botmux 2.92.0 → 2.93.1

package/dist/dashboard.js

@@ -21,7 +21,7 @@ import { handleConnectorApi } from './dashboard/connector-api.js';
 import { redactGroupsForPublic, redactSchedulesForPublic } from './dashboard/public-redact.js';
 import { handleWebhookRoute } from './dashboard/webhook-routes.js';
 import { handleFederationApi } from './dashboard/federation-api.js';
-import { handleFederationSpokeApi, syncAllMemberships } from './dashboard/federation-spoke-api.js';
+import { handleFederationSpokeApi, syncAllMemberships, autoBindOwnerIfUnambiguous } from './dashboard/federation-spoke-api.js';
 import { getRunsDir } from './workflows/runs-dir.js';
 import { BotOnboardingManager } from './dashboard/bot-onboarding.js';
 import { CLI_SELECT_OPTIONS, resolveCliSelection, isTtadkWrapper, ttadkAcceptsModel, TTADK_DEFAULT_MODEL, TTADK_MODEL_SUGGESTIONS, } from './setup/cli-selection.js';
@@ -52,8 +52,7 @@ import { installDashboardSkill, parseDashboardSkillInstallRequest, parseInstallL
 import { botDefaultsPayload, botSummaryPayload } from './dashboard/bot-payload.js';
 import { isValidRoleProfileId } from './services/role-profile-store.js';
 import { mergeSafeInsightOverviews } from './services/insight/report.js';
-import { watch as fsWatch } from 'node:fs';
-import { readPlatformBinding, PLATFORM_BINDING_PATH } from './platform/binding.js';
+import { readPlatformBinding } from './platform/binding.js';
 import { startPlatformTunnelClient } from './platform/tunnel-client.js';
 import { cleanupIdleSessions, parseIdleCleanupHours } from './dashboard/session-cleanup.js';
 const SECRET_PATH = join(homedir(), '.botmux', '.dashboard-secret');
@@ -898,6 +897,22 @@ const server = createServer(async (req, res) => {
                 return jsonRes(res, 404, { error: 'no_active_token' });
             return jsonRes(res, 200, { url: dashboardUrlFor(activeToken) });
         }
+        // CLI 通知绑定变化（HMAC + loopback）——`botmux bind` 写完绑定后捅一下，立即重连平台，
+        // 无需重启 daemon，也不依赖 fs.watch。
+        if (req.method === 'POST' && url.pathname === '/__cli/reload-binding') {
+            const gate = verifyCliRequest(req, url.pathname);
+            if (!gate.ok)
+                return jsonRes(res, gate.status, gate.body);
+            try {
+                platformTunnel?.stop();
+            }
+            catch {
+                /* ignore */
+            }
+            platformTunnel = null;
+            startPlatformTunnelIfBound();
+            return jsonRes(res, 200, { ok: true });
+        }
         const presentedToken = authedToken(req, url);
         const dashboardSettings = resolveDashboardSettings();
         const decision = decideDashboardAuth({
@@ -2306,7 +2321,6 @@ listenWithProbe({
     }
     logger.info(`[dashboard] listening on ${config.dashboard.host}:${port}`);
     startPlatformTunnelIfBound();
-    watchPlatformBinding(); // bind 后无需重启 daemon，自动连接平台
 }).catch((err) => {
     logger.error(`[dashboard] could not bind near ${config.dashboard.host}:${config.dashboard.port} after probing — set BOTMUX_DASHBOARD_PORT to a free port. ${err.message}`);
     process.exit(1);
@@ -2321,14 +2335,46 @@ const federationSync = setInterval(() => {
         .catch(() => { });
 }, 2 * 60 * 1000);
 federationSync.unref();
+// 单候选自动绑定：standalone（未入团队）部署不必手动点面板「绑定」——用各机器人自己的
+// 凭证从 allowedUsers 解析出唯一负责人就自动认领，左上角飞书头像 / 拉群把发起人拉进群 /
+// 机器人归属随即生效。多候选（部署里配了多个人）仍保留手动选择。幂等：绑定后即刻 no-op。
+// 启动时按 0/5/15/60s 退避重试几次以覆盖 boot 时网络/凭证尚未就绪，之后交给手动按钮，
+// 不挂进永久心跳（避免对真·多候选/无 allowedUsers 的部署每 2 分钟空打飞书）。
+async function tryAutoBindOwner() {
+    try {
+        const r = await autoBindOwnerIfUnambiguous(config.session.dataDir, { fetcher: fetch, live: liveBots() });
+        if (r.status === 'bound') {
+            logger.info(`[identity] 已自动绑定本部署负责人：${r.owner?.name || r.owner?.unionId}（头像/拉群/归属即时生效）`);
+            return 'done';
+        }
+        if (r.status === 'already_bound')
+            return 'done';
+        if (r.status === 'need_choice') {
+            logger.info(`[identity] 检测到 ${r.candidates?.length ?? 0} 个候选负责人，请到面板「团队」手动选择绑定`);
+            return 'done';
+        }
+        return 'retry'; // no_candidates：可能是网络/凭证未就绪的瞬时失败，退避后重试
+    }
+    catch (e) {
+        logger.debug(`[identity] 自动绑定尝试失败（将退避重试）：${e.message}`);
+        return 'retry';
+    }
+}
+void (async () => {
+    for (const delayMs of [0, 5_000, 15_000, 60_000]) {
+        if (delayMs)
+            await new Promise((r) => setTimeout(r, delayMs));
+        if ((await tryAutoBindOwner()) === 'done')
+            return;
+    }
+})();
 // 中心化平台隧道（已绑定才启动；每台机器一个，跑在 dashboard 进程里）
 let platformTunnel = null;
-// 当前隧道对应的绑定身份（platformUrl|machineId|machineToken）；用于判断 bind 变化是否需要重连
-let platformBindingKey = null;
 function readBotmuxVersion() {
+    // 与本地 dashboard「版本与更新」卡同源：源码 checkout 的 package.json 是占位的 0.0.0，
+    // resolveCurrentVersion() 会用 git describe 推出真实版本（如 2.91.1），npm 安装则用 package.json。
     try {
-        const pkg = JSON.parse(readFileSync(join(dirname(__dirname), 'package.json'), 'utf8'));
-        return pkg.version || 'unknown';
+        return resolveCurrentVersion();
     }
     catch {
         return 'unknown';
@@ -2360,10 +2406,8 @@ function readPlatformBotsInfo() {
 function startPlatformTunnelIfBound() {
     try {
         const binding = readPlatformBinding();
-        if (!binding) {
-            platformBindingKey = null;
+        if (!binding)
             return;
-        }
         const version = readBotmuxVersion();
         platformTunnel = startPlatformTunnelClient({
             binding,
@@ -2373,52 +2417,12 @@ function startPlatformTunnelIfBound() {
             getBots: () => readPlatformBotsInfo(),
             log: (msg, extra) => logger.info(`[platform-tunnel] ${msg}${extra ? ' ' + JSON.stringify(extra) : ''}`),
         });
-        platformBindingKey = `${binding.platformUrl}|${binding.machineId}|${binding.machineToken}`;
         logger.info(`[platform-tunnel] 绑定到 ${binding.platformUrl}，启动隧道`);
     }
     catch (e) {
         logger.warn(`[platform-tunnel] 启动失败: ${e.message}`);
     }
 }
-/**
- * 监听绑定文件变化：`botmux bind` 写入后无需重启 daemon，自动连接平台。
- * 只在绑定「身份」(platformUrl/machineId/machineToken) 变化时重连——团队成员变化也会改写该文件
- * （tunnel-client 自己写的），那种不重连，避免反复重启。
- */
-function watchPlatformBinding() {
-    let timer = null;
-    const onChange = () => {
-        if (timer)
-            clearTimeout(timer);
-        timer = setTimeout(() => {
-            const b = readPlatformBinding();
-            const key = b ? `${b.platformUrl}|${b.machineId}|${b.machineToken}` : null;
-            if (key === platformBindingKey)
-                return; // 没变（或仅团队变化）→ 不重连
-            logger.info('[platform-tunnel] 检测到绑定变化，重连平台');
-            try {
-                platformTunnel?.stop();
-            }
-            catch {
-                /* ignore */
-            }
-            platformTunnel = null;
-            startPlatformTunnelIfBound();
-        }, 800);
-    };
-    try {
-        // 监听所在目录而非文件本身——绑定走原子写（临时文件 + rename），直接 watch 文件会在 rename 后失效
-        const dir = dirname(PLATFORM_BINDING_PATH);
-        const base = PLATFORM_BINDING_PATH.slice(dir.length + 1);
-        fsWatch(dir, (_event, filename) => {
-            if (!filename || filename === base)
-                onChange();
-        });
-    }
-    catch (e) {
-        logger.warn(`[platform-tunnel] 绑定文件监听启动失败: ${e.message}`);
-    }
-}
 // Graceful shutdown
 function shutdown() {
     for (const off of subs.values())