botmux 2.88.0 → 2.89.0

package/dist/dashboard.js

@@ -1,7 +1,7 @@
 // src/dashboard.ts
 import { createServer } from 'node:http';
 import { createServer as createTcpServer } from 'node:net';
-import { readFileSync, existsSync, chmodSync, mkdirSync, statSync, createReadStream, } from 'node:fs';
+import { readFileSync, existsSync, mkdirSync, statSync, createReadStream, } from 'node:fs';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
 import { join, dirname, extname, resolve, relative, isAbsolute } from 'node:path';
 import { homedir } from 'node:os';
@@ -10,7 +10,7 @@ import { randomBytes, createHmac } from 'node:crypto';
 import { logger } from './utils/logger.js';
 import { config } from './config.js';
 import { listenWithProbe } from './utils/listen-with-probe.js';
-import { generateToken, parseCookie, buildSetCookie, verifyHmac, cliAuthBind, decideDashboardAuth, loadPersistedToken, persistToken, } from './dashboard/auth.js';
+import { generateToken, parseCookie, buildSetCookie, verifyHmac, cliAuthBind, decideDashboardAuth, loadPersistedToken, persistToken, loadDashboardSecret, loadOrCreateDashboardSecret, } from './dashboard/auth.js';
 import { DaemonRegistry } from './dashboard/registry.js';
 import { Aggregator, subscribeDaemon } from './dashboard/aggregator.js';
 import { pickCreatorForGroup } from './dashboard/operator-selector.js';
@@ -26,9 +26,8 @@ import { getRunsDir } from './workflows/runs-dir.js';
 import { BotOnboardingManager } from './dashboard/bot-onboarding.js';
 import { CLI_SELECT_OPTIONS, resolveCliSelection, isTtadkWrapper, ttadkAcceptsModel, TTADK_DEFAULT_MODEL, TTADK_MODEL_SUGGESTIONS, } from './setup/cli-selection.js';
 import { invalidWorkingDirs } from './utils/working-dir.js';
-import { mergeDashboardConfig, mergeGlobalConfig, mergeMaintenanceConfig, parseMaintenancePatch, readGlobalConfig, setGlobalLocale } from './global-config.js';
+import { mergeGlobalConfig, readGlobalConfig } from './global-config.js';
 import { deleteWhiteboard, listWhiteboards, readWhiteboard, whiteboardEnabled } from './services/whiteboard-store.js';
-import { isLocale } from './i18n/types.js';
 import { isLocalDevInstall, botmuxVersion } from './utils/install-info.js';
 import { checkNode, detectBotmuxInstalls, resolveCurrentVersion } from './utils/install-diagnostics.js';
 import { fetchLatestVersion, fetchReleasesSince, isNewerVersion } from './core/update-check.js';
@@ -37,6 +36,11 @@ import { spawnDetachedRestart, npmGlobalUpdateLockTarget } from './core/maintena
 import { writeRestartIntent } from './services/restart-intent-store.js';
 import { withFileLock } from './utils/file-lock.js';
 import { spawn } from 'node:child_process';
+import { applySettingsWrite, defaultSettingsWriteApplierDeps, } from './dashboard/settings-write-applier.js';
+import { addBotsToGroup, bindOncall, disbandGroup, leaveGroup, unbindOncall, } from './dashboard/groups-action-helpers.js';
+import { defaultWorkflowsActionDeps } from './dashboard/workflows-action-helpers.js';
+import { listRuns as listRunsImpl, readRunSnapshot as readRunSnapshotImpl, scrubSnapshotForUnauthed as scrubSnapshotImpl, isValidRunId as isValidRunIdImpl, TERMINAL_RUN_STATUSES as TERMINAL_RUN_STATUSES_IMPL, } from './workflows/ops-projection.js';
+import { createDaemonInternalApi } from './dashboard/daemon-internal-api.js';
 import { listTeamReports, readTeamBoard, setTeamBoardEntry } from './services/team-board-store.js';
 import { hd2dAssetPath, hd2dStatus, startHd2dDownload } from './dashboard/hd2d-assets.js';
 import { installLocalSkillLinks, readSkillRegistry, removeInstalledSkill, updateInstalledSkillAsync, } from './services/skill-registry-store.js';
@@ -63,14 +67,26 @@ const REGISTRY_DIR = join(homedir(), '.botmux', 'data', 'dashboard-daemons');
 // the `botmux dashboard` CLI can reach /__cli/rotate without guessing.
 const PORT_PATH = join(homedir(), '.botmux', '.dashboard-port');
 function loadOrCreateSecret() {
-    if (existsSync(SECRET_PATH))
-        return readFileSync(SECRET_PATH, 'utf8').trim();
-    const s = randomBytes(32).toString('base64url');
-    mkdirSync(dirname(SECRET_PATH), { recursive: true });
-    atomicWriteFileSync(SECRET_PATH, s, { mode: 0o600 });
-    chmodSync(SECRET_PATH, 0o600);
-    logger.info(`[dashboard] Generated dashboard secret at ${SECRET_PATH}`);
-    return s;
+    let existing;
+    try {
+        existing = loadDashboardSecret(SECRET_PATH);
+    }
+    catch (e) {
+        logger.error(`[dashboard] Failed to read dashboard secret at ${SECRET_PATH}: ${e.message}`);
+        process.exit(1);
+    }
+    if (existing)
+        return existing;
+    const existed = existsSync(SECRET_PATH);
+    try {
+        const secret = loadOrCreateDashboardSecret(SECRET_PATH);
+        logger.info(`[dashboard] ${existed ? 'Regenerated empty' : 'Generated'} dashboard secret at ${SECRET_PATH}`);
+        return secret;
+    }
+    catch (e) {
+        logger.error(`[dashboard] Failed to create dashboard secret at ${SECRET_PATH}: ${e.message}`);
+        process.exit(1);
+    }
 }
 // The active dashboard token is persisted to disk so a previously-issued
 // dashboard URL survives `botmux restart`; only `botmux dashboard` (the
@@ -131,6 +147,65 @@ function resolveDashboardSettings() {
         whiteboard: { enabled: global.whiteboard?.enabled === true },
     };
 }
+// Single shared deps object for `applySettingsWrite` — both the browser
+// `PUT /api/settings` route and (PR2 C6) the HMAC-gated `PUT /__daemon/settings-write`
+// route call through this so error codes / merge semantics stay identical.
+async function reloadLocaleOnAllDaemons() {
+    await Promise.all(registry.list().map(d => fetch(`http://127.0.0.1:${d.ipcPort}/api/locale/reload`, { method: 'POST' }).catch(() => undefined)));
+}
+const settingsWriteApplierDeps = defaultSettingsWriteApplierDeps(resolveDashboardSettings, reloadLocaleOnAllDaemons);
+/** Helper to render a {status, body} HandlerResult through `res`. */
+function writeHandlerResult(res, result) {
+    const headers = { 'content-type': 'application/json', ...(result.headers ?? {}) };
+    res.writeHead(result.status, headers);
+    res.end(typeof result.body === 'string' ? result.body : JSON.stringify(result.body));
+}
+// Shared deps for groups-action-helpers — both the browser
+// `/api/groups/*` routes and (PR2 C6) the HMAC-gated `/__daemon/groups/*`
+// routes use these helpers so response shapes / cascade-close semantics
+// stay identical.
+const groupsActionDeps = {
+    registryList: () => registry.list(),
+    registryGetByAppId: (id) => registry.getByAppId(id),
+    proxyToDaemon,
+    closeSessionsMatching,
+};
+// ─── PR2 C8: Route B internal API (`/__daemon/*`) ───────────────────────────
+// HMAC + loopback + ts ±60s + nonce TTL, signed-request envelope = full
+// (ts, nonce, method, pathWithQuery, sha256(body)). Reuses `.dashboard-secret`
+// for the HMAC key — the same secret `/__cli/rotate` already uses — but the
+// signing material is wider so a `/__cli/rotate` signature cannot be replayed
+// here and vice versa (different protocols, same secret, no cross-replay).
+//
+// SECRET fail-closed: `loadOrCreateSecret()` returns a 32-byte base64url
+// string and never empty; we still guard below at server-startup time.
+if (!SECRET || SECRET.length === 0) {
+    logger.error('[dashboard] SECRET is empty — refusing to mount /__daemon/* dispatcher');
+    process.exit(1);
+}
+const daemonInternalApi = createDaemonInternalApi({
+    secret: SECRET,
+    getSessions: () => aggregator.getSessions(),
+    getSchedules: () => aggregator.getSchedules(),
+    resolveDashboardSettings,
+    buildGroupsMatrix,
+    settingsApplierDeps: settingsWriteApplierDeps,
+    groupsActionDeps,
+    workflowsActionDeps: defaultWorkflowsActionDeps({
+        runsDir: getRunsDir(),
+        proxyToDaemon,
+        listRuns: listRunsImpl,
+        readRunSnapshot: readRunSnapshotImpl,
+        scrubSnapshotForUnauthed: scrubSnapshotImpl,
+        TERMINAL_RUN_STATUSES: TERMINAL_RUN_STATUSES_IMPL,
+        isValidRunId: isValidRunIdImpl,
+    }),
+    proxyToDaemon,
+    ownerOf: (sid) => aggregator.ownerOf(sid),
+    scheduleOwnerOf: (id) => aggregator.scheduleOwnerOf(id),
+    scheduleExists: (id) => aggregator.scheduleExists(id),
+    sessionExists: (sessionId) => aggregator.sessionExists(sessionId),
+});
 async function readJsonBody(req) {
     const chunks = [];
     for await (const c of req)
@@ -468,6 +543,73 @@ async function createLifecycleGroupForWebhook(connector, args) {
     }
     return { chatId: parsed.chatId, creatorLarkAppId: parsed.creator ?? pick.creatorLarkAppId };
 }
+/**
+ * Build the per-(chat × bot) coverage matrix shared by `GET /api/groups`
+ * (browser) and `GET /__daemon/groups-matrix` (Route B). Pure aggregation,
+ * always returns the raw (unscrubbed) view — the browser route applies its
+ * `redactGroupsForPublic` scrub on top when the caller is unauthed.
+ */
+async function buildGroupsMatrix() {
+    const out = new Map();
+    const cliIds = configuredCliIds();
+    const onlineBots = [...registry.list()]
+        .map(b => withConfiguredCliId(b, cliIds))
+        .sort((a, b) => a.botIndex - b.botIndex);
+    await Promise.all(onlineBots.map(async (d) => {
+        try {
+            const r = await fetch(`http://127.0.0.1:${d.ipcPort}/api/groups`);
+            if (!r.ok)
+                return;
+            const j = await r.json();
+            for (const c of j.chats ?? []) {
+                const { oncallChat, firstSeenAt, hasRole, observedBotNames, ...chatBase } = c;
+                const cur = out.get(c.chatId) ?? {
+                    ...chatBase,
+                    memberBots: [],
+                    _firstSeenAt: null,
+                    observedBotNames: [],
+                };
+                if (Array.isArray(observedBotNames) && observedBotNames.length > 0) {
+                    cur.observedBotNames = [...new Set([...(cur.observedBotNames ?? []), ...observedBotNames])];
+                }
+                cur.memberBots.push({
+                    larkAppId: d.larkAppId,
+                    botName: d.botName,
+                    cliId: d.cliId,
+                    inChat: true,
+                    oncallChat: oncallChat ?? null,
+                    hasRole: hasRole ?? false,
+                });
+                if (typeof firstSeenAt === 'number') {
+                    cur._firstSeenAt = cur._firstSeenAt === null
+                        ? firstSeenAt
+                        : Math.min(cur._firstSeenAt, firstSeenAt);
+                }
+                out.set(c.chatId, cur);
+            }
+        }
+        catch { /* skip offline daemons silently — best-effort */ }
+    }));
+    for (const c of out.values()) {
+        const present = new Set(c.memberBots.map((mb) => mb.larkAppId));
+        for (const b of onlineBots) {
+            if (!present.has(b.larkAppId)) {
+                c.memberBots.push({ larkAppId: b.larkAppId, botName: b.botName, cliId: b.cliId, inChat: false, oncallChat: null, hasRole: false });
+            }
+        }
+    }
+    const chats = [...out.values()]
+        .sort((a, b) => {
+        const ta = a._firstSeenAt ?? 0;
+        const tb = b._firstSeenAt ?? 0;
+        if (tb !== ta)
+            return tb - ta;
+        return (a.name ?? a.chatId).localeCompare(b.name ?? b.chatId);
+    })
+        .map(({ _firstSeenAt, ...rest }) => rest);
+    const bots = onlineBots.map(botSummaryPayload);
+    return { chats, bots };
+}
 /**
  * Close every active session matching `pred` by routing to its owning daemon.
  * Used after disband (close all sessions in chat) and leave (close only the
@@ -680,6 +822,16 @@ const server = createServer(async (req, res) => {
         if (await handleFederationApi(req, res, url, { createTeamGroup, liveBots })) {
             return;
         }
+        // Route B: daemon internal API (`/__daemon/*`) — HMAC + loopback,
+        // mounted BEFORE the browser cookie/token gate because this protocol is
+        // entirely self-contained (the daemon caller has the shared secret and
+        // the signing-envelope already binds method/path/body to the timestamp).
+        // Letting the auth gate touch these paths would be wrong: there is no
+        // cookie or token to set/check; the gate would either 401 the daemon
+        // (false negative) or grant cross-protocol access (false positive).
+        if (await daemonInternalApi.handle(req, res, url)) {
+            return;
+        }
         // CLI rotate (HMAC + loopback only) — for `botmux dashboard`. Mints a fresh
         // token, invalidating any previously-issued link.
         if (req.method === 'POST' && url.pathname === '/__cli/rotate') {
@@ -893,78 +1045,10 @@ const server = createServer(async (req, res) => {
             catch {
                 return jsonRes(res, 400, { ok: false, error: 'bad_json' });
             }
-            const body = parsed && typeof parsed === 'object' ? parsed : {};
-            const patch = {};
-            if ('publicReadOnly' in body) {
-                if (typeof body.publicReadOnly !== 'boolean')
-                    return jsonRes(res, 400, { ok: false, error: 'invalid_publicReadOnly' });
-                patch.publicReadOnly = body.publicReadOnly;
-            }
-            if ('openTerminalInFeishu' in body) {
-                if (typeof body.openTerminalInFeishu !== 'boolean')
-                    return jsonRes(res, 400, { ok: false, error: 'invalid_openTerminalInFeishu' });
-                patch.openTerminalInFeishu = body.openTerminalInFeishu;
-            }
-            let touched = false;
-            if (Object.keys(patch).length > 0) {
-                mergeDashboardConfig(patch);
-                touched = true;
-            }
-            if ('repoPickerMode' in body) {
-                const v = body.repoPickerMode;
-                if (v !== 'all' && v !== 'repos')
-                    return jsonRes(res, 400, { ok: false, error: 'invalid_repoPickerMode' });
-                mergeGlobalConfig({ repoPickerMode: v });
-                touched = true;
-            }
-            if ('whiteboard' in body) {
-                const raw = body.whiteboard;
-                if (!raw || typeof raw !== 'object' || Array.isArray(raw))
-                    return jsonRes(res, 400, { ok: false, error: 'invalid_whiteboard' });
-                const wb = raw;
-                if (typeof wb.enabled !== 'boolean')
-                    return jsonRes(res, 400, { ok: false, error: 'invalid_whiteboard_enabled' });
-                mergeGlobalConfig({ whiteboard: { enabled: wb.enabled } });
-                touched = true;
-            }
-            if ('maintenance' in body) {
-                const r = parseMaintenancePatch(body.maintenance);
-                if (!r.ok)
-                    return jsonRes(res, 400, { ok: false, error: r.error });
-                // Auto-update is npm-global only; refuse enabling it on a source checkout.
-                if (r.patch.autoUpdate?.enabled && isLocalDevInstall()) {
-                    return jsonRes(res, 400, { ok: false, error: 'local_dev_no_autoupdate' });
-                }
-                // Auto-restart only applies an auto-update — it's meaningless without it.
-                // Refuse enabling auto-restart unless auto-update is (or is being) on.
-                if (r.patch.autoRestart?.enabled) {
-                    const autoUpdateOn = r.patch.autoUpdate?.enabled
-                        ?? readGlobalConfig().maintenance?.autoUpdate?.enabled
-                        ?? false;
-                    if (!autoUpdateOn)
-                        return jsonRes(res, 400, { ok: false, error: 'autoupdate_required' });
-                }
-                mergeMaintenanceConfig(r.patch);
-                touched = true;
-            }
-            if ('lang' in body) {
-                // Global UI locale — single source of truth shared with `botmux lang`
-                // and the Feishu cards. Persist to ~/.botmux/config.json, then fan out
-                // to every online daemon over the same IPC bus the per-bot config
-                // writes use, so running cards switch language live (no restart).
-                const v = body.lang;
-                if (v === null)
-                    setGlobalLocale(null);
-                else if (isLocale(v))
-                    setGlobalLocale(v);
-                else
-                    return jsonRes(res, 400, { ok: false, error: 'invalid_lang' });
-                await Promise.all(registry.list().map(d => fetch(`http://127.0.0.1:${d.ipcPort}/api/locale/reload`, { method: 'POST' }).catch(() => undefined)));
-                touched = true;
-            }
-            if (!touched)
-                return jsonRes(res, 400, { ok: false, error: 'empty_patch' });
-            return jsonRes(res, 200, { ok: true, settings: resolveDashboardSettings() });
+            const result = await applySettingsWrite(parsed, settingsWriteApplierDeps);
+            if (!result.ok)
+                return jsonRes(res, 400, { ok: false, error: result.error });
+            return jsonRes(res, 200, { ok: true, settings: result.settings });
         }
         // ─── Version & manual update ─────────────────────────────────────────────
         // `npm install -g` and a host restart are privileged: none of these paths
@@ -1457,77 +1541,14 @@ const server = createServer(async (req, res) => {
         }
         // ─── Groups (Phase B) ────────────────────────────────────────────────────
         if (req.method === 'GET' && url.pathname === '/api/groups') {
-            // Fan out: each online daemon returns the chats its bot is in.
-            // Merge by chatId; populate memberBots with inChat flags for every configured bot.
-            const out = new Map();
-            // Sort by botIndex so the matrix columns + the create-group bot picker
-            // both match the order in bots.json (fs.readdir order is unstable).
-            const cliIds = configuredCliIds();
-            const onlineBots = [...registry.list()].map(b => withConfiguredCliId(b, cliIds)).sort((a, b) => a.botIndex - b.botIndex);
-            await Promise.all(onlineBots.map(async (d) => {
-                try {
-                    const r = await fetch(`http://127.0.0.1:${d.ipcPort}/api/groups`);
-                    if (!r.ok)
-                        return;
-                    const j = await r.json();
-                    for (const c of j.chats ?? []) {
-                        // Strip per-bot fields from chat-level so the merged record stays
-                        // bot-agnostic. oncallChat lives inside memberBots; firstSeenAt is
-                        // accumulated as the earliest observation across all bots.
-                        const { oncallChat, firstSeenAt, hasRole, observedBotNames, ...chatBase } = c;
-                        const cur = out.get(c.chatId) ?? { ...chatBase, memberBots: [], _firstSeenAt: null, observedBotNames: [] };
-                        // /introduce 记录按观察者（bot）分文件——跨 daemon 取并集（按名字去重）
-                        if (Array.isArray(observedBotNames) && observedBotNames.length) {
-                            cur.observedBotNames = [...new Set([...(cur.observedBotNames ?? []), ...observedBotNames])];
-                        }
-                        cur.memberBots.push({
-                            larkAppId: d.larkAppId,
-                            botName: d.botName,
-                            cliId: d.cliId,
-                            inChat: true,
-                            oncallChat: oncallChat ?? null,
-                            hasRole: hasRole ?? false,
-                        });
-                        if (typeof firstSeenAt === 'number') {
-                            cur._firstSeenAt = cur._firstSeenAt === null
-                                ? firstSeenAt
-                                : Math.min(cur._firstSeenAt, firstSeenAt);
-                        }
-                        out.set(c.chatId, cur);
-                    }
-                }
-                catch { /* skip offline daemons silently — best-effort */ }
-            }));
-            // Fill in inChat:false slots for bots NOT returned for a given chat (matrix view)
-            for (const c of out.values()) {
-                const present = new Set(c.memberBots.map((mb) => mb.larkAppId));
-                for (const b of onlineBots) {
-                    if (!present.has(b.larkAppId)) {
-                        c.memberBots.push({ larkAppId: b.larkAppId, botName: b.botName, cliId: b.cliId, inChat: false, oncallChat: null, hasRole: false });
-                    }
-                }
-            }
-            // Sort newest-first by client-side firstSeenAt (Lark exposes no chat
-            // create_time, so daemon stamps timestamps the first time it lists each
-            // chat). Tie-break by name asc so chats backfilled in the same listChats
-            // pass — typically every chat on first deploy — get a stable order.
-            const sorted = [...out.values()]
-                .sort((a, b) => {
-                const ta = a._firstSeenAt ?? 0;
-                const tb = b._firstSeenAt ?? 0;
-                if (tb !== ta)
-                    return tb - ta;
-                return (a.name ?? a.chatId).localeCompare(b.name ?? b.chatId);
-            })
-                .map(({ _firstSeenAt, ...rest }) => rest);
-            // Public-read carve-out: oncall bindings carry workingDir (repo/customer
-            // paths). The read-only board only needs chat/bot names; the oncall
-            // editor that consumes oncallChat is authed-only. Strip for anon so the
-            // bound dirs don't leak via /api/groups (mirrors the /api/schedules
-            // prompt strip + keeps /api/bots oncall removal honest).
+            // Fan out via the shared `buildGroupsMatrix` helper so the browser
+            // route and the Route B `/__daemon/groups-matrix` endpoint return the
+            // same matrix shape. Public-read carve-out: oncall bindings carry
+            // workingDir (repo/customer paths) so we scrub when unauthed.
+            const matrix = await buildGroupsMatrix();
             return jsonRes(res, 200, {
-                chats: authed ? sorted : redactGroupsForPublic(sorted),
-                bots: onlineBots.map(botSummaryPayload),
+                chats: authed ? matrix.chats : redactGroupsForPublic(matrix.chats),
+                bots: matrix.bots,
             });
         }
         // ─── Roles (proxy to daemon) ────────────────────────────────────────────
@@ -1697,45 +1718,15 @@ const server = createServer(async (req, res) => {
         let m2;
         if (req.method === 'POST' && (m2 = url.pathname.match(/^\/api\/groups\/([^/]+)\/add-bots$/))) {
             const chatId = decodeURIComponent(m2[1]);
-            // Read body once; we'll forward it to the proxy daemon
-            let raw;
-            try {
-                const chunks = [];
-                for await (const c of req)
-                    chunks.push(c);
-                raw = Buffer.concat(chunks).toString('utf8') || '{}';
-                JSON.parse(raw); // validate is JSON
-            }
-            catch {
-                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
-            }
-            // Find a daemon whose bot is already in this chat
-            let proxy;
-            for (const d of registry.list()) {
-                try {
-                    const r = await fetch(`http://127.0.0.1:${d.ipcPort}/api/groups/${encodeURIComponent(chatId)}/membership`);
-                    if (!r.ok)
-                        continue;
-                    const j = await r.json();
-                    if (j.inChat) {
-                        proxy = d;
-                        break;
-                    }
-                }
-                catch { /* skip */ }
-            }
-            if (!proxy)
-                return jsonRes(res, 200, { ok: false, error: 'no_proxy_bot' });
-            const upstream = await fetch(`http://127.0.0.1:${proxy.ipcPort}/api/groups/${encodeURIComponent(chatId)}/add-bots`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: raw });
-            res.writeHead(upstream.status, { 'content-type': 'application/json' });
-            res.end(await upstream.text());
-            return;
+            const chunks = [];
+            for await (const c of req)
+                chunks.push(c);
+            const raw = Buffer.concat(chunks).toString('utf8') || '{}';
+            const result = await addBotsToGroup(chatId, raw, groupsActionDeps);
+            return writeHandlerResult(res, result);
         }
         // Disband a chat. Body: `{ larkAppId }` — the bot whose daemon should
-        // perform the delete. Disband only succeeds when that bot is currently
-        // the chat owner (or creator with operate_as_owner scope, which botmux
-        // doesn't request by default), so the frontend is responsible for picking
-        // a viable bot. The route just proxies and surfaces Lark's error verbatim.
+        // perform the delete. See `dashboard/groups-action-helpers.ts:disbandGroup`.
         let mDisband;
         if (req.method === 'POST' && (mDisband = url.pathname.match(/^\/api\/groups\/([^/]+)\/disband$/))) {
             const chatId = decodeURIComponent(mDisband[1]);
@@ -1749,30 +1740,12 @@ const server = createServer(async (req, res) => {
             catch {
                 return jsonRes(res, 400, { ok: false, error: 'bad_json' });
             }
-            const appId = typeof parsed.larkAppId === 'string' ? parsed.larkAppId : '';
-            if (!appId)
-                return jsonRes(res, 400, { ok: false, error: 'larkAppId_required' });
-            const upstream = await proxyToDaemon(appId, `/api/groups/${encodeURIComponent(chatId)}/disband`, { method: 'POST' });
-            const upstreamText = await upstream.text();
-            let upstreamJson = null;
-            try {
-                upstreamJson = JSON.parse(upstreamText);
-            }
-            catch { /* tolerate */ }
-            // On successful disband, the chat is gone for everyone — every bot's
-            // session in this chat becomes a zombie (worker still alive, can't post).
-            // Close them all so the UI / Sessions list don't keep them as active.
-            let closedSessions = [];
-            if (upstreamJson?.ok) {
-                closedSessions = await closeSessionsMatching(s => s.chatId === chatId);
-            }
-            res.writeHead(upstream.status, { 'content-type': 'application/json' });
-            res.end(JSON.stringify({ ...(upstreamJson ?? {}), closedSessions }));
-            return;
+            const result = await disbandGroup(chatId, parsed, groupsActionDeps);
+            return writeHandlerResult(res, result);
         }
-        // Make selected bots leave a chat. Body: `{ larkAppIds: string[] }`.  Each
-        // bot is removed via its own daemon (Lark allows self-removal under any
-        // role). Per-bot results returned so the UI can show partial successes.
+        // Make selected bots leave a chat. Body: `{ larkAppIds: string[] }`. See
+        // `dashboard/groups-action-helpers.ts:leaveGroup` for membership probe +
+        // cascade-close semantics.
         let mLeave;
         if (req.method === 'POST' && (mLeave = url.pathname.match(/^\/api\/groups\/([^/]+)\/leave$/))) {
             const chatId = decodeURIComponent(mLeave[1]);
@@ -1786,54 +1759,12 @@ const server = createServer(async (req, res) => {
             catch {
                 return jsonRes(res, 400, { ok: false, error: 'bad_json' });
             }
-            const ids = Array.isArray(parsed.larkAppIds)
-                ? parsed.larkAppIds.filter((x) => typeof x === 'string')
-                : [];
-            if (ids.length === 0)
-                return jsonRes(res, 400, { ok: false, error: 'larkAppIds_required' });
-            // Re-check membership on the daemon side before issuing leave — UI cache
-            // can be stale, and Lark's bot-self-remove returns a confusing error if
-            // the bot isn't actually in the chat. Skipping such bots up-front keeps
-            // the per-bot result useful (`not_in_chat`) instead of a vague API error.
-            const result = await Promise.all(ids.map(async (appId) => {
-                const d = registry.getByAppId(appId);
-                if (!d)
-                    return { larkAppId: appId, ok: false, error: 'daemon_offline' };
-                try {
-                    const memRes = await fetch(`http://127.0.0.1:${d.ipcPort}/api/groups/${encodeURIComponent(chatId)}/membership`);
-                    const memJson = await memRes.json();
-                    if (!memJson.inChat)
-                        return { larkAppId: appId, ok: false, error: 'not_in_chat' };
-                }
-                catch (e) {
-                    return { larkAppId: appId, ok: false, error: `membership_check_failed: ${e?.message ?? e}` };
-                }
-                const upstream = await proxyToDaemon(appId, `/api/groups/${encodeURIComponent(chatId)}/leave`, { method: 'POST' });
-                const text = await upstream.text();
-                let body = null;
-                try {
-                    body = JSON.parse(text);
-                }
-                catch { /* tolerate */ }
-                // On successful leave, the leaving bot can no longer post into the
-                // chat — its sessions there are stranded. Close only THIS bot's
-                // sessions for THIS chat (other bots may still be in the chat with
-                // their own active sessions).
-                const closedSessions = body?.ok
-                    ? await closeSessionsMatching(s => s.chatId === chatId && s.larkAppId === appId)
-                    : [];
-                return {
-                    larkAppId: appId,
-                    ok: !!body?.ok,
-                    error: body?.ok ? undefined : (body?.error ?? `http_${upstream.status}`),
-                    closedSessions,
-                };
-            }));
-            return jsonRes(res, 200, { result });
+            const result = await leaveGroup(chatId, parsed, groupsActionDeps);
+            return writeHandlerResult(res, result);
         }
         // ─── Oncall bindings (per chat × bot) ────────────────────────────────────
-        // PUT /api/groups/:chatId/oncall/:larkAppId    body: {workingDir}
-        // DELETE /api/groups/:chatId/oncall/:larkAppId
+        // External: PUT/DELETE /api/groups/:chatId/oncall/:larkAppId
+        // Internal: PUT/DELETE /api/oncall/:chatId (on the named bot's daemon).
         let mOncall;
         if ((mOncall = url.pathname.match(/^\/api\/groups\/([^/]+)\/oncall\/([^/]+)$/))) {
             const chatId = decodeURIComponent(mOncall[1]);
@@ -1842,17 +1773,13 @@ const server = createServer(async (req, res) => {
                 const chunks = [];
                 for await (const c of req)
                     chunks.push(c);
-                const raw = Buffer.concat(chunks).toString('utf8') || '{}';
-                const upstream = await proxyToDaemon(appId, `/api/oncall/${encodeURIComponent(chatId)}`, { method: 'PUT', headers: { 'content-type': 'application/json' }, body: raw });
-                res.writeHead(upstream.status, { 'content-type': 'application/json' });
-                res.end(await upstream.text());
-                return;
+                const raw = Buffer.concat(chunks).toString('utf8');
+                const result = await bindOncall(chatId, appId, raw, groupsActionDeps);
+                return writeHandlerResult(res, result);
             }
             if (req.method === 'DELETE') {
-                const upstream = await proxyToDaemon(appId, `/api/oncall/${encodeURIComponent(chatId)}`, { method: 'DELETE' });
-                res.writeHead(upstream.status, { 'content-type': 'application/json' });
-                res.end(await upstream.text());
-                return;
+                const result = await unbindOncall(chatId, appId, groupsActionDeps);
+                return writeHandlerResult(res, result);
             }
         }
         // ─── Per-bot defaults (Bot Defaults tab) ─────────────────────────────────
@@ -2166,8 +2093,6 @@ const server = createServer(async (req, res) => {
             const content = typeof parsed.content === 'string' ? parsed.content.replace(/\s+$/u, '') : '';
             if (!content.trim())
                 return jsonRes(res, 400, { ok: false, error: 'empty_content' });
-            if (content.length > 8000)
-                return jsonRes(res, 400, { ok: false, error: 'content_too_long' });
             const selectedIds = Array.isArray(parsed.larkAppIds)
                 ? Array.from(new Set(parsed.larkAppIds.filter((x) => typeof x === 'string')))
                 : [];