botmux 2.97.0 → 2.98.0

package/dist/platform/tunnel-client.js

@@ -8,7 +8,16 @@ import { setPlatformTeams } from './binding.js';
 const HEARTBEAT_MS = 30_000;
 const BACKOFF_MIN_MS = 1_000;
 const BACKOFF_MAX_MS = 30_000;
-const DATA_DIAL_TIMEOUT_MS = 10_000;
+// 数据流拨号：单次超时 + 有界重试。某些部署到平台 LB 某几个 VIP 的链路对 TLS/大包 ~50% 丢，
+// 单拨一次就 502/掉 asset；像浏览器/CLI 那样「重试 + 复用」即可大幅救回。重试是「有界 + 限速」的：
+//  - 单次拨号超时缩到 3.5s（原 10s 太长，留不出重试窗口；健康链路拨号 <1s，不受影响）
+//  - 总拨号次数封顶 DATA_DIAL_MAX_ATTEMPTS（含首拨），绝不无限重试
+//  - 两次拨号间至少隔 DATA_DIAL_RETRY_BACKOFF_MS，控制 QPS，不猛拨
+//  - 总时长不超过 DATA_DIAL_OVERALL_DEADLINE_MS（平台 pending 流 10s 后作废，超了再拨也是白拨）
+const DATA_DIAL_TIMEOUT_MS = 3_500;
+const DATA_DIAL_MAX_ATTEMPTS = 3;
+const DATA_DIAL_RETRY_BACKOFF_MS = 300;
+const DATA_DIAL_OVERALL_DEADLINE_MS = 9_000;
 export function startPlatformTunnelClient(opts) {
     let stopped = false;
     let ws = null;
@@ -129,40 +138,77 @@ export function startPlatformTunnelClient(opts) {
     }
     function openDataStream(streamId) {
         const url = `${base}/tunnel/data?token=${tokenQ}&stream=${encodeURIComponent(streamId)}`;
-        // 同上：数据流必须关 permessage-deflate，否则大文件(CSS/JS)帧经网关压缩协商错位 → RSV1 报错断流。
-        const data = new WebSocket(url, { perMessageDeflate: false });
-        const dialTimer = setTimeout(() => {
-            try {
-                data.terminate();
-            }
-            catch {
-                /* ignore */
-            }
-        }, DATA_DIAL_TIMEOUT_MS);
-        data.on('open', () => {
-            clearTimeout(dialTimer);
-            const dup = createWebSocketStream(data);
-            const tcp = net.connect(opts.getDashboardPort(), '127.0.0.1');
-            const kill = () => {
+        const startedAt = Date.now();
+        let attempt = 0;
+        const dial = () => {
+            attempt++;
+            // 同上：数据流必须关 permessage-deflate，否则大文件(CSS/JS)帧经网关压缩协商错位 → RSV1 报错断流。
+            const data = new WebSocket(url, { perMessageDeflate: false });
+            let settled = false; // 本次拨号是否已定局（成功桥接 / 失败转交重试），防 timer 与 error 重复触发
+            // 拨号失败（超时或 error）：在预算内换一条新连接重试同一个 streamId（平台 pending 仍在）；
+            // 超出次数/时间预算就放弃。绝不无限重试，两次之间留 backoff 限速。
+            const retryOrGiveUp = (reason) => {
+                const canRetry = attempt < DATA_DIAL_MAX_ATTEMPTS &&
+                    Date.now() - startedAt < DATA_DIAL_OVERALL_DEADLINE_MS;
+                if (canRetry) {
+                    opts.log('数据连接拨号失败，重试', { attempt, reason });
+                    setTimeout(dial, DATA_DIAL_RETRY_BACKOFF_MS);
+                }
+                else {
+                    opts.log('数据连接失败', { attempts: attempt, err: reason });
+                }
+            };
+            const dialTimer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
                 try {
-                    dup.destroy();
+                    data.terminate();
                 }
                 catch { /* ignore */ }
+                retryOrGiveUp(`dial timeout (${DATA_DIAL_TIMEOUT_MS}ms)`);
+            }, DATA_DIAL_TIMEOUT_MS);
+            data.on('open', () => {
+                if (settled) {
+                    try {
+                        data.terminate();
+                    }
+                    catch { /* ignore */ }
+                    return;
+                }
+                settled = true;
+                clearTimeout(dialTimer);
+                const dup = createWebSocketStream(data);
+                const tcp = net.connect(opts.getDashboardPort(), '127.0.0.1');
+                const kill = () => {
+                    try {
+                        dup.destroy();
+                    }
+                    catch { /* ignore */ }
+                    try {
+                        tcp.destroy();
+                    }
+                    catch { /* ignore */ }
+                };
+                dup.on('error', kill);
+                tcp.on('error', kill);
+                tcp.on('close', kill);
+                dup.pipe(tcp);
+                tcp.pipe(dup);
+            });
+            data.on('error', (e) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(dialTimer);
                 try {
-                    tcp.destroy();
+                    data.terminate();
                 }
                 catch { /* ignore */ }
-            };
-            dup.on('error', kill);
-            tcp.on('error', kill);
-            tcp.on('close', kill);
-            dup.pipe(tcp);
-            tcp.pipe(dup);
-        });
-        data.on('error', (e) => {
-            clearTimeout(dialTimer);
-            opts.log('数据连接失败', { err: String(e) });
-        });
+                retryOrGiveUp(String(e));
+            });
+        };
+        dial();
     }
     connect();
     return {

package/dist/platform/tunnel-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel-client.js","sourceRoot":"","sources":["../../src/platform/tunnel-client.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,iDAAiD;AACjD,kDAAkD;AAClD,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAA2C,MAAM,cAAc,CAAC;AAyBzF,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAMpC,MAAM,UAAU,yBAAyB,CAAC,IAAyB;IACjE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,EAAE,GAAqB,IAAI,CAAC;IAChC,IAAI,SAAS,GAA0B,IAAI,CAAC;IAC5C,IAAI,cAAc,GAA0B,IAAI,CAAC;IACjD,IAAI,OAAO,GAAG,cAAc,CAAC;IAC7B,sBAAsB;IACtB,IAAI,KAAK,GAAmB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7D,SAAS,OAAO;QACd,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,GAAG,GAAG,GAAG,IAAI,yBAAyB,MAAM,EAAE,CAAC;QACrD,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,qBAAqB;QACrB,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,EAAE,GAAG,IAAI,CAAC;QAEV,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACnB,OAAO,GAAG,cAAc,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpB,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,GAA6E,CAAC;YAClF,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC/C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAClD,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACnD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAC/C,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,WAAW,EAAE,CAAC;YACd,iBAAiB,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrC,wBAAwB;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,WAAW;QAClB,IAAI,SAAS,EAAE,CAAC;YACd,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IAED,SAAS,iBAAiB;QACxB,IAAI,OAAO,IAAI,cAAc;YAAE,OAAO;QACtC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,SAAS,YAAY,CAAC,IAAe;QACnC,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,EAAE;YACrC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE;YAChC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE;YAC9C,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACtC,WAAW,EAAE,KAAK;YAClB,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,SAAS,aAAa,CAAC,IAAe;QACpC,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE;YAChC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE;YAC9C,WAAW,EAAE,KAAK;YAClB,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,SAAS,QAAQ,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAe;QACjE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC5C,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,YAAY,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;IACnC,CAAC;IAED,SAAS,SAAS,CAAC,MAAc,EAAE,IAAe;QAChD,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACjD,YAAY,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7B,aAAa,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,SAAS,YAAY;QACnB,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,SAAS,cAAc,CAAC,QAAgB;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,sBAAsB,MAAM,WAAW,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,oEAAoE;QACpE,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAEzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACnB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,WAAW,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,IAAI,CAAC;oBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,CAAC;oBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC/C,CAAC,CAAC;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,CAAC;IAEV,OAAO;QACL,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,EAAE,CAAC;YACd,IAAI,cAAc,EAAE,CAAC;gBACnB,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,CAAC;gBACH,EAAE,EAAE,KAAK,EAAE,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,GAAY;IAC7C,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,WAAmB;IACjC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,gBAAgB;IAChB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"tunnel-client.js","sourceRoot":"","sources":["../../src/platform/tunnel-client.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,iDAAiD;AACjD,kDAAkD;AAClD,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAA2C,MAAM,cAAc,CAAC;AAyBzF,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,2DAA2D;AAC3D,8DAA8D;AAC9D,qDAAqD;AACrD,gDAAgD;AAChD,oDAAoD;AACpD,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAM5C,MAAM,UAAU,yBAAyB,CAAC,IAAyB;IACjE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,EAAE,GAAqB,IAAI,CAAC;IAChC,IAAI,SAAS,GAA0B,IAAI,CAAC;IAC5C,IAAI,cAAc,GAA0B,IAAI,CAAC;IACjD,IAAI,OAAO,GAAG,cAAc,CAAC;IAC7B,sBAAsB;IACtB,IAAI,KAAK,GAAmB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7D,SAAS,OAAO;QACd,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,GAAG,GAAG,GAAG,IAAI,yBAAyB,MAAM,EAAE,CAAC;QACrD,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,qBAAqB;QACrB,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,EAAE,GAAG,IAAI,CAAC;QAEV,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACnB,OAAO,GAAG,cAAc,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpB,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,GAA6E,CAAC;YAClF,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC/C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAClD,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACnD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAC/C,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,WAAW,EAAE,CAAC;YACd,iBAAiB,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrC,wBAAwB;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,WAAW;QAClB,IAAI,SAAS,EAAE,CAAC;YACd,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IAED,SAAS,iBAAiB;QACxB,IAAI,OAAO,IAAI,cAAc;YAAE,OAAO;QACtC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,SAAS,YAAY,CAAC,IAAe;QACnC,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,EAAE;YACrC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE;YAChC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE;YAC9C,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACtC,WAAW,EAAE,KAAK;YAClB,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,SAAS,aAAa,CAAC,IAAe;QACpC,QAAQ,CAAC,IAAI,EAAE;YACb,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE;YAChC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE;YAC9C,WAAW,EAAE,KAAK;YAClB,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,SAAS,QAAQ,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAe;QACjE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC5C,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,YAAY,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;IACnC,CAAC;IAED,SAAS,SAAS,CAAC,MAAc,EAAE,IAAe;QAChD,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACjD,YAAY,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7B,aAAa,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,SAAS,YAAY;QACnB,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,SAAS,cAAc,CAAC,QAAgB;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,sBAAsB,MAAM,WAAW,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,OAAO,EAAE,CAAC;YACV,oEAAoE;YACpE,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,gDAAgD;YAErE,2DAA2D;YAC3D,wCAAwC;YACxC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAQ,EAAE;gBAC7C,MAAM,QAAQ,GACZ,OAAO,GAAG,sBAAsB;oBAChC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,6BAA6B,CAAC;gBACzD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC7C,UAAU,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;gBAC/C,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,CAAC;oBAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAChD,aAAa,CAAC,iBAAiB,oBAAoB,KAAK,CAAC,CAAC;YAC5D,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAEzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACnB,IAAI,OAAO,EAAE,CAAC;oBAAC,IAAI,CAAC;wBAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACzE,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBACxC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC9D,MAAM,IAAI,GAAG,GAAG,EAAE;oBAChB,IAAI,CAAC;wBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;oBAC7C,IAAI,CAAC;wBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC/C,CAAC,CAAC;gBACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACtB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACrB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,IAAI,CAAC;oBAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAChD,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC;IAED,OAAO,EAAE,CAAC;IAEV,OAAO;QACL,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,EAAE,CAAC;YACd,IAAI,cAAc,EAAE,CAAC;gBACnB,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,CAAC;gBACH,EAAE,EAAE,KAAK,EAAE,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,GAAY;IAC7C,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,WAAmB;IACjC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,gBAAgB;IAChB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC"}

package/dist/services/team-bots-store.d.ts

@@ -0,0 +1,34 @@
+/** Learned-teammate entries older than this (by lastSeenAt) are ignored by
+ *  isTeamBot / listTeamBots — the bot hasn't shown up in a team context for a
+ *  month, so we stop vouching for it until it's seen again. */
+export declare const DEFAULT_EXPIRY_MS: number;
+export interface TeamBot {
+    unionId: string;
+    name: string;
+    firstSeenAt: number;
+    lastSeenAt: number;
+}
+/**
+ * Upsert a learned teammate bot by union_id. Existing entry keeps firstSeenAt
+ * and bumps lastSeenAt (+ refreshes name); new entry stamps both.
+ *
+ * No-op when unionId is empty — many inbound bot events DO carry
+ * `sender.sender_id.union_id`, but the ones that don't simply can't be learned
+ * (and fall back to the existing /grant path), never polluting the store with a
+ * keyless entry. name may be empty (we still record the trusted union_id).
+ *
+ * Returns true iff the store changed (new entry or refreshed timestamp/name),
+ * so callers can skip a redundant log.
+ */
+export declare function recordTeamBot(dataDir: string, bot: {
+    unionId: string | undefined;
+    name?: string;
+}, now?: number): boolean;
+/** Is `unionId` a known (non-expired) teammate bot? The auth gate's predicate.
+ *  Empty/unknown/expired → false (caller falls back to /grant). */
+export declare function isTeamBot(dataDir: string, unionId: string | undefined, maxAgeMs?: number, now?: number): boolean;
+/** All non-expired learned teammate bots (for discovery / debugging). Unordered. */
+export declare function listTeamBots(dataDir: string, maxAgeMs?: number, now?: number): TeamBot[];
+/** Forget a learned teammate (explicit revoke). Returns true if removed. */
+export declare function removeTeamBot(dataDir: string, unionId: string | undefined): boolean;
+//# sourceMappingURL=team-bots-store.d.ts.map

package/dist/services/team-bots-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-bots-store.d.ts","sourceRoot":"","sources":["../../src/services/team-bots-store.ts"],"names":[],"mappings":"AAiCA;;+DAE+D;AAC/D,eAAO,MAAM,iBAAiB,QAA2B,CAAC;AAE1D,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACnD,GAAG,GAAE,MAAmB,GACvB,OAAO,CAWT;AAED;mEACmE;AACnE,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,QAAQ,GAAE,MAA0B,EACpC,GAAG,GAAE,MAAmB,GACvB,OAAO,CAMT;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAA0B,EACpC,GAAG,GAAE,MAAmB,GACvB,OAAO,EAAE,CAQX;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQnF"}

package/dist/services/team-bots-store.js

@@ -0,0 +1,111 @@
+/**
+ * Team-bot identity store: the tenant-stable `union_id` set of bots this
+ * deployment has learned are TEAMMATES, so the auth gate can let them
+ * collaborate without `/grant` (and without `/introduce` for discovery).
+ *
+ * Why union_id is the key (not name, not open_id):
+ * - **name is spoofable** — anyone in the tenant can run a bot called "Claude".
+ *   Trust must never hinge on a self-reported display name.
+ * - **open_id is per-app scoped** — bot B's open_id as seen by app A ≠ as seen
+ *   by app B, so it can't be a shared trust key across deployments.
+ * - **union_id is tenant-stable and cross-app consistent** — the same value in
+ *   every app's view of the same bot, and Feishu vouches for it (it arrives on
+ *   inbound events as `sender.sender_id.union_id`). It is the only sound key.
+ *
+ * Where entries come from (the trust ROOT — see recordTeamBot callers):
+ * - A bot observed talking inside a TEAM-ASSEMBLED group (a 拉群 group recorded
+ *   in [[team-groups-store]]). Such groups are built by the team itself, adding
+ *   bots by `larkAppId` from the federated roster — membership is team-controlled,
+ *   so a bot speaking there is a vouched teammate. We capture its union_id here,
+ *   then honour that union_id as a teammate in ANY group (incl. manually-created
+ *   ones), without re-deriving trust from a spoofable name.
+ *
+ * Revocation / self-healing: entries carry lastSeenAt and expire after
+ * DEFAULT_EXPIRY_MS if the bot stops appearing in team contexts — so a bot that
+ * leaves the team ages out of the trusted set on its own.
+ *
+ * Storage: `{dataDir}/team-bots.json`, deployment-wide (not per-chat: trust in a
+ * teammate is global once established). Atomic writes via the shared helper.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { atomicWriteFileSync } from '../utils/atomic-write.js';
+/** Learned-teammate entries older than this (by lastSeenAt) are ignored by
+ *  isTeamBot / listTeamBots — the bot hasn't shown up in a team context for a
+ *  month, so we stop vouching for it until it's seen again. */
+export const DEFAULT_EXPIRY_MS = 30 * 24 * 60 * 60 * 1000;
+function filePath(dataDir) {
+    return join(dataDir, 'team-bots.json');
+}
+function readFile(dataDir) {
+    const fp = filePath(dataDir);
+    if (!existsSync(fp))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(fp, 'utf-8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+            return parsed;
+    }
+    catch { /* corrupt — fall through */ }
+    return {};
+}
+/**
+ * Upsert a learned teammate bot by union_id. Existing entry keeps firstSeenAt
+ * and bumps lastSeenAt (+ refreshes name); new entry stamps both.
+ *
+ * No-op when unionId is empty — many inbound bot events DO carry
+ * `sender.sender_id.union_id`, but the ones that don't simply can't be learned
+ * (and fall back to the existing /grant path), never polluting the store with a
+ * keyless entry. name may be empty (we still record the trusted union_id).
+ *
+ * Returns true iff the store changed (new entry or refreshed timestamp/name),
+ * so callers can skip a redundant log.
+ */
+export function recordTeamBot(dataDir, bot, now = Date.now()) {
+    const unionId = (bot.unionId ?? '').trim();
+    if (!unionId)
+        return false;
+    const name = (bot.name ?? '').trim();
+    const data = readFile(dataDir);
+    const prior = data[unionId];
+    data[unionId] = prior
+        ? { ...prior, name: name || prior.name, lastSeenAt: now }
+        : { name, firstSeenAt: now, lastSeenAt: now };
+    atomicWriteFileSync(filePath(dataDir), JSON.stringify(data, null, 2) + '\n');
+    return true;
+}
+/** Is `unionId` a known (non-expired) teammate bot? The auth gate's predicate.
+ *  Empty/unknown/expired → false (caller falls back to /grant). */
+export function isTeamBot(dataDir, unionId, maxAgeMs = DEFAULT_EXPIRY_MS, now = Date.now()) {
+    const id = (unionId ?? '').trim();
+    if (!id)
+        return false;
+    const entry = readFile(dataDir)[id];
+    if (!entry)
+        return false;
+    return now - entry.lastSeenAt <= maxAgeMs;
+}
+/** All non-expired learned teammate bots (for discovery / debugging). Unordered. */
+export function listTeamBots(dataDir, maxAgeMs = DEFAULT_EXPIRY_MS, now = Date.now()) {
+    const data = readFile(dataDir);
+    const out = [];
+    for (const [unionId, entry] of Object.entries(data)) {
+        if (now - entry.lastSeenAt > maxAgeMs)
+            continue;
+        out.push({ unionId, name: entry.name, firstSeenAt: entry.firstSeenAt, lastSeenAt: entry.lastSeenAt });
+    }
+    return out;
+}
+/** Forget a learned teammate (explicit revoke). Returns true if removed. */
+export function removeTeamBot(dataDir, unionId) {
+    const id = (unionId ?? '').trim();
+    if (!id)
+        return false;
+    const data = readFile(dataDir);
+    if (!(id in data))
+        return false;
+    delete data[id];
+    atomicWriteFileSync(filePath(dataDir), JSON.stringify(data, null, 2) + '\n');
+    return true;
+}
+//# sourceMappingURL=team-bots-store.js.map

package/dist/services/team-bots-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-bots-store.js","sourceRoot":"","sources":["../../src/services/team-bots-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;+DAE+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAY1D,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAmB,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IACxC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,GAAmD,EACnD,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK;QACnB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;QACzD,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAChD,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,SAAS,CACvB,OAAe,EACf,OAA2B,EAC3B,WAAmB,iBAAiB,EACpC,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC;AAC5C,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,WAAmB,iBAAiB,EACpC,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,QAAQ;YAAE,SAAS;QAChD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAA2B;IACxE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/team-groups-store.d.ts

@@ -5,4 +5,12 @@ export interface TeamGroupBinding {
 }
 export declare function listTeamGroups(dataDir: string, teamId?: string): TeamGroupBinding[];
 export declare function recordTeamGroup(dataDir: string, teamId: string, chatId: string, now?: number): void;
+/** Is `chatId` a team-assembled (拉群) group of ANY team? This is the TRUST ROOT
+ *  for team-bot collaboration: such a group is built by the team (bots added by
+ *  larkAppId from the federated roster), so a bot speaking there is a vouched
+ *  teammate (see [[team-bots-store]]). Recorded on the orchestrating deployment
+ *  by recordTeamGroup, and mirrored onto member deployments when the hub returns
+ *  groupChatIds on federation sync — so every member's auth gate sees the same
+ *  trust boundary. */
+export declare function isTeamGroupChat(dataDir: string, chatId: string | undefined): boolean;
 //# sourceMappingURL=team-groups-store.d.ts.map

package/dist/services/team-groups-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"team-groups-store.d.ts","sourceRoot":"","sources":["../../src/services/team-groups-store.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,EAAE,CASnF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CAM/G"}
+{"version":3,"file":"team-groups-store.d.ts","sourceRoot":"","sources":["../../src/services/team-groups-store.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,EAAE,CASnF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CAM/G;AAED;;;;;;sBAMsB;AACtB,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGpF"}

package/dist/services/team-groups-store.js

@@ -28,4 +28,16 @@ export function recordTeamGroup(dataDir, teamId, chatId, now = Date.now()) {
     all.push({ teamId, chatId, createdAt: now });
     atomicWriteFileSync(filePath(dataDir), JSON.stringify(all, null, 2) + '\n');
 }
+/** Is `chatId` a team-assembled (拉群) group of ANY team? This is the TRUST ROOT
+ *  for team-bot collaboration: such a group is built by the team (bots added by
+ *  larkAppId from the federated roster), so a bot speaking there is a vouched
+ *  teammate (see [[team-bots-store]]). Recorded on the orchestrating deployment
+ *  by recordTeamGroup, and mirrored onto member deployments when the hub returns
+ *  groupChatIds on federation sync — so every member's auth gate sees the same
+ *  trust boundary. */
+export function isTeamGroupChat(dataDir, chatId) {
+    if (!chatId)
+        return false;
+    return listTeamGroups(dataDir).some(b => b.chatId === chatId);
+}
 //# sourceMappingURL=team-groups-store.js.map

package/dist/services/team-groups-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"team-groups-store.js","sourceRoot":"","sources":["../../src/services/team-groups-store.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,gDAAgD;AAChD,+BAA+B;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAQ/D,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAe;IAC7D,IAAI,GAAG,GAAuB,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IACD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACvG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO;IAC/B,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO;IACtE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"team-groups-store.js","sourceRoot":"","sources":["../../src/services/team-groups-store.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,gDAAgD;AAChD,+BAA+B;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAQ/D,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAe;IAC7D,IAAI,GAAG,GAAuB,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IACD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACvG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO;IAC/B,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO;IACtE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;sBAMsB;AACtB,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAA0B;IACzE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "botmux",
-  "version": "2.97.0",
+  "version": "2.98.0",
   "description": "Bridge between IM platforms and AI coding CLIs — one topic, one CLI session with live streaming",
   "type": "module",
   "main": "dist/index-daemon.js",