botmux 3.13.0 → 3.15.0

package/dist/im/lark/card-handler.js

@@ -13,7 +13,9 @@ import { addChatGrant, addGlobalGrant } from '../../services/grant-store.js';
 import { checkNonce, clearPending, getPendingGrantLimits, getPendingMessage, markDenied, updatePendingGrantLimits, } from './grant-pending.js';
 import { normalizeGrantDurationOption, normalizeGrantQuotaOption } from '../../services/grant-policy.js';
 import { claimOverloadNonce, releaseOverloadNonce } from './overload-nonce.js';
-import { buildOverloadAlertCard, buildOverloadExpiredCard, OVERLOAD_ACTION_CLEAN_STOPPED, OVERLOAD_ACTION_SUSPEND_IDLE, OVERLOAD_ACTION_NOOP, } from '../../core/host-overload-alert.js';
+import { buildOverloadAlertCard, buildOverloadExpiredCard, OVERLOAD_ACTION_CLEAN_STOPPED, OVERLOAD_ACTION_SUSPEND_IDLE, OVERLOAD_ACTION_RESTART_BROWSER, OVERLOAD_ACTION_NOOP, buildOverloadBrowserFailureCard, } from '../../core/host-overload-alert.js';
+import { restartBrowser, resolveBrowserTargets } from '../../core/browser-restart.js';
+import { readGlobalConfig } from '../../global-config.js';
 import { listOnlineDaemons } from '../../utils/daemon-discovery.js';
 import { fetchDaemonIpc } from '../../core/daemon-ipc-auth.js';
 import { recordObservedBots } from '../../services/observed-bots-store.js';
@@ -692,6 +694,25 @@ export async function countHostOverload() {
     }));
     return { stopped, idle };
 }
+/** Resolve a card's actual visible placement from Lark, not action.value
+ * (which is round-tripped client data and therefore untrusted). */
+async function cardReplyOptions(larkAppId, cardMessageId, expectedChatId) {
+    if (!larkAppId || !cardMessageId)
+        return undefined;
+    try {
+        const detail = await getMessageDetail(larkAppId, cardMessageId);
+        const item = detail?.items?.[0];
+        if (!item || item.chat_id !== expectedChatId)
+            return undefined;
+        return item.thread_id
+            ? { replyTarget: { mode: 'thread', rootMessageId: cardMessageId } }
+            : { replyTarget: { mode: 'plain', chatId: item.chat_id } };
+    }
+    catch (err) {
+        logger.debug(`card reply-placement probe failed; preserving legacy route: ${err}`);
+        return undefined;
+    }
+}
 export async function handleCardAction(data, deps, larkAppId) {
     const { activeSessions, lastRepoScan } = deps;
     // turnId is forwarded only when the caller actually has a turn anchor
@@ -773,6 +794,92 @@ export async function handleCardAction(data, deps, larkAppId) {
         // Rebuild the SAME card: clicked button → ✓done+disabled, other → still live.
         return JSON.parse(buildOverloadAlertCard(st));
     }
+    // ─── 过载告警卡：重启浏览器（overload_restart_browser）────────────────────
+    // owner 强闸门 + 按 bundleId 分开的一次性 nonce 核销（可分别重启 Arc/Chrome/Edge，
+    // 各一次）。重启在本机 daemon 直接执行（浏览器就跑在本机），不跨 daemon 扇出。
+    if (value?.action === OVERLOAD_ACTION_RESTART_BROWSER && larkAppId) {
+        const owner = getOwnerOpenId(larkAppId);
+        if (!operatorOpenId || operatorOpenId !== owner) {
+            logger.info(`Overload browser-restart blocked for non-owner: ${operatorOpenId}`);
+            return { toast: { type: 'error', content: '仅管理员可操作' } };
+        }
+        const bundleId = typeof value.bundleId === 'string' ? value.bundleId : '';
+        if (!bundleId)
+            return { toast: { type: 'error', content: '按钮缺少 bundleId' } };
+        let st;
+        try {
+            st = JSON.parse(value.st ?? '');
+        }
+        catch {
+            return JSON.parse(buildOverloadExpiredCard());
+        }
+        if (!st?.nonce)
+            return JSON.parse(buildOverloadExpiredCard());
+        // Fail-closed against config drift: the button lives
+        // on a card that stays clickable for the nonce's 1h TTL, but the config's
+        // enabled targets can change underneath it (a target disabled via
+        // `enabled:false` or removed entirely). Before we quit a real host browser,
+        // require the bundleId to be present BOTH on this card's `st.browsers` (it
+        // was a rendered button, not a forged value) AND in the live resolved
+        // enabled targets (it's still an allowed target right now). Either miss →
+        // refuse without touching the browser, so a stale card can't kill a browser
+        // the operator has since taken off the allow-list.
+        const target = (st.browsers ?? []).find(b => b.bundleId === bundleId);
+        let liveTargets = [];
+        try {
+            const alertCfg = (readGlobalConfig().hostOverloadAlert ?? {});
+            liveTargets = resolveBrowserTargets(alertCfg.browserRestartTargets);
+        }
+        catch { /* resolver is pure over config; treat a throw as "no live targets" → fail-closed below */ }
+        const liveTarget = liveTargets.find(t => t.bundleId === bundleId);
+        if (!target || !liveTarget) {
+            logger.info(`[overload] restart browser refused (config drift): bundleId=${bundleId} onCard=${!!target} liveEnabled=${!!liveTarget}`);
+            return JSON.parse(buildOverloadExpiredCard('该浏览器的重启配置已变更或卡片已过期，未执行。'));
+        }
+        const label = target.label ?? liveTarget.label ?? bundleId;
+        // One-shot per (nonce, bundleId): each browser button burns its own claim so
+        // the owner can bounce several browsers on one card, but none twice.
+        const claimKey = `${OVERLOAD_ACTION_RESTART_BROWSER}:${bundleId}`;
+        if (!claimOverloadNonce(st.nonce, claimKey)) {
+            return JSON.parse(buildOverloadExpiredCard('这个按钮已点过，或该告警卡已过期。'));
+        }
+        const openArgs = liveTarget.openArgs;
+        let result;
+        try {
+            result = await restartBrowser({ bundleId, ...(openArgs ? { openArgs } : {}) });
+        }
+        catch (err) {
+            logger.warn(`[overload] restart browser ${label} threw: ${err instanceof Error ? err.message : String(err)}`);
+            releaseOverloadNonce(st.nonce, claimKey);
+            // Return a VISIBLE card, not a toast: the handler can
+            // run up to ~12s (quit-wait), which exceeds the 2.5s card-ACK window — a
+            // toast-only result after that ACK is silently dropped by the dispatcher.
+            // buildOverloadBrowserFailureCard renders a patchable card carrying the
+            // rebuilt alert `st`, so the owner actually sees the failure + can retry.
+            return JSON.parse(buildOverloadBrowserFailureCard(st, label, '重启失败，请稍后重试'));
+        }
+        if (!result.ok) {
+            // Quit never happened (e.g. unsaved-changes dialog) — nothing was killed;
+            // release the claim so the owner can retry after handling the dialog. Same
+            // reasoning as above: deliver via a patchable card, never a toast.
+            logger.warn(`[overload] restart browser ${label} not ok: ${result.error ?? 'unknown'}`);
+            releaseOverloadNonce(st.nonce, claimKey);
+            return JSON.parse(buildOverloadBrowserFailureCard(st, label, result.error ?? '重启失败'));
+        }
+        if (!result.relaunched) {
+            // Quit succeeded but relaunch failed: the browser is
+            // now DOWN, not restarted. Do NOT mark it「✓已重启」and do NOT burn the
+            // claim — release it so the owner can retry the reopen. Report the true
+            // state (已退出未重开) on a patchable card.
+            logger.warn(`[overload] browser ${label} quit but relaunch failed: ${result.error ?? 'unknown'}`);
+            releaseOverloadNonce(st.nonce, claimKey);
+            return JSON.parse(buildOverloadBrowserFailureCard(st, label, `已退出但重开失败：${result.error ?? '未知错误'}。可再点一次重试重开`));
+        }
+        // Mark this browser done on the card (button → ✓已重启, disabled).
+        st.restartedBrowsers = [...new Set([...(st.restartedBrowsers ?? []), bundleId])];
+        logger.info(`[overload] browser ${label} restarted by owner ${operatorOpenId} (relaunched=${result.relaunched})`);
+        return JSON.parse(buildOverloadAlertCard(st));
+    }
     // ─── 群内授权卡片动作（限制提交 + grant/revoke，talk-only）──────────────────
     // 不绑定 session，必须在 session 解析之前处理。owner 强闸门 + nonce 校验。
     if (value?.action && (value.action === 'grant_chat'
@@ -952,6 +1059,27 @@ export async function handleCardAction(data, deps, larkAppId) {
     if (isAskCardAction(value?.action)) {
         return handleAskCardAction(data);
     }
+    if (['feedback_submit', 'feedback_reason', 'feedback_comment', 'skill_feedback_submit'].includes(value?.action ?? '') && larkAppId) {
+        const { handleSkillFeedbackCardAction } = await import('./skill-feedback-card.js');
+        const { getSkillFeedbackStore } = await import('../../services/skill-feedback-store.js');
+        const { config } = await import('../../config.js');
+        return handleSkillFeedbackCardAction(data, larkAppId, {
+            store: await getSkillFeedbackStore(config.session.dataDir),
+            loadBaseCard: async (platformMessageId) => {
+                const detail = await getMessageDetail(larkAppId, platformMessageId);
+                const content = detail?.items?.[0]?.body?.content ?? detail?.body?.content;
+                if (typeof content !== 'string')
+                    return undefined;
+                try {
+                    const parsed = JSON.parse(content);
+                    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            },
+        });
+    }
     if ((value?.action === 'codex_notifier_continue' || value?.action === 'codex_notifier_open_app')
         && larkAppId) {
         if (!operatorOpenId) {
@@ -1685,6 +1813,18 @@ export async function handleCardAction(data, deps, larkAppId) {
         const ds = activeSessions.get(sKey);
         if (!ds)
             return { toast: { type: 'error', content: t('card.adopt.toast_no_session', undefined, loc) } };
+        // The picker can live in a folded chat-scope topic while rootId remains the
+        // chat session anchor. Freeze the trusted card placement before adoption
+        // mutates the session, so its success/error replies stay beside the picker.
+        const replyOptionsPromise = cardReplyOptions(larkAppId, cardMessageId, ds.chatId);
+        const pickerSessionReply = async (rid, content, msgType, appId, turnId, opts) => {
+            const placement = await replyOptionsPromise;
+            return deps.sessionReply(rid, content, msgType, appId, turnId, opts?.replyTarget || !placement
+                ? opts
+                : { ...opts, replyTarget: placement.replyTarget });
+        };
+        const pickerDeps = { ...deps, sessionReply: pickerSessionReply };
+        const pickerReply = (content, msgType) => pickerSessionReply(rootId, content, msgType, larkAppId);
         const sourceSession = ds.session;
         if (isSessionTransferring(ds)) {
             return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
@@ -1709,13 +1849,13 @@ export async function handleCardAction(data, deps, larkAppId) {
             }
             const target = resumable.find(r => r.cliSessionId === cliSessionId);
             if (!target) {
-                await sessionReply(rootId, t('cmd.adopt.resume_not_found', { id: cliSessionId }, localeForBot(ds.larkAppId)));
+                await pickerReply(t('cmd.adopt.resume_not_found', { id: cliSessionId }, localeForBot(ds.larkAppId)));
                 clearAdoptCandidates(rootId);
                 if (cardMessageId && larkAppId)
                     deleteMessage(larkAppId, cardMessageId);
                 return;
             }
-            await startResumeImportSession(target, ds, { activeSessions, sessionReply: deps.sessionReply, getActiveCount: () => 0, lastRepoScan }, larkAppId);
+            await startResumeImportSession(target, ds, { ...pickerDeps, getActiveCount: () => 0 }, larkAppId);
             clearAdoptCandidates(rootId);
             if (cardMessageId && larkAppId)
                 deleteMessage(larkAppId, cardMessageId);
@@ -1764,14 +1904,14 @@ export async function handleCardAction(data, deps, larkAppId) {
             return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
         }
         if (!target) {
-            await sessionReply(rootId, t('cmd.adopt.target_exited', undefined, localeForBot(ds.larkAppId)));
+            await pickerReply(t('cmd.adopt.target_exited', undefined, localeForBot(ds.larkAppId)));
             clearAdoptCandidates(rootId);
             if (cardMessageId && larkAppId)
                 deleteMessage(larkAppId, cardMessageId);
             return;
         }
         const { startAdoptSession } = await import('../../core/command-handler.js');
-        await startAdoptSession(target, ds, { activeSessions, sessionReply: deps.sessionReply, getActiveCount: () => 0, lastRepoScan }, larkAppId);
+        await startAdoptSession(target, ds, { ...pickerDeps, getActiveCount: () => 0 }, larkAppId);
         clearAdoptCandidates(rootId);
         if (cardMessageId && larkAppId)
             deleteMessage(larkAppId, cardMessageId);