initStatus, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, initStatus === 'limited' ? ds.usageLimit : undefined);
+                    // See PATCH-branch comment above re: lastScreenStatus preference.
+                    // For relay (kill+fork with surviving tmux/CLI), this avoids the
+                    // jarring "启动中" right after the M1 "已接力" announcement.
+                    const initStatus = ds.usageLimit ? 'limited' : (ds.lastScreenStatus ?? 'starting');
+                    const streamCardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readOnlyUrl, initTitle, 
+                    // For /relay resume, ds.lastScreenContent is the cached pane
+                    // from before the kill+fork — using it avoids a blank flash
+                    // before the first screen_update lands. Fresh worker spawn
+                    // has lastScreenContent undefined → '' (unchanged).
+                    ds.lastScreenContent ?? '', initStatus, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, initStatus === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds));
                     ds.streamCardId = await cb.sessionReply(sessionAnchorId(ds), streamCardJson, 'interactive', ds.larkAppId);
                     persistStreamCardState(ds);
                     // Re-sync worker's display mode (it starts fresh in 'hidden')
@@ -811,6 +1321,10 @@ function setupWorkerHandlers(ds, worker) {
                         },
                     });
                 }
+                // Bot opted out of the streaming card — dashboard SSE above already got
+                // the status patch; just don't touch any Lark card.
+                if (streamingCardDisabled(ds))
+                    break;
                 const readUrl = `http://${config.web.externalHost}:${ds.workerPort}`;
                 const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
                 const mode = ds.displayMode ?? 'hidden';
@@ -826,7 +1340,7 @@ function setupWorkerHandlers(ds, worker) {
                     // New turn → image_key from previous turn no longer valid
                     if (isNewTurn)
                         ds.currentImageKey = undefined;
-                    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, isNewTurn ? '' : msg.content, ds.lastScreenStatus, effectiveCliId, mode, ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds));
+                    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, isNewTurn ? '' : msg.content, ds.lastScreenStatus, effectiveCliId, mode, ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds), writableTerminalLinkFor(ds));
                     // Mark POST in-flight so subsequent screen_updates are dropped,
                     // not POSTed as duplicate cards.
                     ds.streamCardPending = false;
@@ -860,7 +1374,7 @@ function setupWorkerHandlers(ds, worker) {
                     const statusChanged = prevStatus !== ds.lastScreenStatus;
                     if (!statusChanged)
                         break;
-                    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, msg.content, ds.lastScreenStatus, effectiveCliId, mode, ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds));
+                    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, msg.content, ds.lastScreenStatus, effectiveCliId, mode, ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds), writableTerminalLinkFor(ds));
                     scheduleCardPatch(ds, cardJson);
                 }
                 break;
@@ -880,7 +1394,7 @@ function setupWorkerHandlers(ds, worker) {
                     break;
                 const readUrl = `http://${config.web.externalHost}:${ds.workerPort}`;
                 const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', ds.lastScreenStatus, effectiveCliId, 'screenshot', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds));
+                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', ds.lastScreenStatus, effectiveCliId, 'screenshot', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds), writableTerminalLinkFor(ds));
                 scheduleCardPatch(ds, cardJson);
                 break;
             }
@@ -937,7 +1451,7 @@ function setupWorkerHandlers(ds, worker) {
                     if (ds.streamCardId && ds.workerPort) {
                         const readUrl = `http://${config.web.externalHost}:${ds.workerPort}`;
                         const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover);
+                        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, undefined, writableTerminalLinkFor(ds));
                         scheduleCardPatch(ds, frozenCard);
                     }
                     killWorker(ds);
@@ -969,7 +1483,7 @@ function setupWorkerHandlers(ds, worker) {
                     if (ds.streamCardId && ds.workerPort) {
                         const readUrl = `http://${config.web.externalHost}:${ds.workerPort}`;
                         const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc);
+                        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, undefined, writableTerminalLinkFor(ds));
                         scheduleCardPatch(ds, frozenCard);
                     }
                     // Kill the worker process to free resources
@@ -1037,12 +1551,14 @@ function setupWorkerHandlers(ds, worker) {
                 }
                 if (!msg.userText.trim() && !msg.assistantText.trim())
                     break;
+                const recipientOpenId = daemonCardFooterRecipientOpenId(ds);
                 const cardJson = buildContextualReplyCard({
                     title: '📜 /adopt 前最后一轮',
                     userText: msg.userText,
                     assistantText: msg.assistantText,
                     assistantLabel: getCliDisplayName(effectiveCliId),
-                    recipientOpenId: ds.session.ownerOpenId,
+                    recipientOpenId,
+                    brand: resolveBrandLabel(ds.larkAppId),
                 });
                 cb.sessionReply(sessionAnchorId(ds), cardJson, 'interactive', ds.larkAppId).catch((err) => {
                     logger.warn(`[${t}] Failed to deliver adopt_preamble to Lark: ${err.message}`);
@@ -1104,6 +1620,7 @@ function deliverFinalOutput(ds, msg, t, attempt) {
             // they use the contextual card so the user prompt sits in a
             // blockquote and only the assistant body goes through full markdown
             // rendering.
+            const recipientOpenId = daemonCardFooterRecipientOpenId(ds);
             const cardJson = msg.kind === 'local-turn' || msg.kind === 'local-turn-headless'
                 ? buildContextualReplyCard({
                     title: msg.kind === 'local-turn-headless'
@@ -1112,9 +1629,10 @@ function deliverFinalOutput(ds, msg, t, attempt) {
                     userText: msg.kind === 'local-turn' ? msg.userText ?? '' : undefined,
                     assistantText: msg.content,
                     assistantLabel: getCliDisplayName(effectiveCliId),
-                    recipientOpenId: ds.session.ownerOpenId,
+                    recipientOpenId,
+                    brand: resolveBrandLabel(ds.larkAppId),
                 })
-                : buildMarkdownCard(msg.content, ds.session.ownerOpenId);
+                : buildMarkdownCard(msg.content, recipientOpenId, resolveBrandLabel(ds.larkAppId));
             await cb.sessionReply(sessionAnchorId(ds), cardJson, 'interactive', ds.larkAppId);
             ds.lastBridgeEmittedUuid = msg.lastUuid;
             logger.info(`[${t}] Bridge final_output forwarded (turn ${msg.turnId.substring(0, 8)}, ${msg.content.length} chars, kind=${msg.kind ?? 'bridge'}, attempt ${attempt + 1})`);
@@ -1219,6 +1737,7 @@ export function forkAdoptWorker(ds, opts) {
         workingDir: adopted.cwd,
         cliId: adoptedCliId,
         cliSessionId: isStructuredBridge ? adopted.sessionId : undefined,
+        model: botCfg.model,
         backendType: 'tmux',
         prompt: '',
         resume: false,