botmux 3.15.0 → 3.16.0

package/dist/im/lark/card-handler.js

@@ -1,4 +1,5 @@
 import { basename as pathBasename, dirname, join } from 'node:path';
+import { closeResidualIsLocal, describeCloseResidual } from '../../core/close-residual.js';
 import { config } from '../../config.js';
 import { getBot, getAllBots, getOwnerOpenId } from '../../bot-registry.js';
 import { canOperate, canTalk } from './event-dispatcher.js';
@@ -32,18 +33,19 @@ import { ttadkConfigModelChoices } from '../../setup/cli-selection.js';
 import { logger } from '../../utils/logger.js';
 import * as sessionStore from '../../services/session-store.js';
 import { loadFrozenCards, saveFrozenCards } from '../../services/frozen-card-store.js';
+import { resumeStartsFresh } from '../../services/resume-fresh-policy.js';
 import { forkWorker, sendWorkerInput, sendWorkerSessionInput, closeSession as closeWorkerPoolSession, teardownAuthoritativePersistentBackingBeforeClose, scheduleCardPatch, parkStreamCard, clearUsageLimitState, cardUsageLimit, writableTerminalLinkFor, workerHasInitialized, sessionSupportsWebTerminal, readableTerminalUrlFor, resolvePrivateCardAudience, deliverWriteLinkCard, deliverEphemeralOrReply, CARD_POSTING_SENTINEL, requestSessionRestart, isSessionTransferring, getDaemonStreamingCardUsageSnapshot, withActiveSessionKeyLock } from '../../core/worker-pool.js';
 import { getSessionWorkingDir, buildNewTopicCliInput, getAvailableBots, persistStreamCardState, resumeSession, rememberLastCliInput, ensureSessionWhiteboard } from '../../core/session-manager.js';
 import { markInitialUserTurnPending } from '../../core/initial-user-turn.js';
 import { publishAttentionPatch, announcePendingRepoSession } from '../../core/session-activity.js';
-import { fallbackTurnId } from '../../core/reply-target.js';
+import { fallbackTurnId, rehomeReplyTargetState } from '../../core/reply-target.js';
 import { sendWorkerIpc } from '../../core/worker-ipc.js';
 import { validateWorkingDir } from '../../core/working-dir.js';
 import { activeSessionKey, sessionKey, sessionAnchorId, frozenDisplayMode, markRepoCardConsumed, isActiveRepoCard } from '../../core/types.js';
 import { buildTerminalUrl } from '../../core/terminal-url.js';
 import { createRepoWorktree, removeRepoWorktree, dirSuffixForBranch, pushWorktreeBranch } from '../../services/git-worktree.js';
 import { withCodexAppContext } from '../../utils/codex-app-context.js';
-import { isRiffBackendSession, resolvePairedSpawnBackendType } from '../../core/persistent-backend.js';
+import { isRemoteBackendSession, resolvePairedSpawnBackendType } from '../../core/persistent-backend.js';
 import { sessionConfiguredRuntimeDisplayName } from '../../core/cli-runtime-display.js';
 import { worktreeSlugFromContextAI } from '../../services/worktree-slug-ai.js';
 import { t, localeForBot, isLocale } from '../../i18n/index.js';
@@ -261,14 +263,16 @@ opts) {
             + `(current=${ds.repoCardMessageId ?? 'none'})`);
         return false;
     }
-    // A live Riff generation cannot use the generic close-and-refork branch.
-    // Riff teardown is a remote prepare/commit protocol; a failed cancellation
-    // followed by forkWorker would reach the double-fork kill and orphan the
-    // still-live remote task.  Require an explicit /close before any card,
-    // worktree, or manual-directory selection can replace this generation.
-    if (!ds.pendingRepo && isRiffBackendSession(ds)) {
-        await sessionReply(rootId, t('cmd.cd.riff_unsupported', undefined, locTarget));
-        logger.warn(`[${tag(ds)}] Repo switch refused: Riff session requires explicit close before replacement`);
+    // A live REMOTE generation (Riff or Mojo) cannot use the generic
+    // close-and-refork branch. Remote teardown is a prepare/commit protocol; a
+    // failed cancellation followed by forkWorker would reach the double-fork
+    // kill and orphan the still-live remote task. Require an explicit /close
+    // before any card, worktree, or manual-directory selection can replace this
+    // generation. (Fourth-round review: the riff-only predicate left the card
+    // entry point open for mojo.)
+    if (!ds.pendingRepo && isRemoteBackendSession(ds)) {
+        await sessionReply(rootId, t('cmd.cd.remote_unsupported', undefined, locTarget));
+        logger.warn(`[${tag(ds)}] Repo switch refused: remote session requires explicit close before replacement`);
         return false;
     }
     if (!ds.pendingRepo
@@ -492,7 +496,25 @@ opts) {
                 // frozen-card file; it is re-keyed under the replacement session below.
                 parkStreamCard(current);
                 const oldSession = current.session;
-                await closeWorkerPoolSession(targetSessionId);
+                const closeResult = await closeWorkerPoolSession(targetSessionId);
+                // A refused close (remote cancellation unproven) leaves the row ACTIVE on
+                // purpose. Deleting the owner anyway would strand an active row with no
+                // owner — a ghost — while the remote session keeps running and holding the
+                // injected credential. Abort the switch instead. (Same guard as the text
+                // /repo path in command-handler.)
+                if (!closeResult.ok) {
+                    return { ok: false, error: 'close_refused' };
+                }
+                if (closeResult.outcome === 'closed_with_residual') {
+                    // Same rule as the text /repo path: picking a directory is not consent
+                    // to leave a remote session running, so stop instead of spawning a
+                    // replacement on top of it.
+                    return {
+                        ok: false,
+                        error: 'close_residual',
+                        residual: closeResult.residual,
+                    };
+                }
                 if (activeSessions.get(key) === current)
                     activeSessions.delete(key);
                 if (activeSessions.has(key)) {
@@ -520,6 +542,7 @@ opts) {
                 }
                 current.streamCardId = undefined;
                 current.streamCardNonce = undefined;
+                rehomeReplyTargetState(current);
                 current.streamCardPending = undefined;
                 current.lastScreenContent = undefined;
                 current.lastScreenStatus = undefined;
@@ -535,6 +558,20 @@ opts) {
             if (switched.error === 'dispatch_pending') {
                 await sessionReply(rootId, '当前 Codex App 仍有未结算消息，暂不能切换仓库；请等待本轮完成或关闭会话。');
             }
+            else if (switched.error === 'close_residual') {
+                await sessionReply(rootId, closeResidualIsLocal(switched.residual)
+                    ? '⚠️ 原会话已在本地关闭、远端会话已取消，但**本机可能残留带凭证的子进程未确认终止**'
+                        + `（${describeCloseResidual(switched.residual)}），请人工核查该主机进程。\n`
+                        + '**未创建新会话** —— 请先确认该子进程已终止，再重新切换仓库。'
+                    : '⚠️ 原会话已在本地关闭，但它的远端会话未能取消（控制面无法验证），'
+                        + `需要人工清理：\`${switched.residual.taskId}\`。\n`
+                        + '**未创建新会话** —— 请先处理遗留的远端会话，再重新切换仓库。');
+            }
+            else if (switched.error === 'close_refused') {
+                // Without this the user taps the card and gets nothing back, while the old
+                // session is still active and its remote session still running.
+                await sessionReply(rootId, '⚠️ 无法切换仓库：原会话的远端会话未能确认取消，已保留原会话以便重试。请稍后重试。');
+            }
             return false;
         }
         await deliverEphemeralOrReply(switched.current, operatorOpenId, switched.closedCard, 'interactive', () => sessionReply(rootId, switched.closedCard, 'interactive'));
@@ -2081,12 +2118,16 @@ export async function handleCardAction(data, deps, larkAppId) {
                 await sessionReply(rootId, t('card.action.adopt_no_restart', undefined, locDs));
                 return;
             }
-            // New Riff cards omit this button, but old/stale cards remain clickable.
-            // Surface the same explicit close-and-recreate guidance as /restart
-            // instead of forwarding an IPC the Riff worker must silently refuse.
-            if (isRiffBackendSession(ds)) {
-                logger.warn(`[${tag(ds)}] Rejected restart on Riff backend session`);
-                const unsupported = t('cmd.restart.riff_unsupported', undefined, locDs);
+            // New remote cards omit this button, but old/stale cards remain
+            // clickable. Surface the same explicit close-and-recreate guidance as
+            // /restart. This must cover EVERY remote backend: unlike riff (whose
+            // worker refuses restart), a mojo worker EXECUTES restart — its teardown
+            // cancels the remote session and cold-boots a context-less replacement —
+            // so a riff-only guard here was a real user entry point into a silent
+            // remote-session destruction (fourth-round review, gate 1).
+            if (isRemoteBackendSession(ds)) {
+                logger.warn(`[${tag(ds)}] Rejected restart on remote backend session`);
+                const unsupported = t('cmd.restart.remote_unsupported', undefined, locDs);
                 await deliverEphemeralOrReply(ds, operatorOpenId, unsupported, 'text', () => sessionReply(rootId, unsupported));
                 return;
             }
@@ -2135,13 +2176,30 @@ export async function handleCardAction(data, deps, larkAppId) {
                 // Build the closed card BEFORE closeWorkerPoolSession — it reads the
                 // live session's identity off `current`.
                 const card = buildClosedSessionCard(current, localeForBot(current.larkAppId));
+                let closeResult;
                 try {
-                    await closeWorkerPoolSession(targetSessionId);
+                    closeResult = await closeWorkerPoolSession(targetSessionId);
                 }
                 catch (err) {
                     logger.error(`[${tag(current)}] Refused close because backing teardown was not verified: ${err}`);
                     return { status: 'teardown_failed', err };
                 }
+                // Returned (not thrown) refusal: the remote session could not be proven
+                // cancelled, so the row stays active. Sending the closed card here would
+                // tell the user it is gone while it keeps running.
+                if (!closeResult.ok) {
+                    logger.error(`[${tag(current)}] Refused close: remote cancellation not proven (${closeResult.error})`);
+                    return { status: 'close_refused', result: closeResult };
+                }
+                if (closeResult.outcome === 'closed_with_residual') {
+                    return {
+                        status: 'closed_with_residual',
+                        current,
+                        botCfg,
+                        card,
+                        residual: closeResult.residual,
+                    };
+                }
                 return { status: 'closed', current, botCfg, card };
             });
             if (!closed) {
@@ -2155,6 +2213,35 @@ export async function handleCardAction(data, deps, larkAppId) {
                     },
                 };
             }
+            if (closed.status === 'closed_with_residual') {
+                // Closed locally, with a residual. A LOCAL-subtree residual has no taskId,
+                // so the old wording rendered "远端会话 undefined 未被取消" and pointed the
+                // operator at a nonexistent remote session (round-11 P1-2).
+                return {
+                    toast: {
+                        type: 'warning',
+                        content: closeResidualIsLocal(closed.residual)
+                            ? `会话已在本地关闭、远端会话已取消，但本机可能残留带凭证子进程未确认终止`
+                                + `（${describeCloseResidual(closed.residual)}），请人工核查该主机进程。`
+                            : `会话已在本地关闭，但远端会话 ${closed.residual.taskId} 未被取消`
+                                + '（控制面无法验证），需要人工清理。',
+                    },
+                };
+            }
+            if (closed.status === 'close_refused') {
+                const locClose = localeForBot(larkAppId);
+                return {
+                    toast: {
+                        type: 'warning',
+                        content: closed.result.taskId
+                            ? t('card.action.close_refused_with_task', {
+                                error: closed.result.error,
+                                taskId: closed.result.taskId,
+                            }, locClose)
+                            : t('card.action.close_refused', { error: closed.result.error }, locClose),
+                    },
+                };
+            }
             const { current, botCfg, card } = closed;
             // The closed card carries session title / CLI name / workingDir / resume
             // command. In private-card mode those must not leak to the group — send the
@@ -2185,7 +2272,13 @@ export async function handleCardAction(data, deps, larkAppId) {
                 const result = await resumeSession(targetSessionId, activeSessions);
                 if (result.ok) {
                     const cliName = sessionCliDisplayName(result.ds);
-                    const resumeMsg = t('card.action.resume_success', { cliName }, localeForBot(result.ds.larkAppId));
+                    // Distinguish "route reactivated" from "CLI history restored": when
+                    // the adapter can only resume a precise cliSessionId and none was
+                    // persisted, the next spawn starts a FRESH session — say so instead
+                    // of claiming history is back.
+                    const resumeMsg = resumeStartsFresh(result.ds.session)
+                        ? t('card.action.resume_success_fresh', { cliName }, localeForBot(result.ds.larkAppId))
+                        : t('card.action.resume_success', { cliName }, localeForBot(result.ds.larkAppId));
                     await deliverEphemeralOrReply(result.ds, operatorOpenId, resumeMsg, 'text', () => sessionReply(rootId, resumeMsg));
                     logger.info(`[${targetSessionId.substring(0, 8)}] Resumed via card button`);
                 }
@@ -3075,12 +3168,13 @@ export async function handleCardAction(data, deps, larkAppId) {
         logger.info(`Repo card action blocked for ${operatorOpenId} (pending=${targetDs.pendingRepo})`);
         return { toast: { type: 'error', content: t('card.grant.toast_no_repo_perm', undefined, localeForBot(targetDs.larkAppId)) } };
     }
-    // Reject a live Riff repo/worktree replacement before slug generation or
+    // Reject a live REMOTE repo/worktree replacement before slug generation or
     // any local/remote Git side effect. First-spawn pendingRepo selections stay
-    // recoverable when a synchronous fork failure has already stamped Riff.
-    if (!targetDs.pendingRepo && isRiffBackendSession(targetDs)) {
-        await sessionReply(rootId, t('cmd.cd.riff_unsupported', undefined, localeForBot(targetDs.larkAppId)));
-        logger.warn(`[${tag(targetDs)}] Repo switch refused before Git work: Riff session requires explicit close before replacement`);
+    // recoverable when a synchronous fork failure has already stamped the
+    // remote backend.
+    if (!targetDs.pendingRepo && isRemoteBackendSession(targetDs)) {
+        await sessionReply(rootId, t('cmd.cd.remote_unsupported', undefined, localeForBot(targetDs.larkAppId)));
+        logger.warn(`[${tag(targetDs)}] Repo switch refused before Git work: remote session requires explicit close before replacement`);
         return;
     }
     // Resolve the project name from cached scan