botmux 2.51.1 → 2.53.0

package/dist/services/codex-app-threads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-app-threads.d.ts","sourceRoot":"","sources":["../../src/services/codex-app-threads.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAuID,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,0BAA+B,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAqBjH"}

package/dist/services/codex-app-threads.js

@@ -0,0 +1,165 @@
+import { spawn } from 'node:child_process';
+import { resolveCommand } from '../adapters/cli/registry.js';
+class CodexAppServerProbe {
+    child;
+    nextId = 1;
+    stdoutBuffer = '';
+    pending = new Map();
+    lastStderr = '';
+    closed = false;
+    constructor(codexBin, cwd) {
+        this.child = spawn(codexBin, ['app-server', '--listen', 'stdio://'], {
+            cwd,
+            env: process.env,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        this.child.stdout.on('data', chunk => this.onStdout(chunk.toString('utf8')));
+        this.child.stderr.on('data', chunk => {
+            this.lastStderr = (this.lastStderr + chunk.toString('utf8')).slice(-8000);
+        });
+        this.child.on('error', err => this.failAll(new Error(`Failed to start Codex app-server: ${err.message}`)));
+        this.child.on('exit', (code, signal) => {
+            this.closed = true;
+            this.failAll(new Error(`Codex app-server exited (code=${code}, signal=${signal})${this.lastStderr ? `\n${this.lastStderr}` : ''}`));
+        });
+    }
+    async initialize(timeoutMs) {
+        await this.withTimeout(this.request('initialize', {
+            clientInfo: { name: 'botmux-codex-app-thread-picker', version: '0.0.0' },
+            capabilities: {
+                experimentalApi: true,
+                suppressNotifications: ['thread/started', 'thread/status/changed'],
+            },
+        }), timeoutMs, 'initialize');
+        this.notify('initialized');
+    }
+    request(method, params) {
+        if (this.closed)
+            return Promise.reject(new Error('Codex app-server is closed'));
+        const id = this.nextId++;
+        this.child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n');
+        return new Promise((resolve, reject) => {
+            this.pending.set(id, { method, resolve, reject });
+        });
+    }
+    notify(method, params) {
+        if (this.closed)
+            return;
+        const msg = { jsonrpc: '2.0', method };
+        if (params !== undefined)
+            msg.params = params;
+        this.child.stdin.write(JSON.stringify(msg) + '\n');
+    }
+    close() {
+        this.closed = true;
+        try {
+            this.child.kill();
+        }
+        catch { /* already gone */ }
+        this.failAll(new Error('Codex app-server probe closed'));
+    }
+    async withTimeout(promise, timeoutMs, label) {
+        let timer;
+        try {
+            return await Promise.race([
+                promise,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error(`Codex app-server ${label} timed out after ${timeoutMs}ms`)), timeoutMs);
+                }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    onStdout(data) {
+        this.stdoutBuffer += data;
+        for (;;) {
+            const nl = this.stdoutBuffer.indexOf('\n');
+            if (nl < 0)
+                return;
+            const line = this.stdoutBuffer.slice(0, nl).trim();
+            this.stdoutBuffer = this.stdoutBuffer.slice(nl + 1);
+            if (!line)
+                continue;
+            let msg;
+            try {
+                msg = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (typeof msg.id === 'number' && (msg.result !== undefined || msg.error !== undefined)) {
+                const pending = this.pending.get(msg.id);
+                if (!pending)
+                    continue;
+                this.pending.delete(msg.id);
+                if (msg.error)
+                    pending.reject(new Error(`${pending.method}: ${JSON.stringify(msg.error)}`));
+                else
+                    pending.resolve(msg.result);
+            }
+        }
+    }
+    failAll(err) {
+        for (const pending of this.pending.values())
+            pending.reject(err);
+        this.pending.clear();
+    }
+}
+function stringifyStatus(status) {
+    if (!status)
+        return undefined;
+    if (typeof status === 'string')
+        return status;
+    if (typeof status === 'object' && typeof status.type === 'string')
+        return status.type;
+    return undefined;
+}
+function normalizeThread(raw) {
+    const threadId = typeof raw.id === 'string' ? raw.id : undefined;
+    const cwd = typeof raw.cwd === 'string' ? raw.cwd : undefined;
+    if (!threadId || !cwd)
+        return null;
+    const updatedAt = typeof raw.updatedAt === 'number' ? raw.updatedAt : undefined;
+    const createdAt = typeof raw.createdAt === 'number' ? raw.createdAt : undefined;
+    const name = typeof raw.name === 'string' && raw.name.trim() ? raw.name.trim() : undefined;
+    const preview = typeof raw.preview === 'string' ? raw.preview.trim() : '';
+    const source = typeof raw.source === 'string' ? raw.source : undefined;
+    return {
+        threadId,
+        name,
+        preview,
+        cwd,
+        updatedAtMs: updatedAt !== undefined ? updatedAt * 1000 : undefined,
+        createdAtMs: createdAt !== undefined ? createdAt * 1000 : undefined,
+        path: typeof raw.path === 'string' ? raw.path : undefined,
+        source,
+        status: stringifyStatus(raw.status),
+    };
+}
+export async function listCodexAppThreads(opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 7000;
+    const codexBin = resolveCommand(opts.codexBin ?? 'codex');
+    const cwd = opts.cwd ?? process.cwd();
+    const client = new CodexAppServerProbe(codexBin, cwd);
+    try {
+        await client.initialize(timeoutMs);
+        const result = await client.withTimeout(client.request('thread/list', {
+            limit: opts.limit ?? 30,
+            sortKey: 'updated_at',
+            sortDirection: 'desc',
+            archived: false,
+            useStateDbOnly: true,
+            searchTerm: opts.searchTerm && opts.searchTerm.trim() ? opts.searchTerm.trim() : null,
+        }), timeoutMs, 'thread/list');
+        const rows = Array.isArray(result?.data) ? result.data : [];
+        const normalized = rows.map((row) => normalizeThread(row));
+        return normalized.filter((thread) => !!thread);
+    }
+    finally {
+        client.close();
+    }
+}
+//# sourceMappingURL=codex-app-threads.js.map

package/dist/services/codex-app-threads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-app-threads.js","sourceRoot":"","sources":["../../src/services/codex-app-threads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AA8B7D,MAAM,mBAAmB;IACf,KAAK,CAAiC;IACtC,MAAM,GAAG,CAAC,CAAC;IACX,YAAY,GAAG,EAAE,CAAC;IAClB,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,UAAU,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,QAAgB,EAAE,GAAW;QACvC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE;YACnE,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,iCAAiC,IAAI,YAAY,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACtI,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;YAChD,UAAU,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,OAAO,EAAE;YACxE,YAAY,EAAE;gBACZ,eAAe,EAAE,IAAI;gBACrB,qBAAqB,EAAE,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;aACnE;SACF,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,MAAc,EAAE,MAAe;QACrC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAChF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,MAAgB;QACrC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,MAAM,GAAG,GAAe,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,WAAW,CAAI,OAAmB,EAAE,SAAiB,EAAE,KAAa;QACxE,IAAI,KAAiC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;gBACxB,OAAO;gBACP,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC3B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,SAAS,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACrH,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,IAAY;QAC3B,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QAC1B,SAAS,CAAC;YACR,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,GAAe,CAAC;YACpB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;gBACxF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzC,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,GAAG,CAAC,KAAK;oBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;;oBACvF,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,GAAU;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAQ,MAAc,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAQ,MAAc,CAAC,IAAI,CAAC;IACxG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,GAAe;IACtC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvE,OAAO;QACL,QAAQ;QACR,IAAI;QACJ,OAAO;QACP,GAAG;QACH,WAAW,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QACnE,WAAW,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QACnE,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACzD,MAAM;QACN,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAmC,EAAE;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE;YACpE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,MAAM;YACrB,QAAQ,EAAE,KAAK;YACf,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;SACtF,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAiB,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,UAAU,GAAwC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAe,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5G,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAmC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/services/grant-prefs-store.d.ts

@@ -0,0 +1,23 @@
+export interface BotGrantPrefs {
+    /** owner 限制被授权人只能纯对话、拦截一切 slash 命令。默认 false。 */
+    restrictGrantCommands: boolean;
+    /** 消息额度默认值：null = 关闭（无限）；正整数 = 不带数字的 /grant 取此值。 */
+    messageQuotaDefaultLimit: number | null;
+}
+/** Current grant prefs for a bot（缺省 restrict=false、quota=null）。 */
+export declare function getBotGrantPrefs(larkAppId: string): BotGrantPrefs;
+/**
+ * 持久化一次 grant-prefs 局部修改。只动 patch 里出现的 key。
+ *   • restrictGrantCommands=false → 删 key（bots.json 保持干净，缺省即默认）
+ *   • messageQuotaDefaultLimit=null → 删整个 messageQuota（关闭默认额度；不动 quotaState 计数）
+ *   • messageQuotaDefaultLimit=正整数 → 写入；非法值（非整数/0/负数）直接拒，返回 bad_quota
+ * 返回写后解析出的完整 prefs。
+ */
+export declare function updateBotGrantPrefs(larkAppId: string, patch: Partial<BotGrantPrefs>): Promise<{
+    ok: true;
+    prefs: BotGrantPrefs;
+} | {
+    ok: false;
+    reason: string;
+}>;
+//# sourceMappingURL=grant-prefs-store.d.ts.map

package/dist/services/grant-prefs-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-prefs-store.d.ts","sourceRoot":"","sources":["../../src/services/grant-prefs-store.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,qBAAqB,EAAE,OAAO,CAAC;IAC/B,oDAAoD;IACpD,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAQD,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAUjE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,GAC5B,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiD7E"}

package/dist/services/grant-prefs-store.js

@@ -0,0 +1,94 @@
+/**
+ * Per-bot 授权（/grant）相关偏好。与 card-prefs-store / brand-store 同款：
+ * 跨进程文件锁 + bots.json 原子写，外加内存 registry 同步，让 daemon 的
+ * 路由 / grant 处理不必重启即可生效。
+ *
+ * 两个独立设置：
+ *   • restrictGrantCommands     — owner 开关：被授权人只能纯对话，拦截一切 slash 命令
+ *   • messageQuota.defaultLimit — 消息额度默认值。字段「是否存在」本身就是额度机制
+ *                                 总开关：缺省 = 关闭（无限）；正整数 = 不带数字的
+ *                                 `/grant @x` 取此值。显式 `/grant @x N` 恒生效，与此无关。
+ */
+import { rmwBotEntry } from './config-store.js';
+import { getBot } from '../bot-registry.js';
+import { logger } from '../utils/logger.js';
+/** 把 entry.messageQuota.defaultLimit 归一成 number|null（只认正整数，其余视作关闭）。 */
+function readQuotaLimit(c) {
+    const d = c.messageQuota?.defaultLimit;
+    return typeof d === 'number' && Number.isInteger(d) && d > 0 ? d : null;
+}
+/** Current grant prefs for a bot（缺省 restrict=false、quota=null）。 */
+export function getBotGrantPrefs(larkAppId) {
+    try {
+        const c = getBot(larkAppId).config;
+        return {
+            restrictGrantCommands: c.restrictGrantCommands === true,
+            messageQuotaDefaultLimit: readQuotaLimit(c),
+        };
+    }
+    catch {
+        return { restrictGrantCommands: false, messageQuotaDefaultLimit: null };
+    }
+}
+/**
+ * 持久化一次 grant-prefs 局部修改。只动 patch 里出现的 key。
+ *   • restrictGrantCommands=false → 删 key（bots.json 保持干净，缺省即默认）
+ *   • messageQuotaDefaultLimit=null → 删整个 messageQuota（关闭默认额度；不动 quotaState 计数）
+ *   • messageQuotaDefaultLimit=正整数 → 写入；非法值（非整数/0/负数）直接拒，返回 bad_quota
+ * 返回写后解析出的完整 prefs。
+ */
+export async function updateBotGrantPrefs(larkAppId, patch) {
+    let bot;
+    try {
+        bot = getBot(larkAppId);
+    }
+    catch {
+        return { ok: false, reason: 'bot_not_registered' };
+    }
+    // 额度值校验：null 表示关闭；否则必须是正整数。
+    if (patch.messageQuotaDefaultLimit !== undefined && patch.messageQuotaDefaultLimit !== null) {
+        const n = patch.messageQuotaDefaultLimit;
+        if (typeof n !== 'number' || !Number.isInteger(n) || n <= 0) {
+            return { ok: false, reason: 'bad_quota' };
+        }
+    }
+    const r = await rmwBotEntry(larkAppId, (entry) => {
+        if (patch.restrictGrantCommands !== undefined) {
+            if (patch.restrictGrantCommands)
+                entry.restrictGrantCommands = true;
+            else
+                delete entry.restrictGrantCommands;
+        }
+        if (patch.messageQuotaDefaultLimit !== undefined) {
+            if (patch.messageQuotaDefaultLimit === null) {
+                // 关闭默认额度只删 messageQuota.defaultLimit 这个开关，保留 quotaState 计数。
+                delete entry.messageQuota;
+            }
+            else {
+                entry.messageQuota = { ...(entry.messageQuota ?? {}), defaultLimit: patch.messageQuotaDefaultLimit };
+            }
+        }
+        return {
+            write: true,
+            result: {
+                restrictGrantCommands: entry.restrictGrantCommands === true,
+                messageQuotaDefaultLimit: readQuotaLimit(entry),
+            },
+        };
+    });
+    if (!r.ok)
+        return { ok: false, reason: r.reason };
+    // 同步内存 config，路由 / grant 处理不重启即生效。
+    if (patch.restrictGrantCommands !== undefined) {
+        bot.config.restrictGrantCommands = patch.restrictGrantCommands || undefined;
+    }
+    if (patch.messageQuotaDefaultLimit !== undefined) {
+        bot.config.messageQuota = patch.messageQuotaDefaultLimit === null
+            ? undefined
+            : { defaultLimit: patch.messageQuotaDefaultLimit };
+    }
+    logger.info(`[grant-prefs:${larkAppId}] restrictGrantCommands=${r.result.restrictGrantCommands} ` +
+        `messageQuotaDefaultLimit=${r.result.messageQuotaDefaultLimit ?? 'off'}`);
+    return { ok: true, prefs: r.result };
+}
+//# sourceMappingURL=grant-prefs-store.js.map

package/dist/services/grant-prefs-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-prefs-store.js","sourceRoot":"","sources":["../../src/services/grant-prefs-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAS5C,uEAAuE;AACvE,SAAS,cAAc,CAAC,CAA+C;IACrE,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QACnC,OAAO;YACL,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,KAAK,IAAI;YACvD,wBAAwB,EAAE,cAAc,CAAC,CAAC,CAAC;SAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,KAA6B;IAE7B,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAAC,CAAC;IAE9F,4BAA4B;IAC5B,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,IAAI,KAAK,CAAC,wBAAwB,KAAK,IAAI,EAAE,CAAC;QAC5F,MAAM,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;QACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,WAAW,CAAgB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9D,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,qBAAqB;gBAAE,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC;;gBAC/D,OAAO,KAAK,CAAC,qBAAqB,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,wBAAwB,KAAK,IAAI,EAAE,CAAC;gBAC5C,4DAA4D;gBAC5D,OAAO,KAAK,CAAC,YAAY,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,YAAY,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,wBAAwB,EAAE,CAAC;YACvG,CAAC;QACH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE;gBACN,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,KAAK,IAAI;gBAC3D,wBAAwB,EAAE,cAAc,CAAC,KAAK,CAAC;aAChD;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAElD,mCAAmC;IACnC,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,qBAAqB,GAAG,KAAK,CAAC,qBAAqB,IAAI,SAAS,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,wBAAwB,KAAK,IAAI;YAC/D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,wBAAwB,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,IAAI,CACT,gBAAgB,SAAS,2BAA2B,CAAC,CAAC,MAAM,CAAC,qBAAqB,GAAG;QACrF,4BAA4B,CAAC,CAAC,MAAM,CAAC,wBAAwB,IAAI,KAAK,EAAE,CACzE,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/dist/services/grant-store.d.ts

@@ -2,7 +2,9 @@ type Fail = {
     ok: false;
     reason: string;
 };
-export declare function addChatGrant(larkAppId: string, chatId: string, openId: string): Promise<{
+export declare function chatQuotaKey(chatId: string, openId: string): string;
+export declare function globalQuotaKey(openId: string): string;
+export declare function addChatGrant(larkAppId: string, chatId: string, openId: string, quota?: number): Promise<{
     ok: true;
     created: boolean;
 } | Fail>;
@@ -10,10 +12,40 @@ export declare function addChatGrant(larkAppId: string, chatId: string, openId:
  * 全局对话授权：把 open_id 加入 globalGrants（被授权在任意群与本 bot 对话的名单，人/bot 通用）。
  * talk-only —— 只进 canTalk / bot 路由闸，绝不写 allowedUsers、不授 canOperate（与 addChatGrant 同源）。
  */
-export declare function addGlobalGrant(larkAppId: string, openId: string): Promise<{
+export declare function addGlobalGrant(larkAppId: string, openId: string, quota?: number): Promise<{
     ok: true;
     created: boolean;
 } | Fail>;
+/**
+ * scope-aware talk-only 移除：删本群 chatGrants[chatId] 中的 openId + 其 chat quota 记录。
+ * 额度用尽/崩溃自愈时调。不碰 allowedUsers、不碰 globalGrants，故无 would_open_bot 守卫。
+ */
+export declare function removeChatGrant(larkAppId: string, chatId: string, openId: string): Promise<{
+    ok: true;
+    removed: boolean;
+} | Fail>;
+/**
+ * scope-aware talk-only 移除：删 globalGrants 中的 openId + 其 global quota 记录。
+ * talk-only，不碰 allowedUsers，无 would_open_bot 守卫（清空它不放大 operate）。
+ */
+export declare function removeGlobalGrant(larkAppId: string, openId: string): Promise<{
+    ok: true;
+    removed: boolean;
+} | Fail>;
+/**
+ * 扣一次额度（一条对话输入）。RMW 锁内递增、内存以锁内磁盘快照 used 为准。
+ * 无记录 → tracked:false（无需 enforce，放行）。
+ * 已达/超上限 → allow:false（应拦本条 + 自愈 revoke）。
+ * 正常递增 → allow:true，exhausted=（used 恰好达 limit），调用方放行本条、若 exhausted 则处理后 revoke。
+ * 基础设施失败（getBot / RMW）会 throw —— 调用方 catch 后 fail-closed（拒发以保硬上限）。
+ */
+export declare function consumeQuota(larkAppId: string, quotaKey: string): Promise<{
+    tracked: boolean;
+    allow: boolean;
+    exhausted: boolean;
+    used: number;
+    limit: number;
+}>;
 /**
  * 整群 talk 授权：把 chatId 加入 allowedChatGroups（"talk-open 的 chat_id 列表"）。
  * 命中后该 chat 任何成员都过 canTalk（见 event-dispatcher.canTalk），不授 canOperate。

package/dist/services/grant-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-store.d.ts","sourceRoot":"","sources":["../../src/services/grant-store.ts"],"names":[],"mappings":"AAQA,KAAK,IAAI,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAiB1C,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChD,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAkBhD;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAehD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAehD;AAED,oDAAoD;AACpD,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAkBhD;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChD,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CA+DhG"}
+{"version":3,"file":"grant-store.d.ts","sourceRoot":"","sources":["../../src/services/grant-store.ts"],"names":[],"mappings":"AAQA,KAAK,IAAI,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAK1C,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAuC;AAC3G,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAA+B;AA0CrF,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAChE,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAsBhD;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAChD,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAkBhD;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChD,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAuBhD;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAsBhD;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAClC,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBhG;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAehD;AAED,oDAAoD;AACpD,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAkBhD;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAChD,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CAqEhG"}

package/dist/services/grant-store.js

@@ -5,6 +5,39 @@
 import { getBot, getOwnerOpenId } from '../bot-registry.js';
 import { rmwBotEntry } from './config-store.js';
 import { logger } from '../utils/logger.js';
+// ─── 消息额度（scope-aware quota）─────────────────────────────────────────────
+// quotaKey 的单一格式来源：chat 授权按群+人，global 授权按人。evaluateTalk 拼 key 时
+// 复用这两个 builder，保证 store / enforce 两侧格式一致。
+export function chatQuotaKey(chatId, openId) { return `chat:${chatId}:${openId}`; }
+export function globalQuotaKey(openId) { return `global:${openId}`; }
+/** 取 quotaState（容错：非对象/数组 → undefined）。entry（磁盘原始）与 bot.config 同形，通用。 */
+function getQuotaMap(o) {
+    return (o.quotaState && typeof o.quotaState === 'object' && !Array.isArray(o.quotaState)) ? o.quotaState : undefined;
+}
+/** 写/删一条 quota 记录（rec=null 删）。返回是否实际改动。空 map 删键。 */
+function setQuotaRecord(o, qk, rec) {
+    const qs = getQuotaMap(o);
+    if (rec) {
+        o.quotaState = { ...(qs ?? {}), [qk]: rec };
+        return true;
+    }
+    if (qs && qk in qs) {
+        const next = { ...qs };
+        delete next[qk];
+        if (Object.keys(next).length > 0)
+            o.quotaState = next;
+        else
+            delete o.quotaState;
+        return true;
+    }
+    return false;
+}
+/** 授权时套额度：quota>0 → 重置为 {limit,used:0}（续杯语义）；undefined → 删记录（转无限）。 */
+function applyGrantQuota(o, qk, quota) {
+    return quota !== undefined && quota > 0
+        ? setQuotaRecord(o, qk, { limit: quota, used: 0 })
+        : setQuotaRecord(o, qk, null);
+}
 /** 把目标 open_id 映射回 allowedUsers 里的 raw 条目（可能是 email，也可能就是 open_id）。 */
 function rawEntryForOpenId(larkAppId, openId) {
     const bot = getBot(larkAppId);
@@ -19,7 +52,7 @@ function rawEntryForOpenId(larkAppId, openId) {
 function resolvedAfterRemoval(larkAppId, openId) {
     return getBot(larkAppId).resolvedAllowedUsers.filter(u => u !== openId);
 }
-export async function addChatGrant(larkAppId, chatId, openId) {
+export async function addChatGrant(larkAppId, chatId, openId, quota) {
     let bot;
     try {
         bot = getBot(larkAppId);
@@ -27,6 +60,7 @@ export async function addChatGrant(larkAppId, chatId, openId) {
     catch {
         return { ok: false, reason: 'bot_not_registered' };
     }
+    const qk = chatQuotaKey(chatId, openId);
     const r = await rmwBotEntry(larkAppId, (entry) => {
         const map = (entry.chatGrants && typeof entry.chatGrants === 'object') ? entry.chatGrants : {};
         const cur = Array.isArray(map[chatId]) ? map[chatId] : [];
@@ -35,22 +69,26 @@ export async function addChatGrant(larkAppId, chatId, openId) {
             cur.push(openId);
         map[chatId] = cur;
         entry.chatGrants = map;
-        return { write: created, result: { created } };
+        // 带额度即（重）设记录；无额度则删除已有记录（转无限）。重新授权 = 续杯/重置。
+        const qChanged = applyGrantQuota(entry, qk, quota);
+        return { write: created || qChanged, result: { created } };
     });
     if (!r.ok)
         return r;
     if (r.result.created) {
         const map = (bot.config.chatGrants ??= {});
-        map[chatId] = [...(map[chatId] ?? []), openId];
-        logger.info(`[grant:${larkAppId}] +chat ${chatId} ${openId}`);
+        if (!map[chatId]?.includes(openId))
+            map[chatId] = [...(map[chatId] ?? []), openId];
     }
+    applyGrantQuota(bot.config, qk, quota); // 同步内存
+    logger.info(`[grant:${larkAppId}] +chat ${chatId} ${openId}${quota ? ` quota=${quota}` : ''}`);
     return { ok: true, created: r.result.created };
 }
 /**
  * 全局对话授权：把 open_id 加入 globalGrants（被授权在任意群与本 bot 对话的名单，人/bot 通用）。
  * talk-only —— 只进 canTalk / bot 路由闸，绝不写 allowedUsers、不授 canOperate（与 addChatGrant 同源）。
  */
-export async function addGlobalGrant(larkAppId, openId) {
+export async function addGlobalGrant(larkAppId, openId, quota) {
     let bot;
     try {
         bot = getBot(larkAppId);
@@ -58,22 +96,129 @@ export async function addGlobalGrant(larkAppId, openId) {
     catch {
         return { ok: false, reason: 'bot_not_registered' };
     }
+    const qk = globalQuotaKey(openId);
     const r = await rmwBotEntry(larkAppId, (entry) => {
         const cur = Array.isArray(entry.globalGrants) ? entry.globalGrants : [];
         const created = !cur.includes(openId);
         if (created)
             cur.push(openId);
         entry.globalGrants = cur;
-        return { write: created, result: { created } };
+        const qChanged = applyGrantQuota(entry, qk, quota);
+        return { write: created || qChanged, result: { created } };
     });
     if (!r.ok)
         return r;
-    if (r.result.created) {
+    if (r.result.created && !bot.config.globalGrants?.includes(openId)) {
         bot.config.globalGrants = [...(bot.config.globalGrants ?? []), openId];
-        logger.info(`[grant:${larkAppId}] +global ${openId}`);
     }
+    applyGrantQuota(bot.config, qk, quota); // 同步内存
+    logger.info(`[grant:${larkAppId}] +global ${openId}${quota ? ` quota=${quota}` : ''}`);
     return { ok: true, created: r.result.created };
 }
+/**
+ * scope-aware talk-only 移除：删本群 chatGrants[chatId] 中的 openId + 其 chat quota 记录。
+ * 额度用尽/崩溃自愈时调。不碰 allowedUsers、不碰 globalGrants，故无 would_open_bot 守卫。
+ */
+export async function removeChatGrant(larkAppId, chatId, openId) {
+    let bot;
+    try {
+        bot = getBot(larkAppId);
+    }
+    catch {
+        return { ok: false, reason: 'bot_not_registered' };
+    }
+    const qk = chatQuotaKey(chatId, openId);
+    const r = await rmwBotEntry(larkAppId, (entry) => {
+        let removed = false;
+        const map = (entry.chatGrants && typeof entry.chatGrants === 'object') ? entry.chatGrants : {};
+        if (Array.isArray(map[chatId]) && map[chatId].includes(openId)) {
+            map[chatId] = map[chatId].filter((u) => u !== openId);
+            if (map[chatId].length === 0)
+                delete map[chatId];
+            entry.chatGrants = map;
+            removed = true;
+        }
+        const qChanged = setQuotaRecord(entry, qk, null);
+        return { write: removed || qChanged, result: { removed } };
+    });
+    if (!r.ok)
+        return r;
+    if (r.result.removed && bot.config.chatGrants?.[chatId]) {
+        bot.config.chatGrants[chatId] = bot.config.chatGrants[chatId].filter(u => u !== openId);
+        if (bot.config.chatGrants[chatId].length === 0)
+            delete bot.config.chatGrants[chatId];
+    }
+    setQuotaRecord(bot.config, qk, null);
+    logger.info(`[grant:${larkAppId}] -chat ${chatId} ${openId} (quota exhausted/heal)`);
+    return { ok: true, removed: r.result.removed };
+}
+/**
+ * scope-aware talk-only 移除：删 globalGrants 中的 openId + 其 global quota 记录。
+ * talk-only，不碰 allowedUsers，无 would_open_bot 守卫（清空它不放大 operate）。
+ */
+export async function removeGlobalGrant(larkAppId, openId) {
+    let bot;
+    try {
+        bot = getBot(larkAppId);
+    }
+    catch {
+        return { ok: false, reason: 'bot_not_registered' };
+    }
+    const qk = globalQuotaKey(openId);
+    const r = await rmwBotEntry(larkAppId, (entry) => {
+        let removed = false;
+        const gg = Array.isArray(entry.globalGrants) ? entry.globalGrants : [];
+        if (gg.includes(openId)) {
+            const next = gg.filter((u) => u !== openId);
+            if (next.length > 0)
+                entry.globalGrants = next;
+            else
+                delete entry.globalGrants;
+            removed = true;
+        }
+        const qChanged = setQuotaRecord(entry, qk, null);
+        return { write: removed || qChanged, result: { removed } };
+    });
+    if (!r.ok)
+        return r;
+    if (r.result.removed) {
+        const next = (bot.config.globalGrants ?? []).filter(u => u !== openId);
+        if (next.length > 0)
+            bot.config.globalGrants = next;
+        else
+            delete bot.config.globalGrants;
+    }
+    setQuotaRecord(bot.config, qk, null);
+    logger.info(`[grant:${larkAppId}] -global ${openId} (quota exhausted/heal)`);
+    return { ok: true, removed: r.result.removed };
+}
+/**
+ * 扣一次额度（一条对话输入）。RMW 锁内递增、内存以锁内磁盘快照 used 为准。
+ * 无记录 → tracked:false（无需 enforce，放行）。
+ * 已达/超上限 → allow:false（应拦本条 + 自愈 revoke）。
+ * 正常递增 → allow:true，exhausted=（used 恰好达 limit），调用方放行本条、若 exhausted 则处理后 revoke。
+ * 基础设施失败（getBot / RMW）会 throw —— 调用方 catch 后 fail-closed（拒发以保硬上限）。
+ */
+export async function consumeQuota(larkAppId, quotaKey) {
+    const bot = getBot(larkAppId); // throw → 调用方 fail-closed
+    const r = await rmwBotEntry(larkAppId, (entry) => {
+        const qs = getQuotaMap(entry);
+        const rec = qs?.[quotaKey];
+        if (!rec)
+            return { write: false, result: { tracked: false, allow: true, exhausted: false, used: 0, limit: 0 } };
+        if (rec.used >= rec.limit) {
+            return { write: false, result: { tracked: true, allow: false, exhausted: true, used: rec.used, limit: rec.limit } };
+        }
+        const used = rec.used + 1;
+        entry.quotaState = { ...qs, [quotaKey]: { limit: rec.limit, used } };
+        return { write: true, result: { tracked: true, allow: true, exhausted: used >= rec.limit, used, limit: rec.limit } };
+    });
+    if (!r.ok)
+        throw new Error(`consumeQuota RMW failed: ${r.reason}`);
+    if (r.result.tracked)
+        setQuotaRecord(bot.config, quotaKey, { limit: r.result.limit, used: r.result.used });
+    return r.result;
+}
 /**
  * 整群 talk 授权：把 chatId 加入 allowedChatGroups（"talk-open 的 chat_id 列表"）。
  * 命中后该 chat 任何成员都过 canTalk（见 event-dispatcher.canTalk），不授 canOperate。
@@ -188,7 +333,10 @@ export async function revokeGrant(larkAppId, chatId, openId) {
                 delete entry.globalGrants;
             globalTalk = true;
         }
-        return { write: chat || global || globalTalk, result: { chat, global, globalTalk } };
+        // 手动 /revoke 一并清两 scope 的额度记录（与三支授权同 RMW 原子）。
+        const qChat = setQuotaRecord(entry, chatQuotaKey(chatId, openId), null);
+        const qGlobal = setQuotaRecord(entry, globalQuotaKey(openId), null);
+        return { write: chat || global || globalTalk || qChat || qGlobal, result: { chat, global, globalTalk } };
     });
     if (!r.ok)
         return r;
@@ -214,6 +362,9 @@ export async function revokeGrant(larkAppId, chatId, openId) {
         else
             delete bot.config.globalGrants;
     }
+    // 同步内存额度记录（两 scope）
+    setQuotaRecord(bot.config, chatQuotaKey(chatId, openId), null);
+    setQuotaRecord(bot.config, globalQuotaKey(openId), null);
     logger.info(`[grant:${larkAppId}] revoke chat=${chatId} ${openId} removed=${JSON.stringify(r.result)}`);
     return { ok: true, removed: r.result };
 }