botmux 3.1.0 → 3.2.0

package/dist/core/command-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-handler.d.ts","sourceRoot":"","sources":["../../src/core/command-handler.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AASxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAoF,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACjJ,OAAO,EAA8D,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACtI,OAAO,EAAuB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAMnG,OAAO,EAEoB,KAAK,eAAe,EAC9C,MAAM,+BAA+B,CAAC;AAmCvC,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,aAAa,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAchD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAA4D,MAAM,2BAA2B,CAAC;AAC5I,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC;AAEjD;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAAkI,CAAC;AAE3K;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,aAAuB,CAAC;AAE1E,wBAAgB,wCAAwC,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAYrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAe1E;AAID,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA0C9C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKpF;AAED;;;;mCAImC;AACnC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CA0B1F;AAoED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1H,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,gCAAgC,EAAE,WAAW,EAAE,CAAC,CAAC;IAClF,qCAAqC;IACrC,wBAAwB,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvF;AAuqBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CA6Df;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AA8BD,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAsiEf;AAoDD,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,qBAAqB,EAC7B,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,EACjD,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;wBAGwB;AACxB,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,KAAK,EACZ,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC1C,KAAK,SAAK,GACT,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuB7B;AAED;;kFAEkF;AAClF,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,gBAAgB,EACxB,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAoBf"}
+{"version":3,"file":"command-handler.d.ts","sourceRoot":"","sources":["../../src/core/command-handler.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAkBxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAoF,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACjJ,OAAO,EAA8D,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACtI,OAAO,EAAuB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAMnG,OAAO,EAEoB,KAAK,eAAe,EAC9C,MAAM,+BAA+B,CAAC;AAmCvC,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,aAAa,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAchD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAA4D,MAAM,2BAA2B,CAAC;AAC5I,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC;AAEjD;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAAkI,CAAC;AAE3K;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,aAAuB,CAAC;AAE1E,wBAAgB,wCAAwC,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAYrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAe1E;AAID,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA0C9C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKpF;AAED;;;;mCAImC;AACnC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CA0B1F;AAoED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1H,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,gCAAgC,EAAE,WAAW,EAAE,CAAC,CAAC;IAClF,qCAAqC;IACrC,wBAAwB,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvF;AA8qBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CA6Df;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AA8BD,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAykEf;AAoDD,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,qBAAqB,EAC7B,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,EACjD,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;wBAGwB;AACxB,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,KAAK,EACZ,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC1C,KAAK,SAAK,GACT,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuB7B;AAED;;kFAEkF;AAClF,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,gBAAgB,EACxB,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/core/command-handler.js

@@ -25,7 +25,7 @@ import { claimPairing } from '../services/pairing-store.js';
 import { logger } from '../utils/logger.js';
 import { scheduleTimeZone } from '../utils/timezone.js';
 import { killWorker, suspendWorker, forkWorker, forkAdoptWorker, getCurrentCliVersion, postFreshStreamingCard, postPrivateSnapshotCard, resolvePrivateCardAudience, deliverEphemeralOrReply, deliverWritableTerminalCardTo } from './worker-pool.js';
-import { expandHome, getSessionWorkingDir, getProjectScanDirs, rememberLastCliInput } from './session-manager.js';
+import { expandHome, getSessionWorkingDir, getProjectScanDirs, rememberLastCliInput, buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots, } from './session-manager.js';
 import { discoverSlashCommandsForAdapter, listMcpServerNames, supportsFilesystemCommandDiscovery } from './command-discovery.js';
 import { validateWorkingDir } from './working-dir.js';
 import { repinSessionWorkingDir } from './session-cwd.js';
@@ -52,7 +52,7 @@ import { invalidWorkingDirs } from '../utils/working-dir.js';
 import { writeRoleFile, deleteRoleFile, resolveRole, resolveRoleFile, resolveTeamRoleFile, writeTeamRoleFile, deleteTeamRoleFile, MAX_ROLE_BYTES } from './role-resolver.js';
 import { getBotCapability, setBotCapability, clearBotCapability } from '../services/bot-profile-store.js';
 import { deleteRoleProfileEntry, deleteRoleProfileIfEmpty, isValidRoleProfileId, listRoleProfileEntries, listRoleProfiles, MAX_ROLE_PROFILE_ENTRY_BYTES, readRoleProfileEntry, writeRoleProfileEntry, } from '../services/role-profile-store.js';
-import { sessionKey, sessionAnchorId } from './types.js';
+import { sessionKey, sessionAnchorId, markRepoCardConsumed, claimCurrentRepoCard } from './types.js';
 import { t, localeForBot } from '../i18n/index.js';
 import { runSkillsImCommand } from './skills/im-command.js';
 import { fetchDaemonIpc } from './daemon-ipc-auth.js';
@@ -639,7 +639,7 @@ async function handleScheduleCommand(args, rootId, chatId, deps, larkAppId) {
             const nextStr = next ? t('schedule.next_label', { time: next.toLocaleString(timeLocale, { timeZone }) }, loc) : '';
             const lastStr = task.lastRunAt ? t('schedule.last_label', { time: new Date(task.lastRunAt).toLocaleString(timeLocale, { timeZone }) }, loc) : '';
             const display = task.parsed?.display ?? task.schedule;
-            return `${status} [${task.id}] ${display} | ${task.name}\n   prompt: ${task.prompt.substring(0, 50)}${task.prompt.length > 50 ? '...' : ''}${nextStr}${lastStr}`;
+            return `${status} [${task.id}] ${display} | ${task.name}${task.silent ? ' 🔇' : ''}\n   prompt: ${task.prompt.substring(0, 50)}${task.prompt.length > 50 ? '...' : ''}${nextStr}${lastStr}`;
         });
         await sessionReply(rootId, `${t('schedule.list_header', { count: tasks.length }, loc)}\n\n${lines.join('\n\n')}`);
         return;
@@ -699,8 +699,13 @@ async function handleScheduleCommand(args, rootId, chatId, deps, larkAppId) {
         const workingDir = resolveScheduleWorkingDir(ds, chatId, larkAppId);
         const taskScope = ds?.scope === 'chat' ? 'chat' : 'thread';
         // "新话题" keyword → every fire opens a brand-new topic in a fresh session.
-        const { deliver, prompt: schedPrompt } = scheduler.extractDeliveryMode(parsed.prompt);
-        const schedName = deliver === 'new-topic'
+        // "静默" keyword → fires post no banner; the model decides whether to send.
+        const { deliver, silent, prompt: schedPrompt } = scheduler.extractScheduleModifiers(parsed.prompt);
+        if (silent && deliver === 'new-topic') {
+            await sessionReply(rootId, t('schedule.silent_new_topic_conflict', undefined, loc));
+            return;
+        }
+        const schedName = schedPrompt !== parsed.prompt
             ? (schedPrompt.length > 20 ? schedPrompt.slice(0, 20) + '...' : schedPrompt)
             : parsed.name;
         const task = scheduler.addTask({
@@ -715,6 +720,7 @@ async function handleScheduleCommand(args, rootId, chatId, deps, larkAppId) {
             chatType: ds?.chatType === 'p2p' ? 'p2p' : 'topic_group',
             larkAppId,
             deliver,
+            silent,
         });
         const next = scheduler.getNextRun(task.id);
         const nextStr = next ? next.toLocaleString(timeLocale, { timeZone }) : 'N/A';
@@ -727,7 +733,8 @@ async function handleScheduleCommand(args, rootId, chatId, deps, larkAppId) {
             next: nextStr,
         }, loc);
         const deliverNote = deliver === 'new-topic' ? '\n' + t('schedule.deliver_new_topic', undefined, loc) : '';
-        await sessionReply(rootId, createdMsg + deliverNote);
+        const silentNote = silent ? '\n' + t('schedule.silent_note', undefined, loc) : '';
+        await sessionReply(rootId, createdMsg + deliverNote + silentNote);
         return;
     }
     // Unrecognized format
@@ -1381,29 +1388,43 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 // CLI in whatever workingDir is currently set on the session. Shared by
                 // `commitRepoSelection` (a repo was named) and the bare-`/repo` launch
                 // (use the default workingDir) — both only run while `pendingRepo`.
-                const forkPendingCli = async (replyText) => {
+                const forkPendingCli = async (replyText, claimAlready = false) => {
+                    if (!claimAlready) {
+                        if (ds.pendingRepoCommitInFlight) {
+                            await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
+                            return false;
+                        }
+                        ds.pendingRepoCommitInFlight = true;
+                    }
                     const selfBot = getBot(ds.larkAppId);
                     const botCfg = selfBot.config;
                     const commitGenSessionId = ds.session.sessionId;
-                    ds.pendingRepo = false;
-                    publishAttentionPatch(ds);
-                    const pendingPrompt = ds.pendingPrompt ?? '';
-                    const pendingRawInput = ds.pendingRawInput;
-                    // Was there an actual buffered user message to deliver? A session
-                    // launched *via* `/repo` (the command itself is the first message) has
-                    // none — so boot the CLI idle and let the user's NEXT message be the
-                    // first prompt, instead of submitting an empty/boilerplate user_message.
-                    const hasBufferedInput = pendingPrompt.trim().length > 0 ||
-                        (ds.pendingAttachments?.length ?? 0) > 0 ||
-                        (ds.pendingFollowUps?.length ?? 0) > 0;
-                    if (pendingRawInput) {
-                        // Messages buffered while the repo card was pending must not be
-                        // dropped: wrap them now (full prompt-building context lives here)
-                        // and stash for delivery right after the raw input on prompt_ready.
-                        if (hasBufferedInput) {
-                            const { buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots } = await import('./session-manager.js');
+                    let committed = false;
+                    try {
+                        // Keep pendingRepo=true while prompt context is awaited. Incoming
+                        // messages stay in the same buffer and card selections see the
+                        // shared in-flight claim instead of treating this as a repo switch.
+                        const initiallyBuffered = (ds.pendingPrompt?.trim().length ?? 0) > 0 ||
+                            (ds.pendingAttachments?.length ?? 0) > 0 ||
+                            (ds.pendingFollowUps?.length ?? 0) > 0;
+                        const availableBots = initiallyBuffered
+                            ? await getAvailableBots(ds.larkAppId, ds.chatId)
+                            : [];
+                        const stillActive = activeSessions.get(sessionKey(rootId, larkAppId)) === ds;
+                        if (!stillActive || ds.session.sessionId !== commitGenSessionId ||
+                            !ds.pendingRepo || (ds.worker && !ds.worker.killed)) {
+                            logger.warn(`[${logTag}] Session changed while preparing the pending CLI (${commitGenSessionId} → ${ds.session.sessionId}, active=${stillActive}, pending=${!!ds.pendingRepo}, worker=${!!ds.worker})`);
+                            return false;
+                        }
+                        const pendingPrompt = ds.pendingPrompt ?? '';
+                        const pendingRawInput = ds.pendingRawInput;
+                        const hasBufferedInput = pendingPrompt.trim().length > 0 ||
+                            (ds.pendingAttachments?.length ?? 0) > 0 ||
+                            (ds.pendingFollowUps?.length ?? 0) > 0;
+                        if (hasBufferedInput)
                             ensureSessionWhiteboard(ds);
-                            const followUpInput = buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
+                        const wrappedInput = hasBufferedInput
+                            ? buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, availableBots, ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
                                 larkAppId,
                                 chatId: ds.chatId,
                                 whiteboardId: ds.session.whiteboardId,
@@ -1413,64 +1434,82 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                                 codexAppMessageContext: ds.pendingCodexAppMessageContext,
                                 codexAppFollowUps: ds.pendingCodexAppFollowUps,
                                 codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-                            });
+                            })
+                            : { content: '' };
+                        const pendingTurnId = ds.pendingTurnId;
+                        const previousPendingFollowUpInput = ds.pendingFollowUpInput;
+                        if (pendingRawInput && hasBufferedInput) {
                             ds.pendingFollowUpInput = {
                                 userPrompt: ds.pendingCodexAppText !== undefined || ds.pendingCodexAppFollowUps
                                     ? [ds.pendingCodexAppText ?? '', ...(ds.pendingCodexAppFollowUps ?? [])].filter(Boolean).join('\n\n')
                                     : pendingPrompt || ds.pendingFollowUps?.join('\n\n') || '',
-                                cliInput: followUpInput.content,
-                                ...((ds.session.cliId ?? botCfg.cliId) === 'codex-app' && botCfg.codexAppCleanInput === true && followUpInput.codexAppInput
-                                    ? { codexAppInput: followUpInput.codexAppInput }
+                                cliInput: wrappedInput.content,
+                                ...(ds.pendingFollowUpTurnId ? { turnId: ds.pendingFollowUpTurnId } : {}),
+                                ...((ds.session.cliId ?? botCfg.cliId) === 'codex-app' && botCfg.codexAppCleanInput === true && wrappedInput.codexAppInput
+                                    ? { codexAppInput: wrappedInput.codexAppInput }
                                     : {}),
                                 codexAppInputGateFrozen: true,
                             };
                         }
-                        rememberLastCliInput(ds, pendingRawInput, pendingRawInput);
-                        forkWorker(ds, '', false);
-                    }
-                    else if (hasBufferedInput) {
-                        const { buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots } = await import('./session-manager.js');
-                        ensureSessionWhiteboard(ds);
-                        const prompt = buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, await getAvailableBots(ds.larkAppId, ds.chatId), ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
-                            larkAppId,
-                            chatId: ds.chatId,
-                            whiteboardId: ds.session.whiteboardId,
-                            substituteTrigger: ds.pendingSubstituteTrigger,
-                            codexAppText: ds.pendingCodexAppText,
-                            codexAppApplicationContext: ds.pendingCodexAppApplicationContext,
-                            codexAppMessageContext: ds.pendingCodexAppMessageContext,
-                            codexAppFollowUps: ds.pendingCodexAppFollowUps,
-                            codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-                        });
-                        // Last-line defence: prompt prep awaited above — if anything
-                        // replaced OR closed the session in that window (`/close` deletes
-                        // the active-map entry without touching sessionId), forking now
-                        // would clobber it or resurrect a closed session.
-                        const stillActive = activeSessions.get(sessionKey(rootId, larkAppId)) === ds;
-                        if (!stillActive || ds.session.sessionId !== commitGenSessionId) {
-                            logger.warn(`[${logTag}] Session replaced or closed while preparing the pending-CLI prompt (${commitGenSessionId} → ${ds.session.sessionId}, active=${stillActive}) — aborting this fork`);
-                            return;
+                        ds.pendingRepo = false;
+                        publishAttentionPatch(ds);
+                        try {
+                            if (pendingRawInput)
+                                forkWorker(ds, '', false);
+                            else if (pendingTurnId && hasBufferedInput)
+                                forkWorker(ds, wrappedInput, { turnId: pendingTurnId });
+                            else if (hasBufferedInput)
+                                forkWorker(ds, wrappedInput);
+                            else
+                                forkWorker(ds, '', false);
+                        }
+                        catch (e) {
+                            ds.pendingRepo = true;
+                            ds.pendingFollowUpInput = previousPendingFollowUpInput;
+                            publishAttentionPatch(ds);
+                            throw e;
+                        }
+                        if (pendingRawInput || hasBufferedInput) {
+                            rememberLastCliInput(ds, pendingRawInput ?? pendingPrompt, pendingRawInput ?? wrappedInput);
+                        }
+                        ds.pendingPrompt = undefined;
+                        ds.pendingCodexAppText = undefined;
+                        ds.pendingCodexAppApplicationContext = undefined;
+                        ds.pendingCodexAppMessageContext = undefined;
+                        ds.pendingAttachments = undefined;
+                        ds.pendingMentions = undefined;
+                        ds.pendingSubstituteTrigger = undefined;
+                        ds.pendingSender = undefined;
+                        ds.pendingFollowUps = undefined;
+                        ds.pendingCodexAppFollowUps = undefined;
+                        ds.pendingCodexAppFollowUpContexts = undefined;
+                        ds.pendingFollowUpTurnId = undefined;
+                        ds.pendingTurnId = undefined;
+                        committed = true;
+                        // Local one-shot consume BEFORE network awaits. Feishu withdraw is
+                        // best-effort; stale card clicks must be rejected via this mark even
+                        // if sessionReply throws or deleteMessage lags/fails.
+                        const cardToWithdraw = ds.repoCardMessageId;
+                        markRepoCardConsumed(ds, cardToWithdraw);
+                        ds.repoCardMessageId = undefined;
+                        // Hold the claim through confirmation + best-effort card withdraw.
+                        try {
+                            await sessionReply(rootId, replyText);
+                        }
+                        catch (e) {
+                            logger.warn(`[${logTag}] Confirm reply after pending repo commit failed: ${e instanceof Error ? e.message : e}`);
+                        }
+                        if (cardToWithdraw) {
+                            try {
+                                await deleteMessage(ds.larkAppId, cardToWithdraw);
+                            }
+                            catch { /* best-effort */ }
                         }
-                        rememberLastCliInput(ds, pendingPrompt, prompt);
-                        forkWorker(ds, prompt);
                     }
-                    else {
-                        // Empty initial prompt → worker spawns the CLI without submitting
-                        // anything (see worker.ts: the init prompt is only queued when truthy).
-                        forkWorker(ds, '', false);
+                    finally {
+                        ds.pendingRepoCommitInFlight = false;
                     }
-                    ds.pendingPrompt = undefined;
-                    ds.pendingCodexAppText = undefined;
-                    ds.pendingCodexAppApplicationContext = undefined;
-                    ds.pendingCodexAppMessageContext = undefined;
-                    ds.pendingAttachments = undefined;
-                    ds.pendingMentions = undefined;
-                    ds.pendingSubstituteTrigger = undefined;
-                    ds.pendingSender = undefined;
-                    ds.pendingFollowUps = undefined;
-                    ds.pendingCodexAppFollowUps = undefined;
-                    ds.pendingCodexAppFollowUpContexts = undefined;
-                    await sessionReply(rootId, replyText);
+                    return committed;
                 };
                 // Shared commit path for an already-resolved repo: update the session's
                 // working dir, then either fork into the pending CLI (first spawn) or
@@ -1478,13 +1517,27 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 // numeric `/repo <N>` form and the `/repo <path|name>` form.
                 const commitRepoSelection = async (selectedPath, displayName, how) => {
                     if (ds.pendingRepo) {
-                        // First spawn: pin the new cwd onto the CURRENT session, then fork.
-                        ds.workingDir = selectedPath;
-                        ds.session.workingDir = selectedPath;
-                        // A single repo selection supersedes any stale multi-Riff stamp.
-                        ds.session.riffRepoDirs = undefined;
-                        sessionStore.updateSession(ds.session);
-                        await forkPendingCli(t('cmd.repo.selected_in_pending', { name: displayName }, loc));
+                        if (ds.pendingRepoCommitInFlight) {
+                            await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
+                            return false;
+                        }
+                        ds.pendingRepoCommitInFlight = true;
+                        try {
+                            // Claim before changing cwd so a card selection cannot overwrite
+                            // this choice while the pending prompt is prepared.
+                            ds.workingDir = selectedPath;
+                            ds.session.workingDir = selectedPath;
+                            ds.session.riffRepoDirs = undefined;
+                            sessionStore.updateSession(ds.session);
+                            // forkPendingCli owns claim release + confirm reply + card withdraw.
+                            if (!await forkPendingCli(t('cmd.repo.selected_in_pending', { name: displayName }, loc), true)) {
+                                return false;
+                            }
+                        }
+                        catch (e) {
+                            ds.pendingRepoCommitInFlight = false;
+                            throw e;
+                        }
                     }
                     else {
                         // Safety net: a mid-session `/repo` switch closes the running
@@ -1498,11 +1551,15 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         // anchor — expected; `/close` the new one first, or use the
                         // command.) Mirrors the `/close` case above.
                         //
+                        // Claim any open repo card BEFORE killWorker / await so a concurrent
+                        // card click cannot double-switch while this text path runs.
+                        //
                         // The new cwd is NOT written onto the old session here — it would
                         // pollute the displaced session's stored workingDir (and the closed
                         // card), so `claude --resume` later would reopen the old context in
                         // the new repo's cwd. The new repo is pinned onto the fresh session
                         // below instead.
+                        const claimedCard = claimCurrentRepoCard(ds, undefined);
                         const closedCard = buildClosedSessionCard(ds, loc);
                         killWorker(ds);
                         sessionStore.closeSession(ds.session.sessionId);
@@ -1522,13 +1579,21 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         sessionStore.updateSession(ds.session);
                         ds.hasHistory = false;
                         forkWorker(ds, '', false);
-                        await sessionReply(rootId, t('cmd.repo.switched_to', { name: displayName }, loc));
-                    }
-                    if (ds.repoCardMessageId) {
-                        deleteMessage(ds.larkAppId, ds.repoCardMessageId);
-                        ds.repoCardMessageId = undefined;
+                        try {
+                            await sessionReply(rootId, t('cmd.repo.switched_to', { name: displayName }, loc));
+                        }
+                        catch (e) {
+                            logger.warn(`[${logTag}] Confirm reply after mid-session repo switch failed: ${e instanceof Error ? e.message : e}`);
+                        }
+                        if (claimedCard) {
+                            try {
+                                await deleteMessage(ds.larkAppId, claimedCard);
+                            }
+                            catch { /* best-effort */ }
+                        }
                     }
                     logger.info(`[${logTag}] Repo selected via ${how}: ${selectedPath}`);
+                    return true;
                 };
                 // `/repo wt <N|name|path> [branch]` → create a worktree off the repo's
                 // remote default branch and open THAT as the session repo. Without a
@@ -1563,7 +1628,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         }
                         repoPath = resolved.path;
                     }
-                    if (ds.worktreeCreating) {
+                    if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
                         await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
                         break;
                     }
@@ -1644,7 +1709,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 // would double-fork. One lock gates both kinds until the commit
                 // settles. (Bare `/repo` without pending only posts the picker card —
                 // harmless, so it stays open.)
-                if (ds?.worktreeCreating && (repoArg || ds.pendingRepo)) {
+                if ((ds?.worktreeCreating || ds?.pendingRepoCommitInFlight) && (repoArg || ds?.pendingRepo)) {
                     await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
                     break;
                 }
@@ -1690,11 +1755,10 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         break;
                     }
                     const cwd = getSessionWorkingDir(ds);
+                    // bare /repo is the text twin of skip_repo: launch in the default
+                    // cwd without pinning it (forkPendingCli does not write workingDir).
+                    // Confirmation + card withdraw run under the claim inside forkPendingCli.
                     await forkPendingCli(t('cmd.skip.opened', { cwd }, loc));
-                    if (ds.repoCardMessageId) {
-                        deleteMessage(ds.larkAppId, ds.repoCardMessageId);
-                        ds.repoCardMessageId = undefined;
-                    }
                     logger.info(`[${logTag}] Bare /repo while pending → launch in workingDir ${cwd}`);
                     break;
                 }