botmux 3.0.0 → 3.1.1

package/dist/im/lark/card-handler.js

@@ -29,7 +29,7 @@ import { getSessionWorkingDir, buildNewTopicCliInput, getAvailableBots, persistS
 import { publishAttentionPatch, announcePendingRepoSession } from '../../core/session-activity.js';
 import { fallbackTurnId } from '../../core/reply-target.js';
 import { validateWorkingDir } from '../../core/working-dir.js';
-import { sessionKey, sessionAnchorId, frozenDisplayMode } from '../../core/types.js';
+import { sessionKey, sessionAnchorId, frozenDisplayMode, markRepoCardConsumed, isActiveRepoCard, claimCurrentRepoCard } from '../../core/types.js';
 import { buildTerminalUrl } from '../../core/terminal-url.js';
 import { createRepoWorktree, removeRepoWorktree, dirSuffixForBranch, pushWorktreeBranch } from '../../services/git-worktree.js';
 import { withCodexAppContext } from '../../utils/codex-app-context.js';
@@ -207,6 +207,11 @@ export async function commitRepoSelection(ctx, dirPath, dirLabel,
 // The worktree flow already posted a precise "worktree 已创建：path 分支 …"
 // line before funnelling in here — suppress the redundant "已选择/已切换"
 // confirmation so the user sees a single message, not two.
+// pinWorkingDir=false: "直接开始"/skip keeps the default cwd for this launch
+// without persisting it (esp. $HOME) onto session.workingDir — sibling bots
+// must still get their own repo card instead of inheriting HOME.
+// confirmReplyText: optional confirmation to send under the same claim
+// (used by skip_repo so the post-fork reply window cannot race a second click).
 opts) {
     const { ds, rootId, cardMessageId, larkAppId, operatorOpenId, activeSessions, sessionReply } = ctx;
     const locTarget = localeForBot(ds.larkAppId);
@@ -216,85 +221,170 @@ opts) {
     const repoSessionKey = larkAppId ? sessionKey(rootId, larkAppId) : rootId;
     const sessionStillActive = () => activeSessions.get(repoSessionKey) === ds;
     const commitGenSessionId = ds.session.sessionId;
+    const pinWorkingDir = opts?.pinWorkingDir !== false;
     if (ds.pendingRepo) {
-        // First spawn: pin the new cwd onto the CURRENT session before forking.
-        ds.workingDir = dirPath;
-        ds.session.workingDir = dirPath;
-        // riff 多仓 stamp：只有多仓 worktree 流显式传入（保留用户选择顺序，首仓=primary）；
-        // 其它选仓路径一律清除旧 stamp——workingDir 变了，旧的多仓组合不再成立。
-        ds.session.riffRepoDirs = opts?.riffRepoDirs;
-        sessionStore.updateSession(ds.session);
-        const selfBot = getBot(ds.larkAppId);
-        const botCfg = selfBot.config;
-        const effectiveCliId = sessionCliId(ds);
-        // First-time repo selection — now spawn CLI with the original prompt
-        ds.pendingRepo = false;
-        publishAttentionPatch(ds);
-        const pendingPrompt = ds.pendingPrompt ?? '';
-        const pendingRawInput = ds.pendingRawInput;
-        // Raw-input cold start still wraps any input buffered while the repo card
-        // was pending — see the skip_repo branch for the rationale.
-        const hasBufferedInput = pendingPrompt.trim().length > 0 ||
-            (ds.pendingAttachments?.length ?? 0) > 0 ||
-            (ds.pendingFollowUps?.length ?? 0) > 0;
-        if (!pendingRawInput || hasBufferedInput)
-            ensureSessionWhiteboard(ds);
-        const wrappedInput = (!pendingRawInput || hasBufferedInput)
-            ? buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, effectiveCliId, botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, locTarget, ds.pendingSender, {
-                larkAppId: ds.larkAppId,
-                chatId: ds.chatId,
-                whiteboardId: ds.session.whiteboardId,
-                substituteTrigger: ds.pendingSubstituteTrigger,
-                codexAppText: ds.pendingCodexAppText,
-                codexAppApplicationContext: ds.pendingCodexAppApplicationContext,
-                codexAppMessageContext: ds.pendingCodexAppMessageContext,
-                codexAppFollowUps: ds.pendingCodexAppFollowUps,
-                codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-            })
-            : { content: '' };
-        const prompt = pendingRawInput ? '' : wrappedInput;
-        // Last-line defence: prompt prep awaited above — if anything replaced
-        // OR closed the session in that window, forking now would clobber it
-        // (or resurrect a /close'd session).
-        if (!sessionStillActive() || ds.session.sessionId !== commitGenSessionId) {
-            logger.warn(`[${tag(ds)}] Session replaced or closed while preparing the pending-CLI prompt (${commitGenSessionId} → ${ds.session.sessionId}, active=${sessionStillActive()}) — aborting this fork`);
+        // Card select/skip and auto-worktree converge here; the text /repo path
+        // mirrors this transaction through the same in-memory claim. Only one may
+        // own the pending -> worker transition, including prompt preparation.
+        if (ds.pendingRepoCommitInFlight) {
+            logger.info(`[${tag(ds)}] Pending repo commit already in flight — ignoring duplicate selection`);
             return;
         }
-        if (pendingRawInput && hasBufferedInput) {
-            ds.pendingFollowUpInput = {
-                userPrompt: ds.pendingCodexAppText !== undefined || ds.pendingCodexAppFollowUps
-                    ? [ds.pendingCodexAppText ?? '', ...(ds.pendingCodexAppFollowUps ?? [])].filter(Boolean).join('\n\n')
-                    : pendingPrompt || ds.pendingFollowUps?.join('\n\n') || '',
-                cliInput: wrappedInput.content,
-                ...(effectiveCliId === 'codex-app' && botCfg.codexAppCleanInput === true && wrappedInput.codexAppInput
-                    ? { codexAppInput: wrappedInput.codexAppInput }
-                    : {}),
-                codexAppInputGateFrozen: true,
-            };
+        ds.pendingRepoCommitInFlight = true;
+        let committed = false;
+        try {
+            // Claim before mutating the selected directory so two different card
+            // choices cannot overwrite each other while one prompt is being built.
+            // Skip/bare-start may intentionally leave workingDir unpinned so the
+            // launch uses the bot default without persisting $HOME for siblings.
+            if (pinWorkingDir) {
+                ds.workingDir = dirPath;
+                ds.session.workingDir = dirPath;
+            }
+            ds.session.riffRepoDirs = opts?.riffRepoDirs;
+            sessionStore.updateSession(ds.session);
+            const selfBot = getBot(ds.larkAppId);
+            const botCfg = selfBot.config;
+            const effectiveCliId = sessionCliId(ds);
+            // Keep pendingRepo=true across this await. New topic messages therefore
+            // remain buffered on this same session instead of racing a worker-null
+            // safety-net fork. Snapshot every pending field only after it settles.
+            const needsPromptContext = !ds.pendingRawInput ||
+                (ds.pendingPrompt?.trim().length ?? 0) > 0 ||
+                (ds.pendingAttachments?.length ?? 0) > 0 ||
+                (ds.pendingFollowUps?.length ?? 0) > 0;
+            const availableBots = needsPromptContext
+                ? await getAvailableBots(ds.larkAppId, ds.chatId)
+                : [];
+            if (!sessionStillActive() || ds.session.sessionId !== commitGenSessionId ||
+                !ds.pendingRepo || (ds.worker && !ds.worker.killed)) {
+                logger.warn(`[${tag(ds)}] Session changed while preparing the pending-CLI prompt (${commitGenSessionId} → ${ds.session.sessionId}, active=${sessionStillActive()}, pending=${!!ds.pendingRepo}, worker=${!!ds.worker}) — aborting this fork`);
+                return;
+            }
+            const pendingPrompt = ds.pendingPrompt ?? '';
+            const pendingRawInput = ds.pendingRawInput;
+            const hasBufferedInput = pendingPrompt.trim().length > 0 ||
+                (ds.pendingAttachments?.length ?? 0) > 0 ||
+                (ds.pendingFollowUps?.length ?? 0) > 0;
+            if (!pendingRawInput || hasBufferedInput)
+                ensureSessionWhiteboard(ds);
+            const wrappedInput = (!pendingRawInput || hasBufferedInput)
+                ? buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, effectiveCliId, botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, availableBots, ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, locTarget, ds.pendingSender, {
+                    larkAppId: ds.larkAppId,
+                    chatId: ds.chatId,
+                    whiteboardId: ds.session.whiteboardId,
+                    substituteTrigger: ds.pendingSubstituteTrigger,
+                    codexAppText: ds.pendingCodexAppText,
+                    codexAppApplicationContext: ds.pendingCodexAppApplicationContext,
+                    codexAppMessageContext: ds.pendingCodexAppMessageContext,
+                    codexAppFollowUps: ds.pendingCodexAppFollowUps,
+                    codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
+                })
+                : { content: '' };
+            const prompt = pendingRawInput ? '' : wrappedInput;
+            const pendingTurnId = ds.pendingTurnId;
+            const previousPendingFollowUpInput = ds.pendingFollowUpInput;
+            if (pendingRawInput && hasBufferedInput) {
+                ds.pendingFollowUpInput = {
+                    userPrompt: ds.pendingCodexAppText !== undefined || ds.pendingCodexAppFollowUps
+                        ? [ds.pendingCodexAppText ?? '', ...(ds.pendingCodexAppFollowUps ?? [])].filter(Boolean).join('\n\n')
+                        : pendingPrompt || ds.pendingFollowUps?.join('\n\n') || '',
+                    cliInput: wrappedInput.content,
+                    ...(ds.pendingFollowUpTurnId ? { turnId: ds.pendingFollowUpTurnId } : {}),
+                    ...(effectiveCliId === 'codex-app' && botCfg.codexAppCleanInput === true && wrappedInput.codexAppInput
+                        ? { codexAppInput: wrappedInput.codexAppInput }
+                        : {}),
+                    codexAppInputGateFrozen: true,
+                };
+            }
+            // From here through forkWorker there is no await: publish the state
+            // transition atomically from the router's point of view.
+            ds.pendingRepo = false;
+            publishAttentionPatch(ds);
+            try {
+                if (pendingRawInput) {
+                    // pendingRawTurnId is applied at the literal PTY write boundary.
+                    forkWorker(ds, '', false);
+                }
+                else if (pendingTurnId && hasBufferedInput) {
+                    forkWorker(ds, prompt, { turnId: pendingTurnId });
+                }
+                else {
+                    forkWorker(ds, prompt);
+                }
+            }
+            catch (e) {
+                ds.pendingRepo = true;
+                ds.pendingFollowUpInput = previousPendingFollowUpInput;
+                publishAttentionPatch(ds);
+                throw e;
+            }
+            rememberLastCliInput(ds, pendingRawInput ?? pendingPrompt, pendingRawInput ?? wrappedInput);
+            ds.pendingPrompt = undefined;
+            ds.pendingCodexAppText = undefined;
+            ds.pendingCodexAppApplicationContext = undefined;
+            ds.pendingCodexAppMessageContext = undefined;
+            ds.pendingAttachments = undefined;
+            ds.pendingMentions = undefined;
+            ds.pendingSubstituteTrigger = undefined;
+            ds.pendingSender = undefined;
+            ds.pendingFollowUps = undefined;
+            ds.pendingCodexAppFollowUps = undefined;
+            ds.pendingCodexAppFollowUpContexts = undefined;
+            ds.pendingFollowUpTurnId = undefined;
+            ds.pendingTurnId = undefined;
+            committed = true;
+            // Local one-shot consume BEFORE any network await. Feishu withdraw is
+            // best-effort and may lag/fail; correctness for stale card clicks depends
+            // on this mark so a second callback cannot mid-session-switch after claim
+            // release (and so a sessionReply throw that jumps to finally still leaves
+            // the card locally invalid).
+            const cardToWithdraw = cardMessageId ?? ds.repoCardMessageId;
+            markRepoCardConsumed(ds, cardToWithdraw);
+            ds.repoCardMessageId = undefined;
+            // Hold the claim through confirmation + best-effort card withdraw so a
+            // concurrent in-flight select still sees pendingRepoCommitInFlight.
+            try {
+                if (!opts?.suppressConfirmReply) {
+                    // A card click has no turn of its own — anchor the confirmation to the
+                    // session's current reply-target turn so a shared fold-back topic keeps
+                    // it in-thread (same leak as the /repo command path).
+                    await sessionReply(rootId, t('cmd.repo.selected_in_pending', { name: dirLabel }, locTarget), undefined, fallbackTurnId(ds, undefined));
+                }
+                else if (opts.confirmReplyText) {
+                    await sessionReply(rootId, opts.confirmReplyText, undefined, fallbackTurnId(ds, undefined));
+                }
+            }
+            catch (e) {
+                logger.warn(`[${tag(ds)}] Confirm reply after pending repo commit failed: ${e instanceof Error ? e.message : e}`);
+            }
+            if (cardToWithdraw && larkAppId) {
+                try {
+                    await deleteMessage(larkAppId, cardToWithdraw);
+                }
+                catch { /* card may already be gone */ }
+            }
         }
-        rememberLastCliInput(ds, pendingRawInput ?? pendingPrompt, pendingRawInput ?? wrappedInput);
-        ds.pendingPrompt = undefined;
-        ds.pendingCodexAppText = undefined;
-        ds.pendingCodexAppApplicationContext = undefined;
-        ds.pendingCodexAppMessageContext = undefined;
-        ds.pendingAttachments = undefined;
-        ds.pendingMentions = undefined;
-        ds.pendingSubstituteTrigger = undefined;
-        ds.pendingSender = undefined;
-        ds.pendingFollowUps = undefined;
-        ds.pendingCodexAppFollowUps = undefined;
-        ds.pendingCodexAppFollowUpContexts = undefined;
-        forkWorker(ds, prompt);
-        // A card click has no turn of its own — anchor the confirmation to the
-        // session's current reply-target turn so a shared fold-back topic keeps
-        // it in-thread (same leak as the /repo command path).
-        if (!opts?.suppressConfirmReply) {
-            await sessionReply(rootId, t('cmd.repo.selected_in_pending', { name: dirLabel }, locTarget), undefined, fallbackTurnId(ds, undefined));
+        finally {
+            ds.pendingRepoCommitInFlight = false;
         }
+        if (!committed)
+            return;
         logger.info(`[${tag(ds)}] Repo selected: ${dirPath}, spawning CLI`);
+        return;
     }
     else {
         // Mid-session repo switch — close old session, start fresh.
+        // Claim the current card BEFORE killWorker / any await. A concurrent click
+        // on the same Feishu card must not pass a second kill+fork while the first
+        // switch is still awaiting confirm replies. Correctness does not depend on
+        // deleteMessage succeeding.
+        const claimedCard = claimCurrentRepoCard(ds, cardMessageId);
+        if (cardMessageId && !claimedCard) {
+            // Stale / already-claimed card (entry check races can still reach here).
+            logger.info(`[${tag(ds)}] Ignoring stale mid-session repo card ${cardMessageId}`);
+            return;
+        }
         // Safety net (mirrors the `/repo` text-command path): build the same
         // "session closed" card `/close` emits BEFORE displacing the old session
         // (it reads the live session's identity off `ds`). The new session reuses
@@ -355,14 +445,22 @@ opts) {
         ds.lastScreenStatus = undefined;
         forkWorker(ds, '', false);
         if (!opts?.suppressConfirmReply) {
-            await sessionReply(rootId, t('cmd.repo.switched_to', { name: dirLabel }, locTarget));
+            try {
+                await sessionReply(rootId, t('cmd.repo.switched_to', { name: dirLabel }, locTarget));
+            }
+            catch (e) {
+                logger.warn(`[${tag(ds)}] Confirm reply after mid-session repo switch failed: ${e instanceof Error ? e.message : e}`);
+            }
         }
         logger.info(`[${tag(ds)}] Repo switched to ${dirPath}, new session created`);
+        // Best-effort withdraw — card already claimed above.
+        if (claimedCard && larkAppId) {
+            try {
+                await deleteMessage(larkAppId, claimedCard);
+            }
+            catch { /* best-effort */ }
+        }
     }
-    // Withdraw the repo selection card
-    if (cardMessageId && larkAppId)
-        deleteMessage(larkAppId, cardMessageId);
-    ds.repoCardMessageId = undefined;
 }
 /**
  * 仅默认目录 + auto-worktree 的**异步**提交：`ds` 必须已注册进 activeSessions 且处于
@@ -1738,72 +1836,37 @@ export async function handleCardAction(data, deps, larkAppId) {
         }
         if (actionType === 'skip_repo' && ds) {
             const locDs = localeForBot(ds.larkAppId);
+            // Only the live posted card may act — covers consumed, wrong card, and
+            // post-restart (repoCardMessageId is in-memory and empty after reboot).
+            if (cardMessageId && !isActiveRepoCard(ds, cardMessageId)) {
+                return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, locDs) } };
+            }
             if (ds.pendingRepo) {
-                const selfBot = getBot(ds.larkAppId);
-                const botCfg = selfBot.config;
-                const effectiveCliId = sessionCliId(ds);
-                // Skip repo selection — spawn CLI with default working dir
-                ds.pendingRepo = false;
-                publishAttentionPatch(ds);
-                const pendingPrompt = ds.pendingPrompt ?? '';
-                const pendingRawInput = ds.pendingRawInput;
-                // Raw-input cold start still wraps any input buffered while the repo
-                // card was pending (follow-ups / attachments) — delivered right after
-                // the raw input on prompt_ready instead of being dropped.
-                const hasBufferedInput = pendingPrompt.trim().length > 0 ||
-                    (ds.pendingAttachments?.length ?? 0) > 0 ||
-                    (ds.pendingFollowUps?.length ?? 0) > 0;
-                if (!pendingRawInput || hasBufferedInput)
-                    ensureSessionWhiteboard(ds);
-                const wrappedInput = (!pendingRawInput || hasBufferedInput)
-                    ? buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, effectiveCliId, botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, locDs, ds.pendingSender, {
-                        larkAppId: ds.larkAppId,
-                        chatId: ds.chatId,
-                        whiteboardId: ds.session.whiteboardId,
-                        substituteTrigger: ds.pendingSubstituteTrigger,
-                        codexAppText: ds.pendingCodexAppText,
-                        codexAppApplicationContext: ds.pendingCodexAppApplicationContext,
-                        codexAppMessageContext: ds.pendingCodexAppMessageContext,
-                        codexAppFollowUps: ds.pendingCodexAppFollowUps,
-                        codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-                    })
-                    : { content: '' };
-                const prompt = pendingRawInput ? '' : wrappedInput;
-                if (pendingRawInput && hasBufferedInput) {
-                    ds.pendingFollowUpInput = {
-                        userPrompt: ds.pendingCodexAppText !== undefined || ds.pendingCodexAppFollowUps
-                            ? [ds.pendingCodexAppText ?? '', ...(ds.pendingCodexAppFollowUps ?? [])].filter(Boolean).join('\n\n')
-                            : pendingPrompt || ds.pendingFollowUps?.join('\n\n') || '',
-                        cliInput: wrappedInput.content,
-                        ...(effectiveCliId === 'codex-app' && botCfg.codexAppCleanInput === true && wrappedInput.codexAppInput
-                            ? { codexAppInput: wrappedInput.codexAppInput }
-                            : {}),
-                        codexAppInputGateFrozen: true,
-                    };
+                if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
+                    return { toast: { type: 'info', content: t('cmd.repo.worktree_in_progress', undefined, locDs) } };
                 }
-                rememberLastCliInput(ds, pendingRawInput ?? pendingPrompt, pendingRawInput ?? wrappedInput);
-                ds.pendingPrompt = undefined;
-                ds.pendingCodexAppText = undefined;
-                ds.pendingCodexAppApplicationContext = undefined;
-                ds.pendingCodexAppMessageContext = undefined;
-                ds.pendingAttachments = undefined;
-                ds.pendingMentions = undefined;
-                ds.pendingSubstituteTrigger = undefined;
-                ds.pendingSender = undefined;
-                ds.pendingFollowUps = undefined;
-                ds.pendingCodexAppFollowUps = undefined;
-                ds.pendingCodexAppFollowUpContexts = undefined;
-                forkWorker(ds, prompt);
                 const cwd = getSessionWorkingDir(ds);
-                await sessionReply(rootId, t('cmd.skip.opened', { cwd }, locDs));
-                logger.info(`[${tag(ds)}] Skip repo, spawning CLI in ${cwd}`);
+                // Reuse the same claimed pending->worker transition as a normal repo
+                // selection. This keeps buffering active across prompt preparation and
+                // makes skip/select races single-winner. Do NOT pin the resolved default
+                // cwd (often $HOME) onto session.workingDir — that would let sibling
+                // bots inherit HOME instead of getting their own repo card. Confirmation
+                // + card withdraw run under the claim inside commitRepoSelection.
+                await commitRepoSelection({ ds, rootId, cardMessageId, larkAppId, operatorOpenId, activeSessions, sessionReply }, cwd, pathBasename(cwd) || cwd, {
+                    suppressConfirmReply: true,
+                    confirmReplyText: t('cmd.skip.opened', { cwd }, locDs),
+                    pinWorkingDir: false,
+                });
+                if (!ds.pendingRepo) {
+                    logger.info(`[${tag(ds)}] Skip repo, spawning CLI in ${cwd}`);
+                }
             }
             else {
                 await sessionReply(rootId, t('card.action.continue_using_current_repo', { cwd: getSessionWorkingDir(ds) }, locDs));
+                if (cardMessageId && larkAppId)
+                    deleteMessage(larkAppId, cardMessageId);
+                ds.repoCardMessageId = undefined;
             }
-            if (cardMessageId && larkAppId)
-                deleteMessage(larkAppId, cardMessageId);
-            ds.repoCardMessageId = undefined;
         }
         // Manual working-directory entry from the repo card form. The project scan
         // may not surface every useful directory; this mirrors `/repo <path>` from
@@ -1812,6 +1875,9 @@ export async function handleCardAction(data, deps, larkAppId) {
         // needs a scanned git repo root, not an arbitrary path.
         if (actionType === 'repo_manual_submit' && ds) {
             const locDs = localeForBot(ds.larkAppId);
+            if (cardMessageId && !isActiveRepoCard(ds, cardMessageId)) {
+                return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, locDs) } };
+            }
             const rawPath = String(action?.form_value?.repo_manual_path ?? '').trim();
             if (!rawPath) {
                 return { toast: { type: 'error', content: t('card.repo.manual_empty', undefined, locDs) } };
@@ -1822,7 +1888,7 @@ export async function handleCardAction(data, deps, larkAppId) {
             }
             // A worktree creation in flight holds the commit lock — a manual switch
             // interleaving there would double-fork (same guard as the plain switch).
-            if (ds.worktreeCreating) {
+            if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
                 return { toast: { type: 'info', content: t('cmd.repo.worktree_in_progress', undefined, locDs) } };
             }
             const selectedPath = validation.resolvedPath;
@@ -1834,6 +1900,11 @@ export async function handleCardAction(data, deps, larkAppId) {
             // re-send a fresh repo card in the new mode — a form can't ride an
             // in-place patch, so the old card is withdrawn and a new one posted.
             const locDs = localeForBot(ds.larkAppId);
+            // Same active-card gate as skip/manual/worktree: a stale card must not
+            // flip bot config or replace the live repo card after claim/restart.
+            if (cardMessageId && !isActiveRepoCard(ds, cardMessageId)) {
+                return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, locDs) } };
+            }
             const spec = findConfigField('worktreeMultiPicker');
             if (!spec)
                 return;
@@ -1856,11 +1927,14 @@ export async function handleCardAction(data, deps, larkAppId) {
         }
         if (actionType === 'repo_worktree_submit' && ds) {
             const locDs = localeForBot(ds.larkAppId);
+            if (cardMessageId && !isActiveRepoCard(ds, cardMessageId)) {
+                return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, locDs) } };
+            }
             const selectedPaths = stringListFromLarkMultiSelect(action?.form_value?.repo_worktree_paths);
             if (selectedPaths.length === 0) {
                 return { toast: { type: 'error', content: t('card.repo.worktree_empty', undefined, locDs) } };
             }
-            if (ds.worktreeCreating) {
+            if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
                 return { toast: { type: 'info', content: t('cmd.repo.worktree_in_progress', undefined, locDs) } };
             }
             const branch = String(action?.form_value?.repo_worktree_branch ?? '').trim() || undefined;
@@ -2077,6 +2151,12 @@ export async function handleCardAction(data, deps, larkAppId) {
         logger.warn(`Card action: no active session found for root ${rootId}`);
         return;
     }
+    // Only the live posted card may drive selection. Covers: already-consumed,
+    // wrong/old card, and post-restart (repoCardMessageId is in-memory). Must
+    // reject before mid-session switch can killWorker.
+    if (cardMessageId && !isActiveRepoCard(targetDs, cardMessageId)) {
+        return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, localeForBot(targetDs.larkAppId)) } };
+    }
     // 权限边界：pendingRepo（首次选 repo 才能 spawn）放行「会话发起人 或 canOperate」，
     // 让本群授权用户能完成自己的首次使用；非 pending 的 mid-session 切换是管理动作，要 canOperate。
     const isSessionOwnerOp = !!operatorOpenId && operatorOpenId === targetDs.session.ownerOpenId;
@@ -2118,7 +2198,7 @@ export async function handleCardAction(data, deps, larkAppId) {
         // ack the card action immediately with a toast and finish asynchronously.
         // On failure the card (and pendingRepo state) stays put so the user can
         // pick again or fall back to a plain switch.
-        if (targetDs.worktreeCreating) {
+        if (targetDs.worktreeCreating || targetDs.pendingRepoCommitInFlight) {
             // The async path escapes the card-action in-flight dedup — gate repeats
             // here, or two creations would race and the loser's commitSelection
             // would yank the session the winner just spawned.
@@ -2245,7 +2325,7 @@ export async function handleCardAction(data, deps, larkAppId) {
     // worktree commit awaits (Lark replies, prompt prep) after its generation
     // checks; a plain selection interleaving there would double-fork. One lock
     // gates both kinds until the commit settles.
-    if (targetDs.worktreeCreating) {
+    if (targetDs.worktreeCreating || targetDs.pendingRepoCommitInFlight) {
         return { toast: { type: 'info', content: t('cmd.repo.worktree_in_progress', undefined, locTarget) } };
     }
     await commitRepoSelection(commitCtx, selectedPath, displayName);