botmux 2.86.0 → 2.88.0

package/dist/dashboard.js

@@ -27,18 +27,30 @@ import { BotOnboardingManager } from './dashboard/bot-onboarding.js';
 import { CLI_SELECT_OPTIONS, resolveCliSelection, isTtadkWrapper, ttadkAcceptsModel, TTADK_DEFAULT_MODEL, TTADK_MODEL_SUGGESTIONS, } from './setup/cli-selection.js';
 import { invalidWorkingDirs } from './utils/working-dir.js';
 import { mergeDashboardConfig, mergeGlobalConfig, mergeMaintenanceConfig, parseMaintenancePatch, readGlobalConfig, setGlobalLocale } from './global-config.js';
+import { deleteWhiteboard, listWhiteboards, readWhiteboard, whiteboardEnabled } from './services/whiteboard-store.js';
 import { isLocale } from './i18n/types.js';
-import { isLocalDevInstall } from './utils/install-info.js';
+import { isLocalDevInstall, botmuxVersion } from './utils/install-info.js';
+import { checkNode, detectBotmuxInstalls, resolveCurrentVersion } from './utils/install-diagnostics.js';
+import { fetchLatestVersion, fetchReleasesSince, isNewerVersion } from './core/update-check.js';
+import { GITHUB_REPO } from './core/restart-report.js';
+import { spawnDetachedRestart, npmGlobalUpdateLockTarget } from './core/maintenance.js';
+import { writeRestartIntent } from './services/restart-intent-store.js';
+import { withFileLock } from './utils/file-lock.js';
+import { spawn } from 'node:child_process';
 import { listTeamReports, readTeamBoard, setTeamBoardEntry } from './services/team-board-store.js';
 import { hd2dAssetPath, hd2dStatus, startHd2dDownload } from './dashboard/hd2d-assets.js';
-import { readSkillRegistry, removeInstalledSkill, updateInstalledSkillAsync, } from './services/skill-registry-store.js';
+import { installLocalSkillLinks, readSkillRegistry, removeInstalledSkill, updateInstalledSkillAsync, } from './services/skill-registry-store.js';
 import { redactGitUrlCredentials } from './core/skills/sources.js';
 import { loadBotConfigs } from './bot-registry.js';
+import { discoverNativeCliSkillGroups } from './core/skills/discovery.js';
 import { analyzeSkillReferences } from './core/skills/references.js';
-import { installDashboardSkill, parseDashboardSkillInstallRequest } from './dashboard/skill-install-request.js';
+import { installDashboardSkill, parseDashboardSkillInstallRequest, parseInstallLocalLinksSources, MAX_LOCAL_LINK_SOURCES } from './dashboard/skill-install-request.js';
 import { botDefaultsPayload, botSummaryPayload } from './dashboard/bot-payload.js';
 import { isValidRoleProfileId } from './services/role-profile-store.js';
 import { mergeSafeInsightOverviews } from './services/insight/report.js';
+import { readPlatformBinding } from './platform/binding.js';
+import { startPlatformTunnelClient } from './platform/tunnel-client.js';
+import { cleanupIdleSessions, parseIdleCleanupHours } from './dashboard/session-cleanup.js';
 const SECRET_PATH = join(homedir(), '.botmux', '.dashboard-secret');
 const TOKEN_PATH = join(homedir(), '.botmux', '.dashboard-token');
 /** Per-daemon budget for the cross-daemon insight overview fan-out — bounds
@@ -116,6 +128,7 @@ function resolveDashboardSettings() {
         repoPickerMode: global.repoPickerMode ?? 'all',
         maintenance: global.maintenance ?? {},
         localDevInstall: isLocalDevInstall(),
+        whiteboard: { enabled: global.whiteboard?.enabled === true },
     };
 }
 async function readJsonBody(req) {
@@ -125,6 +138,67 @@ async function readJsonBody(req) {
     const raw = Buffer.concat(chunks).toString('utf8').trim();
     return raw ? JSON.parse(raw) : {};
 }
+/** Fast in-process guard against double-clicks within this dashboard process.
+ *  Cross-process serialization against the maintenance auto-update (a different
+ *  process) is handled separately by the shared file lock in the run route. */
+let updateInFlight = false;
+// Cache the upstream version/changelog lookups so the nav-badge check + the
+// Settings card don't hammer the npm registry / GitHub on every page load.
+// GitHub's unauthenticated API is only 60 req/h per IP, so caching the changelog
+// also keeps us from exhausting it. Failures cache briefly so they self-heal.
+const LATEST_TTL_MS = 30 * 60_000;
+const CHANGELOG_TTL_MS = 15 * 60_000;
+const FAILURE_TTL_MS = 60_000;
+let latestVersionCache = null;
+let changelogCache = null;
+async function cachedLatestVersion(now = Date.now()) {
+    const ttl = latestVersionCache?.value ? LATEST_TTL_MS : FAILURE_TTL_MS;
+    if (latestVersionCache && now - latestVersionCache.at < ttl)
+        return latestVersionCache.value;
+    const value = await fetchLatestVersion();
+    latestVersionCache = { value, at: now };
+    return value;
+}
+async function cachedChangelog(current, now = Date.now()) {
+    const ttl = changelogCache?.value.ok ? CHANGELOG_TTL_MS : FAILURE_TTL_MS;
+    if (changelogCache && changelogCache.key === current && now - changelogCache.at < ttl)
+        return changelogCache.value;
+    const value = await fetchReleasesSince(current);
+    changelogCache = { key: current, value, at: now };
+    return value;
+}
+/**
+ * Run `npm install -g botmux@latest` for the manual-update flow WITHOUT blocking
+ * the event loop (async spawn, not execSync — the dashboard must keep serving
+ * during the ~10-30s install). Resolves on exit 0; rejects with the tail of
+ * stdout/stderr on a non-zero exit, spawn error, or 3-minute timeout. Args are
+ * a fixed literal — no shell interpolation of untrusted input.
+ */
+function runNpmInstallLatest() {
+    return new Promise((resolve, reject) => {
+        const child = spawn('npm', ['install', '-g', 'botmux@latest'], {
+            env: process.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            shell: process.platform === 'win32', // resolve npm.cmd on Windows
+        });
+        let tail = '';
+        const capture = (d) => { tail = (tail + d.toString()).slice(-2000); };
+        child.stdout?.on('data', capture);
+        child.stderr?.on('data', capture);
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new Error('npm install timed out after 180s'));
+        }, 180_000);
+        child.on('error', (e) => { clearTimeout(timer); reject(e); });
+        child.on('exit', (code) => {
+            clearTimeout(timer);
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`npm exited ${code}: ${tail.trim().slice(-500)}`));
+        });
+    });
+}
 /**
  * Attach to one daemon: hydrate its sessions/schedules into the aggregator,
  * THEN open the SSE subscription. Order matters — hydrating after subscribe
@@ -507,12 +581,33 @@ function sanitizeSkillForDashboard(skill) {
         source: { ...skill.source, url: redactGitUrlCredentials(skill.source.url) },
     };
 }
+function dashboardSkillCliIds() {
+    const ids = new Set();
+    try {
+        for (const cliId of configuredCliIds().values())
+            ids.add(cliId);
+    }
+    catch {
+        // Fall back to daemon descriptors below when persistent config is unavailable.
+    }
+    for (const bot of registry.list()) {
+        if (bot.cliId)
+            ids.add(bot.cliId);
+    }
+    return [...ids];
+}
 function dashboardSkillsPayload() {
     const globalSkills = readGlobalConfig().skills ?? {};
+    const nativeSkillGroups = discoverNativeCliSkillGroups(dashboardSkillCliIds())
+        .map(group => ({
+        ...group,
+        skills: group.skills.map(sanitizeSkillForDashboard),
+    }));
     return {
         skills: Object.values(readSkillRegistry().skills)
             .sort((a, b) => a.name.localeCompare(b.name))
             .map(sanitizeSkillForDashboard),
+        nativeSkillGroups,
         trustProjectSkills: globalSkills.trustProjectSkills ?? 'off',
         delivery: globalSkills.delivery ?? 'auto',
     };
@@ -700,6 +795,54 @@ const server = createServer(async (req, res) => {
             });
             return jsonRes(res, 200, { sessions });
         }
+        if (req.method === 'POST' && url.pathname === '/api/sessions/cleanup-idle') {
+            let body;
+            try {
+                body = await readJsonBody(req);
+            }
+            catch {
+                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+            }
+            const olderThanHours = parseIdleCleanupHours(body?.olderThanHours);
+            if (!olderThanHours)
+                return jsonRes(res, 400, { ok: false, error: 'invalid_threshold' });
+            // WYSIWYG: the UI scopes cleanup to the rows currently visible under the
+            // page filters and sends their sessionIds, so the closed set matches the
+            // confirmed count. We still hand the scoped rows to cleanupIdleSessions,
+            // which re-validates each is a genuine idle candidate — a stale/forged id
+            // can never close a non-idle session. Omitting sessionIds (e.g. an older
+            // client) falls back to a deployment-wide sweep. Cap the id set so a giant
+            // body can't blow up the Set build.
+            const idScope = Array.isArray(body?.sessionIds)
+                ? new Set(body.sessionIds.slice(0, 10000).map(String))
+                : null;
+            const rows = aggregator.getSessions();
+            const scoped = idScope ? rows.filter(s => idScope.has(s.sessionId)) : rows;
+            const result = await cleanupIdleSessions(scoped, olderThanHours, async (s) => {
+                try {
+                    const upstream = await proxyToDaemon(s.larkAppId, `/api/sessions/${encodeURIComponent(s.sessionId)}/close`, { method: 'POST' });
+                    const text = await upstream.text();
+                    let parsed = null;
+                    try {
+                        parsed = JSON.parse(text);
+                    }
+                    catch { /* tolerate */ }
+                    // The daemon close route always replies 200 {ok:true}; treat anything
+                    // else (incl. an unparseable/missing body) as a failure rather than a
+                    // silent success.
+                    const ok = upstream.ok && parsed?.ok === true;
+                    return {
+                        sessionId: s.sessionId,
+                        ok,
+                        error: ok ? undefined : (parsed?.error ?? `http_${upstream.status}`),
+                    };
+                }
+                catch (e) {
+                    return { sessionId: s.sessionId, ok: false, error: e?.message ?? String(e) };
+                }
+            });
+            return jsonRes(res, 200, result);
+        }
         if (req.method === 'GET' && url.pathname === '/api/insights/summary') {
             const limit = Math.min(Math.max(parseInt(url.searchParams.get('limit') ?? '200', 10) || 200, 1), 500);
             // Per-daemon timeout + isolate failures: an upstream insight parse can be
@@ -774,6 +917,16 @@ const server = createServer(async (req, res) => {
                 mergeGlobalConfig({ repoPickerMode: v });
                 touched = true;
             }
+            if ('whiteboard' in body) {
+                const raw = body.whiteboard;
+                if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+                    return jsonRes(res, 400, { ok: false, error: 'invalid_whiteboard' });
+                const wb = raw;
+                if (typeof wb.enabled !== 'boolean')
+                    return jsonRes(res, 400, { ok: false, error: 'invalid_whiteboard_enabled' });
+                mergeGlobalConfig({ whiteboard: { enabled: wb.enabled } });
+                touched = true;
+            }
             if ('maintenance' in body) {
                 const r = parseMaintenancePatch(body.maintenance);
                 if (!r.ok)
@@ -813,6 +966,96 @@ const server = createServer(async (req, res) => {
                 return jsonRes(res, 400, { ok: false, error: 'empty_patch' });
             return jsonRes(res, 200, { ok: true, settings: resolveDashboardSettings() });
         }
+        // ─── Version & manual update ─────────────────────────────────────────────
+        // `npm install -g` and a host restart are privileged: none of these paths
+        // are on PUBLIC_READ_PATHS, so decideDashboardAuth already 401s an
+        // unauthenticated caller (in both normal and public-read mode). The explicit
+        // `authed` guards on the two mutations are defense-in-depth for host actions.
+        if (req.method === 'GET' && url.pathname === '/api/update/status') {
+            const current = resolveCurrentVersion();
+            // Compare against the npm `latest` dist-tag (always stable; the update
+            // button installs `@latest`). isNewerVersion uses semver precedence, so a
+            // canary running AHEAD of the latest stable (e.g. 2.87.0-canary.0 vs
+            // 2.86.0) is NOT flagged behind — exactly the canary case we want.
+            const latest = await cachedLatestVersion();
+            return jsonRes(res, 200, {
+                current,
+                latest,
+                behind: !!latest && isNewerVersion(latest, current),
+                localDevInstall: isLocalDevInstall(),
+                node: checkNode(),
+                installs: detectBotmuxInstalls(),
+            });
+        }
+        if (req.method === 'GET' && url.pathname === '/api/update/changelog') {
+            const current = resolveCurrentVersion();
+            const result = await cachedChangelog(current);
+            return jsonRes(res, 200, {
+                current,
+                ok: result.ok,
+                rateLimited: result.rateLimited === true,
+                releases: result.releases,
+                releasesUrl: `https://github.com/${GITHUB_REPO}/releases`,
+            });
+        }
+        if (req.method === 'POST' && url.pathname === '/api/update/run') {
+            if (!authed)
+                return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
+            if (isLocalDevInstall())
+                return jsonRes(res, 400, { ok: false, error: 'local_dev_no_update' });
+            const node = checkNode();
+            if (!node.ok)
+                return jsonRes(res, 400, { ok: false, error: 'node_too_old', node });
+            if (updateInFlight)
+                return jsonRes(res, 409, { ok: false, error: 'update_in_flight' });
+            updateInFlight = true;
+            const oldVersion = botmuxVersion();
+            // Acquire the shared cross-process lock so a scheduled maintenance
+            // auto-update (running in the bot-0 daemon) can't `npm install -g` at the
+            // same time. `acquired` distinguishes "lock held by maintenance" (409)
+            // from "npm itself failed" (500). Short wait: don't block the request on a
+            // full in-progress install — report busy fast.
+            let acquired = false;
+            try {
+                await withFileLock(npmGlobalUpdateLockTarget(), async () => {
+                    acquired = true;
+                    await runNpmInstallLatest();
+                }, { maxWaitMs: 2_000 });
+            }
+            catch (e) {
+                if (!acquired)
+                    return jsonRes(res, 409, { ok: false, error: 'update_in_flight' });
+                return jsonRes(res, 500, { ok: false, error: 'npm_failed', detail: e instanceof Error ? e.message : String(e) });
+            }
+            finally {
+                updateInFlight = false;
+            }
+            const newVersion = botmuxVersion();
+            return jsonRes(res, 200, { ok: true, oldVersion, newVersion, changed: newVersion !== oldVersion });
+        }
+        if (req.method === 'POST' && url.pathname === '/api/update/restart') {
+            if (!authed)
+                return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
+            let body = {};
+            try {
+                const parsed = await readJsonBody(req);
+                if (parsed && typeof parsed === 'object')
+                    body = parsed;
+            }
+            catch { /* empty / bad body → plain restart */ }
+            const upd = body.update && typeof body.update === 'object' ? body.update : null;
+            // After a manual update, leave an `update` breadcrumb so the fresh daemon
+            // DMs the owner the changelog (reuses the restart-report pipeline). A plain
+            // restart leaves none here; cmdRestart writes a `manual` breadcrumb itself.
+            if (upd && typeof upd.oldVersion === 'string' && typeof upd.newVersion === 'string' && upd.oldVersion !== upd.newVersion) {
+                try {
+                    writeRestartIntent({ kind: 'update', oldVersion: upd.oldVersion, newVersion: upd.newVersion, at: new Date().toISOString() });
+                }
+                catch { /* breadcrumb is best-effort */ }
+            }
+            spawnDetachedRestart('dashboard');
+            return jsonRes(res, 200, { ok: true });
+        }
         if (req.method === 'GET' && url.pathname === '/api/skills') {
             return jsonRes(res, 200, dashboardSkillsPayload());
         }
@@ -865,6 +1108,30 @@ const server = createServer(async (req, res) => {
                 return jsonRes(res, 400, { ok: false, error: redactGitUrlCredentials(err?.message ?? String(err)) });
             }
         }
+        if (req.method === 'POST' && url.pathname === '/api/skills/install-local-links') {
+            let parsed;
+            try {
+                parsed = await readJsonBody(req);
+            }
+            catch {
+                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+            }
+            const sources = parseInstallLocalLinksSources(parsed);
+            if (sources.length === 0)
+                return jsonRes(res, 400, { ok: false, error: 'sources_required' });
+            if (sources.length > MAX_LOCAL_LINK_SOURCES)
+                return jsonRes(res, 400, { ok: false, error: 'too_many_sources' });
+            try {
+                const skills = installLocalSkillLinks(sources);
+                // Frontend re-fetches /api/skills (refresh()) after success, so we keep
+                // the response lean — no need to spread a full dashboardSkillsPayload()
+                // (which would re-run the native-skill discovery scan a second time).
+                return jsonRes(res, 200, { ok: true, installed: skills.map(sanitizeSkillForDashboard) });
+            }
+            catch (err) {
+                return jsonRes(res, 400, { ok: false, error: redactGitUrlCredentials(err?.message ?? String(err)) });
+            }
+        }
         let mSkillJob;
         if (req.method === 'GET' && (mSkillJob = url.pathname.match(/^\/api\/skills\/jobs\/([^/]+)$/))) {
             const job = skillJobs.get(decodeURIComponent(mSkillJob[1]));
@@ -908,6 +1175,28 @@ const server = createServer(async (req, res) => {
                 ...dashboardSkillsPayload(),
             });
         }
+        if (req.method === 'GET' && url.pathname === '/api/whiteboards') {
+            return jsonRes(res, 200, { enabled: whiteboardEnabled(), whiteboards: listWhiteboards() });
+        }
+        const mWhiteboard = url.pathname.match(/^\/api\/whiteboards\/([^/]+)$/);
+        if (req.method === 'GET' && mWhiteboard) {
+            try {
+                const id = decodeURIComponent(mWhiteboard[1]);
+                return jsonRes(res, 200, { enabled: whiteboardEnabled(), id, content: readWhiteboard(id, { allowDisabled: true }) });
+            }
+            catch (err) {
+                return jsonRes(res, 404, { ok: false, error: err?.message ?? 'whiteboard_not_found' });
+            }
+        }
+        if (req.method === 'DELETE' && mWhiteboard) {
+            try {
+                const id = decodeURIComponent(mWhiteboard[1]);
+                return jsonRes(res, 200, deleteWhiteboard(id));
+            }
+            catch (err) {
+                return jsonRes(res, 400, { ok: false, error: err?.message ?? 'whiteboard_delete_failed' });
+            }
+        }
         if (await handleConnectorApi(req, res, url)) {
             return;
         }
@@ -1011,7 +1300,7 @@ const server = createServer(async (req, res) => {
             return jsonRes(res, 200, { job });
         }
         let m;
-        if (req.method === 'POST' && (m = url.pathname.match(/^\/api\/sessions\/([^/]+)\/(close|locate|resume)$/))) {
+        if (req.method === 'POST' && (m = url.pathname.match(/^\/api\/sessions\/([^/]+)\/(close|locate|resume|restart|start)$/))) {
             const sid = decodeURIComponent(m[1]);
             const op = m[2];
             const owner = aggregator.ownerOf(sid);
@@ -1658,6 +1947,24 @@ const server = createServer(async (req, res) => {
             res.end(await upstream.text());
             return;
         }
+        // PUT /api/bots/:appId/env — proxy to that bot's daemon. Body
+        // `{ env: string }` (raw JSON text; '' = clear).
+        let mBotEnv;
+        if (req.method === 'PUT' && (mBotEnv = url.pathname.match(/^\/api\/bots\/([^/]+)\/env$/))) {
+            const appId = decodeURIComponent(mBotEnv[1]);
+            const chunks = [];
+            for await (const c of req)
+                chunks.push(c);
+            const raw = Buffer.concat(chunks).toString('utf8') || '{}';
+            const upstream = await proxyToDaemon(appId, `/api/bot-env`, {
+                method: 'PUT',
+                headers: { 'content-type': 'application/json' },
+                body: raw,
+            });
+            res.writeHead(upstream.status, { 'content-type': 'application/json' });
+            res.end(await upstream.text());
+            return;
+        }
         // PUT /api/bots/:appId/sandbox — proxy to that bot's daemon. Body `{ enabled: boolean }`.
         let mBotSandbox;
         if (req.method === 'PUT' && (mBotSandbox = url.pathname.match(/^\/api\/bots\/([^/]+)\/sandbox$/))) {
@@ -1713,7 +2020,8 @@ const server = createServer(async (req, res) => {
             return;
         }
         // PUT /api/bots/:appId/grant-prefs — proxy to that bot's daemon. Body carries
-        // any subset of `{ restrictGrantCommands?: boolean, messageQuotaDefaultLimit?: number|null }`.
+        // any subset of `{ restrictGrantCommands?: boolean, autoGrantRequestCards?: boolean,
+        // messageQuotaDefaultLimit?: number|null }`.
         let mBotGrantPrefs;
         if (req.method === 'PUT' && (mBotGrantPrefs = url.pathname.match(/^\/api\/bots\/([^/]+)\/grant-prefs$/))) {
             const appId = decodeURIComponent(mBotGrantPrefs[1]);
@@ -1841,6 +2149,133 @@ const server = createServer(async (req, res) => {
             res.end(upstreamJson ? JSON.stringify(upstreamJson) : upstreamText);
             return;
         }
+        // Dashboard「创建会话」：建飞书群 + 拉选中的 bot，然后按协作模式给各 bot 拉起/暂存
+        // 一条 chat-scope 会话。一起开工=每个被选 bot 各起一条；lead 分配=只起 lead，由它
+        // 在群里 @ 拉起 sub bot。in_progress=立即开跑；backlog=入待办池（parked，等激活）。
+        if (req.method === 'POST' && url.pathname === '/api/sessions/create') {
+            let parsed;
+            try {
+                const chunks = [];
+                for await (const c of req)
+                    chunks.push(c);
+                parsed = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+            }
+            catch {
+                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+            }
+            const content = typeof parsed.content === 'string' ? parsed.content.replace(/\s+$/u, '') : '';
+            if (!content.trim())
+                return jsonRes(res, 400, { ok: false, error: 'empty_content' });
+            if (content.length > 8000)
+                return jsonRes(res, 400, { ok: false, error: 'content_too_long' });
+            const selectedIds = Array.isArray(parsed.larkAppIds)
+                ? Array.from(new Set(parsed.larkAppIds.filter((x) => typeof x === 'string')))
+                : [];
+            if (selectedIds.length === 0)
+                return jsonRes(res, 400, { ok: false, error: 'larkAppIds_required' });
+            const mode = parsed.mode === 'lead' ? 'lead' : parsed.mode === 'all' ? 'all' : null;
+            if (!mode)
+                return jsonRes(res, 400, { ok: false, error: 'bad_mode' });
+            const column = parsed.column === 'backlog' ? 'backlog' : parsed.column === 'in_progress' ? 'in_progress' : null;
+            if (!column)
+                return jsonRes(res, 400, { ok: false, error: 'bad_column' });
+            const bindWorkingDir = typeof parsed.bindWorkingDir === 'string' && parsed.bindWorkingDir.trim()
+                ? parsed.bindWorkingDir.trim() : undefined;
+            const name = typeof parsed.name === 'string' && parsed.name.trim() ? parsed.name.trim().slice(0, 60) : undefined;
+            // 解析 creator：lead 模式 = lead bot；一起开工 = pickCreatorForGroup 在选中里挑一个在线的。
+            let creatorLarkAppId;
+            if (mode === 'lead') {
+                const leadLarkAppId = typeof parsed.leadLarkAppId === 'string' ? parsed.leadLarkAppId : '';
+                if (!leadLarkAppId || !selectedIds.includes(leadLarkAppId)) {
+                    return jsonRes(res, 400, { ok: false, error: 'bad_lead' });
+                }
+                if (!registry.getByAppId(leadLarkAppId))
+                    return jsonRes(res, 503, { ok: false, error: 'lead_offline' });
+                creatorLarkAppId = leadLarkAppId;
+            }
+            else {
+                const pick = pickCreatorForGroup(selectedIds, (id) => {
+                    const d = registry.getByAppId(id);
+                    return d ? { larkAppId: d.larkAppId, resolvedAllowedUsers: d.resolvedAllowedUsers ?? [] } : undefined;
+                });
+                if (!pick)
+                    return jsonRes(res, 503, { ok: false, error: 'no_online_daemon' });
+                creatorLarkAppId = pick.creatorLarkAppId;
+            }
+            // creator 作用域里的操作者 open_id（首个 ou_ allowedUser）——用于邀请进群 + 转群主 + @通知。
+            // 同时取 on_（union_id，租户内跨 app 稳定）做兜底邀请：lead 模式强制 creator=lead，
+            // 万一 lead 的 allowlist 没有 ou_ 条目，open_id 解析不到、操作者就进不了群——union_id
+            // 不受 app 作用域影响，仍能把人拉进来（createGroupWithBots 走 ownerUnionIds 通道）。
+            const creatorDesc = registry.getByAppId(creatorLarkAppId);
+            const allowed = creatorDesc.resolvedAllowedUsers ?? [];
+            const userOpenId = allowed.find(u => u.startsWith('ou_'));
+            const ownerUnionIds = allowed.filter(u => u.startsWith('on_'));
+            // 建群（拉所有选中 bot + 邀请操作者 + 转群主 + @通知 + 可选绑 oncall 工作目录）。
+            let groupResp = null;
+            try {
+                const groupUpstream = await proxyToDaemon(creatorLarkAppId, '/api/groups/create', {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify({
+                        name,
+                        larkAppIds: selectedIds,
+                        userOpenIds: userOpenId ? [userOpenId] : [],
+                        ownerUnionIds,
+                        transferOwnerTo: userOpenId,
+                        notifyOwnerOpenId: userOpenId,
+                        bindWorkingDir,
+                    }),
+                });
+                groupResp = await groupUpstream.json().catch(() => null);
+                if (!groupUpstream.ok || !groupResp?.ok || typeof groupResp.chatId !== 'string') {
+                    return jsonRes(res, 502, { ok: false, error: groupResp?.error ?? `group_create_http_${groupUpstream.status}` });
+                }
+            }
+            catch {
+                return jsonRes(res, 502, { ok: false, error: 'group_create_proxy_failed' });
+            }
+            const chatId = groupResp.chatId;
+            const invalidBotIds = Array.isArray(groupResp.invalidBotIds) ? groupResp.invalidBotIds : [];
+            // spawn 目标：lead 模式只有 lead；一起开工是所有成功入群的选中 bot。
+            const joinedIds = selectedIds.filter(id => !invalidBotIds.includes(id) && !!registry.getByAppId(id));
+            const targets = mode === 'lead'
+                ? (joinedIds.includes(creatorLarkAppId) ? [creatorLarkAppId] : [])
+                : joinedIds;
+            if (targets.length === 0) {
+                return jsonRes(res, 200, { ok: true, chatId, shareLink: groupResp.shareLink, spawned: [], failed: [], warning: 'no_spawn_target' });
+            }
+            const bots = liveBots();
+            const nameOf = (id) => bots.find(b => b.larkAppId === id)?.botName ?? id;
+            const spawned = [];
+            const failed = [];
+            await Promise.all(targets.map(async (appId) => {
+                const role = mode === 'lead' ? 'lead' : (targets.length > 1 ? 'collab' : 'solo');
+                // lead 的 coworker = 所有 sub（除自己）；collab 的 coworker = 其它并列 bot（除自己）。
+                const coworkerIds = (mode === 'lead' ? selectedIds : targets).filter(id => id !== appId);
+                const coworkers = coworkerIds.map(id => ({ name: nameOf(id) }));
+                try {
+                    const up = await proxyToDaemon(appId, '/api/sessions/spawn', {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json' },
+                        body: JSON.stringify({
+                            chatId, content, column, role, coworkers,
+                            postBanner: appId === creatorLarkAppId,
+                        }),
+                    });
+                    const b = await up.json().catch(() => null);
+                    if (up.ok && b?.ok)
+                        spawned.push(appId);
+                    else
+                        failed.push({ larkAppId: appId, error: b?.error ?? `http_${up.status}` });
+                }
+                catch (e) {
+                    failed.push({ larkAppId: appId, error: e?.message ?? String(e) });
+                }
+            }));
+            return jsonRes(res, 200, {
+                ok: true, chatId, shareLink: groupResp.shareLink, mode, column, spawned, failed,
+            });
+        }
         // Public SSE — relays aggregator's listener events
         if (req.method === 'GET' && url.pathname === '/events') {
             res.writeHead(200, {
@@ -1899,6 +2334,7 @@ listenWithProbe({
         logger.warn(`[dashboard] Failed to persist port to ${PORT_PATH}: ${e.message}`);
     }
     logger.info(`[dashboard] listening on ${config.dashboard.host}:${port}`);
+    startPlatformTunnelIfBound();
 }).catch((err) => {
     logger.error(`[dashboard] could not bind near ${config.dashboard.host}:${config.dashboard.port} after probing — set BOTMUX_DASHBOARD_PORT to a free port. ${err.message}`);
     process.exit(1);
@@ -1913,12 +2349,43 @@ const federationSync = setInterval(() => {
         .catch(() => { });
 }, 2 * 60 * 1000);
 federationSync.unref();
+// 中心化平台隧道（已绑定才启动；每台机器一个，跑在 dashboard 进程里）
+let platformTunnel = null;
+function readBotmuxVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(join(dirname(__dirname), 'package.json'), 'utf8'));
+        return pkg.version || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function startPlatformTunnelIfBound() {
+    try {
+        const binding = readPlatformBinding();
+        if (!binding)
+            return;
+        const version = readBotmuxVersion();
+        platformTunnel = startPlatformTunnelClient({
+            binding,
+            getDashboardPort: () => boundDashboardPort,
+            getDashboardToken: () => activeToken,
+            getVersion: () => version,
+            log: (msg, extra) => logger.info(`[platform-tunnel] ${msg}${extra ? ' ' + JSON.stringify(extra) : ''}`),
+        });
+        logger.info(`[platform-tunnel] 绑定到 ${binding.platformUrl}，启动隧道`);
+    }
+    catch (e) {
+        logger.warn(`[platform-tunnel] 启动失败: ${e.message}`);
+    }
+}
 // Graceful shutdown
 function shutdown() {
     for (const off of subs.values())
         off();
     subs.clear();
     registry.stop();
+    platformTunnel?.stop();
     server.close(() => process.exit(0));
     // Hard-exit fallback after 5s
     setTimeout(() => process.exit(0), 5_000).unref();