botmux 3.15.0 → 3.16.0

package/dist/core/command-handler.js

@@ -7,14 +7,15 @@ import { join, resolve, basename } from 'node:path';
 import { config } from '../config.js';
 import { buildTerminalUrl } from './terminal-url.js';
 import { getBot, getAllBots, getBotOpenId, getOwnerOpenId, findOncallChat, effectiveDefaultWorkingDir } from '../bot-registry.js';
-import { readGlobalConfig, repoPickerScanOptions } from '../global-config.js';
+import { readGlobalConfig, repoPickerScanOptions, isWorkflowFeatureEnabled } from '../global-config.js';
+import { closeResidualIsLocal, describeCloseResidual } from './close-residual.js';
 import * as sessionStore from '../services/session-store.js';
 import * as scheduleStore from '../services/schedule-store.js';
 import * as scheduler from './scheduler.js';
 import { scanMultipleProjects, describeProjectDir } from '../services/project-scanner.js';
 import { createRepoWorktree, pushWorktreeBranch } from '../services/git-worktree.js';
 import { worktreeSlugFromContextAI } from '../services/worktree-slug-ai.js';
-import { isRiffBackendSession, resolvePairedSpawnBackendType } from './persistent-backend.js';
+import { isRemoteBackendSession, resolvePairedSpawnBackendType } from './persistent-backend.js';
 import { buildRepoSelectCard, buildAdoptSelectCard, buildCodexAppThreadSelectCard, buildSlashListCard, getCliDisplayName, buildConfigCard, buildForkPanelCard, buildAdoptBlockedCard } from '../im/lark/card-builder.js';
 import { handleDashboardCommand } from './dashboard-command/index.js';
 import { createCliAdapterSync } from '../adapters/cli/registry.js';
@@ -61,6 +62,7 @@ import { updateSessionTitle } from './session-title.js';
 import { requestAgentSessionRename } from './session-rename.js';
 import { hasProtectedSessionMutationOwnership } from './session-mutation-guard.js';
 import { withBotTurnMutation } from './bot-turn-mutation-gate.js';
+import { rehomeReplyTargetState } from './reply-target.js';
 import { configuredRuntimeDisplayName, sessionConfiguredRuntimeDisplayName, } from './cli-runtime-display.js';
 import { isSessionGroup } from '../services/session-groups-store.js';
 // ─── Exported constants ──────────────────────────────────────────────────────
@@ -1283,16 +1285,36 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         // Capture the closed-session card BEFORE closeWorkerPoolSession —
                         // it reads the live session's identity off `current`.
                         const card = buildClosedSessionCard(current, localeForBot(current.larkAppId));
+                        let closeResult;
                         try {
                             // closeWorkerPoolSession proves fail-closed backing teardown
                             // before mutating any registry/store state, throwing when it
                             // cannot verify it. Surface that so the active record is kept
                             // for retry instead of being silently dropped.
-                            await closeWorkerPoolSession(targetSessionId);
+                            closeResult = await closeWorkerPoolSession(targetSessionId);
                         }
                         catch (err) {
                             return { status: 'teardown_failed', err };
                         }
+                        // A remote backend (riff / mojo) that could not prove its remote
+                        // session was cancelled RETURNS a retryable failure rather than
+                        // throwing, and deliberately leaves the row active. Reporting
+                        // "closed" here is exactly the lie that fix meant to remove: the
+                        // remote session would still be running and holding the credential.
+                        if (!closeResult.ok) {
+                            return { status: 'close_refused', result: closeResult };
+                        }
+                        if (closeResult.outcome === 'closed_with_residual') {
+                            // Local row IS closed, so this is not a failure — but a remote
+                            // session was deliberately left running, and the ordinary "closed"
+                            // card would imply everything is gone.
+                            return {
+                                status: 'closed_with_residual',
+                                current,
+                                card,
+                                residual: closeResult.residual,
+                            };
+                        }
                         return { status: 'closed', current, card };
                     });
                     if (!closed) {
@@ -1304,6 +1326,33 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         await sessionReply(rootId, `⚠️ 会话关闭失败，已保留 active 记录以便重试：${closed.err instanceof Error ? closed.err.message : String(closed.err)}`);
                         break;
                     }
+                    if (closed.status === 'closed_with_residual') {
+                        const isLocal = closeResidualIsLocal(closed.residual);
+                        logger.warn(`[${logTag}] session closed locally with residual (${closed.residual.reason}); `
+                            + `${isLocal ? 'local host subtree unproven' : `remote lineage ${closed.residual.taskId} NOT cancelled`}; `
+                            + 'manual cleanup required');
+                        await sessionReply(rootId, isLocal
+                            ? '✅ 会话已在本地关闭，远端会话已取消。\n'
+                                + '⚠️ 但**本机可能残留带凭证的子进程未确认终止**'
+                                + `（${describeCloseResidual(closed.residual)}）——**请人工核查该主机进程**。`
+                                + 'device-isolation 会保留隔离直到主机重启或 `botmux mojo-containment revoke`。'
+                            : '✅ 会话已在本地关闭。\n'
+                                + `⚠️ 但远端会话 \`${closed.residual.taskId}\` **未被取消** —— 它的控制面无法验证`
+                                + '（quarantined），盲目取消可能打到别的租户，因此保留下来。**需要人工清理**，'
+                                + '否则它会继续占用云端沙箱并持有已注入的凭据。');
+                        break;
+                    }
+                    if (closed.status === 'close_refused') {
+                        logger.error(`[${logTag}] Refused /close: remote session cancellation not proven `
+                            + `(${closed.result.error}); active record kept for retry`);
+                        await sessionReply(rootId, closed.result.taskId
+                            ? t('cmd.close.refused_with_task', {
+                                error: closed.result.error,
+                                taskId: closed.result.taskId,
+                            }, loc)
+                            : t('cmd.close.refused', { error: closed.result.error }, loc));
+                        break;
+                    }
                     // 「会话已关闭」卡片优先「仅自己可见」：普通群顶层走 ephemeral 只发给
                     // 执行 /close 的本人；若本命令从折叠到 chat-scope 的真实话题触发，则
                     // invocationReplyTarget 让 helper 跳过无 thread 锚点的 ephemeral，回原话题。
@@ -1373,9 +1422,13 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                         await sessionReply(rootId, t('card.action.adopt_no_restart', undefined, loc));
                         break;
                     }
-                    if (isRiffBackendSession(ds)) {
-                        logger.info(`[${logTag}] Rejected /restart for Riff backend session`);
-                        await sessionReply(rootId, t('cmd.restart.riff_unsupported', undefined, loc));
+                    // ALL remote backends: destroy-and-respawn severs or replaces the
+                    // remote lineage. The riff-only guard let mojo /restart through to
+                    // restartCliProcess, which cancels the remote session and cold-boots
+                    // a context-less replacement (third-round review, gate 4).
+                    if (isRemoteBackendSession(ds)) {
+                        logger.info(`[${logTag}] Rejected /restart for remote backend session`);
+                        await sessionReply(rootId, t('cmd.restart.remote_unsupported', undefined, loc));
                         break;
                     }
                     // Codex App: an accepted-but-unsettled dispatch still owns the turn
@@ -1418,12 +1471,14 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     await sessionReply(rootId, t('cmd.session.transfer_in_progress', undefined, loc));
                     break;
                 }
-                // A live Riff worker owns a remote task rooted in its original cwd.
-                // killWorker/restart deliberately refuse to replace that generation,
-                // so persisting a new cwd here would report success while the remote
-                // task keeps running in the old directory.
-                if (isRiffBackendSession(ds)) {
-                    await sessionReply(rootId, t('cmd.cd.riff_unsupported', undefined, loc));
+                // A live remote worker (Riff OR Mojo) owns a remote lineage rooted in
+                // its original cwd. killWorker refuses unprepared live retirement for
+                // EVERY remote backend, so persisting a new cwd here would report
+                // success while the live generation keeps running against the old
+                // directory — the exact split brain the riff-only guard used to allow
+                // for mojo (P1-a).
+                if (isRemoteBackendSession(ds)) {
+                    await sessionReply(rootId, t('cmd.cd.remote_unsupported', undefined, loc));
                     break;
                 }
                 // Cheap preflight avoids creating a requested directory when the
@@ -1510,13 +1565,15 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                 break;
             }
             case '/repo': {
-                // A live Riff generation must finish the explicit /close protocol before
-                // its anchor can be reused.  The generic repo-switch path closes and
-                // immediately reforks; if remote cancellation fails, that would fall
-                // through to the double-fork kill and orphan the remote task.
-                if (ds && !ds.pendingRepo && isRiffBackendSession(ds)) {
-                    await sessionReply(rootId, t('cmd.cd.riff_unsupported', undefined, loc));
-                    logger.warn(`[${logTag}] Repo switch refused: Riff session requires explicit close before replacement`);
+                // A live REMOTE generation (Riff or Mojo) must finish the explicit
+                // /close protocol before its anchor can be reused. The generic
+                // repo-switch path closes and immediately reforks; if remote
+                // cancellation fails, that would fall through to the double-fork kill
+                // and orphan the remote task — the guard's own rationale, which the
+                // riff-only predicate left open for mojo (third-round review, gate 4).
+                if (ds && !ds.pendingRepo && isRemoteBackendSession(ds)) {
+                    await sessionReply(rootId, t('cmd.cd.remote_unsupported', undefined, loc));
+                    logger.warn(`[${logTag}] Repo switch refused: remote session requires explicit close before replacement`);
                     break;
                 }
                 const repoArg = message.content.replace(/^\/repo\s*/, '').trim();
@@ -1727,7 +1784,24 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                                 }
                                 const closedCard = buildClosedSessionCard(current, loc);
                                 const oldSession = current.session;
-                                await closeWorkerPoolSession(targetSessionId);
+                                const closeResult = await closeWorkerPoolSession(targetSessionId);
+                                // A refused close (remote cancellation unproven) leaves the row
+                                // ACTIVE on purpose. Continuing would delete it from the registry
+                                // anyway, stranding an active row with no owner — a ghost — while
+                                // the remote session keeps running. Abort the replacement instead.
+                                if (!closeResult.ok) {
+                                    return { ok: false, error: 'close_refused' };
+                                }
+                                if (closeResult.outcome === 'closed_with_residual') {
+                                    // The user asked to switch directory, not to consent to leaving a
+                                    // remote session running. Stop here and tell them, rather than
+                                    // quietly spawning a replacement on top of the residual.
+                                    return {
+                                        ok: false,
+                                        error: 'close_residual',
+                                        residual: closeResult.residual,
+                                    };
+                                }
                                 // The key lock excludes every sanctioned creator. A direct
                                 // lifecycle callback may still have published unexpectedly;
                                 // fail closed instead of overwriting that first owner.
@@ -1750,6 +1824,7 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                                 session.ownerOpenId = oldSession.ownerOpenId;
                                 session.creatorOpenId = oldSession.creatorOpenId;
                                 session.lastCallerOpenId = oldSession.lastCallerOpenId;
+                                rehomeReplyTargetState(current);
                                 sessionStore.updateSession(session);
                                 current.hasHistory = false;
                                 activeSessions.set(key, current);
@@ -1766,6 +1841,25 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                             if (switched.error === 'dispatch_pending') {
                                 await sessionReply(rootId, '当前 Codex App 仍有未结算消息，暂不能切换仓库；请等待本轮完成或关闭会话。');
                             }
+                            else if (switched.error === 'close_residual') {
+                                const isLocal = closeResidualIsLocal(switched.residual);
+                                logger.warn(`[${logTag}] Repo switch stopped: old session closed with `
+                                    + `${isLocal ? 'an unproven local host subtree' : 'an uncancelled remote lineage'}`);
+                                await sessionReply(rootId, isLocal
+                                    ? '⚠️ 原会话已在本地关闭、远端会话已取消，但**本机可能残留带凭证的子进程未确认终止**'
+                                        + `（${describeCloseResidual(switched.residual)}），请人工核查该主机进程。\n`
+                                        + '**未创建新会话** —— 请先确认该子进程已终止，再重新切换仓库。'
+                                    : '⚠️ 原会话已在本地关闭，但它的远端会话未能取消（控制面无法验证），'
+                                        + `需要人工清理：\`${switched.residual.taskId}\`。\n`
+                                        + '**未创建新会话** —— 请先处理遗留的远端会话，再重新切换仓库。');
+                            }
+                            else if (switched.error === 'close_refused') {
+                                // Silence here would be the worst outcome: the old session is
+                                // still active AND its remote session is still running, but the
+                                // user asked for a switch and would see nothing at all.
+                                logger.error(`[${logTag}] Repo switch aborted: old session's remote cancellation was not proven`);
+                                await sessionReply(rootId, '⚠️ 无法切换仓库：原会话的远端会话未能确认取消，已保留原会话以便重试。请稍后重试。');
+                            }
                             else {
                                 logger.warn(`[${logTag}] Repo switch aborted because the session was replaced`);
                             }
@@ -3910,10 +4004,16 @@ export async function handleCommand(cmd, rootId, message, deps, larkAppId) {
                     t('help.login', undefined, loc),
                     t('help.login_status', undefined, loc),
                     t('help.pair', undefined, loc),
-                    '',
-                    t('help.heading_workflow', undefined, loc),
-                    t('help.workflow_run', undefined, loc),
-                    t('help.workflow_cancel', undefined, loc),
+                    // Workflow help section — omitted when the machine-wide workflow
+                    // switch is off, so `/help` never advertises a disabled feature.
+                    ...(isWorkflowFeatureEnabled()
+                        ? [
+                            '',
+                            t('help.heading_workflow', undefined, loc),
+                            t('help.workflow_run', undefined, loc),
+                            t('help.workflow_cancel', undefined, loc),
+                        ]
+                        : []),
                     '',
                     t('help.heading_role', undefined, loc),
                     t('help.role_show', undefined, loc),
@@ -4033,11 +4133,13 @@ async function blockTakeoverWhilePendingRepo(ds, sessionReply) {
  * persisted ownership mutation so the original lineage stays recoverable.
  */
 async function blockRiffTakeover(ds, sessionReply) {
-    if (!isRiffBackendSession(ds))
+    // Historical name, remote-wide guard: takeover/import replaces the live
+    // generation, which every remote backend forbids outside prepare/commit.
+    if (!isRemoteBackendSession(ds))
         return false;
     const loc = localeForBot(ds.larkAppId);
-    await sessionReply(sessionAnchorId(ds), t('cmd.takeover.riff_unsupported', undefined, loc));
-    logger.warn(`[${tag(ds)}] Takeover refused: Riff session requires explicit close before replacement`);
+    await sessionReply(sessionAnchorId(ds), t('cmd.takeover.remote_unsupported', undefined, loc));
+    logger.warn(`[${tag(ds)}] Takeover refused: remote session requires explicit close before replacement`);
     return true;
 }
 export async function startCodexAppThreadSession(thread, ds, deps, larkAppId) {