botmux 3.0.0 → 3.1.1

package/dist/core/command-handler.js

@@ -19,13 +19,13 @@ import { buildRepoSelectCard, buildAdoptSelectCard, buildCodexAppThreadSelectCar
 import { computeSandboxDiff } from '../services/sandbox-land.js';
 import { handleDashboardCommand } from './dashboard-command/index.js';
 import { createCliAdapterSync } from '../adapters/cli/registry.js';
-import { deleteMessage, sendMessage, sendUserMessage, listChatBotMembers, resolveUserUnionId, getChatModeStrict, uploadFile, UserTokenMissingError } from '../im/lark/client.js';
+import { deleteMessage, sendMessage, sendUserMessage, replyMessage, listChatBotMembers, resolveUserUnionId, getChatModeStrict, uploadFile, UserTokenMissingError } from '../im/lark/client.js';
 import { chatAppLink, normalizeBrand } from '../im/lark/lark-hosts.js';
 import { claimPairing } from '../services/pairing-store.js';
 import { logger } from '../utils/logger.js';
 import { scheduleTimeZone } from '../utils/timezone.js';
-import { killWorker, forkWorker, forkAdoptWorker, getCurrentCliVersion, postFreshStreamingCard, postPrivateSnapshotCard, resolvePrivateCardAudience, deliverEphemeralOrReply, deliverWritableTerminalCardTo } from './worker-pool.js';
-import { expandHome, getSessionWorkingDir, getProjectScanDirs, rememberLastCliInput } from './session-manager.js';
+import { killWorker, suspendWorker, forkWorker, forkAdoptWorker, getCurrentCliVersion, postFreshStreamingCard, postPrivateSnapshotCard, resolvePrivateCardAudience, deliverEphemeralOrReply, deliverWritableTerminalCardTo } from './worker-pool.js';
+import { expandHome, getSessionWorkingDir, getProjectScanDirs, rememberLastCliInput, buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots, } from './session-manager.js';
 import { discoverSlashCommandsForAdapter, listMcpServerNames, supportsFilesystemCommandDiscovery } from './command-discovery.js';
 import { validateWorkingDir } from './working-dir.js';
 import { repinSessionWorkingDir } from './session-cwd.js';
@@ -35,8 +35,10 @@ import { listCodexAppThreads } from '../services/codex-app-threads.js';
 import { generateAuthUrl, getTokenStatus, resolveUserToken, DOC_COMMENT_OAUTH_SCOPES } from '../utils/user-token.js';
 import { DocSubscriptionPermissionError, listDocComments, resolveDocFile, subscribeDocFile, unsubscribeDocFile } from '../im/lark/doc-comment.js';
 import { parseDocWatchCommand } from './doc-watch-command.js';
+import { parseVcMeetingPrepareCommand } from './vc-meeting-prepare-command.js';
 import { latestDocCommentPollCursor } from './doc-comment-poller.js';
 import { putDocSubscription, removeDocSubscription, listDocSubscriptionsForSession, listAllDocSubscriptions, getDocSubscription, } from '../services/doc-subs-store.js';
+import { findVcMeetingPreparationByChat, getVcMeetingPreparation, listVcMeetingPreparations, putVcMeetingPreparation, removeVcMeetingPreparation, removeVcMeetingPreparationsByChat, } from '../services/vc-meeting-preparations-store.js';
 import { bindOncall, unbindOncall, getOncallStatus } from '../services/oncall-store.js';
 import { CONFIG_FIELDS, findConfigField, settableFieldKeys, parseBooleanValue, applyConfigField, setBotAllowedUsers, getConfigSnapshot, getConfigCardData, coerceConfigValue, } from '../services/bot-config-store.js';
 import { resolveCliId, findInvalidAllowedUserEntries } from '../setup/bot-config-editor.js';
@@ -50,7 +52,7 @@ import { invalidWorkingDirs } from '../utils/working-dir.js';
 import { writeRoleFile, deleteRoleFile, resolveRole, resolveRoleFile, resolveTeamRoleFile, writeTeamRoleFile, deleteTeamRoleFile, MAX_ROLE_BYTES } from './role-resolver.js';
 import { getBotCapability, setBotCapability, clearBotCapability } from '../services/bot-profile-store.js';
 import { deleteRoleProfileEntry, deleteRoleProfileIfEmpty, isValidRoleProfileId, listRoleProfileEntries, listRoleProfiles, MAX_ROLE_PROFILE_ENTRY_BYTES, readRoleProfileEntry, writeRoleProfileEntry, } from '../services/role-profile-store.js';
-import { sessionKey, sessionAnchorId } from './types.js';
+import { sessionKey, sessionAnchorId, markRepoCardConsumed, claimCurrentRepoCard } from './types.js';
 import { t, localeForBot } from '../i18n/index.js';
 import { runSkillsImCommand } from './skills/im-command.js';
 import { fetchDaemonIpc } from './daemon-ipc-auth.js';
@@ -1321,7 +1323,15 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     break;
                 }
                 const resolvedPath = validation.resolvedPath;
-                killWorker(ds);
+                // Persistent backends can cold-resume without treating a cwd switch as
+                // a real session close. This also preserves a sandbox upper long enough
+                // for the next worker to relocate Claude's cwd-scoped transcript.
+                // Adopted sessions are observers of a user-owned CLI and keep the old
+                // detach/kill behavior; PTY falls back to killWorker, while its normal
+                // on-disk transcript remains available for the resume-sync preflight.
+                const suspended = !ds.adoptedFrom && suspendWorker(ds, 'working_dir_changed');
+                if (!suspended)
+                    killWorker(ds);
                 repinSessionWorkingDir(ds, resolvedPath);
                 if (validation.created) {
                     await sessionReply(rootId, t('cmd.cd.created_switched', { path: resolvedPath }, loc));
@@ -1371,29 +1381,43 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 // CLI in whatever workingDir is currently set on the session. Shared by
                 // `commitRepoSelection` (a repo was named) and the bare-`/repo` launch
                 // (use the default workingDir) — both only run while `pendingRepo`.
-                const forkPendingCli = async (replyText) => {
+                const forkPendingCli = async (replyText, claimAlready = false) => {
+                    if (!claimAlready) {
+                        if (ds.pendingRepoCommitInFlight) {
+                            await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
+                            return false;
+                        }
+                        ds.pendingRepoCommitInFlight = true;
+                    }
                     const selfBot = getBot(ds.larkAppId);
                     const botCfg = selfBot.config;
                     const commitGenSessionId = ds.session.sessionId;
-                    ds.pendingRepo = false;
-                    publishAttentionPatch(ds);
-                    const pendingPrompt = ds.pendingPrompt ?? '';
-                    const pendingRawInput = ds.pendingRawInput;
-                    // Was there an actual buffered user message to deliver? A session
-                    // launched *via* `/repo` (the command itself is the first message) has
-                    // none — so boot the CLI idle and let the user's NEXT message be the
-                    // first prompt, instead of submitting an empty/boilerplate user_message.
-                    const hasBufferedInput = pendingPrompt.trim().length > 0 ||
-                        (ds.pendingAttachments?.length ?? 0) > 0 ||
-                        (ds.pendingFollowUps?.length ?? 0) > 0;
-                    if (pendingRawInput) {
-                        // Messages buffered while the repo card was pending must not be
-                        // dropped: wrap them now (full prompt-building context lives here)
-                        // and stash for delivery right after the raw input on prompt_ready.
-                        if (hasBufferedInput) {
-                            const { buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots } = await import('./session-manager.js');
+                    let committed = false;
+                    try {
+                        // Keep pendingRepo=true while prompt context is awaited. Incoming
+                        // messages stay in the same buffer and card selections see the
+                        // shared in-flight claim instead of treating this as a repo switch.
+                        const initiallyBuffered = (ds.pendingPrompt?.trim().length ?? 0) > 0 ||
+                            (ds.pendingAttachments?.length ?? 0) > 0 ||
+                            (ds.pendingFollowUps?.length ?? 0) > 0;
+                        const availableBots = initiallyBuffered
+                            ? await getAvailableBots(ds.larkAppId, ds.chatId)
+                            : [];
+                        const stillActive = activeSessions.get(sessionKey(rootId, larkAppId)) === ds;
+                        if (!stillActive || ds.session.sessionId !== commitGenSessionId ||
+                            !ds.pendingRepo || (ds.worker && !ds.worker.killed)) {
+                            logger.warn(`[${logTag}] Session changed while preparing the pending CLI (${commitGenSessionId} → ${ds.session.sessionId}, active=${stillActive}, pending=${!!ds.pendingRepo}, worker=${!!ds.worker})`);
+                            return false;
+                        }
+                        const pendingPrompt = ds.pendingPrompt ?? '';
+                        const pendingRawInput = ds.pendingRawInput;
+                        const hasBufferedInput = pendingPrompt.trim().length > 0 ||
+                            (ds.pendingAttachments?.length ?? 0) > 0 ||
+                            (ds.pendingFollowUps?.length ?? 0) > 0;
+                        if (hasBufferedInput)
                             ensureSessionWhiteboard(ds);
-                            const followUpInput = buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
+                        const wrappedInput = hasBufferedInput
+                            ? buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, availableBots, ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
                                 larkAppId,
                                 chatId: ds.chatId,
                                 whiteboardId: ds.session.whiteboardId,
@@ -1403,64 +1427,82 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                                 codexAppMessageContext: ds.pendingCodexAppMessageContext,
                                 codexAppFollowUps: ds.pendingCodexAppFollowUps,
                                 codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-                            });
+                            })
+                            : { content: '' };
+                        const pendingTurnId = ds.pendingTurnId;
+                        const previousPendingFollowUpInput = ds.pendingFollowUpInput;
+                        if (pendingRawInput && hasBufferedInput) {
                             ds.pendingFollowUpInput = {
                                 userPrompt: ds.pendingCodexAppText !== undefined || ds.pendingCodexAppFollowUps
                                     ? [ds.pendingCodexAppText ?? '', ...(ds.pendingCodexAppFollowUps ?? [])].filter(Boolean).join('\n\n')
                                     : pendingPrompt || ds.pendingFollowUps?.join('\n\n') || '',
-                                cliInput: followUpInput.content,
-                                ...((ds.session.cliId ?? botCfg.cliId) === 'codex-app' && botCfg.codexAppCleanInput === true && followUpInput.codexAppInput
-                                    ? { codexAppInput: followUpInput.codexAppInput }
+                                cliInput: wrappedInput.content,
+                                ...(ds.pendingFollowUpTurnId ? { turnId: ds.pendingFollowUpTurnId } : {}),
+                                ...((ds.session.cliId ?? botCfg.cliId) === 'codex-app' && botCfg.codexAppCleanInput === true && wrappedInput.codexAppInput
+                                    ? { codexAppInput: wrappedInput.codexAppInput }
                                     : {}),
                                 codexAppInputGateFrozen: true,
                             };
                         }
-                        rememberLastCliInput(ds, pendingRawInput, pendingRawInput);
-                        forkWorker(ds, '', false);
-                    }
-                    else if (hasBufferedInput) {
-                        const { buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots } = await import('./session-manager.js');
-                        ensureSessionWhiteboard(ds);
-                        const prompt = buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
-                            larkAppId,
-                            chatId: ds.chatId,
-                            whiteboardId: ds.session.whiteboardId,
-                            substituteTrigger: ds.pendingSubstituteTrigger,
-                            codexAppText: ds.pendingCodexAppText,
-                            codexAppApplicationContext: ds.pendingCodexAppApplicationContext,
-                            codexAppMessageContext: ds.pendingCodexAppMessageContext,
-                            codexAppFollowUps: ds.pendingCodexAppFollowUps,
-                            codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-                        });
-                        // Last-line defence: prompt prep awaited above — if anything
-                        // replaced OR closed the session in that window (`/close` deletes
-                        // the active-map entry without touching sessionId), forking now
-                        // would clobber it or resurrect a closed session.
-                        const stillActive = activeSessions.get(sessionKey(rootId, larkAppId)) === ds;
-                        if (!stillActive || ds.session.sessionId !== commitGenSessionId) {
-                            logger.warn(`[${logTag}] Session replaced or closed while preparing the pending-CLI prompt (${commitGenSessionId} → ${ds.session.sessionId}, active=${stillActive}) — aborting this fork`);
-                            return;
+                        ds.pendingRepo = false;
+                        publishAttentionPatch(ds);
+                        try {
+                            if (pendingRawInput)
+                                forkWorker(ds, '', false);
+                            else if (pendingTurnId && hasBufferedInput)
+                                forkWorker(ds, wrappedInput, { turnId: pendingTurnId });
+                            else if (hasBufferedInput)
+                                forkWorker(ds, wrappedInput);
+                            else
+                                forkWorker(ds, '', false);
+                        }
+                        catch (e) {
+                            ds.pendingRepo = true;
+                            ds.pendingFollowUpInput = previousPendingFollowUpInput;
+                            publishAttentionPatch(ds);
+                            throw e;
+                        }
+                        if (pendingRawInput || hasBufferedInput) {
+                            rememberLastCliInput(ds, pendingRawInput ?? pendingPrompt, pendingRawInput ?? wrappedInput);
+                        }
+                        ds.pendingPrompt = undefined;
+                        ds.pendingCodexAppText = undefined;
+                        ds.pendingCodexAppApplicationContext = undefined;
+                        ds.pendingCodexAppMessageContext = undefined;
+                        ds.pendingAttachments = undefined;
+                        ds.pendingMentions = undefined;
+                        ds.pendingSubstituteTrigger = undefined;
+                        ds.pendingSender = undefined;
+                        ds.pendingFollowUps = undefined;
+                        ds.pendingCodexAppFollowUps = undefined;
+                        ds.pendingCodexAppFollowUpContexts = undefined;
+                        ds.pendingFollowUpTurnId = undefined;
+                        ds.pendingTurnId = undefined;
+                        committed = true;
+                        // Local one-shot consume BEFORE network awaits. Feishu withdraw is
+                        // best-effort; stale card clicks must be rejected via this mark even
+                        // if sessionReply throws or deleteMessage lags/fails.
+                        const cardToWithdraw = ds.repoCardMessageId;
+                        markRepoCardConsumed(ds, cardToWithdraw);
+                        ds.repoCardMessageId = undefined;
+                        // Hold the claim through confirmation + best-effort card withdraw.
+                        try {
+                            await sessionReply(rootId, replyText);
+                        }
+                        catch (e) {
+                            logger.warn(`[${logTag}] Confirm reply after pending repo commit failed: ${e instanceof Error ? e.message : e}`);
+                        }
+                        if (cardToWithdraw) {
+                            try {
+                                await deleteMessage(ds.larkAppId, cardToWithdraw);
+                            }
+                            catch { /* best-effort */ }
                         }
-                        rememberLastCliInput(ds, pendingPrompt, prompt);
-                        forkWorker(ds, prompt);
                     }
-                    else {
-                        // Empty initial prompt → worker spawns the CLI without submitting
-                        // anything (see worker.ts: the init prompt is only queued when truthy).
-                        forkWorker(ds, '', false);
+                    finally {
+                        ds.pendingRepoCommitInFlight = false;
                     }
-                    ds.pendingPrompt = undefined;
-                    ds.pendingCodexAppText = undefined;
-                    ds.pendingCodexAppApplicationContext = undefined;
-                    ds.pendingCodexAppMessageContext = undefined;
-                    ds.pendingAttachments = undefined;
-                    ds.pendingMentions = undefined;
-                    ds.pendingSubstituteTrigger = undefined;
-                    ds.pendingSender = undefined;
-                    ds.pendingFollowUps = undefined;
-                    ds.pendingCodexAppFollowUps = undefined;
-                    ds.pendingCodexAppFollowUpContexts = undefined;
-                    await sessionReply(rootId, replyText);
+                    return committed;
                 };
                 // Shared commit path for an already-resolved repo: update the session's
                 // working dir, then either fork into the pending CLI (first spawn) or
@@ -1468,13 +1510,27 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 // numeric `/repo <N>` form and the `/repo <path|name>` form.
                 const commitRepoSelection = async (selectedPath, displayName, how) => {
                     if (ds.pendingRepo) {
-                        // First spawn: pin the new cwd onto the CURRENT session, then fork.
-                        ds.workingDir = selectedPath;
-                        ds.session.workingDir = selectedPath;
-                        // A single repo selection supersedes any stale multi-Riff stamp.
-                        ds.session.riffRepoDirs = undefined;
-                        sessionStore.updateSession(ds.session);
-                        await forkPendingCli(t('cmd.repo.selected_in_pending', { name: displayName }, loc));
+                        if (ds.pendingRepoCommitInFlight) {
+                            await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
+                            return false;
+                        }
+                        ds.pendingRepoCommitInFlight = true;
+                        try {
+                            // Claim before changing cwd so a card selection cannot overwrite
+                            // this choice while the pending prompt is prepared.
+                            ds.workingDir = selectedPath;
+                            ds.session.workingDir = selectedPath;
+                            ds.session.riffRepoDirs = undefined;
+                            sessionStore.updateSession(ds.session);
+                            // forkPendingCli owns claim release + confirm reply + card withdraw.
+                            if (!await forkPendingCli(t('cmd.repo.selected_in_pending', { name: displayName }, loc), true)) {
+                                return false;
+                            }
+                        }
+                        catch (e) {
+                            ds.pendingRepoCommitInFlight = false;
+                            throw e;
+                        }
                     }
                     else {
                         // Safety net: a mid-session `/repo` switch closes the running
@@ -1488,11 +1544,15 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         // anchor — expected; `/close` the new one first, or use the
                         // command.) Mirrors the `/close` case above.
                         //
+                        // Claim any open repo card BEFORE killWorker / await so a concurrent
+                        // card click cannot double-switch while this text path runs.
+                        //
                         // The new cwd is NOT written onto the old session here — it would
                         // pollute the displaced session's stored workingDir (and the closed
                         // card), so `claude --resume` later would reopen the old context in
                         // the new repo's cwd. The new repo is pinned onto the fresh session
                         // below instead.
+                        const claimedCard = claimCurrentRepoCard(ds, undefined);
                         const closedCard = buildClosedSessionCard(ds, loc);
                         killWorker(ds);
                         sessionStore.closeSession(ds.session.sessionId);
@@ -1512,13 +1572,21 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         sessionStore.updateSession(ds.session);
                         ds.hasHistory = false;
                         forkWorker(ds, '', false);
-                        await sessionReply(rootId, t('cmd.repo.switched_to', { name: displayName }, loc));
-                    }
-                    if (ds.repoCardMessageId) {
-                        deleteMessage(ds.larkAppId, ds.repoCardMessageId);
-                        ds.repoCardMessageId = undefined;
+                        try {
+                            await sessionReply(rootId, t('cmd.repo.switched_to', { name: displayName }, loc));
+                        }
+                        catch (e) {
+                            logger.warn(`[${logTag}] Confirm reply after mid-session repo switch failed: ${e instanceof Error ? e.message : e}`);
+                        }
+                        if (claimedCard) {
+                            try {
+                                await deleteMessage(ds.larkAppId, claimedCard);
+                            }
+                            catch { /* best-effort */ }
+                        }
                     }
                     logger.info(`[${logTag}] Repo selected via ${how}: ${selectedPath}`);
+                    return true;
                 };
                 // `/repo wt <N|name|path> [branch]` → create a worktree off the repo's
                 // remote default branch and open THAT as the session repo. Without a
@@ -1553,7 +1621,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         }
                         repoPath = resolved.path;
                     }
-                    if (ds.worktreeCreating) {
+                    if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
                         await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
                         break;
                     }
@@ -1634,7 +1702,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 // would double-fork. One lock gates both kinds until the commit
                 // settles. (Bare `/repo` without pending only posts the picker card —
                 // harmless, so it stays open.)
-                if (ds?.worktreeCreating && (repoArg || ds.pendingRepo)) {
+                if ((ds?.worktreeCreating || ds?.pendingRepoCommitInFlight) && (repoArg || ds?.pendingRepo)) {
                     await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
                     break;
                 }
@@ -1680,11 +1748,10 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         break;
                     }
                     const cwd = getSessionWorkingDir(ds);
+                    // bare /repo is the text twin of skip_repo: launch in the default
+                    // cwd without pinning it (forkPendingCli does not write workingDir).
+                    // Confirmation + card withdraw run under the claim inside forkPendingCli.
                     await forkPendingCli(t('cmd.skip.opened', { cwd }, loc));
-                    if (ds.repoCardMessageId) {
-                        deleteMessage(ds.larkAppId, ds.repoCardMessageId);
-                        ds.repoCardMessageId = undefined;
-                    }
                     logger.info(`[${logTag}] Bare /repo while pending → launch in workingDir ${cwd}`);
                     break;
                 }
@@ -2055,7 +2122,12 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     const mode = request.requestedMode
                         ?? (botCfg.docSubscribeDefaultMode === 'all' ? 'all' : 'mention-only');
                     const anchor = ds ? sessionAnchorId(ds) : `doc:${file.fileToken}`;
-                    const effectiveDir = validatedDir ?? existing?.workingDir ?? botCfg.docRepoMap?.[file.fileToken];
+                    // Existing chat/thread sessions own their project binding. A watch
+                    // without an explicit --dir inherits that binding; session-less
+                    // document watches keep their own stored/mapped directory fallback.
+                    const effectiveDir = ds
+                        ? (validatedDir ?? ds.workingDir ?? ds.session.workingDir)
+                        : (validatedDir ?? existing?.workingDir ?? botCfg.docRepoMap?.[file.fileToken]);
                     let pollCursorAt;
                     let pollCursorReplyId;
                     let pollBaselineReady;
@@ -2106,6 +2178,8 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     }, loc);
                     if (effectiveDir)
                         replyText += `\n📂 ${t('cmd.watch.working_dir', { dir: effectiveDir }, loc)}`;
+                    else
+                        replyText += `\n\n${t(ds ? 'cmd.watch.project_optional_session' : 'cmd.watch.project_optional_lazy', undefined, loc)}`;
                     if (ds && deps.prewarmDocCommentSession) {
                         try {
                             await deps.prewarmDocCommentSession(ds, subscription);
@@ -2124,6 +2198,95 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 }
                 break;
             }
+            case '/vc': {
+                if (!larkAppId) {
+                    await sessionReply(rootId, t('cmd.vc.no_session', undefined, loc));
+                    break;
+                }
+                const ownerOpenId = getOwnerOpenId(larkAppId);
+                if (!ownerOpenId || message.senderId !== ownerOpenId) {
+                    await sessionReply(rootId, t('cmd.vc.owner_only', undefined, loc));
+                    break;
+                }
+                const request = parseVcMeetingPrepareCommand(message.content);
+                const dataDir = config.session.dataDir;
+                if (request.kind === 'usage' || request.kind === 'invalid') {
+                    const prefix = request.kind === 'invalid'
+                        ? `${t('cmd.vc.invalid', undefined, loc)}\n\n`
+                        : '';
+                    await sessionReply(rootId, prefix + t('cmd.vc.usage', undefined, loc));
+                    break;
+                }
+                if (request.kind === 'status') {
+                    const requestedRecord = request.meetingNo
+                        ? getVcMeetingPreparation(dataDir, larkAppId, request.meetingNo)
+                        : undefined;
+                    const records = request.meetingNo
+                        ? (requestedRecord ? [requestedRecord] : [])
+                        : listVcMeetingPreparations(dataDir, larkAppId);
+                    if (records.length === 0) {
+                        await sessionReply(rootId, t('cmd.vc.none', undefined, loc));
+                        break;
+                    }
+                    const lines = records.map(record => [
+                        `• ${record.topic || record.meetingNo}`,
+                        `  meetingNo: \`${record.meetingNo}\``,
+                        `  chat: \`${record.prepChatId}\``,
+                        `  agent: \`${record.agentAppId}\``,
+                        `  Q&A: ${record.qaMode}`,
+                    ].join('\n'));
+                    await sessionReply(rootId, [t('cmd.vc.status_title', undefined, loc), '', ...lines].join('\n'));
+                    break;
+                }
+                if (request.kind === 'off') {
+                    let count = 0;
+                    if (request.all) {
+                        for (const record of listVcMeetingPreparations(dataDir, larkAppId)) {
+                            if (removeVcMeetingPreparation(dataDir, larkAppId, record.meetingNo))
+                                count += 1;
+                        }
+                    }
+                    else if (request.meetingNo) {
+                        count = removeVcMeetingPreparation(dataDir, larkAppId, request.meetingNo) ? 1 : 0;
+                    }
+                    else if (ds) {
+                        count = removeVcMeetingPreparationsByChat(dataDir, larkAppId, ds.chatId);
+                    }
+                    await sessionReply(rootId, count > 0
+                        ? t('cmd.vc.stopped', { count }, loc)
+                        : t('cmd.vc.none', undefined, loc));
+                    break;
+                }
+                if (!ds || ds.chatType !== 'group' || ds.scope !== 'chat') {
+                    await sessionReply(rootId, t('cmd.vc.need_group_chat', undefined, loc));
+                    break;
+                }
+                const existingInChat = findVcMeetingPreparationByChat(dataDir, larkAppId, ds.chatId);
+                const record = putVcMeetingPreparation(dataDir, {
+                    larkAppId,
+                    meetingNo: request.meetingNo,
+                    ...(request.meetingLink ? { meetingLink: request.meetingLink } : {}),
+                    prepChatId: ds.chatId,
+                    agentAppId: larkAppId,
+                    agentSessionId: ds.session.sessionId,
+                    ownerOpenId: message.senderId,
+                    qaMode: request.qaMode,
+                });
+                const replaced = existingInChat && existingInChat.meetingNo !== record.meetingNo
+                    ? `\n${t('cmd.vc.replaced', { meetingNo: existingInChat.meetingNo }, loc)}`
+                    : '';
+                let preparedText = t('cmd.vc.prepared', {
+                    meetingNo: record.meetingNo,
+                    qaMode: record.qaMode,
+                }, loc) + replaced;
+                const meetingProjectDir = ds.workingDir ?? ds.session.workingDir;
+                preparedText += meetingProjectDir
+                    ? `\n\n${t('cmd.vc.project_bound', { dir: meetingProjectDir }, loc)}`
+                    : `\n\n${t('cmd.vc.project_optional', undefined, loc)}`;
+                await sessionReply(rootId, preparedText);
+                logger.info(`[${logTag}] /vc prepare meetingNo=${record.meetingNo} chat=${record.prepChatId} agent=${record.agentAppId} qa=${record.qaMode}`);
+                break;
+            }
             case '/adopt': {
                 const adoptArgs = message.content.replace(/^\/adopt\s*/i, '').trim();
                 if (ds?.adoptedFrom) {
@@ -2470,6 +2633,11 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
              * the @-mentioned bots, then migrate every bot's session in this
              * thread (including the leader's) into the new chat.
              *
+             * p2p (私聊) variant: `/relay --create [群名]` with NO mentions — DMs
+             * have no member roster so @-ing a bot is impossible there. The bot
+             * itself is the sole participant and leader; the new group is user +
+             * this bot, and the DM session migrates over (solo relay, no peers).
+             *
              * Two-path command:
              *   • `--create` (PR2) — implemented below; creates a new chat.
              *   • no flag (PR3)    — picker card listing user's relayable sessions
@@ -2552,6 +2720,29 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     });
                     const targetScope = targetRouting.scope;
                     const targetAnchor = targetRouting.anchor;
+                    // ── Reply WHERE the user typed /relay ─────────────────────────────
+                    // Not through sessionReply: in chat-scope groups (普通群扁平 /
+                    // chat-topic / shared) that path either leaks to the chat top level
+                    // (the /relay scratch has no turn state to fold back into) or lands
+                    // in the CURRENT turn's 话题 (a real chat-scope session) — both away
+                    // from the 话题 the user invoked in (申晗 live 反馈). The target
+                    // routing already encodes the invocation spot:
+                    //   thread → reply_in_thread into that 话题 (for 话题群 / DM-thread
+                    //            top-level this seeds the 话题 on the /relay message —
+                    //            same place the relayed session will land);
+                    //   chat   → quote-reply the /relay message at the top level.
+                    // Fallback to sessionReply if the reply API refuses (e.g. the
+                    // command message was withdrawn mid-flight).
+                    const replyAtInvocation = async (content, msgType) => {
+                        try {
+                            await replyMessage(myAppId, targetScope === 'thread' ? targetAnchor : message.messageId, content, msgType ?? 'text', 
+                            /*replyInThread*/ targetScope === 'thread');
+                        }
+                        catch (err) {
+                            logger.warn(`[${logTag}] /relay reply-at-invocation failed (${err instanceof Error ? err.message : err}); falling back to sessionReply`);
+                            await sessionReply(rootId, content, msgType);
+                        }
+                    };
                     // ── Existing-session guard (anchor-based) ─────────────────────────
                     // A real session already sitting AT the target anchor would collide
                     // on sessionKey(targetAnchor, larkAppId) after transfer — Map.set
@@ -2566,7 +2757,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         && !!c.worker // real running session, not a placeholder
                     );
                     if (conflict) {
-                        await sessionReply(rootId, t('cmd.relay.target_has_session', { title: conflict.session.title || conflict.session.sessionId.substring(0, 8) }, loc));
+                        await replyAtInvocation(t('cmd.relay.target_has_session', { title: conflict.session.title || conflict.session.sessionId.substring(0, 8) }, loc));
                         break;
                     }
                     // Shared candidate-collection logic — used here at initial render
@@ -2578,7 +2769,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     const entries = await collectRelayPickerEntries(activeSessions, myAppId, targetAnchor, operatorOpenId);
                     const { buildRelayPickerCard } = await import('../im/lark/card-builder.js');
                     const card = buildRelayPickerCard(entries, targetChatId, targetAnchor, operatorOpenId, loc, undefined, targetScope, targetChatType);
-                    await sessionReply(rootId, card, 'interactive');
+                    await replyAtInvocation(card, 'interactive');
                     break;
                 }
                 const afterFlag = argsLine.replace(/^--create\s*/i, '').trim();
@@ -2618,30 +2809,38 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     await sessionReply(rootId, t('cmd.relay.not_started_yet', undefined, loc));
                     break;
                 }
+                // ── p2p (私聊) solo relay: no mention gate, no leader election ──────
+                // 飞书私聊里 @ 不到任何机器人（DM 没有成员列表），mention 门与 leader
+                // 选举在这里没有意义 —— 本 bot 就是唯一参与者兼 leader，新群 = 用户 +
+                // 本 bot，无 peer 协调（peerAppIds 自然为空）。群聊路径语义不变。
+                // chatType 取自 ds（会话创建时从 Lark 事件记录，权威、不漂移）。
+                const sourceIsP2p = ds.chatType === 'p2p';
                 // ── Mention parsing & leader election (mirror of /group) ───────────
                 const mentions = message.mentions ?? [];
                 const knownBotNames = globalKnownBotNames();
-                if (knownBotNames.size === 0 && mentions.some(m => !!m.name)) {
-                    logger.warn(`[${logTag}] /relay --create: global bot registry empty; cannot elect a creator`);
-                    await sessionReply(rootId, t('cmd.relay.resolve_failed', undefined, loc));
-                    break;
-                }
-                const botMentions = mentions.filter(m => m.name && knownBotNames.has(m.name.toLowerCase()));
-                if (botMentions.length === 0) {
-                    await sessionReply(rootId, t('cmd.relay.no_mentions', undefined, loc));
-                    break;
-                }
-                // Am I `mentions[0]`?
-                const firstBot = botMentions[0];
-                const myOpenId = getBotOpenId(creatorAppId);
-                const myName = getBot(creatorAppId).botName?.toLowerCase();
-                const myNameAmbiguous = !!myName
-                    && botMentions.filter(m => m.name?.toLowerCase() === myName).length > 1;
-                const iAmFirstBot = (!!myOpenId && firstBot.openId === myOpenId) ||
-                    (!myOpenId && !!myName && !myNameAmbiguous && firstBot.name?.toLowerCase() === myName);
-                if (!iAmFirstBot) {
-                    logger.info(`[${logTag}] /relay --create: not the first @-mentioned bot, staying silent`);
-                    break;
+                const botMentions = sourceIsP2p ? [] : mentions.filter(m => m.name && knownBotNames.has(m.name.toLowerCase()));
+                if (!sourceIsP2p) {
+                    if (knownBotNames.size === 0 && mentions.some(m => !!m.name)) {
+                        logger.warn(`[${logTag}] /relay --create: global bot registry empty; cannot elect a creator`);
+                        await sessionReply(rootId, t('cmd.relay.resolve_failed', undefined, loc));
+                        break;
+                    }
+                    if (botMentions.length === 0) {
+                        await sessionReply(rootId, t('cmd.relay.no_mentions', undefined, loc));
+                        break;
+                    }
+                    // Am I `mentions[0]`?
+                    const firstBot = botMentions[0];
+                    const myOpenId = getBotOpenId(creatorAppId);
+                    const myName = getBot(creatorAppId).botName?.toLowerCase();
+                    const myNameAmbiguous = !!myName
+                        && botMentions.filter(m => m.name?.toLowerCase() === myName).length > 1;
+                    const iAmFirstBot = (!!myOpenId && firstBot.openId === myOpenId) ||
+                        (!myOpenId && !!myName && !myNameAmbiguous && firstBot.name?.toLowerCase() === myName);
+                    if (!iAmFirstBot) {
+                        logger.info(`[${logTag}] /relay --create: not the first @-mentioned bot, staying silent`);
+                        break;
+                    }
                 }
                 // Owner-only — only the source session owner may relay this session.
                 if (ds.session.ownerOpenId && ds.session.ownerOpenId !== senderOpenId) {
@@ -2649,38 +2848,45 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     break;
                 }
                 // ── Resolve @-bots to larkAppIds via the source chat's bot roster ──
+                // p2p: 跳过成员表解析（DM 没有 bot roster，listChatBotMembers 会失败），
+                // 参与者就是本 bot 自己；名字兜底走 botDisplayName（nameOf）。
                 const sourceChatId = ds.chatId;
-                let members = [];
-                try {
-                    members = await listChatBotMembers(creatorAppId, sourceChatId);
-                }
-                catch (e) {
-                    logger.warn(`[${logTag}] /relay --create: failed to list source chat members: ${e?.message ?? e}`);
-                }
-                const memberByOpenId = new Map(members.map(m => [m.openId, m]));
                 const appIdToName = new Map();
-                for (const m of members) {
-                    if (m.larkAppId && m.displayName)
-                        appIdToName.set(m.larkAppId, m.displayName);
-                }
                 const mentionedBotAppIds = [];
-                const seenApp = new Set();
-                let unresolved;
-                for (const bm of botMentions) {
-                    const mem = bm.openId ? memberByOpenId.get(bm.openId) : undefined;
-                    if (!mem || !mem.larkAppId) {
-                        unresolved = bm.name;
-                        break;
+                if (sourceIsP2p) {
+                    mentionedBotAppIds.push(creatorAppId);
+                }
+                else {
+                    let members = [];
+                    try {
+                        members = await listChatBotMembers(creatorAppId, sourceChatId);
                     }
-                    if (!seenApp.has(mem.larkAppId)) {
-                        seenApp.add(mem.larkAppId);
-                        mentionedBotAppIds.push(mem.larkAppId);
+                    catch (e) {
+                        logger.warn(`[${logTag}] /relay --create: failed to list source chat members: ${e?.message ?? e}`);
+                    }
+                    const memberByOpenId = new Map(members.map(m => [m.openId, m]));
+                    for (const m of members) {
+                        if (m.larkAppId && m.displayName)
+                            appIdToName.set(m.larkAppId, m.displayName);
+                    }
+                    const seenApp = new Set();
+                    let unresolved;
+                    for (const bm of botMentions) {
+                        const mem = bm.openId ? memberByOpenId.get(bm.openId) : undefined;
+                        if (!mem || !mem.larkAppId) {
+                            unresolved = bm.name;
+                            break;
+                        }
+                        if (!seenApp.has(mem.larkAppId)) {
+                            seenApp.add(mem.larkAppId);
+                            mentionedBotAppIds.push(mem.larkAppId);
+                        }
+                    }
+                    if (unresolved) {
+                        logger.warn(`[${logTag}] /relay --create: unresolved bot "${unresolved}"`);
+                        await sessionReply(rootId, t('cmd.relay.resolve_failed', undefined, loc));
+                        break;
                     }
-                }
-                if (unresolved) {
-                    logger.warn(`[${logTag}] /relay --create: unresolved bot "${unresolved}"`);
-                    await sessionReply(rootId, t('cmd.relay.resolve_failed', undefined, loc));
-                    break;
                 }
                 // ── Group name extraction (mirror of /group) ───────────────────────
                 let rawArgs = afterFlag;
@@ -2742,10 +2948,14 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 const placeholderRootMessageId = newChatId;
                 // Resolve friendly source-chat label for the M1 body — falls back to
                 // raw chatId if Lark can't return a name. Mirrors picker-path
-                // (card-handler.ts:341) so the message reads the same in both UX
-                // entry points.
+                // (card-handler.ts relay_confirm) so the message reads the same in
+                // both UX entry points; p2p source has no chat name (chat.get often
+                // fails/returns empty for DMs) — use the locale-aware 单聊 label
+                // instead of leaking a raw oc_ id into the M1.
                 const { getChatName } = await import('../im/lark/client.js');
-                const sourceLabel = (await getChatName(creatorAppId, sourceChatId).catch(() => null)) ?? sourceChatId;
+                const sourceLabel = sourceIsP2p
+                    ? t('card.relay.type_p2p', undefined, loc)
+                    : (await getChatName(creatorAppId, sourceChatId).catch(() => null)) ?? sourceChatId;
                 // ── Step 1: leader transfers its own session (if any) ───────────────
                 // Empty-leader handling: daemon auto-creates a placeholder ds for any
                 // DAEMON_COMMAND (worker:null + hasHistory:false). If the user typed
@@ -3009,6 +3219,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     t('help.land', undefined, loc),
                     t('help.subscribe_doc', undefined, loc),
                     t('help.watch_comment', undefined, loc),
+                    t('help.vc', undefined, loc),
                     t('help.summary', undefined, loc),
                     '',
                     t('help.heading_passthrough', { cliName }, loc),