botmux 3.0.0 → 3.1.1

package/dist/core/worker-pool.js

@@ -80,6 +80,13 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const WORKER_SIGTERM_BACKSTOP_MS = 2_000;
 const WORKER_SIGKILL_BACKSTOP_MS = 7_000;
+const WORKER_REDACTED_ENV_KEYS = ['GITHUB_TOKEN', 'GH_TOKEN'];
+function workerForkEnv(base) {
+    const env = { ...base };
+    for (const key of WORKER_REDACTED_ENV_KEYS)
+        delete env[key];
+    return env;
+}
 let callbacks;
 /**
  * Initialise worker-pool callbacks. Must be called once before forkWorker().
@@ -1650,14 +1657,12 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     else {
         resume = resumeOrTurnId;
     }
-    // An empty prompt is a pure worker reattach/restore, not a newly accepted
-    // user turn. Never inherit the previous reply target in that case: doing so
-    // would re-publish stale per-turn authority (notably an explicit meeting IM
-    // origin) into a fresh worker lifetime after a daemon restart. Non-empty
-    // prompts keep the historical fallback for callers that accepted a turn
-    // before they learned to pass its id explicitly.
-    const initAttributionTurnId = initTurnId
-        ?? (prompt.length > 0 ? ds.currentReplyTarget?.turnId : undefined);
+    // Per-turn authority is never inferred from mutable session state. Human
+    // message routes pass their accepted Lark message id explicitly; restore,
+    // scheduler, card retry and other system starts stay unattributed. Falling
+    // back to currentReplyTarget here would let a later system prompt reuse an
+    // older human turn after a worker replacement.
+    const initAttributionTurnId = initTurnId;
     // A fork() whose cwd no longer exists emits an unhandled 'error' (spawn
     // ENOENT) that crashes the WHOLE daemon (→ pm2 crash-loop). Fall back to
     // home so a stale session workingDir can never take the daemon down.
@@ -1756,12 +1761,13 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     // The wrapper script there is written by the daemon at startup.
     const botmuxBinDir = join(homedir(), '.botmux', 'bin');
     const pathWithBotmux = prependBotmuxBin(botmuxBinDir, process.env.PATH);
+    const forkEnv = workerForkEnv(process.env);
     const worker = fork(workerPath, [], {
         windowsHide: true,
         stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
         cwd,
         env: {
-            ...process.env,
+            ...forkEnv,
             PATH: pathWithBotmux,
             CLAUDECODE: undefined,
             BOTMUX: '1', // Marker so user scripts/skills can detect a botmux-spawned CLI
@@ -2232,6 +2238,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 if (ds.pendingRawInput && ds.worker && !ds.worker.killed) {
                     const rawInput = ds.pendingRawInput;
                     ds.pendingRawInput = undefined;
+                    const rawTurnId = ds.pendingRawTurnId;
+                    ds.pendingRawTurnId = undefined;
                     // Input buffered while the repo card was pending rides on the SAME
                     // IPC: worker message handlers run concurrently (async handlers
                     // don't serialize), so a separate `message` IPC could write into
@@ -2245,7 +2253,9 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     ds.worker.send({
                         type: 'raw_input',
                         content: rawInput,
+                        ...(rawTurnId ? { turnId: rawTurnId } : {}),
                         followUpContent: followUp?.cliInput,
+                        ...(followUp?.turnId ? { followUpTurnId: followUp.turnId } : {}),
                         ...(followUpCodexAppInput ? { followUpCodexAppInput } : {}),
                     });
                     logger.info(`[${t}] Sent pending raw input after prompt_ready: ${rawInput.substring(0, 80)}${followUp ? ` (+follow-up ${followUp.cliInput.length} chars)` : ''}`);
@@ -3274,12 +3284,13 @@ export function forkAdoptWorker(ds, opts) {
     const adoptCwd = rawAdoptCwd && existsSync(rawAdoptCwd) ? rawAdoptCwd : homedir();
     if (adoptCwd !== rawAdoptCwd)
         logger.warn(`[${t}] adopt cwd "${rawAdoptCwd}" does not exist — falling back to ${adoptCwd}`);
+    const forkEnv = workerForkEnv(process.env);
     const worker = fork(workerPath, [], {
         windowsHide: true,
         stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
         cwd: adoptCwd,
         env: {
-            ...process.env,
+            ...forkEnv,
             CLAUDECODE: undefined,
             BOTMUX: '1',
             LARK_APP_ID: botCfg.larkAppId,