botmux 3.10.0 → 3.23.1

package/dist/core/command-handler.js

@@ -1,4108 +0,0 @@
-/**
- * Command handler — processes /slash commands from users.
- * Extracted from daemon.ts for modularity.
- */
-import { existsSync, readFileSync, statSync } from 'node:fs';
-import { join, resolve, basename } from 'node:path';
-import { config } from '../config.js';
-import { buildTerminalUrl } from './terminal-url.js';
-import { getBot, getAllBots, getBotOpenId, getOwnerOpenId, findOncallChat, effectiveDefaultWorkingDir } from '../bot-registry.js';
-import { readGlobalConfig, repoPickerScanOptions } from '../global-config.js';
-import * as sessionStore from '../services/session-store.js';
-import * as scheduleStore from '../services/schedule-store.js';
-import * as scheduler from './scheduler.js';
-import { scanMultipleProjects, describeProjectDir } from '../services/project-scanner.js';
-import { createRepoWorktree, pushWorktreeBranch } from '../services/git-worktree.js';
-import { worktreeSlugFromContextAI } from '../services/worktree-slug-ai.js';
-import { resolvePairedSpawnBackendType } from './persistent-backend.js';
-import { buildRepoSelectCard, buildAdoptSelectCard, buildCodexAppThreadSelectCard, buildSlashListCard, getCliDisplayName, buildConfigCard, buildForkPanelCard, buildAdoptBlockedCard } from '../im/lark/card-builder.js';
-import { handleDashboardCommand } from './dashboard-command/index.js';
-import { createCliAdapterSync } from '../adapters/cli/registry.js';
-import { resolveCliRuntime, runtimeInstallationKey } from '../adapters/cli/runtime.js';
-import { deleteMessage, sendMessage, sendUserMessage, replyMessage, listChatBotMembers, resolveUserUnionId, getChatModeStrict, getMessageThreadId, UserTokenMissingError } from '../im/lark/client.js';
-import { chatAppLink, threadAppLink, normalizeBrand } from '../im/lark/lark-hosts.js';
-import { claimPairing } from '../services/pairing-store.js';
-import { logger } from '../utils/logger.js';
-import { scheduleTimeZone } from '../utils/timezone.js';
-import { closeSession, killWorker, teardownAuthoritativePersistentBackingBeforeClose, suspendWorker, forkWorker, forkAdoptWorker, adoptSandboxBlocked, getCurrentCliVersion, postFreshStreamingCard, postPrivateSnapshotCard, resolvePrivateCardAudience, deliverEphemeralOrReply, deliverWritableTerminalCardTo, requestSessionRestart, isSessionTransferring } from './worker-pool.js';
-import { expandHome, getSessionWorkingDir, getProjectScanDirs, rememberLastCliInput, buildNewTopicCliInput, ensureSessionWhiteboard, getAvailableBots, } from './session-manager.js';
-import { markInitialUserTurnPending } from './initial-user-turn.js';
-import { discoverSlashCommandsForAdapter, listMcpServerNames, supportsFilesystemCommandDiscovery } from './command-discovery.js';
-import { validateWorkingDir } from './working-dir.js';
-import { repinSessionWorkingDir } from './session-cwd.js';
-import { validateAdoptTarget, adoptTargetKey, adoptTargetLabel } from './session-discovery.js';
-import { validateZellijAdoptTarget } from './zellij-adopt-discovery.js';
-import { listCodexAppThreads } from '../services/codex-app-threads.js';
-import { generateAuthUrl, getTokenStatus, resolveUserToken, DOC_COMMENT_OAUTH_SCOPES } from '../utils/user-token.js';
-import { DocSubscriptionPermissionError, listDocComments, resolveDocFile, subscribeDocFile, unsubscribeDocFile } from '../im/lark/doc-comment.js';
-import { parseDocWatchCommand } from './doc-watch-command.js';
-import { parseVcMeetingPrepareCommand } from './vc-meeting-prepare-command.js';
-import { latestDocCommentPollCursor } from './doc-comment-poller.js';
-import { putDocSubscription, removeDocSubscription, listDocSubscriptionsForSession, listAllDocSubscriptions, getDocSubscription, } from '../services/doc-subs-store.js';
-import { findVcMeetingPreparationByChat, getVcMeetingPreparation, listVcMeetingPreparations, putVcMeetingPreparation, removeVcMeetingPreparation, removeVcMeetingPreparationsByChat, } from '../services/vc-meeting-preparations-store.js';
-import { bindOncall, unbindOncall, getOncallStatus } from '../services/oncall-store.js';
-import { CONFIG_FIELDS, findConfigField, settableFieldKeys, parseBooleanValue, applyConfigField, setBotAllowedUsers, getConfigSnapshot, getConfigCardData, coerceConfigValue, } from '../services/bot-config-store.js';
-import { resolveCliId, findInvalidAllowedUserEntries } from '../setup/bot-config-editor.js';
-import { buildClosedSessionCard } from './closed-session-card.js';
-import { ttadkConfigModelChoices } from '../setup/cli-selection.js';
-import { publishAttentionPatch, publishClosedSessionPatch, announcePendingRepoSession } from './session-activity.js';
-import { setCardMode } from '../services/card-mode-store.js';
-import { canOperate } from '../im/lark/event-dispatcher.js';
-import { buildSafeInsightReport } from '../services/insight/report.js';
-import { invalidWorkingDirs } from '../utils/working-dir.js';
-import { writeRoleFile, deleteRoleFile, resolveRole, resolveRoleFile, resolveTeamRoleFile, writeTeamRoleFile, deleteTeamRoleFile, MAX_ROLE_BYTES } from './role-resolver.js';
-import { getBotCapability, setBotCapability, clearBotCapability } from '../services/bot-profile-store.js';
-import { deleteRoleProfileEntry, deleteRoleProfileIfEmpty, isValidRoleProfileId, listRoleProfileEntries, listRoleProfiles, MAX_ROLE_PROFILE_ENTRY_BYTES, readRoleProfileEntry, writeRoleProfileEntry, } from '../services/role-profile-store.js';
-import { sessionKey, sessionAnchorId, markRepoCardConsumed, claimCurrentRepoCard } from './types.js';
-import { t, localeForBot } from '../i18n/index.js';
-import { runSkillsImCommand } from './skills/im-command.js';
-import { fetchDaemonIpc } from './daemon-ipc-auth.js';
-import { updateSessionTitle } from './session-title.js';
-import { requestAgentSessionRename } from './session-rename.js';
-import { configuredRuntimeDisplayName, sessionConfiguredRuntimeDisplayName, } from './cli-runtime-display.js';
-// ─── Exported constants ──────────────────────────────────────────────────────
-// DAEMON_COMMANDS / PASSTHROUGH_COMMANDS / normalizePassthroughCommand now live
-// in the leaf ./passthrough-commands.js so the config store can share the
-// normalization without a circular import; imported for internal use and
-// re-exported to keep callers (daemon.ts, tests) importing from command-handler
-// unchanged.
-import { DAEMON_COMMANDS, PASSTHROUGH_COMMANDS, normalizePassthroughCommand, parseCustomPassthroughInput } from './passthrough-commands.js';
-export { DAEMON_COMMANDS, PASSTHROUGH_COMMANDS };
-/**
- * Daemon commands that act on the chat itself rather than opening a
- * conversation. `/group` (`/g`) just creates a Lark group and replies once —
- * no follow-up turns, no CLI worker. The new-topic spawn path normally
- * pre-creates a sessionStore record so a command can attach state and keep
- * card buttons routable, but for these that record is a phantom conversation
- * that pollutes the dashboard's session list. Handle them without a session.
- */
-export const SESSIONLESS_DAEMON_COMMANDS = new Set(['/group', '/g', '/list-slash-command', '/slash', '/botconfig', '/dashboard', '/skills', '/vc-auth', '/watch-comment', '/issue']);
-const SLASH_GROUP_NAME_MAX_UTF16_LENGTH = 50;
-/** Apply the machine-wide prefix used only by `/group` and `/g`, then keep the
- *  existing Lark headroom. The legacy limit is measured in UTF-16 code units;
- *  iterating by code point keeps that limit without slicing an emoji's
- *  surrogate pair. */
-export function formatSlashGroupName(name, prefix = '') {
-    const prefixed = prefix && !name.startsWith(prefix) ? `${prefix}${name}` : name;
-    if (prefixed.length <= SLASH_GROUP_NAME_MAX_UTF16_LENGTH)
-        return prefixed;
-    let truncated = '';
-    for (const character of prefixed) {
-        if (truncated.length + character.length > SLASH_GROUP_NAME_MAX_UTF16_LENGTH)
-            break;
-        truncated += character;
-    }
-    return `${truncated}…`;
-}
-/**
- * Daemon commands that operate on an ALREADY-EXISTING session and must never
- * pre-create one. With no real session to operate on, the daemon routes must skip their generic
- * "createSession + activeSessions.set(worker:null)" pre-create block and let
- * handleCommand's `!ds` branch reply no_active_session. Without this, one of these commands
- * in a brand-new topic (or a thread with no session) would spawn a phantom
- * worker:null session just to handle it, polluting the dashboard. (Same class
- * of fix as the `/card` / `/term` special cases in daemon.ts.)
- */
-export const EXISTING_SESSION_ONLY_DAEMON_COMMANDS = new Set(['/rename', '/fork', '/forklist']);
-export function resolveAdapterDefaultPassthroughCommands(larkAppId) {
-    if (!larkAppId)
-        return [];
-    try {
-        const bot = getBot(larkAppId);
-        const adapter = createCliAdapterSync(bot.config.cliId, bot.config.cliPathOverride);
-        const normalized = (adapter.defaultPassthroughCommands ?? [])
-            .map(normalizePassthroughCommand)
-            .filter((c) => !!c);
-        return [...new Set(normalized)];
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Effective passthrough set for a bot: the fixed {@link PASSTHROUGH_COMMANDS}
- * plus adapter-scoped defaults and the bot's `customPassthroughCommands`
- * (bots.json). Entries that would shadow a botmux daemon command are dropped —
- * daemon commands must keep their daemon semantics, and passthrough is checked
- * BEFORE DAEMON_COMMANDS in the router, so an un-filtered custom `/status`
- * would hijack the daemon's own.
- * Unknown / no bot → falls back to the builtin set unchanged.
- */
-export function resolvePassthroughCommands(larkAppId) {
-    const effective = new Set(PASSTHROUGH_COMMANDS);
-    if (!larkAppId)
-        return effective;
-    for (const c of resolveAdapterDefaultPassthroughCommands(larkAppId)) {
-        effective.add(c);
-    }
-    try {
-        for (const c of getBot(larkAppId).config.customPassthroughCommands ?? []) {
-            const normalized = normalizePassthroughCommand(c);
-            if (normalized)
-                effective.add(normalized);
-        }
-    }
-    catch {
-        /* unknown bot — builtin set only */
-    }
-    return effective;
-}
-const MULTILINE_COMMANDS = new Set(['/schedule', '/role', '/fork']);
-// `validateWorkingDir` now lives in ./working-dir.js (leaf module the CLI can
-// import without the daemon graph); re-exported here for existing callers.
-export { validateWorkingDir };
-/**
- * Resolve a non-numeric `/repo <arg>` into a concrete repo path + display name.
- * `arg` is either a path (absolute or relative) or a first-level project name
- * under one of the bot's scan dirs — letting the user skip the selection card.
- *
- * Resolution:
- *   1. Build candidate absolute paths — absolute / `~` taken as-is; relative or
- *      bare names resolved against each scan dir, then the daemon cwd (mirrors
- *      how the card's project list is rooted).
- *   2. Return the first directly existing candidate, describing its git ref
- *      without scanning unrelated roots. This is lenient like `/cd`, whose trust
- *      model is "owner explicitly chose a dir"; the CLI already runs with full
- *      FS access.
- *   3. Only for a bare name that did not directly resolve, scan projects and
- *      match by basename (covers projects nested deeper than the scan-dir top
- *      level).
- * Returns null when nothing resolves to an existing directory.
- */
-export function resolveRepoSelection(repoArg, scanDirs) {
-    const isExplicitPath = repoArg.startsWith('/') ||
-        repoArg.startsWith('~') ||
-        repoArg.startsWith('.') ||
-        repoArg.includes('/');
-    const candidates = [];
-    if (repoArg.startsWith('/') || repoArg.startsWith('~')) {
-        candidates.push(resolve(expandHome(repoArg)));
-    }
-    else {
-        for (const d of scanDirs)
-            candidates.push(resolve(d, repoArg));
-        candidates.push(resolve(expandHome(repoArg))); // daemon-cwd fallback (matches /cd)
-    }
-    // Direct candidates must win before any recursive scan. Besides avoiding
-    // unnecessary traversal (especially a legacy HOME fallback), describing just
-    // the selected directory preserves the same "name (branch)" label for repos.
-    for (const cand of candidates) {
-        try {
-            if (!statSync(cand).isDirectory())
-                continue;
-        }
-        catch {
-            continue; // missing / not a dir — try next candidate
-        }
-        const desc = describeProjectDir(cand);
-        return desc
-            ? { path: cand, displayName: `${desc.name} (${desc.branch})` }
-            : { path: cand, displayName: basename(cand) };
-    }
-    // Explicit and relative paths have no basename-search semantics: when their
-    // concrete candidates do not exist, a recursive project scan cannot resolve
-    // them. Bare names alone may refer to a repo nested below a scan root.
-    if (isExplicitPath)
-        return null;
-    const existingScanDirs = scanDirs.filter((d) => existsSync(d));
-    const projects = existingScanDirs.length > 0 ? scanMultipleProjects(existingScanDirs) : [];
-    const byName = projects.find((p) => p.name === repoArg);
-    if (byName)
-        return { path: byName.path, displayName: `${byName.name} (${byName.branch})` };
-    return null;
-}
-/**
- * Parse a force-topic invocation: `/t [prompt]` or `/topic [prompt]`.
- *
- * This is a routing meta-command, distinct from `parseSlashCommandInvocation`
- * (which routes to daemon command handlers). The match conditions are
- * deliberately tighter than the regular slash parser:
- *
- * - exact-prefix match (`/t` / `/topic`, case-insensitive); `/tea` / `/topical`
- *   must NOT match, otherwise we'd false-trigger on common /-prefixed words.
- * - tolerates leading whitespace (mention-stripping can leave a space).
- * - prompt is whatever follows the prefix (verbatim, including newlines).
- * - `/t` alone (no args) is allowed → empty prompt; the user can fill it in
- *   while the repo selection card is still pending.
- *
- * Returns null for anything else, so callers can fall through to the regular
- * `parseSlashCommandInvocation` / message-handling path.
- */
-export function parseForceTopicInvocation(content) {
-    const trimmed = content.replace(/^\s+/, '');
-    const match = /^\/(t|topic)(?:\s+([\s\S]*))?$/i.exec(trimmed);
-    if (!match)
-        return null;
-    return { prompt: (match[2] ?? '').trim() };
-}
-/** Parse a user-authored slash command after leading @mentions have already
- *  been stripped. Messages that look like command examples or command lists
- *  are intentionally left for the CLI instead of being intercepted by the
- *  daemon; otherwise discussion text such as `/adopt <pane>` can accidentally
- *  trigger real daemon actions. */
-export function parseSlashCommandInvocation(content) {
-    // trim BOTH ends: a trailing newline/space rides into the returned `content`
-    // and, for a passthrough command relayed verbatim to the CLI (raw_input), gets
-    // typed as a literal trailing newline — which breaks the CLI's slash-command
-    // detection (it sees a multi-line message, not a `/cmd`). Internal newlines for
-    // MULTILINE_COMMANDS are preserved (trim only touches the ends).
-    const trimmed = content.trim();
-    if (!trimmed.startsWith('/'))
-        return null;
-    const lines = trimmed.split(/\r?\n/);
-    const firstLine = (lines[0] ?? '').trimEnd();
-    const [cmdRaw] = firstLine.split(/\s+/);
-    const cmd = cmdRaw?.toLowerCase();
-    if (!cmd)
-        return null;
-    // Treat angle-bracket placeholders as documentation, not an invocation.
-    if (/<[^>\r\n]+>/.test(firstLine))
-        return null;
-    const restNonBlank = lines.slice(1).map(l => l.trim()).filter(Boolean);
-    if (restNonBlank.length > 0) {
-        // A list of slash commands is almost certainly discussion / planning text.
-        if (restNonBlank.some(l => l.startsWith('/')))
-            return null;
-        if (!MULTILINE_COMMANDS.has(cmd))
-            return null;
-    }
-    return { cmd, content: trimmed };
-}
-function tag(ds) {
-    return ds.session.sessionId.substring(0, 8);
-}
-/**
- * Lowercased display names of ALL bots known to the deployment, read from the
- * shared bots-info.json. This is the only globally-complete, process-stable
- * source of "is this @-mention a bot?": production runs one daemon per bot, so
- * getAllBots() only sees this process's own bot, and the live chat-member roster
- * (listChatBotMembers) can transiently miss a bot — either would let competing
- * bot processes disagree on who the first @-mentioned bot is and double-create.
- * bots-info.json is a local file merge-written by every daemon at startup.
- */
-function globalKnownBotNames() {
-    try {
-        const p = join(config.session.dataDir, 'bots-info.json');
-        if (!existsSync(p))
-            return new Set();
-        const entries = JSON.parse(readFileSync(p, 'utf-8'));
-        return new Set(entries.map(e => e.botName?.toLowerCase()).filter((n) => !!n));
-    }
-    catch {
-        return new Set();
-    }
-}
-/** Human-friendly name for a bot larkAppId — Lark app display name, else cliId, else the raw id. */
-function botDisplayName(larkAppId) {
-    try {
-        const bot = getBot(larkAppId);
-        return bot.botName ?? getCliDisplayName(bot.config.cliId) ?? larkAppId;
-    }
-    catch {
-        return larkAppId;
-    }
-}
-function sessionCliDisplayName(ds) {
-    const botCfg = getBot(ds.larkAppId).config;
-    const configured = sessionConfiguredRuntimeDisplayName(ds.session, botCfg.cliRuntime);
-    if (configured)
-        return configured;
-    return getCliDisplayName(ds.session.cliId ?? botCfg.cliId);
-}
-function formatUptime(ms) {
-    const s = Math.floor(ms / 1000);
-    if (s < 60)
-        return `${s}s`;
-    const m = Math.floor(s / 60);
-    if (m < 60)
-        return `${m}m${s % 60}s`;
-    const h = Math.floor(m / 60);
-    return `${h}h${m % 60}m`;
-}
-function codexAppThreadTitle(thread) {
-    const raw = (thread.name || thread.preview || thread.threadId).replace(/\s+/g, ' ').trim();
-    return raw.length > 80 ? raw.slice(0, 79) + '…' : raw;
-}
-function invalidConfiguredWorkingDirs(ds, larkAppId) {
-    if (ds?.workingDir)
-        return invalidWorkingDirs({ workingDir: ds.workingDir });
-    if (larkAppId) {
-        const bot = getBot(larkAppId);
-        return invalidWorkingDirs({
-            workingDir: bot.config.workingDir ?? '~',
-            workingDirs: bot.config.workingDirs,
-        });
-    }
-    return invalidWorkingDirs({
-        workingDir: config.daemon.workingDir ?? '~',
-        workingDirs: config.daemon.workingDirs,
-    });
-}
-// ─── Schedule command ────────────────────────────────────────────────────────
-async function handleRoleCommand(args, rootId, chatId, larkAppId, senderId, deps) {
-    const sessionReply = (rid, content, msgType) => deps.sessionReply(rid, content, msgType, larkAppId);
-    const trimmed = args.trim();
-    const loc = localeForBot(larkAppId);
-    const dataDir = config.session.dataDir;
-    // /role profile [...] — reusable suites of per-bot chat roles. Profiles are
-    // not a runtime role layer; applying one materializes this bot's entry into
-    // the current chat role.
-    const profileMatch = trimmed.match(/^profile\b([\s\S]*)$/);
-    if (profileMatch) {
-        const profileArgs = profileMatch[1].trim();
-        const subMatch = profileArgs.match(/^(\S+)(?:\s+([\s\S]*))?$/);
-        const sub = (subMatch?.[1] ?? '').toLowerCase();
-        const subBody = subMatch?.[2]?.trim() ?? '';
-        if (!sub || sub === 'help') {
-            await sessionReply(rootId, t('role.profile.help', undefined, loc));
-            return;
-        }
-        if (sub === 'list' || sub === 'ls') {
-            const profiles = listRoleProfiles(dataDir);
-            if (profiles.length === 0) {
-                await sessionReply(rootId, t('role.profile.list_empty', undefined, loc));
-                return;
-            }
-            const lines = profiles.map(p => {
-                const hasEntry = readRoleProfileEntry(dataDir, p.profileId, larkAppId) !== null;
-                const status = hasEntry
-                    ? t('role.profile.current_configured', undefined, loc)
-                    : t('role.profile.current_missing', undefined, loc);
-                return `• ${p.profileId} — ${p.entryCount} ${t('role.profile.entries', undefined, loc)}; ${status}`;
-            });
-            await sessionReply(rootId, `${t('role.profile.list_header', undefined, loc)}\n${lines.join('\n')}`);
-            return;
-        }
-        const [profileId = '', ...afterProfile] = subBody.split(/\s+/);
-        if (!profileId || !isValidRoleProfileId(profileId)) {
-            await sessionReply(rootId, t('role.profile.invalid', undefined, loc));
-            return;
-        }
-        if (sub === 'show') {
-            const showAll = afterProfile.includes('--all');
-            if (showAll) {
-                const entries = listRoleProfileEntries(dataDir, profileId);
-                if (entries.length === 0) {
-                    await sessionReply(rootId, t('role.profile.no_entries', { profile: profileId }, loc));
-                    return;
-                }
-                const body = entries.map(entry => `### ${entry.larkAppId}\n${t('role.byte_count', { bytes: entry.byteLength, max: MAX_ROLE_PROFILE_ENTRY_BYTES }, loc)}\n\`\`\`markdown\n${entry.content}\n\`\`\``).join('\n\n');
-                await sessionReply(rootId, `${t('role.profile.show_all_header', { profile: profileId }, loc)}\n${body}`);
-                return;
-            }
-            const content = readRoleProfileEntry(dataDir, profileId, larkAppId);
-            if (content === null) {
-                await sessionReply(rootId, t('role.profile.entry_empty', { profile: profileId }, loc));
-                return;
-            }
-            await sessionReply(rootId, `${t('role.profile.entry_current', { profile: profileId }, loc)}\n\`\`\`markdown\n${content}\n\`\`\`\n${t('role.byte_count', { bytes: Buffer.byteLength(content, 'utf-8'), max: MAX_ROLE_PROFILE_ENTRY_BYTES }, loc)}`);
-            return;
-        }
-        if (sub === 'set') {
-            const content = subBody.slice(profileId.length).trim();
-            if (!content) {
-                await sessionReply(rootId, t('role.profile.set_empty', undefined, loc));
-                return;
-            }
-            writeRoleProfileEntry(dataDir, profileId, larkAppId, content);
-            await sessionReply(rootId, t('role.profile.entry_saved', {
-                profile: profileId,
-                bytes: Math.min(Buffer.byteLength(content.trim(), 'utf-8'), MAX_ROLE_PROFILE_ENTRY_BYTES),
-                max: MAX_ROLE_PROFILE_ENTRY_BYTES,
-            }, loc));
-            return;
-        }
-        if (sub === 'save') {
-            const { content, source } = resolveRole(larkAppId, chatId);
-            if (!content) {
-                await sessionReply(rootId, t('role.profile.save_no_effective', { profile: profileId }, loc));
-                return;
-            }
-            writeRoleProfileEntry(dataDir, profileId, larkAppId, content);
-            await sessionReply(rootId, t('role.profile.saved_effective', {
-                profile: profileId,
-                source,
-                bytes: Buffer.byteLength(content, 'utf-8'),
-                max: MAX_ROLE_PROFILE_ENTRY_BYTES,
-            }, loc));
-            return;
-        }
-        if (sub === 'delete' || sub === 'del' || sub === 'rm' || sub === '删除') {
-            const existed = deleteRoleProfileEntry(dataDir, profileId, larkAppId);
-            deleteRoleProfileIfEmpty(dataDir, profileId);
-            await sessionReply(rootId, existed
-                ? t('role.profile.entry_deleted', { profile: profileId }, loc)
-                : t('role.profile.entry_nothing', { profile: profileId }, loc));
-            return;
-        }
-        if (sub === 'apply') {
-            const flags = new Set(afterProfile);
-            const preview = flags.has('--preview');
-            const force = flags.has('--force');
-            const quiet = flags.has('--quiet');
-            const content = readRoleProfileEntry(dataDir, profileId, larkAppId);
-            if (content === null) {
-                await sessionReply(rootId, t('role.profile.apply_missing', { profile: profileId }, loc));
-                return;
-            }
-            const existing = resolveRoleFile(larkAppId, chatId);
-            const bytes = Buffer.byteLength(content, 'utf-8');
-            if (preview) {
-                const overwriteLine = existing && !force
-                    ? `\n${t('role.profile.apply_would_refuse', undefined, loc)}`
-                    : '';
-                await sessionReply(rootId, `${t('role.profile.apply_preview', { profile: profileId, bytes, max: MAX_ROLE_PROFILE_ENTRY_BYTES }, loc)}${overwriteLine}\n\`\`\`markdown\n${content}\n\`\`\``);
-                return;
-            }
-            if (existing && !force) {
-                // An empty entry would *clear* the chat role, not overwrite it — phrase
-                // the --force refusal accordingly so the intent is not misread.
-                const refusedKey = content ? 'role.profile.apply_refused' : 'role.profile.apply_refused_clear';
-                await sessionReply(rootId, t(refusedKey, { profile: profileId }, loc));
-                return;
-            }
-            if (!content) {
-                deleteRoleFile(larkAppId, chatId);
-                if (!quiet) {
-                    await sessionReply(rootId, t('role.profile.applied', { profile: profileId, bytes, max: MAX_ROLE_PROFILE_ENTRY_BYTES }, loc));
-                }
-                return;
-            }
-            writeRoleFile(larkAppId, chatId, content);
-            if (!quiet) {
-                await sessionReply(rootId, t('role.profile.applied', { profile: profileId, bytes, max: MAX_ROLE_PROFILE_ENTRY_BYTES }, loc));
-            }
-            return;
-        }
-        await sessionReply(rootId, t('role.profile.help', undefined, loc));
-        return;
-    }
-    // /role team [...] — manage the team-level (per-bot, cross-chat) role
-    const teamMatch = trimmed.match(/^team\b([\s\S]*)$/);
-    if (teamMatch) {
-        const teamArgs = teamMatch[1].trim();
-        const teamSet = teamArgs.match(/^set\s+([\s\S]+)/);
-        if (teamSet) {
-            const content = teamSet[1].trim();
-            if (!content) {
-                await sessionReply(rootId, t('role.set_empty', undefined, loc));
-                return;
-            }
-            writeTeamRoleFile(larkAppId, content);
-            await sessionReply(rootId, t('role.team_saved', { bytes: Buffer.byteLength(content, 'utf-8'), max: MAX_ROLE_BYTES }, loc));
-            return;
-        }
-        if (teamArgs === 'delete' || teamArgs === '删除') {
-            await sessionReply(rootId, deleteTeamRoleFile(larkAppId) ? t('role.team_deleted', undefined, loc) : t('role.team_nothing', undefined, loc));
-            return;
-        }
-        const content = resolveTeamRoleFile(larkAppId);
-        if (content) {
-            await sessionReply(rootId, `${t('role.team_current', undefined, loc)}\n\`\`\`markdown\n${content}\n\`\`\`\n${t('role.byte_count', { bytes: Buffer.byteLength(content, 'utf-8'), max: MAX_ROLE_BYTES }, loc)}`);
-        }
-        else {
-            await sessionReply(rootId, t('role.team_empty', undefined, loc));
-        }
-        return;
-    }
-    // /role cap [...] — manage the short capability label shown in the roster
-    const capMatch = trimmed.match(/^cap\b([\s\S]*)$/);
-    if (capMatch) {
-        const capArgs = capMatch[1].trim();
-        const capSet = capArgs.match(/^set\s+([\s\S]+)/);
-        if (capSet) {
-            const label = capSet[1].trim();
-            if (!label) {
-                await sessionReply(rootId, t('role.cap_set_empty', undefined, loc));
-                return;
-            }
-            setBotCapability(dataDir, larkAppId, label, senderId);
-            await sessionReply(rootId, t('role.cap_saved', { cap: getBotCapability(dataDir, larkAppId) ?? label }, loc));
-            return;
-        }
-        if (capArgs === 'clear' || capArgs === '清除') {
-            await sessionReply(rootId, clearBotCapability(dataDir, larkAppId) ? t('role.cap_cleared', undefined, loc) : t('role.cap_empty', undefined, loc));
-            return;
-        }
-        const cap = getBotCapability(dataDir, larkAppId);
-        await sessionReply(rootId, cap ? t('role.cap_current', { cap }, loc) : t('role.cap_empty', undefined, loc));
-        return;
-    }
-    // /role → show the EFFECTIVE role + where it comes from (chat override > team > none)
-    if (!trimmed) {
-        const { content, source } = resolveRole(larkAppId, chatId);
-        if (content) {
-            const len = Buffer.byteLength(content, 'utf-8');
-            const srcLabel = source === 'chat' ? t('role.src_chat', undefined, loc) : t('role.src_team', undefined, loc);
-            await sessionReply(rootId, `${t('role.current', undefined, loc)} ${srcLabel}\n\`\`\`markdown\n${content}\n\`\`\`\n${t('role.byte_count', { bytes: len, max: MAX_ROLE_BYTES }, loc)}`);
-        }
-        else {
-            await sessionReply(rootId, t('role.empty', undefined, loc));
-        }
-        return;
-    }
-    // /role set <content> — write role file
-    const setMatch = trimmed.match(/^set\s+([\s\S]+)/);
-    if (setMatch) {
-        const content = setMatch[1].trim();
-        if (!content) {
-            await sessionReply(rootId, t('role.set_empty', undefined, loc));
-            return;
-        }
-        writeRoleFile(larkAppId, chatId, content);
-        const len = Buffer.byteLength(content, 'utf-8');
-        await sessionReply(rootId, t('role.saved_via_cmd', { bytes: len, max: MAX_ROLE_BYTES }, loc));
-        return;
-    }
-    // /role delete
-    if (trimmed === 'delete' || trimmed === '删除') {
-        const existed = deleteRoleFile(larkAppId, chatId);
-        if (existed) {
-            await sessionReply(rootId, t('role.deleted_via_cmd', undefined, loc));
-        }
-        else {
-            await sessionReply(rootId, t('role.nothing_to_delete', undefined, loc));
-        }
-        return;
-    }
-    // /role help — fallback
-    await sessionReply(rootId, t('role.help', undefined, loc));
-}
-/**
- * Resolve the workingDir for a newly created scheduled task, mirroring the
- * layered lookup used by the normal new-session spawn path (see
- * `resolvePinnedWorkingDir` in daemon.ts) but STRICTLY read-only: it never
- * triggers the defaultOncall auto-bind side effect (which writes to bots.json).
- * Creating a schedule must not mutate oncall binding state.
- *
- * Priority:
- *   1) existing session workingDir (ds.workingDir — already pinned via /cd or
- *      a previously-applied oncall bind)
- *   2) this bot/chat oncall binding (read-only findOncallChat, no auto-bind)
- *   3) this bot's effective default working dir (defaultWorkingDir, or
- *      defaultOncall.workingDir when Oncall 模式 is on)
- *   4) legacy bot.config.workingDir
- *   5) '~'
- *
- * Deliberate deltas vs `resolvePinnedWorkingDir` (do NOT "sync" them away):
- *   - no sibling-inherit layer (findInheritablePeer) — a schedule needs a
- *     deterministic dir at create time, not whatever peer session happens to
- *     be open at that moment;
- *   - extra layers 4/5 — a schedule has no interactive repo-select card to
- *     fall back on, so it must always resolve to something;
- *   - every layer validates the candidate dir and falls through when it is
- *     stale (deleted/renamed): a dead path would otherwise be baked into
- *     schedules.json (workingDir is not editable afterwards) and every fire
- *     would silently spawn in $HOME. This includes layer 1 — a ds restored
- *     by restoreActiveSessions (worker:null) or idle-suspended keeps a
- *     workingDir no live process is running in, so it can be stale too.
- */
-function resolveScheduleWorkingDir(ds, chatId, larkAppId) {
-    // Validate candidates and fall through (returning the RAW form — keep `~`;
-    // expansion happens at fire time via getSessionWorkingDir), matching the
-    // other copies of this ladder (daemon resolveBotDefaultWorkingDir,
-    // trigger-session).
-    const usable = (dir, layer) => {
-        const v = validateWorkingDir(dir);
-        if (v.ok)
-            return true;
-        logger.warn(`[schedule] ${layer} workingDir "${dir}" invalid — falling through: ${v.error}`);
-        return false;
-    };
-    // Layer 1: existing session dir already pinned.
-    if (ds?.workingDir && usable(ds.workingDir, 'session'))
-        return ds.workingDir;
-    const appId = ds?.larkAppId ?? larkAppId;
-    // getBot() throws for unregistered ids — degrade to the '~' fallback
-    // instead of aborting the whole /schedule command.
-    let bot;
-    try {
-        bot = appId ? getBot(appId) : getAllBots()[0];
-    }
-    catch {
-        bot = undefined;
-    }
-    if (!bot)
-        return '~';
-    // Layer 2: oncall binding for this chat (read-only — does NOT auto-bind).
-    const oncallEntry = findOncallChat(bot.config.larkAppId, ds?.chatId ?? chatId);
-    if (oncallEntry?.workingDir && usable(oncallEntry.workingDir, 'oncall-binding')) {
-        return oncallEntry.workingDir;
-    }
-    // Layer 3: effective default working dir (defaultWorkingDir or
-    // defaultOncall.workingDir). Read-only — never writes state.
-    const effectiveDefault = effectiveDefaultWorkingDir(bot.config);
-    if (effectiveDefault && usable(effectiveDefault, 'effective-default'))
-        return effectiveDefault;
-    // Layer 4: legacy workingDir field.
-    if (bot.config.workingDir && usable(bot.config.workingDir, 'legacy'))
-        return bot.config.workingDir;
-    // Layer 5: home fallback.
-    return '~';
-}
-async function handleScheduleCommand(args, rootId, chatId, deps, larkAppId) {
-    const { activeSessions } = deps;
-    const sessionReply = (rid, content, msgType) => deps.sessionReply(rid, content, msgType, larkAppId);
-    const trimmed = args.trim();
-    const loc = localeForBot(larkAppId);
-    // Format dates using a locale that matches the user's UI choice. Both
-    // forms include the wall-clock components the user cares about; the
-    // difference is just punctuation and digit order.
-    const timeLocale = loc === 'en' ? 'en-US' : 'zh-CN';
-    const timeZone = scheduleTimeZone();
-    // /schedule list | /schedule 列表
-    if (!trimmed || trimmed === 'list' || trimmed === '列表') {
-        const tasks = scheduleStore.listTasks();
-        if (tasks.length === 0) {
-            await sessionReply(rootId, t('schedule.empty_with_examples', undefined, loc));
-            return;
-        }
-        const lines = tasks.map(task => {
-            const status = task.enabled ? '✅' : '⏸️';
-            const next = task.enabled ? scheduler.getNextRun(task.id) : null;
-            const nextStr = next ? t('schedule.next_label', { time: next.toLocaleString(timeLocale, { timeZone }) }, loc) : '';
-            const lastStr = task.lastRunAt ? t('schedule.last_label', { time: new Date(task.lastRunAt).toLocaleString(timeLocale, { timeZone }) }, loc) : '';
-            const display = task.parsed?.display ?? task.schedule;
-            return `${status} [${task.id}] ${display} | ${task.name}${task.silent ? ' 🔇' : ''}\n   prompt: ${task.prompt.substring(0, 50)}${task.prompt.length > 50 ? '...' : ''}${nextStr}${lastStr}`;
-        });
-        await sessionReply(rootId, `${t('schedule.list_header', { count: tasks.length }, loc)}\n\n${lines.join('\n\n')}`);
-        return;
-    }
-    // /schedule remove <id> | /schedule 删除 <id>
-    const removeMatch = trimmed.match(/^(?:remove|删除)\s+(\S+)/);
-    if (removeMatch) {
-        const id = removeMatch[1];
-        if (scheduler.removeTask(id)) {
-            await sessionReply(rootId, t('schedule.removed', { id }, loc));
-        }
-        else {
-            await sessionReply(rootId, t('schedule.not_found', { id }, loc));
-        }
-        return;
-    }
-    // /schedule enable <id> | /schedule 启用 <id>
-    const enableMatch = trimmed.match(/^(?:enable|启用)\s+(\S+)/);
-    if (enableMatch) {
-        const id = enableMatch[1];
-        if (scheduler.enableTask(id)) {
-            await sessionReply(rootId, t('schedule.enabled', { id }, loc));
-        }
-        else {
-            await sessionReply(rootId, t('schedule.not_found', { id }, loc));
-        }
-        return;
-    }
-    // /schedule disable <id> | /schedule 禁用 <id>
-    const disableMatch = trimmed.match(/^(?:disable|禁用)\s+(\S+)/);
-    if (disableMatch) {
-        const id = disableMatch[1];
-        if (scheduler.disableTask(id)) {
-            await sessionReply(rootId, t('schedule.disabled', { id }, loc));
-        }
-        else {
-            await sessionReply(rootId, t('schedule.not_found', { id }, loc));
-        }
-        return;
-    }
-    // /schedule run <id> | /schedule 执行 <id>
-    const runMatch = trimmed.match(/^(?:run|执行)\s+(\S+)/);
-    if (runMatch) {
-        const id = runMatch[1];
-        if (scheduler.runTaskNow(id)) {
-            await sessionReply(rootId, t('schedule.triggered_now', { id }, loc));
-        }
-        else {
-            await sessionReply(rootId, t('schedule.not_found', { id }, loc));
-        }
-        return;
-    }
-    // Natural language: /schedule 每日17:50给我"帮我看看AI新闻"
-    const parsed = scheduler.parseNaturalSchedule(trimmed);
-    if (parsed) {
-        const ds = larkAppId ? activeSessions.get(sessionKey(rootId, larkAppId)) : undefined;
-        const workingDir = resolveScheduleWorkingDir(ds, chatId, larkAppId);
-        const capturedScope = ds?.scope === 'chat' ? 'chat' : 'thread';
-        const capturedRootMessageId = capturedScope === 'thread' ? rootId : undefined;
-        const { executionPosition: requestedPosition, silent, prompt: schedPrompt } = scheduler.extractScheduleModifiers(parsed.prompt);
-        const executionPosition = requestedPosition
-            ?? (capturedScope === 'thread' ? 'topic' : 'top-level');
-        const taskScope = executionPosition === 'topic' ? 'thread' : 'chat';
-        const schedName = schedPrompt !== parsed.prompt
-            ? (schedPrompt.length > 20 ? schedPrompt.slice(0, 20) + '...' : schedPrompt)
-            : parsed.name;
-        const task = scheduler.addTask({
-            name: schedName,
-            schedule: trimmed,
-            parsed: parsed.parsed,
-            prompt: schedPrompt,
-            workingDir,
-            chatId,
-            // Retain the captured root even when top-level is selected so the task
-            // can later switch back to topic execution without losing its anchor.
-            rootMessageId: capturedRootMessageId,
-            scope: taskScope,
-            executionPosition,
-            chatType: ds?.chatType === 'p2p' ? 'p2p' : 'topic_group',
-            larkAppId,
-            deliver: 'origin',
-            silent,
-        });
-        const next = scheduler.getNextRun(task.id);
-        const nextStr = next ? next.toLocaleString(timeLocale, { timeZone }) : 'N/A';
-        const createdMsg = t('schedule.created', {
-            id: task.id,
-            name: task.name,
-            rule: parsed.parsed.display,
-            prompt: task.prompt,
-            dir: expandHome(workingDir),
-            next: nextStr,
-        }, loc);
-        const positionNote = '\n' + t(executionPosition === 'new-topic'
-            ? 'schedule.deliver_new_topic'
-            : executionPosition === 'top-level'
-                ? 'schedule.position_top_level'
-                : 'schedule.position_topic', undefined, loc);
-        const silentNote = silent ? '\n' + t('schedule.silent_note', undefined, loc) : '';
-        await sessionReply(rootId, createdMsg + positionNote + silentNote);
-        return;
-    }
-    // Unrecognized format
-    await sessionReply(rootId, t('schedule.parse_failed', undefined, loc));
-}
-// ─── Config command ──────────────────────────────────────────────────────────
-function configEffectNote(effect, loc) {
-    return effect === 'immediate'
-        ? t('cmd.config.effect_immediate', undefined, loc)
-        : t('cmd.config.effect_next_session', undefined, loc);
-}
-/** `/botconfig zh|en`（及常见别名）→ 卡片显示语言；非语言参数 → undefined（按子命令走）。 */
-function cardLocaleArg(sub) {
-    if (!sub)
-        return undefined;
-    if (sub === 'zh' || sub === 'cn' || sub === '中文' || sub === '中')
-        return 'zh';
-    if (sub === 'en' || sub === 'english' || sub === '英文' || sub === '英')
-        return 'en';
-    return undefined;
-}
-function buildConfigHelp(loc) {
-    const fields = CONFIG_FIELDS.map(f => `• ${f.key} — ${f.hint}`).join('\n');
-    return t('cmd.config.help', { fields }, loc);
-}
-function buildConfigSnapshot(larkAppId, loc) {
-    const snap = getConfigSnapshot(larkAppId);
-    if (!snap.ok)
-        return t('cmd.config.no_bot', undefined, loc);
-    const lines = snap.rows.map(r => `• ${r.key} = ${r.value}`).join('\n');
-    return t('cmd.config.snapshot', {
-        cli: snap.info.cliId,
-        brand: snap.info.brand,
-        admins: snap.info.resolvedAdmins,
-        dirs: snap.info.workingDirs.join(', ') || '∅',
-        fields: lines,
-    }, loc);
-}
-/**
- * `/botconfig set allowedUsers ...` —— 动信任根的敏感路径，与普通字段分开：
- * 末尾的 `确认`/`confirm` 才真正落盘；缺确认 → 回显预览要求二次确认。
- * 非法条目（裸邮箱前缀等）先挡；防自锁 / 解析空由 {@link setBotAllowedUsers} 兜底。
- */
-async function applyAllowedUsersSet(tokens, rootId, larkAppId, senderId, deps, loc) {
-    const reply = (c) => deps.sessionReply(rootId, c, undefined, larkAppId);
-    let list = [...tokens];
-    let confirmed = false;
-    if (list.length && /^(confirm|确认|yes|--yes)$/i.test(list[list.length - 1])) {
-        confirmed = true;
-        list = list.slice(0, -1);
-    }
-    const entries = list.join(' ').split(/[,\s]+/).map(s => s.trim()).filter(Boolean);
-    if (entries.length === 0) {
-        await reply(t('cmd.config.allow_usage', undefined, loc));
-        return;
-    }
-    const invalid = findInvalidAllowedUserEntries(entries);
-    if (invalid.length) {
-        await reply(t('cmd.config.allow_invalid', { items: invalid.join(', ') }, loc));
-        return;
-    }
-    if (!confirmed) {
-        await reply(t('cmd.config.allow_confirm', { list: entries.join(', ') }, loc));
-        return;
-    }
-    const r = await setBotAllowedUsers(larkAppId, entries, senderId);
-    if (!r.ok) {
-        if (r.reason === 'self_lockout') {
-            await reply(t('cmd.config.allow_lockout', undefined, loc));
-            return;
-        }
-        if (r.reason === 'empty_resolved') {
-            await reply(t('cmd.config.allow_empty', undefined, loc));
-            return;
-        }
-        await reply(t('cmd.config.write_failed', { reason: r.reason }, loc));
-        return;
-    }
-    await reply(t('cmd.config.allow_ok', { count: r.resolved.length, total: r.raw.length }, loc));
-}
-/**
- * `/botconfig` —— owner/allowedUsers 远程改本 bot 运营字段。sessionless：只认 larkAppId，
- * 不需活跃会话。严格 admin 闸（拒绝开放模式 bot），写盘 + 内存热更新，无需重启。
- */
-async function handleConfigCommand(message, rootId, larkAppId, deps) {
-    const loc = localeForBot(larkAppId);
-    const reply = (c) => deps.sessionReply(rootId, c, undefined, larkAppId);
-    const senderId = message.senderId;
-    // Admin 闸：严格限定 allowedUsers，**拒绝开放模式**（无 allowlist 的 bot 没有可
-    // 授权的 owner，不能凭聊天改配置）。上游 canOperate 对开放模式 / 兄弟 bot 也放行，
-    // 改配置比一般 daemon 命令敏感，这里收紧到「本 bot 的 allowedUsers」。
-    let bot;
-    try {
-        bot = getBot(larkAppId);
-    }
-    catch {
-        await reply(t('cmd.config.no_bot', undefined, loc));
-        return;
-    }
-    const admins = bot.resolvedAllowedUsers;
-    if (admins.length === 0) {
-        await reply(t('cmd.config.no_owner', undefined, loc));
-        return;
-    }
-    if (!senderId || !admins.includes(senderId)) {
-        await reply(t('cmd.config.not_admin', undefined, loc));
-        return;
-    }
-    const trimmed = message.content.replace(/^\/botconfig\s*/i, '').trim();
-    const parts = trimmed ? trimmed.split(/\s+/) : [];
-    const sub = parts[0]?.toLowerCase();
-    // 裸 /botconfig → 交互配置卡片；`/botconfig zh|en` → 指定卡片显示语言（覆盖 bot 默认）。
-    const cardLoc = cardLocaleArg(sub);
-    if (!sub || cardLoc) {
-        const renderLoc = cardLoc ?? loc;
-        // ttadk 网关 bot：模型候选用 ttadk 网关模型（glm-5.1…），不是底层适配器的
-        // opus/gpt-5（那会被 worker 注入成 `ttadk -m opus` 用错模型启动失败）；CoCo 无候选。
-        // 非 ttadk（返回 null）才回落底层适配器自己的 modelChoices。
-        const ttadkChoices = ttadkConfigModelChoices(bot.config.wrapperCli);
-        let modelChoices = ttadkChoices ?? [];
-        if (ttadkChoices === null) {
-            try {
-                modelChoices = createCliAdapterSync(bot.config.cliId, bot.config.cliPathOverride).modelChoices ?? [];
-            }
-            catch { /* 无候选 → 不渲染 model 下拉 */ }
-        }
-        const data = getConfigCardData(larkAppId, modelChoices);
-        if (!data) {
-            await reply(buildConfigHelp(renderLoc));
-            return;
-        }
-        const cardJson = buildConfigCard(data, renderLoc);
-        // 始终把卡片**私信**给 owner，群里不留任何回复：
-        //   • 私聊（单发给 bot）→ sendUserMessage 落在当前私聊 = 直接返回配置；
-        //   • 群 / 话题群 → 卡片落在 owner 私聊，群内不产生「话题回复」、也只他可见。
-        // 不再依赖 getChatModeStrict（它会偶发 500 → 误判）。
-        // 私信失败（owner 从未与 bot 开过单聊等）：**绝不**把整张配置卡回退到会话内——
-        // 在群/话题群里那会让 owner-only 的运营配置卡全员可见（按钮虽仍重验 admin 无法提权，
-        // 但卡片本身就违背「始终私信」意图）。只回一句简短文字引导去单聊后重试。
-        try {
-            await sendUserMessage(larkAppId, senderId, cardJson, 'interactive');
-        }
-        catch {
-            await reply(t('cmd.config.card_dm_failed', undefined, renderLoc));
-        }
-        return;
-    }
-    if (sub === 'help' || sub === '帮助') {
-        await reply(buildConfigHelp(loc));
-        return;
-    }
-    if (sub === 'get' || sub === 'show' || sub === 'list' || sub === '查看') {
-        await reply(buildConfigSnapshot(larkAppId, loc));
-        return;
-    }
-    if (sub === 'set' || sub === 'unset') {
-        const fieldKey = parts[1];
-        if (!fieldKey) {
-            await reply(t('cmd.config.set_usage', undefined, loc));
-            return;
-        }
-        const spec = findConfigField(fieldKey);
-        if (!spec) {
-            await reply(t('cmd.config.unknown_field', { field: fieldKey, fields: settableFieldKeys().join(', ') }, loc));
-            return;
-        }
-        if (sub === 'unset') {
-            if (!spec.clearable) {
-                await reply(t('cmd.config.not_clearable', { field: spec.key }, loc));
-                return;
-            }
-            const r = await applyConfigField(larkAppId, spec, null);
-            if (!r.ok) {
-                await reply(t('cmd.config.write_failed', { reason: r.reason }, loc));
-                return;
-            }
-            await reply(t('cmd.config.unset_ok', { field: spec.key, old: r.oldText, effect: configEffectNote(r.effect, loc) }, loc));
-            return;
-        }
-        // set
-        if (spec.kind === 'allowedUsers') {
-            await applyAllowedUsersSet(parts.slice(2), rootId, larkAppId, senderId, deps, loc);
-            return;
-        }
-        const rawValue = parts.slice(2).join(' ').trim();
-        if (!rawValue) {
-            await reply(t('cmd.config.value_required', { field: spec.key }, loc));
-            return;
-        }
-        let value;
-        switch (spec.kind) {
-            case 'stringList': {
-                // 与 card/config-store 路径（bot-config-store.ts 的 coerce）同口径：优先用
-                // 字段自带的 parseList——canTalkDaemonCommands / startupCommands 的解析规则
-                // 与默认的 parseCustomPassthroughInput 相反或不同，硬编码默认解析器会把
-                // 合法输入静默滤光成"空值"。
-                const arr = (spec.parseList ?? parseCustomPassthroughInput)(rawValue);
-                if (arr.length === 0) {
-                    await reply(t('cmd.config.value_required', { field: spec.key }, loc));
-                    return;
-                }
-                value = arr;
-                break;
-            }
-            case 'number': {
-                // 统一走 coerceConfigValue 的 number 校验（正整数），避免文字路径把 '6'
-                // 当字符串写进 maxLiveWorkers（与 card/API 路径同口径）。
-                const coerced = coerceConfigValue(spec, rawValue);
-                if (!coerced.ok) {
-                    await reply(t('cmd.config.invalid_number', { field: spec.key, value: rawValue }, loc));
-                    return;
-                }
-                value = coerced.value;
-                break;
-            }
-            case 'boolean': {
-                const b = parseBooleanValue(rawValue);
-                if (b === undefined) {
-                    await reply(t('cmd.config.invalid_bool', { field: spec.key, value: rawValue }, loc));
-                    return;
-                }
-                value = b;
-                break;
-            }
-            case 'enum': {
-                const v = rawValue.toLowerCase();
-                if (!spec.enumValues?.includes(v)) {
-                    await reply(t('cmd.config.invalid_enum', { field: spec.key, values: (spec.enumValues ?? []).join('|') }, loc));
-                    return;
-                }
-                value = v;
-                break;
-            }
-            case 'cli': {
-                try {
-                    const id = resolveCliId(rawValue);
-                    if (!id) {
-                        await reply(t('cmd.config.value_required', { field: spec.key }, loc));
-                        return;
-                    }
-                    value = id;
-                }
-                catch (e) {
-                    await reply(t('cmd.config.invalid_cli', { msg: e?.message ?? String(e) }, loc));
-                    return;
-                }
-                break;
-            }
-            case 'dir': {
-                const v = validateWorkingDir(rawValue, loc);
-                if (!v.ok) {
-                    await reply(v.error);
-                    return;
-                }
-                value = rawValue; // 存原始（保留 ~），与 workingDir 落盘一致；使用处再 expandHome
-                break;
-            }
-            case 'json': {
-                const coerced = coerceConfigValue(spec, rawValue);
-                if (!coerced.ok) {
-                    await reply(t('cmd.config.write_failed', { reason: coerced.reason }, loc));
-                    return;
-                }
-                value = coerced.value;
-                break;
-            }
-            default: { // 'string'
-                // 与 dashboard PUT 同口径：string 字段也过 coerceConfigValue（长度上限
-                // maxLen 等约束在 spec 上，避免 IM 文本入口绕过校验）。
-                const coerced = coerceConfigValue(spec, rawValue);
-                if (!coerced.ok) {
-                    await reply(t('cmd.config.write_failed', { reason: coerced.reason }, loc));
-                    return;
-                }
-                value = coerced.value;
-            }
-        }
-        const r = await applyConfigField(larkAppId, spec, value);
-        if (!r.ok) {
-            await reply(t('cmd.config.write_failed', { reason: r.reason }, loc));
-            return;
-        }
-        await reply(t('cmd.config.set_ok', { field: spec.key, old: r.oldText, new: r.newText, effect: configEffectNote(r.effect, loc) }, loc));
-        return;
-    }
-    await reply(t('cmd.config.unknown_sub', { sub }, loc));
-}
-// ─── Main command handler ────────────────────────────────────────────────────
-/**
- * Handle `/card` (operator-only). Resolves the active session itself, so off/on
- * work WITHOUT one -- they only toggle the per-chat `noCardChats` config. A
- * summon (show/bare) needs a live session.
- *
- * off  -> suppress the live streaming card for this chat (add to noCardChats);
- *         status falls back to master's pending-card morph.
- * on   -> restore cards for this chat (remove from noCardChats).
- * ''/show -> summon a live card. privateCard -> private ephemeral snapshot
- *         (fail closed on non-group); otherwise a group-visible live card.
- * off/on also clear `streamingCardForced` so a prior summon does not
- * short-circuit `streamingCardDisabled()`.
- */
-export async function handleCardCommand(rootId, larkAppId, chatId, senderOpenId, content, deps) {
-    const loc = localeForBot(larkAppId);
-    const reply = (c) => deps.sessionReply(rootId, c, undefined, larkAppId);
-    // /card is an operator command — gate on canOperate, the same model every other
-    // daemon command uses. Open mode (no owner/allowlist) → canOperate passes for
-    // everyone; configured → any allowedUser (owner or co-owner); talk-only grantees
-    // (chatGrant/globalGrant/oncall members) are never operators.
-    if (!canOperate(larkAppId, chatId, senderOpenId)) {
-        await reply(t('cmd.card.operator_only', undefined, loc));
-        return;
-    }
-    const ds = deps.activeSessions.get(sessionKey(rootId, larkAppId));
-    const sub = content.replace(/^\/card\s*/i, '').trim().toLowerCase();
-    if (sub === 'off') {
-        const r = await setCardMode(larkAppId, chatId, true);
-        if (ds)
-            ds.streamingCardForced = undefined;
-        await reply(r.ok ? t('cmd.card.off_ok', undefined, loc) : t('cmd.card.fail', { reason: r.reason }, loc));
-        return;
-    }
-    if (sub === 'on') {
-        const r = await setCardMode(larkAppId, chatId, false);
-        if (ds)
-            ds.streamingCardForced = undefined;
-        await reply(r.ok ? t('cmd.card.on_ok', undefined, loc) : t('cmd.card.fail', { reason: r.reason }, loc));
-        return;
-    }
-    if (sub === '' || sub === 'show') {
-        if (!ds) {
-            await reply(t('cmd.no_active_session', undefined, loc));
-            return;
-        }
-        if (getBot(ds.larkAppId).config.privateCard) {
-            const mode = await getChatModeStrict(ds.larkAppId, ds.chatId);
-            if (mode !== 'group') {
-                await reply(t('cmd.card.private_not_group', undefined, loc));
-                return;
-            }
-            const audience = resolvePrivateCardAudience(ds);
-            if (audience.length === 0) {
-                await reply(t('cmd.card.private_no_audience', undefined, loc));
-                return;
-            }
-            const r = await postPrivateSnapshotCard(ds, audience);
-            if (r.notReady) {
-                await reply(t('cmd.card.private_not_ready', undefined, loc));
-            }
-            else if (r.sent === 0) {
-                await reply(t('cmd.card.private_failed', undefined, loc));
-            }
-            else if (r.sent < r.total) {
-                await reply(t('cmd.card.private_partial', { sent: r.sent, total: r.total }, loc));
-            }
-            return;
-        }
-        ds.streamingCardForced = true;
-        const posted = await postFreshStreamingCard(ds, deps.sessionReply);
-        if (!posted)
-            await reply(t('cmd.card.not_ready', undefined, loc));
-        return;
-    }
-    await reply(t('cmd.card.usage', undefined, loc));
-}
-/**
- * Handle `/term` (operator-only) — the slash-command twin of the "🔑 获取操作链接"
- * card button. Privately hands the operator a writable (token-bearing) terminal
- * card: an in-chat visible-to-you ephemeral card in plain groups, auto-falling back
- * to a DM in topic / p2p chats. The link rides only that private channel — never the
- * group. Gated identically to /card (`canOperate`), and strictly needs a live
- * session whose terminal is up. Routed for both the new-topic path (daemon.ts) and
- * the existing-session switch below.
- */
-export async function handleTermLinkCommand(rootId, larkAppId, chatId, senderOpenId, _content, deps) {
-    const loc = localeForBot(larkAppId);
-    const reply = (c) => deps.sessionReply(rootId, c, undefined, larkAppId);
-    // /term is an operator command that hands out a *writable* terminal link — gate
-    // on canOperate (same model as other daemon commands). senderOpenId must be
-    // present: open-mode canOperate passes even an undefined sender, but the writable
-    // card is delivered privately to that exact open_id.
-    if (!senderOpenId || !canOperate(larkAppId, chatId, senderOpenId)) {
-        await reply(t('cmd.term.operator_only', undefined, loc));
-        return;
-    }
-    const ds = deps.activeSessions.get(sessionKey(rootId, larkAppId));
-    if (!ds) {
-        await reply(t('cmd.term.no_session', undefined, loc));
-        return;
-    }
-    const channel = await deliverWritableTerminalCardTo(ds, senderOpenId);
-    if (channel === 'unsupported') {
-        await reply(t('cmd.term.unsupported', undefined, loc));
-    }
-    else if (channel === 'not_ready') {
-        await reply(t('cmd.term.not_ready', undefined, loc));
-    }
-    else if (channel === 'failed') {
-        await reply(t('cmd.term.failed', undefined, loc));
-    }
-    else if (channel === 'dm') {
-        // The card landed in DM (topic / p2p) — nothing showed in the topic, so drop a
-        // visible breadcrumb pointing the owner at their DM. (No token, safe to show.)
-        await reply(t('cmd.term.sent_dm', undefined, loc));
-    }
-    // channel === 'ephemeral': the visible-to-you card IS the response; no extra msg.
-}
-/** Format a SafeInsightReport into a compact owner-facing summary for the
- *  `/insight` command. Spans are never rendered here — the dashboard Insight tab
- *  owns span detail; the chat card stays a one-glance summary (aggregate + the
- *  severity-sorted rule suggestions, top first). */
-function formatInsightCard(report, loc) {
-    if (report.status === 'unsupported_cli')
-        return t('cmd.insight.unsupported', undefined, loc);
-    if (report.status === 'transcript_missing')
-        return t('cmd.insight.no_transcript', undefined, loc);
-    if (report.status !== 'ok')
-        return t('cmd.insight.parse_error', undefined, loc);
-    const a = report.agg;
-    if (a.totalSpans === 0)
-        return t('cmd.insight.no_spans', undefined, loc);
-    const icon = (s) => (s === 'bad' ? '🔴' : s === 'warn' ? '🟡' : 'ℹ️');
-    const header = t('cmd.insight.header', undefined, loc);
-    const lines = [report.meta.asOf ? `${header} · ${report.meta.asOf}` : header];
-    lines.push(t('cmd.insight.metrics_line', {
-        total: String(a.totalSpans),
-        failed: String(a.failedSpans),
-        slow: String(a.slowSpans),
-        rw: a.readWriteRatio === null ? '—' : String(a.readWriteRatio),
-        compactions: String(a.compactions),
-    }, loc));
-    lines.push('', `${t('cmd.insight.suggestions_label', undefined, loc)}:`);
-    for (const s of report.suggestions) {
-        lines.push(`${icon(s.severity)} ${s.title} — ${s.action}`);
-        if (s.evidence.length)
-            lines.push(`   · ${s.evidence.join('；')}`);
-    }
-    return lines.join('\n');
-}
-export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
-    const { activeSessions, getActiveCount, lastRepoScan } = deps;
-    // Command replies carry the triggering messageId as the turnId so a shared
-    // (chat-scope) session triggered from inside a Lark thread anchors them into
-    // that thread (resolveSessionReplyTarget turnId gate) instead of leaking a
-    // plain top-level message.
-    const sessionReply = (rid, content, msgType) => deps.sessionReply(rid, content, msgType, larkAppId, message.messageId);
-    const ds = larkAppId ? activeSessions.get(sessionKey(rootId, larkAppId)) : undefined;
-    const logTag = ds ? tag(ds) : rootId.substring(0, 12);
-    const loc = localeForBot(ds?.larkAppId ?? larkAppId);
-    logger.info(`[${logTag}] Command: ${cmd}`);
-    logger.debug(`repo command`, message);
-    try {
-        switch (cmd) {
-            case '/close': {
-                if (ds) {
-                    // Capture the closed-session card BEFORE killWorker/closeSession —
-                    // it reads the live session's identity off `ds`.
-                    const card = buildClosedSessionCard(ds, loc);
-                    const activeKey = sessionKey(rootId, larkAppId);
-                    try {
-                        await closeSession(ds.session.sessionId);
-                    }
-                    catch (err) {
-                        logger.error(`[${logTag}] Refused /close because backing teardown was not verified: ${err}`);
-                        await sessionReply(rootId, `⚠️ 会话关闭失败，已保留 active 记录以便重试：${err instanceof Error ? err.message : String(err)}`);
-                        break;
-                    }
-                    if (activeSessions.get(activeKey) === ds)
-                        activeSessions.delete(activeKey);
-                    // 「会话已关闭」卡片优先「仅自己可见」：普通群里走 ephemeral 只发给执行
-                    // /close 的本人；话题群不支持 ephemeral(18053) 时回退为正常的群内可见回复
-                    // ——与流式卡片上「关闭会话」按钮的送达方式保持一致。
-                    await deliverEphemeralOrReply(ds, message.senderId, card, 'interactive', () => sessionReply(rootId, card, 'interactive'));
-                    logger.info(`[${logTag}] Session closed by /close command`);
-                }
-                else {
-                    await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
-                }
-                break;
-            }
-            case '/insight': {
-                if (!ds) {
-                    await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
-                    break;
-                }
-                // owner-only：与 /card /term 同一 operator 门（开放模式下 owner 通过；
-                // 仅对话授权的 grantee 不算 operator）。无权限直接不回内容。
-                if (!canOperate(larkAppId, ds.chatId, message.senderId)) {
-                    await sessionReply(rootId, t('cmd.insight.operator_only', undefined, loc));
-                    break;
-                }
-                // 卡片只取 summary（聚合 + 规则建议）；span 明细留给 dashboard Insight tab。
-                // buildSafeInsightReport 同步、只读、自带 fail-closed 脱敏，raw 永不进结构。
-                const report = buildSafeInsightReport({
-                    cliId: ds.session.cliId ?? 'unknown',
-                    sessionId: ds.session.sessionId,
-                    cliSessionId: ds.session.cliSessionId,
-                    cwd: ds.session.workingDir,
-                    larkAppId: ds.larkAppId ?? ds.session.larkAppId,
-                }, { detail: 'summary' });
-                await sessionReply(rootId, formatInsightCard(report, loc));
-                break;
-            }
-            case '/detach':
-            case '/disconnect': {
-                // 文字版的"⏏ 断开"按钮：仅 adopt 会话适用——botmux 只是观察用户原本在
-                // 跑的 CLI，断开只清掉 botmux 这一侧的 worker / polling，绝不结束 CLI
-                // 进程本身。等价于 card-handler 里 `actionType === 'disconnect'` 那段。
-                if (!ds) {
-                    await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
-                    break;
-                }
-                if (!ds.adoptedFrom) {
-                    await sessionReply(rootId, t('cmd.detach.not_adopted', undefined, loc));
-                    break;
-                }
-                const closedSessionId = ds.session.sessionId;
-                killWorker(ds);
-                sessionStore.closeSession(closedSessionId);
-                publishClosedSessionPatch(closedSessionId, ds.session.closedAt ? Date.parse(ds.session.closedAt) : undefined);
-                activeSessions.delete(sessionKey(rootId, larkAppId));
-                await sessionReply(rootId, t('cmd.detach.success', undefined, loc));
-                logger.info(`[${logTag}] Detached (adopt) by ${cmd} command`);
-                break;
-            }
-            case '/restart': {
-                if (ds) {
-                    if (ds.adoptedFrom) {
-                        await sessionReply(rootId, t('card.action.adopt_no_restart', undefined, loc));
-                        break;
-                    }
-                    if (isSessionTransferring(ds)) {
-                        await sessionReply(rootId, t('cmd.session.transfer_in_progress', undefined, loc));
-                        break;
-                    }
-                    const cliName = sessionCliDisplayName(ds);
-                    requestSessionRestart(ds, {
-                        source: 'slash',
-                        notify: async (status) => {
-                            await sessionReply(rootId, t(`cmd.restart.${status}`, { cliName }, loc));
-                        },
-                    });
-                    logger.info(`[${logTag}] Restart by /restart command`);
-                }
-                else {
-                    await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
-                }
-                break;
-            }
-            case '/cd': {
-                const targetPath = message.content.replace(/^\/cd\s*/, '').trim();
-                if (!targetPath) {
-                    await sessionReply(rootId, t('cmd.cd.usage', undefined, loc));
-                    break;
-                }
-                if (!ds) {
-                    await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
-                    break;
-                }
-                if (isSessionTransferring(ds)) {
-                    await sessionReply(rootId, t('cmd.session.transfer_in_progress', undefined, loc));
-                    break;
-                }
-                const validation = validateWorkingDir(targetPath, loc, { autoCreate: true });
-                if (!validation.ok) {
-                    await sessionReply(rootId, validation.error);
-                    break;
-                }
-                const resolvedPath = validation.resolvedPath;
-                // Persistent backends can cold-resume without treating a cwd switch as
-                // a real session close. This also preserves a sandbox upper long enough
-                // for the next worker to relocate Claude's cwd-scoped transcript.
-                // Adopted sessions are observers of a user-owned CLI and keep the old
-                // detach/kill behavior; PTY falls back to killWorker, while its normal
-                // on-disk transcript remains available for the resume-sync preflight.
-                const suspended = !ds.adoptedFrom && suspendWorker(ds, 'working_dir_changed');
-                if (!suspended)
-                    killWorker(ds);
-                repinSessionWorkingDir(ds, resolvedPath);
-                if (validation.created) {
-                    await sessionReply(rootId, t('cmd.cd.created_switched', { path: resolvedPath }, loc));
-                }
-                else {
-                    await sessionReply(rootId, t('cmd.cd.switched', { path: resolvedPath }, loc));
-                }
-                logger.info(`[${logTag}] Working directory changed to ${resolvedPath} by /cd command${validation.created ? ' (auto-created)' : ''}`);
-                break;
-            }
-            case '/rename': {
-                if (!ds) {
-                    await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
-                    break;
-                }
-                const rawTitle = message.content.replace(/^\/rename\s*/i, '').trim();
-                if (!rawTitle) {
-                    await sessionReply(rootId, t('cmd.rename.usage', undefined, loc));
-                    break;
-                }
-                const updated = updateSessionTitle(ds.session, rawTitle, 'user');
-                if (!updated.ok) {
-                    await sessionReply(rootId, t('cmd.rename.usage', undefined, loc));
-                    break;
-                }
-                const agentSync = requestAgentSessionRename(ds, updated.title);
-                const cliName = sessionCliDisplayName(ds);
-                if (agentSync.status === 'requested') {
-                    await sessionReply(rootId, t('cmd.rename.updated_requested', { title: updated.title, cliName }, loc));
-                }
-                else if (agentSync.status === 'not_running') {
-                    await sessionReply(rootId, t('cmd.rename.updated_not_running', { title: updated.title }, loc));
-                }
-                else if (agentSync.status === 'unsupported') {
-                    await sessionReply(rootId, t('cmd.rename.updated_unsupported', { title: updated.title, cliName }, loc));
-                }
-                else {
-                    await sessionReply(rootId, t('cmd.rename.updated_failed', { title: updated.title, cliName }, loc));
-                    logger.warn(`[${logTag}] Native session rename request failed for ${cliName}: ${agentSync.error}`);
-                }
-                logger.info(`[${logTag}] Session renamed by /rename: ${updated.title} (agentSync=${agentSync.status})`);
-                break;
-            }
-            case '/repo': {
-                const repoArg = message.content.replace(/^\/repo\s*/, '').trim();
-                // First-spawn fork: consume the buffered prompt/attachments and start the
-                // CLI in whatever workingDir is currently set on the session. Shared by
-                // `commitRepoSelection` (a repo was named) and the bare-`/repo` launch
-                // (use the default workingDir) — both only run while `pendingRepo`.
-                const forkPendingCli = async (replyText, claimAlready = false) => {
-                    if (!claimAlready) {
-                        if (ds.pendingRepoCommitInFlight) {
-                            await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
-                            return false;
-                        }
-                        ds.pendingRepoCommitInFlight = true;
-                    }
-                    const selfBot = getBot(ds.larkAppId);
-                    const botCfg = selfBot.config;
-                    const commitGenSessionId = ds.session.sessionId;
-                    let committed = false;
-                    try {
-                        // Keep pendingRepo=true while prompt context is awaited. Incoming
-                        // messages stay in the same buffer and card selections see the
-                        // shared in-flight claim instead of treating this as a repo switch.
-                        const initiallyBuffered = (ds.pendingPrompt?.trim().length ?? 0) > 0 ||
-                            (ds.pendingAttachments?.length ?? 0) > 0 ||
-                            (ds.pendingFollowUps?.length ?? 0) > 0 ||
-                            ds.pendingChatContext !== undefined;
-                        const availableBots = initiallyBuffered
-                            ? await getAvailableBots(ds.larkAppId, ds.chatId)
-                            : [];
-                        const stillActive = activeSessions.get(sessionKey(rootId, larkAppId)) === ds;
-                        if (!stillActive || ds.session.sessionId !== commitGenSessionId ||
-                            !ds.pendingRepo || (ds.worker && !ds.worker.killed)) {
-                            logger.warn(`[${logTag}] Session changed while preparing the pending CLI (${commitGenSessionId} → ${ds.session.sessionId}, active=${stillActive}, pending=${!!ds.pendingRepo}, worker=${!!ds.worker})`);
-                            return false;
-                        }
-                        const pendingPrompt = ds.pendingPrompt ?? '';
-                        const pendingRawInput = ds.pendingRawInput;
-                        const hasBufferedInput = pendingPrompt.trim().length > 0 ||
-                            (ds.pendingAttachments?.length ?? 0) > 0 ||
-                            (ds.pendingFollowUps?.length ?? 0) > 0 ||
-                            ds.pendingChatContext !== undefined;
-                        // Nothing to submit at all (bare `/repo`: the message IS the command).
-                        // The CLI boots idle, so the user's NEXT real message is its first
-                        // turn and must carry the full new-topic opening — see
-                        // markInitialUserTurnPending below.
-                        const emptyStart = !pendingRawInput && !hasBufferedInput;
-                        if (hasBufferedInput)
-                            ensureSessionWhiteboard(ds);
-                        const wrappedInput = hasBufferedInput
-                            ? buildNewTopicCliInput(pendingPrompt, ds.session.sessionId, ds.session.cliId ?? botCfg.cliId, ds.session.cliPathOverride ?? botCfg.cliPathOverride, ds.pendingAttachments, ds.pendingMentions, availableBots, ds.pendingFollowUps, { name: selfBot.botName, openId: selfBot.botOpenId }, loc, ds.pendingSender, {
-                                larkAppId,
-                                chatId: ds.chatId,
-                                whiteboardId: ds.session.whiteboardId,
-                                substituteTrigger: ds.pendingSubstituteTrigger,
-                                codexAppText: ds.pendingCodexAppText,
-                                codexAppApplicationContext: ds.pendingCodexAppApplicationContext,
-                                codexAppMessageContext: ds.pendingCodexAppMessageContext,
-                                codexAppFollowUps: ds.pendingCodexAppFollowUps,
-                                codexAppFollowUpContexts: ds.pendingCodexAppFollowUpContexts,
-                                chatContext: ds.pendingChatContext,
-                            })
-                            : { content: '' };
-                        const pendingTurnId = ds.pendingTurnId;
-                        const previousPendingFollowUpInput = ds.pendingFollowUpInput;
-                        if (pendingRawInput && hasBufferedInput) {
-                            ds.pendingFollowUpInput = {
-                                userPrompt: ds.pendingCodexAppText !== undefined || ds.pendingCodexAppFollowUps
-                                    ? [ds.pendingCodexAppText ?? '', ...(ds.pendingCodexAppFollowUps ?? [])].filter(Boolean).join('\n\n')
-                                    : pendingPrompt || ds.pendingFollowUps?.join('\n\n') || '',
-                                cliInput: wrappedInput.content,
-                                ...(ds.pendingFollowUpTurnId ? { turnId: ds.pendingFollowUpTurnId } : {}),
-                                ...((ds.session.cliId ?? botCfg.cliId) === 'codex-app' && botCfg.codexAppCleanInput === true && wrappedInput.codexAppInput
-                                    ? { codexAppInput: wrappedInput.codexAppInput }
-                                    : {}),
-                                codexAppInputGateFrozen: true,
-                            };
-                        }
-                        ds.pendingRepo = false;
-                        publishAttentionPatch(ds);
-                        try {
-                            if (pendingRawInput)
-                                forkWorker(ds, '', false);
-                            else if (pendingTurnId && hasBufferedInput)
-                                forkWorker(ds, wrappedInput, { turnId: pendingTurnId });
-                            else if (hasBufferedInput)
-                                forkWorker(ds, wrappedInput);
-                            else
-                                forkWorker(ds, '', false);
-                        }
-                        catch (e) {
-                            ds.pendingRepo = true;
-                            ds.pendingFollowUpInput = previousPendingFollowUpInput;
-                            publishAttentionPatch(ds);
-                            throw e;
-                        }
-                        if (pendingRawInput || hasBufferedInput) {
-                            rememberLastCliInput(ds, pendingRawInput ?? pendingPrompt, pendingRawInput ?? wrappedInput);
-                        }
-                        // Durable, one-shot: the CLI is up but has never received a real user
-                        // turn, so the next business message must be built as a NEW TOPIC
-                        // (routing + built-in skill discovery + identity), not a follow-up.
-                        // Set after the fork so a throwing fork leaves the session untouched.
-                        if (emptyStart)
-                            markInitialUserTurnPending(ds);
-                        ds.pendingPrompt = undefined;
-                        ds.pendingCodexAppText = undefined;
-                        ds.pendingCodexAppApplicationContext = undefined;
-                        ds.pendingCodexAppMessageContext = undefined;
-                        ds.pendingChatContext = undefined;
-                        ds.pendingAttachments = undefined;
-                        ds.pendingMentions = undefined;
-                        ds.pendingSubstituteTrigger = undefined;
-                        ds.pendingSender = undefined;
-                        ds.pendingFollowUps = undefined;
-                        ds.pendingCodexAppFollowUps = undefined;
-                        ds.pendingCodexAppFollowUpContexts = undefined;
-                        ds.pendingFollowUpTurnId = undefined;
-                        ds.pendingTurnId = undefined;
-                        committed = true;
-                        // Local one-shot consume BEFORE network awaits. Feishu withdraw is
-                        // best-effort; stale card clicks must be rejected via this mark even
-                        // if sessionReply throws or deleteMessage lags/fails.
-                        const cardToWithdraw = ds.repoCardMessageId;
-                        markRepoCardConsumed(ds, cardToWithdraw);
-                        ds.repoCardMessageId = undefined;
-                        // Hold the claim through confirmation + best-effort card withdraw.
-                        try {
-                            await sessionReply(rootId, replyText);
-                        }
-                        catch (e) {
-                            logger.warn(`[${logTag}] Confirm reply after pending repo commit failed: ${e instanceof Error ? e.message : e}`);
-                        }
-                        if (cardToWithdraw) {
-                            try {
-                                await deleteMessage(ds.larkAppId, cardToWithdraw);
-                            }
-                            catch { /* best-effort */ }
-                        }
-                    }
-                    finally {
-                        ds.pendingRepoCommitInFlight = false;
-                    }
-                    return committed;
-                };
-                // Shared commit path for an already-resolved repo: update the session's
-                // working dir, then either fork into the pending CLI (first spawn) or
-                // close + recreate the session (mid-session switch). Used by both the
-                // numeric `/repo <N>` form and the `/repo <path|name>` form.
-                const commitRepoSelection = async (selectedPath, displayName, how) => {
-                    if (ds.pendingRepo) {
-                        if (ds.pendingRepoCommitInFlight) {
-                            await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
-                            return false;
-                        }
-                        ds.pendingRepoCommitInFlight = true;
-                        try {
-                            // Claim before changing cwd so a card selection cannot overwrite
-                            // this choice while the pending prompt is prepared.
-                            ds.workingDir = selectedPath;
-                            ds.session.workingDir = selectedPath;
-                            ds.session.riffRepoDirs = undefined;
-                            sessionStore.updateSession(ds.session);
-                            // forkPendingCli owns claim release + confirm reply + card withdraw.
-                            if (!await forkPendingCli(t('cmd.repo.selected_in_pending', { name: displayName }, loc), true)) {
-                                return false;
-                            }
-                        }
-                        catch (e) {
-                            ds.pendingRepoCommitInFlight = false;
-                            throw e;
-                        }
-                    }
-                    else {
-                        // Safety net: a mid-session `/repo` switch closes the running
-                        // session and spawns a fresh one on the SAME anchor. Without a
-                        // trace, the old context silently vanishes (relay/adopt/resume all
-                        // hit `anchor_occupied` once the new session holds the anchor).
-                        // So, before displacing it, post the same "session closed" card
-                        // `/close` emits — it keeps the old session visible and carries the
-                        // terminal `claude --resume` command. (Its in-card resume button
-                        // still hits anchor_occupied while the new session occupies this
-                        // anchor — expected; `/close` the new one first, or use the
-                        // command.) Mirrors the `/close` case above.
-                        //
-                        // ZMX close is identity/generation verified and may refuse. Prove
-                        // teardown before claiming the card or mutating any state so a
-                        // refusal leaves the current session fully retryable.
-                        try {
-                            teardownAuthoritativePersistentBackingBeforeClose(ds);
-                        }
-                        catch (err) {
-                            const reason = err instanceof Error ? err.message : String(err);
-                            logger.warn(`[${logTag}] Repo switch refused because backing teardown was not proven: ${reason}`);
-                            await sessionReply(rootId, t('cmd.repo.switch_close_failed', { error: reason }, loc));
-                            return false;
-                        }
-                        // Claim any open repo card BEFORE killWorker / await so a concurrent
-                        // card click cannot double-switch while this text path runs.
-                        //
-                        // The new cwd is NOT written onto the old session here — it would
-                        // pollute the displaced session's stored workingDir (and the closed
-                        // card), so `claude --resume` later would reopen the old context in
-                        // the new repo's cwd. The new repo is pinned onto the fresh session
-                        // below instead.
-                        const claimedCard = claimCurrentRepoCard(ds, undefined);
-                        const oldSession = ds.session;
-                        const oldSessionId = oldSession.sessionId;
-                        const closedCard = buildClosedSessionCard(ds, loc);
-                        killWorker(ds);
-                        sessionStore.closeSession(ds.session.sessionId);
-                        publishClosedSessionPatch(ds.session.sessionId, ds.session.closedAt ? Date.parse(ds.session.closedAt) : undefined);
-                        await deliverEphemeralOrReply(ds, message.senderId, closedCard, 'interactive', () => sessionReply(rootId, closedCard, 'interactive'));
-                        const stillOwnsGeneration = activeSessions.get(sessionKey(rootId, larkAppId)) === ds
-                            && ds.session === oldSession;
-                        if (!stillOwnsGeneration) {
-                            logger.warn(`[${logTag}] Repo switch cancelled after closing ${oldSessionId.substring(0, 8)}; routing generation changed during card delivery`);
-                            return false;
-                        }
-                        // `rootId` is the routing anchor. For chat-scope sessions it is the
-                        // `oc_...` chat id, not the traceable `om_...` message root stored on
-                        // Session. Preserve the old identity and explicitly persist scope so
-                        // repo switches cannot turn a chat session into a legacy scope-less
-                        // record that the CLI later mistakes for a thread.
-                        const session = sessionStore.createSession(ds.chatId, ds.scope === 'chat' ? oldSession.rootMessageId : rootId, displayName, ds.chatType, ds.scope);
-                        ds.session = session;
-                        ds.lastUserPrompt = undefined;
-                        ds.lastCliInput = undefined;
-                        ds.workingDir = selectedPath;
-                        ds.session.workingDir = selectedPath;
-                        ds.session.larkAppId = ds.larkAppId;
-                        ds.session.chatDisplayName = oldSession.chatDisplayName;
-                        ds.session.ownerOpenId = oldSession.ownerOpenId;
-                        ds.session.creatorOpenId = oldSession.creatorOpenId;
-                        ds.session.lastCallerOpenId = oldSession.lastCallerOpenId;
-                        sessionStore.updateSession(ds.session);
-                        ds.hasHistory = false;
-                        forkWorker(ds, '', false);
-                        // Brand-new CLI in a brand-new session record: it has never seen the
-                        // botmux opening context either, so the next real business message
-                        // is its new-topic first turn (same invariant as the pending path).
-                        markInitialUserTurnPending(ds);
-                        try {
-                            await sessionReply(rootId, t('cmd.repo.switched_to', { name: displayName }, loc));
-                        }
-                        catch (e) {
-                            logger.warn(`[${logTag}] Confirm reply after mid-session repo switch failed: ${e instanceof Error ? e.message : e}`);
-                        }
-                        if (claimedCard) {
-                            try {
-                                await deleteMessage(ds.larkAppId, claimedCard);
-                            }
-                            catch { /* best-effort */ }
-                        }
-                    }
-                    logger.info(`[${logTag}] Repo selected via ${how}: ${selectedPath}`);
-                    return true;
-                };
-                // `/repo wt <N|name|path> [branch]` → create a worktree off the repo's
-                // remote default branch and open THAT as the session repo. Without a
-                // branch arg the branch/dir are auto-named from the topic title / first
-                // pending prompt when possible (fallback: wt/N, <repo>-wt-N).
-                if (ds && /^wt(\s|$)/i.test(repoArg)) {
-                    const rest = repoArg.replace(/^wt\s*/i, '').trim().split(/\s+/).filter(Boolean);
-                    if (rest.length < 1 || rest.length > 2) {
-                        await sessionReply(rootId, t('cmd.repo.worktree_usage', undefined, loc));
-                        break;
-                    }
-                    const [targetArg, branchArg] = rest;
-                    let repoPath;
-                    if (/^\d+$/.test(targetArg)) {
-                        const cached = lastRepoScan.get(ds.chatId);
-                        if (!cached || cached.length === 0) {
-                            await sessionReply(rootId, t('cmd.repo.no_prior_scan', undefined, loc));
-                            break;
-                        }
-                        const repoIndex = parseInt(targetArg, 10);
-                        if (repoIndex < 1 || repoIndex > cached.length) {
-                            await sessionReply(rootId, t('cmd.repo.index_out_of_range', { max: cached.length }, loc));
-                            break;
-                        }
-                        repoPath = cached[repoIndex - 1].path;
-                    }
-                    else {
-                        const resolved = resolveRepoSelection(targetArg, getProjectScanDirs(ds));
-                        if (!resolved) {
-                            await sessionReply(rootId, t('cmd.repo.path_not_found', { arg: targetArg }, loc));
-                            break;
-                        }
-                        repoPath = resolved.path;
-                    }
-                    if (ds.worktreeCreating || ds.pendingRepoCommitInFlight) {
-                        await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
-                        break;
-                    }
-                    ds.worktreeCreating = true;
-                    // Session generation snapshot — another selection can land while the
-                    // (awaited) git fetch runs; committing afterwards would kill the
-                    // session it just spawned. Mirror of the card-side guard.
-                    const startSessionId = ds.session.sessionId;
-                    const wasPending = !!ds.pendingRepo;
-                    // Identity against the active map catches `/close` (which deletes
-                    // the entry without touching sessionId/pendingRepo) alongside the
-                    // generation snapshots.
-                    const wtSessionChanged = () => activeSessions.get(sessionKey(rootId, larkAppId)) !== ds ||
-                        ds.session.sessionId !== startSessionId || !!ds.pendingRepo !== wasPending;
-                    // Hold the in-flight lock through commit (matching the card path) —
-                    // releasing it right after `git` would let a second `/repo wt` start
-                    // while this one is still replying/committing.
-                    try {
-                        await sessionReply(rootId, t('cmd.repo.worktree_creating', { repo: repoPath }, loc));
-                        let creation;
-                        try {
-                            const slug = branchArg ? undefined : await worktreeSlugFromContextAI(ds.session.title, ds.pendingPrompt);
-                            creation = await createRepoWorktree(repoPath, {
-                                branch: branchArg,
-                                slug,
-                            });
-                        }
-                        catch (e) {
-                            await sessionReply(rootId, t('cmd.repo.worktree_failed', { error: e instanceof Error ? e.message : String(e) }, loc));
-                            break;
-                        }
-                        if (wtSessionChanged()) {
-                            logger.info(`[${logTag}] Worktree ${creation.path} created but session changed mid-flight — not switching`);
-                            await sessionReply(rootId, t('cmd.repo.worktree_created_not_switched', { path: creation.path, branch: creation.branch }, loc));
-                            break;
-                        }
-                        const botCfg = getBot(ds.larkAppId).config;
-                        const effectiveBackend = resolvePairedSpawnBackendType(wasPending ? (ds.session.cliId ?? botCfg.cliId) : botCfg.cliId, wasPending ? ds.session.backendType : undefined, botCfg.backendType, config.daemon.backendType);
-                        if (effectiveBackend === 'riff') {
-                            try {
-                                await pushWorktreeBranch(creation.path, creation.branch);
-                            }
-                            catch (e) {
-                                const errMsg = e instanceof Error ? e.message : String(e);
-                                logger.warn(`[${logTag}] riff worktree branch push failed (${creation.branch}): ${errMsg}`);
-                                await sessionReply(rootId, t('card.repo.riff_worktree_push_failed', { branch: creation.branch, error: errMsg }, loc));
-                            }
-                        }
-                        await sessionReply(rootId, t('cmd.repo.worktree_created', {
-                            path: creation.path, branch: creation.branch, base: creation.baseRef,
-                        }, loc));
-                        // The reply above awaited a Lark round-trip — a plain selection
-                        // (not gated by worktreeCreating) can land in that window. Re-check
-                        // right before committing. Mirror of the card-side double guard.
-                        if (wtSessionChanged()) {
-                            logger.info(`[${logTag}] Worktree ${creation.path} created but session changed during reply — not switching`);
-                            await sessionReply(rootId, t('cmd.repo.worktree_created_not_switched', { path: creation.path, branch: creation.branch }, loc));
-                            break;
-                        }
-                        try {
-                            await commitRepoSelection(creation.path, `${basename(creation.path)} (${creation.branch})`, `/repo wt`);
-                        }
-                        catch (e) {
-                            // The worktree DOES exist — only the switch failed. Don't report
-                            // it as a creation failure, or a retry trips over "already exists".
-                            logger.warn(`[${logTag}] Worktree ${creation.path} created but switching failed: ${e instanceof Error ? e.message : e}`);
-                            await sessionReply(rootId, t('cmd.repo.worktree_switch_failed', { path: creation.path, error: e instanceof Error ? e.message : String(e) }, loc));
-                        }
-                    }
-                    finally {
-                        ds.worktreeCreating = false;
-                    }
-                    break;
-                }
-                // Plain selections are blocked while a worktree creation/commit is in
-                // flight: the worktree commit awaits (Lark replies, prompt prep) after
-                // its generation checks, and a plain selection interleaving there
-                // would double-fork. One lock gates both kinds until the commit
-                // settles. (Bare `/repo` without pending only posts the picker card —
-                // harmless, so it stays open.)
-                if ((ds?.worktreeCreating || ds?.pendingRepoCommitInFlight) && (repoArg || ds?.pendingRepo)) {
-                    await sessionReply(rootId, t('cmd.repo.worktree_in_progress', undefined, loc));
-                    break;
-                }
-                // Numeric arg → pick by 1-based index from the last scan.
-                if (repoArg && ds && /^\d+$/.test(repoArg)) {
-                    const repoIndex = parseInt(repoArg, 10);
-                    const cached = lastRepoScan.get(ds.chatId);
-                    if (!cached || cached.length === 0) {
-                        await sessionReply(rootId, t('cmd.repo.no_prior_scan', undefined, loc));
-                        break;
-                    }
-                    if (repoIndex < 1 || repoIndex > cached.length) {
-                        await sessionReply(rootId, t('cmd.repo.index_out_of_range', { max: cached.length }, loc));
-                        break;
-                    }
-                    const project = cached[repoIndex - 1];
-                    await commitRepoSelection(project.path, `${project.name} (${project.branch})`, `/repo ${repoIndex}`);
-                    break;
-                }
-                // Non-numeric arg → a path (relative/absolute) or first-level project
-                // name under workingDir; resolve it directly and skip the card.
-                if (repoArg && ds) {
-                    const resolved = resolveRepoSelection(repoArg, getProjectScanDirs(ds));
-                    if (!resolved) {
-                        await sessionReply(rootId, t('cmd.repo.path_not_found', { arg: repoArg }, loc));
-                        break;
-                    }
-                    await commitRepoSelection(resolved.path, resolved.displayName, `/repo ${repoArg}`);
-                    break;
-                }
-                // Bare `/repo` while a repo card is pending → launch right away in the
-                // default workingDir. This is the text-command twin of the card's
-                // "start directly" button (and replaces the old `/skip` command).
-                // Mid-session bare `/repo` (no pending) still falls through to the card.
-                if (!repoArg && ds?.pendingRepo) {
-                    // Validate the configured workingDir before spawning — `forkWorker`
-                    // doesn't, so a dead cwd would otherwise spawn-and-fail silently. Same
-                    // guard the card path runs below. On failure we keep the pending state
-                    // so the user can recover with `/repo <valid-path>` (no card here).
-                    const invalidDirs = invalidConfiguredWorkingDirs(ds, ds.larkAppId ?? larkAppId);
-                    if (invalidDirs.length > 0) {
-                        await sessionReply(rootId, t('cmd.repo.working_dir_not_exist', { dirs: invalidDirs.map(d => `\`${d}\``).join(', ') }, loc));
-                        break;
-                    }
-                    const cwd = getSessionWorkingDir(ds);
-                    // bare /repo is the text twin of skip_repo: launch in the default
-                    // cwd without pinning it (forkPendingCli does not write workingDir).
-                    // Confirmation + card withdraw run under the claim inside forkPendingCli.
-                    await forkPendingCli(t('cmd.skip.opened', { cwd }, loc));
-                    logger.info(`[${logTag}] Bare /repo while pending → launch in workingDir ${cwd}`);
-                    break;
-                }
-                if (ds?.worker && !ds.worker.killed) {
-                    await sessionReply(rootId, t('cmd.repo.warning_running', undefined, loc));
-                }
-                const scanDirs = getProjectScanDirs(ds);
-                const invalidDirs = invalidConfiguredWorkingDirs(ds, ds?.larkAppId ?? larkAppId);
-                if (invalidDirs.length > 0) {
-                    await sessionReply(rootId, t('cmd.repo.working_dir_not_exist', { dirs: invalidDirs.map(d => `\`${d}\``).join(', ') }, loc));
-                    break;
-                }
-                const validDirs = scanDirs.filter(d => existsSync(d));
-                if (validDirs.length === 0) {
-                    await sessionReply(rootId, t('cmd.repo.scan_dir_not_exist', { dirs: scanDirs.join(', ') }, loc));
-                    break;
-                }
-                const projects = scanMultipleProjects(validDirs, 3, repoPickerScanOptions());
-                if (projects.length === 0) {
-                    await sessionReply(rootId, t('cmd.repo.no_git_repos', { dirs: validDirs.join(', ') }, loc));
-                    break;
-                }
-                if (ds)
-                    lastRepoScan.set(ds.chatId, projects);
-                const currentCwd = getSessionWorkingDir(ds);
-                const cardJson = buildRepoSelectCard(projects, currentCwd, rootId, loc, ds ? getBot(ds.larkAppId).config.worktreeMultiPicker : undefined);
-                const repoCardMsgId = await sessionReply(rootId, cardJson, 'interactive');
-                if (ds) {
-                    ds.repoCardMessageId = repoCardMsgId;
-                    announcePendingRepoSession(ds);
-                }
-                logger.info(`[${logTag}] Sent repo card with ${projects.length} project(s)`);
-                break;
-            }
-            case '/status': {
-                if (ds) {
-                    const alive = ds.worker && !ds.worker.killed;
-                    const idle = formatUptime(Date.now() - ds.lastMessageAt);
-                    const termUrl = ds.workerPort ? buildTerminalUrl(ds) : '-';
-                    const botCfg = getBot(ds.larkAppId).config;
-                    const migratedFrozenRuntime = ds.session.agentFrozen && !ds.session.cliRuntime
-                        ? resolveCliRuntime({
-                            cliId: ds.session.cliId ?? botCfg.cliId,
-                            cliPathOverride: ds.session.cliPathOverride,
-                            context: 'status session cliRuntime',
-                        })
-                        : undefined;
-                    const effectiveRuntime = ds.session.cliRuntime
-                        ?? migratedFrozenRuntime
-                        ?? (!ds.session.agentFrozen ? botCfg.cliRuntime : undefined);
-                    const effectivePath = ds.session.agentFrozen
-                        ? ds.session.cliPathOverride
-                        : ds.session.cliPathOverride ?? botCfg.cliPathOverride;
-                    const runtimeName = configuredRuntimeDisplayName(effectiveRuntime)
-                        ?? getCliDisplayName(ds.session.cliId ?? botCfg.cliId);
-                    const latestRuntimeVersion = getCurrentCliVersion(runtimeInstallationKey({
-                        cliId: ds.session.cliId ?? botCfg.cliId,
-                        cliRuntime: effectiveRuntime,
-                        cliPathOverride: effectivePath,
-                    }));
-                    const lines = [
-                        `Session: ${ds.session.sessionId}`,
-                        `Status: ${alive ? t('cmd.status.running', undefined, loc) : t('cmd.status.waiting', undefined, loc)}`,
-                        `Terminal: ${termUrl}`,
-                        `CWD: ${getSessionWorkingDir(ds)}`,
-                        `${runtimeName}: v${ds.cliVersion}${latestRuntimeVersion !== 'unknown' && ds.cliVersion !== latestRuntimeVersion ? ` (latest: v${latestRuntimeVersion})` : ''}`,
-                        ...(alive ? [`Uptime: ${formatUptime(Date.now() - ds.spawnedAt)}`] : []),
-                        `Last message: ${idle} ago`,
-                        `Active sessions: ${getActiveCount()}`,
-                    ];
-                    await sessionReply(rootId, lines.join('\n'));
-                }
-                else {
-                    const fallbackCfg = larkAppId ? getBot(larkAppId).config : undefined;
-                    const fallbackCliName = configuredRuntimeDisplayName(fallbackCfg?.cliRuntime)
-                        ?? (fallbackCfg ? getCliDisplayName(fallbackCfg.cliId) : 'CLI');
-                    const fallbackVersion = fallbackCfg
-                        ? getCurrentCliVersion(runtimeInstallationKey({
-                            cliId: fallbackCfg.cliId,
-                            cliRuntime: fallbackCfg.cliRuntime,
-                            cliPathOverride: fallbackCfg.cliPathOverride,
-                        }))
-                        : getCurrentCliVersion();
-                    await sessionReply(rootId, t('cmd.status.fallback_no_session', {
-                        count: getActiveCount(),
-                        cliName: fallbackCliName,
-                        version: fallbackVersion,
-                    }, loc));
-                }
-                break;
-            }
-            case '/schedule': {
-                const scheduleArgs = message.content.replace(/^\/schedule\s*/, '');
-                const chatId = ds?.chatId;
-                await handleScheduleCommand(scheduleArgs, rootId, chatId, deps, larkAppId);
-                logger.info(`[${logTag}] Schedule command handled`);
-                break;
-            }
-            case '/dashboard': {
-                const dashboardArgs = message.content.replace(/^\/dashboard\s*/, '');
-                const chatId = ds?.chatId ?? message.chatId ?? '';
-                await handleDashboardCommand(message, dashboardArgs, rootId, chatId, deps, larkAppId);
-                logger.info(`[${logTag}] Dashboard command handled (sub=${dashboardArgs.trim().split(/\s+/)[0] || 'overview'})`);
-                break;
-            }
-            case '/role': {
-                const chatId = ds?.chatId;
-                if (!chatId || !larkAppId) {
-                    await sessionReply(rootId, t('role.no_chat', undefined, loc));
-                    break;
-                }
-                const roleArgs = message.content.replace(/^\/role\s*/, '');
-                await handleRoleCommand(roleArgs, rootId, chatId, larkAppId, message.senderId, deps);
-                logger.info(`[${logTag}] Role command handled`);
-                break;
-            }
-            case '/botconfig': {
-                const appId = larkAppId ?? ds?.larkAppId;
-                if (!appId) {
-                    await sessionReply(rootId, t('cmd.config.no_bot', undefined, loc));
-                    break;
-                }
-                await handleConfigCommand(message, rootId, appId, deps);
-                logger.info(`[${logTag}] Config command handled`);
-                break;
-            }
-            // Issue Board：`/issue` 出看板卡片，后续都在卡片上就地操作（见 issue-command）。
-            // 权限门（allowedUsers + invoker lock）在 handler 里，命令入口和每次回调各跑一遍。
-            case '/issue': {
-                const appId = larkAppId ?? ds?.larkAppId;
-                if (!appId) {
-                    await sessionReply(rootId, t('cmd.config.no_bot', undefined, loc));
-                    break;
-                }
-                const sub = message.content.replace(/^\/issue\s*/i, '').trim().split(/\s+/, 1)[0]?.toLowerCase();
-                const { handleIssueCommand, handleIssueDone, handleIssueRelease, handleIssueStatus } = await import('../im/lark/issue-command.js');
-                const { buildIssueCommandDeps } = await import('../im/lark/issue-command-deps.js');
-                // 这三个子命令都在**领取时建出来的那个群里**发，锚点从当前会话推。两个候选按
-                // sessionAnchorId 的语义给（拉群 → chatId，话题 → rootMessageId），由 handler 依次试。
-                const anchors = [message.chatId, rootId];
-                if (sub === 'release' || sub === 'done') {
-                    const handler = sub === 'done' ? handleIssueDone : handleIssueRelease;
-                    const rel = await handler(appId, message.senderId, anchors, buildIssueCommandDeps());
-                    await sessionReply(rootId, rel.toast.content);
-                    logger.info(`[${logTag}] Issue ${sub} handled: ${rel.toast.type}`);
-                    break;
-                }
-                if (sub === 'status') {
-                    const st = await handleIssueStatus(appId, message.senderId, anchors, buildIssueCommandDeps());
-                    if ('card' in st)
-                        await sessionReply(rootId, st.card, 'interactive');
-                    else
-                        await sessionReply(rootId, st.toast.content);
-                    logger.info(`[${logTag}] Issue status handled: ${'card' in st ? 'card' : 'toast'}`);
-                    break;
-                }
-                const r = await handleIssueCommand(appId, message.senderId, buildIssueCommandDeps());
-                if ('card' in r)
-                    await sessionReply(rootId, r.card, 'interactive');
-                else
-                    await sessionReply(rootId, r.toast.content);
-                logger.info(`[${logTag}] Issue command handled: ${'card' in r ? 'card' : 'toast'}`);
-                break;
-            }
-            case '/skills': {
-                const appId = larkAppId ?? ds?.larkAppId;
-                if (!appId) {
-                    await sessionReply(rootId, t('cmd.config.no_bot', undefined, loc));
-                    break;
-                }
-                const sub = message.content.replace(/^\/skills\s*/i, '').trim().split(/\s+/, 1)[0]?.toLowerCase();
-                if (sub === 'attach' || sub === 'detach') {
-                    let bot;
-                    try {
-                        bot = getBot(appId);
-                    }
-                    catch {
-                        await sessionReply(rootId, t('cmd.config.no_bot', undefined, loc));
-                        break;
-                    }
-                    const admins = bot.resolvedAllowedUsers ?? [];
-                    if (admins.length === 0) {
-                        await sessionReply(rootId, t('cmd.config.no_owner', undefined, loc));
-                        break;
-                    }
-                    if (!message.senderId || !admins.includes(message.senderId)) {
-                        await sessionReply(rootId, t('cmd.config.not_admin', undefined, loc));
-                        break;
-                    }
-                }
-                const result = await runSkillsImCommand(appId, message.content);
-                await sessionReply(rootId, result.message);
-                logger.info(`[${logTag}] Skills command handled: ${result.ok ? 'ok' : 'error'}`);
-                break;
-            }
-            case '/pair': {
-                const code = message.content.replace(/^\/pair\s*/, '').trim();
-                if (!larkAppId) {
-                    await sessionReply(rootId, t('role.no_chat', undefined, loc));
-                    break;
-                }
-                if (!code) {
-                    await sessionReply(rootId, t('pair.usage', undefined, loc));
-                    break;
-                }
-                // Resolve the sender's canonical union_id (best-effort) so the web
-                // session is keyed stably across apps; degrade to open_id-only.
-                const who = await resolveUserUnionId(larkAppId, message.senderId);
-                const result = claimPairing(config.session.dataDir, code, { openId: message.senderId, unionId: who.unionId, name: who.name, larkAppId });
-                if (result.ok)
-                    await sessionReply(rootId, t('pair.ok', undefined, loc));
-                else if (result.reason === 'expired')
-                    await sessionReply(rootId, t('pair.expired', undefined, loc));
-                else if (result.reason === 'already_claimed')
-                    await sessionReply(rootId, t('pair.already', undefined, loc));
-                else
-                    await sessionReply(rootId, t('pair.not_found', undefined, loc));
-                logger.info(`[${logTag}] Pair command handled: ${result.ok ? 'ok' : result.reason}`);
-                break;
-            }
-            case '/login': {
-                const subCmd = message.content.replace(/^\/login\s*/, '').trim();
-                // 先定位本 bot 配置——token 状态与 OAuth URL 都按 per-bot appId/brand 走。
-                const botCfg2 = ds ? getBot(ds.larkAppId).config : (larkAppId ? getBot(larkAppId).config : getAllBots()[0]?.config);
-                if (!botCfg2?.larkAppId || !botCfg2?.larkAppSecret) {
-                    await sessionReply(rootId, t('cmd.login.no_credentials', undefined, loc));
-                    break;
-                }
-                if (subCmd === 'status' || subCmd === '状态') {
-                    await sessionReply(rootId, getTokenStatus(botCfg2.larkAppId, normalizeBrand(botCfg2.brand)));
-                    break;
-                }
-                const { authUrl } = generateAuthUrl(botCfg2.larkAppId, botCfg2.larkAppSecret, normalizeBrand(botCfg2.brand));
-                await sessionReply(rootId, [
-                    t('cmd.login.title', undefined, loc),
-                    '',
-                    t('cmd.login.step1', undefined, loc),
-                    authUrl,
-                    '',
-                    t('cmd.login.step2', undefined, loc),
-                    t('cmd.login.step3', undefined, loc),
-                    '',
-                    t('cmd.login.footer', undefined, loc),
-                    t('cmd.login.status_hint', undefined, loc),
-                ].join('\n'));
-                break;
-            }
-            case '/subscribe-lark-doc': {
-                // 保留 origin/master 的既有语义：显式获取文档 scope 的 User Token，调用
-                // 飞书逐文件 subscribe API，再把文档绑定到当前会话。新增的评论监听、自动
-                // 会话和审批能力走独立的 /watch-comment，不改变这个远端已有命令。
-                if (!ds || !larkAppId) {
-                    await sessionReply(rootId, t('cmd.subdoc.no_session', undefined, loc));
-                    break;
-                }
-                const arg = message.content.replace(/^\/subscribe-lark-doc\s*/i, '').trim();
-                const anchor = sessionAnchorId(ds);
-                const dataDir = config.session.dataDir;
-                const modeLabel = (m) => t(m === 'all' ? 'cmd.subdoc.mode_all' : 'cmd.subdoc.mode_mention', undefined, loc);
-                if (arg === 'list' || arg === '列表') {
-                    const subs = listDocSubscriptionsForSession(dataDir, larkAppId, anchor)
-                        .filter(s => s.managedBy !== 'watch-comment');
-                    if (!subs.length) {
-                        await sessionReply(rootId, t('cmd.subdoc.none', undefined, loc));
-                        break;
-                    }
-                    const lines = subs.map(s => `• ${s.docTitle || s.fileToken}（${modeLabel(s.commentTriggerMode)}）`);
-                    await sessionReply(rootId, [t('cmd.subdoc.list_title', undefined, loc), ...lines].join('\n'));
-                    break;
-                }
-                if (arg === 'off' || arg === 'stop' || arg === '退订') {
-                    const subs = listDocSubscriptionsForSession(dataDir, larkAppId, anchor)
-                        .filter(s => s.managedBy !== 'watch-comment');
-                    for (const s of subs) {
-                        await unsubscribeDocFile(larkAppId, { fileToken: s.fileToken, fileType: s.fileType });
-                        removeDocSubscription(dataDir, larkAppId, s.fileToken);
-                    }
-                    await sessionReply(rootId, t('cmd.subdoc.unsubscribed', { count: subs.length }, loc));
-                    break;
-                }
-                if (!arg) {
-                    await sessionReply(rootId, t('cmd.subdoc.usage', undefined, loc));
-                    break;
-                }
-                // 旧流程：文档 scope 不污染通用 /login；缺少时由本命令发专用 OAuth 链接。
-                const subCfg = getBot(larkAppId).config;
-                const replyDocLogin = async () => {
-                    const { authUrl } = generateAuthUrl(subCfg.larkAppId, subCfg.larkAppSecret, normalizeBrand(subCfg.brand), DOC_COMMENT_OAUTH_SCOPES);
-                    await sessionReply(rootId, [
-                        t('cmd.subdoc.need_login', undefined, loc),
-                        '',
-                        t('cmd.login.step1', undefined, loc),
-                        authUrl,
-                        '',
-                        t('cmd.login.step2', undefined, loc),
-                        t('cmd.login.step3', undefined, loc),
-                    ].join('\n'));
-                };
-                const userTok = await resolveUserToken(subCfg.larkAppId, subCfg.larkAppSecret, normalizeBrand(subCfg.brand));
-                if (!userTok) {
-                    await replyDocLogin();
-                    break;
-                }
-                try {
-                    const file = await resolveDocFile(larkAppId, arg);
-                    await subscribeDocFile(larkAppId, file);
-                    const mode = subCfg.docSubscribeDefaultMode === 'all' ? 'all' : 'mention-only';
-                    const { previous } = putDocSubscription(dataDir, larkAppId, {
-                        fileToken: file.fileToken,
-                        fileType: file.fileType,
-                        sessionAnchor: anchor,
-                        sessionId: ds.session.sessionId,
-                        scope: ds.scope,
-                        chatId: ds.chatId,
-                        commentTriggerMode: mode,
-                        managedBy: 'subscribe-lark-doc',
-                        ownerOpenId: message.senderId,
-                        createdAt: Date.now(),
-                    });
-                    const title = file.fileToken.slice(0, 12);
-                    const rebound = previous && previous.sessionAnchor !== anchor;
-                    await sessionReply(rootId, t(rebound ? 'cmd.subdoc.subscribed_moved' : 'cmd.subdoc.subscribed', { title, mode: modeLabel(mode) }, loc));
-                    logger.info(`[${logTag}] /subscribe-lark-doc → ${file.fileType}:${file.fileToken.slice(0, 12)} mode=${mode}${rebound ? ' (rebound)' : ''}`);
-                }
-                catch (err) {
-                    // 1069603 重新 OAuth 无法修复；保留实际返回该业务码的身份，避免把
-                    // tenant-only 失败误归因到当前用户。只有 token 缺失 / 失效才重新授权。
-                    if (err instanceof DocSubscriptionPermissionError) {
-                        const identity = err.source === 'user'
-                            ? t('cmd.subdoc.permission_identity_user', undefined, loc)
-                            : err.source === 'tenant'
-                                ? t('cmd.subdoc.permission_identity_tenant', undefined, loc)
-                                : err.source === 'both'
-                                    ? t('cmd.subdoc.permission_identity_both', undefined, loc)
-                                    : t('cmd.subdoc.permission_identity_unknown', undefined, loc);
-                        await sessionReply(rootId, t('cmd.subdoc.manage_required', {
-                            code: err.larkCode,
-                            identity,
-                        }, loc));
-                    }
-                    else if (err instanceof UserTokenMissingError) {
-                        await replyDocLogin();
-                    }
-                    else {
-                        await sessionReply(rootId, t('cmd.subdoc.failed', { err: err instanceof Error ? err.message : String(err) }, loc));
-                    }
-                }
-                break;
-            }
-            case '/watch-comment': {
-                if (!larkAppId) {
-                    await sessionReply(rootId, t('cmd.watch.no_session', undefined, loc));
-                    break;
-                }
-                const request = parseDocWatchCommand(message.content);
-                const dataDir = config.session.dataDir;
-                const modeLabel = (m) => t(m === 'all' ? 'cmd.subdoc.mode_all' : 'cmd.subdoc.mode_mention', undefined, loc);
-                if (request.kind === 'usage' || request.kind === 'invalid') {
-                    const prefix = request.kind === 'invalid' && request.reason === 'conflicting_modes'
-                        ? `${t('cmd.watch.conflicting_modes', undefined, loc)}\n\n`
-                        : '';
-                    await sessionReply(rootId, prefix + t('cmd.watch.usage', undefined, loc));
-                    break;
-                }
-                // 设计：只有 bot owner 能管理文档评论监听（watch / list / off）。非 owner 无法
-                // 主动发起监听，只能在文档里 @bot 触发回复——那条路径会私信通知 owner 审计
-                // （notify-not-approve，见 event-dispatcher.processCommentEvent），不经这里。
-                const ownerOpenId = getOwnerOpenId(larkAppId);
-                if (!ownerOpenId || message.senderId !== ownerOpenId) {
-                    await sessionReply(rootId, t('cmd.watch.owner_only', undefined, loc));
-                    break;
-                }
-                if (request.kind === 'list') {
-                    // 命令已收归 owner-only，无 session 时直接列全部（不再按 ownerOpenId 过滤），
-                    // 否则非 owner @bot 触发的 auto-sub 对 owner 不可见。
-                    const subs = (ds
-                        ? listDocSubscriptionsForSession(dataDir, larkAppId, sessionAnchorId(ds))
-                        : listAllDocSubscriptions(dataDir, larkAppId))
-                        .filter(s => s.managedBy === 'watch-comment');
-                    if (!subs.length) {
-                        await sessionReply(rootId, t(ds ? 'cmd.watch.none' : 'cmd.watch.none_owned', undefined, loc));
-                        break;
-                    }
-                    const lines = subs.map(s => {
-                        const wd = s.workingDir ? ` 📂${s.workingDir}` : '';
-                        return `• ${s.docTitle || s.fileToken}（${modeLabel(s.commentTriggerMode)}）${wd}`;
-                    });
-                    await sessionReply(rootId, [t(ds ? 'cmd.watch.list_title' : 'cmd.watch.list_title_owned', undefined, loc), ...lines].join('\n'));
-                    break;
-                }
-                if (request.kind === 'off') {
-                    if (request.docRef) {
-                        try {
-                            const file = await resolveDocFile(larkAppId, request.docRef);
-                            const existing = getDocSubscription(dataDir, larkAppId, file.fileToken);
-                            if (!existing || existing.managedBy !== 'watch-comment') {
-                                await sessionReply(rootId, t('cmd.watch.not_found', undefined, loc));
-                                break;
-                            }
-                            removeDocSubscription(dataDir, larkAppId, file.fileToken);
-                            await sessionReply(rootId, t('cmd.watch.stopped_one', { title: file.fileToken.slice(0, 12) }, loc));
-                        }
-                        catch (err) {
-                            await sessionReply(rootId, t('cmd.watch.failed', { err: err instanceof Error ? err.message : String(err) }, loc));
-                        }
-                        break;
-                    }
-                    // 命令已收归 owner-only，无 session 时直接列全部（不再按 ownerOpenId 过滤）。
-                    const subs = (ds
-                        ? listDocSubscriptionsForSession(dataDir, larkAppId, sessionAnchorId(ds))
-                        : listAllDocSubscriptions(dataDir, larkAppId))
-                        .filter(s => s.managedBy === 'watch-comment');
-                    for (const s of subs) {
-                        removeDocSubscription(dataDir, larkAppId, s.fileToken);
-                    }
-                    await sessionReply(rootId, t(ds ? 'cmd.watch.stopped_all' : 'cmd.watch.stopped_owned', { count: subs.length }, loc));
-                    break;
-                }
-                if (request.kind !== 'watch') {
-                    await sessionReply(rootId, t('cmd.watch.usage', undefined, loc));
-                    break;
-                }
-                let validatedDir;
-                if (request.workingDir) {
-                    const v = validateWorkingDir(request.workingDir, loc);
-                    if (!v.ok) {
-                        await sessionReply(rootId, v.error);
-                        break;
-                    }
-                    validatedDir = v.resolvedPath;
-                }
-                const botCfg = getBot(larkAppId).config;
-                try {
-                    const file = await resolveDocFile(larkAppId, request.docRef);
-                    const existing = getDocSubscription(dataDir, larkAppId, file.fileToken);
-                    const mode = request.requestedMode
-                        ?? (botCfg.docSubscribeDefaultMode === 'all' ? 'all' : 'mention-only');
-                    const anchor = ds ? sessionAnchorId(ds) : `doc:${file.fileToken}`;
-                    // Existing chat/thread sessions own their project binding. A watch
-                    // without an explicit --dir inherits that binding; session-less
-                    // document watches keep their own stored/mapped directory fallback.
-                    const effectiveDir = ds
-                        ? (validatedDir ?? ds.workingDir ?? ds.session.workingDir)
-                        : (validatedDir ?? existing?.workingDir ?? botCfg.docRepoMap?.[file.fileToken]);
-                    let pollCursorAt;
-                    let pollCursorReplyId;
-                    let pollBaselineReady;
-                    if (mode === 'all') {
-                        const canReuseBaseline = existing?.managedBy === 'watch-comment'
-                            && existing.commentTriggerMode === 'all'
-                            && existing.pollBaselineReady === true;
-                        if (canReuseBaseline) {
-                            pollCursorAt = existing.pollCursorAt;
-                            pollCursorReplyId = existing.pollCursorReplyId;
-                            pollBaselineReady = true;
-                        }
-                        else {
-                            try {
-                                const latest = latestDocCommentPollCursor(await listDocComments(larkAppId, file));
-                                pollCursorAt = latest?.createdAt ?? Math.floor(Date.now() / 1000);
-                                pollCursorReplyId = latest?.replyId ?? '';
-                                pollBaselineReady = true;
-                            }
-                            catch (err) {
-                                // 不让一次读取失败阻塞登记。poller 首次成功时只建立基线，不重放历史。
-                                pollBaselineReady = false;
-                                logger.warn(`[${logTag}] /watch-comment baseline failed for ${file.fileToken.slice(0, 12)}: ${err instanceof Error ? err.message : String(err)}`);
-                            }
-                        }
-                    }
-                    const subscription = {
-                        fileToken: file.fileToken,
-                        fileType: file.fileType,
-                        sessionAnchor: anchor,
-                        sessionId: ds?.session.sessionId,
-                        scope: ds?.scope ?? 'chat',
-                        chatId: ds?.chatId ?? `doc:${file.fileToken}`,
-                        commentTriggerMode: mode,
-                        managedBy: 'watch-comment',
-                        ownerOpenId: message.senderId,
-                        workingDir: effectiveDir,
-                        pollCursorAt,
-                        pollCursorReplyId,
-                        pollBaselineReady,
-                        createdAt: existing?.createdAt ?? Date.now(),
-                    };
-                    const { previous } = putDocSubscription(dataDir, larkAppId, subscription);
-                    const rebound = previous && previous.sessionAnchor !== anchor;
-                    let replyText = t(!ds ? 'cmd.watch.started_lazy' : rebound ? 'cmd.watch.started_moved' : 'cmd.watch.started', {
-                        title: file.fileToken.slice(0, 12),
-                        mode: modeLabel(mode),
-                    }, loc);
-                    if (effectiveDir)
-                        replyText += `\n📂 ${t('cmd.watch.working_dir', { dir: effectiveDir }, loc)}`;
-                    else
-                        replyText += `\n\n${t(ds ? 'cmd.watch.project_optional_session' : 'cmd.watch.project_optional_lazy', undefined, loc)}`;
-                    if (ds && deps.prewarmDocCommentSession) {
-                        try {
-                            await deps.prewarmDocCommentSession(ds, subscription);
-                            replyText += `\n\n${t('cmd.watch.prewarming', undefined, loc)}`;
-                        }
-                        catch (err) {
-                            logger.warn(`[${logTag}] /watch-comment prewarm failed for ${file.fileToken.slice(0, 12)}: ${err instanceof Error ? err.message : String(err)}`);
-                            replyText += `\n\n${t('cmd.watch.prewarm_failed', undefined, loc)}`;
-                        }
-                    }
-                    await sessionReply(rootId, replyText);
-                    logger.info(`[${logTag}] /watch-comment → ${file.fileType}:${file.fileToken.slice(0, 12)} mode=${mode}${effectiveDir ? ` wd=${effectiveDir}` : ''}${rebound ? ' (rebound)' : ''}${ds ? '' : ' (doc-native lazy session)'}`);
-                }
-                catch (err) {
-                    await sessionReply(rootId, t('cmd.watch.failed', { err: err instanceof Error ? err.message : String(err) }, loc));
-                }
-                break;
-            }
-            case '/vc': {
-                if (!larkAppId) {
-                    await sessionReply(rootId, t('cmd.vc.no_session', undefined, loc));
-                    break;
-                }
-                const ownerOpenId = getOwnerOpenId(larkAppId);
-                if (!ownerOpenId || message.senderId !== ownerOpenId) {
-                    await sessionReply(rootId, t('cmd.vc.owner_only', undefined, loc));
-                    break;
-                }
-                const request = parseVcMeetingPrepareCommand(message.content);
-                const dataDir = config.session.dataDir;
-                if (request.kind === 'usage' || request.kind === 'invalid') {
-                    const prefix = request.kind === 'invalid'
-                        ? `${t('cmd.vc.invalid', undefined, loc)}\n\n`
-                        : '';
-                    await sessionReply(rootId, prefix + t('cmd.vc.usage', undefined, loc));
-                    break;
-                }
-                if (request.kind === 'status') {
-                    const requestedRecord = request.meetingNo
-                        ? getVcMeetingPreparation(dataDir, larkAppId, request.meetingNo)
-                        : undefined;
-                    const records = request.meetingNo
-                        ? (requestedRecord ? [requestedRecord] : [])
-                        : listVcMeetingPreparations(dataDir, larkAppId);
-                    if (records.length === 0) {
-                        await sessionReply(rootId, t('cmd.vc.none', undefined, loc));
-                        break;
-                    }
-                    const lines = records.map(record => [
-                        `• ${record.topic || record.meetingNo}`,
-                        `  meetingNo: \`${record.meetingNo}\``,
-                        `  chat: \`${record.prepChatId}\``,
-                        `  agent: \`${record.agentAppId}\``,
-                        `  Q&A: ${record.qaMode}`,
-                    ].join('\n'));
-                    await sessionReply(rootId, [t('cmd.vc.status_title', undefined, loc), '', ...lines].join('\n'));
-                    break;
-                }
-                if (request.kind === 'off') {
-                    let count = 0;
-                    if (request.all) {
-                        for (const record of listVcMeetingPreparations(dataDir, larkAppId)) {
-                            if (removeVcMeetingPreparation(dataDir, larkAppId, record.meetingNo))
-                                count += 1;
-                        }
-                    }
-                    else if (request.meetingNo) {
-                        count = removeVcMeetingPreparation(dataDir, larkAppId, request.meetingNo) ? 1 : 0;
-                    }
-                    else if (ds) {
-                        count = removeVcMeetingPreparationsByChat(dataDir, larkAppId, ds.chatId);
-                    }
-                    await sessionReply(rootId, count > 0
-                        ? t('cmd.vc.stopped', { count }, loc)
-                        : t('cmd.vc.none', undefined, loc));
-                    break;
-                }
-                if (!ds || ds.chatType !== 'group' || ds.scope !== 'chat') {
-                    await sessionReply(rootId, t('cmd.vc.need_group_chat', undefined, loc));
-                    break;
-                }
-                const existingInChat = findVcMeetingPreparationByChat(dataDir, larkAppId, ds.chatId);
-                const record = putVcMeetingPreparation(dataDir, {
-                    larkAppId,
-                    meetingNo: request.meetingNo,
-                    ...(request.meetingLink ? { meetingLink: request.meetingLink } : {}),
-                    prepChatId: ds.chatId,
-                    agentAppId: larkAppId,
-                    agentSessionId: ds.session.sessionId,
-                    ownerOpenId: message.senderId,
-                    qaMode: request.qaMode,
-                });
-                const replaced = existingInChat && existingInChat.meetingNo !== record.meetingNo
-                    ? `\n${t('cmd.vc.replaced', { meetingNo: existingInChat.meetingNo }, loc)}`
-                    : '';
-                let preparedText = t('cmd.vc.prepared', {
-                    meetingNo: record.meetingNo,
-                    qaMode: record.qaMode,
-                }, loc) + replaced;
-                const meetingProjectDir = ds.workingDir ?? ds.session.workingDir;
-                preparedText += meetingProjectDir
-                    ? `\n\n${t('cmd.vc.project_bound', { dir: meetingProjectDir }, loc)}`
-                    : `\n\n${t('cmd.vc.project_optional', undefined, loc)}`;
-                await sessionReply(rootId, preparedText);
-                logger.info(`[${logTag}] /vc prepare meetingNo=${record.meetingNo} chat=${record.prepChatId} agent=${record.agentAppId} qa=${record.qaMode}`);
-                break;
-            }
-            case '/adopt': {
-                const adoptArgs = message.content.replace(/^\/adopt\s*/i, '').trim();
-                if (ds && isSessionTransferring(ds)) {
-                    await sessionReply(rootId, t('cmd.session.transfer_in_progress', undefined, loc));
-                    break;
-                }
-                if (ds?.adoptedFrom) {
-                    const adopted = ds.adoptedFrom;
-                    const cliName = sessionCliDisplayName(ds);
-                    const project = adopted.cwd ? (adopted.cwd.split('/').pop() || adopted.cwd) : '';
-                    const label = project ? `${cliName} · ${project}` : cliName;
-                    await sessionReply(rootId, t('cmd.adopt.already_adopted', { label, pane: adoptTargetLabel(adopted) }, loc));
-                    break;
-                }
-                const botCfgForAdopt = ds ? getBot(ds.larkAppId).config : (larkAppId ? getBot(larkAppId).config : undefined);
-                if (botCfgForAdopt?.cliId === 'codex-app') {
-                    if (!ds) {
-                        await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
-                        break;
-                    }
-                    await handleCodexAppAdoptCommand(adoptArgs, rootId, ds, deps, larkAppId);
-                    break;
-                }
-                const botCliId = botCfgForAdopt?.cliId;
-                const adoptSession = ds?.session;
-                const adoptAnchor = ds ? sessionAnchorId(ds) : undefined;
-                // Discover every supported backend, but only offer live sessions for
-                // this bot's configured CLI. A Pi bot must not show Codex/TRAE panes:
-                // adopting one would unexpectedly change the agent behind the bot.
-                // collectAdoptCandidates folds live-pane + disk-resume discovery into
-                // one snapshot; we cache it (by root message id) so the V2 picker's
-                // search / page re-renders don't re-shell-out to tmux each click.
-                const { collectAdoptCandidates, cacheAdoptCandidates } = await import('../services/adopt-picker.js');
-                const candidates = await collectAdoptCandidates(botCliId, botCfgForAdopt?.cliPathOverride, activeSessions, discoverResumableSessionsForBot, ADOPT_RESUME_LIMIT, botCfgForAdopt?.cliRuntime?.executable);
-                const sessions = candidates.sessions;
-                const resumable = candidates.resumable;
-                if (ds
-                    && adoptSession
-                    && adoptAnchor
-                    && (ds.session !== adoptSession
-                        || ds.session.status !== 'active'
-                        || activeSessions.get(sessionKey(adoptAnchor, ds.larkAppId)) !== ds
-                        || isSessionTransferring(ds))) {
-                    await sessionReply(rootId, t('cmd.session.transfer_in_progress', undefined, loc));
-                    break;
-                }
-                if (sessions.length === 0 && resumable.length === 0) {
-                    await sessionReply(rootId, t('cmd.adopt.no_sessions', undefined, loc));
-                    break;
-                }
-                const directTarget = adoptArgs;
-                if (directTarget) {
-                    // Match a tmux address ("session:window.pane") OR a zellij target
-                    // ("session:paneId" / "session/paneId") against the merged list.
-                    const zellijNorm = directTarget.replace('/', ':');
-                    const target = sessions.find(s => 'zellijPaneId' in s
-                        ? `${s.zellijSession}:${s.zellijPaneId}` === zellijNorm
-                        : adoptTargetLabel(s) === directTarget || adoptTargetKey(s) === directTarget || s.tmuxTarget === directTarget || s.herdrPaneId === directTarget);
-                    if (target) {
-                        if (ds)
-                            await startAdoptSession(target, ds, deps, larkAppId);
-                        break;
-                    }
-                    // Fall back to a resumable session matched by its CLI-native id.
-                    const resumeTarget = resumable.find(r => r.cliSessionId === directTarget);
-                    if (resumeTarget) {
-                        if (ds)
-                            await startResumeImportSession(resumeTarget, ds, deps, larkAppId);
-                        break;
-                    }
-                    await sessionReply(rootId, t('cmd.adopt.pane_not_found', { pane: directTarget }, loc));
-                    break;
-                }
-                // Cache the snapshot so the picker's search / page clicks reuse it
-                // (confirm re-discovers to re-validate the live pane).
-                cacheAdoptCandidates(rootId, candidates, Date.now());
-                const cardJson = buildAdoptSelectCard(sessions, rootId, loc, resumable, undefined, message.senderId, candidates.resumeLimit, botCliId, ds
-                    ? sessionConfiguredRuntimeDisplayName(ds.session, getBot(ds.larkAppId).config.cliRuntime)
-                    : configuredRuntimeDisplayName(botCfgForAdopt?.cliRuntime));
-                await sessionReply(rootId, cardJson, 'interactive');
-                break;
-            }
-            case '/oncall': {
-                const args = message.content.replace(/^\/oncall\s*/i, '').trim();
-                const [sub, ...rest] = args.length > 0 ? args.split(/\s+/) : [];
-                const appId = larkAppId ?? ds?.larkAppId;
-                const chatId = ds?.chatId;
-                if (!appId || !chatId) {
-                    await sessionReply(rootId, t('cmd.oncall.need_group', undefined, loc));
-                    break;
-                }
-                if (!sub || sub === 'status' || sub === '状态') {
-                    const entry = getOncallStatus(appId, chatId);
-                    if (!entry) {
-                        await sessionReply(rootId, t('cmd.oncall.not_bound', undefined, loc));
-                    }
-                    else {
-                        await sessionReply(rootId, t('cmd.oncall.bound', { dir: entry.workingDir }, loc));
-                    }
-                    break;
-                }
-                if (sub === 'bind' || sub === '绑定') {
-                    const target = rest.join(' ').trim();
-                    if (!target) {
-                        await sessionReply(rootId, t('cmd.oncall.bind_usage', undefined, loc));
-                        break;
-                    }
-                    const validation = validateWorkingDir(target, loc, { autoCreate: true });
-                    if (!validation.ok) {
-                        await sessionReply(rootId, validation.error);
-                        break;
-                    }
-                    const resolvedPath = validation.resolvedPath;
-                    const result = await bindOncall(appId, chatId, target);
-                    if (!result.ok) {
-                        if (result.reason === 'bot_not_in_config') {
-                            await sessionReply(rootId, t('cmd.oncall.bind_failed_no_bot', undefined, loc));
-                        }
-                        else {
-                            await sessionReply(rootId, t('cmd.oncall.bind_failed', { reason: result.reason }, loc));
-                        }
-                        break;
-                    }
-                    const verb = result.created
-                        ? t('cmd.oncall.verb_bound', undefined, loc)
-                        : t('cmd.oncall.verb_updated', undefined, loc);
-                    const createdNote = validation.created ? `\n\n${t('cmd.oncall.bind_created_note', undefined, loc)}` : '';
-                    await sessionReply(rootId, t('cmd.oncall.bind_success', {
-                        verb,
-                        chatId,
-                        target,
-                        resolved: resolvedPath,
-                    }, loc) + createdNote);
-                    logger.info(`[${logTag}] /oncall bind chat=${chatId} dir=${target}${validation.created ? ' (auto-created)' : ''}`);
-                    break;
-                }
-                if (sub === 'unbind' || sub === '解绑') {
-                    const result = await unbindOncall(appId, chatId);
-                    if (!result.ok) {
-                        await sessionReply(rootId, t('cmd.oncall.unbind_failed', { reason: result.reason }, loc));
-                        break;
-                    }
-                    if (!result.wasBound) {
-                        await sessionReply(rootId, t('cmd.oncall.unbind_not_bound', undefined, loc));
-                    }
-                    else {
-                        await sessionReply(rootId, t('cmd.oncall.unbind_success', undefined, loc));
-                    }
-                    logger.info(`[${logTag}] /oncall unbind chat=${chatId} wasBound=${result.wasBound}`);
-                    break;
-                }
-                await sessionReply(rootId, t('cmd.oncall.unknown_sub', { sub }, loc));
-                break;
-            }
-            case '/group':
-            case '/g': {
-                const creatorAppId = larkAppId ?? ds?.larkAppId;
-                if (!creatorAppId) {
-                    await sessionReply(rootId, t('cmd.group.no_bot', undefined, loc));
-                    break;
-                }
-                const senderOpenId = message.senderId;
-                if (!senderOpenId) {
-                    await sessionReply(rootId, t('cmd.group.no_sender', undefined, loc));
-                    break;
-                }
-                // Each @-mentioned bot independently receives this same event and reaches
-                // this handler, so exactly one must create the group and the rest must
-                // stay silent. Intent: pull every @-mentioned bot into a new group, with
-                // the FIRST mentioned bot doing the creating.
-                //
-                // Two distinct sources, each used for what it's reliable at:
-                //   • DETECTION ("is this @-mention a bot, and which is first?") uses
-                //     globalKnownBotNames() from bots-info.json — process-stable and
-                //     complete. getAllBots() can't be used (one daemon per bot ⇒ it only
-                //     sees self), and the live roster can transiently miss a bot; either
-                //     would let competing processes disagree on the first bot → split
-                //     brain. The name set + my own open_id give every process the same
-                //     leadership verdict with no API/cross-ref dependency.
-                //   • RESOLUTION (bot → larkAppId for the invite) uses the live roster
-                //     listChatBotMembers(), failing CLOSED on any miss.
-                const mentions = message.mentions ?? [];
-                // `/group` runs without a pre-created session (see
-                // SESSIONLESS_DAEMON_COMMANDS), so the source chat comes from the
-                // message; fall back to the active session when invoked mid-session.
-                const sourceChatId = message.chatId ?? ds?.chatId;
-                const knownBotNames = globalKnownBotNames();
-                // Degraded-state guard: if the user @-mentioned someone but the global bot
-                // registry is empty (bots-info.json missing/corrupt/not-yet-written), we
-                // can't tell bots from users — so we can't elect a creator. Fail CLOSED
-                // rather than fall through to "no bot mentions" → per-bot solo group,
-                // which would let every @-mentioned bot create its own group.
-                if (knownBotNames.size === 0 && mentions.some(m => !!m.name)) {
-                    logger.warn(`[${logTag}] /group: global bot registry empty (bots-info.json missing/corrupt); cannot elect a creator`);
-                    await sessionReply(rootId, t('cmd.group.resolve_failed', undefined, loc));
-                    break;
-                }
-                // The @-mentioned bots, in mention order. The first one is the creator.
-                const botMentions = mentions.filter(m => m.name && knownBotNames.has(m.name.toLowerCase()));
-                // ── Leader election ──────────────────────────────────────────────────
-                const mentionedBotAppIds = [];
-                const appIdToName = new Map();
-                if (botMentions.length > 0) {
-                    const firstBot = botMentions[0];
-                    const myOpenId = getBotOpenId(creatorAppId);
-                    // Am I the first @-mentioned bot? My own open_id is always reliable in
-                    // my own app scope (Lark reports a bot its own open_id consistently),
-                    // so this needs no cross-ref. Name fallback only when my open_id isn't
-                    // probed yet AND my display name is globally unambiguous.
-                    const myName = getBot(creatorAppId).botName?.toLowerCase();
-                    const myNameAmbiguous = !!myName && botMentions.filter(m => m.name?.toLowerCase() === myName).length > 1;
-                    const iAmFirstBot = (!!myOpenId && firstBot.openId === myOpenId) ||
-                        (!myOpenId && !!myName && !myNameAmbiguous && firstBot.name?.toLowerCase() === myName);
-                    if (!iAmFirstBot) {
-                        logger.info(`[${logTag}] /group: not the first @-mentioned bot (first="${firstBot.name}"), staying silent`);
-                        break;
-                    }
-                    // I'm the creator. Resolving invitees needs the chat roster — fail
-                    // CLOSED if it's missing rather than fall through to a per-bot solo
-                    // group (which would let every mentioned bot create one).
-                    if (!sourceChatId) {
-                        logger.warn(`[${logTag}] /group: missing source chatId, cannot resolve @-mentioned bots`);
-                        await sessionReply(rootId, t('cmd.group.resolve_failed', undefined, loc));
-                        break;
-                    }
-                    let members = [];
-                    try {
-                        members = await listChatBotMembers(creatorAppId, sourceChatId);
-                    }
-                    catch (e) {
-                        logger.warn(`[${logTag}] /group failed to list chat bot members: ${e?.message ?? e}`);
-                    }
-                    const memberByOpenId = new Map(members.map(m => [m.openId, m]));
-                    for (const m of members) {
-                        if (m.larkAppId && m.displayName)
-                            appIdToName.set(m.larkAppId, m.displayName);
-                    }
-                    // Resolve each bot mention → larkAppId by open_id (our scope; reliable
-                    // for distinct bots, and disambiguates duplicate display names), in
-                    // mention order, deduped. Fail CLOSED on any unresolved bot rather than
-                    // build a group missing an intended one.
-                    const seen = new Set();
-                    let unresolved;
-                    for (const bm of botMentions) {
-                        const mem = bm.openId ? memberByOpenId.get(bm.openId) : undefined;
-                        if (!mem || !mem.larkAppId) {
-                            unresolved = bm.name;
-                            break;
-                        }
-                        if (!seen.has(mem.larkAppId)) {
-                            seen.add(mem.larkAppId);
-                            mentionedBotAppIds.push(mem.larkAppId);
-                        }
-                    }
-                    if (unresolved) {
-                        logger.warn(`[${logTag}] /group: could not resolve @-mentioned bot "${unresolved}" to an app id; aborting`);
-                        await sessionReply(rootId, t('cmd.group.resolve_failed', undefined, loc));
-                        break;
-                    }
-                }
-                // Extract the requested group name. Strip whichever alias was used, then
-                // remove any `@<name>` mention tokens that leaked into the body (Lark
-                // renders mentions as literal `@Name` text in content), then take the
-                // first non-blank line so multi-line pastes don't smear into the name.
-                let rawArgs = message.content.replace(/^\/(group|g)\s*/i, '');
-                for (const m of mentions) {
-                    if (m.name)
-                        rawArgs = rawArgs.split(`@${m.name}`).join(' ');
-                }
-                let roleProfileId;
-                const roleProfileArg = rawArgs.match(/(?:^|\s)--role-profile(?:=|\s+)(\S+)/);
-                if (roleProfileArg) {
-                    if (!isValidRoleProfileId(roleProfileArg[1])) {
-                        await sessionReply(rootId, t('role.profile.invalid', undefined, loc));
-                        break;
-                    }
-                    roleProfileId = roleProfileArg[1];
-                    rawArgs = rawArgs.replace(roleProfileArg[0], ' ');
-                }
-                const firstLine = rawArgs.split(/\r?\n/).map(s => s.trim()).find(Boolean) ?? '';
-                let baseGroupName;
-                if (firstLine) {
-                    baseGroupName = firstLine;
-                }
-                else {
-                    const now = new Date();
-                    const ts = `${String(now.getMonth() + 1).padStart(2, '0')}/${String(now.getDate()).padStart(2, '0')} ${String(now.getHours()).padStart(2, '0')}:${String(now.getMinutes()).padStart(2, '0')}`;
-                    baseGroupName = t('cmd.group.empty_fallback', { ts }, loc);
-                }
-                const groupName = formatSlashGroupName(baseGroupName, readGlobalConfig().groupNamePrefix);
-                // Bots to invite: every @-mentioned bot (creator filtered out internally
-                // by the service). Empty mentions → solo group (creator only).
-                const larkAppIdsForGroup = mentionedBotAppIds.length > 0 ? mentionedBotAppIds : [creatorAppId];
-                try {
-                    const { createGroupWithBots } = await import('../services/group-creator.js');
-                    const result = await createGroupWithBots({
-                        creatorLarkAppId: creatorAppId,
-                        larkAppIds: larkAppIdsForGroup,
-                        name: groupName,
-                        userOpenIds: [senderOpenId],
-                        transferOwnerTo: senderOpenId,
-                        notifyOwnerOpenId: senderOpenId,
-                        roleProfileId,
-                    });
-                    // Prefer the shareable join link (others can click to *join*); fall
-                    // back to the member-only applink URL when Lark's link API failed.
-                    const applink = chatAppLink(result.chatId, normalizeBrand(getBot(creatorAppId).config.brand));
-                    const link = result.shareLink ?? applink;
-                    // Partial failures are non-fatal — the chat exists; surface them as
-                    // hints so the user knows whether to expect to be auto-invited.
-                    const hints = [];
-                    if (result.invalidUserIds.includes(senderOpenId)) {
-                        hints.push(t('cmd.group.warn_invite_rejected', undefined, loc));
-                    }
-                    else if (result.transferError) {
-                        hints.push(t('cmd.group.warn_transfer_failed', { reason: result.transferError }, loc));
-                    }
-                    // Share-link fetch failed → the displayed link is the member-only
-                    // applink; warn the user so they don't expect non-members to join via it.
-                    if (!result.shareLink && result.shareLinkError) {
-                        logger.warn(`[${logTag}] /group share-link unavailable, using applink: ${result.shareLinkError}`);
-                        hints.push(t('cmd.group.warn_share_link_failed', undefined, loc));
-                    }
-                    // List every bot in the new group (creator included), and warn about
-                    // any Feishu rejected. Names come from the chat roster (members) since
-                    // getBot() only knows this process's own bot in the one-daemon-per-bot
-                    // model; fall back to the registry/raw id for anything not in the map.
-                    const nameOf = (id) => appIdToName.get(id) ?? botDisplayName(id);
-                    const groupBotIds = larkAppIdsForGroup.filter(id => !result.invalidBotIds.includes(id));
-                    if (groupBotIds.length > 1) {
-                        hints.push(t('cmd.group.bots_invited', { bots: groupBotIds.map(nameOf).join('、') }, loc));
-                    }
-                    if (result.invalidBotIds.length > 0) {
-                        hints.push(t('cmd.group.warn_bots_rejected', { bots: result.invalidBotIds.map(nameOf).join('、') }, loc));
-                    }
-                    if (roleProfileId) {
-                        if (result.roleProfileBootstrapError) {
-                            hints.push(t('cmd.group.role_profile_bootstrap_failed', { profile: roleProfileId, reason: result.roleProfileBootstrapError ?? 'unknown' }, loc));
-                        }
-                        else {
-                            hints.push(t('cmd.group.role_profile_bootstrap_sent', { profile: roleProfileId }, loc));
-                        }
-                    }
-                    const hintsText = hints.length > 0 ? '\n' + hints.join('\n') : '';
-                    await sessionReply(rootId, t('cmd.group.created', { name: groupName, link, hints: hintsText }, loc));
-                    logger.info(`[${logTag}] /group created chat=${result.chatId} name="${groupName}" bots=[${larkAppIdsForGroup.join(',')}] invitee=${senderOpenId}`);
-                    // Intentionally NO auto-bootstrap (repo-select card / chat-scope
-                    // session) here: the group name rarely carries enough context to seed
-                    // a useful prompt. The user starts a real conversation with the bot in
-                    // the new group, which spawns the session on first message.
-                }
-                catch (err) {
-                    logger.error(`[${logTag}] /group failed: ${err?.message ?? err}`);
-                    await sessionReply(rootId, t('cmd.group.failed', { error: err?.message ?? String(err) }, loc));
-                }
-                break;
-            }
-            /**
-             * `/relay --create <群名> @bot [@bot...]` — create a new chat, invite
-             * the @-mentioned bots, then migrate every bot's session in this
-             * thread (including the leader's) into the new chat.
-             *
-             * p2p (私聊) variant: `/relay --create [群名]` with NO mentions — DMs
-             * have no member roster so @-ing a bot is impossible there. The bot
-             * itself is the sole participant and leader; the new group is user +
-             * this bot, and the DM session migrates over (solo relay, no peers).
-             *
-             * Two-path command:
-             *   • `--create` (PR2) — implemented below; creates a new chat.
-             *   • no flag (PR3)    — picker card listing user's relayable sessions
-             *                         in OTHER chats so the user can pull one into
-             *                         the current chat. Stubbed for now.
-             *
-             * Leader election is `mentions[0]` (identical to /group). The leader
-             * is the only daemon that:
-             *   1. Creates the new chat (createGroupWithBots)
-             *   2. Sends the M1 announcement message (its message_id becomes the
-             *      shared rootMessageId for all relayed sessions — multi-bot
-             *      sessions co-anchor on the same root via different larkAppIds)
-             *   3. Transfers its own session (if any) via local transferSession()
-             *   4. POSTs /api/sessions/migrate-to-chat to every peer daemon to
-             *      ask them to transfer their own session at the same anchor
-             *   5. Aggregates results into a single reply in the source thread
-             *
-             * Owner-only: only the source session's `ownerOpenId` may invoke. Peers
-             * enforce the same check independently inside the migrate endpoint.
-             *
-             * Failure mode: best-effort, no rollback. Peers that timeout / fail /
-             * are offline simply appear in the report as "skipped". The new chat
-             * and any successful transfers stand.
-             */
-            case '/relay': {
-                const argsLine = message.content.replace(/^\/relay\s*/i, '').trim();
-                if (!/^--create\b/i.test(argsLine)) {
-                    // ── Pull picker ───────────────────────────────────────────────────
-                    // /relay (no flag) lives in the *target* chat — list the operator's
-                    // own active sessions in OTHER chats so they can pull one in.
-                    //
-                    // Filter:
-                    //   • same bot (this larkAppId)
-                    //   • session is active (has a worker / appears in activeSessions)
-                    //   • session NOT in the current chat (can't relay to yourself)
-                    //   • operator IS the session owner (owner-only access)
-                    //
-                    // The button's `target_chat_id` / `target_root_id` are the chat we're
-                    // pulling INTO (the chat hosting this command). card-handler uses
-                    // them to invoke transferSession after sending the M1 announcement.
-                    const operatorOpenId = message.senderId;
-                    if (!operatorOpenId) {
-                        await sessionReply(rootId, t('cmd.relay.no_sender', undefined, loc));
-                        break;
-                    }
-                    const myAppId = larkAppId ?? ds?.larkAppId;
-                    if (!myAppId) {
-                        await sessionReply(rootId, t('cmd.group.no_bot', undefined, loc));
-                        break;
-                    }
-                    const targetChatId = ds?.chatId;
-                    if (!targetChatId) {
-                        await sessionReply(rootId, t('cmd.relay.no_session', undefined, loc));
-                        break;
-                    }
-                    // ── Target-routing resolution ─────────────────────────────────────
-                    // Resolve the chat mode once, then compute WHERE the relayed session
-                    // should land via resolveRelayTargetRouting (mirrors decideRouting;
-                    // 话题群 / 线程内 / 普通群 new-topic·shared → thread-scope, 普通群
-                    // flat → chat-scope; DM 扁平(p2pMode chat) → chat-scope, DM 话题模式
-                    // → thread-scope seeded on the /relay message).
-                    // p2p is authoritative from `ds.chatType` (recorded off the Lark
-                    // event payload — doesn't drift, and the API's safe-default 'group'
-                    // on failure would misclassify a DM); only group chats need the API
-                    // call to split topic-vs-regular (both record chatType 'group').
-                    const targetIsP2p = ds?.chatType === 'p2p';
-                    const targetChatType = targetIsP2p ? 'p2p' : 'group';
-                    let targetChatMode = 'p2p';
-                    if (!targetIsP2p) {
-                        const { getChatNameAndMode } = await import('../im/lark/client.js');
-                        const info = await getChatNameAndMode(myAppId, targetChatId).catch(() => null);
-                        targetChatMode = info?.mode ?? 'group';
-                    }
-                    const { resolveRelayTargetRouting } = await import('../im/lark/relay-target-routing.js');
-                    const targetRouting = resolveRelayTargetRouting({
-                        larkAppId: myAppId,
-                        chatId: targetChatId,
-                        message: { messageId: message.messageId, rootId: message.rootId || undefined, threadId: message.threadId },
-                        chatMode: targetChatMode,
-                    });
-                    const targetScope = targetRouting.scope;
-                    const targetAnchor = targetRouting.anchor;
-                    // ── Reply WHERE the user typed /relay ─────────────────────────────
-                    // Not through sessionReply: in chat-scope groups (普通群扁平 /
-                    // chat-topic / shared) that path either leaks to the chat top level
-                    // (the /relay scratch has no turn state to fold back into) or lands
-                    // in the CURRENT turn's 话题 (a real chat-scope session) — both away
-                    // from the 话题 the user invoked in (申晗 live 反馈). The target
-                    // routing already encodes the invocation spot:
-                    //   thread → reply_in_thread into that 话题 (for 话题群 / DM-thread
-                    //            top-level this seeds the 话题 on the /relay message —
-                    //            same place the relayed session will land);
-                    //   chat   → quote-reply the /relay message at the top level.
-                    // Fallback to sessionReply if the reply API refuses (e.g. the
-                    // command message was withdrawn mid-flight).
-                    const replyAtInvocation = async (content, msgType) => {
-                        try {
-                            await replyMessage(myAppId, targetScope === 'thread' ? targetAnchor : message.messageId, content, msgType ?? 'text', 
-                            /*replyInThread*/ targetScope === 'thread');
-                        }
-                        catch (err) {
-                            logger.warn(`[${logTag}] /relay reply-at-invocation failed (${err instanceof Error ? err.message : err}); falling back to sessionReply`);
-                            await sessionReply(rootId, content, msgType);
-                        }
-                    };
-                    // ── Existing-session guard (anchor-based) ─────────────────────────
-                    // A real session already sitting AT the target anchor would collide
-                    // on sessionKey(targetAnchor, larkAppId) after transfer — Map.set
-                    // would orphan its worker. Scratch placeholders (worker:null, e.g.
-                    // the /relay command's own record at this anchor) are NOT a conflict;
-                    // transferSession closes them inline. We do NOT exclude `ds`: if
-                    // /relay rides an existing real session at the anchor, `ds` itself IS
-                    // the conflict. Anchor-based so同群 other-topic sessions (different
-                    // anchor) don't false-positive — that's what enables 同群话题间搬运.
-                    const conflict = [...activeSessions.values()].find(c => c.larkAppId === myAppId
-                        && sessionAnchorId(c) === targetAnchor
-                        && !!c.worker // real running session, not a placeholder
-                    );
-                    if (conflict) {
-                        await replyAtInvocation(t('cmd.relay.target_has_session', { title: conflict.session.title || conflict.session.sessionId.substring(0, 8) }, loc));
-                        break;
-                    }
-                    // Shared candidate-collection logic — used here at initial render
-                    // and again in card-handler when the user clicks a card to switch
-                    // selection (the card re-render needs the same filtered list).
-                    // Excludes (by anchor) the target itself; keeps cross-group + 同群
-                    // other-topic sessions. Resolves friendly chat names + modes.
-                    const { collectRelayPickerEntries } = await import('../services/relay-picker.js');
-                    const entries = await collectRelayPickerEntries(activeSessions, myAppId, targetAnchor, operatorOpenId);
-                    const { buildRelayPickerCard } = await import('../im/lark/card-builder.js');
-                    // ── Ephemeral (仅邀请者可见) picker ────────────────────────────────
-                    // The picker exposes session metadata — title + source-chat name — to
-                    // everyone who can see the message. When the bot runs in privateCard
-                    // mode we hide it: send the picker as an ephemeral card visible only to
-                    // the invoker.
-                    //
-                    // Gate on group + privateCard + **chat-scope**. The chat-scope clause
-                    // is load-bearing: the ephemeral API (`ephemeral/v1/send`) takes a
-                    // `chat_id` only — it has NO thread/root anchor — so a thread-scope
-                    // target (话题群 / 话题 inside a 普通群 / new-topic·shared) can't keep the
-                    // card in its 话题. A 话题群 rejects with 18053 (→ fall back below), but
-                    // a 话题 inside a 普通群 SUCCEEDS and the card escapes to the group top
-                    // level. This is the same trap `deliverEphemeralOrReply` (worker-pool)
-                    // guards against with a REGRESSION test; PR #164 was the original live
-                    // fix. Per 申晗 (2026-07-29): 话题内公开可接受 — so thread-scope pickers
-                    // stay on the visible in-thread reply (public card in the 话题), and
-                    // ephemeral is scoped to flat 普通群 only, mirroring /card & /close
-                    // private cards. p2p has no ephemeral option; an unexpected reject
-                    // (18053 etc.) still falls back to the visible reply below.
-                    const privatePicker = targetChatType === 'group'
-                        && targetScope === 'chat'
-                        && getBot(myAppId).config.privateCard === true;
-                    const card = buildRelayPickerCard(entries, targetChatId, targetAnchor, operatorOpenId, loc, undefined, targetScope, targetChatType, privatePicker ? 'private' : 'public');
-                    if (privatePicker) {
-                        const { sendEphemeralCard } = await import('../im/lark/client.js');
-                        try {
-                            await sendEphemeralCard(myAppId, targetChatId, operatorOpenId, card);
-                        }
-                        catch (err) {
-                            // Ephemeral unavailable here (18053 topic / permission / network):
-                            // fall back to the visible reply so the picker still works — the
-                            // privacy win is best-effort, correctness is not.
-                            logger.warn(`[${logTag}] /relay ephemeral picker failed (${err instanceof Error ? err.message : err}); sending visible picker`);
-                            const visibleCard = buildRelayPickerCard(entries, targetChatId, targetAnchor, operatorOpenId, loc, undefined, targetScope, targetChatType, 'public');
-                            await replyAtInvocation(visibleCard, 'interactive');
-                        }
-                    }
-                    else {
-                        await replyAtInvocation(card, 'interactive');
-                    }
-                    break;
-                }
-                const afterFlag = argsLine.replace(/^--create\s*/i, '').trim();
-                const creatorAppId = larkAppId ?? ds?.larkAppId;
-                if (!creatorAppId) {
-                    await sessionReply(rootId, t('cmd.group.no_bot', undefined, loc));
-                    break;
-                }
-                const senderOpenId = message.senderId;
-                // Cross-app stable identity — peer daemons can't compare against
-                // leader's open_id directly because the same user has a different
-                // open_id in each bot's namespace. union_id is shared per tenant.
-                // We pass it through the migrate-to-chat HTTP body; peers compare
-                // against their session's `ownerUnionId` (with fallback to
-                // open_id for sessions persisted before this field existed).
-                const senderUnionId = message.senderUnionId;
-                if (!senderOpenId) {
-                    await sessionReply(rootId, t('cmd.relay.no_sender', undefined, loc));
-                    break;
-                }
-                // `--create` must be invoked inside an existing thread — the source
-                // anchor for peer transfers comes from `ds`. (Picker mode in PR3 is
-                // allowed without a session.)
-                if (!ds) {
-                    await sessionReply(rootId, t('cmd.relay.no_session', undefined, loc));
-                    break;
-                }
-                // Front-loaded guards — transferSession refuses adoptedFrom /
-                // pendingRepo too, but only after createGroupWithBots has already
-                // built a new chat. Failing here keeps relay clean and avoids
-                // orphan-chat garbage when the operation can't possibly succeed.
-                if (ds.session.adoptedFrom) {
-                    await sessionReply(rootId, t('cmd.relay.adopt_not_relayable', undefined, loc));
-                    break;
-                }
-                if (ds.pendingRepo) {
-                    await sessionReply(rootId, t('cmd.relay.not_started_yet', undefined, loc));
-                    break;
-                }
-                // ── p2p (私聊) solo relay: no mention gate, no leader election ──────
-                // 飞书私聊里 @ 不到任何机器人（DM 没有成员列表），mention 门与 leader
-                // 选举在这里没有意义 —— 本 bot 就是唯一参与者兼 leader，新群 = 用户 +
-                // 本 bot，无 peer 协调（peerAppIds 自然为空）。群聊路径语义不变。
-                // chatType 取自 ds（会话创建时从 Lark 事件记录，权威、不漂移）。
-                const sourceIsP2p = ds.chatType === 'p2p';
-                // ── Mention parsing & leader election (mirror of /group) ───────────
-                const mentions = message.mentions ?? [];
-                const knownBotNames = globalKnownBotNames();
-                const botMentions = sourceIsP2p ? [] : mentions.filter(m => m.name && knownBotNames.has(m.name.toLowerCase()));
-                if (!sourceIsP2p) {
-                    if (knownBotNames.size === 0 && mentions.some(m => !!m.name)) {
-                        logger.warn(`[${logTag}] /relay --create: global bot registry empty; cannot elect a creator`);
-                        await sessionReply(rootId, t('cmd.relay.resolve_failed', undefined, loc));
-                        break;
-                    }
-                    if (botMentions.length === 0) {
-                        await sessionReply(rootId, t('cmd.relay.no_mentions', undefined, loc));
-                        break;
-                    }
-                    // Am I `mentions[0]`?
-                    const firstBot = botMentions[0];
-                    const myOpenId = getBotOpenId(creatorAppId);
-                    const myName = getBot(creatorAppId).botName?.toLowerCase();
-                    const myNameAmbiguous = !!myName
-                        && botMentions.filter(m => m.name?.toLowerCase() === myName).length > 1;
-                    const iAmFirstBot = (!!myOpenId && firstBot.openId === myOpenId) ||
-                        (!myOpenId && !!myName && !myNameAmbiguous && firstBot.name?.toLowerCase() === myName);
-                    if (!iAmFirstBot) {
-                        logger.info(`[${logTag}] /relay --create: not the first @-mentioned bot, staying silent`);
-                        break;
-                    }
-                }
-                // Owner-only — only the source session owner may relay this session.
-                if (ds.session.ownerOpenId && ds.session.ownerOpenId !== senderOpenId) {
-                    await sessionReply(rootId, t('cmd.relay.not_owner', undefined, loc));
-                    break;
-                }
-                // ── Resolve @-bots to larkAppIds via the source chat's bot roster ──
-                // p2p: 跳过成员表解析（DM 没有 bot roster，listChatBotMembers 会失败），
-                // 参与者就是本 bot 自己；名字兜底走 botDisplayName（nameOf）。
-                const sourceChatId = ds.chatId;
-                const appIdToName = new Map();
-                const mentionedBotAppIds = [];
-                if (sourceIsP2p) {
-                    mentionedBotAppIds.push(creatorAppId);
-                }
-                else {
-                    let members = [];
-                    try {
-                        members = await listChatBotMembers(creatorAppId, sourceChatId);
-                    }
-                    catch (e) {
-                        logger.warn(`[${logTag}] /relay --create: failed to list source chat members: ${e?.message ?? e}`);
-                    }
-                    const memberByOpenId = new Map(members.map(m => [m.openId, m]));
-                    for (const m of members) {
-                        if (m.larkAppId && m.displayName)
-                            appIdToName.set(m.larkAppId, m.displayName);
-                    }
-                    const seenApp = new Set();
-                    let unresolved;
-                    for (const bm of botMentions) {
-                        const mem = bm.openId ? memberByOpenId.get(bm.openId) : undefined;
-                        if (!mem || !mem.larkAppId) {
-                            unresolved = bm.name;
-                            break;
-                        }
-                        if (!seenApp.has(mem.larkAppId)) {
-                            seenApp.add(mem.larkAppId);
-                            mentionedBotAppIds.push(mem.larkAppId);
-                        }
-                    }
-                    if (unresolved) {
-                        logger.warn(`[${logTag}] /relay --create: unresolved bot "${unresolved}"`);
-                        await sessionReply(rootId, t('cmd.relay.resolve_failed', undefined, loc));
-                        break;
-                    }
-                }
-                // ── Group name extraction (mirror of /group) ───────────────────────
-                let rawArgs = afterFlag;
-                for (const m of mentions) {
-                    if (m.name)
-                        rawArgs = rawArgs.split(`@${m.name}`).join(' ');
-                }
-                const firstLine = rawArgs.split(/\r?\n/).map(s => s.trim()).find(Boolean) ?? '';
-                const MAX_NAME = 50;
-                let groupName;
-                if (firstLine) {
-                    groupName = firstLine.length > MAX_NAME ? firstLine.slice(0, MAX_NAME) + '…' : firstLine;
-                }
-                else {
-                    const now = new Date();
-                    const ts = `${String(now.getMonth() + 1).padStart(2, '0')}/${String(now.getDate()).padStart(2, '0')} ${String(now.getHours()).padStart(2, '0')}:${String(now.getMinutes()).padStart(2, '0')}`;
-                    groupName = t('cmd.relay.empty_group_name', { ts }, loc);
-                }
-                // ── Create the new chat ────────────────────────────────────────────
-                const nameOf = (id) => appIdToName.get(id) ?? botDisplayName(id);
-                let newChatId;
-                let inviteLink;
-                try {
-                    const { createGroupWithBots } = await import('../services/group-creator.js');
-                    const result = await createGroupWithBots({
-                        creatorLarkAppId: creatorAppId,
-                        larkAppIds: mentionedBotAppIds,
-                        name: groupName,
-                        userOpenIds: [senderOpenId],
-                        transferOwnerTo: senderOpenId,
-                    });
-                    newChatId = result.chatId;
-                    const applink = chatAppLink(result.chatId, normalizeBrand(getBot(creatorAppId).config.brand));
-                    inviteLink = result.shareLink ?? applink;
-                }
-                catch (err) {
-                    logger.error(`[${logTag}] /relay --create: createGroup failed: ${err?.message ?? err}`);
-                    await sessionReply(rootId, t('cmd.relay.failed', { error: err?.message ?? String(err) }, loc));
-                    break;
-                }
-                // Snapshot the pre-transfer source anchor — peers locate their own
-                // session by this value, and `transferSession()` will overwrite
-                // `ds.session.rootMessageId` once it runs. Must capture BEFORE the
-                // leader transfer call (caught in review).
-                const sourceAnchor = ds.session.rootMessageId;
-                // ── M1 deferred: post the announcement AFTER all transfers settle ──
-                // Previous flow sent an optimistic "已接力" M1 before running any
-                // transfer. When leader/peers later failed, that M1 was a lie — and
-                // the --create path had no orphan-cleanup (picker path did).
-                //
-                // New flow: pass `newChatId` as a placeholder for targetRootMessageId
-                // into transferSession. Chat-scope routing ignores rootMessageId
-                // (worker-pool transferSession only stores it for audit/UX), so the
-                // placeholder doesn't break routing. Once all outcomes are in, we
-                // post the real M1 with success/failure breakdown, then patch the
-                // leader's session.rootMessageId to that final M1 id. Peer sessions
-                // keep newChatId as a cosmetic placeholder — fixing them would
-                // require another round-trip; chat-scope doesn't actually care.
-                const placeholderRootMessageId = newChatId;
-                // Resolve friendly source-chat label for the M1 body — falls back to
-                // raw chatId if Lark can't return a name. Mirrors picker-path
-                // (card-handler.ts relay_confirm) so the message reads the same in
-                // both UX entry points; p2p source has no chat name (chat.get often
-                // fails/returns empty for DMs) — use the locale-aware 单聊 label
-                // instead of leaking a raw oc_ id into the M1.
-                const { getChatName } = await import('../im/lark/client.js');
-                const sourceLabel = sourceIsP2p
-                    ? t('card.relay.type_p2p', undefined, loc)
-                    : (await getChatName(creatorAppId, sourceChatId).catch(() => null)) ?? sourceChatId;
-                // ── Step 1: leader transfers its own session (if any) ───────────────
-                // Empty-leader handling: daemon auto-creates a placeholder ds for any
-                // DAEMON_COMMAND (worker:null + hasHistory:false). If the user typed
-                // `/relay --create` in a chat where they never actually chatted with
-                // the bot, ds IS that placeholder — there's no real session to
-                // migrate. Pre-Codex-review we'd happily transferSession the empty
-                // shell and report "已就绪：leader" as a lie. Now we detect this,
-                // skip transferSession, mark leader as `no_session`, and close the
-                // scratch so it doesn't linger as a ghost.
-                //
-                // The new chat is still created (createGroupWithBots already ran
-                // above) — that itself is a valuable product outcome since the
-                // mentioned bots were invited. Peers continue through their normal
-                // path; the final M1 template adapts to "all_fresh" when no bot
-                // actually had a session to bring along.
-                const reportLines = [];
-                const leaderName = nameOf(creatorAppId);
-                const successBotNames = [];
-                const failedBotNames = [];
-                // Use the persisted-marker predicate, not runtime ds.hasHistory:
-                // restoreActiveSessions sets hasHistory:true UNCONDITIONALLY on
-                // restart (session-manager.ts:618), so a scratch that survives a
-                // restart comes back with hasHistory:true and would defeat a
-                // naive `!!ds.worker || ds.hasHistory` check. cliId / lastCliInput
-                // are only written after a real worker started the CLI, so they
-                // survive restart correctly.
-                const { isRelayableRealSession } = await import('./worker-pool.js');
-                const leaderHasRealSession = isRelayableRealSession(ds);
-                if (leaderHasRealSession) {
-                    const { transferSession } = await import('./worker-pool.js');
-                    // Target chat was just built by createGroupWithBots — by
-                    // construction a regular group, chat-scope.
-                    const leaderResult = await transferSession(ds.session.sessionId, newChatId, placeholderRootMessageId, 'group', 'chat');
-                    if (!leaderResult.ok) {
-                        // Real session, real failure (worker busy / unsupported target
-                        // / tmux issue). Abort the entire --create flow — the new chat
-                        // exists but is empty of any migrated session; we don't post
-                        // an M1 because there's nothing to announce.
-                        reportLines.push(t('cmd.relay.report_leader_failed', { bot: leaderName, error: leaderResult.error }, loc));
-                        await sessionReply(rootId, t('cmd.relay.created', { name: groupName, link: inviteLink, report: reportLines.join('\n') }, loc));
-                        break;
-                    }
-                    reportLines.push(t('cmd.relay.report_leader_ok', { bot: leaderName }, loc));
-                    successBotNames.push(leaderName);
-                }
-                else {
-                    // Empty leader: no real session to migrate.
-                    reportLines.push(t('cmd.relay.report_leader_no_session', { bot: leaderName }, loc));
-                    failedBotNames.push(leaderName);
-                    // Close the daemon-command scratch so it doesn't linger as a
-                    // ghost active row at the source anchor (same hygiene that
-                    // transferSession's pre-flight applies to target-chat scratches).
-                    const { closeSession } = await import('./worker-pool.js');
-                    await closeSession(ds.session.sessionId).catch(err => {
-                        logger.warn(`[${logTag}] /relay --create: failed to close empty-leader scratch: ${err instanceof Error ? err.message : err}`);
-                    });
-                }
-                // ── Step 2: coordinate peer daemons (parallel) ─────────────────────
-                const { findOnlineDaemon } = await import('../utils/daemon-discovery.js');
-                const peerAppIds = mentionedBotAppIds.filter(id => id !== creatorAppId);
-                const peerOutcomes = await Promise.all(peerAppIds.map(async (peerAppId) => {
-                    const botName = nameOf(peerAppId);
-                    const daemon = findOnlineDaemon(peerAppId);
-                    if (!daemon)
-                        return { peerAppId, botName, status: 'offline' };
-                    try {
-                        const ctrl = new AbortController();
-                        const tt = setTimeout(() => ctrl.abort(), 5000);
-                        const res = await fetchDaemonIpc(daemon.ipcPort, '/api/sessions/migrate-to-chat', {
-                            method: 'POST',
-                            headers: { 'content-type': 'application/json' },
-                            body: JSON.stringify({
-                                sourceAnchor,
-                                targetChatId: newChatId,
-                                targetRootMessageId: placeholderRootMessageId,
-                                requesterLarkAppId: creatorAppId,
-                                requestingUserOpenId: senderOpenId,
-                                // union_id is cross-app stable within a tenant — peer
-                                // compares against its own session.ownerUnionId rather
-                                // than translating open_ids per bot. Optional for
-                                // backward compat with daemons older than this commit.
-                                requestingUserUnionId: senderUnionId,
-                            }),
-                            signal: ctrl.signal,
-                        }).finally(() => clearTimeout(tt));
-                        const body = await res.json().catch(() => ({}));
-                        if (res.ok && body.ok)
-                            return { peerAppId, botName, status: 'ok' };
-                        if (body.error === 'no_session_at_anchor')
-                            return { peerAppId, botName, status: 'no_session' };
-                        if (body.error === 'not_session_owner')
-                            return { peerAppId, botName, status: 'not_owner' };
-                        if (body.error === 'worker_busy')
-                            return { peerAppId, botName, status: 'busy' };
-                        return { peerAppId, botName, status: 'failed', error: body.error ?? `http_${res.status}` };
-                    }
-                    catch (err) {
-                        const reason = err?.name === 'AbortError' ? 'busy' : 'failed';
-                        return { peerAppId, botName, status: reason, error: err?.message ?? String(err) };
-                    }
-                }));
-                // Bucket peer outcomes for the final M1 (success / failure) AND extend the
-                // source-chat report with per-peer detail. Leader was already bucketed
-                // above (real-success → successBotNames; real-fail or empty-leader →
-                // failedBotNames), so we only iterate peers here.
-                for (const r of peerOutcomes) {
-                    if (r.status === 'ok') {
-                        successBotNames.push(r.botName);
-                        reportLines.push(t('cmd.relay.report_peer_ok', { bot: r.botName }, loc));
-                    }
-                    else {
-                        failedBotNames.push(r.botName);
-                        switch (r.status) {
-                            case 'no_session':
-                                reportLines.push(t('cmd.relay.report_peer_no_session', { bot: r.botName }, loc));
-                                break;
-                            case 'not_owner':
-                                reportLines.push(t('cmd.relay.report_peer_not_owner', { bot: r.botName }, loc));
-                                break;
-                            case 'offline':
-                                reportLines.push(t('cmd.relay.report_peer_offline', { bot: r.botName }, loc));
-                                break;
-                            case 'busy':
-                                reportLines.push(t('cmd.relay.report_peer_busy', { bot: r.botName }, loc));
-                                break;
-                            case 'failed':
-                                reportLines.push(t('cmd.relay.report_peer_failed', { bot: r.botName, error: r.error ?? 'unknown' }, loc));
-                                break;
-                        }
-                    }
-                }
-                // ── Step 3: post the real M1 with status breakdown ─────────────────
-                // Three templates:
-                //   - all_ok      : every bot migrated cleanly
-                //   - partial     : some migrated, some didn't (failed list explains)
-                //   - all_fresh   : nobody had a session to migrate (group's still
-                //                   useful — bots were invited; user just @s to start)
-                // Pass the raw text — sendMessage wraps `'text'` msgType bodies into
-                // { text: content } itself.
-                let finalM1Text;
-                if (successBotNames.length === 0) {
-                    finalM1Text = t('cmd.relay.m1_final_all_fresh', { sourceChat: sourceLabel }, loc);
-                }
-                else if (failedBotNames.length === 0) {
-                    finalM1Text = t('cmd.relay.m1_final_all_ok', {
-                        sourceChat: sourceLabel,
-                        successBots: successBotNames.join('、'),
-                    }, loc);
-                }
-                else {
-                    finalM1Text = t('cmd.relay.m1_final_partial', {
-                        sourceChat: sourceLabel,
-                        successBots: successBotNames.join('、'),
-                        failedBots: failedBotNames.join('、'),
-                    }, loc);
-                }
-                try {
-                    const finalM1Id = await sendMessage(creatorAppId, newChatId, finalM1Text, 'text');
-                    // Patch the leader's session.rootMessageId to the real M1 id, but
-                    // only if the leader was actually transferred — for the empty-
-                    // leader / all_fresh path, ds was either closed or never moved,
-                    // so we don't touch it (would write to a closed/stale record).
-                    if (leaderHasRealSession && successBotNames.includes(leaderName)) {
-                        ds.session.rootMessageId = finalM1Id;
-                        sessionStore.updateSession(ds.session);
-                    }
-                }
-                catch (err) {
-                    // Non-fatal: transfers already succeeded. The source-chat report
-                    // (sessionReply below) is the user's authoritative status.
-                    logger.warn(`[${logTag}] /relay --create: final M1 send failed: ${err?.message ?? err}`);
-                }
-                await sessionReply(rootId, t('cmd.relay.created', { name: groupName, link: inviteLink, report: reportLines.join('\n') }, loc));
-                logger.info(`[${logTag}] /relay --create completed: chat=${newChatId} leader=${creatorAppId} peers=[${peerAppIds.join(',')}]`);
-                break;
-            }
-            case '/fork': {
-                // Session fork (Bot 分身): non-destructive copy of a running session
-                // into a SECOND independent session at a new anchor; source untouched.
-                // `/fork <task>` hosts it in a new sub-topic of the same topic group;
-                // `/fork --create <name>` keeps the existing new-group destination.
-                const argsLine = message.content.replace(/^\/fork\s*/i, '').trim();
-                const forkAppId = larkAppId ?? ds?.larkAppId;
-                if (!forkAppId) {
-                    await sessionReply(rootId, t('cmd.fork.no_bot', undefined, loc));
-                    break;
-                }
-                if (!ds) {
-                    await sessionReply(rootId, t('cmd.fork.no_session', undefined, loc));
-                    break;
-                }
-                const forkSenderOpenId = message.senderId;
-                if (!forkSenderOpenId) {
-                    await sessionReply(rootId, t('cmd.fork.no_sender', undefined, loc));
-                    break;
-                }
-                // Owner-only.
-                if (ds.session.ownerOpenId && ds.session.ownerOpenId !== forkSenderOpenId) {
-                    await sessionReply(rootId, t('cmd.fork.not_owner', undefined, loc));
-                    break;
-                }
-                // Capability gate — refuse non-forkable backends up front with a clear,
-                // typed message (mirrors the design doc §4 refusal). Cheap check before
-                // we create any group.
-                const { isForkCapableSession } = await import('./worker-pool.js');
-                if (!isForkCapableSession(ds)) {
-                    const cliName = getCliDisplayName((ds.session.cliId ?? getBot(forkAppId).config.cliId ?? 'claude-code'));
-                    await sessionReply(rootId, t('cmd.fork.unsupported_backend', { cli: cliName }, loc));
-                    break;
-                }
-                // Front guards (fork needs a clean, real, idle source — same as relay).
-                // These MUST run before creating either a topic root or a new group.
-                if (ds.session.adoptedFrom) {
-                    await sessionReply(rootId, t('cmd.fork.adopt_not_forkable', undefined, loc));
-                    break;
-                }
-                if (ds.pendingRepo) {
-                    await sessionReply(rootId, t('cmd.fork.not_started_yet', undefined, loc));
-                    break;
-                }
-                // Real, resumable source session? A bare /fork scratch (worker:null, no
-                // persisted CLI markers) is not forkable — most commonly this fires when
-                // /fork was invoked at the group top-level while the session lives in a
-                // 话题 (thread-scope). Refuse BEFORE creating any group.
-                const { isRelayableRealSession: forkIsRealSession } = await import('./worker-pool.js');
-                if (!forkIsRealSession(ds)) {
-                    await sessionReply(rootId, t('cmd.fork.no_source_here', undefined, loc));
-                    break;
-                }
-                // Idle check up front — mid-turn source can't be forked cleanly.
-                const forkSt = ds.lastScreenStatus;
-                if (ds.worker && !ds.worker.killed && forkSt !== 'idle' && forkSt !== 'limited') {
-                    await sessionReply(rootId, t('cmd.fork.mid_turn', undefined, loc));
-                    break;
-                }
-                if (!/^--create\b/i.test(argsLine)) {
-                    if (!argsLine) {
-                        await sessionReply(rootId, t('cmd.fork.subtopic_usage', undefined, loc));
-                        break;
-                    }
-                    if (ds.scope !== 'thread' || !ds.session.rootMessageId?.startsWith('om_')) {
-                        await sessionReply(rootId, t('cmd.fork.subtopic_thread_only', undefined, loc));
-                        break;
-                    }
-                    let chatMode;
-                    try {
-                        chatMode = await getChatModeStrict(forkAppId, ds.chatId);
-                    }
-                    catch {
-                        // Treat an unknown mode as unsupported: sending a top-level message
-                        // to a regular group would not create the isolated topic we promise.
-                    }
-                    if (chatMode !== 'topic') {
-                        await sessionReply(rootId, t('cmd.fork.subtopic_thread_only', undefined, loc));
-                        break;
-                    }
-                    const result = await startForkSubtopicSession(argsLine, ds, message, forkAppId);
-                    if (!result.ok) {
-                        const errKey = result.error === 'worker_busy' ? 'cmd.fork.mid_turn'
-                            : result.error === 'adopt_not_forkable' ? 'cmd.fork.adopt_not_forkable'
-                                : result.error === 'fork_unsupported_backend' ? 'cmd.fork.unsupported_backend'
-                                    : result.error === 'not_started_yet' ? 'cmd.fork.not_started_yet'
-                                        : undefined;
-                        if (errKey === 'cmd.fork.unsupported_backend') {
-                            const cliName = getCliDisplayName((ds.session.cliId ?? getBot(forkAppId).config.cliId ?? 'claude-code'));
-                            await sessionReply(rootId, t(errKey, { cli: cliName }, loc));
-                        }
-                        else if (errKey) {
-                            await sessionReply(rootId, t(errKey, undefined, loc));
-                        }
-                        else {
-                            await sessionReply(rootId, t('cmd.fork.failed', { error: result.error }, loc));
-                        }
-                        if (result.orphanTopic) {
-                            await sessionReply(rootId, t('cmd.fork.orphan_topic_left', undefined, loc));
-                        }
-                        break;
-                    }
-                    await sessionReply(rootId, t('cmd.fork.subtopic_created', { link: result.link }, loc));
-                    logger.info(`[${logTag}] /fork sub-topic completed: child=${result.childSessionId.substring(0, 8)} anchor=${result.anchorId.substring(0, 12)} (source ${ds.session.sessionId.substring(0, 8)} untouched)`);
-                    break;
-                }
-                // ── /fork --create <群名> @bot ──────────────────────────────────────
-                const afterFlag = argsLine.replace(/^--create\s*/i, '').trim();
-                // Resolve the bot to invite into the new group. Fork copies THIS
-                // session's transcript, so the child MUST run the same bot as the
-                // source — i.e. the invited bot is always this bot. Therefore:
-                //   • no @mention → default to the current bot (the common "fork myself
-                //     to a new group" case — no need to @ the bot you're already talking to);
-                //   • an explicit @mention → must resolve to THIS bot, else refuse.
-                const forkSourceIsP2p = ds.chatType === 'p2p';
-                const targetBotAppId = forkAppId;
-                let targetBotName = botDisplayName(forkAppId);
-                if (!forkSourceIsP2p) {
-                    const forkMentions = message.mentions ?? [];
-                    const knownBotNames = globalKnownBotNames();
-                    const forkBotMentions = forkMentions.filter(m => m.name && knownBotNames.has(m.name.toLowerCase()));
-                    // Only validate WHEN the user explicitly @'d a bot. An explicit
-                    // mention that resolves to a DIFFERENT bot is a real error (fork can't
-                    // hand this session's transcript to another CLI). No mention → just
-                    // use the current bot.
-                    if (forkBotMentions.length > 0) {
-                        const firstBot = forkBotMentions[0];
-                        const myOpenId = getBotOpenId(forkAppId);
-                        const myName = getBot(forkAppId).botName?.toLowerCase();
-                        const mentionIsThisBot = (!!myOpenId && firstBot.openId === myOpenId) ||
-                            (!myOpenId && !!myName && firstBot.name?.toLowerCase() === myName);
-                        if (!mentionIsThisBot) {
-                            await sessionReply(rootId, t('cmd.fork.wrong_bot', undefined, loc));
-                            break;
-                        }
-                    }
-                }
-                // Group name = first non-empty line after --create (mention text stripped).
-                let forkRawArgs = afterFlag;
-                for (const m of (message.mentions ?? [])) {
-                    if (m.name)
-                        forkRawArgs = forkRawArgs.split(`@${m.name}`).join(' ');
-                }
-                const forkFirstLine = forkRawArgs.split(/\r?\n/).map(s => s.trim()).find(Boolean) ?? '';
-                const FORK_MAX_NAME = 50;
-                let forkGroupName;
-                if (forkFirstLine) {
-                    forkGroupName = forkFirstLine.length > FORK_MAX_NAME ? forkFirstLine.slice(0, FORK_MAX_NAME) + '…' : forkFirstLine;
-                }
-                else {
-                    const src = ds.session.title || ds.session.sessionId.substring(0, 8);
-                    forkGroupName = `🔱 ${src}`.slice(0, FORK_MAX_NAME);
-                }
-                // Create the new chat (single bot + the invoking user).
-                let forkChatId;
-                let forkInviteLink;
-                try {
-                    const { createGroupWithBots } = await import('../services/group-creator.js');
-                    const result = await createGroupWithBots({
-                        creatorLarkAppId: forkAppId,
-                        larkAppIds: [targetBotAppId],
-                        name: forkGroupName,
-                        userOpenIds: [forkSenderOpenId],
-                        transferOwnerTo: forkSenderOpenId,
-                    });
-                    forkChatId = result.chatId;
-                    const applink = chatAppLink(result.chatId, normalizeBrand(getBot(forkAppId).config.brand));
-                    forkInviteLink = result.shareLink ?? applink;
-                }
-                catch (err) {
-                    logger.error(`[${logTag}] /fork --create: createGroup failed: ${err?.message ?? err}`);
-                    await sessionReply(rootId, t('cmd.fork.failed', { error: err?.message ?? String(err) }, loc));
-                    break;
-                }
-                // Fork the session into the new chat (chat-scope, group). The new chat
-                // is empty by construction, so no target-anchor conflict. Source is
-                // never touched.
-                const { forkSession } = await import('./worker-pool.js');
-                const forkResult = await forkSession(ds.session.sessionId, forkChatId, forkChatId, 'group', 'chat');
-                if (!forkResult.ok) {
-                    // Residual-orphan cleanup: the front guards already ran before
-                    // createGroupWithBots, so this only fires on a narrow TOCTOU race
-                    // (source went busy / closed in the sub-second between guard and
-                    // fork). Best-effort disband the just-created empty group so a failed
-                    // fork never leaves an orphan chat. May fail if ownership already
-                    // transferred to the user (transferOwnerTo) — then we just tell them.
-                    let orphanCleaned = false;
-                    try {
-                        const { disbandChat } = await import('../services/groups-store.js');
-                        const dis = await disbandChat(forkAppId, forkChatId);
-                        orphanCleaned = dis.ok;
-                        if (!dis.ok)
-                            logger.warn(`[${logTag}] /fork --create: orphan group ${forkChatId} disband failed: ${dis.error}`);
-                    }
-                    catch (e) {
-                        logger.warn(`[${logTag}] /fork --create: orphan group ${forkChatId} disband threw: ${e?.message ?? e}`);
-                    }
-                    const errKey = forkResult.error === 'worker_busy' ? 'cmd.fork.mid_turn'
-                        : forkResult.error === 'adopt_not_forkable' ? 'cmd.fork.adopt_not_forkable'
-                            : forkResult.error === 'fork_unsupported_backend' ? 'cmd.fork.unsupported_backend'
-                                : forkResult.error === 'not_started_yet' ? 'cmd.fork.not_started_yet'
-                                    : undefined;
-                    if (errKey === 'cmd.fork.unsupported_backend') {
-                        const cliName = getCliDisplayName((ds.session.cliId ?? getBot(forkAppId).config.cliId ?? 'claude-code'));
-                        await sessionReply(rootId, t(errKey, { cli: cliName }, loc));
-                    }
-                    else if (errKey) {
-                        await sessionReply(rootId, t(errKey, undefined, loc));
-                    }
-                    else {
-                        await sessionReply(rootId, t('cmd.fork.failed', { error: forkResult.error }, loc));
-                    }
-                    if (!orphanCleaned) {
-                        await sessionReply(rootId, t('cmd.fork.orphan_group_left', { name: forkGroupName }, loc));
-                    }
-                    logger.warn(`[${logTag}] /fork --create: forkSession failed (${forkResult.error}); new chat ${forkChatId} ${orphanCleaned ? 'disbanded' : 'LEFT (disband failed)'}`);
-                    break;
-                }
-                await sessionReply(rootId, t('cmd.fork.created', { name: forkGroupName, link: forkInviteLink }, loc));
-                logger.info(`[${logTag}] /fork --create completed: chat=${forkChatId} child=${forkResult.childSessionId.substring(0, 8)} bot=${targetBotAppId} (source ${ds.session.sessionId.substring(0, 8)} untouched)`);
-                break;
-            }
-            case '/forklist': {
-                if (!ds) {
-                    await sessionReply(rootId, t('cmd.fork.no_session', undefined, loc));
-                    break;
-                }
-                await upsertForkPanelCard(ds, loc, { allowEmpty: true });
-                break;
-            }
-            case '/card': {
-                // Existing-session path. New topics route /card via handleCardCommand at
-                // the router (so no phantom session is created). off/on work without a
-                // live worker; show/bare summons a card.
-                const appId = ds?.larkAppId ?? larkAppId;
-                const cardChatId = ds?.chatId;
-                if (!appId || !cardChatId) {
-                    await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
-                    break;
-                }
-                await handleCardCommand(rootId, appId, cardChatId, message.senderId, message.content, deps);
-                break;
-            }
-            case '/term': {
-                // Existing-session path. New topics route /term via handleTermLinkCommand
-                // at the router (daemon.ts) so no phantom worker=null session is created.
-                const appId = ds?.larkAppId ?? larkAppId;
-                if (!appId) {
-                    await sessionReply(rootId, t('cmd.no_active_session', undefined, loc));
-                    break;
-                }
-                await handleTermLinkCommand(rootId, appId, ds?.chatId ?? '', message.senderId, message.content, deps);
-                break;
-            }
-            case '/list-slash-command':
-            case '/slash': {
-                // 列出本 bot 当前可用的 slash 命令，分四段：
-                //   ① botmux 固定放行的透传白名单（PASSTHROUGH_COMMANDS）
-                //   ② 当前 CLI adapter 默认透传命令（defaultPassthroughCommands）
-                //   ③ 用户在 bots.json 自定义配置的额外透传命令（customPassthroughCommands）
-                //   ④ 文件系统自动发现的 CLI 自定义命令 / skill / 插件
-                // MCP 的 /mcp__<server>__<prompt> 需运行时握手才能枚举，这里仅按 .mcp.json 提示 server 名。
-                const botCfg = ds
-                    ? getBot(ds.larkAppId).config
-                    : (larkAppId ? getBot(larkAppId).config : getAllBots()[0]?.config);
-                const cliId = botCfg?.cliId ?? 'claude-code';
-                const cliName = ds
-                    ? sessionCliDisplayName(ds)
-                    : configuredRuntimeDisplayName(botCfg?.cliRuntime) ?? getCliDisplayName(cliId);
-                const workingDir = getSessionWorkingDir(ds);
-                const builtin = [...PASSTHROUGH_COMMANDS];
-                const adapterDefaults = resolveAdapterDefaultPassthroughCommands(larkAppId);
-                // 只展示「实际生效」的 custom 命令：用与 resolvePassthroughCommands 同一套
-                // normalize 过滤掉手写 bots.json 里遮蔽 daemon 命令 / 非法的项（parser 出于
-                // 兼容会保留它们，但路由会丢弃），避免 `/status` 之类被展示成可用却走 daemon。
-                const custom = [...new Set((botCfg?.customPassthroughCommands ?? [])
-                        .map(normalizePassthroughCommand)
-                        .filter((c) => !!c))];
-                let cliAdapter;
-                try {
-                    cliAdapter = createCliAdapterSync(cliId, botCfg?.cliPathOverride);
-                }
-                catch (err) {
-                    logger.warn(`[${logTag}] /list-slash-command could not create adapter for ${cliId}: ${err instanceof Error ? err.message : String(err)}`);
-                }
-                const discoverySupported = supportsFilesystemCommandDiscovery(cliAdapter);
-                const discovered = cliAdapter && discoverySupported
-                    ? discoverSlashCommandsForAdapter(workingDir, cliAdapter)
-                    : [];
-                const mcpServers = listMcpServerNames(workingDir);
-                const card = buildSlashListCard({ cliName, builtin, adapterDefaults, custom, discovered, workingDir, mcpServers, discoverySupported }, loc);
-                await sessionReply(rootId, card, 'interactive');
-                logger.info(`[${logTag}] /list-slash-command builtin=${builtin.length} custom=${custom.length} discovered=${discovered.length}`);
-                break;
-            }
-            case '/help': {
-                const helpAppId = ds?.larkAppId ?? larkAppId;
-                const botCfg = ds ? getBot(ds.larkAppId).config : (helpAppId ? getBot(helpAppId).config : getAllBots()[0]?.config);
-                const cliName = ds
-                    ? sessionCliDisplayName(ds)
-                    : configuredRuntimeDisplayName(botCfg?.cliRuntime)
-                        ?? getCliDisplayName(botCfg?.cliId ?? 'claude-code');
-                const passthroughCommands = [...resolvePassthroughCommands(helpAppId)];
-                const help = [
-                    t('help.heading_session', undefined, loc),
-                    t('help.close', { cliName }, loc),
-                    t('help.restart', { cliName }, loc),
-                    t('help.topic', undefined, loc),
-                    t('help.cd', { cliName }, loc),
-                    t('help.repo_list', undefined, loc),
-                    t('help.repo_n', undefined, loc),
-                    t('help.repo_path', undefined, loc),
-                    t('help.repo_wt', undefined, loc),
-                    t('help.rename', undefined, loc),
-                    t('help.status', undefined, loc),
-                    t('help.card', undefined, loc),
-                    t('help.term', undefined, loc),
-                    t('help.dashboard', undefined, loc),
-                    t('help.issue', undefined, loc),
-                    t('help.insight', undefined, loc),
-                    t('help.subscribe_doc', undefined, loc),
-                    t('help.watch_comment', undefined, loc),
-                    t('help.vc', undefined, loc),
-                    t('help.summary', undefined, loc),
-                    '',
-                    t('help.heading_passthrough', { cliName }, loc),
-                    // 展示当前 bot 实际生效的透传集合：固定白名单 + adapter 默认 + 有效自定义项。
-                    passthroughCommands.join(' '),
-                    '',
-                    t('help.heading_schedule', undefined, loc),
-                    t('help.schedule_create', undefined, loc),
-                    t('help.schedule_list', undefined, loc),
-                    t('help.schedule_remove', undefined, loc),
-                    t('help.schedule_toggle', undefined, loc),
-                    t('help.schedule_run', undefined, loc),
-                    '',
-                    t('help.schedule_formats', undefined, loc),
-                    '',
-                    t('help.heading_adopt', undefined, loc),
-                    t('help.adopt', undefined, loc),
-                    t('help.adopt_pane', undefined, loc),
-                    t('help.detach', undefined, loc),
-                    '',
-                    t('help.heading_collab', undefined, loc),
-                    t('help.introduce', undefined, loc),
-                    t('help.relay', undefined, loc),
-                    t('help.relay_create', undefined, loc),
-                    t('help.fork', undefined, loc),
-                    t('help.forklist', undefined, loc),
-                    '',
-                    t('help.heading_login', undefined, loc),
-                    t('help.login', undefined, loc),
-                    t('help.login_status', undefined, loc),
-                    t('help.pair', undefined, loc),
-                    '',
-                    t('help.heading_workflow', undefined, loc),
-                    t('help.workflow_run', undefined, loc),
-                    t('help.workflow_cancel', undefined, loc),
-                    '',
-                    t('help.heading_role', undefined, loc),
-                    t('help.role_show', undefined, loc),
-                    t('help.role_set', undefined, loc),
-                    t('help.role_team', undefined, loc),
-                    t('help.role_cap', undefined, loc),
-                    t('help.role_profile', undefined, loc),
-                    '',
-                    t('help.heading_oncall', undefined, loc),
-                    t('help.oncall_bind', undefined, loc),
-                    t('help.oncall_unbind', undefined, loc),
-                    t('help.oncall_status', undefined, loc),
-                    '',
-                    t('help.heading_grant', undefined, loc),
-                    t('help.grant', undefined, loc),
-                    t('help.revoke', undefined, loc),
-                    t('help.vc_auth', undefined, loc),
-                    t('help.invite', undefined, loc),
-                    '',
-                    t('help.heading_config', undefined, loc),
-                    t('help.config_get', undefined, loc),
-                    t('help.config_set', undefined, loc),
-                    t('help.skills', undefined, loc),
-                    t('help.reply_mode', undefined, loc),
-                    '',
-                    t('help.heading_group', undefined, loc),
-                    t('help.group', undefined, loc),
-                    '',
-                    t('help.list_slash', undefined, loc),
-                    t('help.help', undefined, loc),
-                ];
-                await sessionReply(rootId, help.join('\n'));
-                break;
-            }
-        }
-    }
-    catch (err) {
-        logger.error(`[${logTag}] Command ${cmd} error: ${err.message}`);
-    }
-}
-async function handleCodexAppAdoptCommand(args, rootId, ds, deps, larkAppId) {
-    const sessionReply = (rid, content, msgType) => deps.sessionReply(rid, content, msgType, larkAppId);
-    const loc = localeForBot(ds.larkAppId ?? larkAppId);
-    const botCfg = getBot(ds.larkAppId).config;
-    const sourceSession = ds.session;
-    const sourceAnchor = sessionAnchorId(ds);
-    let threads;
-    try {
-        threads = await listCodexAppThreads({
-            codexBin: botCfg.cliPathOverride,
-            cwd: getSessionWorkingDir(ds),
-            limit: 50,
-        });
-    }
-    catch (err) {
-        await sessionReply(rootId, t('cmd.codex_app_adopt.list_failed', { error: err?.message ?? String(err) }, loc));
-        return;
-    }
-    if (ds.session !== sourceSession
-        || ds.session.status !== 'active'
-        || deps.activeSessions.get(sessionKey(sourceAnchor, ds.larkAppId)) !== ds
-        || isSessionTransferring(ds)) {
-        await sessionReply(rootId, t('cmd.session.transfer_in_progress', undefined, loc));
-        return;
-    }
-    if (threads.length === 0) {
-        await sessionReply(rootId, t('cmd.codex_app_adopt.no_threads', undefined, loc));
-        return;
-    }
-    if (args) {
-        const target = threads.find(t => t.threadId === args || t.threadId.startsWith(args));
-        if (!target) {
-            await sessionReply(rootId, t('cmd.codex_app_adopt.thread_not_found', { threadId: args }, loc));
-            return;
-        }
-        await startCodexAppThreadSession(target, ds, deps, larkAppId);
-        return;
-    }
-    const cardJson = buildCodexAppThreadSelectCard(threads, rootId, loc);
-    await sessionReply(rootId, cardJson, 'interactive');
-}
-// ─── Adopt session helper ────────────────────────────────────────────────────
-/** Discriminate a zellij adopt candidate from tmux/herdr candidates. */
-function isZellijTarget(t) {
-    return 'zellijPaneId' in t;
-}
-/**
- * Refuse a takeover (`/adopt`, Codex App thread, disk resume import) while the
- * session is still on the first-spawn repo-select gate (`pendingRepo`).
- *
- * Adopt/import attaches to an already-running CLI, so it cannot double as a way
- * to finish that gate — the two states are mutually exclusive by design. Rather
- * than migrate the pending placeholder in place (which used to leave a
- * contradictory `adopt` + "待选仓库" session, and risked folding botmux
- * envelopes into the external CLI), we post a card that explains the refusal
- * and offers a one-tap "close session". After the user closes it, a fresh
- * `/adopt` runs as a clean first message (which never enters pendingRepo).
- *
- * Returns true when the takeover was blocked (caller must return immediately).
- * Note pendingRepo is in-memory only, so this can never wrongly fire on a
- * daemon-restored session.
- */
-async function blockTakeoverWhilePendingRepo(ds, sessionReply) {
-    if (!ds.pendingRepo)
-        return false;
-    const loc = localeForBot(ds.larkAppId);
-    const card = buildAdoptBlockedCard(sessionAnchorId(ds), ds.session.sessionId, getBot(ds.larkAppId).config.cliId, loc);
-    await sessionReply(sessionAnchorId(ds), card, 'interactive');
-    logger.info(`[${tag(ds)}] Takeover refused: session still on pendingRepo gate — posted close-session card`);
-    return true;
-}
-export async function startCodexAppThreadSession(thread, ds, deps, larkAppId) {
-    const sessionReply = (rid, content, msgType) => deps.sessionReply(rid, content, msgType, larkAppId);
-    const loc = localeForBot(ds.larkAppId ?? larkAppId);
-    const title = codexAppThreadTitle(thread);
-    if (isSessionTransferring(ds)) {
-        await sessionReply(sessionAnchorId(ds), t('cmd.session.transfer_in_progress', undefined, loc));
-        return;
-    }
-    if (await blockTakeoverWhilePendingRepo(ds, sessionReply))
-        return;
-    ds.adoptedFrom = undefined;
-    ds.workingDir = thread.cwd;
-    ds.hasHistory = true;
-    ds.currentTurnTitle = undefined;
-    ds.lastScreenContent = undefined;
-    ds.lastScreenStatus = undefined;
-    ds.session.workingDir = thread.cwd;
-    ds.session.title = `Codex App: ${title}`;
-    ds.session.cliId = 'codex-app';
-    ds.session.cliSessionId = thread.threadId;
-    ds.session.adoptedFrom = undefined;
-    sessionStore.updateSession(ds.session);
-    forkWorker(ds, '', true);
-    await sessionReply(sessionAnchorId(ds), t('cmd.codex_app_adopt.success', { title }, loc));
-}
-export async function startAdoptSession(target, ds, deps, larkAppId) {
-    const sessionReply = (rid, content, msgType) => deps.sessionReply(rid, content, msgType, larkAppId);
-    const loc = localeForBot(ds.larkAppId ?? larkAppId);
-    if (isSessionTransferring(ds)) {
-        await sessionReply(sessionAnchorId(ds), t('cmd.session.transfer_in_progress', undefined, loc));
-        return;
-    }
-    const zellij = isZellijTarget(target);
-    if (!zellij && target.source === 'herdr' && target.herdrSessionName && target.herdrAgentName) {
-        const occupied = [...deps.activeSessions.values()].some(active => {
-            if (active.session.sessionId === ds.session.sessionId || active.session.status !== 'active' || active.adoptedFrom)
-                return false;
-            const owned = active.session.persistentBackendTarget;
-            return owned?.backendType === 'herdr'
-                && owned.sessionName === target.herdrSessionName
-                && owned.agentName === target.herdrAgentName;
-        });
-        if (occupied) {
-            await sessionReply(sessionAnchorId(ds), t('cmd.adopt.target_exited', undefined, loc));
-            return;
-        }
-    }
-    // Fail-closed at the ENTRY point, BEFORE any target validation or state
-    // mutation: a sandbox-enabled bot can't wrap an already-running CLI
-    // (confinement is spawn-time only). Reject here so `adoptedFrom` is never
-    // persisted and "adopted" is never replied — otherwise the session would
-    // become a worker=null pseudo-adopt whose next message still routes as a
-    // bridge/adopt session. Covers both real host-process adopt entries
-    // (`/adopt <pane>` and the adopt_select card, which both route here). Checks
-    // the live bot flag AND the session's frozen sandbox decision (union).
-    const adoptBotCfg = getBot(ds.larkAppId ?? larkAppId).config;
-    const adoptRuntimeExecutable = ds.session.agentFrozen
-        ? ds.session.cliRuntime?.source === 'configured' ? ds.session.cliRuntime.executable : undefined
-        : adoptBotCfg.cliRuntime?.executable;
-    if (adoptSandboxBlocked(adoptBotCfg, ds.session)) {
-        await sessionReply(sessionAnchorId(ds), t('cmd.adopt.sandbox_blocked', undefined, loc));
-        return;
-    }
-    // A session still on the repo-select gate can't be adopted in place — refuse
-    // and offer a one-tap close so the user retires it and re-adopts cleanly.
-    if (await blockTakeoverWhilePendingRepo(ds, sessionReply))
-        return;
-    const valid = zellij
-        ? validateZellijAdoptTarget(target.zellijSession, target.zellijPaneId, target.cliPid, target.cliId, adoptRuntimeExecutable)
-        : validateAdoptTarget(target, adoptRuntimeExecutable);
-    if (!valid) {
-        await sessionReply(sessionAnchorId(ds), t('cmd.adopt.target_exited', undefined, loc));
-        return;
-    }
-    const project = target.cwd.split('/').pop() || target.cwd;
-    const pane = zellij ? `${target.zellijSession}/${target.zellijPaneId}` : adoptTargetLabel(target);
-    ds.workingDir = target.cwd;
-    ds.session.workingDir = target.cwd;
-    ds.session.title = `Adopt: ${project}`;
-    ds.adoptedFrom = {
-        source: zellij ? 'zellij' : target.source,
-        tmuxTarget: zellij ? undefined : target.tmuxTarget,
-        zellijSession: zellij ? target.zellijSession : undefined,
-        zellijPaneId: zellij ? target.zellijPaneId : undefined,
-        herdrSessionName: zellij ? undefined : target.herdrSessionName,
-        herdrTarget: zellij ? undefined : target.herdrTarget,
-        herdrPaneId: zellij ? undefined : target.herdrPaneId,
-        herdrAgentName: zellij ? undefined : target.herdrAgentName,
-        herdrTerminalId: zellij ? undefined : target.herdrTerminalId,
-        originalCliPid: target.cliPid,
-        sessionId: target.sessionId,
-        cliId: target.cliId,
-        cwd: target.cwd,
-        paneCols: target.paneCols,
-        paneRows: target.paneRows,
-    };
-    ds.session.adoptedFrom = { ...ds.adoptedFrom };
-    sessionStore.updateSession(ds.session);
-    forkAdoptWorker(ds);
-    const cliName = sessionCliDisplayName(ds);
-    await sessionReply(sessionAnchorId(ds), t('cmd.adopt.success', { cliName, project, pane }, loc));
-}
-/** Cap on resume candidates surfaced by the /adopt picker. Kept at the legacy
- *  20 (per product call: the V2 card is a display change, not a scope change).
- *  When the cap is hit the card shows a hint pointing at search + the
- *  `/adopt <id>` direct path, so history beyond the cap is still reachable. */
-export const ADOPT_RESUME_LIMIT = 20;
-/** Discover the sessions resumable from disk for `cliId`, excluding any whose
- *  CLI-native id is already live in a botmux session (so a session botmux
- *  already runs isn't offered for re-import). Returns [] when the adapter has
- *  no on-disk store. */
-export async function discoverResumableSessionsForBot(cliId, cliPathOverride, activeSessions, limit = ADOPT_RESUME_LIMIT) {
-    let adapter;
-    try {
-        adapter = createCliAdapterSync(cliId, cliPathOverride);
-    }
-    catch {
-        return [];
-    }
-    if (!adapter.listResumableSessions)
-        return [];
-    // Exclude every session botmux already manages — live OR closed — so the
-    // picker surfaces only genuinely external sessions (a CLI the user ran
-    // standalone). botmux's own closed sessions stay resumable via their
-    // session-closed cards, so hiding them here avoids a redundant, confusing
-    // duplicate. The identity set spans all bot stores and includes both the
-    // botmux sessionId (= the claude jsonl filename) and the cliSessionId
-    // (codex/traex rollout id), covering every CLI's id shape. Passed INTO the
-    // adapter so exclusion happens BEFORE the `limit` truncation.
-    const exclude = sessionStore.collectBotmuxSessionIdentities() ?? new Set();
-    // Belt-and-suspenders: also fold in the in-memory active map (freshest).
-    for (const ds of activeSessions.values()) {
-        if (ds.session.sessionId)
-            exclude.add(ds.session.sessionId);
-        if (ds.session.cliSessionId)
-            exclude.add(ds.session.cliSessionId);
-    }
-    try {
-        return await adapter.listResumableSessions({ limit, exclude });
-    }
-    catch {
-        return [];
-    }
-}
-/** Import (resume) a stored session into the current topic: re-spawn the bot's
- *  CLI via `--resume <cliSessionId>` in `cwd`. Mirrors the manual resume path —
- *  the worker owns the CLI (NOT an observe-adopt), so no `adoptedFrom` is set. */
-export async function startResumeImportSession(target, ds, deps, larkAppId) {
-    const sessionReply = (rid, content, msgType) => deps.sessionReply(rid, content, msgType, larkAppId);
-    const loc = localeForBot(ds.larkAppId ?? larkAppId);
-    const project = target.cwd.split('/').pop() || target.cwd;
-    if (isSessionTransferring(ds)) {
-        await sessionReply(sessionAnchorId(ds), t('cmd.session.transfer_in_progress', undefined, loc));
-        return;
-    }
-    if (await blockTakeoverWhilePendingRepo(ds, sessionReply))
-        return;
-    ds.workingDir = target.cwd;
-    ds.session.workingDir = target.cwd;
-    ds.session.cliSessionId = target.cliSessionId;
-    ds.session.title = target.title || `Import: ${project}`;
-    // Resume sandbox decision is left to forkWorker (resume=true → not sandboxed,
-    // matching restore semantics). Mark history so the session is treated as a
-    // resume, not a fresh spawn.
-    ds.hasHistory = true;
-    sessionStore.updateSession(ds.session);
-    forkWorker(ds, '', true);
-    const cliName = sessionCliDisplayName(ds);
-    await sessionReply(sessionAnchorId(ds), t('cmd.adopt.resume_success', { cliName, project, title: target.title || target.cliSessionId.slice(0, 8) }, loc));
-}
-/** Fork the current session into a new sub-topic of the same topic group.
- *  The session copy itself stays in worker-pool's generic `forkSession()`;
- *  this layer only creates the Lark destination, supplies the first task turn,
- *  and records display-only lineage for the parent panel. */
-export async function startForkSubtopicSession(taskText, parentDs, message, larkAppId) {
-    const appId = parentDs.larkAppId ?? larkAppId;
-    if (!appId)
-        return { ok: false, error: 'missing_lark_app_id', orphanTopic: false };
-    const loc = localeForBot(appId);
-    const bot = getBot(appId);
-    const botCfg = bot.config;
-    const parentSession = parentDs.session;
-    const chatId = parentDs.chatId;
-    const brand = normalizeBrand(botCfg.brand);
-    const taskTitle = taskText.split(/\r?\n/).map(line => line.trim()).find(Boolean)?.slice(0, 60)
-        ?? taskText.slice(0, 60);
-    const senderIsBot = message.senderType === 'app' || message.senderType === 'bot';
-    const triggerSender = {
-        openId: message.senderId,
-        type: senderIsBot ? 'bot' : 'user',
-        ...(message.senderName ? { name: message.senderName } : {}),
-    };
-    let anchorId;
-    const recallAnchor = async () => {
-        if (!anchorId)
-            return true;
-        try {
-            return await deleteMessage(appId, anchorId);
-        }
-        catch (err) {
-            logger.warn(`[${parentSession.sessionId.substring(0, 8)}] /fork sub-topic recall failed: `
-                + `${err instanceof Error ? err.message : String(err)}`);
-            return false;
-        }
-    };
-    try {
-        let parentThreadId = parentSession.larkThreadId ?? message.threadId;
-        if (!parentThreadId) {
-            parentThreadId = (await getMessageThreadId(appId, parentSession.rootMessageId)) ?? undefined;
-        }
-        if (parentThreadId && parentSession.larkThreadId !== parentThreadId) {
-            parentSession.larkThreadId = parentThreadId;
-            sessionStore.updateSession(parentSession);
-        }
-        const parentLink = parentThreadId
-            ? threadAppLink(chatId, parentThreadId, brand)
-            : chatAppLink(chatId, brand);
-        const localeKey = loc === 'en' ? 'en_us' : 'zh_cn';
-        const seedPost = JSON.stringify({
-            [localeKey]: {
-                title: `${t('cmd.fork.badge', undefined, loc)} ${taskText.replace(/\s*\n+\s*/g, ' ').slice(0, 300)}`,
-                content: [[
-                        ...(senderIsBot ? [] : [{ tag: 'at', user_id: message.senderId }]),
-                        {
-                            tag: 'text',
-                            text: `${senderIsBot ? '' : ' '}${t('cmd.fork.seed_parent_line', { title: parentSession.title || '' }, loc)} `,
-                        },
-                        { tag: 'a', text: t('cmd.fork.seed_back_link', undefined, loc), href: parentLink },
-                    ]],
-            },
-        });
-        anchorId = await sendMessage(appId, chatId, seedPost, 'post');
-        const childThreadId = (await getMessageThreadId(appId, anchorId)) ?? undefined;
-        const childIntro = t('cmd.fork.child_intro', {
-            parentTitle: parentSession.title || '',
-            parentSessionId: parentSession.sessionId,
-            parentRootId: parentSession.rootMessageId,
-        }, loc);
-        const availableBots = await getAvailableBots(appId, chatId);
-        const childCliId = parentSession.cliId ?? botCfg.cliId;
-        const { forkSession } = await import('./worker-pool.js');
-        const forkResult = await forkSession(parentSession.sessionId, chatId, anchorId, 'group', 'thread', {
-            childTitle: `${t('cmd.fork.badge', undefined, loc)} ${taskTitle}`,
-            forkTaskText: taskText,
-            larkThreadId: childThreadId,
-            turnId: message.messageId,
-            senderOpenId: triggerSender.openId,
-            senderIsBot,
-            buildInitialPrompt: childSessionId => buildNewTopicCliInput(`${childIntro}\n\n${taskText}`, childSessionId, childCliId, botCfg.cliPathOverride, undefined, undefined, availableBots, undefined, { name: bot.botName, openId: bot.botOpenId }, loc, triggerSender, { larkAppId: appId, chatId }),
-        });
-        if (!forkResult.ok) {
-            const orphanTopic = !await recallAnchor();
-            return { ok: false, error: forkResult.error, orphanTopic };
-        }
-        if (!parentSession.forkChildSessionIds?.includes(forkResult.childSessionId)) {
-            parentSession.forkChildSessionIds = [
-                ...(parentSession.forkChildSessionIds ?? []),
-                forkResult.childSessionId,
-            ];
-            try {
-                sessionStore.updateSession(parentSession);
-            }
-            catch (err) {
-                logger.warn(`[${parentSession.sessionId.substring(0, 8)}] /fork parent lineage update failed: `
-                    + `${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        try {
-            await upsertForkPanelCard(parentDs, loc);
-        }
-        catch (err) {
-            logger.warn(`[${parentSession.sessionId.substring(0, 8)}] /fork panel refresh failed: `
-                + `${err instanceof Error ? err.message : String(err)}`);
-        }
-        return {
-            ok: true,
-            childSessionId: forkResult.childSessionId,
-            anchorId,
-            link: childThreadId ? threadAppLink(chatId, childThreadId, brand) : chatAppLink(chatId, brand),
-        };
-    }
-    catch (err) {
-        logger.error(`[${parentSession.sessionId.substring(0, 8)}] /fork sub-topic failed: `
-            + `${err instanceof Error ? err.message : String(err)}`);
-        return {
-            ok: false,
-            error: anchorId ? 'fork_subtopic_failed' : 'topic_creation_failed',
-            orphanTopic: anchorId ? !await recallAnchor() : false,
-        };
-    }
-}
-/** Re-post the parent session's fork panel at the bottom of the topic. Reading
- *  each child row from the store keeps `/forklist` status current without
- *  coupling child lifecycle to its parent. */
-async function upsertForkPanelCard(parentDs, loc, opts) {
-    const appId = parentDs.larkAppId;
-    const chatId = parentDs.chatId;
-    const brand = normalizeBrand(getBot(appId).config.brand);
-    const children = (parentDs.session.forkChildSessionIds ?? [])
-        .map(sessionId => sessionStore.getSession(sessionId))
-        .filter((session) => !!session)
-        .map(session => ({
-        instruction: session.forkTaskText ?? session.title,
-        status: (session.status === 'active' ? 'active' : 'closed'),
-        link: session.larkThreadId
-            ? threadAppLink(chatId, session.larkThreadId, brand)
-            : chatAppLink(chatId, brand),
-    }));
-    if (children.length === 0 && !opts?.allowEmpty)
-        return;
-    const staleCardId = parentDs.session.forkPanelCardId;
-    if (staleCardId) {
-        try {
-            await deleteMessage(appId, staleCardId);
-        }
-        catch {
-            // It may already be withdrawn or past Lark's recall window. Posting the
-            // fresh panel is still more useful than keeping the command silent.
-        }
-    }
-    try {
-        const cardId = await replyMessage(appId, parentDs.session.rootMessageId, buildForkPanelCard(children, loc), 'interactive', true);
-        parentDs.session.forkPanelCardId = cardId;
-        sessionStore.updateSession(parentDs.session);
-    }
-    catch (err) {
-        logger.warn(`[fork-panel] failed to post panel card: ${err instanceof Error ? err.message : err}`);
-    }
-}
-//# sourceMappingURL=command-handler.js.map