botmux 2.63.1 → 2.65.0

package/dist/daemon.js

@@ -5,7 +5,10 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
-import { config } from './config.js';
+import { config, getDashboardExternalHost } from './config.js';
+import { writeHeartbeat } from './core/daemon-heartbeat.js';
+import { startMaintenance, stopMaintenance } from './core/maintenance.js';
+import { sendRestartReportIfPending } from './core/restart-report.js';
 import { statSync } from 'node:fs';
 import { getChatMode, listChatMemberOpenIds, replyMessage, resolveAllowedUsersWithMap, sendMessage, sendUserMessage, updateMessage } from './im/lark/client.js';
 import { chatHasAllowedUser, resolveGroupJoinPrompt } from './core/auto-start.js';
@@ -15,6 +18,8 @@ import * as chatFirstSeenStore from './services/chat-first-seen-store.js';
 import { ensureDefaultOncallBound } from './services/oncall-store.js';
 import * as scheduleStore from './services/schedule-store.js';
 import * as messageQueue from './services/message-queue.js';
+import { emitHookEvent, HOOK_EVENTS } from './services/hook-runner.js';
+import { setSessionLifecycleShutdown } from './services/session-lifecycle-hooks.js';
 import { parseEventMessage, resolveNonsupportMessage, stripLeadingMentions } from './im/lark/message-parser.js';
 import { expandMergeForward } from './im/lark/merge-forward.js';
 import { buildQuoteHint } from './im/lark/quote-hint.js';
@@ -27,9 +32,8 @@ import { buildTerminalUrl, setTerminalProxyPort } from './core/terminal-url.js';
 import { startTerminalProxy } from './core/terminal-proxy.js';
 import * as scheduler from './core/scheduler.js';
 import { scanMultipleProjects } from './services/project-scanner.js';
-import { buildPendingResponseCard, buildQuotaExhaustedCard, buildRepoSelectCard, buildStreamingCard, getCliDisplayName } from './im/lark/card-builder.js';
-import { createPendingResponseQueue, markPendingResponseCardPatched, shouldReplyPendingInThread, shouldTreatPendingCardAsPatchedByMarker, startPendingResponseTurn, syncPendingResponseState } from './core/pending-response.js';
-import { readPendingResponsePatchMarker } from './services/pending-response-transaction-store.js';
+import { buildQuotaExhaustedCard, buildRepoSelectCard, buildStreamingCard, getCliDisplayName } from './im/lark/card-builder.js';
+import { createPendingResponseQueue, markPendingResponseCardPatched, syncPendingResponseState } from './core/pending-response.js';
 import { t as tr, botLocale, localeForBot } from './i18n/index.js';
 import { createCliAdapterSync } from './adapters/cli/registry.js';
 import { initWorkerPool, setActiveSessionsRegistry, forkWorker, killWorker, scheduleCardPatch, setCurrentCliVersion, CARD_POSTING_SENTINEL, parkStreamCard, closeSession as closeSessionHelper, ensureCliEnv, writableTerminalLinkFor, } from './core/worker-pool.js';
@@ -41,6 +45,8 @@ import { isCallbackUrl, handleCallbackUrl } from './utils/user-token.js';
 import { consumeQuota, removeChatGrant, removeGlobalGrant } from './services/grant-store.js';
 import { abortCharge, commitCharge, beginCharge } from './services/quota-dedup.js';
 import { getSessionWorkingDir, getProjectScanDirs, expandHome, downloadResources, formatAttachmentsHint, buildNewTopicPrompt, buildFollowUpContent, buildBridgeInputContent, buildReforkPrompt, getAvailableBots, restoreActiveSessions, executeScheduledTask, persistStreamCardState, rememberLastCliInput, ensureTerminalWorkerPort, } from './core/session-manager.js';
+import { beginReplyTargetTurn, resolveSessionReplyTarget, syncReplyTargetState } from './core/reply-target.js';
+import { sweepIdleWorkers } from './core/idle-worker-sweeper.js';
 import { handleCardAction } from './im/lark/card-handler.js';
 import { executeWorkflowCommand, parseWorkflowCommand, resolveBotSnapshot, } from './im/lark/workflow-slash-command.js';
 import { workflowRunDetailUrl } from './im/lark/workflow-cards.js';
@@ -68,12 +74,32 @@ import { resolveWait } from './workflows/wait.js';
 import { replay } from './workflows/events/replay.js';
 import { isValidRunId, readRunSnapshot } from './workflows/ops-projection.js';
 import { AttemptResumeManager } from './workflows/attempt-resume.js';
-import { setCardDispatcher as setAskCardDispatcher, registerAsk as registerAskBroker, } from './core/ask-broker.js';
+import { setCardDispatcher as setAskCardDispatcher, registerAsk as registerAskBroker, findPendingAskByAnchor, submitCustomReply, } from './core/ask-broker.js';
 import { parseAskBody, resolveAskApprovers } from './core/ask-api.js';
 import { createLarkAskCardDispatcher } from './im/lark/ask-card.js';
 // ─── State ───────────────────────────────────────────────────────────────────
 const activeSessions = new Map();
 const workflowEventWatchers = new Map();
+function sessionHasReplyThreadAlias(s, rootId) {
+    return s.scope === 'chat' && !!s.replyThreadAliases?.[rootId];
+}
+function findChatReplyAlias(rootId, chatId, larkAppId) {
+    // A real thread-scope session at this root wins over any historical alias.
+    if (activeSessions.get(sessionKey(rootId, larkAppId))?.scope === 'thread')
+        return null;
+    for (const ds of activeSessions.values()) {
+        if (ds.larkAppId !== larkAppId || ds.scope !== 'chat' || ds.chatId !== chatId)
+            continue;
+        if (sessionHasReplyThreadAlias(ds.session, rootId))
+            return { chatId: ds.chatId, sessionId: ds.session.sessionId };
+    }
+    const diskSessions = sessionStore.listSessions();
+    if (diskSessions.some(s => s.status === 'active' && s.larkAppId === larkAppId && s.scope !== 'chat' && s.rootMessageId === rootId)) {
+        return null;
+    }
+    const hit = diskSessions.find(s => s.status === 'active' && s.larkAppId === larkAppId && s.chatId === chatId && sessionHasReplyThreadAlias(s, rootId));
+    return hit ? { chatId: hit.chatId, sessionId: hit.sessionId } : null;
+}
 const workflowRuns = new Map();
 // v0.1.5 slice 1: run-level progress card index.  daemon-internal only
 // (codex contract boundary 2: daemon restart drops the cardMessageId
@@ -213,29 +239,24 @@ function readSessionFreshFromDisk(sessionId, larkAppId) {
     }
     return undefined;
 }
-async function postPendingResponseCard(ds, replyToMessageId, prompt, sender) {
-    if (!streamingCardDisabledFor(ds))
-        return;
+async function postPendingResponseCard(ds, replyToMessageId, prompt, sender, turnId) {
+    // Card-off means no visible botmux cards at all. If a prior build left an
+    // open pending-response placeholder on this session, clear its state so a
+    // later `botmux send --mention...` cannot patch it to “final reply sent via
+    // new message”. Do not call any Lark send/update API here.
     await pendingResponseQueue.run(ds.session.sessionId, async () => {
-        syncPendingResponseState(ds, readSessionFreshFromDisk(ds.session.sessionId, ds.larkAppId));
-        const marker = readPendingResponsePatchMarker(ds.session.sessionId);
-        if (shouldTreatPendingCardAsPatchedByMarker(ds.pendingResponseCardId, marker)) {
+        const fresh = readSessionFreshFromDisk(ds.session.sessionId, ds.larkAppId);
+        syncPendingResponseState(ds, fresh);
+        if (fresh)
+            syncReplyTargetState(ds, fresh);
+        if (ds.pendingResponseCardId || ds.session.pendingResponseCardId) {
             markPendingResponseCardPatched(ds);
-        }
-        syncPendingResponseState(ds.session, ds);
-        const card = buildPendingResponseCard(localeForBot(ds.larkAppId));
-        try {
-            const messageId = await replyMessage(ds.larkAppId, replyToMessageId, card, 'interactive', shouldReplyPendingInThread(ds.scope));
-            startPendingResponseTurn(ds, messageId);
-            startPendingResponseTurn(ds.session, messageId);
+            markPendingResponseCardPatched(ds.session);
             sessionStore.updateSession(ds.session);
         }
-        catch (err) {
-            logger.warn(`[${tag(ds)}] failed to post pending response card: ${err instanceof Error ? err.message : String(err)}`);
-        }
     });
 }
-async function sessionReply(anchor, content, msgType = 'text', larkAppId) {
+async function sessionReply(anchor, content, msgType = 'text', larkAppId, turnId) {
     let ds;
     if (larkAppId) {
         ds = activeSessions.get(sessionKey(anchor, larkAppId));
@@ -251,6 +272,11 @@ async function sessionReply(anchor, content, msgType = 'text', larkAppId) {
     const appId = larkAppId ?? ds?.larkAppId ?? getAllBots()[0]?.config.larkAppId;
     if (!appId)
         throw new Error('No bot configured');
+    const hookContext = ds ? {
+        sessionId: ds.session.sessionId,
+        scope: ds.scope,
+        anchor: sessionAnchorId(ds),
+    } : undefined;
     // Chat-scope: post a plain message to the chat. No reply_in_thread → keeps
     // the conversation flat in 普通群. The card layer carries chatId in its button
     // values, so handleCardAction routes back via sessionKey(chatId).
@@ -267,17 +293,25 @@ async function sessionReply(anchor, content, msgType = 'text', larkAppId) {
     // to know we should sendMessage, not reply_in_thread to a non-message-id.
     if (ds?.scope === 'chat' || anchor.startsWith('oc_')) {
         const chatId = ds?.chatId ?? anchor;
-        if (ds?.scope === 'chat' && ds.session.rootMessageId) {
-            const mode = await getChatMode(appId, chatId, { forceRefresh: true });
-            if (mode === 'topic') {
-                logger.warn(`[routing] Chat-scope session ${ds.session.sessionId.substring(0, 8)} is now topic-mode; replying in original thread ${ds.session.rootMessageId.substring(0, 12)}`);
-                return replyMessage(appId, ds.session.rootMessageId, content, msgType, true);
+        if (ds?.scope === 'chat') {
+            const fresh = readSessionFreshFromDisk(ds.session.sessionId, ds.larkAppId);
+            if (fresh)
+                syncReplyTargetState(ds, fresh);
+            const target = resolveSessionReplyTarget(ds, turnId);
+            if (target.mode === 'thread')
+                return replyMessage(appId, target.rootMessageId, content, msgType, true, undefined, hookContext);
+            if (ds.session.rootMessageId) {
+                const mode = await getChatMode(appId, chatId, { forceRefresh: true });
+                if (mode === 'topic') {
+                    logger.warn(`[routing] Chat-scope session ${ds.session.sessionId.substring(0, 8)} is now topic-mode; replying in original thread ${ds.session.rootMessageId.substring(0, 12)}`);
+                    return replyMessage(appId, ds.session.rootMessageId, content, msgType, true, undefined, hookContext);
+                }
             }
         }
-        return sendMessage(appId, chatId, content, msgType);
+        return sendMessage(appId, chatId, content, msgType, undefined, hookContext);
     }
     // Thread-scope (or unknown / legacy): reply in thread.
-    return replyMessage(appId, anchor, content, msgType, true);
+    return replyMessage(appId, anchor, content, msgType, true, undefined, hookContext);
 }
 async function revokeQuotaGrant(larkAppId, chatId, senderOpenId, ev) {
     const result = ev.reason === 'chatGrant'
@@ -1374,6 +1408,33 @@ ipcRoute('POST', '/api/asks', async (req, res) => {
     });
     return jsonRes(res, 200, result);
 });
+// ─── hooks emit 转发端点 ────────────────────────────────────────────────────
+// CLI side（botmux send 等）调用 emitHookEvent 时，把事件转发到 daemon 这条
+// 接口；daemon 在自己的长寿命事件循环里负责 spawn hook、跑 timeout、超时杀
+// 整个进程组。短命 CLI 进程的 timer.unref 会让超时承诺失效、跑飞的 hook 留
+// 孤儿，让 daemon 接管根治这一缺口。daemon 进程自身不带 BOTMUX_SESSION_ID
+// 环境变量，所以这里调 emitHookEvent 不会再触发转发回退（无递归）。
+ipcRoute('POST', '/api/hooks/emit', async (req, res) => {
+    let raw;
+    try {
+        raw = await readJsonBody(req);
+    }
+    catch {
+        return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+    }
+    if (!raw || typeof raw !== 'object') {
+        return jsonRes(res, 400, { ok: false, error: 'bad_body' });
+    }
+    const { event, payload } = raw;
+    if (typeof event !== 'string' || !HOOK_EVENTS.includes(event)) {
+        return jsonRes(res, 400, { ok: false, error: 'bad_event' });
+    }
+    if (!payload || typeof payload !== 'object') {
+        return jsonRes(res, 400, { ok: false, error: 'bad_payload' });
+    }
+    emitHookEvent(event, payload);
+    return jsonRes(res, 202, { ok: true });
+});
 // ─── adopt-session 查询端点 ───────────────────────────────────────────────────
 // CLI side（botmux hook）通过祖先 PID 匹配 adopt 会话，路由 askUserQuestion。
 // GET /api/adopt-session/:pid — 返回该 pid 对应的 adopt 会话路由信息。
@@ -1493,7 +1554,7 @@ async function replyInvalidWorkingDirs(anchor, larkAppId, ds) {
     return true;
 }
 async function handleNewTopic(data, ctx) {
-    const { chatId, messageId, chatType, larkAppId } = ctx;
+    const { chatId, messageId, chatType, larkAppId, replyRootId } = ctx;
     // scope/anchor are mutable here: `/t` / `/topic` may flip a 普通群 chat-scope
     // routing into thread-scope so the bot's first reply seeds a Lark thread.
     let scope = ctx.scope;
@@ -1538,6 +1599,18 @@ async function handleNewTopic(data, ctx) {
     const senderUnionId = data.sender?.sender_id?.union_id;
     const botCfg = getBot(larkAppId).config;
     logger.info(`New session: "${content.substring(0, 60)}" (scope=${scope}, anchor=${anchor.substring(0, 12)}, resources: ${resources.length}, active: ${getActiveCount()}, messageId: ${messageId}, chatId: ${chatId})`);
+    emitHookEvent('topic.new', {
+        larkAppId,
+        chatId,
+        chatType,
+        scope,
+        anchor,
+        messageId,
+        senderOpenId,
+        senderType: parsed.senderType,
+        msgType: parsed.msgType,
+        content,
+    });
     if (parseWorkflowCommand(cmdContent)) {
         if (await replyGrantRestrictionIfNeeded(larkAppId, chatId, senderOpenId, anchor, '/workflow')) {
             return;
@@ -1720,6 +1793,8 @@ async function handleNewTopic(data, ctx) {
         ds.session.workingDir = pinnedWorkingDir;
         sessionStore.updateSession(ds.session);
     }
+    beginReplyTargetTurn(ds, replyRootId, messageId);
+    sessionStore.updateSession(ds.session);
     activeSessions.set(sessionKey(anchor, larkAppId), ds);
     // Pinned (oncall binding or inherited from sibling bot): spawn CLI immediately.
     if (pinnedWorkingDir) {
@@ -1728,7 +1803,7 @@ async function handleNewTopic(data, ctx) {
         const selfBot = getBot(larkAppId);
         const prompt = buildNewTopicPrompt(promptContent, session.sessionId, botCfg.cliId, botCfg.cliPathOverride, attachments, parsed.mentions, await getAvailableBots(larkAppId, chatId), undefined, { name: selfBot.botName, openId: selfBot.botOpenId }, localeForBot(larkAppId), newTopicSender, { larkAppId, chatId });
         rememberLastCliInput(ds, promptContent, prompt);
-        await postPendingResponseCard(ds, messageId, content, newTopicSender);
+        await postPendingResponseCard(ds, messageId, content, newTopicSender, messageId);
         forkWorker(ds, prompt);
         const reason = oncallEntry
             ? `oncall-bound chat ${chatId}`
@@ -1760,7 +1835,7 @@ async function handleNewTopic(data, ctx) {
         const selfBot = getBot(larkAppId);
         const prompt = buildNewTopicPrompt(promptContent, session.sessionId, botCfg.cliId, botCfg.cliPathOverride, attachments, parsed.mentions, await getAvailableBots(larkAppId, chatId), undefined, { name: selfBot.botName, openId: selfBot.botOpenId }, localeForBot(larkAppId), newTopicSender, { larkAppId, chatId });
         rememberLastCliInput(ds, promptContent, prompt);
-        await postPendingResponseCard(ds, messageId, content, newTopicSender);
+        await postPendingResponseCard(ds, messageId, content, newTopicSender, messageId);
         forkWorker(ds, prompt);
         logger.info(`Session ${session.sessionId} ready (no projects to select), total active: ${getActiveCount()}`);
     }
@@ -1987,7 +2062,7 @@ function lookupForeignBotName(senderOpenId, larkAppId) {
     return 'Bot';
 }
 async function handleThreadReply(data, ctx) {
-    const { chatId: ctxChatId, chatType: ctxChatType, scope, anchor, larkAppId } = ctx;
+    const { chatId: ctxChatId, chatType: ctxChatType, scope, anchor, larkAppId, replyRootId } = ctx;
     await resolveNonsupportMessage(data, larkAppId);
     const { parsed, resources } = parseEventMessage(data);
     // Expand merge_forward: fetch sub-messages and collect their resources
@@ -2021,6 +2096,22 @@ async function handleThreadReply(data, ctx) {
         ? `${tr('daemon.foreign_bot_mention_prefix', { botName: foreignBotName }, localeForBot(larkAppId))}\n`
         : '';
     const promptContent = buildQuoteHint(parsed, scope, anchor) + botSenderPrefix + parsed.content;
+    const existingHookSession = activeSessions.get(sessionKey(anchor, larkAppId));
+    emitHookEvent('thread.reply', {
+        larkAppId,
+        chatId: ctxChatId,
+        chatType: ctxChatType,
+        scope,
+        anchor,
+        messageId: parsed.messageId,
+        rootId: parsed.rootId,
+        parentId: parsed.parentId,
+        senderOpenId: senderOpenIdForPrefix,
+        senderType: parsed.senderType,
+        msgType: parsed.msgType,
+        sessionId: existingHookSession?.session.sessionId,
+        content: parsed.content,
+    });
     if (isForeignBot) {
         logger.info(`[${larkAppId}] foreign-bot @mention prefix attached: sender=${senderOpenIdForPrefix?.substring(0, 12)} ` +
             `senderType=${parsed.senderType} via=${isBotSenderType ? 'sender_type' : 'cross-ref'}`);
@@ -2163,6 +2254,30 @@ async function handleThreadReply(data, ctx) {
             return;
         }
     }
+    // 自定义回复拦截：该话题有未结的 ask 且发送者有答复权限 → 把这条文字当答案，
+    // 走 submitCustomReply settle 掉 ask（替代选项语义），不再当作新一轮指令喂给 CLI。
+    // 此时发起 ask 的 CLI 正阻塞等结果，回什么都得先等 ask 结束，故无副作用。
+    // 仅拦截纯文字（slash 命令 / 回调 URL / workflow 已在上方各自 return，可用来中止）；
+    // 外部 bot 的 open_id 不在 approvers 里，天然不会命中。非授权人 / 空文字则落到正常
+    // 路由。卡片由 broker.onSettle 自动 PATCH 反映答案，无需额外回消息。
+    if (threadSenderOpenId && threadChatId) {
+        const askReplyText = cmdContent.trim();
+        if (askReplyText) {
+            const pendingAsk = findPendingAskByAnchor({ larkAppId, chatId: threadChatId, anchor });
+            if (pendingAsk && pendingAsk.approvers.has(threadSenderOpenId)) {
+                const outcome = submitCustomReply({
+                    askId: pendingAsk.askId,
+                    by: threadSenderOpenId,
+                    text: askReplyText,
+                });
+                if (outcome === 'accepted') {
+                    logger.info(`[${anchor.substring(0, 12)}] ask custom reply accepted from ${threadSenderOpenId.substring(0, 12)}`);
+                    return;
+                }
+                logger.info(`[${anchor.substring(0, 12)}] ask custom reply not accepted (${outcome}); falling through to normal routing`);
+            }
+        }
+    }
     logger.info(`Reply in ${scope}-scope session ${anchor.substring(0, 12)}: ${content.substring(0, 100)} (resources: ${resources.length})`);
     let ds = activeSessions.get(sessionKey(anchor, larkAppId));
     // If another bot already owns this anchor, ignore unmentioned replies here as a
@@ -2210,6 +2325,7 @@ async function handleThreadReply(data, ctx) {
         ds.session.quoteTargetId = parsed.messageId;
         ds.session.quoteTargetSenderOpenId = callerOpenId;
         ds.session.quoteTargetSenderIsBot = isForeignBot;
+        beginReplyTargetTurn(ds, replyRootId, parsed.messageId);
         if (callerOpenId && ds.session.lastCallerOpenId !== callerOpenId) {
             ds.session.lastCallerOpenId = callerOpenId;
         }
@@ -2350,6 +2466,8 @@ async function handleThreadReply(data, ctx) {
             newDs.session.workingDir = pinnedWorkingDir;
             sessionStore.updateSession(newDs.session);
         }
+        beginReplyTargetTurn(newDs, replyRootId, parsed.messageId);
+        sessionStore.updateSession(newDs.session);
         activeSessions.set(sessionKey(anchor, larkAppId), newDs);
         // Pinned (oncall binding or inherited from peer bot in same thread):
         // spawn CLI immediately, skip repo selection.
@@ -2359,7 +2477,7 @@ async function handleThreadReply(data, ctx) {
             const selfBot = getBot(larkAppId);
             const prompt = buildNewTopicPrompt(promptContent, session.sessionId, botCfg.cliId, botCfg.cliPathOverride, attachments, parsed.mentions, await getAvailableBots(larkAppId, autoCreateChatId), undefined, { name: selfBot.botName, openId: selfBot.botOpenId }, localeForBot(larkAppId), autoCreateSender, { larkAppId, chatId: autoCreateChatId });
             rememberLastCliInput(newDs, promptContent, prompt);
-            await postPendingResponseCard(newDs, parsed.messageId, parsed.content, autoCreateSender);
+            await postPendingResponseCard(newDs, parsed.messageId, parsed.content, autoCreateSender, parsed.messageId);
             forkWorker(newDs, prompt);
             const reason = oncallEntry
                 ? `oncall-bound chat ${autoCreateChatId}`
@@ -2391,7 +2509,7 @@ async function handleThreadReply(data, ctx) {
             const selfBot = getBot(larkAppId);
             const prompt = buildNewTopicPrompt(promptContent, session.sessionId, botCfg.cliId, botCfg.cliPathOverride, attachments, parsed.mentions, await getAvailableBots(larkAppId, autoCreateChatId), undefined, { name: selfBot.botName, openId: selfBot.botOpenId }, localeForBot(larkAppId), autoCreateSender, { larkAppId, chatId: autoCreateChatId });
             rememberLastCliInput(newDs, promptContent, prompt);
-            await postPendingResponseCard(newDs, parsed.messageId, parsed.content, autoCreateSender);
+            await postPendingResponseCard(newDs, parsed.messageId, parsed.content, autoCreateSender, parsed.messageId);
             forkWorker(newDs, prompt);
         }
         return;
@@ -2427,8 +2545,8 @@ async function handleThreadReply(data, ctx) {
             });
         beginNewTurn(ds, parsed.content);
         rememberLastCliInput(ds, promptContent, msgContent);
-        await postPendingResponseCard(ds, parsed.messageId, parsed.content, await getThreadSender());
-        ds.worker.send({ type: 'message', content: msgContent });
+        await postPendingResponseCard(ds, parsed.messageId, parsed.content, await getThreadSender(), parsed.messageId);
+        ds.worker.send({ type: 'message', content: msgContent, turnId: parsed.messageId });
     }
     else {
         // Worker not running — re-fork with resume. This is a NEW turn, so drop
@@ -2476,11 +2594,47 @@ async function handleThreadReply(data, ctx) {
             sender: await getThreadSender(),
         });
         rememberLastCliInput(ds, promptContent, wrappedPrompt);
-        await postPendingResponseCard(ds, parsed.messageId, parsed.content, await getThreadSender());
+        await postPendingResponseCard(ds, parsed.messageId, parsed.content, await getThreadSender(), parsed.messageId);
+        sessionStore.updateSession(ds.session);
         forkWorker(ds, wrappedPrompt, ds.hasHistory);
     }
 }
 // ─── Main ────────────────────────────────────────────────────────────────────
+/** Owner to DM for the restart report: the bot's first resolved allowedUser
+ *  (open_id). Falls back to a raw `ou_…` entry in the config. */
+function resolvePrimaryOwnerOpenId(larkAppId) {
+    try {
+        const bot = getBot(larkAppId);
+        const resolved = (bot.resolvedAllowedUsers ?? []).find(u => typeof u === 'string' && u.startsWith('ou_'));
+        if (resolved)
+            return resolved;
+        return (bot.config.allowedUsers ?? []).find(u => typeof u === 'string' && u.startsWith('ou_'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Build the current dashboard URL (active token, not a rotation) from the
+ *  dashboard process's persisted `.dashboard-port` / `.dashboard-token`. Falls
+ *  back to a token-less base URL if the dashboard hasn't published a token yet. */
+function dashboardUrlForReport() {
+    try {
+        const dir = join(homedir(), '.botmux');
+        const portFile = join(dir, '.dashboard-port');
+        const tokenFile = join(dir, '.dashboard-token');
+        const port = existsSync(portFile) ? readFileSync(portFile, 'utf8').trim() : String(config.dashboard.port);
+        const base = `http://${getDashboardExternalHost()}:${port}/`;
+        if (existsSync(tokenFile)) {
+            const tok = readFileSync(tokenFile, 'utf8').trim();
+            if (tok)
+                return `${base}?t=${tok}`;
+        }
+        return base;
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function startDaemon(botIndex) {
     // 首次启动时后台尝试安装 CJK 字体（Debian/Ubuntu），避免截图中文显示豆腐块。
     // 不阻塞：首张截图可能仍是豆腐块，装完重启 daemon 即可正常。
@@ -2560,6 +2714,11 @@ export async function startDaemon(botIndex) {
     // newly-started daemon's hydrate failing on dashboard startup. Binds to
     // 127.0.0.1 only since the dashboard sibling runs on the same host.
     const ipcHandle = await startIpcServer({ port: ipcPort, host: '127.0.0.1' });
+    // startIpcServer probes upward on EADDRINUSE (e.g. a second botmux instance on
+    // this host already holds ipcBasePort+idx), so the bound port may differ from
+    // the requested one. Republish the ACTUAL port into the descriptor before it
+    // is written below — the dashboard reaches us via desc.ipcPort verbatim.
+    desc.ipcPort = ipcHandle.port;
     logger.info(`[dashboard-ipc] listening on 127.0.0.1:${ipcHandle.port} (bot ${idx})`);
     // Single reverse-proxy port that fronts every session's web terminal under
     // /s/{sessionId}, so dev-machine users forward one port (proxyBasePort+idx)
@@ -2649,8 +2808,17 @@ export async function startDaemon(botIndex) {
         probeBotOpenId(cfg.larkAppId).then(() => {
             writeBotInfoFile(config.session.dataDir);
             const probedName = bot.botName;
+            const probedAvatar = bot.botAvatarUrl;
+            let descChanged = false;
             if (probedName && probedName !== desc.botName) {
                 desc.botName = probedName;
+                descChanged = true;
+            }
+            if (probedAvatar && probedAvatar !== desc.botAvatarUrl) {
+                desc.botAvatarUrl = probedAvatar;
+                descChanged = true;
+            }
+            if (descChanged) {
                 try {
                     writeDaemonDescriptor(desc);
                 }
@@ -2686,6 +2854,7 @@ export async function startDaemon(botIndex) {
             handleThreadReply: (data, ctx) => handleThreadReply(data, ctx),
             handleBotAdded: (chatId, operatorOpenId, appId) => handleBotAdded(chatId, operatorOpenId, appId),
             isSessionOwner: (anchor, appId) => activeSessions.has(sessionKey(anchor, appId)),
+            resolveReplyThreadAlias: (rootId, chatId, appId) => findChatReplyAlias(rootId, chatId, appId),
             // Chat was converted 普通群 → 话题群 while we held a chat-scope session.
             // Evict it from the routing map so subsequent inbound messages can land
             // on a fresh thread-scope session (dispatcher already rerouted this turn
@@ -2703,6 +2872,13 @@ export async function startDaemon(botIndex) {
     }
     // Restore active sessions from previous run
     await restoreActiveSessions(activeSessions);
+    const idleWorkerSweepTimer = setInterval(() => {
+        const suspended = sweepIdleWorkers(activeSessions);
+        if (suspended.length > 0) {
+            logger.info(`[idle-worker-sweeper] suspended ${suspended.length} idle worker(s)`);
+        }
+    }, 60_000);
+    idleWorkerSweepTimer.unref?.();
     await attachColdWorkflowRuns(cfg.larkAppId);
     // Start scheduler in every daemon.  Each daemon owns exactly one bot, so
     // each filters to only execute tasks whose `larkAppId` matches its bot
@@ -2711,6 +2887,39 @@ export async function startDaemon(botIndex) {
     scheduler.setExecuteCallback((task) => executeScheduledTask(task, activeSessions, refreshCliVersion));
     scheduler.setOwnerFilter(cfg.larkAppId, idx === 0);
     scheduler.startScheduler();
+    // Cross-daemon busy heartbeat: each daemon reports how many of its sessions
+    // are mid-CLI-turn so the primary daemon's maintenance gate sees activity
+    // across all bots (one daemon per bot). See core/daemon-heartbeat.ts.
+    const writeBusyHeartbeat = () => {
+        try {
+            let busy = 0;
+            for (const [, ds] of activeSessions) {
+                if (ds.worker && !ds.worker.killed && ds.lastScreenStatus === 'working')
+                    busy++;
+            }
+            writeHeartbeat(cfg.larkAppId, busy);
+        }
+        catch { /* best-effort */ }
+    };
+    writeBusyHeartbeat();
+    const maintenanceHeartbeat = setInterval(writeBusyHeartbeat, 15_000);
+    maintenanceHeartbeat.unref?.();
+    // Auto-update / auto-restart and the restart-report DM run only on the
+    // primary daemon (bot-0) — a restart is host-wide.
+    if (idx === 0) {
+        startMaintenance();
+        // After an intentional restart, DM the owner a summary. Delayed a few
+        // seconds so the dashboard process can publish its token first.
+        setTimeout(() => {
+            void sendRestartReportIfPending({
+                primaryLarkAppId: cfg.larkAppId,
+                ownerOpenId: resolvePrimaryOwnerOpenId(cfg.larkAppId),
+                dashboardUrl: dashboardUrlForReport(),
+                sendCard: (openId, card) => sendUserMessage(cfg.larkAppId, openId, card, 'interactive').then(() => undefined),
+                log: (m) => logger.info(`[restart-report] ${m}`),
+            });
+        }, 5_000).unref?.();
+    }
     // Graceful shutdown. Sends SIGTERM (or `{type:'close'}` IPC via killWorker)
     // to every worker, then waits up to SHUTDOWN_GRACE_MS for them to exit
     // before sending SIGKILL to stragglers. Without the wait, daemon
@@ -2725,13 +2934,17 @@ export async function startDaemon(botIndex) {
         if (shuttingDown)
             return;
         shuttingDown = true;
+        setSessionLifecycleShutdown(true);
         logger.info(`Daemon shutting down... (active: ${getActiveCount()})`);
         scheduler.stopScheduler();
+        stopMaintenance();
+        clearInterval(maintenanceHeartbeat);
         for (const watcher of workflowEventWatchers.values())
             watcher.close();
         workflowEventWatchers.clear();
         workflowRuns.clear();
         clearInterval(descriptorHeartbeat);
+        clearInterval(idleWorkerSweepTimer);
         if (memoryDiagnostics)
             clearInterval(memoryDiagnostics);
         removeDaemonDescriptor(cfg.larkAppId);
@@ -2805,6 +3018,7 @@ export async function startDaemon(botIndex) {
     // the descriptor so the dashboard doesn't see a phantom daemon.
     process.on('exit', () => {
         clearInterval(descriptorHeartbeat);
+        clearInterval(idleWorkerSweepTimer);
         if (memoryDiagnostics)
             clearInterval(memoryDiagnostics);
         removeDaemonDescriptor(cfg.larkAppId);