botmux 3.10.0 → 3.23.1

package/dist/im/lark/card-handler.js

@@ -1,2923 +0,0 @@
-import { basename as pathBasename, dirname, join } from 'node:path';
-import { config } from '../../config.js';
-import { getBot, getAllBots, getOwnerOpenId } from '../../bot-registry.js';
-import { canOperate, canTalk } from './event-dispatcher.js';
-import { updateMessage, deleteMessage, replyMessage, sendMessage, sendUserMessage, sendEphemeralCard, getMessageDetail, isHumanOpenId, resolveUserUnionId as defaultResolveUserUnionId } from './client.js';
-import { buildSessionCard, buildStreamingCard, buildTuiPromptCard, buildTuiPromptProcessingCard, buildGrantResultCard, getCliDisplayName, truncateContent, buildConfigCard, buildConfigTextCard, CONFIG_UNSET, buildRepoSelectCard } from './card-builder.js';
-import { codexServiceTierBadge } from '../../services/codex-service-tier.js';
-import { findConfigField, applyConfigField, coerceConfigValue, getConfigCardData, } from '../../services/bot-config-store.js';
-import { updateBotGrantPrefs } from '../../services/grant-prefs-store.js';
-import { writeTeamRoleFile, deleteTeamRoleFile } from '../../core/role-resolver.js';
-import { addChatGrant, addGlobalGrant } from '../../services/grant-store.js';
-import { checkNonce, clearPending, getPendingGrantLimits, getPendingMessage, markDenied, updatePendingGrantLimits, } from './grant-pending.js';
-import { normalizeGrantDurationOption, normalizeGrantQuotaOption } from '../../services/grant-policy.js';
-import { claimOverloadNonce, releaseOverloadNonce } from './overload-nonce.js';
-import { buildOverloadAlertCard, buildOverloadExpiredCard, OVERLOAD_ACTION_CLEAN_STOPPED, OVERLOAD_ACTION_SUSPEND_IDLE, OVERLOAD_ACTION_NOOP, } from '../../core/host-overload-alert.js';
-import { listOnlineDaemons } from '../../utils/daemon-discovery.js';
-import { fetchDaemonIpc } from '../../core/daemon-ipc-auth.js';
-import { recordObservedBots } from '../../services/observed-bots-store.js';
-import { handleV3GateAction, isV3GateAction, } from './v3-gate-card-handler.js';
-import { handleV3BlockedAction, isV3BlockedAction, } from './v3-blocked-card-handler.js';
-import { handleV3LoopGrantAction, isV3LoopGrantAction, } from './v3-loop-grant-card-handler.js';
-import { handleV3RevisitGrantAction, isV3RevisitGrantAction, } from './v3-revisit-grant-card-handler.js';
-import { handleV3RunSaveAction, isV3RunSaveAction, } from './v3-run-save-card-handler.js';
-import { handleV3DistillationAction, isV3DistillationAction, } from './v3-distillation-card-handler.js';
-import { handleAskCardAction, isAskCardAction } from './ask-card.js';
-import { createCliAdapterSync } from '../../adapters/cli/registry.js';
-import { buildClosedSessionCard } from '../../core/closed-session-card.js';
-import { ttadkConfigModelChoices } from '../../setup/cli-selection.js';
-import { logger } from '../../utils/logger.js';
-import * as sessionStore from '../../services/session-store.js';
-import { loadFrozenCards, saveFrozenCards } from '../../services/frozen-card-store.js';
-import { forkWorker, sendWorkerInput, sendWorkerSessionInput, killWorker, closeSession, teardownAuthoritativePersistentBackingBeforeClose, scheduleCardPatch, parkStreamCard, clearUsageLimitState, cardUsageLimit, writableTerminalLinkFor, workerHasInitialized, sessionSupportsWebTerminal, readableTerminalUrlFor, resolvePrivateCardAudience, deliverWriteLinkCard, deliverEphemeralOrReply, CARD_POSTING_SENTINEL, requestSessionRestart, isSessionTransferring, getDaemonStreamingCardUsageSnapshot } from '../../core/worker-pool.js';
-import { getSessionWorkingDir, buildNewTopicCliInput, getAvailableBots, persistStreamCardState, resumeSession, rememberLastCliInput, ensureSessionWhiteboard } from '../../core/session-manager.js';
-import { markInitialUserTurnPending } from '../../core/initial-user-turn.js';
-import { publishAttentionPatch, publishClosedSessionPatch, announcePendingRepoSession } from '../../core/session-activity.js';
-import { fallbackTurnId } from '../../core/reply-target.js';
-import { sendWorkerIpc } from '../../core/worker-ipc.js';
-import { validateWorkingDir } from '../../core/working-dir.js';
-import { sessionKey, sessionAnchorId, frozenDisplayMode, markRepoCardConsumed, isActiveRepoCard, claimCurrentRepoCard } from '../../core/types.js';
-import { buildTerminalUrl } from '../../core/terminal-url.js';
-import { createRepoWorktree, removeRepoWorktree, dirSuffixForBranch, pushWorktreeBranch } from '../../services/git-worktree.js';
-import { withCodexAppContext } from '../../utils/codex-app-context.js';
-import { resolvePairedSpawnBackendType } from '../../core/persistent-backend.js';
-import { sessionConfiguredRuntimeDisplayName } from '../../core/cli-runtime-display.js';
-import { worktreeSlugFromContextAI } from '../../services/worktree-slug-ai.js';
-import { t, localeForBot, isLocale } from '../../i18n/index.js';
-import { isLocalCliOpenCapable, isLocalCliOpenConfigured, isLocalCliOpenReady, localCliOpenMode, openLocalCliInIterm, preflightLocalCliOpen, } from '../../services/local-cli-opener.js';
-/**
- * Resolve the verified `union_id` of the operator who clicked a card button.
- *
- * Three-state semantics:
- *  1. `operator.union_id` starts with `on_` → trust it directly.
- *  2. `operator.union_id` is present but does NOT start with `on_` (e.g.
- *     `ou_xxx`, malformed) → reject; do NOT fallback. Trusting `open_id`
- *     after a malformed verified field would be a bypass.
- *  3. `operator.union_id` is absent → fall back to
- *     `resolveUserUnionId(larkAppId, openId)`, accepting only `on_`-prefixed
- *     results.
- *
- * In every failure mode (missing open_id, fallback returns no unionId,
- * fallback throws) the function returns `{ openId }` with `unionId` left
- * undefined, so callers fail closed.
- *
- * `action.value` is NEVER read here — see the unit tests that pin that
- * contract.
- */
-export async function resolveCardOperatorUnionId(data, larkAppId, deps = {}) {
-    const openId = data.operator?.open_id;
-    if (!openId)
-        return {};
-    const verified = data.operator?.union_id;
-    if (typeof verified === 'string') {
-        // Verified field present — must be on_ prefix or we reject. Fallback is
-        // deliberately skipped: a malformed verified identity is a stronger
-        // negative signal than its absence.
-        if (verified.startsWith('on_'))
-            return { unionId: verified, openId };
-        return { openId };
-    }
-    // Verified field absent — fallback to the contact API. Wrapped in try/catch
-    // so resolver errors don't bubble up and surprise card-callback paths.
-    const resolver = deps.resolveUserUnionId ?? defaultResolveUserUnionId;
-    try {
-        const { unionId } = await resolver(larkAppId, openId);
-        if (typeof unionId === 'string' && unionId.startsWith('on_')) {
-            return { unionId, openId };
-        }
-        return { openId };
-    }
-    catch {
-        return { openId };
-    }
-}
-// ─── Helpers ──────────────────────────────────────────────────────────────
-function tag(ds) {
-    return ds.session.sessionId.substring(0, 8);
-}
-const LEGACY_SELF_HEAL_ACTIONS = new Set(['toggle_display', 'toggle_stream', 'refresh_screenshot']);
-// 🔊 语音总结 once-only guard: card message ids that already triggered a voice
-// summary. Keyed by the clicked card's message id so any number of users
-// clicking the same reply only ever generates ONE voice bubble (防刷屏).
-// In-memory (per daemon lifetime) — a restart resets it, which at worst allows
-// one re-trigger on an old card; acceptable. Capped to avoid unbounded growth.
-const voicedCardIds = new Set();
-// Instruction injected into the session when the voice button is clicked. The
-// model (which still has its just-sent reply in context) condenses it into
-// spoken prose and emits it via `botmux send --voice`. Kept terse and explicit
-// so the model produces ONE voice bubble and no stray text card. Resolved per
-// the bot's locale so an English-mode bot gets the English instruction.
-function voiceSummaryInstruction(locale) {
-    return t('card.voice.summary_instruction', undefined, locale);
-}
-function isLiveWorkerIdleOrLimited(ds) {
-    if (!ds.worker || ds.worker.killed)
-        return true;
-    return ds.lastScreenStatus === 'idle' || ds.lastScreenStatus === 'limited';
-}
-function isLegacySelfHealAction(actionType) {
-    return !!actionType && LEGACY_SELF_HEAL_ACTIONS.has(actionType);
-}
-function getSessionByActionValue(activeSessions, rootId, larkAppId, sessionId, actionType) {
-    const primary = rootId && larkAppId ? activeSessions.get(sessionKey(rootId, larkAppId)) : undefined;
-    if (primary && (!sessionId || primary.session.sessionId === sessionId))
-        return primary;
-    if (sessionId) {
-        for (const ds of activeSessions.values()) {
-            if (ds.larkAppId === larkAppId && ds.session.sessionId === sessionId)
-                return ds;
-        }
-    }
-    // Legacy visible cards may carry a stale/closed session_id.  Only redirect
-    // self-healing display actions to the current root session; sensitive actions
-    // (close/restart/disconnect/get_write_link/term_action/...) must not operate
-    // on a different current session just because an old card shared the root.
-    if (primary && isLegacySelfHealAction(actionType))
-        return primary;
-    return undefined;
-}
-function sessionCliId(ds) {
-    return ds.session.cliId ?? getBot(ds.larkAppId).config.cliId;
-}
-/** A session's configured distribution name is frozen with its launch config.
- * Never borrow today's bot runtime for an already-frozen legacy/official
- * session: a hot switch must not relabel old cards or action feedback. */
-function sessionRuntimeDisplayName(ds) {
-    return sessionConfiguredRuntimeDisplayName(ds.session, getBot(ds.larkAppId).config.cliRuntime);
-}
-function sessionCliDisplayName(ds) {
-    return sessionRuntimeDisplayName(ds) ?? getCliDisplayName(sessionCliId(ds));
-}
-/** Worktree selection always creates or starts a fresh session. Decide whether
- * that next session will use Riff from the live bot pairing after applying the
- * same invalid-pair reconciliation as forkWorker, rather than from the old
- * session stamp or the raw backendType alone. */
-function nextSessionUsesRiffBackend(ds) {
-    const botCfg = getBot(ds.larkAppId).config;
-    const pendingSession = ds.pendingRepo === true;
-    return resolvePairedSpawnBackendType(pendingSession ? sessionCliId(ds) : botCfg.cliId, pendingSession ? ds.session.backendType : undefined, botCfg.backendType, config.daemon.backendType) === 'riff';
-}
-function validateCardCliBinding(ds, value) {
-    const expected = value?.cli_id;
-    if (!expected)
-        return true;
-    const actual = sessionCliId(ds);
-    if (actual === expected)
-        return true;
-    // Backward-compat migration path: some already-visible Worker(CoCo) cards
-    // were rendered with cli_id=claude-code before the binding fix.  Let only
-    // display self-healing actions through so the handler can PATCH the clicked
-    // card into the current session/CLI.  Never allow stale mismatched cards to
-    // trigger sensitive/session-mutating actions.
-    if (expected === 'claude-code' && actual !== 'claude-code' && isLegacySelfHealAction(value?.action)) {
-        logger.warn(`[${tag(ds)}] Accepting legacy mismatched CLI card for self-heal: ` +
-            `action=${value?.action ?? '?'} expected=${expected} actual=${actual}`);
-        return true;
-    }
-    logger.warn(`[${tag(ds)}] Ignoring card action from mismatched CLI card: ` +
-        `action=${value?.action ?? '?'} expected=${expected} actual=${actual}`);
-    return false;
-}
-function stringListFromLarkMultiSelect(raw) {
-    const tokens = Array.isArray(raw)
-        ? raw.filter((item) => typeof item === 'string' && item.trim().length > 0)
-        : [];
-    const seen = new Set();
-    const result = [];
-    for (const token of tokens) {
-        if (seen.has(token))
-            continue;
-        seen.add(token);
-        result.push(token);
-    }
-    return result;
-}
-function multiWorktreeParentPath(repoPaths, name) {
-    const first = repoPaths[0];
-    const parentRoot = first ? dirname(first) : process.cwd();
-    return join(parentRoot, dirSuffixForBranch(name));
-}
-function worktreeChildNameForRepo(repoPath, projects) {
-    return projects?.find(p => p.path === repoPath)?.name ?? pathBasename(repoPath);
-}
-function duplicateMultiWorktreeChildNames(repoPaths, projects) {
-    const seen = new Set();
-    const dupes = new Set();
-    for (const repoPath of repoPaths) {
-        const childName = worktreeChildNameForRepo(repoPath, projects);
-        if (seen.has(childName))
-            dupes.add(childName);
-        else
-            seen.add(childName);
-    }
-    return [...dupes];
-}
-function deferRepoCardWithdraw(larkAppId, messageId) {
-    if (!larkAppId || !messageId)
-        return;
-    // Let the card-action promise resolve so the SDK can send its callback ACK
-    // before the original card disappears. A microtask is too early here: it may
-    // run before the SDK continuation that serializes and writes the ACK frame.
-    setImmediate(() => {
-        void deleteMessage(larkAppId, messageId)
-            .catch(err => logger.debug(`Repo card withdraw (post-callback) failed: ${err}`));
-    });
-}
-/**
- * Commit a resolved working directory onto a repo-select session: pin it, then
- * either fork the pending CLI (first selection) or close + recreate the session
- * (mid-session switch). Shared by the dropdown flow, the worktree flow (which
- * funnels back in with the freshly created worktree path) and the manual
- * directory-entry form. Extracted to module scope so the form-submit branch can
- * reuse the exact same spawn/switch path instead of duplicating it.
- */
-export async function commitRepoSelection(ctx, dirPath, dirLabel, 
-// The worktree flow already posted a precise "worktree 已创建：path 分支 …"
-// line before funnelling in here — suppress the redundant "已选择/已切换"
-// confirmation so the user sees a single message, not two.
-// pinWorkingDir=false: "直接开始"/skip keeps the default cwd for this launch
-// without persisting it (esp. $HOME) onto session.workingDir — sibling bots
-// must still get their own repo card instead of inheriting HOME.
-// confirmReplyText: optional confirmation to send under the same claim
-// (used by skip_repo so the post-fork reply window cannot race a second click).
-opts) {
-    const { ds, rootId, cardMessageId, larkAppId, operatorOpenId, activeSessions, sessionReply } = ctx;
-    const locTarget = localeForBot(ds.larkAppId);
-    // `/close` deletes the active-map entry without touching sessionId or
-    // pendingRepo — identity against the map is the only tell that the session
-    // this flow captured is gone. Checked alongside the generation snapshots.
-    const repoSessionKey = larkAppId ? sessionKey(rootId, larkAppId) : rootId;
-    const sessionStillActive = () => activeSessions.get(repoSessionKey) === ds;
-    const commitGenSessionId = ds.session.sessionId;
-    const pinWorkingDir = opts?.pinWorkingDir !== false;
-    if (ds.pendingRepo) {
-        // Card select/skip and auto-worktree converge here; the text /repo path
-        // mirrors this transaction through the same in-memory claim. Only one may
-        // own the pending -> worker transition, including prompt preparation.
-        if (ds.pendingRepoCommitInFlight) {
-            logger.info(`[${tag(ds)}] Pending repo commit already in flight — ignoring duplicate selection`);
-            return;
-        }
-        ds.pendingRepoCommitInFlight = true;
-        let committed = false;
-        try {
-            // Claim before mutating the selected directory so two different card
-            // choices cannot overwrite each other while one prompt is being built.
-            // Skip/bare-start may intentionally leave workingDir unpinned so the
-            // launch uses the bot default without persisting $HOME for siblings.
-            if (pinWorkingDir) {
-                ds.workingDir = dirPath;
-                ds.session.workingDir = dirPath;
-            }
-            ds.session.riffRepoDirs = opts?.riffRepoDirs;
-            sessionStore.updateSession(ds.session);
-            const selfBot = getBot(ds.larkAppId);
-            const botCfg = selfBot.config;
-            const effectiveCliId = sessionCliId(ds);
-            // Keep pendingRepo=true across this await. New topic messages therefore
-            // remain buffered on this same session instead of racing a worker-null
-            // safety-net fork. Snapshot every pending field only after it settles.
-            const needsPromptContext = !ds.pendingRawInput ||
-                (ds.pendingPrompt?.trim().length ?? 0) > 0 ||
-                (ds.pendingAttachments?.length ?? 0) > 0 ||
-                (ds.pendingFollowUps?.length ?? 0) > 0 ||
-                ds.pendingChatContext !== undefined;
-            const availableBots = needsPromptContext
-                ? await getAvailableBots(ds.larkAppId, ds.chatId)
-                : [];
-            if (!sessionStillActive() || ds.session.sessionId !== commitGenSessionId ||
-                !ds.pendingRepo || (ds.worker && !ds.worker.killed)) {
-                logger.warn(`[${tag(ds)}] Session changed while preparing the pending-CLI prompt (${commitGenSessionId} → ${ds.session.sessionId}, active=${sessionStillActive()}, pending=${!!ds.pendingRepo}, worker=${!!ds.worker}) — aborting this fork`);
-                return;
-            }
-            const pendingPrompt = ds.pendingPrompt ?? '';
-            const pendingRawInput = ds.pendingRawInput;
-            const hasBufferedInput = pendingPrompt.trim().length > 0 ||
-                (ds.pendingAttachments?.length ?? 0) > 0 ||
-                (ds.pendingFollowUps?.length ?? 0) > 0 ||
-                ds.pendingChatContext !== undefined;
-            // Nothing to submit at all (session created by a bare `/repo`, i.e. the
-            // message IS the command). Boot the CLI idle instead of burning an empty
-            // `<user_message>` opening on it, and mark the session so the user's NEXT
-            // real message becomes the new-topic first turn. Mirrors the text
-            // `/repo` path in command-handler's forkPendingCli.
-            const emptyStart = !pendingRawInput && !hasBufferedInput;
-            if (!pendingRawInput || hasBufferedInput)
-                ensureSessionWhiteboard(ds);
-            const wrappedInput = hasBufferedInput
-                ? buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, effectiveCliId, botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, availableBots, ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, locTarget, ds.pendingSender, {
-                    larkAppId: ds.larkAppId,
-                    chatId: ds.chatId,
-                    whiteboardId: ds.session.whiteboardId,
-                    substituteTrigger: ds.pendingSubstituteTrigger,
-                    codexAppText: ds.pendingCodexAppText,
-                    codexAppApplicationContext: ds.pendingCodexAppApplicationContext,
-                    codexAppMessageContext: ds.pendingCodexAppMessageContext,
-                    codexAppFollowUps: ds.pendingCodexAppFollowUps,
-                    codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-                    chatContext: ds.pendingChatContext,
-                })
-                : { content: '' };
-            const prompt = pendingRawInput ? '' : wrappedInput;
-            const pendingTurnId = ds.pendingTurnId;
-            const previousPendingFollowUpInput = ds.pendingFollowUpInput;
-            if (pendingRawInput && hasBufferedInput) {
-                ds.pendingFollowUpInput = {
-                    userPrompt: ds.pendingCodexAppText !== undefined || ds.pendingCodexAppFollowUps
-                        ? [ds.pendingCodexAppText ?? '', ...(ds.pendingCodexAppFollowUps ?? [])].filter(Boolean).join('\n\n')
-                        : pendingPrompt || ds.pendingFollowUps?.join('\n\n') || '',
-                    cliInput: wrappedInput.content,
-                    ...(ds.pendingFollowUpTurnId ? { turnId: ds.pendingFollowUpTurnId } : {}),
-                    ...(effectiveCliId === 'codex-app' && botCfg.codexAppCleanInput === true && wrappedInput.codexAppInput
-                        ? { codexAppInput: wrappedInput.codexAppInput }
-                        : {}),
-                    codexAppInputGateFrozen: true,
-                };
-            }
-            // From here through forkWorker there is no await: publish the state
-            // transition atomically from the router's point of view.
-            ds.pendingRepo = false;
-            publishAttentionPatch(ds);
-            try {
-                if (pendingRawInput) {
-                    // pendingRawTurnId is applied at the literal PTY write boundary.
-                    forkWorker(ds, '', false);
-                }
-                else if (pendingTurnId && hasBufferedInput) {
-                    forkWorker(ds, prompt, { turnId: pendingTurnId });
-                }
-                else if (hasBufferedInput) {
-                    forkWorker(ds, prompt);
-                }
-                else {
-                    // Empty start — idle boot, no turn submitted.
-                    forkWorker(ds, '', false);
-                }
-            }
-            catch (e) {
-                ds.pendingRepo = true;
-                ds.pendingFollowUpInput = previousPendingFollowUpInput;
-                publishAttentionPatch(ds);
-                throw e;
-            }
-            if (pendingRawInput || hasBufferedInput) {
-                rememberLastCliInput(ds, pendingRawInput ?? pendingPrompt, pendingRawInput ?? wrappedInput);
-            }
-            // Durable, one-shot: the CLI is up but has never received a real user turn.
-            // Set after the fork so a throwing fork leaves the session untouched.
-            if (emptyStart)
-                markInitialUserTurnPending(ds);
-            ds.pendingPrompt = undefined;
-            ds.pendingCodexAppText = undefined;
-            ds.pendingCodexAppApplicationContext = undefined;
-            ds.pendingCodexAppMessageContext = undefined;
-            ds.pendingChatContext = undefined;
-            ds.pendingAttachments = undefined;
-            ds.pendingMentions = undefined;
-            ds.pendingSubstituteTrigger = undefined;
-            ds.pendingSender = undefined;
-            ds.pendingFollowUps = undefined;
-            ds.pendingCodexAppFollowUps = undefined;
-            ds.pendingCodexAppFollowUpContexts = undefined;
-            ds.pendingFollowUpTurnId = undefined;
-            ds.pendingTurnId = undefined;
-            committed = true;
-            // Local one-shot consume BEFORE any network await. Feishu withdraw is
-            // best-effort and may lag/fail; correctness for stale card clicks depends
-            // on this mark so a second callback cannot mid-session-switch after claim
-            // release (and so a sessionReply throw that jumps to finally still leaves
-            // the card locally invalid).
-            const cardToWithdraw = cardMessageId ?? ds.repoCardMessageId;
-            markRepoCardConsumed(ds, cardToWithdraw);
-            ds.repoCardMessageId = undefined;
-            // Hold the claim through confirmation. Card withdrawal is deferred until
-            // after the callback can ACK; stale clicks are blocked by the local
-            // consume mark above rather than by the network request's lifetime.
-            try {
-                if (!opts?.suppressConfirmReply) {
-                    // A card click has no turn of its own — anchor the confirmation to the
-                    // session's current reply-target turn so a shared fold-back topic keeps
-                    // it in-thread (same leak as the /repo command path).
-                    await sessionReply(rootId, t('cmd.repo.selected_in_pending', { name: dirLabel }, locTarget), undefined, fallbackTurnId(ds, undefined));
-                }
-                else if (opts.confirmReplyText) {
-                    await sessionReply(rootId, opts.confirmReplyText, undefined, fallbackTurnId(ds, undefined));
-                }
-            }
-            catch (e) {
-                logger.warn(`[${tag(ds)}] Confirm reply after pending repo commit failed: ${e instanceof Error ? e.message : e}`);
-            }
-            deferRepoCardWithdraw(larkAppId, cardToWithdraw);
-        }
-        finally {
-            ds.pendingRepoCommitInFlight = false;
-        }
-        if (!committed)
-            return;
-        logger.info(`[${tag(ds)}] Repo selected: ${dirPath}, spawning CLI`);
-        return;
-    }
-    else {
-        // Mid-session repo switch — close old session, start fresh.
-        // ZMX close is identity/generation verified and may refuse. Prove teardown
-        // before claiming the card or mutating any old-session state; on refusal
-        // the current session and card remain fully retryable.
-        try {
-            teardownAuthoritativePersistentBackingBeforeClose(ds);
-        }
-        catch (err) {
-            const reason = err instanceof Error ? err.message : String(err);
-            logger.warn(`[${tag(ds)}] Repo switch refused because backing teardown was not proven: ${reason}`);
-            try {
-                await sessionReply(rootId, t('cmd.repo.switch_close_failed', { error: reason }, locTarget));
-            }
-            catch (replyErr) {
-                logger.warn(`[${tag(ds)}] Repo-switch teardown failure reply failed: ${replyErr instanceof Error ? replyErr.message : replyErr}`);
-            }
-            return;
-        }
-        // Claim the current card BEFORE killWorker / any await. A concurrent click
-        // on the same Feishu card must not pass a second kill+fork while the first
-        // switch is still awaiting confirm replies. Correctness does not depend on
-        // deleteMessage succeeding.
-        const claimedCard = claimCurrentRepoCard(ds, cardMessageId);
-        if (cardMessageId && !claimedCard) {
-            // Stale / already-claimed card (entry check races can still reach here).
-            logger.info(`[${tag(ds)}] Ignoring stale mid-session repo card ${cardMessageId}`);
-            return;
-        }
-        // Safety net (mirrors the `/repo` text-command path): build the same
-        // "session closed" card `/close` emits BEFORE displacing the old session
-        // (it reads the live session's identity off `ds`). The new session reuses
-        // this anchor, so the old context would otherwise vanish without a trace
-        // (relay/adopt/resume all hit `anchor_occupied`). The card keeps it
-        // visible and carries the terminal `claude --resume` command.
-        //
-        // The new cwd is NOT written onto the old session here — it would pollute
-        // the displaced session's stored workingDir (and the closed card), so
-        // `claude --resume` later would reopen the old context in the new repo's
-        // cwd. The new repo is pinned onto the fresh session below instead.
-        const oldSession = ds.session;
-        const closedCard = buildClosedSessionCard(ds, locTarget);
-        killWorker(ds);
-        // Park the current card in `frozenCards` so the next POST under the new
-        // session sweeps it via recall. closeSession() wipes the on-disk
-        // frozen-cards file under the OLD sessionId, but the in-memory Map
-        // travels with `ds` into the new session and still carries the
-        // old messageId for deletion. If fork or POST fails, the parked card
-        // stays in the thread instead of vanishing prematurely.
-        parkStreamCard(ds);
-        sessionStore.closeSession(ds.session.sessionId);
-        publishClosedSessionPatch(ds.session.sessionId, ds.session.closedAt ? Date.parse(ds.session.closedAt) : undefined);
-        await deliverEphemeralOrReply(ds, operatorOpenId, closedCard, 'interactive', () => sessionReply(rootId, closedCard, 'interactive'));
-        // The close card delivery yields to inbound routing and dashboard IPC. If
-        // the user closed/replaced this generation during that await, do not mint a
-        // fresh active row from the stale continuation.
-        if (!sessionStillActive() || ds.session !== oldSession) {
-            logger.warn(`[${tag(ds)}] Repo switch cancelled after old-session close; routing generation changed during card delivery`);
-            return;
-        }
-        // `rootId` is the routing anchor. For chat-scope sessions it is the
-        // `oc_...` chat id, not the traceable `om_...` message root stored on
-        // Session. Preserve the old identity and explicitly persist scope so card
-        // switches cannot recreate the session as a legacy scope-less thread.
-        const session = sessionStore.createSession(ds.chatId, ds.scope === 'chat' ? oldSession.rootMessageId : rootId, dirLabel, ds.chatType, ds.scope);
-        ds.session = session;
-        ds.lastUserPrompt = undefined;
-        ds.lastCliInput = undefined;
-        // Pin workingDir + larkAppId onto the new session before forkWorker.
-        // Without this, a daemon restart restores the session with an empty
-        // workingDir and the worker spawns in the bot's default cwd, so
-        // `claude --resume` looks in the wrong .claude/projects/<hash>/ dir and
-        // exits code 0 immediately, crash-looping until the rate-limiter trips.
-        ds.workingDir = dirPath;
-        ds.session.workingDir = dirPath;
-        ds.session.larkAppId = ds.larkAppId;
-        ds.session.chatDisplayName = oldSession.chatDisplayName;
-        ds.session.ownerOpenId = oldSession.ownerOpenId;
-        ds.session.creatorOpenId = oldSession.creatorOpenId;
-        ds.session.lastCallerOpenId = oldSession.lastCallerOpenId;
-        // Stamp the newly-created session, not the displaced session that was just
-        // closed. Plain/single-repo switches pass undefined and clear stale state.
-        ds.session.riffRepoDirs = opts?.riffRepoDirs;
-        sessionStore.updateSession(ds.session);
-        ds.hasHistory = false;
-        // Re-persist the parked card under the NEW sessionId so a daemon crash
-        // before the next POST doesn't strand it. closeSession() above wiped
-        // the on-disk file under the OLD sessionId; without this re-save, the
-        // in-memory Map only survives in process memory.
-        if (ds.frozenCards && ds.frozenCards.size > 0) {
-            saveFrozenCards(ds.session.sessionId, ds.frozenCards);
-        }
-        // Drop the old turn's streaming-card reference so worker_ready POSTs a
-        // fresh card for the new session instead of PATCHing the previous one.
-        ds.streamCardId = undefined;
-        ds.streamCardNonce = undefined;
-        ds.streamCardPending = undefined;
-        ds.lastScreenContent = undefined;
-        ds.lastScreenStatus = undefined;
-        forkWorker(ds, '', false);
-        // Brand-new CLI in a brand-new session record: the next real business
-        // message is its new-topic first turn (same invariant as the pending path).
-        markInitialUserTurnPending(ds);
-        if (!opts?.suppressConfirmReply) {
-            try {
-                await sessionReply(rootId, t('cmd.repo.switched_to', { name: dirLabel }, locTarget));
-            }
-            catch (e) {
-                logger.warn(`[${tag(ds)}] Confirm reply after mid-session repo switch failed: ${e instanceof Error ? e.message : e}`);
-            }
-        }
-        logger.info(`[${tag(ds)}] Repo switched to ${dirPath}, new session created`);
-        // The card was claimed locally above; withdraw it only after this callback
-        // can return its ACK so the delete request cannot race the callback frame.
-        deferRepoCardWithdraw(larkAppId, claimedCard);
-    }
-}
-/**
- * 仅默认目录 + auto-worktree 的**异步**提交：`ds` 必须已注册进 activeSessions 且处于
- * `pendingRepo` 挂起态（prompt 已 buffer，入站路由不会去抢 fork——见 daemon.ts pendingRepo
- * 分支），本函数在**关键路径之外**（调用方 `void` 掉、立即返回）跑：
- *   1) 在 `baseDir` 建独立 worktree（非 git / 失败 → 回退 baseDir，均经 `notify` 发提示）
- *   2) 用与「选仓库卡」完全相同的 {@link commitRepoSelection} 提交该目录并 fork——复用其
- *      prompt 重建（会 fold 进等待期间 buffer 的后续消息）、代际守卫、僵尸防护。
- *
- * 这样避免了把 git fetch（可长达 30s）同步塞进 spawn/fork 链路的三宗罪：放大重复 spawn
- * 竞态、worker=null 期间被路由在**基目录**抢 fork、阻塞 dashboard/webhook 响应。
- *
- * 永不抛出：worktree 失败已在内部回退；commitRepoSelection 异常被兜底 log（会话仍留在
- * pendingRepo，用户可 /repo 自救），绝不让 unhandled rejection 掀掉 daemon。
- */
-export async function runAutoWorktreeCommit(deps) {
-    const { ds, anchor, larkAppId, baseDir, title, prompt, operatorOpenId, activeSessions, notify } = deps;
-    ds.worktreeCreating = true;
-    // Surface the pending row NOW (all three callers funnel through here, so this is
-    // the single place that guarantees the session is visible on SSE-only dashboards
-    // during the up-to-30s build) — commitRepoSelection's forkWorker is what would
-    // otherwise emit session.spawned, far too late.
-    announcePendingRepoSession(ds);
-    try {
-        const { maybeCreateDefaultWorktree } = await import('../../services/default-worktree.js');
-        const wt = await maybeCreateDefaultWorktree(larkAppId, baseDir, {
-            isBotDefaultDir: true, title, prompt, locale: localeForBot(larkAppId), notify,
-        });
-        // The pendingRepo placeholder can legitimately be consumed WHILE this
-        // up-to-30s build runs — e.g. the Codex-notifier「继续处理」callback adopts
-        // the same DM session and clears pendingRepo before we get here. If we now
-        // funneled into commitRepoSelection, its mid-session branch would kill the
-        // freshly-adopted worker and replace it with a botmux-owned worktree
-        // session. Bail on the late result instead: the takeover already owns the
-        // session. (commitRepoSelection also re-checks pendingRepo under its claim,
-        // but that check runs after an await — fence here before any mutation.)
-        if (!ds.pendingRepo) {
-            logger.info(`[${tag(ds)}] auto-worktree completion ignored — pendingRepo already consumed (session taken over)`);
-            return;
-        }
-        // Commit even on fallback (wt.dir === baseDir) — the session must still start.
-        // commitRepoSelection has its own /close + generation guards and, for a
-        // pendingRepo session, folds any messages buffered during creation (pendingPrompt
-        // + pendingFollowUps) into the first turn. suppressConfirmReply: the worktree
-        // helper already posted the '已创建/回退' line, so skip the '已选择' confirmation.
-        await commitRepoSelection({
-            ds, rootId: anchor, larkAppId, operatorOpenId, activeSessions,
-            // Never reached under suppressConfirmReply for a pendingRepo session.
-            sessionReply: async () => '',
-        }, wt.dir, pathBasename(wt.dir), { suppressConfirmReply: true });
-    }
-    catch (e) {
-        // No recovery fork here: forking with an empty prompt would DROP the buffered
-        // first turn (pendingPrompt lives only in-memory, not the message queue). Leave
-        // the session as commitRepoSelection left it — the inbound router's worker=null
-        // branch re-forks (with the pinned dir) on the user's next message, and a still-
-        // pending session keeps buffering. Loud log so the rare mid-commit throw is seen.
-        logger.error(`[${tag(ds)}] auto-worktree commit failed (session recoverable on next message): ${e instanceof Error ? e.message : e}`);
-    }
-    finally {
-        ds.worktreeCreating = false;
-    }
-}
-// ─── Main handler ─────────────────────────────────────────────────────────
-/**
- * Drive a host-overload降压 sweep across daemons.
- *
- * Both modes fan out to EVERY online daemon and sum the affected counts. Each
- * daemon owns one bot-scoped session store and its own live workers, so neither
- * stopped sessions nor idle workers can be swept through a sibling daemon.
- *
- * Fail-closed on partial failure: if ANY discovered daemon doesn't ACK, throw —
- * the caller then rolls back the nonce (releaseOverloadNonce) so the owner can
- * retry, instead of burning the button on a card that reports「已清理 0」while
- * the daemon that actually held the zombies never ran. Both sweeps are
- * idempotent (an already-closed session leaves the stopped set; an already-
- * suspended worker leaves the idle set), so a retry only re-hits whatever
- * failed. Reporting a partial count as a completed action would resurrect the
- * exact "显示 0、实际没清" symptom this fix exists to kill — just triggered by
- * "the daemon holding the zombies failed" instead of "the first daemon had none".
- */
-async function sweepHostOverload(mode) {
-    const daemons = listOnlineDaemons();
-    if (daemons.length === 0)
-        throw new Error(`sweep ${mode}: no online daemon`);
-    const postSweep = async (d) => {
-        try {
-            const res = await fetchDaemonIpc(d.ipcPort, '/api/host-overload/sweep', {
-                method: 'POST',
-                headers: { 'content-type': 'application/json' },
-                body: JSON.stringify({ mode }),
-            });
-            const body = await res.json().catch(() => ({}));
-            if (res.ok && body?.ok && typeof body.affected === 'number')
-                return body.affected;
-            logger.warn(`[overload-sweep] daemon ${d.larkAppId} returned ${res.status} ${JSON.stringify(body)}`);
-            return null;
-        }
-        catch (err) {
-            logger.warn(`[overload-sweep] daemon ${d.larkAppId} unreachable: ${err instanceof Error ? err.message : String(err)}`);
-            return null;
-        }
-    };
-    // Fan out to all daemons and sum. Fail the whole action if ANY didn't ACK, so
-    // the caller keeps the button retriable rather than reporting a partial sweep
-    // as complete.
-    const results = await Promise.all(daemons.map(postSweep));
-    const failed = results.filter(n => n === null).length;
-    if (failed > 0) {
-        throw new Error(`sweep ${mode}: ${failed}/${daemons.length} daemon(s) did not ack — retriable`);
-    }
-    return results.reduce((sum, n) => sum + (n ?? 0), 0);
-}
-/**
- * Machine-wide counts for the overload alert preview. Each daemon reports its
- * bot-scoped stopped sessions and its own live workers, so both fields must be
- * summed. Best-effort: an unreachable daemon just contributes 0.
- */
-export async function countHostOverload() {
-    const daemons = listOnlineDaemons();
-    let stopped = 0;
-    let idle = 0;
-    await Promise.all(daemons.map(async (d) => {
-        try {
-            const res = await fetchDaemonIpc(d.ipcPort, '/api/host-overload/counts', { method: 'GET' });
-            const body = await res.json().catch(() => ({}));
-            if (res.ok && body?.ok) {
-                if (typeof body.stopped === 'number')
-                    stopped += body.stopped;
-                if (typeof body.idle === 'number')
-                    idle += body.idle;
-            }
-        }
-        catch { /* unreachable daemon contributes 0 */ }
-    }));
-    return { stopped, idle };
-}
-export async function handleCardAction(data, deps, larkAppId) {
-    const { activeSessions, lastRepoScan } = deps;
-    // turnId is forwarded only when the caller actually has a turn anchor
-    // (e.g. the pendingRepo confirmation) — most card actions have none.
-    const sessionReply = (rid, content, msgType, turnId) => turnId !== undefined
-        ? deps.sessionReply(rid, content, msgType, larkAppId, turnId)
-        : deps.sessionReply(rid, content, msgType, larkAppId);
-    const action = data?.action;
-    const value = action?.value;
-    const cardMessageId = data?.context?.open_message_id ?? data?.open_message_id;
-    if (logger.isDebug()) {
-        logger.debug(`[card] app=${larkAppId ?? '?'} op=${data?.operator?.open_id ?? '?'} ` +
-            `action=${value?.action ?? action?.option ?? '?'} root=${value?.root_id ?? '?'}`);
-    }
-    // Check ALLOWED_USERS for sensitive actions.
-    // Use the receiving bot's allowedUsers — the operator open_id in card actions
-    // is scoped to the app that received the callback.
-    const operatorOpenId = data?.operator?.open_id;
-    // ─── 机器过载告警卡动作（overload_clean_stopped / overload_suspend_idle / noop）──
-    // 不绑 session。owner 强闸门 + nonce 一次性核销（每按钮各一次，防重复点/超时重投/旧卡）。
-    // 点完不替换成死卡：重建同一张卡，把点过的按钮标 done+数量并 disabled，另一个仍可点。
-    if (value?.action === OVERLOAD_ACTION_NOOP) {
-        // 已完成的按钮（disabled 兜底）——个别客户端仍会回调，给个 toast 不做任何事。
-        return { toast: { type: 'info', content: '该操作已执行过' } };
-    }
-    if (value?.action && (value.action === OVERLOAD_ACTION_CLEAN_STOPPED || value.action === OVERLOAD_ACTION_SUSPEND_IDLE) && larkAppId) {
-        const owner = getOwnerOpenId(larkAppId);
-        if (!operatorOpenId || operatorOpenId !== owner) {
-            logger.info(`Overload action "${value.action}" blocked for non-owner: ${operatorOpenId}`);
-            return { toast: { type: 'error', content: '仅管理员可操作' } };
-        }
-        // Parse the card state carried on the button. Missing/corrupt → treat as a
-        // stale card (daemon restart drops the nonce too).
-        let st;
-        try {
-            st = JSON.parse(value.st ?? '');
-        }
-        catch {
-            return JSON.parse(buildOverloadExpiredCard());
-        }
-        if (!st?.nonce)
-            return JSON.parse(buildOverloadExpiredCard());
-        // One-shot per (nonce, action): the OTHER button on the same card stays
-        // clickable (different action), but this button can't re-fire.
-        if (!claimOverloadNonce(st.nonce, value.action)) {
-            return JSON.parse(buildOverloadExpiredCard('这个按钮已点过，或该告警卡已过期。'));
-        }
-        const mode = value.action === OVERLOAD_ACTION_CLEAN_STOPPED ? 'clean_stopped' : 'suspend_idle';
-        let affected;
-        try {
-            affected = await sweepHostOverload(mode);
-        }
-        catch (err) {
-            logger.warn(`[overload] ${value.action} failed: ${err instanceof Error ? err.message : String(err)}`);
-            // Only the destructive sweep is guarded here: roll back the claim so a
-            // transient sweep failure doesn't permanently burn the button — the owner
-            // can click it again to retry. (The post-sweep count refresh below is
-            // deliberately outside this try: once the sweep has run, its failure must
-            // not re-open the button for a second destructive run.)
-            releaseOverloadNonce(st.nonce, value.action);
-            return { toast: { type: 'error', content: '执行失败，请稍后重试或用 CLI 手动处理' } };
-        }
-        if (mode === 'clean_stopped')
-            st.cleanedN = affected;
-        else
-            st.suspendedN = affected;
-        // Refresh the machine-wide candidate counts so the still-live button and
-        // the header reflect what's left after this sweep. Best-effort: the sweep
-        // already succeeded, so a count failure must not roll back the nonce.
-        try {
-            const counts = await countHostOverload();
-            st.stopped = counts.stopped;
-            st.idle = counts.idle;
-        }
-        catch (err) {
-            logger.warn(`[overload] post-sweep count refresh failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        logger.info(`[overload] ${value.action} by owner ${operatorOpenId}: affected=${affected}, remaining stopped=${st.stopped} idle=${st.idle}`);
-        // Rebuild the SAME card: clicked button → ✓done+disabled, other → still live.
-        return JSON.parse(buildOverloadAlertCard(st));
-    }
-    // ─── 群内授权卡片动作（限制提交 + grant/revoke，talk-only）──────────────────
-    // 不绑定 session，必须在 session 解析之前处理。owner 强闸门 + nonce 校验。
-    if (value?.action && (value.action === 'grant_chat'
-        || value.action === 'grant_global'
-        || value.action === 'grant_deny'
-        || value.action === 'grant_set_duration'
-        || value.action === 'grant_set_quota') && larkAppId) {
-        const loc = localeForBot(larkAppId);
-        const owner = getOwnerOpenId(larkAppId);
-        // owner 强闸门：必须是当前 app 的 owner 本人（比 canOperate 更严）
-        if (!operatorOpenId || operatorOpenId !== owner) {
-            logger.info(`Grant action "${value.action}" blocked for non-owner: ${operatorOpenId}`);
-            return { toast: { type: 'error', content: t('card.grant.toast_owner_only', undefined, loc) } };
-        }
-        // 一次 /grant 可带多个目标（多人/多 bot），共用一张卡 + 同一 nonce。
-        // 兼容旧卡（重启前发出的单目标卡只带 target_open_id）：归一成数组。
-        const targets = Array.isArray(value.target_open_ids)
-            ? value.target_open_ids
-            : (value.target_open_id ? [value.target_open_id] : []);
-        const grantChatId = value.chat_id;
-        const nonce = value.nonce;
-        // 全部 target 都得仍 pending 且 nonce 匹配，否则视为整卡失效。
-        if (!targets.length || !grantChatId || !nonce || !targets.every(tt => checkNonce(larkAppId, grantChatId, tt, nonce))) {
-            return { toast: { type: 'error', content: t('card.grant.toast_expired', undefined, loc) } };
-        }
-        // 兼容已发出的旧卡：旧卡用下拉 callback 暂存限制，新卡在授权按钮的 form_submit
-        // 中一次提交有效期和额度。两条路径都必须走服务端校验，不能信任卡片输入。
-        if (value.action === 'grant_set_duration' || value.action === 'grant_set_quota') {
-            const selected = action?.option;
-            const parsed = value.action === 'grant_set_duration'
-                ? normalizeGrantDurationOption(selected)
-                : normalizeGrantQuotaOption(selected);
-            if (parsed === null) {
-                return { toast: { type: 'error', content: t('card.grant.toast_bad_limit', undefined, loc) } };
-            }
-            const updated = updatePendingGrantLimits(larkAppId, grantChatId, targets, nonce, value.action === 'grant_set_duration'
-                ? { durationMs: parsed ?? null }
-                : { quota: parsed ?? null });
-            return updated
-                ? { toast: { type: 'success', content: t('card.grant.toast_limit_staged', undefined, loc) } }
-                : { toast: { type: 'error', content: t('card.grant.toast_expired', undefined, loc) } };
-        }
-        // 拒绝：只把卡更新成「已拒绝」+ 全部目标进 deny 冷却，绝不触碰 grant-store。
-        // 返回原始卡 body，由 dispatcher 包成 in-place patch（不再走 updateMessage 双写）。
-        if (value.action === 'grant_deny') {
-            for (const tt of targets)
-                markDenied(larkAppId, grantChatId, tt);
-            return JSON.parse(buildGrantResultCard('deny', loc));
-        }
-        const formValue = action?.form_value;
-        if (formValue) {
-            const duration = normalizeGrantDurationOption(formValue.grant_duration);
-            const quota = normalizeGrantQuotaOption(typeof formValue.grant_quota === 'string' ? formValue.grant_quota.trim() : formValue.grant_quota);
-            if (quota === null) {
-                return { toast: { type: 'error', content: t('card.grant.toast_bad_quota', undefined, loc) } };
-            }
-            if (duration === null) {
-                return { toast: { type: 'error', content: t('card.grant.toast_bad_limit', undefined, loc) } };
-            }
-            if (!updatePendingGrantLimits(larkAppId, grantChatId, targets, nonce, {
-                durationMs: duration ?? null,
-                quota: quota ?? null,
-            })) {
-                return { toast: { type: 'error', content: t('card.grant.toast_expired', undefined, loc) } };
-            }
-        }
-        // 授权（talk-only）：grant_chat 写本群 chatGrants，grant_global 写全局 globalGrants，
-        // 两者都绝不碰 allowedUsers（operate 只由 bots.json 配）。逐个落库，统计成功/失败。
-        const kind = value.action === 'grant_global' ? 'global' : 'chat';
-        const names = Array.isArray(value.target_names) ? value.target_names : [];
-        const idToName = new Map();
-        targets.forEach((tt, i) => idToName.set(tt, names[i] ?? ''));
-        // 限制挂在 pending 上；确认时生成绝对 expiresAt，多目标共享同一组限制。
-        const limits = getPendingGrantLimits(larkAppId, grantChatId, targets[0]);
-        if (!limits) {
-            return { toast: { type: 'error', content: t('card.grant.toast_expired', undefined, loc) } };
-        }
-        const quota = limits.quota;
-        const expiresAt = limits.durationMs === undefined ? undefined : Date.now() + limits.durationMs;
-        // 触发本次授权申请的原始消息事件：授权成功后重放，用户无需再 @ 一遍。
-        // 自助申请卡每次只对应一个 target，取第一个即可。
-        const pendingMessage = getPendingMessage(larkAppId, grantChatId, targets[0]);
-        const granted = [];
-        const failed = [];
-        for (const tt of targets) {
-            const res = kind === 'global'
-                ? await addGlobalGrant(larkAppId, tt, quota, expiresAt)
-                : await addChatGrant(larkAppId, grantChatId, tt, quota, expiresAt);
-            if (res.ok) {
-                clearPending(larkAppId, grantChatId, tt);
-                granted.push(tt);
-            }
-            else {
-                failed.push({ openId: tt, reason: res.reason });
-                logger.warn(`Grant action "${value.action}" store failed for ${tt}: ${res.reason}`);
-            }
-        }
-        // 全部失败：保留 pending + 不撤卡（owner 可点原卡重试），toast 报错。
-        if (granted.length === 0) {
-            return { toast: { type: 'error', content: t('card.grant.toast_failed', { reason: failed[0]?.reason ?? 'unknown' }, loc) } };
-        }
-        // 部分成功：失败 target 的 pending 必须立刻清掉——卡马上要撤回（owner 无法再点原卡重试），
-        // 而 pending 无 TTL，isThrottled 会永久挡住失败 target 后续的自助申请直到 daemon 重启。
-        // 清掉后失败 target 可重新走 /grant 或自助申请；失败清单下面在原线程明确告知 owner，
-        // 不做「撤卡 + 静默失败 + pending 永久卡住」。
-        for (const f of failed)
-            clearPending(larkAppId, grantChatId, f.openId);
-        // 一次查通讯录判定哪些 grantee 是真人（vs bot），结果同时供下面两处复用：
-        //   1. observed 花名册自动登记（只收 bot，剔真人）；
-        //   2. 通知卡 @ 渲染（只 @ 真人，bot 用纯文本名字 —— 见下方注释）。
-        // 缺 contact 读权限/查询瞬时失败 → 一律按 bot 处理（false）：登记侧沿用历史「全部登记」回退，
-        // 通知侧则把对方当 bot 不 @（宁可少 @ 一次真人，也不误唤醒 bot 拉空会话）。
-        const humanFlags = await Promise.all(granted.map(id => isHumanOpenId(larkAppId, id).catch(() => false)));
-        // /grant @bot 成功后顺带把「bot」目标登记进 observed 花名册（等价内部跑一次 /introduce），
-        // 授权 + 可点名一步到位。写的是 observed-bots-store（让本 daemon 能 @ 回对方），不影响
-        // isKnownPeerBot 接收闸（那查的是 cross-ref，两套独立存储），零额外路由权。best-effort。
-        // 真人**不**登记：查通讯录确认是真人就剔除，避免污染 <available_bots> 误导模型。
-        try {
-            const botEntries = granted
-                .map((id, i) => ({ id, human: humanFlags[i] }))
-                .filter(x => !x.human)
-                .map(x => ({ openId: x.id, name: idToName.get(x.id) ?? '' }));
-            const skipped = granted.length - botEntries.length;
-            if (skipped > 0)
-                logger.debug(`grant auto-introduce: skipped ${skipped} confirmed human target(s)`);
-            if (botEntries.length > 0) {
-                recordObservedBots(config.session.dataDir, larkAppId, grantChatId, botEntries, 'introduce');
-            }
-        }
-        catch (err) {
-            logger.warn(`grant auto-introduce (observed) failed (grant still applied): ${err}`);
-        }
-        // 通知卡的 grantee 渲染参数：bot 只用纯文本名字（不 <at>，否则唤醒对方 bot 误拉空会话），真人 @ 点名。
-        const notifyTargets = granted.map((id, i) => ({ openId: id, name: idToName.get(id) || undefined, isBot: !humanFlags[i] }));
-        // 授权成功后：**就地 patch 原卡**为终态（正文直接 @ 被授权人 + 额度/有效期），这一张卡既是
-        // 「已授权」结果态、又 ping 到被授权人——无需再单独发通知卡、也无需撤回原卡（申晗 2026-07-31
-        // 反馈：直接在原卡更新即可）。同步返回该 body 即完成 in-place patch，避免 deleteMessage 与
-        // callback 响应竞态导致客户端 300000。仅「部分失败」仍走后台补一条文字告知。
-        const resultCardBody = JSON.parse(buildGrantResultCard(kind, loc, quota, expiresAt, notifyTargets));
-        if (cardMessageId && failed.length > 0) {
-            let replyInThread = true;
-            try {
-                const detail = await getMessageDetail(larkAppId, cardMessageId);
-                const item = detail?.items?.[0];
-                if (!item)
-                    throw new Error('no message item in getMessageDetail response');
-                replyInThread = Boolean(item.thread_id);
-            }
-            catch (err) {
-                logger.debug(`grant partial-failure thread-mode probe failed, defaulting to thread reply: ${err}`);
-            }
-            // fire-and-forget: 仅在有部分目标失败时补一条文字告知（不阻塞 callback）。
-            Promise.resolve()
-                .then(async () => {
-                const failNames = failed.map(f => idToName.get(f.openId) || f.openId).join('、');
-                try {
-                    await replyMessage(larkAppId, cardMessageId, t('card.grant.partial_failed', { names: failNames }, loc), 'text', replyInThread);
-                }
-                catch (err) {
-                    logger.warn(`grant partial-failure notice failed: ${err}`);
-                }
-            })
-                .catch(err => logger.error(`grant post-callback background tasks failed: ${err}`));
-        }
-        // 授权成功后重放触发本次申请的原始消息，用户无需再 @ 一遍。
-        // replayGrantedMessage 内部异步执行（setImmediate），不阻塞 callback 响应。
-        if (pendingMessage && deps.replayGrantedMessage) {
-            try {
-                deps.replayGrantedMessage(pendingMessage, larkAppId);
-            }
-            catch (err) {
-                logger.warn(`replay granted message failed (grant still applied): ${err}`);
-            }
-        }
-        return resultCardBody;
-    }
-    if (isAskCardAction(value?.action)) {
-        return handleAskCardAction(data);
-    }
-    if ((value?.action === 'codex_notifier_continue' || value?.action === 'codex_notifier_open_app')
-        && larkAppId) {
-        if (!operatorOpenId) {
-            logger.info(`${value.action} blocked because operator identity is missing`);
-            return { toast: { type: 'error', content: '只有机器人管理员可以操作此 Codex 任务' } };
-        }
-        if (!deps.codexNotifierCardAction) {
-            return { toast: { type: 'error', content: 'Codex 完成通知处理器未启用' } };
-        }
-        return deps.codexNotifierCardAction(data, larkAppId);
-    }
-    if (typeof value?.action === 'string' &&
-        value.action.startsWith('vc_meeting_') &&
-        larkAppId) {
-        if (!deps.vcMeetingCardAction) {
-            return { toast: { type: 'error', content: '会议监听处理器未启用' } };
-        }
-        return deps.vcMeetingCardAction(data, larkAppId);
-    }
-    // Dashboard callbacks dispatch before session lookup. They do not require an
-    // active DaemonSession and use dashboard-internal Route B endpoints.
-    if (typeof value?.action === 'string' &&
-        value.action.startsWith('dash_settings_') &&
-        larkAppId) {
-        const { handleSettingsCardAction } = await import('./settings-card.js');
-        const { createDaemonClientFor } = await import('../../daemon-internal-client-wrapper.js');
-        const settingsLocale = localeForBot(larkAppId);
-        // Success returns `{ card }` only so Lark replaces the card in the same
-        // callback response. Slow fallback is handled by the event dispatcher.
-        return handleSettingsCardAction(data, larkAppId, {
-            createClient: (appId) => createDaemonClientFor(appId),
-            locale: settingsLocale,
-        });
-    }
-    // ─── `/dashboard sessions` callbacks ─────────────────────────────────
-    // Same response shape as dash_settings_*: success returns `{ card }` only,
-    // no toast, so Lark renders the new list in a single pass.
-    if (typeof value?.action === 'string' &&
-        value.action.startsWith('dash_sessions_') &&
-        larkAppId) {
-        const { handleSessionsCardAction } = await import('./sessions-card.js');
-        const { createDaemonClientFor } = await import('../../daemon-internal-client-wrapper.js');
-        const sessionsLocale = localeForBot(larkAppId);
-        return handleSessionsCardAction(data, larkAppId, {
-            createClient: (appId) => createDaemonClientFor(appId),
-            locale: sessionsLocale,
-        });
-    }
-    // ─── `/dashboard schedules` callbacks ────────────────────────────────
-    if (typeof value?.action === 'string' &&
-        value.action.startsWith('dash_schedules_') &&
-        larkAppId) {
-        const { handleSchedulesCardAction } = await import('./schedules-card.js');
-        const { createDaemonClientFor } = await import('../../daemon-internal-client-wrapper.js');
-        const schedulesLocale = localeForBot(larkAppId);
-        return handleSchedulesCardAction(data, larkAppId, {
-            createClient: (appId) => createDaemonClientFor(appId),
-            locale: schedulesLocale,
-        });
-    }
-    // ─── `/dashboard groups` callbacks ───────────────────────────────────
-    if (typeof value?.action === 'string' &&
-        value.action.startsWith('dash_groups_') &&
-        larkAppId) {
-        const { handleGroupsCardAction } = await import('./groups-card.js');
-        const { createDaemonClientFor } = await import('../../daemon-internal-client-wrapper.js');
-        const groupsLocale = localeForBot(larkAppId);
-        return handleGroupsCardAction(data, larkAppId, {
-            createClient: (appId) => createDaemonClientFor(appId),
-            locale: groupsLocale,
-        });
-    }
-    // ─── `/issue` Issue Board callbacks ──────────────────────────────────
-    // 权限门（allowedUsers + invoker lock）在 handleIssueCardAction 里，每次回调都重跑。
-    if (typeof value?.action === 'string' &&
-        value.action.startsWith('issue_') &&
-        larkAppId) {
-        const { handleIssueCardAction } = await import('./issue-command.js');
-        const { buildIssueCommandDeps } = await import('./issue-command-deps.js');
-        return handleIssueCardAction(data, larkAppId, buildIssueCommandDeps());
-    }
-    // ─── `/dashboard overview` callbacks ─────────────────────────────────
-    // Goto buttons rebuild the TARGET card by re-fetching the corresponding
-    // dedicated Route B endpoint (sessions-list / schedules-list /
-    // settings-snapshot). No new endpoints, no multi_url cross-card jumps.
-    if (typeof value?.action === 'string' &&
-        value.action.startsWith('dash_overview_') &&
-        larkAppId) {
-        const { handleOverviewCardAction } = await import('./overview-card.js');
-        const { createDaemonClientFor } = await import('../../daemon-internal-client-wrapper.js');
-        const overviewLocale = localeForBot(larkAppId);
-        return handleOverviewCardAction(data, larkAppId, {
-            createClient: (appId) => createDaemonClientFor(appId),
-            locale: overviewLocale,
-        });
-    }
-    // ─── /relay picker: state-changing actions (select / page / search) ────
-    // These three actions all re-render the picker card with updated state:
-    //   • relay_select — user clicked a session card → set as selectedSessionId
-    //   • relay_page   — user clicked prev/next page → bump page index
-    //   • relay_search — user submitted the search form → apply new query (reset page)
-    //
-    // The card is stateless on the Lark side, so each callback value carries
-    // the FULL state (search / page / selected / target_chat_id / root_id);
-    // we just compute the new state from the action and re-render.
-    if (value?.action && larkAppId && ['relay_select', 'relay_page', 'relay_search'].includes(value.action)) {
-        const loc = localeForBot(larkAppId);
-        const targetChatId = value.target_chat_id;
-        const targetRootId = value.root_id;
-        // root_id IS the relay target anchor (chatId for chat-scope, 话题 root for
-        // thread-scope). target_scope tells the confirm/re-render which it is;
-        // target_chat_type (group | p2p) rides along so confirm can flip the
-        // session's chatType for DM targets. Default 'group' covers legacy cards.
-        const targetScope = value.target_scope ?? 'chat';
-        const targetChatType = value.target_chat_type ?? 'group';
-        const cardVisibility = value.visibility ?? 'public';
-        const invokerOpenId = value.invoker_open_id;
-        if (!targetChatId || !targetRootId || !operatorOpenId) {
-            return { toast: { type: 'error', content: t('card.relay.toast_failed', { error: 'missing_value' }, loc) } };
-        }
-        // Picker is owner-only: only the user who summoned it may flip pages,
-        // search, or select. Otherwise A's invocation in a shared chat could be
-        // silently swapped to C's session list when C clicks a button. Cards
-        // built before this guard was deployed lack invoker_open_id — we let
-        // them through (legacy) rather than break in-flight pickers; new cards
-        // are protected from the moment they're rendered.
-        if (invokerOpenId && invokerOpenId !== operatorOpenId) {
-            return { toast: { type: 'error', content: t('card.relay.toast_not_invoker', undefined, loc) } };
-        }
-        // Reconstruct the next state from the action.
-        const carriedSearch = value.search ?? '';
-        const carriedPage = Number(value.page ?? 0) || 0;
-        const carriedSelected = value.selected ?? '';
-        let nextSearch = carriedSearch;
-        let nextPage = carriedPage;
-        let nextSelected = carriedSelected || undefined;
-        if (value.action === 'relay_search') {
-            // v2 input fires `behaviors[].callback` directly — the typed text
-            // arrives as action.input_value (NOT form_value), since we're no
-            // longer wrapping the input in a form. Reset page on new search.
-            nextSearch = String(action?.input_value ?? '').trim();
-            nextPage = 0;
-            // Don't carry over the selection on a new search — the selected entry
-            // may not match the new filter, and even if it does, "I just searched
-            // for something else" implies the user is changing what they want.
-            nextSelected = undefined;
-        }
-        else if (value.action === 'relay_page') {
-            nextPage = Number(value.page ?? 0) || 0;
-        }
-        else if (value.action === 'relay_select') {
-            nextSelected = value.session_id;
-        }
-        // Exclude by the target ANCHOR (root_id), not chatId — keeps 同群 other-
-        // topic sessions in the candidate list on re-render, matching初次渲染.
-        const { collectRelayPickerEntries } = await import('../../services/relay-picker.js');
-        const entries = await collectRelayPickerEntries(activeSessions, larkAppId, targetRootId, operatorOpenId);
-        const { buildRelayPickerCard } = await import('./card-builder.js');
-        const cardJson = buildRelayPickerCard(entries, targetChatId, targetRootId, 
-        // Preserve the original invoker so the re-rendered card stays bound
-        // to them. Fall back to operatorOpenId for legacy cards rendered
-        // before invoker_open_id was added (shouldn't normally happen since
-        // the check above already lets legacy through, but a render needs a
-        // string regardless).
-        invokerOpenId ?? operatorOpenId, loc, {
-            selectedSessionId: nextSelected,
-            searchQuery: nextSearch,
-            page: nextPage,
-        }, targetScope, targetChatType, cardVisibility);
-        // ── Private (ephemeral) picker: delete-then-resend ────────────────────
-        // Ephemeral cards CANNOT be PATCH-updated (Feishu legacy interface), so we
-        // can't return a body for the dispatcher to patch in place. Instead delete
-        // the clicked card and resend a fresh ephemeral one carrying the new state
-        // — the same send→interact→delete→resend pattern Feishu documents for
-        // ephemeral flows. Resend FIRST, then delete the old one, so a resend
-        // failure doesn't leave the user with no card at all. The toast keeps the
-        // callback response non-empty (returning {} would make Lark show nothing).
-        if (cardVisibility === 'private') {
-            const { sendEphemeralCard, deleteEphemeralCard } = await import('./client.js');
-            try {
-                await sendEphemeralCard(larkAppId, targetChatId, invokerOpenId ?? operatorOpenId, cardJson);
-                if (cardMessageId) {
-                    await deleteEphemeralCard(larkAppId, cardMessageId).catch(() => { });
-                }
-                // No card body returned — the replacement is already sent. An empty
-                // response is fine here (the new ephemeral card is the user-visible
-                // result); a toast would double up with the freshly-rendered card.
-                return;
-            }
-            catch (err) {
-                logger.warn(`[card-action] relay private picker re-render failed (${err instanceof Error ? err.message : err}); leaving old card in place`);
-                return { toast: { type: 'error', content: t('card.relay.toast_failed', { error: 'ephemeral_refresh_failed' }, loc) } };
-            }
-        }
-        // Return an updated card body — event-dispatcher wraps this as
-        // { card: { type: 'raw', data: <body> } } so Lark patches the picker
-        // in place rather than appending a new message.
-        return JSON.parse(cardJson);
-    }
-    // ─── /botconfig 交互卡片：切换布尔开关 / 选择 cli·model·lang / 消息额度，就地刷新 ──
-    const CONFIG_CARD_ACTIONS = ['config_toggle', 'config_set', 'config_quota', 'config_text_open', 'config_text_save'];
-    if (value?.action && larkAppId && CONFIG_CARD_ACTIONS.includes(value.action)) {
-        // 卡片携带的渲染语言（`/botconfig en` 的覆盖）优先；缺省回落 bot 默认。
-        const vLoc = value?.loc;
-        const loc = isLocale(vLoc) ? vLoc : localeForBot(larkAppId);
-        let cbot;
-        try {
-            cbot = getBot(larkAppId);
-        }
-        catch {
-            return { toast: { type: 'error', content: t('cmd.config.no_bot', undefined, loc) } };
-        }
-        // 严格 owner/allowlist 闸（与文字版 /botconfig 同口径）：拒开放模式 + 非 admin。
-        const admins = cbot.resolvedAllowedUsers;
-        if (admins.length === 0 || !operatorOpenId || !admins.includes(operatorOpenId)) {
-            return { toast: { type: 'error', content: t('cmd.config.not_admin', undefined, loc) } };
-        }
-        // ttadk 网关 bot 用 ttadk 网关模型候选（glm-5.1…），非底层适配器的 opus/gpt-5
-        // （否则被 worker 注入成 `ttadk -m opus` 用错模型启动失败）；CoCo 无候选。
-        const modelChoices = (() => {
-            const ttadkChoices = ttadkConfigModelChoices(cbot.config.wrapperCli);
-            if (ttadkChoices !== null)
-                return ttadkChoices;
-            try {
-                return createCliAdapterSync(cbot.config.cliId, cbot.config.cliPathOverride).modelChoices ?? [];
-            }
-            catch {
-                return [];
-            }
-        })();
-        const reRender = () => {
-            const d = getConfigCardData(larkAppId, modelChoices);
-            return d ? { card: { type: 'raw', data: JSON.parse(buildConfigCard(d, loc)) } } : {};
-        };
-        // 「文本设置」子卡：点主卡按钮 → **私信新发**一张含输入框的子卡（v1 form 须新发、
-        // 不能 patch，否则空卡）。子卡每个字段一个 form，保存即写、回 toast、卡片保持
-        // （不回 card → 不 patch，避免 form 重渲染异常）。
-        if (value.action === 'config_text_open') {
-            const d = getConfigCardData(larkAppId, modelChoices);
-            if (!d)
-                return { toast: { type: 'error', content: t('cmd.config.no_bot', undefined, loc) } };
-            try {
-                await sendUserMessage(larkAppId, operatorOpenId, buildConfigTextCard(d, loc), 'interactive');
-                return { toast: { type: 'success', content: t('card.config.text_sent', undefined, loc) } };
-            }
-            catch {
-                return { toast: { type: 'error', content: t('card.config.text_send_fail', undefined, loc) } };
-            }
-        }
-        if (value.action === 'config_text_save') {
-            const fk = value?.field;
-            const fv = action?.form_value ?? {};
-            const raw = String((fk ? fv[fk] : '') ?? '').trim();
-            if (fk === 'teamRole') {
-                // writeTeamRoleFile truncates by UTF-8 byte length (MAX_ROLE_BYTES); do
-                // not pre-slice by JS char count here (would mis-cut CJK).
-                if (raw)
-                    writeTeamRoleFile(larkAppId, raw);
-                else
-                    deleteTeamRoleFile(larkAppId);
-                logger.info(`[config:${larkAppId}] team role ${raw ? 'set' : 'cleared'} via card`);
-                return { toast: { type: 'success', content: t('card.config.text_saved', undefined, loc) } };
-            }
-            const spec = fk ? findConfigField(fk) : undefined;
-            if (!spec)
-                return { toast: { type: 'error', content: t('cmd.config.unknown_field', { field: fk ?? '?', fields: '' }, loc) } };
-            // 留空 = 清除；非空一律过 coerceConfigValue 按 kind 归一化/校验（stringList
-            // 拆数组、string 执行 maxLen 等 spec 约束），与 /config 文字入口、dashboard
-            // PUT 同一校验点，避免卡片入口绕过。
-            let valueToApply;
-            if (!raw) {
-                valueToApply = null;
-            }
-            else {
-                const coerced = coerceConfigValue(spec, raw);
-                if (!coerced.ok)
-                    return { toast: { type: 'error', content: t('cmd.config.write_failed', { reason: coerced.reason }, loc) } };
-                // 文本子卡只承载 string / stringList 字段；narrow 给 applyConfigField。
-                valueToApply = coerced.value;
-            }
-            const r = await applyConfigField(larkAppId, spec, valueToApply);
-            if (!r.ok)
-                return { toast: { type: 'error', content: t('cmd.config.write_failed', { reason: r.reason }, loc) } };
-            logger.info(`[config:${larkAppId}] text field ${spec.key} saved via card`);
-            return { toast: { type: 'success', content: `✓ ${spec.key} = ${r.newText}` } };
-        }
-        // 消息额度（grant-prefs，非 CONFIG_FIELDS 字段）：'off' = 关闭，正整数 = 设定。
-        if (value.action === 'config_quota') {
-            const raw = action?.option ?? '';
-            const n = raw === 'off' ? null : Number(raw);
-            const limit = n && Number.isInteger(n) && n > 0 ? n : null;
-            const qr = await updateBotGrantPrefs(larkAppId, { messageQuotaDefaultLimit: limit });
-            if (!qr.ok)
-                return { toast: { type: 'error', content: t('cmd.config.write_failed', { reason: qr.reason }, loc) } };
-            return { toast: { type: 'success', content: `✓ quota = ${limit ?? 'off'}` }, ...reRender() };
-        }
-        const field = value.field;
-        const spec = field ? findConfigField(field) : undefined;
-        if (!spec || spec.kind === 'allowedUsers') {
-            return { toast: { type: 'error', content: t('cmd.config.unknown_field', { field: field ?? '?', fields: '' }, loc) } };
-        }
-        let r;
-        if (value.action === 'config_toggle') {
-            if (spec.kind !== 'boolean')
-                return { toast: { type: 'error', content: t('cmd.config.invalid_bool', { field: spec.key, value: '' }, loc) } };
-            const cur = cbot.config[spec.configKey] === true;
-            r = await applyConfigField(larkAppId, spec, !cur);
-        }
-        else {
-            const raw = action?.option ?? action?.input_value ?? '';
-            if (raw === CONFIG_UNSET) {
-                if (!spec.clearable)
-                    return { toast: { type: 'error', content: t('cmd.config.not_clearable', { field: spec.key }, loc) }, ...reRender() };
-                r = await applyConfigField(larkAppId, spec, null);
-            }
-            else {
-                const coerced = coerceConfigValue(spec, raw);
-                if (!coerced.ok)
-                    return { toast: { type: 'error', content: t('cmd.config.write_failed', { reason: coerced.reason }, loc) }, ...reRender() };
-                r = await applyConfigField(larkAppId, spec, coerced.value);
-            }
-        }
-        if (!r.ok)
-            return { toast: { type: 'error', content: t('cmd.config.write_failed', { reason: r.reason }, loc) } };
-        return { toast: { type: 'success', content: `✓ ${spec.key} = ${r.newText}` }, ...reRender() };
-    }
-    // ─── /relay picker: confirm transfer (stage 2 → done) ──────────────────
-    // The confirm button on the picker card fires this. Same logic as the
-    // original (pre-two-stage) relay_pickup action: owner-check, pre-flight
-    // conflict check, send M1, transferSession, delete picker card.
-    if (value?.action === 'relay_confirm' && larkAppId) {
-        const loc = localeForBot(larkAppId);
-        const sourceSessionId = value.session_id;
-        const targetChatId = value.target_chat_id;
-        const targetRootId = value.root_id;
-        // root_id IS the target anchor for thread-scope (the 话题 root); for chat-
-        // scope the anchor is chatId and root_id is unused for routing.
-        // target_chat_type tells transferSession whether the destination is a DM
-        // (p2p) so the session's chatType flips with it; legacy cards lack the
-        // field and default to 'group' (their pickers never offered DM targets).
-        const targetScope = value.target_scope ?? 'chat';
-        const targetChatType = value.target_chat_type ?? 'group';
-        const cardVisibility = value.visibility ?? 'public';
-        const targetAnchor = targetScope === 'chat' ? targetChatId : targetRootId;
-        const invokerOpenId = value.invoker_open_id;
-        if (!sourceSessionId || !targetChatId || !targetRootId) {
-            return { toast: { type: 'error', content: t('card.relay.toast_failed', { error: 'missing_value' }, loc) } };
-        }
-        // Invoker-only confirm: redundant with the ownerOpenId check below in
-        // normal flow (invoker = session owner = picker invoker), but defends
-        // against the edge case where the source session changed owners after
-        // the picker was rendered, OR where the picker was shared/forwarded.
-        // Legacy cards (no invoker_open_id) fall through to ownerOpenId only.
-        if (invokerOpenId && operatorOpenId && invokerOpenId !== operatorOpenId) {
-            return { toast: { type: 'error', content: t('card.relay.toast_not_invoker', undefined, loc) } };
-        }
-        // Locate the source session in the in-process registry. Since picker only
-        // lists sessions of THIS bot in OTHER chats, the source must live in our
-        // activeSessions — if it's gone, treat as not found rather than reaching
-        // across daemons (cross-daemon pull is out of v1 scope).
-        let sourceDs;
-        for (const cand of activeSessions.values()) {
-            if (cand.larkAppId === larkAppId && cand.session.sessionId === sourceSessionId) {
-                sourceDs = cand;
-                break;
-            }
-        }
-        if (!sourceDs) {
-            return { toast: { type: 'error', content: t('card.relay.toast_not_found', undefined, loc) } };
-        }
-        if (sourceDs.session.ownerOpenId && sourceDs.session.ownerOpenId !== operatorOpenId) {
-            return { toast: { type: 'error', content: t('card.relay.toast_not_owner', undefined, loc) } };
-        }
-        // Anchor-based self-relay guard: a thread-scope source in the SAME chat
-        // (different 话题) is a legitimate cross-topic move, so refuse only when the
-        // source and target anchors are identical.
-        if (sessionAnchorId(sourceDs) === targetAnchor) {
-            return { toast: { type: 'error', content: t('card.relay.toast_same_chat', undefined, loc) } };
-        }
-        // Real-session preflight — done BEFORE M1 send so a refusal doesn't
-        // leave a misleading "已接力" announcement in the target chat.
-        // collectRelayPickerEntries already filters scratches at render time,
-        // but a stale picker (rendered before a scratch was created) could
-        // still produce a confirm click; this is the depth defense.
-        const { isDisposableCommandScratch, isRelayableRealSession } = await import('../../core/worker-pool.js');
-        if (!isRelayableRealSession(sourceDs)) {
-            return { toast: { type: 'error', content: t('card.relay.toast_not_started_yet', undefined, loc) } };
-        }
-        // Pre-flight target-chat conflict check — done BEFORE sendMessage M1 so
-        // a refusal doesn't leave a misleading "已接力" announcement in the
-        // target chat (王皓 caught this in testing). Mirror the same predicate
-        // transferSession uses. Only a narrowly classified daemon-command scratch
-        // may be ignored; worker-less queued/adopt/deferred/real sessions still own
-        // the anchor and must block before a misleading M1 is sent.
-        const targetConflict = [...activeSessions.values()].find(c => c !== sourceDs
-            && c.larkAppId === larkAppId
-            && sessionAnchorId(c) === targetAnchor
-            && !isDisposableCommandScratch(c));
-        if (targetConflict) {
-            const conflictTitle = targetConflict.session.title || targetConflict.session.sessionId.substring(0, 8);
-            // Send as a regular text message in the target chat instead of a
-            // popup toast — per王皓's preference for visible/persistent error
-            // ("不要用弹窗，就用消息形式"). No toast returned so the operator
-            // sees the chat message land where the error actually applies.
-            // Pass raw text — sendMessage wraps text-msgType bodies itself; the
-            // earlier `JSON.stringify({text: ...})` caused double-wrapping and
-            // Lark rendered the JSON literally (王皓 caught this in the M1).
-            const errText = t('cmd.relay.target_has_session_msg', { title: conflictTitle }, loc);
-            sendMessage(larkAppId, targetChatId, errText, 'text').catch(() => undefined);
-            return;
-        }
-        // Resolve a friendly source chat label for the M1 announcement — falls
-        // back to the raw chatId if Lark can't return a name. A p2p source has no
-        // chat name (chat.get often fails or returns empty for DMs) — use the
-        // locale-aware 单聊 label instead of leaking a raw oc_ id into the M1.
-        const { getChatName } = await import('./client.js');
-        const sourceLabel = sourceDs.chatType === 'p2p'
-            ? t('card.relay.type_p2p', undefined, loc)
-            : (await getChatName(larkAppId, sourceDs.chatId)) ?? sourceDs.chatId;
-        // Send the M1 announcement.
-        //   chat-scope: a plain top-level message; its id becomes the (audit-only)
-        //               rootMessageId after the transfer (mirrors /relay --create).
-        //   thread-scope: reply_in_thread INTO the target 话题 (anchor) so the
-        //               announcement lands in the 话题; the session anchors on the
-        //               话题 root (targetAnchor), NOT the M1 id.
-        let m1MessageId;
-        try {
-            const m1Text = t(targetChatType === 'p2p' ? 'cmd.relay.m1_announce_dm' : 'cmd.relay.m1_announce', { sourceChat: sourceLabel, groupName: targetChatId }, loc);
-            m1MessageId = targetScope === 'thread'
-                ? await replyMessage(larkAppId, targetAnchor, m1Text, 'text', /*replyInThread*/ true)
-                : await sendMessage(larkAppId, targetChatId, m1Text, 'text');
-        }
-        catch (err) {
-            return { toast: { type: 'error', content: t('card.relay.toast_failed', { error: err?.message ?? 'send_m1_failed' }, loc) } };
-        }
-        const { transferSession, TRANSFER_DETACH_FENCE_PICKER_MS } = await import('../../core/worker-pool.js');
-        // chat-scope → anchor on the M1 id (audit-only); thread-scope → anchor on
-        // the 话题 root (targetAnchor) so future replies in the 话题 route here.
-        // In-process picker relay has no HTTP abort above it (unlike the cross-daemon
-        // /relay --create peer path), so give the observer-detach fence generous
-        // headroom — a clean-but-slightly-slow worker teardown (~3.5s observed) must
-        // not be misclassified as worker_detach_timeout.
-        const r = targetScope === 'thread'
-            ? await transferSession(sourceDs.session.sessionId, targetChatId, targetAnchor, targetChatType, 'thread', { detachTimeoutMs: TRANSFER_DETACH_FENCE_PICKER_MS })
-            : await transferSession(sourceDs.session.sessionId, targetChatId, m1MessageId, targetChatType, 'chat', { detachTimeoutMs: TRANSFER_DETACH_FENCE_PICKER_MS });
-        if (!r.ok) {
-            // Best-effort: orphan M1 cleanup so a failed transfer doesn't leave a
-            // misleading "已接力" message in the target chat (王皓's "明明失败了
-            // 却返回成功了" complaint). Race-condition fallback only — the
-            // pre-flight checks above should catch the common cases first.
-            deleteMessage(larkAppId, m1MessageId).catch(() => { });
-            // Deliver the failure as a VISIBLE message, never a toast. The confirm
-            // handler awaits the detach fence (up to TRANSFER_DETACH_FENCE_PICKER_MS
-            // = 8s), which always exceeds the 2.5s card-ACK window — once the generic
-            // "后台处理中" ACK has gone out, a toast can no longer be surfaced and is
-            // silently dropped (only a `not shown to user` log line remained; this is
-            // exactly the failure 申晗 hit — a false-timeout relay whose error the
-            // user never saw). transferSession never commits the routing rewrite on
-            // ANY !ok path, so the source session is always still intact; the copy
-            // reassures the user it was not lost and points at a concrete retry (the
-            // picker card + its 确认 button survive — we only delete them on success
-            // below). Land the notice where the user is looking, mirroring the M1
-            // delivery target: thread-scope → reply_in_thread into the 话题;
-            // chat-scope → a top-level message in the target chat.
-            const failText = r.error === 'worker_detach_timeout' ? t('card.relay.fail_timeout', undefined, loc)
-                : r.error === 'worker_busy' ? t('card.relay.fail_worker_busy', undefined, loc)
-                    : r.error === 'target_chat_has_session' ? t('cmd.relay.target_has_session_msg', { title: '' }, loc)
-                        : r.error === 'adopt_not_relayable' ? t('card.relay.toast_adopt_not_relayable', undefined, loc)
-                            : r.error === 'not_started_yet' ? t('card.relay.toast_not_started_yet', undefined, loc)
-                                : t('card.relay.fail_generic', { error: r.error }, loc);
-            try {
-                if (targetScope === 'thread') {
-                    await replyMessage(larkAppId, targetAnchor, failText, 'text', /*replyInThread*/ true);
-                }
-                else {
-                    await sendMessage(larkAppId, targetChatId, failText, 'text');
-                }
-            }
-            catch (e) {
-                logger.warn(`[card-action] relay failure notice send failed (${e instanceof Error ? e.message : e}); relay error was: ${r.error}`);
-            }
-            return;
-        }
-        // Best-effort: remove the picker card now that the selection resolved.
-        // Ephemeral (private) pickers need the ephemeral-delete endpoint —
-        // deleteMessage (im/v1/messages) doesn't apply to ephemeral message ids.
-        if (cardMessageId && larkAppId) {
-            if (cardVisibility === 'private') {
-                const { deleteEphemeralCard } = await import('./client.js');
-                deleteEphemeralCard(larkAppId, cardMessageId).catch(() => { });
-            }
-            else {
-                deleteMessage(larkAppId, cardMessageId).catch(() => { });
-            }
-        }
-        return { toast: { type: 'success', content: t('card.relay.toast_success', undefined, loc) } };
-    }
-    // v3 humanGate 审批卡（独立 namespace，不混 v0.2 wait path）。**在通用 sensitive
-    // 权限门之前**处理（codex medium）：v3 卡 value 没有 root_id/session_id，通用门只能
-    // 用 chatId=undefined 做粗判，可能误拦；v3 自己的 `canResolve(binding, operator)`
-    // 才有 run binding 的 chatId，是权威权限门。
-    if (isV3GateAction(value?.action)) {
-        if (!deps.v3GateDeps)
-            return;
-        return await handleV3GateAction(value, operatorOpenId, deps.v3GateDeps);
-    }
-    if (isV3BlockedAction(value?.action)) {
-        if (!deps.v3BlockedDeps)
-            return;
-        return await handleV3BlockedAction(value, operatorOpenId, deps.v3BlockedDeps, action?.form_value);
-    }
-    if (isV3RevisitGrantAction(value?.action)) {
-        if (!deps.v3RevisitGrantDeps)
-            return;
-        return await handleV3RevisitGrantAction(value, operatorOpenId, deps.v3RevisitGrantDeps);
-    }
-    if (isV3LoopGrantAction(value?.action)) {
-        if (!deps.v3LoopGrantDeps)
-            return;
-        return await handleV3LoopGrantAction(value, operatorOpenId, deps.v3LoopGrantDeps);
-    }
-    if (isV3RunSaveAction(value?.action)) {
-        if (!deps.v3RunSaveDeps)
-            return;
-        return await handleV3RunSaveAction(value, operatorOpenId, larkAppId, deps.v3RunSaveDeps);
-    }
-    if (isV3DistillationAction(value?.action)) {
-        if (!deps.v3DistillationDeps)
-            return;
-        return await handleV3DistillationAction(value, operatorOpenId, larkAppId, cardMessageId, deps.v3DistillationDeps);
-    }
-    const isSensitive = value?.action && ['restart', 'close', 'resume', 'skip_repo', 'repo_manual_submit', 'repo_worktree_submit', 'worktree_toggle_mode', 'retry_last_task', 'get_write_link', 'open_local_terminal', 'open_local_cli', 'toggle_stream', 'toggle_display', 'export_text', 'term_action', 'refresh_screenshot', 'takeover', 'disconnect', 'tui_keys', 'tui_text_input', 'wf_approve', 'wf_reject', 'wf_cancel'].includes(value.action);
-    if (isSensitive) {
-        const rootId = value?.root_id;
-        // activeSessions is keyed by sessionKey(anchor, larkAppId) — `${anchor}::${larkAppId}`
-        // (double colon). Earlier this was hand-spliced with a single colon and
-        // always missed, falling through to the bare-rootId legacy lookup; that
-        // worked for permission gating only because chatId came from elsewhere
-        // most of the time. Use sessionKey() so the bot-scoped lookup actually
-        // hits, and keep the bare-rootId fallback for legacy single-bot cards.
-        const ds = rootId
-            ? (larkAppId
-                ? getSessionByActionValue(activeSessions, rootId, larkAppId, value?.session_id, value?.action)
-                : activeSessions.get(rootId))
-            : undefined;
-        // Resume targets a closed session — fall back to the persistent store so
-        // we can still pin chatId/larkAppId for the canOperate gate.
-        const closedForCtx = !ds && value?.action === 'resume' && value?.session_id
-            ? sessionStore.getSession(value.session_id)
-            : undefined;
-        const effectiveAppId = larkAppId ?? ds?.larkAppId ?? closedForCtx?.larkAppId;
-        const chatId = ds?.chatId ?? closedForCtx?.chatId;
-        // pendingRepo 阶段，会话发起人（含 chat-granted 用户）可以 skip_repo / 手动填目录
-        // 起会话——与 repo 下拉选择同款例外，否则被授权人连自己的首次会话都启动不了。
-        // 注意：worktree_toggle_mode 故意不在此列——它持久写 bot 级 worktreeMultiPicker
-        // （影响该 bot 所有后续会话），属管理动作，必须走 canOperate，不能让 talk-only/
-        // chat-granted 用户借「开自己的 pending 卡」绕过去改 bot 配置。
-        const pendingRepoOwnerException = (value.action === 'skip_repo' || value.action === 'repo_manual_submit' || value.action === 'repo_worktree_submit') && !!ds?.pendingRepo &&
-            !!operatorOpenId && operatorOpenId === ds.session.ownerOpenId;
-        if (effectiveAppId) {
-            if (!pendingRepoOwnerException && !canOperate(effectiveAppId, chatId, operatorOpenId)) {
-                logger.info(`Card action "${value.action}" blocked for non-operator user: ${operatorOpenId} (chat=${chatId})`);
-                // get_write_link 显式破例：其余敏感动作沿用「静默 block（仅日志）」的既有设计
-                // （test/card-handler-repo-select.test.ts 把这点 pin 住了），但「获取操作链接」是
-                // 用户主动点的取权动作，静默会让人以为按钮坏了——给一条明确的「无操作权限」toast。
-                if (value.action === 'get_write_link' || value.action === 'open_local_terminal' || value.action === 'open_local_cli') {
-                    const key = value.action === 'open_local_terminal'
-                        ? 'card.action.local_terminal_no_permission'
-                        : value.action === 'open_local_cli'
-                            ? 'card.action.local_cli_no_permission'
-                            : 'card.action.write_link_no_permission';
-                    return { toast: { type: 'warning', content: t(key, undefined, localeForBot(effectiveAppId)) } };
-                }
-                return;
-            }
-        }
-        else {
-            const bots = getAllBots();
-            const allowedUsers = bots.flatMap(b => b.resolvedAllowedUsers);
-            // globalGrants 与 allowedChatGroups 同理计入 hasAllowlist：只配 globalGrants（talk-only）
-            // 也算限制态，否则这条手写 fallback 会算成 false → 敏感动作 fall through 成全开放。
-            // 注意只进 hasAllowlist 判定，命中仍只认 allowedUsers（与 canOperate 一致，不授 operate）。
-            const hasAllowlist = allowedUsers.length > 0
-                || bots.some(b => (b.config.allowedChatGroups?.length ?? 0) > 0)
-                || bots.some(b => (b.config.globalGrants?.length ?? 0) > 0)
-                // p2pOpen 同理（与 evaluateTalk 的 hasConfiguredAllowlist 保持一致）：它是一次显式的
-                // 权限边界声明，不能让这条 fallback 把「只配 p2pOpen」的部署算成无白名单 → 敏感卡片
-                // 动作 fall through 成全开放。
-                || bots.some(b => b.config.p2pOpen === true);
-            if (hasAllowlist && (!operatorOpenId || !allowedUsers.includes(operatorOpenId))) {
-                logger.info(`Card action "${value.action}" blocked for non-allowed user: ${operatorOpenId}`);
-                // 与上面 non-operator 分支同理：仅 get_write_link 破例给 toast，其余保持静默。
-                if (value.action === 'get_write_link' || value.action === 'open_local_terminal' || value.action === 'open_local_cli') {
-                    const key = value.action === 'open_local_terminal'
-                        ? 'card.action.local_terminal_no_permission'
-                        : value.action === 'open_local_cli'
-                            ? 'card.action.local_cli_no_permission'
-                            : 'card.action.write_link_no_permission';
-                    return { toast: { type: 'warning', content: t(key, undefined, localeForBot(larkAppId)) } };
-                }
-                return;
-            }
-        }
-    }
-    // Historical v2 workflow cards remain in chat history after the runtime is
-    // removed. Treat every legacy callback as a tombstone instead of allowing it
-    // to fall through to an unrelated generic card action.
-    if (typeof value?.action === 'string' &&
-        (value.action.startsWith('wf_') || value.action.startsWith('dash_workflows_'))) {
-        return {
-            toast: {
-                type: 'warning',
-                content: 'v2 workflow 已下线；旧卡片不再可操作，请迁移定义后使用 /workflow。',
-            },
-        };
-    }
-    // Handle session card button actions (restart/close)
-    // ─── /adopt V2 picker: state-changing re-renders (pick / page / search) ─
-    // Mirrors the /relay picker. Lark cards are stateless server-side, so every
-    // callback value carries the full state (search / page / selected / root_id /
-    // invoker). We reuse the candidates snapshot cached at first render so a page
-    // flip or search doesn't re-shell-out to tmux; on a cache miss (TTL expiry /
-    // daemon restart) we re-discover and re-cache.
-    if (value?.action && larkAppId && ['adopt_pick', 'adopt_page', 'adopt_search'].includes(value.action)) {
-        const rootId = value.root_id;
-        if (!rootId)
-            return { toast: { type: 'error', content: t('card.adopt.toast_missing_value', undefined, localeForBot(larkAppId)) } };
-        const loc = localeForBot(larkAppId);
-        const sKey = sessionKey(rootId, larkAppId);
-        const ds = activeSessions.get(sKey);
-        if (!ds)
-            return { toast: { type: 'error', content: t('card.adopt.toast_no_session', undefined, loc) } };
-        // Owner-only, same gate as the command path.
-        if (!canOperate(ds.larkAppId, ds.chatId, operatorOpenId)) {
-            return { toast: { type: 'error', content: t('card.adopt.toast_no_perm', undefined, loc) } };
-        }
-        // Pin the card to its summoner (legacy cards without the field pass through).
-        const invokerOpenId = value.invoker_open_id;
-        if (invokerOpenId && operatorOpenId && invokerOpenId !== operatorOpenId) {
-            return { toast: { type: 'error', content: t('card.adopt.toast_not_invoker', undefined, loc) } };
-        }
-        // Reconstruct next state from the action.
-        let nextSearch = value.search ?? '';
-        let nextPage = Number(value.page ?? 0) || 0;
-        let nextSelected = value.selected || undefined;
-        if (value.action === 'adopt_search') {
-            nextSearch = String(action?.input_value ?? '').trim();
-            nextPage = 0;
-            nextSelected = undefined; // new filter → drop selection
-        }
-        else if (value.action === 'adopt_page') {
-            nextPage = Number(value.page ?? 0) || 0;
-        }
-        else if (value.action === 'adopt_pick') {
-            nextSelected = value.entry_key;
-        }
-        const botCfg = getBot(ds.larkAppId).config;
-        const { collectAdoptCandidates, cacheAdoptCandidates, getCachedAdoptCandidates, } = await import('../../services/adopt-picker.js');
-        let candidates = getCachedAdoptCandidates(rootId, Date.now());
-        if (!candidates) {
-            const { discoverResumableSessionsForBot, ADOPT_RESUME_LIMIT } = await import('../../core/command-handler.js');
-            candidates = await collectAdoptCandidates(botCfg.cliId, botCfg.cliPathOverride, activeSessions, discoverResumableSessionsForBot, ADOPT_RESUME_LIMIT, botCfg.cliRuntime?.executable);
-            cacheAdoptCandidates(rootId, candidates, Date.now());
-        }
-        const { buildAdoptSelectCard } = await import('./card-builder.js');
-        const cardJson = buildAdoptSelectCard(candidates.sessions, rootId, loc, candidates.resumable, { selectedKey: nextSelected, searchQuery: nextSearch, page: nextPage }, invokerOpenId ?? operatorOpenId, candidates.resumeLimit, botCfg.cliId, sessionRuntimeDisplayName(ds));
-        // event-dispatcher wraps this as { card: { type: 'raw', data } } → in-place patch.
-        return JSON.parse(cardJson);
-    }
-    // ─── /adopt V2 picker: confirm (dispatch to adopt or resume-import) ─────
-    // Confirm does NOT trust the cached snapshot for liveness — a live pane may
-    // have exited since render. Live targets re-discover (fast-path by tmux
-    // target to stay inside Lark's 3s callback budget); resume targets re-scan
-    // disk. The cached entry only tells us WHICH target the key refers to.
-    if (value?.action === 'adopt_confirm' && larkAppId) {
-        const rootId = value.root_id;
-        const entryKey = value.entry_key;
-        if (!rootId || !entryKey)
-            return;
-        const loc = localeForBot(larkAppId);
-        const sKey = sessionKey(rootId, larkAppId);
-        const ds = activeSessions.get(sKey);
-        if (!ds)
-            return { toast: { type: 'error', content: t('card.adopt.toast_no_session', undefined, loc) } };
-        const sourceSession = ds.session;
-        if (isSessionTransferring(ds)) {
-            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
-        }
-        if (!canOperate(ds.larkAppId, ds.chatId, operatorOpenId)) {
-            return { toast: { type: 'error', content: t('card.adopt.toast_no_perm', undefined, loc) } };
-        }
-        const invokerOpenId = value.invoker_open_id;
-        if (invokerOpenId && operatorOpenId && invokerOpenId !== operatorOpenId) {
-            return { toast: { type: 'error', content: t('card.adopt.toast_not_invoker', undefined, loc) } };
-        }
-        const botCfg = getBot(ds.larkAppId).config;
-        const { clearAdoptCandidates } = await import('../../services/adopt-picker.js');
-        // ── Resume-import path (key = "resume:<cliSessionId>") ──────────────
-        if (entryKey.startsWith('resume:')) {
-            const cliSessionId = entryKey.slice('resume:'.length);
-            const { discoverResumableSessionsForBot, startResumeImportSession, ADOPT_RESUME_LIMIT } = await import('../../core/command-handler.js');
-            const resumable = await discoverResumableSessionsForBot(botCfg.cliId, botCfg.cliPathOverride, activeSessions, ADOPT_RESUME_LIMIT);
-            if (ds.session !== sourceSession || ds.session.status !== 'active'
-                || activeSessions.get(sKey) !== ds || isSessionTransferring(ds)) {
-                return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
-            }
-            const target = resumable.find(r => r.cliSessionId === cliSessionId);
-            if (!target) {
-                await sessionReply(rootId, t('cmd.adopt.resume_not_found', { id: cliSessionId }, localeForBot(ds.larkAppId)));
-                clearAdoptCandidates(rootId);
-                if (cardMessageId && larkAppId)
-                    deleteMessage(larkAppId, cardMessageId);
-                return;
-            }
-            await startResumeImportSession(target, ds, { activeSessions, sessionReply: deps.sessionReply, getActiveCount: () => 0, lastRepoScan }, larkAppId);
-            clearAdoptCandidates(rootId);
-            if (cardMessageId && larkAppId)
-                deleteMessage(larkAppId, cardMessageId);
-            return;
-        }
-        // ── Live-adopt path (key = "live:...") ──────────────────────────────
-        // The cached snapshot only tells us WHICH pane the key referred to; we
-        // re-discover fresh so startAdoptSession gets a live pid (a pane may have
-        // exited since render). adoptLiveKey mirrors the builder's key format so
-        // a freshly-discovered session maps back to the clicked entry_key.
-        const { adoptLiveKey } = await import('./card-builder.js');
-        const { discoverAdoptableSessions, discoverAdoptableSessionByTarget, excludeOwnedHerdrAdoptTargets } = await import('../../core/session-discovery.js');
-        const { discoverAdoptableZellijSessions } = await import('../../core/zellij-adopt-discovery.js');
-        async function resolveLive() {
-            // Zellij keys carry "live:zellij:" — resolve from the zellij backend.
-            if (entryKey.startsWith('live:zellij:')) {
-                return discoverAdoptableZellijSessions(botCfg.cliId, botCfg.cliRuntime?.executable)
-                    .find(s => adoptLiveKey(s) === entryKey);
-            }
-            // Fast path: the key IS "live:<adoptTargetKey>" = "live:tmux:<target>:<pid>".
-            // Parse the tmux target for a cheap single-pane resolve, staying under
-            // Lark's 3s callback budget (a full scan can take seconds on many panes).
-            const inner = entryKey.slice('live:'.length); // e.g. "tmux:0:2.0:12345"
-            const parts = inner.split(':');
-            if (parts[0] === 'tmux' && parts.length >= 3) {
-                const tmuxTarget = parts.slice(1, -1).join(':'); // drop "tmux" + trailing pid
-                const fast = discoverAdoptableSessionByTarget(tmuxTarget, botCfg.cliId, botCfg.cliRuntime?.executable);
-                if (fast && adoptLiveKey(fast) === entryKey)
-                    return fast;
-            }
-            const ownedHerdrTargets = [...activeSessions.values()].flatMap(active => {
-                const t2 = active.session.persistentBackendTarget;
-                return active.session.status === 'active' && !active.adoptedFrom && t2?.backendType === 'herdr' && !!t2.agentName
-                    ? [{ sessionName: t2.sessionName, agentName: t2.agentName }] : [];
-            });
-            return excludeOwnedHerdrAdoptTargets(discoverAdoptableSessions(botCfg.cliId, botCfg.cliRuntime?.executable), ownedHerdrTargets)
-                .find(s => adoptLiveKey(s) === entryKey);
-        }
-        let target = await resolveLive();
-        for (let attempt = 0; !target && attempt < 3; attempt++) {
-            await new Promise(r => setTimeout(r, 150));
-            target = await resolveLive();
-        }
-        if (ds.session !== sourceSession || ds.session.status !== 'active'
-            || activeSessions.get(sKey) !== ds || isSessionTransferring(ds)) {
-            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
-        }
-        if (!target) {
-            await sessionReply(rootId, t('cmd.adopt.target_exited', undefined, localeForBot(ds.larkAppId)));
-            clearAdoptCandidates(rootId);
-            if (cardMessageId && larkAppId)
-                deleteMessage(larkAppId, cardMessageId);
-            return;
-        }
-        const { startAdoptSession } = await import('../../core/command-handler.js');
-        await startAdoptSession(target, ds, { activeSessions, sessionReply: deps.sessionReply, getActiveCount: () => 0, lastRepoScan }, larkAppId);
-        clearAdoptCandidates(rootId);
-        if (cardMessageId && larkAppId)
-            deleteMessage(larkAppId, cardMessageId);
-        return;
-    }
-    if (value?.action) {
-        const { action: actionType, root_id: rootId } = value;
-        const sKey = larkAppId ? sessionKey(rootId, larkAppId) : rootId;
-        const ds = larkAppId
-            ? getSessionByActionValue(activeSessions, rootId, larkAppId, value.session_id, actionType)
-            : activeSessions.get(rootId);
-        const launchLocalCli = (target, locDs) => {
-            const cliId = sessionCliId(target);
-            const mode = localCliOpenMode();
-            const preflight = preflightLocalCliOpen(target, { cliId, mode });
-            if (!preflight.ok) {
-                logger.warn(`[${tag(target)}] Rejected ${actionType} preflight: ${preflight.error}: ${preflight.message}`);
-                if (preflight.error === 'missing_resume_id') {
-                    return { toast: { type: 'warning', content: t('card.action.local_cli_not_ready', undefined, locDs) } };
-                }
-                if (preflight.error === 'unsupported_cli' || preflight.error === 'unsupported_backend' || preflight.error === 'missing_attach_target') {
-                    return { toast: { type: 'warning', content: t('card.action.local_terminal_unsupported', { cliName: sessionCliDisplayName(target) }, locDs) } };
-                }
-                return { toast: { type: 'error', content: t('card.action.local_cli_failed', { reason: preflight.message }, locDs) } };
-            }
-            const reportFailure = (reason) => {
-                if (value.visibility === 'private') {
-                    logger.warn(`[${tag(target)}] ${actionType} failed for private card; suppressing public fallback: ${reason}`);
-                    return;
-                }
-                void sessionReply(rootId, t('card.action.local_cli_failed', { reason }, locDs))
-                    .catch((err) => logger.warn(`[${tag(target)}] ${actionType} failure reply failed: ${err instanceof Error ? err.message : String(err)}`));
-            };
-            void openLocalCliInIterm(target, { cliId, mode })
-                .then((result) => {
-                if (!result.ok) {
-                    logger.warn(`[${tag(target)}] ${actionType} failed: ${result.error}: ${result.message}`);
-                    reportFailure(result.message);
-                    return;
-                }
-                logger.info(`[${tag(target)}] ${actionType} launched local terminal for ${cliId} (${mode})`);
-            })
-                .catch((err) => {
-                const reason = err instanceof Error ? err.message : String(err);
-                logger.warn(`[${tag(target)}] ${actionType} crashed: ${reason}`);
-                reportFailure(reason);
-            });
-            return {
-                toast: {
-                    type: 'success',
-                    content: t('card.action.local_cli_opened', { cliName: sessionCliDisplayName(target) }, locDs),
-                },
-            };
-        };
-        const guardLocalCliOpen = (target, locDs) => {
-            if (!isLocalCliOpenConfigured()) {
-                logger.info(`[${tag(target)}] Rejected ${actionType}: native CLI opening is disabled`);
-                return { toast: { type: 'warning', content: t('card.action.local_cli_disabled', undefined, locDs) } };
-            }
-            if (!isLocalCliOpenCapable()) {
-                logger.info(`[${tag(target)}] Rejected ${actionType}: daemon host cannot open the native CLI`);
-                return {
-                    toast: {
-                        type: 'warning',
-                        content: t('card.action.local_terminal_unsupported', { cliName: sessionCliDisplayName(target) }, locDs),
-                    },
-                };
-            }
-        };
-        if (ds && actionType === 'open_local_cli') {
-            const actualCliId = sessionCliId(ds);
-            const locDs = localeForBot(ds.larkAppId);
-            if (!value?.cli_id) {
-                return { toast: { type: 'error', content: t('card.action.local_cli_missing_cli_id', undefined, locDs) } };
-            }
-            if (value.cli_id !== actualCliId) {
-                logger.warn(`[${tag(ds)}] Rejected open_local_cli from mismatched CLI card: expected=${value.cli_id} actual=${actualCliId}`);
-                return { toast: { type: 'error', content: t('card.action.local_cli_cli_mismatch', undefined, locDs) } };
-            }
-        }
-        else if (ds && !validateCardCliBinding(ds, value))
-            return;
-        if (actionType === 'open_local_cli') {
-            const locDs = localeForBot(ds?.larkAppId ?? larkAppId);
-            if (!ds) {
-                return { toast: { type: 'warning', content: t('card.action.session_gone', undefined, locDs) } };
-            }
-            const blocked = guardLocalCliOpen(ds, locDs);
-            if (blocked)
-                return blocked;
-            return launchLocalCli(ds, locDs);
-        }
-        // 🔊 语音总结 — no permission gate (任意人可点). Inject a condense-and-speak
-        // instruction into the session; the model emits the voice via
-        // `botmux send --voice`. Dedup per card so only one voice is generated.
-        if (actionType === 'voice_summary') {
-            const locDs = localeForBot(ds?.larkAppId ?? larkAppId);
-            if (!ds) {
-                return { toast: { type: 'warning', content: t('card.voice.toast_session_gone', undefined, locDs) } };
-            }
-            // 权限：仅 canTalk / canOperate 用户可点；其他人提示需授权（无声门会让人以为按钮坏了）。
-            // 传 ds.chatType：p2pOpen 的 bot 在私聊里，对方点自己会话的卡片按钮应与其 talk 权一致
-            // （仍不给 canOperate —— 管理类按钮另有 canOperate 闸）。
-            if (!canTalk(ds.larkAppId, ds.chatId, operatorOpenId, undefined, undefined, ds.chatType)
-                && !canOperate(ds.larkAppId, ds.chatId, operatorOpenId)) {
-                logger.info(`[${tag(ds)}] voice_summary blocked for unauthorized user: ${operatorOpenId ?? '?'}`);
-                return { toast: { type: 'warning', content: t('card.voice.toast_need_auth', undefined, locDs) } };
-            }
-            // Dedupe read BEFORE the busy guard: a card whose voice is already being
-            // generated will have its worker back in `working`, so the busy guard would
-            // otherwise shadow the "already on the way" hint with a misleading
-            // "wait for idle" toast. Read first (correct message), guard second, and
-            // only `add` after the guard so a genuinely-busy first click still doesn't
-            // burn the dedupe key.
-            const dedupeKey = cardMessageId ?? `${sessionAnchorId(ds)}::voice`;
-            if (voicedCardIds.has(dedupeKey)) {
-                return { toast: { type: 'info', content: t('card.voice.toast_already', undefined, locDs) } };
-            }
-            if (!isLiveWorkerIdleOrLimited(ds)) {
-                logger.info(`[${tag(ds)}] voice_summary blocked because worker is busy: ${ds.lastScreenStatus ?? 'unknown'}`);
-                return { toast: { type: 'warning', content: t('card.voice.toast_worker_busy', undefined, locDs) } };
-            }
-            voicedCardIds.add(dedupeKey);
-            if (voicedCardIds.size > 5000) {
-                voicedCardIds.clear();
-                voicedCardIds.add(dedupeKey);
-            }
-            const instruction = voiceSummaryInstruction(locDs);
-            const voiceInput = {
-                content: instruction,
-                codexAppInput: withCodexAppContext({ text: t('card.voice.user_message', undefined, locDs) }, 'botmux_voice_summary_instruction', instruction, 'application'),
-            };
-            if (ds.worker && !ds.worker.killed)
-                sendWorkerInput(ds, voiceInput);
-            else
-                forkWorker(ds, voiceInput, ds.hasHistory);
-            logger.info(`[${tag(ds)}] voice_summary triggered by ${operatorOpenId ?? '?'}`);
-            return { toast: { type: 'success', content: t('card.voice.toast_wait', undefined, locDs) } };
-        }
-        if (actionType === 'restart' && ds) {
-            // Adopt sessions: hard-reject. botmux never owned the user's CLI;
-            // restarting would mean killing their tmux pane / Claude process,
-            // which violates the bridge invariant. Defense in depth — buildSessionCard
-            // already omits the restart button when adoptMode=true, but a stale
-            // pre-fix card or a malformed action payload could still arrive.
-            const locDs = localeForBot(ds.larkAppId);
-            if (ds.adoptedFrom) {
-                logger.warn(`[${tag(ds)}] Rejected restart on adopt session — would kill user's pane`);
-                await sessionReply(rootId, t('card.action.adopt_no_restart', undefined, locDs));
-                return;
-            }
-            if (isSessionTransferring(ds)) {
-                return {
-                    toast: {
-                        type: 'warning',
-                        content: t('cmd.session.transfer_in_progress', undefined, locDs),
-                    },
-                };
-            }
-            const effectiveCliId = sessionCliId(ds);
-            const cliName = sessionCliDisplayName(ds);
-            logger.info(`[${tag(ds)}] Correlated restart via card button`);
-            requestSessionRestart(ds, {
-                source: 'card',
-                notify: status => {
-                    const content = t(`cmd.restart.${status}`, { cliName }, locDs);
-                    return deliverEphemeralOrReply(ds, operatorOpenId, content, 'text', () => sessionReply(rootId, content));
-                },
-            });
-        }
-        if (actionType === 'close') {
-            if (!ds) {
-                // 会话已不在 activeSessions（已关过 / 卡片过期 / daemon 重启丢失）——点「关闭
-                // 会话」却静默无反应会让人以为按钮坏了，给一条失败 toast（成功路径不弹，已关卡即反馈）。
-                return { toast: { type: 'warning', content: t('card.action.session_gone', undefined, localeForBot(larkAppId)) } };
-            }
-            const botCfg = getBot(ds.larkAppId).config;
-            // Build the closed card BEFORE killWorker/closeSession — it reads the
-            // live session's identity off `ds`.
-            const card = buildClosedSessionCard(ds, localeForBot(ds.larkAppId));
-            try {
-                await closeSession(ds.session.sessionId);
-            }
-            catch (err) {
-                logger.error(`[${tag(ds)}] Refused close because backing teardown was not verified: ${err}`);
-                return {
-                    toast: {
-                        type: 'warning',
-                        content: `会话关闭失败：${err instanceof Error ? err.message : String(err)}`,
-                    },
-                };
-            }
-            // closeSession removes the captured ds before awaiting best-effort remote
-            // cleanup. A new session may claim the same route during that await; only
-            // delete here if this handler still owns the exact object it closed.
-            if (activeSessions.get(sKey) === ds)
-                activeSessions.delete(sKey);
-            // The closed card carries session title / CLI name / workingDir / resume
-            // command. In private-card mode those must not leak to the group — send the
-            // closed card ephemeral to the same owner audience instead. No group
-            // fallback on failure (privacy wins; the session is already closed).
-            // `value.visibility === 'private'` pins the decision to the card that was
-            // clicked, so a card built in private mode stays ephemeral even if the
-            // bot's `privateCard` config was turned off in the meantime.
-            if (value?.visibility === 'private' || botCfg.privateCard) {
-                const audience = resolvePrivateCardAudience(ds);
-                for (const openId of audience) {
-                    await sendEphemeralCard(ds.larkAppId, ds.chatId, openId, card).catch(err => logger.warn(`[${tag(ds)}] private close card ephemeral send to ${openId.substring(0, 8)}… failed: ${err}`));
-                }
-                logger.info(`[${tag(ds)}] Closed via card button (private close card → ${audience.length} owner(s))`);
-            }
-            else {
-                await deliverEphemeralOrReply(ds, operatorOpenId, card, 'interactive', () => sessionReply(rootId, card, 'interactive'));
-                logger.info(`[${tag(ds)}] Closed via card button`);
-            }
-        }
-        if (actionType === 'resume') {
-            const targetSessionId = value?.session_id;
-            const locDsResume = localeForBot(ds?.larkAppId ?? larkAppId);
-            if (!targetSessionId) {
-                await sessionReply(rootId, t('card.action.resume_missing_session_id', undefined, locDsResume));
-            }
-            else {
-                const result = await resumeSession(targetSessionId, activeSessions);
-                if (result.ok) {
-                    const cliName = sessionCliDisplayName(result.ds);
-                    const resumeMsg = t('card.action.resume_success', { cliName }, localeForBot(result.ds.larkAppId));
-                    await deliverEphemeralOrReply(result.ds, operatorOpenId, resumeMsg, 'text', () => sessionReply(rootId, resumeMsg));
-                    logger.info(`[${targetSessionId.substring(0, 8)}] Resumed via card button`);
-                }
-                else if (result.error === 'not_found') {
-                    await sessionReply(rootId, t('card.action.resume_not_found', { short: targetSessionId.substring(0, 8) }, locDsResume));
-                }
-                else if (result.error === 'not_closed') {
-                    await sessionReply(rootId, t('card.action.resume_not_closed', undefined, locDsResume));
-                }
-                else if (result.error === 'anchor_occupied') {
-                    const detail = result.activeSessionId
-                        ? t('card.action.resume_anchor_holder', { short: result.activeSessionId.substring(0, 8) }, locDsResume)
-                        : '';
-                    await sessionReply(rootId, t('card.action.resume_anchor_occupied', { detail }, locDsResume));
-                }
-                else if (result.error === 'adopt_unsupported') {
-                    await sessionReply(rootId, t('card.action.resume_adopt_unsupported', undefined, locDsResume));
-                }
-                else if (result.error === 'deferred_unmaterialized') {
-                    await sessionReply(rootId, t('card.action.resume_deferred_unmaterialized', undefined, locDsResume));
-                }
-                else if (result.error === 'resume_cancelled') {
-                    await sessionReply(rootId, t('card.action.resume_cancelled', undefined, locDsResume));
-                }
-            }
-        }
-        if (actionType === 'disconnect' && ds) {
-            killWorker(ds);
-            sessionStore.closeSession(ds.session.sessionId);
-            publishClosedSessionPatch(ds.session.sessionId, ds.session.closedAt ? Date.parse(ds.session.closedAt) : undefined);
-            activeSessions.delete(sKey);
-            await sessionReply(rootId, t('card.action.disconnected', undefined, localeForBot(ds.larkAppId)));
-            logger.info(`[${tag(ds)}] Disconnected (adopt) via card button`);
-        }
-        if (actionType === 'takeover' && ds && ds.adoptedFrom) {
-            await sessionReply(rootId, t('card.action.takeover_retired', undefined, localeForBot(ds.larkAppId)));
-            logger.info(`[${tag(ds)}] Legacy takeover action ignored (bridge era; historical card)`);
-        }
-        if (actionType === 'retry_last_task' && ds) {
-            const locDs = localeForBot(ds.larkAppId);
-            const cliInput = ds.lastCliInput;
-            if (!cliInput) {
-                await sessionReply(rootId, t('card.action.retry_last_task_missing', undefined, locDs));
-                return;
-            }
-            if (!ds.usageLimit) {
-                await sessionReply(rootId, t('card.action.retry_last_task_unavailable', undefined, locDs));
-                return;
-            }
-            if (!ds.usageLimit.retryReady && ds.usageLimit.retryAtMs > Date.now()) {
-                await sessionReply(rootId, t('card.action.retry_last_task_not_ready', { retryLabel: ds.usageLimit.retryLabel }, locDs));
-                return;
-            }
-            clearUsageLimitState(ds);
-            ds.lastScreenStatus = 'working';
-            ds.streamCardPending = true;
-            ds.currentTurnTitle = (ds.lastUserPrompt || ds.currentTurnTitle || ds.session.title || getCliDisplayName(sessionCliId(ds))).substring(0, 50);
-            ds.currentImageKey = undefined;
-            persistStreamCardState(ds);
-            let cardJson;
-            if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL && workerHasInitialized(ds)) {
-                const readUrl = readableTerminalUrlFor(ds);
-                cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, ds.currentTurnTitle, '', 'working', sessionCliId(ds), ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, locDs, undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: sessionCliId(ds) }), getDaemonStreamingCardUsageSnapshot(ds, sessionCliId(ds)), sessionRuntimeDisplayName(ds), codexServiceTierBadge(sessionCliId(ds), ds.codexServiceTier));
-                scheduleCardPatch(ds, cardJson);
-            }
-            const retryCodexAppInput = ds.lastCodexAppInput
-                ? (({ clientUserMessageId: _priorMessageId, ...input }) => input)(ds.lastCodexAppInput)
-                : undefined;
-            const retryInput = {
-                content: cliInput,
-                ...(retryCodexAppInput ? { codexAppInput: retryCodexAppInput } : {}),
-            };
-            if (ds.worker && !ds.worker.killed)
-                sendWorkerInput(ds, retryInput);
-            else
-                forkWorker(ds, retryInput, ds.hasHistory);
-            logger.info(`[${tag(ds)}] Retrying last task after usage limit`);
-            if (cardJson) {
-                try {
-                    return JSON.parse(cardJson);
-                }
-                catch { /* fall through */ }
-            }
-            return;
-        }
-        if (actionType === 'tui_keys' && ds) {
-            if (isSessionTransferring(ds)) {
-                return {
-                    toast: {
-                        type: 'warning',
-                        content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)),
-                    },
-                };
-            }
-            // Fail-closed: only act on a currently-active card (either the
-            // ScreenAnalyzer TUI prompt card or our stuck-warning card). A stale
-            // click from a resolved/replaced card must NOT send any IPC to the
-            // worker — the CLI may have moved on or recovered. PATCH is UI only,
-            // not an authorization check.
-            const isActiveTuiCard = !!ds.tuiPromptCardId && cardMessageId === ds.tuiPromptCardId;
-            const isActiveStuckCard = !!ds.stuckWarningCardId && cardMessageId === ds.stuckWarningCardId;
-            if (!isActiveTuiCard && !isActiveStuckCard) {
-                logger.info(`[${tag(ds)}] tui_keys from stale card ${cardMessageId} — ignored (active tui=${ds.tuiPromptCardId ?? 'none'} stuck=${ds.stuckWarningCardId ?? 'none'})`);
-                return;
-            }
-            let keys = [];
-            try {
-                keys = JSON.parse(value?.keys ?? '[]');
-            }
-            catch { /* bad json */ }
-            const isFinal = value?.is_final === '1';
-            const optionType = value?.option_type ?? 'select';
-            const selectedIndex = Number(value?.selected_index ?? 0);
-            const selectedText = value?.selected_text ?? `Option ${selectedIndex + 1}`;
-            if (isActiveTuiCard && ds.tuiPromptProcessing) {
-                logger.info(`[${tag(ds)}] Duplicate TUI prompt card click — dropped (processing already in flight)`);
-                return;
-            }
-            if (optionType === 'toggle') {
-                // Only a ScreenAnalyzer TUI card may own toggle state. A stuck-warning
-                // card must never read or mutate the other card's global selections.
-                if (!isActiveTuiCard) {
-                    logger.info(`[${tag(ds)}] Ignored toggle from non-TUI card ${cardMessageId}`);
-                    return;
-                }
-                // Toggle: only update card UI, do NOT send keys to terminal yet.
-                // Keys will be sent in batch when confirm is clicked.
-                if (!ds.tuiToggledIndices)
-                    ds.tuiToggledIndices = [];
-                const idx = ds.tuiToggledIndices.indexOf(selectedIndex);
-                if (idx >= 0)
-                    ds.tuiToggledIndices.splice(idx, 1);
-                else
-                    ds.tuiToggledIndices.push(selectedIndex);
-                logger.info(`[${tag(ds)}] TUI toggle (card only): option ${selectedIndex}, toggled: [${ds.tuiToggledIndices}]`);
-                // PATCH card to update ☐/☑ state
-                if (cardMessageId && ds.tuiPromptOptions) {
-                    const locDs = localeForBot(ds.larkAppId);
-                    const updatedCard = buildTuiPromptCard(sessionAnchorId(ds), ds.session.sessionId, ds.currentTurnTitle || t('card.action.tui_select_title', undefined, locDs), ds.tuiPromptOptions, true, ds.tuiToggledIndices, locDs);
-                    updateMessage(ds.larkAppId, cardMessageId, updatedCard).catch(err => logger.debug(`[${tag(ds)}] Failed to update TUI toggle card: ${err}`));
-                    try {
-                        return JSON.parse(updatedCard);
-                    }
-                    catch { /* fall through */ }
-                }
-                return;
-            }
-            // For a normal TUI confirm: batch all toggled options' keys first.
-            // For a stuck-warning card: derive the single allowed key from the
-            // page type + selected index — NEVER trust value.keys from the card,
-            // which could be tampered to inject arbitrary keys. The allowlist is
-            // exactly the documented controls for each Codex hook-review screen.
-            if (ds.worker) {
-                let allKeys = [];
-                let isFinalStuck = false;
-                let dispatchedKeys = false;
-                if (isActiveTuiCard && ds.tuiToggledIndices?.length && ds.tuiPromptOptions) {
-                    // Send each toggled option's keys in sequence
-                    for (const ti of ds.tuiToggledIndices.sort((a, b) => a - b)) {
-                        const opt = ds.tuiPromptOptions[ti];
-                        if (opt?.keys?.length) {
-                            allKeys.push(...opt.keys);
-                        }
-                    }
-                    // Then the action's own keys (confirm/select)
-                    allKeys.push(...keys);
-                }
-                else if (isActiveStuckCard) {
-                    // P1-4: do NOT trust the callback's selected_index. Require it to be
-                    // present and a safe integer, then range-check against the page type's
-                    // option count. A missing/malformed index must NOT default to 0 (trust),
-                    // which is the highest-risk action.
-                    const rawIdx = value?.selected_index;
-                    if (rawIdx === undefined || rawIdx === null || rawIdx === '') {
-                        logger.info(`[${tag(ds)}] Stuck-warning card click missing selected_index — dropped`);
-                        return;
-                    }
-                    const idx = Number(rawIdx);
-                    if (!Number.isSafeInteger(idx)) {
-                        logger.info(`[${tag(ds)}] Stuck-warning card click with non-integer selected_index=${rawIdx} — dropped`);
-                        return;
-                    }
-                    // Allowlist: map (pageType, idx) → the one safe key.
-                    // Level 1: 0=t, 1=Enter, 2=Esc ; Level 2: 0=t, 1=Esc
-                    const pt = ds.stuckWarningPageType;
-                    const allowlist = pt === 'hook review level 1'
-                        ? ['t', 'Enter', 'Escape']
-                        : pt === 'hook review level 2'
-                            ? ['t', 'Escape']
-                            : null;
-                    if (!allowlist || idx < 0 || idx >= allowlist.length) {
-                        logger.info(`[${tag(ds)}] Stuck-warning card click with out-of-range index ${idx} for pageType=${pt ?? 'none'} — dropped`);
-                        return;
-                    }
-                    allKeys = [allowlist[idx]];
-                    // Stuck-card actions are always final (they resolve the current
-                    // hook-review screen). Define this server-side — do NOT trust
-                    // value.is_final from the callback.
-                    isFinalStuck = true;
-                }
-                else {
-                    // Non-stuck, non-TUI card (shouldn't happen given the active-card
-                    // guard above, but fail-closed).
-                    allKeys.push(...keys);
-                }
-                if (allKeys.length > 0) {
-                    const effectiveFinal = isFinal || isFinalStuck;
-                    // Atomic processing claim: if a previous click is already in flight
-                    // (waiting for tui_keys_delivered / stuck_warning_expired ACK), drop
-                    // this duplicate. Without this, two rapid clicks could both pass the
-                    // fresh-capture guard and inject keys twice.
-                    if (isActiveStuckCard) {
-                        if (ds.stuckWarningProcessing) {
-                            logger.info(`[${tag(ds)}] Duplicate stuck-warning card click — dropped (processing already in flight)`);
-                            return;
-                        }
-                        ds.stuckWarningProcessing = true;
-                    }
-                    if (isActiveTuiCard && effectiveFinal) {
-                        ds.tuiPromptProcessing = true;
-                    }
-                    // Only the stuck-warning card's Enter action re-arms the detector
-                    // (Enter advances from the hook list to a per-hook review). Match by
-                    // the actual keys sent — NOT by optionType, since t is typed 'confirm'
-                    // in the card definition. t/Esc and all ScreenAnalyzer cards never
-                    // set this flag. Also require the source card to be our own.
-                    const isStuckWarningEnter = isActiveStuckCard
-                        && allKeys.length === 1
-                        && allKeys[0] === 'Enter';
-                    // If this click is from a stuck-warning card, forward the nonce,
-                    // cliLifetime, and page type so the worker can re-verify the current
-                    // screen still matches before injecting keys. A stale click (CLI
-                    // recovered) will be dropped at the worker boundary.
-                    const stuckNonce = isActiveStuckCard ? ds.stuckWarningNonce : undefined;
-                    const stuckCliLifetime = isActiveStuckCard ? ds.stuckWarningCliLifetime : undefined;
-                    const stuckPage = isActiveStuckCard ? ds.stuckWarningPageType : undefined;
-                    const resolveText = isActiveTuiCard && ds.tuiToggledIndices?.length
-                        ? ds.tuiToggledIndices.map(i => ds.tuiPromptOptions?.[i]?.text).filter(Boolean).join(', ')
-                        : selectedText;
-                    try {
-                        await sendWorkerIpc(ds.worker, {
-                            type: 'tui_keys',
-                            keys: allKeys,
-                            isFinal: effectiveFinal,
-                            rearmStuckDetector: isStuckWarningEnter,
-                            stuckNonce,
-                            stuckCliLifetime,
-                            stuckPageType: stuckPage,
-                            cardMessageId: isActiveTuiCard ? cardMessageId : undefined,
-                            selectedText: resolveText || selectedText,
-                        });
-                        dispatchedKeys = true;
-                    }
-                    catch (err) {
-                        if (isActiveStuckCard)
-                            ds.stuckWarningProcessing = false;
-                        if (isActiveTuiCard && effectiveFinal)
-                            ds.tuiPromptProcessing = false;
-                        logger.warn(`[${tag(ds)}] TUI key IPC delivery failed: ${err instanceof Error ? err.message : String(err)}`);
-                        return {
-                            toast: {
-                                type: 'warning',
-                                content: t('card.action.tui_ipc_failed', undefined, localeForBot(ds.larkAppId)),
-                            },
-                        };
-                    }
-                    logger.info(`[${tag(ds)}] TUI keys: [${allKeys.join(',')}] final=${effectiveFinal} rearmStuck=${isStuckWarningEnter} stuckNonce=${stuckNonce ?? 'none'} — "${selectedText}"`);
-                }
-                if ((isFinal || isFinalStuck) && dispatchedKeys) {
-                    const resolveText = isActiveTuiCard && ds.tuiToggledIndices?.length
-                        ? ds.tuiToggledIndices.map(i => ds.tuiPromptOptions?.[i]?.text).filter(Boolean).join(', ')
-                        : selectedText;
-                    const finalText = resolveText || selectedText;
-                    const locDs = localeForBot(ds.larkAppId);
-                    // For a stuck-warning card, do NOT clear authority or render success
-                    // here. The worker may still reject the keys (stale screen). We show a
-                    // "processing" state to block duplicate clicks, and wait for the
-                    // worker's tui_keys_delivered (success), stuck_warning_expired
-                    // ("page changed, not sent"), or tui_prompt_submit_failed ACK before
-                    // resolving the card.
-                    if (isActiveStuckCard) {
-                        if (cardMessageId) {
-                            const processingCard = buildTuiPromptProcessingCard('处理中…', locDs);
-                            updateMessage(ds.larkAppId, cardMessageId, processingCard).catch(err => logger.debug(`[${tag(ds)}] Failed to set stuck-warning card to processing: ${err}`));
-                        }
-                        publishAttentionPatch(ds);
-                        try {
-                            return JSON.parse(buildTuiPromptProcessingCard('处理中…', locDs));
-                        }
-                        catch { /* fall through */ }
-                    }
-                    // Normal TUI prompt cards also remain in processing until the worker
-                    // confirms backend delivery via tui_prompt_resolved. A worker/backend
-                    // rejection produces tui_prompt_submit_failed instead.
-                    publishAttentionPatch(ds);
-                    try {
-                        return JSON.parse(buildTuiPromptProcessingCard(finalText, locDs));
-                    }
-                    catch { /* fall through */ }
-                }
-            }
-        }
-        if (actionType === 'tui_text_input' && ds) {
-            if (isSessionTransferring(ds)) {
-                return {
-                    toast: {
-                        type: 'warning',
-                        content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)),
-                    },
-                };
-            }
-            const inputTextRaw = action?.form_value?.tui_custom_input;
-            const inputText = typeof inputTextRaw === 'string' ? inputTextRaw : '';
-            let inputKeys = [];
-            try {
-                inputKeys = JSON.parse(value?.input_keys ?? '[]');
-            }
-            catch { /* bad json */ }
-            const locDs = localeForBot(ds.larkAppId);
-            const isActiveTuiCard = !!ds.tuiPromptCardId && cardMessageId === ds.tuiPromptCardId;
-            if (!isActiveTuiCard) {
-                logger.info(`[${tag(ds)}] tui_text_input from stale card ${cardMessageId} — ignored`);
-                return;
-            }
-            if (ds.tuiPromptProcessing) {
-                logger.info(`[${tag(ds)}] Duplicate TUI text input — dropped (processing already in flight)`);
-                return;
-            }
-            if (!ds.worker || !inputText || inputKeys.length === 0) {
-                logger.info(`[${tag(ds)}] TUI text input not dispatched ` +
-                    `(worker=${!!ds.worker}, text=${!!inputText}, keys=${inputKeys.length})`);
-                return {
-                    toast: {
-                        type: 'warning',
-                        content: t('card.action.tui_ipc_failed', undefined, locDs),
-                    },
-                };
-            }
-            // Atomic IPC — worker handles keys + text in one flow to avoid race
-            ds.tuiPromptProcessing = true;
-            try {
-                await sendWorkerIpc(ds.worker, {
-                    type: 'tui_text_input',
-                    keys: inputKeys,
-                    text: inputText,
-                    cardMessageId,
-                });
-            }
-            catch (err) {
-                ds.tuiPromptProcessing = false;
-                logger.warn(`[${tag(ds)}] TUI text IPC delivery failed: ${err instanceof Error ? err.message : String(err)}`);
-                return {
-                    toast: {
-                        type: 'warning',
-                        content: t('card.action.tui_ipc_failed', undefined, locDs),
-                    },
-                };
-            }
-            logger.info(`[${tag(ds)}] TUI text input: "${inputText}" (keys: ${JSON.stringify(inputKeys)})`);
-            publishAttentionPatch(ds);
-            try {
-                return JSON.parse(buildTuiPromptProcessingCard(inputText, locDs));
-            }
-            catch { /* fall through */ }
-        }
-        // Compatibility path for cards emitted before open_local_cli was introduced.
-        // The opt-in/capability guard still applies so old cards cannot bypass the
-        // default-off continuity protection. Clicks read the current mode: attach
-        // mode uses exact backend attach with no fallback; resume mode uses the same
-        // precise resume preflight and also fails closed when unsupported.
-        if (actionType === 'open_local_terminal') {
-            const locDs = localeForBot(ds?.larkAppId ?? larkAppId);
-            if (!ds) {
-                return { toast: { type: 'warning', content: t('card.action.session_gone', undefined, locDs) } };
-            }
-            const blocked = guardLocalCliOpen(ds, locDs);
-            if (blocked)
-                return blocked;
-            return launchLocalCli(ds, locDs);
-        }
-        if (actionType === 'get_write_link' && ds && operatorOpenId) {
-            const effectiveCliId = sessionCliId(ds);
-            const locDs = localeForBot(ds.larkAppId);
-            if (!sessionSupportsWebTerminal(ds)) {
-                // Old cards can retain a get_write_link callback and stale port/token
-                // fields after the session is restored onto ZMX. This is a permanent
-                // backend capability boundary, not a transient startup delay.
-                const unsupportedCard = JSON.stringify({
-                    config: { wide_screen_mode: true },
-                    elements: [{ tag: 'markdown', content: t('card.action.terminal_unsupported', undefined, locDs) }],
-                });
-                await deliverEphemeralOrReply(ds, operatorOpenId, unsupportedCard, 'interactive', () => sessionReply(rootId, unsupportedCard, 'interactive'));
-                return;
-            }
-            if (sessionSupportsWebTerminal(ds) && (ds.riffAccessUrl || (ds.workerPort && ds.workerToken))) {
-                const writeUrl = buildTerminalUrl(ds, { write: true });
-                const cardJson = buildSessionCard(ds.session.sessionId, sessionAnchorId(ds), writeUrl, ds.session.title || getCliDisplayName(effectiveCliId), effectiveCliId, true, // showManageButtons — write-link card includes restart & close
-                !!ds.adoptedFrom, // adoptMode — disconnect, never close-the-CLI
-                locDs, isLocalCliOpenReady(ds, { cliId: effectiveCliId }), sessionRuntimeDisplayName(ds));
-                // 普通群发「仅自己可见」私密卡，话题群 / 单聊自动回退私聊 DM（两条通道都私密，
-                // 不泄露写入 token）。fire-and-forget，保持卡片回调快速返回。
-                void deliverWriteLinkCard(ds, operatorOpenId, cardJson);
-                // 乐观回执：投递是异步的（话题群要先 ephemeral 失败再 DM，两次往返 await 容易
-                // 超过 2500ms 的 ACK 窗口而被丢弃），点完立即弹 toast，让用户知道链接已私密发出。
-                return { toast: { type: 'success', content: t('card.action.write_link_sent', undefined, locDs) } };
-            }
-            else {
-                // 普通群发「仅自己可见」私密卡；话题群 / 单聊不支持 ephemeral，回退为同样内容的
-                // 卡片回复（而非纯文本），三种场景都渲染成卡片，行为不变。
-                const notReadyCard = JSON.stringify({
-                    config: { wide_screen_mode: true },
-                    elements: [{ tag: 'markdown', content: t('card.action.terminal_not_ready', undefined, locDs) }],
-                });
-                await deliverEphemeralOrReply(ds, operatorOpenId, notReadyCard, 'interactive', () => sessionReply(rootId, notReadyCard, 'interactive'));
-            }
-        }
-        // Display toggle: hidden ↔ screenshot. 'toggle_stream' is the legacy alias
-        // from pre-screenshot cards and is mapped to toggle_display semantics.
-        if (actionType === 'toggle_display' || actionType === 'toggle_stream') {
-            if (!ds) {
-                // 同 close：会话已不在线时「显示 / 隐藏输出」静默无反应 → 给失败 toast（成功不弹）。
-                return { toast: { type: 'warning', content: t('card.action.session_gone', undefined, localeForBot(larkAppId)) } };
-            }
-            const clickedNonce = value?.card_nonce;
-            const isFrozenClick = clickedNonce && ds.streamCardNonce && clickedNonce !== ds.streamCardNonce;
-            const nextMode = (current) => current === 'hidden' ? 'screenshot' : 'hidden';
-            if (isFrozenClick) {
-                // Historical card — toggle using cached state
-                if (!ds.frozenCards)
-                    ds.frozenCards = loadFrozenCards(ds.session.sessionId);
-                const frozen = ds.frozenCards.get(clickedNonce);
-                if (!frozen) {
-                    // The clicked card can predate the frozen-card cache for the current
-                    // active session (e.g. a stale Worker card whose session_id/card_nonce
-                    // came from a now-closed session). Migrate the visible card to the
-                    // current root session/CLI instead of leaving stale terminal URL/chrome.
-                    const effectiveCliId = sessionCliId(ds);
-                    const cur = ds.displayMode ?? 'hidden';
-                    const next = nextMode(cur);
-                    ds.displayMode = next;
-                    persistStreamCardState(ds);
-                    if (ds.worker || isSessionTransferring(ds)) {
-                        sendWorkerSessionInput(ds, { type: 'set_display_mode', mode: next });
-                    }
-                    if (cardMessageId && workerHasInitialized(ds)) {
-                        const readUrl = readableTerminalUrlFor(ds);
-                        const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                        const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, next, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
-                        updateMessage(ds.larkAppId, cardMessageId, cardJson).catch(err => logger.debug(`[${tag(ds)}] Failed to migrate unknown frozen card: ${err}`));
-                        logger.info(`[${tag(ds)}] Migrated unknown frozen card to ${next} (legacy nonce=${clickedNonce})`);
-                        try {
-                            return JSON.parse(cardJson);
-                        }
-                        catch { /* fall through */ }
-                    }
-                    logger.debug(`[${tag(ds)}] Toggle on unknown frozen card could not migrate: nonce=${clickedNonce}`);
-                    return;
-                }
-                // Self-heal known historical cards by migrating the clicked card to the
-                // current live session/CLI instead of rebuilding from cached frozen
-                // title/content/imageKey. The cache may have been persisted while this
-                // thread was bound to a different CLI (or before cli_id existed), and
-                // reusing its imageKey is exactly what makes a second click snap back to
-                // an old Claude Code screenshot.
-                const cur = ds.displayMode ?? frozenDisplayMode(frozen);
-                const next = nextMode(cur);
-                ds.displayMode = next;
-                persistStreamCardState(ds);
-                if (ds.worker || isSessionTransferring(ds)) {
-                    sendWorkerSessionInput(ds, { type: 'set_display_mode', mode: next });
-                }
-                const effectiveCliId = sessionCliId(ds);
-                const readUrl = readableTerminalUrlFor(ds);
-                const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, next, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds), effectiveCliId === 'codex' ? frozen.codexServiceTierBadge : undefined);
-                updateMessage(ds.larkAppId, frozen.messageId, cardJson).catch(err => logger.debug(`[${tag(ds)}] Failed to migrate frozen card: ${err}`));
-                ds.frozenCards.delete(clickedNonce);
-                saveFrozenCards(ds.session.sessionId, ds.frozenCards);
-                logger.info(`[${tag(ds)}] Migrated frozen card to current ${next} (legacy nonce=${clickedNonce})`);
-                try {
-                    return JSON.parse(cardJson);
-                }
-                catch { /* fall through */ }
-                return;
-            }
-            // Current (latest) card — change displayMode + tell worker
-            const botCfg = getBot(ds.larkAppId).config;
-            const effectiveCliId = sessionCliId(ds);
-            const cur = ds.displayMode ?? 'hidden';
-            const next = nextMode(cur);
-            ds.displayMode = next;
-            persistStreamCardState(ds);
-            if (ds.worker || isSessionTransferring(ds)) {
-                sendWorkerSessionInput(ds, { type: 'set_display_mode', mode: next });
-            }
-            if (ds.streamCardId && workerHasInitialized(ds)) {
-                const readUrl = readableTerminalUrlFor(ds);
-                const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, next, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
-                if (cardMessageId && cardMessageId !== ds.streamCardId) {
-                    updateMessage(ds.larkAppId, cardMessageId, cardJson).catch(err => logger.debug(`[${tag(ds)}] Failed to migrate clicked legacy card: ${err}`));
-                }
-                else {
-                    scheduleCardPatch(ds, cardJson);
-                }
-                logger.info(`[${tag(ds)}] Display mode → ${next}`);
-                try {
-                    return JSON.parse(cardJson);
-                }
-                catch { /* fall through */ }
-            }
-            logger.info(`[${tag(ds)}] Display mode → ${next}`);
-            return;
-        }
-        // Export current terminal text as a thread reply. One-shot action — the
-        // card body itself stays in screenshot mode. For frozen cards, export
-        // from the cached frozen content; for the live card, use ds.lastScreenContent.
-        if (actionType === 'export_text' && ds) {
-            const clickedNonce = value?.card_nonce;
-            const isFrozenClick = clickedNonce && ds.streamCardNonce && clickedNonce !== ds.streamCardNonce;
-            let content = '';
-            if (isFrozenClick) {
-                if (!ds.frozenCards)
-                    ds.frozenCards = loadFrozenCards(ds.session.sessionId);
-                content = ds.frozenCards.get(clickedNonce)?.content ?? '';
-            }
-            else {
-                content = ds.lastScreenContent ?? '';
-            }
-            const locDs = localeForBot(ds.larkAppId);
-            const body = content.trim() ? truncateContent(content, locDs) : t('card.action.no_output', undefined, locDs);
-            await sessionReply(sessionAnchorId(ds), body);
-            logger.info(`[${tag(ds)}] Exported terminal text (${body.length} chars)`);
-            return;
-        }
-        // Manual screenshot refresh — force immediate capture bypassing 10s interval + hash dedup.
-        if (actionType === 'refresh_screenshot' && ds) {
-            if (ds.worker || isSessionTransferring(ds)) {
-                sendWorkerSessionInput(ds, { type: 'refresh_screen' });
-                logger.info(`[${tag(ds)}] Manual screenshot refresh`);
-            }
-            // Return the current card JSON so Feishu doesn't revert the displayed
-            // image to the originally-POSTed initial frame while waiting for the
-            // fresh screenshot PATCH (~1s).
-            if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL && workerHasInitialized(ds)) {
-                const botCfg = getBot(ds.larkAppId).config;
-                const effectiveCliId = sessionCliId(ds);
-                const readUrl = readableTerminalUrlFor(ds);
-                const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, ds.displayMode ?? 'screenshot', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
-                if (cardMessageId && cardMessageId !== ds.streamCardId) {
-                    updateMessage(ds.larkAppId, cardMessageId, cardJson).catch(err => logger.debug(`[${tag(ds)}] Failed to migrate clicked legacy card: ${err}`));
-                }
-                try {
-                    return JSON.parse(cardJson);
-                }
-                catch { /* fall through */ }
-            }
-            return;
-        }
-        // Quick-action keys (Esc, ^C, Tab, Space, Enter, ←↑↓→, ½ page) — forward to worker.
-        if (actionType === 'term_action' && ds) {
-            if (isSessionTransferring(ds)) {
-                return {
-                    toast: {
-                        type: 'warning',
-                        content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)),
-                    },
-                };
-            }
-            const key = value?.key;
-            if (!key)
-                return;
-            if (ds.worker) {
-                sendWorkerSessionInput(ds, { type: 'term_action', key });
-                logger.info(`[${tag(ds)}] term_action: ${key}`);
-            }
-            if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL && workerHasInitialized(ds)) {
-                const botCfg = getBot(ds.larkAppId).config;
-                const effectiveCliId = sessionCliId(ds);
-                const readUrl = readableTerminalUrlFor(ds);
-                const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, ds.displayMode ?? 'screenshot', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
-                try {
-                    return JSON.parse(cardJson);
-                }
-                catch { /* fall through */ }
-            }
-            return;
-        }
-        if (actionType === 'skip_repo' && ds) {
-            const locDs = localeForBot(ds.larkAppId);
-            // Only the live posted card may act — covers consumed, wrong card, and
-            // post-restart (repoCardMessageId is in-memory and empty after reboot).
-            if (cardMessageId && !isActiveRepoCard(ds, cardMessageId)) {
-                return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, locDs) } };
-            }
-            if (ds.pendingRepo) {
-                if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
-                    return { toast: { type: 'info', content: t('cmd.repo.worktree_in_progress', undefined, locDs) } };
-                }
-                const cwd = getSessionWorkingDir(ds);
-                // Reuse the same claimed pending->worker transition as a normal repo
-                // selection. This keeps buffering active across prompt preparation and
-                // makes skip/select races single-winner. Do NOT pin the resolved default
-                // cwd (often $HOME) onto session.workingDir — that would let sibling
-                // bots inherit HOME instead of getting their own repo card. Confirmation
-                // + card withdraw run under the claim inside commitRepoSelection.
-                await commitRepoSelection({ ds, rootId, cardMessageId, larkAppId, operatorOpenId, activeSessions, sessionReply }, cwd, pathBasename(cwd) || cwd, {
-                    suppressConfirmReply: true,
-                    confirmReplyText: t('cmd.skip.opened', { cwd }, locDs),
-                    pinWorkingDir: false,
-                });
-                if (!ds.pendingRepo) {
-                    logger.info(`[${tag(ds)}] Skip repo, spawning CLI in ${cwd}`);
-                }
-            }
-            else {
-                await sessionReply(rootId, t('card.action.continue_using_current_repo', { cwd: getSessionWorkingDir(ds) }, locDs));
-                deferRepoCardWithdraw(larkAppId, cardMessageId);
-                ds.repoCardMessageId = undefined;
-            }
-        }
-        // Manual working-directory entry from the repo card form. The project scan
-        // may not surface every useful directory; this mirrors `/repo <path>` from
-        // the card. Permission is gated at the top (isSensitive + pendingRepoOwner
-        // exception), same as skip_repo. Always a plain commit — worktree creation
-        // needs a scanned git repo root, not an arbitrary path.
-        if (actionType === 'repo_manual_submit' && ds) {
-            const locDs = localeForBot(ds.larkAppId);
-            if (cardMessageId && !isActiveRepoCard(ds, cardMessageId)) {
-                return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, locDs) } };
-            }
-            const rawPath = String(action?.form_value?.repo_manual_path ?? '').trim();
-            if (!rawPath) {
-                return { toast: { type: 'error', content: t('card.repo.manual_empty', undefined, locDs) } };
-            }
-            const validation = validateWorkingDir(rawPath, locDs);
-            if (!validation.ok) {
-                return { toast: { type: 'error', content: validation.error } };
-            }
-            // A worktree creation in flight holds the commit lock — a manual switch
-            // interleaving there would double-fork (same guard as the plain switch).
-            if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
-                return { toast: { type: 'info', content: t('cmd.repo.worktree_in_progress', undefined, locDs) } };
-            }
-            const selectedPath = validation.resolvedPath;
-            const displayName = pathBasename(selectedPath) || selectedPath;
-            await commitRepoSelection({ ds, rootId, cardMessageId, larkAppId, operatorOpenId, activeSessions, sessionReply }, selectedPath, displayName);
-        }
-        if (actionType === 'worktree_toggle_mode' && ds) {
-            // Flip the persisted per-bot worktree picker mode (single ⇄ multi), then
-            // re-send a fresh repo card in the new mode — a form can't ride an
-            // in-place patch, so the old card is withdrawn and a new one posted.
-            const locDs = localeForBot(ds.larkAppId);
-            // Same active-card gate as skip/manual/worktree: a stale card must not
-            // flip bot config or replace the live repo card after claim/restart.
-            if (cardMessageId && !isActiveRepoCard(ds, cardMessageId)) {
-                return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, locDs) } };
-            }
-            const spec = findConfigField('worktreeMultiPicker');
-            if (!spec)
-                return;
-            const next = getBot(ds.larkAppId).config.worktreeMultiPicker !== true;
-            const r = await applyConfigField(ds.larkAppId, spec, next);
-            if (!r.ok)
-                return { toast: { type: 'error', content: t('cmd.config.write_failed', { reason: r.reason }, locDs) } };
-            const projects = lastRepoScan.get(ds.chatId) ?? [];
-            // await so a rejected delete is caught here (not an unhandled rejection);
-            // a missing/already-gone card is fine — we post the fresh one regardless.
-            if (ds.repoCardMessageId && ds.larkAppId) {
-                try {
-                    await deleteMessage(ds.larkAppId, ds.repoCardMessageId);
-                }
-                catch { /* card already gone */ }
-            }
-            const newCard = buildRepoSelectCard(projects, getSessionWorkingDir(ds), rootId, locDs, next);
-            ds.repoCardMessageId = await sessionReply(rootId, newCard, 'interactive');
-            return { toast: { type: 'info', content: t(next ? 'card.repo.toast_worktree_mode_switched' : 'card.repo.toast_worktree_mode_switched_back', undefined, locDs) } };
-        }
-        if (actionType === 'repo_worktree_submit' && ds) {
-            const locDs = localeForBot(ds.larkAppId);
-            if (cardMessageId && !isActiveRepoCard(ds, cardMessageId)) {
-                return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, locDs) } };
-            }
-            const selectedPaths = stringListFromLarkMultiSelect(action?.form_value?.repo_worktree_paths);
-            if (selectedPaths.length === 0) {
-                return { toast: { type: 'error', content: t('card.repo.worktree_empty', undefined, locDs) } };
-            }
-            if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
-                return { toast: { type: 'info', content: t('cmd.repo.worktree_in_progress', undefined, locDs) } };
-            }
-            const branch = String(action?.form_value?.repo_worktree_branch ?? '').trim() || undefined;
-            const multiParent = selectedPaths.length > 1
-                ? multiWorktreeParentPath(selectedPaths, branch ?? await worktreeSlugFromContextAI(ds.session.title, ds.pendingPrompt) ?? 'worktree')
-                : undefined;
-            if (multiParent) {
-                const duplicateNames = duplicateMultiWorktreeChildNames(selectedPaths, lastRepoScan.get(ds.chatId));
-                if (duplicateNames.length > 0) {
-                    return { toast: { type: 'error', content: t('card.repo.worktree_child_conflict', { names: duplicateNames.join(', ') }, locDs) } };
-                }
-            }
-            const rootIdForAction = rootId;
-            void handleCardAction({
-                ...data,
-                action: {
-                    value: { key: 'repo_worktree', root_id: rootIdForAction, repo_worktree_paths_json: JSON.stringify(selectedPaths), ...(branch ? { branch } : {}), ...(multiParent ? { parent_path: multiParent } : {}) },
-                    option: selectedPaths[0],
-                },
-            }, deps, larkAppId);
-            return { toast: { type: 'info', content: t('card.repo.toast_worktree_creating', undefined, locDs) } };
-        }
-        return;
-    }
-    // Handle dropdown selections (option-based)
-    const option = action?.option;
-    if (!option) {
-        logger.warn('Card action received but no option or action value');
-        return;
-    }
-    if (Array.isArray(option)) {
-        logger.warn('Card action received multi options for a single-select handler');
-        return;
-    }
-    if (typeof option !== 'string') {
-        logger.warn('Card action received non-string option for a single-select handler');
-        return;
-    }
-    // Handle adopt session selection
-    if (action?.value?.key === 'codex_app_thread_select' && option) {
-        const rootId = action?.value?.root_id;
-        if (!rootId)
-            return;
-        const sKey = larkAppId ? sessionKey(rootId, larkAppId) : rootId;
-        const ds = activeSessions.get(sKey);
-        if (!ds)
-            return;
-        const sourceSession = ds.session;
-        if (isSessionTransferring(ds)) {
-            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
-        }
-        if (!canOperate(ds.larkAppId, ds.chatId, operatorOpenId)) {
-            logger.info(`codex_app_thread_select blocked for non-operator user: ${operatorOpenId} (chat=${ds.chatId})`);
-            return { toast: { type: 'error', content: t('card.grant.toast_no_repo_perm', undefined, localeForBot(ds.larkAppId)) } };
-        }
-        let selected;
-        try {
-            selected = JSON.parse(option);
-        }
-        catch {
-            return;
-        }
-        if (!selected.threadId)
-            return;
-        const botCfg = getBot(ds.larkAppId).config;
-        if (botCfg.cliId !== 'codex-app')
-            return;
-        const { listCodexAppThreads } = await import('../../services/codex-app-threads.js');
-        let threads;
-        try {
-            threads = await listCodexAppThreads({
-                codexBin: botCfg.cliPathOverride,
-                cwd: getSessionWorkingDir(ds),
-                limit: 80,
-            });
-        }
-        catch (err) {
-            await sessionReply(rootId, t('cmd.codex_app_adopt.list_failed', { error: err?.message ?? String(err) }, localeForBot(ds.larkAppId)));
-            return;
-        }
-        if (ds.session !== sourceSession
-            || ds.session.status !== 'active'
-            || activeSessions.get(sKey) !== ds
-            || isSessionTransferring(ds)) {
-            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
-        }
-        const target = threads.find(t => t.threadId === selected.threadId);
-        if (!target) {
-            await sessionReply(rootId, t('cmd.codex_app_adopt.thread_not_found', { threadId: selected.threadId }, localeForBot(ds.larkAppId)));
-            if (cardMessageId && larkAppId)
-                deleteMessage(larkAppId, cardMessageId);
-            return;
-        }
-        const { startCodexAppThreadSession } = await import('../../core/command-handler.js');
-        await startCodexAppThreadSession(target, ds, { activeSessions, sessionReply: deps.sessionReply, getActiveCount: () => 0, lastRepoScan }, larkAppId);
-        if (cardMessageId && larkAppId)
-            deleteMessage(larkAppId, cardMessageId);
-        return;
-    }
-    // Handle repo select card (option-based dropdowns: plain switch, or
-    // `repo_worktree` = create a worktree from the picked repo and open that).
-    // Require an explicit, recognized key: botmux's own dropdowns always set
-    // `repo_switch` / `repo_worktree` (card-builder.ts). Treating a keyless
-    // `option + root_id` as a plain switch let a hand-crafted card drive the
-    // session's working dir to an arbitrary path — reject anything unrecognized.
-    const repoKey = action?.value?.key;
-    if (repoKey !== 'repo_switch' && repoKey !== 'repo_worktree') {
-        logger.warn(`Card action: unrecognized repo dropdown key ${repoKey ?? '(none)'} — ignoring`);
-        return;
-    }
-    const isWorktreeOpen = repoKey === 'repo_worktree';
-    const selectedPath = option;
-    const rootId = action?.value?.root_id;
-    logger.info(`Card action: repo ${isWorktreeOpen ? 'worktree-open' : 'switch'} to ${selectedPath} (root_id: ${rootId})`);
-    if (!rootId) {
-        logger.warn('Card action: no root_id in action value');
-        return;
-    }
-    const targetDs = larkAppId ? activeSessions.get(sessionKey(rootId, larkAppId)) : undefined;
-    if (!targetDs) {
-        logger.warn(`Card action: no active session found for root ${rootId}`);
-        return;
-    }
-    // Only the live posted card may drive selection. Covers: already-consumed,
-    // wrong/old card, and post-restart (repoCardMessageId is in-memory). Must
-    // reject before mid-session switch can killWorker.
-    if (cardMessageId && !isActiveRepoCard(targetDs, cardMessageId)) {
-        return { toast: { type: 'info', content: t('cmd.repo.card_already_consumed', undefined, localeForBot(targetDs.larkAppId)) } };
-    }
-    // 权限边界：pendingRepo（首次选 repo 才能 spawn）放行「会话发起人 或 canOperate」，
-    // 让本群授权用户能完成自己的首次使用；非 pending 的 mid-session 切换是管理动作，要 canOperate。
-    const isSessionOwnerOp = !!operatorOpenId && operatorOpenId === targetDs.session.ownerOpenId;
-    const allowRepo = targetDs.pendingRepo
-        ? (isSessionOwnerOp || canOperate(targetDs.larkAppId, targetDs.chatId, operatorOpenId))
-        : canOperate(targetDs.larkAppId, targetDs.chatId, operatorOpenId);
-    if (!allowRepo) {
-        logger.info(`Repo card action blocked for ${operatorOpenId} (pending=${targetDs.pendingRepo})`);
-        return { toast: { type: 'error', content: t('card.grant.toast_no_repo_perm', undefined, localeForBot(targetDs.larkAppId)) } };
-    }
-    // Resolve the project name from cached scan
-    const cached = lastRepoScan.get(targetDs.chatId);
-    const project = cached?.find(p => p.path === selectedPath);
-    const displayName = project ? `${project.name} (${project.branch})` : selectedPath;
-    let selectedWorktreePaths = [selectedPath];
-    if (isWorktreeOpen && typeof action?.value?.repo_worktree_paths_json === 'string') {
-        try {
-            selectedWorktreePaths = stringListFromLarkMultiSelect(JSON.parse(action.value.repo_worktree_paths_json));
-        }
-        catch {
-            selectedWorktreePaths = [];
-        }
-        if (selectedWorktreePaths.length === 0) {
-            return { toast: { type: 'error', content: t('card.repo.worktree_empty', undefined, localeForBot(targetDs.larkAppId)) } };
-        }
-    }
-    const locTarget = localeForBot(targetDs.larkAppId);
-    // `/close` deletes the active-map entry without touching sessionId or
-    // pendingRepo — identity against the map is the only tell that the session
-    // this flow captured is gone. Checked alongside the generation snapshots.
-    const repoSessionKey = sessionKey(rootId, larkAppId);
-    const sessionStillActive = () => activeSessions.get(repoSessionKey) === targetDs;
-    // Shared commit context for a resolved directory — funnels the dropdown,
-    // worktree and manual-entry flows through the same module-level
-    // commitRepoSelection (pin dir, then fork pending CLI or close+recreate).
-    const commitCtx = { ds: targetDs, rootId, cardMessageId, larkAppId, operatorOpenId, activeSessions, sessionReply };
-    if (isWorktreeOpen) {
-        // Worktree creation involves a `git fetch` that can take many seconds —
-        // ack the card action immediately with a toast and finish asynchronously.
-        // On failure the card (and pendingRepo state) stays put so the user can
-        // pick again or fall back to a plain switch.
-        if (targetDs.worktreeCreating || targetDs.pendingRepoCommitInFlight) {
-            // The async path escapes the card-action in-flight dedup — gate repeats
-            // here, or two creations would race and the loser's commitSelection
-            // would yank the session the winner just spawned.
-            return { toast: { type: 'info', content: t('cmd.repo.worktree_in_progress', undefined, locTarget) } };
-        }
-        const parentPath = action?.value?.parent_path;
-        if (selectedWorktreePaths.length > 1 && parentPath) {
-            const duplicateNames = duplicateMultiWorktreeChildNames(selectedWorktreePaths, cached);
-            if (duplicateNames.length > 0) {
-                return { toast: { type: 'error', content: t('card.repo.worktree_child_conflict', { names: duplicateNames.join(', ') }, locTarget) } };
-            }
-        }
-        targetDs.worktreeCreating = true;
-        // Session generation snapshot: if another selection lands while git runs
-        // (pendingRepo consumed, or the session swapped), committing this worktree
-        // afterwards would kill that fresh session — notify instead of switching.
-        const startSessionId = targetDs.session.sessionId;
-        const wasPending = !!targetDs.pendingRepo;
-        const sessionChanged = () => !sessionStillActive() ||
-            targetDs.session.sessionId !== startSessionId ||
-            !!targetDs.pendingRepo !== wasPending;
-        const notSwitched = async (creation, when) => {
-            logger.info(`[${tag(targetDs)}] Worktree ${creation.path} created but session changed ${when} — not switching`);
-            await sessionReply(rootId, t('cmd.repo.worktree_created_not_switched', { path: creation.path, branch: creation.branch }, locTarget));
-        };
-        void (async () => {
-            try {
-                let creation;
-                // Track each successful (sourceRepo → created worktree) so a later repo's
-                // failure in a multi-repo batch can roll the earlier ones back instead of
-                // leaking orphaned worktree dirs/branches.
-                const created = [];
-                try {
-                    const branch = action?.value?.branch?.trim() || undefined;
-                    const slug = branch ? undefined : await worktreeSlugFromContextAI(targetDs.session.title, targetDs.pendingPrompt);
-                    for (const repoPath of selectedWorktreePaths) {
-                        const result = await createRepoWorktree(repoPath, {
-                            branch,
-                            slug,
-                            worktreePath: selectedWorktreePaths.length > 1 && parentPath
-                                ? join(parentPath, worktreeChildNameForRepo(repoPath, cached))
-                                : undefined,
-                        });
-                        created.push({ repo: repoPath, result });
-                    }
-                    creation = selectedWorktreePaths.length > 1 && parentPath
-                        ? {
-                            path: parentPath,
-                            branch: branch ?? created.map(c => c.result.branch).join(', '),
-                            baseRef: Array.from(new Set(created.map(c => c.result.baseRef))).join(', '),
-                        }
-                        : created[0].result;
-                }
-                catch (e) {
-                    // The repo that threw is the one right after the last success.
-                    const failedRepo = selectedWorktreePaths[created.length] ?? selectedPath;
-                    const errMsg = e instanceof Error ? e.message : String(e);
-                    logger.warn(`[${tag(targetDs)}] Worktree creation failed for ${failedRepo}: ${errMsg}`);
-                    let rolledBack = 0;
-                    for (const c of created) {
-                        try {
-                            await removeRepoWorktree(c.repo, c.result.path);
-                            rolledBack++;
-                        }
-                        catch (re) {
-                            logger.warn(`[${tag(targetDs)}] rollback of ${c.result.path} failed: ${re instanceof Error ? re.message : re}`);
-                        }
-                    }
-                    await sessionReply(rootId, rolledBack > 0
-                        ? t('card.repo.worktree_rolled_back', { repo: pathBasename(failedRepo), error: errMsg, count: rolledBack }, locTarget)
-                        : t('cmd.repo.worktree_failed', { error: errMsg }, locTarget));
-                    return;
-                }
-                if (sessionChanged())
-                    return notSwitched(creation, 'mid-flight');
-                // riff：新建的 worktree 分支只存在于本地，远程沙箱克隆不到 → 先推送
-                // 分支指针到远端，riff 任务才能钉住这个新分支。推送失败不阻塞（worker
-                // 推导会按现状回退默认分支并在卡片注入告警），只提示用户。
-                if (nextSessionUsesRiffBackend(targetDs)) {
-                    for (const c of created) {
-                        try {
-                            await pushWorktreeBranch(c.result.path, c.result.branch);
-                        }
-                        catch (e) {
-                            const errMsg = e instanceof Error ? e.message : String(e);
-                            logger.warn(`[${tag(targetDs)}] riff worktree branch push failed (${c.result.branch}): ${errMsg}`);
-                            await sessionReply(rootId, t('card.repo.riff_worktree_push_failed', { branch: c.result.branch, error: errMsg }, locTarget));
-                        }
-                    }
-                }
-                await sessionReply(rootId, t('cmd.repo.worktree_created', {
-                    path: creation.path, branch: creation.branch, base: creation.baseRef,
-                }, locTarget));
-                // The reply above awaited a Lark round-trip — a plain switch (which is
-                // NOT gated by worktreeCreating) can land in that window. Re-check
-                // right before committing, or we'd kill the session it just spawned.
-                if (sessionChanged())
-                    return notSwitched(creation, 'during reply');
-                try {
-                    // The "worktree 已创建：…" notice above already confirms the switch —
-                    // suppress commitRepoSelection's own "已选择/已切换" to avoid a dup.
-                    await commitRepoSelection(commitCtx, creation.path, `${pathBasename(creation.path)} (${creation.branch})`, {
-                        suppressConfirmReply: true,
-                        // 多仓：把按用户选择顺序创建的 worktree 目录 stamp 到 session，
-                        // riff 按此显式列表（而非目录扫描）推导 repos，首仓为 primary。
-                        riffRepoDirs: created.length > 1 ? created.map(c => c.result.path) : undefined,
-                    });
-                }
-                catch (e) {
-                    // The worktree DOES exist at this point — only the switch failed.
-                    // Don't report it as a creation failure, or the user retries and
-                    // trips over "worktree target already exists".
-                    logger.warn(`[${tag(targetDs)}] Worktree ${creation.path} created but switching failed: ${e instanceof Error ? e.message : e}`);
-                    await sessionReply(rootId, t('cmd.repo.worktree_switch_failed', { path: creation.path, error: e instanceof Error ? e.message : String(e) }, locTarget));
-                }
-            }
-            finally {
-                targetDs.worktreeCreating = false;
-            }
-        })();
-        return { toast: { type: 'info', content: t('card.repo.toast_worktree_creating', undefined, locTarget) } };
-    }
-    // Plain switch — blocked while a worktree creation/commit is in flight. The
-    // worktree commit awaits (Lark replies, prompt prep) after its generation
-    // checks; a plain selection interleaving there would double-fork. One lock
-    // gates both kinds until the commit settles.
-    if (targetDs.worktreeCreating || targetDs.pendingRepoCommitInFlight) {
-        return { toast: { type: 'info', content: t('cmd.repo.worktree_in_progress', undefined, locTarget) } };
-    }
-    await commitRepoSelection(commitCtx, selectedPath, displayName);
-}
-//# sourceMappingURL=card-handler.js.map