botmux 3.13.0 → 3.14.0

package/dist/core/current-turn-provenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"current-turn-provenance.d.ts","sourceRoot":"","sources":["../../src/core/current-turn-provenance.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAiDD,MAAM,WAAW,mCAAmC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,mCAAmC,GAC3C,qBAAqB,GAAG,IAAI,CAsE9B"}
+{"version":3,"file":"current-turn-provenance.d.ts","sourceRoot":"","sources":["../../src/core/current-turn-provenance.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AA+BD,MAAM,WAAW,mCAAmC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,mCAAmC,GAC3C,qBAAqB,GAAG,IAAI,CAsE9B"}

package/dist/core/current-turn-provenance.js

@@ -1,5 +1,4 @@
-import { readdirSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { readSessionRowCopiesAcrossStores } from '../services/session-store.js';
 import { findAuthenticatedAncestorSessionContext } from './session-marker.js';
 export class CurrentTurnProvenanceError extends Error {
     constructor(message) {
@@ -11,36 +10,17 @@ function nonEmpty(value) {
     return typeof value === 'string' && value.trim().length > 0;
 }
 function readPersistedSession(dataDir, sessionId) {
-    const matches = [];
-    let files;
+    // The scan itself lives in session-store (fail-closed on an unlistable data
+    // dir, corrupt individual files skipped so an unrelated bot's bad file can
+    // neither block nor impersonate a valid record). The exactly-once policy —
+    // a duplicated row must not be used to infer the caller — stays here.
+    let matches;
     try {
-        files = readdirSync(dataDir).filter((name) => (name === 'sessions.json'
-            || (name.startsWith('sessions-') && name.endsWith('.json'))));
+        matches = readSessionRowCopiesAcrossStores(sessionId, dataDir);
     }
     catch (err) {
         throw new CurrentTurnProvenanceError(`无法读取 botmux session store：${err instanceof Error ? err.message : String(err)}`);
     }
-    for (const file of files) {
-        let parsed;
-        try {
-            parsed = JSON.parse(readFileSync(join(dataDir, file), 'utf-8'));
-        }
-        catch {
-            // A corrupt unrelated bot file must not make a valid caller look like a
-            // different principal. The target session still has to resolve exactly
-            // once from a readable record below.
-            continue;
-        }
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-            continue;
-        const keyed = parsed[sessionId];
-        if (!keyed || typeof keyed !== 'object' || Array.isArray(keyed))
-            continue;
-        const session = keyed;
-        if (session.sessionId !== sessionId)
-            continue;
-        matches.push(session);
-    }
     if (matches.length === 0) {
         throw new CurrentTurnProvenanceError(`未找到当前进程所属 session ${sessionId}`);
     }

package/dist/core/current-turn-provenance.js.map

@@ -1 +1 @@
-{"version":3,"file":"current-turn-provenance.js","sourceRoot":"","sources":["../../src/core/current-turn-provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,uCAAuC,EAAE,MAAM,qBAAqB,CAAC;AAiC9E,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,SAAiB;IAC9D,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAC5C,IAAI,KAAK,eAAe;eACrB,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAC5D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAY,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,uEAAuE;YACvE,qCAAqC;YACrC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QAC7E,MAAM,KAAK,GAAI,MAAkC,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QAC1E,MAAM,OAAO,GAAG,KAA6B,CAAC;QAC9C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,SAAS;QAC9C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,0BAA0B,CAAC,qBAAqB,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,0BAA0B,CAClC,WAAW,SAAS,kCAAkC,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AASD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA4C;IAE5C,MAAM,MAAM,GAAG,uCAAuC,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CACjC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,0BAA0B,CAClC,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,0BAA0B,CAClC,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAChF,MAAM,IAAI,0BAA0B,CAClC,gBAAgB,MAAM,CAAC,SAAS,gBAAgB,OAAO,CAAC,YAAY,MAAM,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,0BAA0B,CAAC,WAAW,MAAM,CAAC,SAAS,qBAAqB,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAChF,MAAM,IAAI,0BAA0B,CAClC,aAAa,MAAM,CAAC,MAAM,4BAA4B,OAAO,CAAC,aAAa,IAAI,WAAW,MAAM,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAC/C,IAAI,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,0BAA0B,CAClC,aAAa,MAAM,CAAC,MAAM,4BAA4B,WAAW,CAAC,MAAM,IAAI,WAAW,MAAM,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,0BAA0B,CAAC,WAAW,MAAM,CAAC,SAAS,sBAAsB,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,0BAA0B,CAAC,WAAW,MAAM,CAAC,SAAS,sBAAsB,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,aAAiC,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,MAAM,CAAC,SAAS,mBAAmB,CAAC,CAAC;QAC9F,CAAC;QACD,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACxC,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,MAAM,CAAC,SAAS,oCAAoC,CAAC,CAAC;QAC7G,CAAC;QACD,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,OAAO,CAAC,gBAAgB;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;YAC5D,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"current-turn-provenance.js","sourceRoot":"","sources":["../../src/core/current-turn-provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,uCAAuC,EAAE,MAAM,qBAAqB,CAAC;AAiC9E,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,SAAiB;IAC9D,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,gCAAgC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,0BAA0B,CAAC,qBAAqB,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,0BAA0B,CAClC,WAAW,SAAS,kCAAkC,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAyB,CAAC;AAC5C,CAAC;AASD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA4C;IAE5C,MAAM,MAAM,GAAG,uCAAuC,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CACjC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,0BAA0B,CAClC,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,0BAA0B,CAClC,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAChF,MAAM,IAAI,0BAA0B,CAClC,gBAAgB,MAAM,CAAC,SAAS,gBAAgB,OAAO,CAAC,YAAY,MAAM,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,0BAA0B,CAAC,WAAW,MAAM,CAAC,SAAS,qBAAqB,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAChF,MAAM,IAAI,0BAA0B,CAClC,aAAa,MAAM,CAAC,MAAM,4BAA4B,OAAO,CAAC,aAAa,IAAI,WAAW,MAAM,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAC/C,IAAI,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,0BAA0B,CAClC,aAAa,MAAM,CAAC,MAAM,4BAA4B,WAAW,CAAC,MAAM,IAAI,WAAW,MAAM,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,0BAA0B,CAAC,WAAW,MAAM,CAAC,SAAS,sBAAsB,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,0BAA0B,CAAC,WAAW,MAAM,CAAC,SAAS,sBAAsB,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,aAAiC,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,MAAM,CAAC,SAAS,mBAAmB,CAAC,CAAC;QAC9F,CAAC;QACD,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACxC,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,MAAM,CAAC,SAAS,oCAAoC,CAAC,CAAC;QAC7G,CAAC;QACD,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,OAAO,CAAC,gBAAgB;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;YAC5D,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/core/dashboard-ipc-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-ipc-server.d.ts","sourceRoot":"","sources":["../../src/core/dashboard-ipc-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAe,MAAM,WAAW,CAAC;AA+DjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAyE7E,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,8BAA8B,CAAC;AAGtC,4FAA4F;AAC5F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAEhG;AAID,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAE/F;AAID,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAEnG;AAED,KAAK,8BAA8B,GAAG,0BAA0B,GAAG;IACjE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,8BAA8B,GAAG,IAAI,GAClD,IAAI,CAEN;AACD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,6BAA6B,EAI7B,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAiC,cAAc,EAAE,yBAAyB,EAAW,MAAM,aAAa,CAAC;AAsBrH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAe1B,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAErE;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAM7E;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAGhF;AAwED,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;CAItC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM;gBADjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM;CAK7B;AAED,gDAAgD;AAChD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWlC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5D,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,GAAG,EAAE,eAAe,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,CAAC,CAAC,CAuEZ;AA6FD,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAgC;AAM7F;;;wBAGwB;AACxB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAS9E;AA4GD,wBAAgB,wBAAwB,IAAI,IAAI,CAAkC;AAClF,wBAAgB,gBAAgB,IAAI,IAAI,CAA0B;AAClE,6EAA6E;AAC7E,wBAAgB,iCAAiC,IAAI,IAAI,CAA0D;AAuLnH,YAAY,EAAE,UAAU,EAAE,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,CAAC;AAMrF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAA0B;AAkBxE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAA0B;AA07CxE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAw4ED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;+EAG2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;sDAEkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;wCAIoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;kFAE8E;IAC9E,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,OAAO,CAAC,eAAe,CAAC,CA8D3B"}
+{"version":3,"file":"dashboard-ipc-server.d.ts","sourceRoot":"","sources":["../../src/core/dashboard-ipc-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAe,MAAM,WAAW,CAAC;AAuEjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AA0E7E,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,8BAA8B,CAAC;AAGtC,4FAA4F;AAC5F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAEhG;AAID,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAE/F;AAID,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAEnG;AAED,KAAK,8BAA8B,GAAG,0BAA0B,GAAG;IACjE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,8BAA8B,GAAG,IAAI,GAClD,IAAI,CAEN;AACD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,6BAA6B,EAI7B,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAiC,cAAc,EAAE,yBAAyB,EAAW,MAAM,aAAa,CAAC;AAuBrH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAe1B,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAErE;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAM7E;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAGhF;AAwED,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;CAItC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM;gBADjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM;CAK7B;AAED,gDAAgD;AAChD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWlC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5D,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,GAAG,EAAE,eAAe,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,CAAC,CAAC,CAuEZ;AA6FD,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAgC;AAM7F;;;wBAGwB;AACxB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAS9E;AAqHD,wBAAgB,wBAAwB,IAAI,IAAI,CAAkC;AAClF,wBAAgB,gBAAgB,IAAI,IAAI,CAA0B;AAClE,6EAA6E;AAC7E,wBAAgB,iCAAiC,IAAI,IAAI,CAA0D;AAuLnH,YAAY,EAAE,UAAU,EAAE,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,CAAC;AAMrF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAA0B;AAkBxE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAA0B;AA4/CxE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAykFD,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;+EAG2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;sDAEkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;wCAIoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;kFAE8E;IAC9E,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,OAAO,CAAC,eAAe,CAAC,CA8D3B"}

package/dist/core/dashboard-ipc-server.js

@@ -7,11 +7,14 @@ import { logger } from '../utils/logger.js';
 import { cliAuthBind, verifyHmac } from '../dashboard/auth.js';
 import { WORKFLOW_DAEMON_IPC_ROUTE_PREFIX } from '../workflows/v3/daemon-ipc-auth.js';
 import { V3_SESSION_RUN_MUTATION_ROUTE_PREFIX } from '../workflows/v3/session-relay.js';
+import { REPORT_SESSION_RELAY_ROUTE } from './report-session-relay.js';
+import { DISPATCH_REPORT_REGISTER_ROUTE } from './dispatch-report-binding.js';
 import { listenWithProbe } from '../utils/listen-with-probe.js';
 import { dashboardSecretPath } from './dashboard-secret.js';
 import { MANAGED_ORIGIN_ATTEST_ROUTE, MANAGED_ORIGIN_PROOF_DOMAIN, MANAGED_ORIGIN_PROOF_TTL_MS, writeManagedOriginAttestationProof, } from './managed-origin-attestation.js';
 import * as sessionStore from '../services/session-store.js';
 import { cliSupportsNativeUsage } from '../services/transcript-resolver.js';
+import { codexModelSupportsReasoningEffort, isCodexReasoningCliId, isCodexReasoningEffort, } from '../services/codex-reasoning-effort.js';
 import * as asyncTriggerStore from '../services/async-trigger-store.js';
 import { resolveAsyncTriggerState, decideAsyncOwnership } from '../services/async-trigger-state.js';
 import * as scheduleStore from '../services/schedule-store.js';
@@ -26,6 +29,7 @@ import { ensureBackendAvailable } from '../services/backend-availability.js';
 import * as persistentBackend from './persistent-backend.js';
 import * as cardPrefsStore from '../services/card-prefs-store.js';
 import * as substituteModeStore from '../services/substitute-mode-store.js';
+import { claimPromptContext } from '../services/prompt-context-store.js';
 import { createCliAdapterSync } from '../adapters/cli/registry.js';
 import { normalizeCliRuntimeConfig } from '../adapters/cli/runtime.js';
 import { evaluateReadIsolationGate } from '../adapters/cli/read-isolation.js';
@@ -61,7 +65,8 @@ import { getDeploymentIdentity } from '../services/deployment-identity.js';
 import { getBotUnionId } from '../services/bot-union-ids-store.js';
 import * as grantPrefsStore from '../services/grant-prefs-store.js';
 import { applyExactChatGrantRequest } from '../services/exact-chat-grant.js';
-import { findConfigField, applyConfigField, coerceConfigValue } from '../services/bot-config-store.js';
+import { findConfigField, applyConfigField, coerceConfigValue, setChatFeedbackPolicy } from '../services/bot-config-store.js';
+import { traceFeedbackPolicyForDelivery } from '../services/feedback-policy-resolver.js';
 import { globalBuiltinSkillInjectionDefault, resolveSkillInjectionSupport } from '../skills/injection-mode.js';
 import { summaryRangeFromBotConfig, updateDashboardSummaryRange } from '../services/summary-range-store.js';
 import { config } from '../config.js';
@@ -124,6 +129,8 @@ export function setSupervisorShutdownHandler(registration) {
 }
 import { composeRowFromActive, composeRowFromClosed, composeRowFromPersistedActive, feishuChatLink, setBotName as setRowsBotName, getBotName, } from './dashboard-rows.js';
 import { getBotBrand, getBot, getBotOpenId, loadBotConfigs, readBotSkillPolicy, getBotTuiSlashAllow } from '../bot-registry.js';
+import { generateAuthUrl, tryHandleCallbackUrl, getFeedGroupAuthStatus, FEED_GROUP_OAUTH_SCOPES } from '../utils/user-token.js';
+import { normalizeBrand } from '../im/lark/lark-hosts.js';
 import { normalizeKanbanColumn, normalizeKanbanPosition, normalizeSessionTitle } from './session-board.js';
 import { validateSlashInjection } from './slash-inject.js';
 import { validateRoleLibraryPath } from './role-library.js';
@@ -136,6 +143,7 @@ import { sessionAnchorId, larkTransportEnabled } from './types.js';
 import { isRiffBackendSession } from './persistent-backend.js';
 import { attachSkillPolicy, detachSkillPolicy } from './skills/im-command.js';
 import { readSkillRegistry } from '../services/skill-registry-store.js';
+import { isSessionGroup } from '../services/session-groups-store.js';
 import { commitDeviceIsolationActivation, DEVICE_ISOLATION_COMMIT_PATH, DEVICE_ISOLATION_PREPARE_PATH, DEVICE_ISOLATION_RELEASE_PATH, logDeviceIsolationActivationError, prepareDeviceIsolationActivation, releaseDeviceIsolationActivation, } from './device-isolation-daemon.js';
 // Daemon process start (module load ≈ daemon boot). Used by the SSE snapshot
 // replay to bound the "recently closed" set to sessions that flipped
@@ -530,10 +538,22 @@ function routeHasNarrowUntrustedAuth(method, pathname) {
     // 证明「我是这个会话当前这一轮的 CLI」，选不了别的会话。
     if (method === 'POST' && /^\/api\/sessions\/[^/]+\/(?:slash|cd|close|chat-rename)$/.test(pathname))
         return true;
+    // UserPromptSubmit hook 的 envelope claim：沙箱内 hook 读不到 host secret，
+    // 走 body 里的 per-turn capability；handler 内 sessionCliIpcAuth 绑定到 URL 的
+    // sessionId + 按 managedTurnOrigin.turnId 权威取（同 /close 姿势）。
+    if (method === 'POST' && /^\/api\/sessions\/[^/]+\/prompt-ctx\/claim$/.test(pathname))
+        return true;
     if (method === 'POST' && pathname === '/api/hooks/emit')
         return true;
     if (method === 'POST' && pathname === '/api/attention')
         return true;
+    // A sandboxed report cannot read the host HMAC secret. This narrow route
+    // validates the current session's rotating capability, binds the dispatch
+    // root server-side, then lets the trusted daemon relay to the orchestrator.
+    if (method === 'POST' && pathname === REPORT_SESSION_RELAY_ROUTE)
+        return true;
+    if (method === 'POST' && pathname === DISPATCH_REPORT_REGISTER_ROUTE)
+        return true;
     // macOS read-isolated `botmux send` presents a rotating worker capability;
     // the handler writes the authoritative tuple into a host-owned read-only
     // proof sidecar, so loopback response spoofing cannot confer authority.
@@ -889,6 +909,44 @@ ipcRoute('POST', '/api/sessions/:sessionId/close', async (req, res, params) => {
         jsonRes(res, r.ok ? 200 : 502, r);
     });
 });
+/**
+ * Host-side atomic claim/pop for the UserPromptSubmit hook（#794 方向 B）。
+ *
+ * 沙箱内的 `botmux user-prompt-hook` 不能在 read-only 的 `prompt-ctx/<sid>` 里
+ * unlink（HIGH-2），同正文多轮也不能靠 FIFO 猜（HIGH-1：某轮漏 claim 会串轮到
+ * 后续轮）。hook 把 (session 凭据 + fingerprint) 提交到这里，宿主按
+ * **managedTurnOrigin.turnId 权威 turn 绑定**精确取该轮的 envelope，先删再返回。
+ * 漏 claim 只孤儿化自己那条，不污染后续轮；上一轮的 stale sidecar 永远不会被返回。
+ *
+ * 鉴权与 /close、/slash 同构：trusted-host HMAC，或本会话 rotating per-turn
+ * capability（沙箱内读 host secret 失败时的回退）。任何未命中/失败 → 404/403，
+ * hook 端空输出 exit 0（fail-open：reminder 丢失 < 卡住 prompt）。
+ */
+ipcRoute('POST', '/api/sessions/:sessionId/prompt-ctx/claim', async (req, res, params) => {
+    const body = await readJsonBody(req).catch(() => ({}));
+    const ds = findActiveBySessionId(params.sessionId);
+    // claim 只读 daemon 自有本轮非凭证上下文（reminder/whiteboard），receiver 会话
+    // 也允许（allowReceiver: true）；close/slash/cd 等 managed action 仍默认拒绝。
+    const auth = sessionCliIpcAuth(req, ds, params.sessionId, body, { allowReceiver: true });
+    if (!auth.ok)
+        return jsonRes(res, 403, { ok: false, error: auth.error });
+    const fingerprint = typeof body?.fingerprint === 'string' ? body.fingerprint : '';
+    if (!/^[a-f0-9]{64}$/.test(fingerprint)) {
+        return jsonRes(res, 400, { ok: false, error: 'invalid_fingerprint' });
+    }
+    // 权威 turnId：daemon 当前这轮的 turnId（worker 发布的 managed_turn_origin）。
+    // hook 不需要、也不应自己提供 turnId——daemon 只认自己的权威值，避免 FIFO 串轮。
+    const turnId = ds?.managedTurnOrigin?.turnId;
+    if (!turnId)
+        return jsonRes(res, 404, { ok: false, error: 'no_active_turn' });
+    const prefix = typeof body?.prefix === 'string' && body.prefix.length > 0
+        ? body.prefix.slice(0, 64)
+        : undefined;
+    const envelope = claimPromptContext(params.sessionId, turnId, fingerprint, prefix);
+    if (!envelope)
+        return jsonRes(res, 404, { ok: false, error: 'not_found' });
+    jsonRes(res, 200, { ok: true, envelope });
+});
 // `botmux list` zombie pruning is maintenance, not explicit abandon. Serialize
 // against inbound admission and refuse if any backend-neutral durable owner
 // became unsettled after the CLI took its liveness snapshot.
@@ -1023,6 +1081,25 @@ ipcRoute('POST', '/api/sessions/:sessionId/suspend', async (_req, res, params) =
             // already reached, so report idempotent success without a live kill.
             return jsonRes(res, 200, { ok: true, sessionId: params.sessionId, suspended: false, reason: 'no_live_worker' });
         }
+        // Producing a reply — killing the worker now would drop this turn. Queue
+        // instead; worker-pool's runPendingSuspendIfSettled cashes it in on the
+        // idle/limited edge. Ordering matters: the idempotent no-worker branch above
+        // must win, so "worker was already gone" never reports as deferred.
+        //
+        // The suspendability check is part of the queueing condition, not a new guard
+        // ahead of it: a non-suspendable (pty) backend must keep falling through to
+        // suspendWorker's existing 409 rather than get a `deferred` that could only
+        // fail silently at fulfillment time.
+        if ((ds.lastScreenStatus === 'working' || ds.lastScreenStatus === 'analyzing')
+            && isSuspendableBackendType(ds.initConfig?.backendType)) {
+            ds.pendingSuspendReason = 'manual_suspend';
+            // Bind the claim to the generation that is producing right now: it must not
+            // outlive that worker (see clearPendingSuspendClaim).
+            ds.pendingSuspendGeneration = ds.workerGeneration;
+            return jsonRes(res, 200, {
+                ok: true, sessionId: params.sessionId, suspended: false, reason: 'deferred',
+            });
+        }
         if (!suspendWorker(ds, 'manual_suspend')) {
             // Live worker but a non-suspendable (pty) backend: killing it would drop the
             // in-memory conversation with no persistent pane to resume from lazily.
@@ -1125,7 +1202,7 @@ ipcRoute('POST', '/api/host-overload/sweep', async (req, res) => {
  *  capability 只证明「我是这个会话当前这一轮的 CLI」——绑定 URL sessionId，
  *  拿到别的 sessionId 也伪造不了它的 capability。会话不存在时对未签名调用方
  *  同样回 origin_unproven，不提供「哪些 sessionId 活跃」的探针。 */
-function sessionCliIpcAuth(req, ds, sessionId, body) {
+function sessionCliIpcAuth(req, ds, sessionId, body, opts = {}) {
     const claimedAttempt = typeof body?.originDispatchAttempt === 'number'
         && Number.isSafeInteger(body.originDispatchAttempt)
         && body.originDispatchAttempt > 0
@@ -1135,7 +1212,9 @@ function sessionCliIpcAuth(req, ds, sessionId, body) {
         trustedHost: isTrustedHostIpcRequest(req),
         sessionExists: !!ds,
         receiverSession: !!ds?.session.vcMeetingReceiver,
-        allowReceiver: false,
+        // close/slash/cd 是 managed action，默认拒绝 receiver；claim 只读 daemon 自有
+        // 本轮非凭证上下文（reminder/whiteboard），读自己本轮 reminder 非提权，单独放开。
+        allowReceiver: opts.allowReceiver === true,
         sessionId,
         liveOrigin: ds?.managedTurnOrigin,
         claimedCapability: typeof body?.originCapability === 'string' ? body.originCapability : undefined,
@@ -2679,7 +2758,17 @@ ipcRoute('GET', '/api/groups', async (_req, res) => {
             const observedBotNames = observedBotsStore
                 .listObservedBots(config.session.dataDir, cachedLarkAppId, c.chatId)
                 .map(b => b.name);
-            return { ...c, oncallChat: oncall ?? null, firstSeenAt: seenMap.get(c.chatId) ?? null, hasRole, hasMessageListener, observedBotNames };
+            return {
+                ...c,
+                oncallChat: oncall ?? null,
+                firstSeenAt: seenMap.get(c.chatId) ?? null,
+                hasRole,
+                hasMessageListener,
+                observedBotNames,
+                // 会话群分型（p2pMode=group 自动创建）：dashboard 群面板据此把它们
+                // 收进独立折叠区，避免淹没需要人工管理的常驻群。
+                ...(isSessionGroup(c.chatId) ? { sessionGroup: true } : {}),
+            };
         });
         jsonRes(res, 200, { chats: enriched });
     }
@@ -3369,10 +3458,17 @@ ipcRoute('GET', '/api/bot-default-oncall', async (_req, res) => {
     const grantPrefs = grantPrefsStore.getBotGrantPrefs(cachedLarkAppId);
     let p2pMode = 'chat';
     try {
-        if (getBot(cachedLarkAppId).config.p2pMode === 'thread')
-            p2pMode = 'thread';
+        const configured = getBot(cachedLarkAppId).config.p2pMode;
+        if (configured === 'thread' || configured === 'group')
+            p2pMode = configured;
     }
     catch { /* default chat */ }
+    let envelopeInjection = 'off';
+    try {
+        if (getBot(cachedLarkAppId).config.envelopeInjection === 'auto')
+            envelopeInjection = 'auto';
+    }
+    catch { /* default off */ }
     let skillInjection = null;
     // How this bot's CLI delivers botmux skills, so the dashboard can render the
     // control correctly: 'dynamic' = per-session --plugin-dir (claude-family, not
@@ -3392,6 +3488,7 @@ ipcRoute('GET', '/api/bot-default-oncall', async (_req, res) => {
     let cliPathOverride = null;
     let wrapperCli = null;
     let model = null;
+    let reasoningEffort = null;
     let agentSelectionKey = '';
     try {
         const cfg = getBot(cachedLarkAppId).config;
@@ -3406,6 +3503,7 @@ ipcRoute('GET', '/api/bot-default-oncall', async (_req, res) => {
             : null;
         wrapperCli = typeof cfg.wrapperCli === 'string' && cfg.wrapperCli.trim() ? cfg.wrapperCli : null;
         model = typeof cfg.model === 'string' && cfg.model.trim() ? cfg.model : null;
+        reasoningEffort = cfg.reasoningEffort ?? null;
         agentSelectionKey = selectionKeyForBot(cliId, wrapperCli ?? undefined);
     }
     catch { /* no registered bot */ }
@@ -3493,6 +3591,7 @@ ipcRoute('GET', '/api/bot-default-oncall', async (_req, res) => {
         cliPathOverride,
         wrapperCli,
         model,
+        reasoningEffort,
         agentSelectionKey,
         defaultOncall: defaultOncall ?? { enabled: false, workingDir: '', since: 0 },
         defaultWorkingDir,
@@ -3524,12 +3623,20 @@ ipcRoute('GET', '/api/bot-default-oncall', async (_req, res) => {
         regularGroupReplyMode: cardPrefs.regularGroupReplyMode,
         regularGroupMentionMode: cardPrefs.regularGroupMentionMode,
         substituteMode: substituteModeStore.getBotSubstituteMode(cachedLarkAppId) ?? null,
+        feedback: (() => { try {
+            return getBot(cachedLarkAppId).config.feedback ?? null;
+        }
+        catch {
+            return null;
+        } })(),
         docSubscribeDefaultMode: cardPrefs.docSubscribeDefaultMode,
         restrictGrantCommands: grantPrefs.restrictGrantCommands,
         autoGrantRequestCards: grantPrefs.autoGrantRequestCards,
+        p2pOpen: grantPrefs.p2pOpen,
         messageQuotaDefaultLimit: grantPrefs.messageQuotaDefaultLimit,
         grantDefaultDurationMs: grantPrefs.grantDefaultDurationMs,
         p2pMode,
+        envelopeInjection,
         skillInjection,
         skillInjectionSupport,
         // Resolved machine-wide default → the dashboard shows it as the pre-selected
@@ -3698,6 +3805,7 @@ ipcRoute('PUT', '/api/bot-summary-trigger', async (req, res) => {
 // Per-bot 授权偏好。Body 任意子集：
 //   • restrictGrantCommands: boolean       — 限制被授权人只能纯对话
 //   • autoGrantRequestCards: boolean       — 未授权 @ 被挡住时是否发 grant 申请卡
+//   • p2pOpen: boolean                     — 私聊对话全开（talk-only；管理权仍只认 allowedUsers）
 //   • messageQuotaDefaultLimit: number|null — 卡片/Oncall 额度覆盖（null = 卡片内置 3 条、Oncall 不限）
 //   • grantDefaultDurationMs: number|null   — 新授权默认有限时长（null = 产品默认 1 小时）
 ipcRoute('PUT', '/api/bot-grant-prefs', async (req, res) => {
@@ -3720,6 +3828,8 @@ ipcRoute('PUT', '/api/bot-grant-prefs', async (req, res) => {
         patch.restrictGrantCommands = body.restrictGrantCommands;
     if (typeof body.autoGrantRequestCards === 'boolean')
         patch.autoGrantRequestCards = body.autoGrantRequestCards;
+    if (typeof body.p2pOpen === 'boolean')
+        patch.p2pOpen = body.p2pOpen;
     // null（含 JSON null）= 恢复内置额度策略；number = 设定覆盖值（store 内校验 1–1000）。
     if (body.messageQuotaDefaultLimit === null)
         patch.messageQuotaDefaultLimit = null;
@@ -3876,7 +3986,13 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
         return jsonRes(res, 400, { ok: false, error: 'invalid_cli', message: err?.message ?? String(err) });
     }
     const model = typeof body.model === 'string' ? body.model.trim() : '';
+    const reasoningEffortFieldPresent = Object.prototype.hasOwnProperty.call(body, 'reasoningEffort');
+    const reasoningEffort = isCodexReasoningEffort(body.reasoningEffort) ? body.reasoningEffort : null;
+    if (body.reasoningEffort !== undefined && body.reasoningEffort !== '' && reasoningEffort === null) {
+        return jsonRes(res, 400, { ok: false, error: 'invalid_reasoning_effort' });
+    }
     const currentBotConfig = getBot(larkAppId).config;
+    const supportsReasoningEffort = isCodexReasoningCliId(selected.cliId);
     const runtimeFieldPresent = Object.prototype.hasOwnProperty.call(body, 'cliRuntime');
     const currentSelectionKey = selectionKeyForBot(currentBotConfig.cliId, currentBotConfig.wrapperCli);
     const selectionChanged = key !== currentSelectionKey;
@@ -3971,6 +4087,12 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
         // is the other way a bot could end up configured-but-unenforceable.)
         let readIsolationCleared = false;
         const r = await rmwBotEntry(larkAppId, (entry) => {
+            const nextReasoningEffort = supportsReasoningEffort
+                ? (reasoningEffortFieldPresent ? reasoningEffort ?? undefined : entry.reasoningEffort)
+                : undefined;
+            if (nextReasoningEffort && !codexModelSupportsReasoningEffort(model || undefined, nextReasoningEffort)) {
+                return { write: false, result: { error: 'reasoning_effort_not_supported_by_model' } };
+            }
             entry.cliId = selected.cliId;
             if (selected.wrapperCli)
                 entry.wrapperCli = selected.wrapperCli;
@@ -3994,6 +4116,14 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
                 entry.model = model;
             else
                 delete entry.model;
+            if (!supportsReasoningEffort)
+                delete entry.reasoningEffort;
+            else if (reasoningEffortFieldPresent) {
+                if (reasoningEffort)
+                    entry.reasoningEffort = reasoningEffort;
+                else
+                    delete entry.reasoningEffort;
+            }
             if (entry.readIsolation === true &&
                 !readIsolationEnforceableFor({ cliId: selected.cliId, cliPathOverride: effectivePath, wrapperCli: selected.wrapperCli })) {
                 delete entry.readIsolation;
@@ -4009,10 +4139,17 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
                 // 任务）。手动的 pty/tmux/herdr/zellij override 不受影响（它们不会是 riff）。
                 delete entry.backendType;
             }
-            return { write: true, result: null };
+            return { write: true, result: { nextReasoningEffort } };
         });
         if (!r.ok)
             return jsonRes(res, 400, { ok: false, error: r.reason });
+        if (r.result.error) {
+            return jsonRes(res, 400, {
+                ok: false,
+                error: r.result.error,
+                message: `模型 ${model || '（Codex 默认模型）'} 不支持当前思考强度`,
+            });
+        }
         const bot = getBot(larkAppId);
         bot.config.cliId = selected.cliId;
         bot.config.cliRuntime = nextRuntime;
@@ -4022,6 +4159,10 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
         else
             bot.config.wrapperCli = undefined;
         bot.config.model = model || undefined;
+        if (!supportsReasoningEffort)
+            bot.config.reasoningEffort = undefined;
+        else
+            bot.config.reasoningEffort = r.result.nextReasoningEffort ?? undefined;
         if (readIsolationCleared)
             bot.config.readIsolation = false;
         if (selected.cliId === 'riff') {
@@ -4041,6 +4182,7 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
             cliPathOverride: nextRuntime ? null : nextLegacyPath ?? null,
             wrapperCli: selected.wrapperCli ?? null,
             model: model || null,
+            reasoningEffort: supportsReasoningEffort ? bot.config.reasoningEffort ?? null : null,
             selectionKey,
             closedMismatchedSessions,
             // Report the (possibly auto-cleared) read-isolation state + whether the new
@@ -4056,9 +4198,100 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
         });
     });
 });
-// Per-bot 私聊单聊模式 p2pMode。Body `{ p2pMode: 'chat' | 'thread' }`:
+// ─── 会话群标签授权（feed-group OAuth，Dashboard 一站式流程）────────────────
+// POST /api/oauth-callback {url} — dashboard 的 /oauth/callback 接收页把回调
+// URL 广播给各 daemon；state 在本进程 pendingLogins 里的那个完成 code→token
+// 交换，其它 daemon 返回 matched:false 让 dashboard 继续尝试下一个。
+ipcRoute('POST', '/api/oauth-callback', async (req, res) => {
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch {
+        return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+    }
+    if (typeof body.url !== 'string' || !body.url.trim()) {
+        return jsonRes(res, 400, { ok: false, error: 'url_required' });
+    }
+    const result = await tryHandleCallbackUrl(body.url.trim());
+    if (!result)
+        return jsonRes(res, 200, { ok: false, matched: false, message: 'not a callback url' });
+    jsonRes(res, 200, { ok: result.ok, matched: result.matched, message: result.message });
+});
+// POST /api/session-group-tag-auth — 生成带 feed-group scope 的授权链接。
+// state 存本 daemon 进程内存，回调必须经由上面的 /api/oauth-callback 回到
+// 同一进程完成，故链接生成与回调处理都放 IPC 侧。
+ipcRoute('POST', '/api/session-group-tag-auth', async (_req, res) => {
+    if (!cachedLarkAppId)
+        return jsonRes(res, 503, { error: 'larkAppId_not_set' });
+    try {
+        const cfg = getBot(cachedLarkAppId).config;
+        const { authUrl } = generateAuthUrl(cfg.larkAppId, cfg.larkAppSecret, normalizeBrand(cfg.brand), FEED_GROUP_OAUTH_SCOPES);
+        jsonRes(res, 200, { ok: true, authUrl });
+    }
+    catch (e) {
+        jsonRes(res, 500, { ok: false, error: e?.message ?? String(e) });
+    }
+});
+// GET /api/session-group-tag-status — 标签授权状态（Dashboard 徽标）。
+ipcRoute('GET', '/api/session-group-tag-status', async (_req, res) => {
+    if (!cachedLarkAppId)
+        return jsonRes(res, 503, { error: 'larkAppId_not_set' });
+    try {
+        const cfg = getBot(cachedLarkAppId).config;
+        const status = getFeedGroupAuthStatus(cfg.larkAppId, normalizeBrand(cfg.brand));
+        jsonRes(res, 200, { ok: true, ...status, tagMode: cfg.sessionGroup?.tag?.mode ?? 'feed-group' });
+    }
+    catch (e) {
+        jsonRes(res, 500, { ok: false, error: e?.message ?? String(e) });
+    }
+});
+// PUT /api/session-group-tag-config — 会话群标签模式（Dashboard tag mode
+// selector，PR review：授权行必须与实际 tagMode 一致）。Body `{ mode }`：
+// 'feed-group'（默认，个人侧边栏分组，需一次 OAuth，任何租户可用）|
+// 'chat-tag'（应用租户身份，无需用户授权，但部分租户权限目录无该 scope）|
+// 'off'。写 bots.json 的 sessionGroup.tag.mode 并热更内存注册表，与
+// /botconfig 同一持久化通道。
+ipcRoute('PUT', '/api/session-group-tag-config', async (req, res) => {
+    if (!cachedLarkAppId)
+        return jsonRes(res, 503, { error: 'larkAppId_not_set' });
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch {
+        return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+    }
+    const mode = body.mode === 'chat-tag' || body.mode === 'feed-group' || body.mode === 'off'
+        ? body.mode : undefined;
+    if (!mode)
+        return jsonRes(res, 400, { ok: false, error: 'invalid_mode' });
+    try {
+        const bot = getBot(cachedLarkAppId);
+        const r = await rmwBotEntry(cachedLarkAppId, (entry) => {
+            if (!entry.sessionGroup || typeof entry.sessionGroup !== 'object')
+                entry.sessionGroup = {};
+            if (!entry.sessionGroup.tag || typeof entry.sessionGroup.tag !== 'object')
+                entry.sessionGroup.tag = {};
+            entry.sessionGroup.tag.mode = mode;
+            return { write: true, result: mode };
+        });
+        if (!r.ok)
+            return jsonRes(res, 400, { ok: false, error: r.reason });
+        bot.config.sessionGroup = {
+            ...(bot.config.sessionGroup ?? {}),
+            tag: { ...(bot.config.sessionGroup?.tag ?? {}), mode },
+        };
+        jsonRes(res, 200, { ok: true, tagMode: mode });
+    }
+    catch (e) {
+        jsonRes(res, 500, { ok: false, error: e?.message ?? String(e) });
+    }
+});
+// Per-bot 私聊单聊模式 p2pMode。Body `{ p2pMode: 'chat' | 'thread' | 'group' }`:
 //   • 'chat'（默认）    → 私聊走扁平连续 chat-scope 会话
 //   • 'thread'          → 显式回到每条 DM 独立 thread-scope 会话
+//   • 'group'           → 每条顶层 DM 自动建专属会话群并把会话落进去
 // 走 applyConfigField（与 /botconfig 同一写盘 + 热更新路径），保证一致。
 ipcRoute('PUT', '/api/bot-p2p-mode', async (req, res) => {
     if (!cachedLarkAppId)
@@ -4073,13 +4306,37 @@ ipcRoute('PUT', '/api/bot-p2p-mode', async (req, res) => {
     const spec = findConfigField('p2pMode');
     if (!spec)
         return jsonRes(res, 500, { ok: false, error: 'spec_missing' });
-    // 只有 'thread' 有意义；其它（含 'chat'，新默认)一律清回默认，bots.json 保持干净。
-    const value = body.p2pMode === 'thread' ? 'thread' : null;
+    // 只有 'thread' / 'group' 有意义；其它（含 'chat'，新默认)一律清回默认，bots.json 保持干净。
+    const value = body.p2pMode === 'thread' ? 'thread' : body.p2pMode === 'group' ? 'group' : null;
     const r = await applyConfigField(cachedLarkAppId, spec, value);
     if (!r.ok)
         return jsonRes(res, 400, { ok: false, error: r.reason });
     jsonRes(res, 200, { ok: true, p2pMode: value ?? 'chat' });
 });
+// Per-bot 每轮上下文注入方式 envelopeInjection（#794）。Body `{ envelopeInjection: 'auto'|'off'|'' }`:
+//   • 'auto' → 支持的 CLI（claude-code）把 reminder/whiteboard 经 UserPromptSubmit
+//     hook 注入为 system-reminder，user turn 只留消息本身；不支持的自动回退内联
+//   • 'off'/其它 → 内联 envelope（历史行为，默认）
+// 走 applyConfigField（与 /botconfig 同一写盘 + 热更新路径），下一个 follow-up turn 生效。
+ipcRoute('PUT', '/api/bot-envelope-injection', async (req, res) => {
+    if (!cachedLarkAppId)
+        return jsonRes(res, 503, { error: 'larkAppId_not_set' });
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch {
+        return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+    }
+    const spec = findConfigField('envelopeInjection');
+    if (!spec)
+        return jsonRes(res, 500, { ok: false, error: 'spec_missing' });
+    const value = body.envelopeInjection === 'auto' ? 'auto' : null;
+    const r = await applyConfigField(cachedLarkAppId, spec, value);
+    if (!r.ok)
+        return jsonRes(res, 400, { ok: false, error: r.reason });
+    jsonRes(res, 200, { ok: true, envelopeInjection: value ?? 'off' });
+});
 // Per-bot 内置技能注入模式 skillInjection。Body `{ skillInjection: 'global'|'prompt'|'off'|'' }`:
 //   • 'global'|'prompt'|'off' → 显式覆盖本 bot
 //   • ''/其它                  → 清回机器级默认（config.json skills.builtinInjection）
@@ -4236,6 +4493,56 @@ ipcRoute('PUT', '/api/bot-launch-shell', async (req, res) => {
         return jsonRes(res, 400, { ok: false, error: r.reason });
     jsonRes(res, 200, { ok: true, launchShell: value ?? '' });
 });
+ipcRoute('PUT', '/api/bot-feedback', async (req, res) => {
+    if (!cachedLarkAppId)
+        return jsonRes(res, 503, { error: 'larkAppId_not_set' });
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch {
+        return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+    }
+    const spec = findConfigField('feedback');
+    if (!spec)
+        return jsonRes(res, 500, { ok: false, error: 'spec_missing' });
+    const raw = typeof body.feedback === 'string' ? body.feedback : '';
+    let value = null;
+    if (raw.trim()) {
+        const coerced = coerceConfigValue(spec, raw);
+        if (!coerced.ok)
+            return jsonRes(res, 400, { ok: false, error: coerced.reason });
+        value = coerced.value;
+    }
+    const r = await applyConfigField(cachedLarkAppId, spec, value);
+    if (!r.ok)
+        return jsonRes(res, 400, { ok: false, error: r.reason });
+    jsonRes(res, 200, { ok: true, feedback: value });
+});
+ipcRoute('PUT', '/api/chat-feedback/:chatId', async (req, res, params) => {
+    if (!cachedLarkAppId)
+        return jsonRes(res, 503, { ok: false, error: 'larkAppId_not_set' });
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch {
+        return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+    }
+    const feedback = body.feedback === null || body.feedback === undefined ? null : body.feedback;
+    const result = await setChatFeedbackPolicy(cachedLarkAppId, decodeURIComponent(params.chatId), feedback);
+    if (!result.ok)
+        return jsonRes(res, result.reason === 'bot_not_registered' ? 404 : 400, { ok: false, error: result.reason });
+    jsonRes(res, 200, { ok: true, feedback });
+});
+ipcRoute('GET', '/api/feedback-effective', async (req, res) => {
+    if (!cachedLarkAppId)
+        return jsonRes(res, 503, { ok: false, error: 'larkAppId_not_set' });
+    const chatId = new URL(req.url ?? '/', 'http://localhost').searchParams.get('chatId') || undefined;
+    jsonRes(res, 200, { ok: true, trace: traceFeedbackPolicyForDelivery({
+            dataDir: config.session.dataDir, larkAppId: cachedLarkAppId, chatId, bot: getBot(cachedLarkAppId).config,
+        }) });
+});
 // Per-bot 环境变量 env。Body `{ env: string }`（原始 JSON 文本，如
 // `{"ANTHROPIC_BASE_URL":"…","ANTHROPIC_AUTH_TOKEN":"…"}` 让本 bot 走 GLM/第三方
 // 服务商）：空白 → 清除；否则按 json kind 解析 + sanitizePerBotEnv 过滤后落盘。