botmux 2.67.0 → 2.68.0

package/dist/core/auto-start.d.ts

@@ -58,4 +58,27 @@ export declare function chatHasAllowedUser(memberOpenIds: Iterable<string>, allo
  * produces a non-empty CLI turn (FR-11).
  */
 export declare function resolveGroupJoinPrompt(configured: string | undefined): string;
+/**
+ * 场景①: D7 gate with retry — wait for an allowedUser to appear in the chat.
+ *
+ * Alarm/oncall platforms that auto-create incident chats (e.g. ByteDance
+ * Nexus) add the bot FIRST and the human members moments later. A one-shot
+ * membership snapshot taken at bot.added time races against that and loses:
+ * the chat looks like it has no allowedUser and auto-start is silently
+ * skipped even though the owner lands in the chat a second later. Re-check
+ * membership a few times with backoff before giving up.
+ *
+ * Attempts = retryDelaysMs.length + 1 (default 4 attempts over ~25s). Errors
+ * from `listMembers` propagate to the caller on ANY attempt — same handling
+ * as the previous one-shot check (warn + scope hint). Empty allowedUsers
+ * short-circuits to false without calling `listMembers` (FR-2).
+ */
+export declare function waitForAllowedUserInChat(opts: {
+    listMembers: () => Promise<string[]>;
+    allowedUsers: Iterable<string>;
+    /** Waits BETWEEN attempts (ms). Default [3000, 7000, 15000]. */
+    retryDelaysMs?: number[];
+    sleep?: (ms: number) => Promise<void>;
+    onRetry?: (attempt: number, delayMs: number) => void;
+}): Promise<boolean>;
 //# sourceMappingURL=auto-start.d.ts.map

package/dist/core/auto-start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auto-start.d.ts","sourceRoot":"","sources":["../../src/core/auto-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,oBAAoB,EAAE,OAAO,CAAC;IAC9B,+EAA+E;IAC/E,0BAA0B,EAAE,MAAM,CAAC;IACnC,2EAA2E;IAC3E,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,QAAQ,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,GAAG,KAAK,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAQV;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC/B,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,GACnC,OAAO,CAOT;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAE7E"}
+{"version":3,"file":"auto-start.d.ts","sourceRoot":"","sources":["../../src/core/auto-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,oBAAoB,EAAE,OAAO,CAAC;IAC9B,+EAA+E;IAC/E,0BAA0B,EAAE,MAAM,CAAC;IACnC,2EAA2E;IAC3E,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,QAAQ,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,GAAG,KAAK,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAQV;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC/B,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,GACnC,OAAO,CAOT;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAE7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnB"}

package/dist/core/auto-start.js

@@ -59,4 +59,34 @@ export function chatHasAllowedUser(memberOpenIds, allowedUserOpenIds) {
 export function resolveGroupJoinPrompt(configured) {
     return (configured ?? '').trim();
 }
+/**
+ * 场景①: D7 gate with retry — wait for an allowedUser to appear in the chat.
+ *
+ * Alarm/oncall platforms that auto-create incident chats (e.g. ByteDance
+ * Nexus) add the bot FIRST and the human members moments later. A one-shot
+ * membership snapshot taken at bot.added time races against that and loses:
+ * the chat looks like it has no allowedUser and auto-start is silently
+ * skipped even though the owner lands in the chat a second later. Re-check
+ * membership a few times with backoff before giving up.
+ *
+ * Attempts = retryDelaysMs.length + 1 (default 4 attempts over ~25s). Errors
+ * from `listMembers` propagate to the caller on ANY attempt — same handling
+ * as the previous one-shot check (warn + scope hint). Empty allowedUsers
+ * short-circuits to false without calling `listMembers` (FR-2).
+ */
+export async function waitForAllowedUserInChat(opts) {
+    const allowed = [...opts.allowedUsers];
+    if (allowed.length === 0)
+        return false;
+    const delays = opts.retryDelaysMs ?? [3000, 7000, 15000];
+    const sleep = opts.sleep ?? ((ms) => new Promise(r => setTimeout(r, ms)));
+    for (let attempt = 0;; attempt++) {
+        if (chatHasAllowedUser(await opts.listMembers(), allowed))
+            return true;
+        if (attempt >= delays.length)
+            return false;
+        opts.onRetry?.(attempt + 1, delays[attempt]);
+        await sleep(delays[attempt]);
+    }
+}
 //# sourceMappingURL=auto-start.js.map

package/dist/core/auto-start.js.map

@@ -1 +1 @@
-{"version":3,"file":"auto-start.js","sourceRoot":"","sources":["../../src/core/auto-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAOzC;IACC,OAAO,CACL,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ,KAAK,OAAO;QACzB,IAAI,CAAC,KAAK,KAAK,QAAQ;QACvB,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS;QAC9B,CAAC,IAAI,CAAC,WAAW,CAClB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAA+B,EAC/B,kBAAoC;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B;IACnE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC"}
+{"version":3,"file":"auto-start.js","sourceRoot":"","sources":["../../src/core/auto-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAOzC;IACC,OAAO,CACL,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ,KAAK,OAAO;QACzB,IAAI,CAAC,KAAK,KAAK,QAAQ;QACvB,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS;QAC9B,CAAC,IAAI,CAAC,WAAW,CAClB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAA+B,EAC/B,kBAAoC;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B;IACnE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAO9C;IACC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,kBAAkB,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACvE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,GAAG,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/core/command-handler.d.ts

@@ -89,7 +89,7 @@ export interface CommandHandlerDeps {
     lastRepoScan: Map<string, import('../services/project-scanner.js').ProjectInfo[]>;
 }
 /**
- * Handle `/card` (owner-only). Resolves the active session itself, so off/on
+ * Handle `/card` (operator-only). Resolves the active session itself, so off/on
  * work WITHOUT one -- they only toggle the per-chat `noCardChats` config. A
  * summon (show/bare) needs a live session.
  *
@@ -103,15 +103,15 @@ export interface CommandHandlerDeps {
  */
 export declare function handleCardCommand(rootId: string, larkAppId: string, chatId: string, senderOpenId: string | undefined, content: string, deps: CommandHandlerDeps): Promise<void>;
 /**
- * Handle `/term` (owner-only) — the slash-command twin of the "🔑 获取操作链接"
- * card button. Privately hands the owner a writable (token-bearing) terminal card:
- * an in-chat visible-to-you ephemeral card in plain groups, auto-falling back to a
- * DM in topic / p2p chats. The link rides only that private channel — never the
- * group. Gated identically to /card (`senderOpenId === owner`), and strictly
- * needs a live session whose terminal is up. Routed for both the new-topic path
- * (daemon.ts) and the existing-session switch below.
+ * Handle `/term` (operator-only) — the slash-command twin of the "🔑 获取操作链接"
+ * card button. Privately hands the operator a writable (token-bearing) terminal
+ * card: an in-chat visible-to-you ephemeral card in plain groups, auto-falling back
+ * to a DM in topic / p2p chats. The link rides only that private channel — never the
+ * group. Gated identically to /card (`canOperate`), and strictly needs a live
+ * session whose terminal is up. Routed for both the new-topic path (daemon.ts) and
+ * the existing-session switch below.
  */
-export declare function handleTermLinkCommand(rootId: string, larkAppId: string, _chatId: string, senderOpenId: string | undefined, _content: string, deps: CommandHandlerDeps): Promise<void>;
+export declare function handleTermLinkCommand(rootId: string, larkAppId: string, chatId: string, senderOpenId: string | undefined, _content: string, deps: CommandHandlerDeps): Promise<void>;
 export declare function handleCommand(cmd: string, rootId: string, message: LarkMessage, deps: CommandHandlerDeps, larkAppId?: string): Promise<void>;
 export declare function startCodexAppThreadSession(thread: CodexAppThreadSummary, ds: DaemonSession, deps: CommandHandlerDeps, larkAppId?: string): Promise<void>;
 export declare function startAdoptSession(target: AdoptableSession | ZellijAdoptableSession, ds: DaemonSession, deps: CommandHandlerDeps, larkAppId?: string): Promise<void>;

package/dist/core/command-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-handler.d.ts","sourceRoot":"","sources":["../../src/core/command-handler.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAoF,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACjJ,OAAO,EAA8D,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACtI,OAAO,EAAuB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAanG,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,aAAa,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD,eAAO,MAAM,eAAe,aAAkQ,CAAC;AAE/R;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAA2E,CAAC;AAEpH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,aAO/B,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAY1E;AAID,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA0C9C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKpF;AAED;;;;mCAImC;AACnC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAqB1F;AAmED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,gCAAgC,EAAE,WAAW,EAAE,CAAC,CAAC;CACnF;AAkaD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CA0Df;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA2yCf;AAoDD,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,qBAAqB,EAC7B,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,EACjD,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA4Cf"}
+{"version":3,"file":"command-handler.d.ts","sourceRoot":"","sources":["../../src/core/command-handler.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAoF,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACjJ,OAAO,EAA8D,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACtI,OAAO,EAAuB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAcnG,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,aAAa,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD,eAAO,MAAM,eAAe,aAAkQ,CAAC;AAE/R;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAA2E,CAAC;AAEpH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,aAO/B,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAY1E;AAID,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA0C9C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKpF;AAED;;;;mCAImC;AACnC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAqB1F;AAmED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,gCAAgC,EAAE,WAAW,EAAE,CAAC,CAAC;CACnF;AAkaD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CA6Df;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA2yCf;AAoDD,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,qBAAqB,EAC7B,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,EACjD,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA4Cf"}

package/dist/core/command-handler.js

@@ -6,7 +6,7 @@ import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { join, resolve, basename } from 'node:path';
 import { config } from '../config.js';
 import { buildTerminalUrl } from './terminal-url.js';
-import { getBot, getAllBots, getBotOpenId, getOwnerOpenId } from '../bot-registry.js';
+import { getBot, getAllBots, getBotOpenId } from '../bot-registry.js';
 import * as sessionStore from '../services/session-store.js';
 import * as scheduleStore from '../services/schedule-store.js';
 import * as scheduler from './scheduler.js';
@@ -31,6 +31,7 @@ import { CONFIG_FIELDS, findConfigField, settableFieldKeys, parseBooleanValue, a
 import { resolveCliId, findInvalidAllowedUserEntries } from '../setup/bot-config-editor.js';
 import { publishAttentionPatch, announcePendingRepoSession } from './session-activity.js';
 import { setCardMode } from '../services/card-mode-store.js';
+import { canOperate } from '../im/lark/event-dispatcher.js';
 import { invalidWorkingDirs } from '../utils/working-dir.js';
 import { writeRoleFile, deleteRoleFile, resolveRole, resolveTeamRoleFile, writeTeamRoleFile, deleteTeamRoleFile } from './role-resolver.js';
 import { getBotCapability, setBotCapability, clearBotCapability } from '../services/bot-profile-store.js';
@@ -709,7 +710,7 @@ async function handleConfigCommand(message, rootId, larkAppId, deps) {
 }
 // ─── Main command handler ────────────────────────────────────────────────────
 /**
- * Handle `/card` (owner-only). Resolves the active session itself, so off/on
+ * Handle `/card` (operator-only). Resolves the active session itself, so off/on
  * work WITHOUT one -- they only toggle the per-chat `noCardChats` config. A
  * summon (show/bare) needs a live session.
  *
@@ -724,9 +725,12 @@ async function handleConfigCommand(message, rootId, larkAppId, deps) {
 export async function handleCardCommand(rootId, larkAppId, chatId, senderOpenId, content, deps) {
     const loc = localeForBot(larkAppId);
     const reply = (c) => deps.sessionReply(rootId, c, undefined, larkAppId);
-    const ownerOpenId = getOwnerOpenId(larkAppId);
-    if (!ownerOpenId || !senderOpenId || senderOpenId !== ownerOpenId) {
-        await reply(t('cmd.card.owner_only', undefined, loc));
+    // /card is an operator command — gate on canOperate, the same model every other
+    // daemon command uses. Open mode (no owner/allowlist) → canOperate passes for
+    // everyone; configured → any allowedUser (owner or co-owner); talk-only grantees
+    // (chatGrant/globalGrant/oncall members) are never operators.
+    if (!canOperate(larkAppId, chatId, senderOpenId)) {
+        await reply(t('cmd.card.operator_only', undefined, loc));
         return;
     }
     const ds = deps.activeSessions.get(sessionKey(rootId, larkAppId));
@@ -782,20 +786,23 @@ export async function handleCardCommand(rootId, larkAppId, chatId, senderOpenId,
     await reply(t('cmd.card.usage', undefined, loc));
 }
 /**
- * Handle `/term` (owner-only) — the slash-command twin of the "🔑 获取操作链接"
- * card button. Privately hands the owner a writable (token-bearing) terminal card:
- * an in-chat visible-to-you ephemeral card in plain groups, auto-falling back to a
- * DM in topic / p2p chats. The link rides only that private channel — never the
- * group. Gated identically to /card (`senderOpenId === owner`), and strictly
- * needs a live session whose terminal is up. Routed for both the new-topic path
- * (daemon.ts) and the existing-session switch below.
+ * Handle `/term` (operator-only) — the slash-command twin of the "🔑 获取操作链接"
+ * card button. Privately hands the operator a writable (token-bearing) terminal
+ * card: an in-chat visible-to-you ephemeral card in plain groups, auto-falling back
+ * to a DM in topic / p2p chats. The link rides only that private channel — never the
+ * group. Gated identically to /card (`canOperate`), and strictly needs a live
+ * session whose terminal is up. Routed for both the new-topic path (daemon.ts) and
+ * the existing-session switch below.
  */
-export async function handleTermLinkCommand(rootId, larkAppId, _chatId, senderOpenId, _content, deps) {
+export async function handleTermLinkCommand(rootId, larkAppId, chatId, senderOpenId, _content, deps) {
     const loc = localeForBot(larkAppId);
     const reply = (c) => deps.sessionReply(rootId, c, undefined, larkAppId);
-    const ownerOpenId = getOwnerOpenId(larkAppId);
-    if (!ownerOpenId || !senderOpenId || senderOpenId !== ownerOpenId) {
-        await reply(t('cmd.term.owner_only', undefined, loc));
+    // /term is an operator command that hands out a *writable* terminal link — gate
+    // on canOperate (same model as other daemon commands). senderOpenId must be
+    // present: open-mode canOperate passes even an undefined sender, but the writable
+    // card is delivered privately to that exact open_id.
+    if (!senderOpenId || !canOperate(larkAppId, chatId, senderOpenId)) {
+        await reply(t('cmd.term.operator_only', undefined, loc));
         return;
     }
     const ds = deps.activeSessions.get(sessionKey(rootId, larkAppId));