botmux 3.1.0 → 3.1.1

package/dist/core/command-handler.js

@@ -25,7 +25,7 @@ import { claimPairing } from '../services/pairing-store.js';
 import { logger } from '../utils/logger.js';
 import { scheduleTimeZone } from '../utils/timezone.js';
 import { killWorker, suspendWorker, forkWorker, forkAdoptWorker, getCurrentCliVersion, postFreshStreamingCard, postPrivateSnapshotCard, resolvePrivateCardAudience, deliverEphemeralOrReply, deliverWritableTerminalCardTo } from './worker-pool.js';
-import { expandHome, getSessionWorkingDir, getProjectScanDirs, rememberLastCliInput } from './session-manager.js';
+import { expandHome, getSessionWorkingDir, getProjectScanDirs, rememberLastCliInput, buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots, } from './session-manager.js';
 import { discoverSlashCommandsForAdapter, listMcpServerNames, supportsFilesystemCommandDiscovery } from './command-discovery.js';
 import { validateWorkingDir } from './working-dir.js';
 import { repinSessionWorkingDir } from './session-cwd.js';
@@ -52,7 +52,7 @@ import { invalidWorkingDirs } from '../utils/working-dir.js';
 import { writeRoleFile, deleteRoleFile, resolveRole, resolveRoleFile, resolveTeamRoleFile, writeTeamRoleFile, deleteTeamRoleFile, MAX_ROLE_BYTES } from './role-resolver.js';
 import { getBotCapability, setBotCapability, clearBotCapability } from '../services/bot-profile-store.js';
 import { deleteRoleProfileEntry, deleteRoleProfileIfEmpty, isValidRoleProfileId, listRoleProfileEntries, listRoleProfiles, MAX_ROLE_PROFILE_ENTRY_BYTES, readRoleProfileEntry, writeRoleProfileEntry, } from '../services/role-profile-store.js';
-import { sessionKey, sessionAnchorId } from './types.js';
+import { sessionKey, sessionAnchorId, markRepoCardConsumed, claimCurrentRepoCard } from './types.js';
 import { t, localeForBot } from '../i18n/index.js';
 import { runSkillsImCommand } from './skills/im-command.js';
 import { fetchDaemonIpc } from './daemon-ipc-auth.js';
@@ -1381,29 +1381,43 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 // CLI in whatever workingDir is currently set on the session. Shared by
                 // `commitRepoSelection` (a repo was named) and the bare-`/repo` launch
                 // (use the default workingDir) — both only run while `pendingRepo`.
-                const forkPendingCli = async (replyText) => {
+                const forkPendingCli = async (replyText, claimAlready = false) => {
+                    if (!claimAlready) {
+                        if (ds.pendingRepoCommitInFlight) {
+                            await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
+                            return false;
+                        }
+                        ds.pendingRepoCommitInFlight = true;
+                    }
                     const selfBot = getBot(ds.larkAppId);
                     const botCfg = selfBot.config;
                     const commitGenSessionId = ds.session.sessionId;
-                    ds.pendingRepo = false;
-                    publishAttentionPatch(ds);
-                    const pendingPrompt = ds.pendingPrompt ?? '';
-                    const pendingRawInput = ds.pendingRawInput;
-                    // Was there an actual buffered user message to deliver? A session
-                    // launched *via* `/repo` (the command itself is the first message) has
-                    // none — so boot the CLI idle and let the user's NEXT message be the
-                    // first prompt, instead of submitting an empty/boilerplate user_message.
-                    const hasBufferedInput = pendingPrompt.trim().length > 0 ||
-                        (ds.pendingAttachments?.length ?? 0) > 0 ||
-                        (ds.pendingFollowUps?.length ?? 0) > 0;
-                    if (pendingRawInput) {
-                        // Messages buffered while the repo card was pending must not be
-                        // dropped: wrap them now (full prompt-building context lives here)
-                        // and stash for delivery right after the raw input on prompt_ready.
-                        if (hasBufferedInput) {
-                            const { buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots } = await import('./session-manager.js');
+                    let committed = false;
+                    try {
+                        // Keep pendingRepo=true while prompt context is awaited. Incoming
+                        // messages stay in the same buffer and card selections see the
+                        // shared in-flight claim instead of treating this as a repo switch.
+                        const initiallyBuffered = (ds.pendingPrompt?.trim().length ?? 0) > 0 ||
+                            (ds.pendingAttachments?.length ?? 0) > 0 ||
+                            (ds.pendingFollowUps?.length ?? 0) > 0;
+                        const availableBots = initiallyBuffered
+                            ? await getAvailableBots(ds.larkAppId, ds.chatId)
+                            : [];
+                        const stillActive = activeSessions.get(sessionKey(rootId, larkAppId)) === ds;
+                        if (!stillActive || ds.session.sessionId !== commitGenSessionId ||
+                            !ds.pendingRepo || (ds.worker && !ds.worker.killed)) {
+                            logger.warn(`[${logTag}] Session changed while preparing the pending CLI (${commitGenSessionId} → ${ds.session.sessionId}, active=${stillActive}, pending=${!!ds.pendingRepo}, worker=${!!ds.worker})`);
+                            return false;
+                        }
+                        const pendingPrompt = ds.pendingPrompt ?? '';
+                        const pendingRawInput = ds.pendingRawInput;
+                        const hasBufferedInput = pendingPrompt.trim().length > 0 ||
+                            (ds.pendingAttachments?.length ?? 0) > 0 ||
+                            (ds.pendingFollowUps?.length ?? 0) > 0;
+                        if (hasBufferedInput)
                             ensureSessionWhiteboard(ds);
-                            const followUpInput = buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
+                        const wrappedInput = hasBufferedInput
+                            ? buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, availableBots, ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
                                 larkAppId,
                                 chatId: ds.chatId,
                                 whiteboardId: ds.session.whiteboardId,
@@ -1413,64 +1427,82 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                                 codexAppMessageContext: ds.pendingCodexAppMessageContext,
                                 codexAppFollowUps: ds.pendingCodexAppFollowUps,
                                 codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-                            });
+                            })
+                            : { content: '' };
+                        const pendingTurnId = ds.pendingTurnId;
+                        const previousPendingFollowUpInput = ds.pendingFollowUpInput;
+                        if (pendingRawInput && hasBufferedInput) {
                             ds.pendingFollowUpInput = {
                                 userPrompt: ds.pendingCodexAppText !== undefined || ds.pendingCodexAppFollowUps
                                     ? [ds.pendingCodexAppText ?? '', ...(ds.pendingCodexAppFollowUps ?? [])].filter(Boolean).join('\n\n')
                                     : pendingPrompt || ds.pendingFollowUps?.join('\n\n') || '',
-                                cliInput: followUpInput.content,
-                                ...((ds.session.cliId ?? botCfg.cliId) === 'codex-app' && botCfg.codexAppCleanInput === true && followUpInput.codexAppInput
-                                    ? { codexAppInput: followUpInput.codexAppInput }
+                                cliInput: wrappedInput.content,
+                                ...(ds.pendingFollowUpTurnId ? { turnId: ds.pendingFollowUpTurnId } : {}),
+                                ...((ds.session.cliId ?? botCfg.cliId) === 'codex-app' && botCfg.codexAppCleanInput === true && wrappedInput.codexAppInput
+                                    ? { codexAppInput: wrappedInput.codexAppInput }
                                     : {}),
                                 codexAppInputGateFrozen: true,
                             };
                         }
-                        rememberLastCliInput(ds, pendingRawInput, pendingRawInput);
-                        forkWorker(ds, '', false);
-                    }
-                    else if (hasBufferedInput) {
-                        const { buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots } = await import('./session-manager.js');
-                        ensureSessionWhiteboard(ds);
-                        const prompt = buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
-                            larkAppId,
-                            chatId: ds.chatId,
-                            whiteboardId: ds.session.whiteboardId,
-                            substituteTrigger: ds.pendingSubstituteTrigger,
-                            codexAppText: ds.pendingCodexAppText,
-                            codexAppApplicationContext: ds.pendingCodexAppApplicationContext,
-                            codexAppMessageContext: ds.pendingCodexAppMessageContext,
-                            codexAppFollowUps: ds.pendingCodexAppFollowUps,
-                            codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-                        });
-                        // Last-line defence: prompt prep awaited above — if anything
-                        // replaced OR closed the session in that window (`/close` deletes
-                        // the active-map entry without touching sessionId), forking now
-                        // would clobber it or resurrect a closed session.
-                        const stillActive = activeSessions.get(sessionKey(rootId, larkAppId)) === ds;
-                        if (!stillActive || ds.session.sessionId !== commitGenSessionId) {
-                            logger.warn(`[${logTag}] Session replaced or closed while preparing the pending-CLI prompt (${commitGenSessionId} → ${ds.session.sessionId}, active=${stillActive}) — aborting this fork`);
-                            return;
+                        ds.pendingRepo = false;
+                        publishAttentionPatch(ds);
+                        try {
+                            if (pendingRawInput)
+                                forkWorker(ds, '', false);
+                            else if (pendingTurnId && hasBufferedInput)
+                                forkWorker(ds, wrappedInput, { turnId: pendingTurnId });
+                            else if (hasBufferedInput)
+                                forkWorker(ds, wrappedInput);
+                            else
+                                forkWorker(ds, '', false);
+                        }
+                        catch (e) {
+                            ds.pendingRepo = true;
+                            ds.pendingFollowUpInput = previousPendingFollowUpInput;
+                            publishAttentionPatch(ds);
+                            throw e;
+                        }
+                        if (pendingRawInput || hasBufferedInput) {
+                            rememberLastCliInput(ds, pendingRawInput ?? pendingPrompt, pendingRawInput ?? wrappedInput);
+                        }
+                        ds.pendingPrompt = undefined;
+                        ds.pendingCodexAppText = undefined;
+                        ds.pendingCodexAppApplicationContext = undefined;
+                        ds.pendingCodexAppMessageContext = undefined;
+                        ds.pendingAttachments = undefined;
+                        ds.pendingMentions = undefined;
+                        ds.pendingSubstituteTrigger = undefined;
+                        ds.pendingSender = undefined;
+                        ds.pendingFollowUps = undefined;
+                        ds.pendingCodexAppFollowUps = undefined;
+                        ds.pendingCodexAppFollowUpContexts = undefined;
+                        ds.pendingFollowUpTurnId = undefined;
+                        ds.pendingTurnId = undefined;
+                        committed = true;
+                        // Local one-shot consume BEFORE network awaits. Feishu withdraw is
+                        // best-effort; stale card clicks must be rejected via this mark even
+                        // if sessionReply throws or deleteMessage lags/fails.
+                        const cardToWithdraw = ds.repoCardMessageId;
+                        markRepoCardConsumed(ds, cardToWithdraw);
+                        ds.repoCardMessageId = undefined;
+                        // Hold the claim through confirmation + best-effort card withdraw.
+                        try {
+                            await sessionReply(rootId, replyText);
+                        }
+                        catch (e) {
+                            logger.warn(`[${logTag}] Confirm reply after pending repo commit failed: ${e instanceof Error ? e.message : e}`);
+                        }
+                        if (cardToWithdraw) {
+                            try {
+                                await deleteMessage(ds.larkAppId, cardToWithdraw);
+                            }
+                            catch { /* best-effort */ }
                         }
-                        rememberLastCliInput(ds, pendingPrompt, prompt);
-                        forkWorker(ds, prompt);
                     }
-                    else {
-                        // Empty initial prompt → worker spawns the CLI without submitting
-                        // anything (see worker.ts: the init prompt is only queued when truthy).
-                        forkWorker(ds, '', false);
+                    finally {
+                        ds.pendingRepoCommitInFlight = false;
                     }
-                    ds.pendingPrompt = undefined;
-                    ds.pendingCodexAppText = undefined;
-                    ds.pendingCodexAppApplicationContext = undefined;
-                    ds.pendingCodexAppMessageContext = undefined;
-                    ds.pendingAttachments = undefined;
-                    ds.pendingMentions = undefined;
-                    ds.pendingSubstituteTrigger = undefined;
-                    ds.pendingSender = undefined;
-                    ds.pendingFollowUps = undefined;
-                    ds.pendingCodexAppFollowUps = undefined;
-                    ds.pendingCodexAppFollowUpContexts = undefined;
-                    await sessionReply(rootId, replyText);
+                    return committed;
                 };
                 // Shared commit path for an already-resolved repo: update the session's
                 // working dir, then either fork into the pending CLI (first spawn) or
@@ -1478,13 +1510,27 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 // numeric `/repo <N>` form and the `/repo <path|name>` form.
                 const commitRepoSelection = async (selectedPath, displayName, how) => {
                     if (ds.pendingRepo) {
-                        // First spawn: pin the new cwd onto the CURRENT session, then fork.
-                        ds.workingDir = selectedPath;
-                        ds.session.workingDir = selectedPath;
-                        // A single repo selection supersedes any stale multi-Riff stamp.
-                        ds.session.riffRepoDirs = undefined;
-                        sessionStore.updateSession(ds.session);
-                        await forkPendingCli(t('cmd.repo.selected_in_pending', { name: displayName }, loc));
+                        if (ds.pendingRepoCommitInFlight) {
+                            await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
+                            return false;
+                        }
+                        ds.pendingRepoCommitInFlight = true;
+                        try {
+                            // Claim before changing cwd so a card selection cannot overwrite
+                            // this choice while the pending prompt is prepared.
+                            ds.workingDir = selectedPath;
+                            ds.session.workingDir = selectedPath;
+                            ds.session.riffRepoDirs = undefined;
+                            sessionStore.updateSession(ds.session);
+                            // forkPendingCli owns claim release + confirm reply + card withdraw.
+                            if (!await forkPendingCli(t('cmd.repo.selected_in_pending', { name: displayName }, loc), true)) {
+                                return false;
+                            }
+                        }
+                        catch (e) {
+                            ds.pendingRepoCommitInFlight = false;
+                            throw e;
+                        }
                     }
                     else {
                         // Safety net: a mid-session `/repo` switch closes the running
@@ -1498,11 +1544,15 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         // anchor — expected; `/close` the new one first, or use the
                         // command.) Mirrors the `/close` case above.
                         //
+                        // Claim any open repo card BEFORE killWorker / await so a concurrent
+                        // card click cannot double-switch while this text path runs.
+                        //
                         // The new cwd is NOT written onto the old session here — it would
                         // pollute the displaced session's stored workingDir (and the closed
                         // card), so `claude --resume` later would reopen the old context in
                         // the new repo's cwd. The new repo is pinned onto the fresh session
                         // below instead.
+                        const claimedCard = claimCurrentRepoCard(ds, undefined);
                         const closedCard = buildClosedSessionCard(ds, loc);
                         killWorker(ds);
                         sessionStore.closeSession(ds.session.sessionId);
@@ -1522,13 +1572,21 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         sessionStore.updateSession(ds.session);
                         ds.hasHistory = false;
                         forkWorker(ds, '', false);
-                        await sessionReply(rootId, t('cmd.repo.switched_to', { name: displayName }, loc));
-                    }
-                    if (ds.repoCardMessageId) {
-                        deleteMessage(ds.larkAppId, ds.repoCardMessageId);
-                        ds.repoCardMessageId = undefined;
+                        try {
+                            await sessionReply(rootId, t('cmd.repo.switched_to', { name: displayName }, loc));
+                        }
+                        catch (e) {
+                            logger.warn(`[${logTag}] Confirm reply after mid-session repo switch failed: ${e instanceof Error ? e.message : e}`);
+                        }
+                        if (claimedCard) {
+                            try {
+                                await deleteMessage(ds.larkAppId, claimedCard);
+                            }
+                            catch { /* best-effort */ }
+                        }
                     }
                     logger.info(`[${logTag}] Repo selected via ${how}: ${selectedPath}`);
+                    return true;
                 };
                 // `/repo wt <N|name|path> [branch]` → create a worktree off the repo's
                 // remote default branch and open THAT as the session repo. Without a
@@ -1563,7 +1621,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         }
                         repoPath = resolved.path;
                     }
-                    if (ds.worktreeCreating) {
+                    if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
                         await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
                         break;
                     }
@@ -1644,7 +1702,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 // would double-fork. One lock gates both kinds until the commit
                 // settles. (Bare `/repo` without pending only posts the picker card —
                 // harmless, so it stays open.)
-                if (ds?.worktreeCreating && (repoArg || ds.pendingRepo)) {
+                if ((ds?.worktreeCreating || ds?.pendingRepoCommitInFlight) && (repoArg || ds?.pendingRepo)) {
                     await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
                     break;
                 }
@@ -1690,11 +1748,10 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         break;
                     }
                     const cwd = getSessionWorkingDir(ds);
+                    // bare /repo is the text twin of skip_repo: launch in the default
+                    // cwd without pinning it (forkPendingCli does not write workingDir).
+                    // Confirmation + card withdraw run under the claim inside forkPendingCli.
                     await forkPendingCli(t('cmd.skip.opened', { cwd }, loc));
-                    if (ds.repoCardMessageId) {
-                        deleteMessage(ds.larkAppId, ds.repoCardMessageId);
-                        ds.repoCardMessageId = undefined;
-                    }
                     logger.info(`[${logTag}] Bare /repo while pending → launch in workingDir ${cwd}`);
                     break;
                 }