botmux 3.4.3 → 3.5.2

package/dist/im/lark/card-handler.js

@@ -3,8 +3,7 @@ import { config } from '../../config.js';
 import { getBot, getAllBots, getOwnerOpenId } from '../../bot-registry.js';
 import { canOperate, canTalk } from './event-dispatcher.js';
 import { updateMessage, deleteMessage, replyMessage, sendMessage, sendUserMessage, sendEphemeralCard, getMessageDetail, isHumanOpenId, resolveUserUnionId as defaultResolveUserUnionId } from './client.js';
-import { buildSessionCard, buildStreamingCard, buildTuiPromptCard, buildTuiPromptProcessingCard, buildTuiPromptResolvedCard, buildGrantResultCard, buildGrantNotifyCard, getCliDisplayName, truncateContent, buildConfigCard, buildConfigTextCard, CONFIG_UNSET, buildLandResultCard, buildRepoSelectCard } from './card-builder.js';
-import { computeSandboxDiff, applySandboxDiff } from '../../services/sandbox-land.js';
+import { buildSessionCard, buildStreamingCard, buildTuiPromptCard, buildTuiPromptProcessingCard, buildTuiPromptResolvedCard, buildGrantResultCard, buildGrantNotifyCard, getCliDisplayName, truncateContent, buildConfigCard, buildConfigTextCard, CONFIG_UNSET, buildRepoSelectCard } from './card-builder.js';
 import { findConfigField, applyConfigField, coerceConfigValue, getConfigCardData } from '../../services/bot-config-store.js';
 import { updateBotGrantPrefs } from '../../services/grant-prefs-store.js';
 import { writeTeamRoleFile, deleteTeamRoleFile } from '../../core/role-resolver.js';
@@ -195,6 +194,17 @@ function duplicateMultiWorktreeChildNames(repoPaths, projects) {
     }
     return [...dupes];
 }
+function deferRepoCardWithdraw(larkAppId, messageId) {
+    if (!larkAppId || !messageId)
+        return;
+    // Let the card-action promise resolve so the SDK can send its callback ACK
+    // before the original card disappears. A microtask is too early here: it may
+    // run before the SDK continuation that serializes and writes the ACK frame.
+    setImmediate(() => {
+        void deleteMessage(larkAppId, messageId)
+            .catch(err => logger.debug(`Repo card withdraw (post-callback) failed: ${err}`));
+    });
+}
 /**
  * Commit a resolved working directory onto a repo-select session: pin it, then
  * either fork the pending CLI (first selection) or close + recreate the session
@@ -342,8 +352,9 @@ opts) {
             const cardToWithdraw = cardMessageId ?? ds.repoCardMessageId;
             markRepoCardConsumed(ds, cardToWithdraw);
             ds.repoCardMessageId = undefined;
-            // Hold the claim through confirmation + best-effort card withdraw so a
-            // concurrent in-flight select still sees pendingRepoCommitInFlight.
+            // Hold the claim through confirmation. Card withdrawal is deferred until
+            // after the callback can ACK; stale clicks are blocked by the local
+            // consume mark above rather than by the network request's lifetime.
             try {
                 if (!opts?.suppressConfirmReply) {
                     // A card click has no turn of its own — anchor the confirmation to the
@@ -358,12 +369,7 @@ opts) {
             catch (e) {
                 logger.warn(`[${tag(ds)}] Confirm reply after pending repo commit failed: ${e instanceof Error ? e.message : e}`);
             }
-            if (cardToWithdraw && larkAppId) {
-                try {
-                    await deleteMessage(larkAppId, cardToWithdraw);
-                }
-                catch { /* card may already be gone */ }
-            }
+            deferRepoCardWithdraw(larkAppId, cardToWithdraw);
         }
         finally {
             ds.pendingRepoCommitInFlight = false;
@@ -457,13 +463,9 @@ opts) {
             }
         }
         logger.info(`[${tag(ds)}] Repo switched to ${dirPath}, new session created`);
-        // Best-effort withdraw — card already claimed above.
-        if (claimedCard && larkAppId) {
-            try {
-                await deleteMessage(larkAppId, claimedCard);
-            }
-            catch { /* best-effort */ }
-        }
+        // The card was claimed locally above; withdraw it only after this callback
+        // can return its ACK so the delete request cannot race the callback frame.
+        deferRepoCardWithdraw(larkAppId, claimedCard);
     }
 }
 /**
@@ -535,34 +537,6 @@ export async function handleCardAction(data, deps, larkAppId) {
     // Use the receiving bot's allowedUsers — the operator open_id in card actions
     // is scoped to the app that received the callback.
     const operatorOpenId = data?.operator?.open_id;
-    // ─── 沙盒落盘卡（land_apply / land_discard）──────────────────────────────────
-    // 不绑 session（sessionId + workingDir 都在 value 里）。owner 强闸门：只有 owner 能把
-    // 隔离副本的改动应用回真实磁盘。agent 在沙盒里无感，不参与。
-    if (value?.action && (value.action === 'land_apply' || value.action === 'land_discard') && larkAppId) {
-        const loc = localeForBot(larkAppId);
-        const owner = getOwnerOpenId(larkAppId);
-        if (!operatorOpenId || operatorOpenId !== owner) {
-            logger.info(`Land action "${value.action}" blocked for non-owner: ${operatorOpenId}`);
-            return { toast: { type: 'error', content: t('card.land.toast_owner_only', undefined, loc) } };
-        }
-        if (value.action === 'land_discard') {
-            return JSON.parse(buildLandResultCard('discarded', '', loc));
-        }
-        const sid = value.sessionId;
-        const wd = value.workingDir;
-        if (!sid || !wd)
-            return JSON.parse(buildLandResultCard('failed', t('card.land.stale', undefined, loc), loc));
-        const d = computeSandboxDiff(config.session.dataDir, sid, loc);
-        if (!d.ok)
-            return JSON.parse(buildLandResultCard('failed', d.error, loc));
-        if (d.empty)
-            return JSON.parse(buildLandResultCard('discarded', '', loc));
-        const a = applySandboxDiff(wd, config.session.dataDir, sid, loc);
-        if (!a.ok)
-            return JSON.parse(buildLandResultCard('failed', a.error, loc));
-        logger.info(`Land applied: ${d.files} files (+${d.insertions}/-${d.deletions}) → ${wd}`);
-        return JSON.parse(buildLandResultCard('applied', t('card.land.applied_body', { files: d.files, ins: d.insertions, del: d.deletions, dir: wd }, loc), loc));
-    }
     // ─── 群内授权卡片动作（grant_chat / grant_global / grant_deny，talk-only）─────
     // 不绑定 session，必须在 session 解析之前处理。owner 强闸门 + nonce 校验。
     if (value?.action && (value.action === 'grant_chat' || value.action === 'grant_global' || value.action === 'grant_deny') && larkAppId) {
@@ -713,6 +687,17 @@ export async function handleCardAction(data, deps, larkAppId) {
     if (isAskCardAction(value?.action)) {
         return handleAskCardAction(data);
     }
+    if ((value?.action === 'codex_notifier_continue' || value?.action === 'codex_notifier_open_app')
+        && larkAppId) {
+        if (!operatorOpenId) {
+            logger.info(`${value.action} blocked because operator identity is missing`);
+            return { toast: { type: 'error', content: '只有机器人管理员可以操作此 Codex 任务' } };
+        }
+        if (!deps.codexNotifierCardAction) {
+            return { toast: { type: 'error', content: 'Codex 完成通知处理器未启用' } };
+        }
+        return deps.codexNotifierCardAction(data, larkAppId);
+    }
     if (typeof value?.action === 'string' &&
         value.action.startsWith('vc_meeting_') &&
         larkAppId) {
@@ -1547,6 +1532,17 @@ export async function handleCardAction(data, deps, larkAppId) {
             return;
         }
         if (actionType === 'tui_keys' && ds) {
+            // Fail-closed: only act on a currently-active card (either the
+            // ScreenAnalyzer TUI prompt card or our stuck-warning card). A stale
+            // click from a resolved/replaced card must NOT send any IPC to the
+            // worker — the CLI may have moved on or recovered. PATCH is UI only,
+            // not an authorization check.
+            const isActiveTuiCard = !!ds.tuiPromptCardId && cardMessageId === ds.tuiPromptCardId;
+            const isActiveStuckCard = !!ds.stuckWarningCardId && cardMessageId === ds.stuckWarningCardId;
+            if (!isActiveTuiCard && !isActiveStuckCard) {
+                logger.info(`[${tag(ds)}] tui_keys from stale card ${cardMessageId} — ignored (active tui=${ds.tuiPromptCardId ?? 'none'} stuck=${ds.stuckWarningCardId ?? 'none'})`);
+                return;
+            }
             let keys = [];
             try {
                 keys = JSON.parse(value?.keys ?? '[]');
@@ -1557,6 +1553,12 @@ export async function handleCardAction(data, deps, larkAppId) {
             const selectedIndex = Number(value?.selected_index ?? 0);
             const selectedText = value?.selected_text ?? `Option ${selectedIndex + 1}`;
             if (optionType === 'toggle') {
+                // Only a ScreenAnalyzer TUI card may own toggle state. A stuck-warning
+                // card must never read or mutate the other card's global selections.
+                if (!isActiveTuiCard) {
+                    logger.info(`[${tag(ds)}] Ignored toggle from non-TUI card ${cardMessageId}`);
+                    return;
+                }
                 // Toggle: only update card UI, do NOT send keys to terminal yet.
                 // Keys will be sent in batch when confirm is clicked.
                 if (!ds.tuiToggledIndices)
@@ -1579,10 +1581,15 @@ export async function handleCardAction(data, deps, larkAppId) {
                 }
                 return;
             }
-            // For confirm: batch all toggled options' keys first, then confirm keys
+            // For a normal TUI confirm: batch all toggled options' keys first.
+            // For a stuck-warning card: derive the single allowed key from the
+            // page type + selected index — NEVER trust value.keys from the card,
+            // which could be tampered to inject arbitrary keys. The allowlist is
+            // exactly the documented controls for each Codex hook-review screen.
             if (ds.worker) {
                 let allKeys = [];
-                if (ds.tuiToggledIndices?.length && ds.tuiPromptOptions) {
+                let isFinalStuck = false;
+                if (isActiveTuiCard && ds.tuiToggledIndices?.length && ds.tuiPromptOptions) {
                     // Send each toggled option's keys in sequence
                     for (const ti of ds.tuiToggledIndices.sort((a, b) => a - b)) {
                         const opt = ds.tuiPromptOptions[ti];
@@ -1590,29 +1597,116 @@ export async function handleCardAction(data, deps, larkAppId) {
                             allKeys.push(...opt.keys);
                         }
                     }
+                    // Then the action's own keys (confirm/select)
+                    allKeys.push(...keys);
+                }
+                else if (isActiveStuckCard) {
+                    // P1-4: do NOT trust the callback's selected_index. Require it to be
+                    // present and a safe integer, then range-check against the page type's
+                    // option count. A missing/malformed index must NOT default to 0 (trust),
+                    // which is the highest-risk action.
+                    const rawIdx = value?.selected_index;
+                    if (rawIdx === undefined || rawIdx === null || rawIdx === '') {
+                        logger.info(`[${tag(ds)}] Stuck-warning card click missing selected_index — dropped`);
+                        return;
+                    }
+                    const idx = Number(rawIdx);
+                    if (!Number.isSafeInteger(idx)) {
+                        logger.info(`[${tag(ds)}] Stuck-warning card click with non-integer selected_index=${rawIdx} — dropped`);
+                        return;
+                    }
+                    // Allowlist: map (pageType, idx) → the one safe key.
+                    // Level 1: 0=t, 1=Enter, 2=Esc ; Level 2: 0=t, 1=Esc
+                    const pt = ds.stuckWarningPageType;
+                    const allowlist = pt === 'hook review level 1'
+                        ? ['t', 'Enter', 'Escape']
+                        : pt === 'hook review level 2'
+                            ? ['t', 'Escape']
+                            : null;
+                    if (!allowlist || idx < 0 || idx >= allowlist.length) {
+                        logger.info(`[${tag(ds)}] Stuck-warning card click with out-of-range index ${idx} for pageType=${pt ?? 'none'} — dropped`);
+                        return;
+                    }
+                    allKeys = [allowlist[idx]];
+                    // Stuck-card actions are always final (they resolve the current
+                    // hook-review screen). Define this server-side — do NOT trust
+                    // value.is_final from the callback.
+                    isFinalStuck = true;
+                }
+                else {
+                    // Non-stuck, non-TUI card (shouldn't happen given the active-card
+                    // guard above, but fail-closed).
+                    allKeys.push(...keys);
                 }
-                // Then the action's own keys (confirm/select)
-                allKeys.push(...keys);
                 if (allKeys.length > 0) {
-                    ds.worker.send({ type: 'tui_keys', keys: allKeys, isFinal });
-                    logger.info(`[${tag(ds)}] TUI keys: [${allKeys.join(',')}] final=${isFinal} — "${selectedText}"`);
+                    // Atomic processing claim: if a previous click is already in flight
+                    // (waiting for tui_keys_delivered / stuck_warning_expired ACK), drop
+                    // this duplicate. Without this, two rapid clicks could both pass the
+                    // fresh-capture guard and inject keys twice.
+                    if (isActiveStuckCard) {
+                        if (ds.stuckWarningProcessing) {
+                            logger.info(`[${tag(ds)}] Duplicate stuck-warning card click — dropped (processing already in flight)`);
+                            return;
+                        }
+                        ds.stuckWarningProcessing = true;
+                    }
+                    // Only the stuck-warning card's Enter action re-arms the detector
+                    // (Enter advances from the hook list to a per-hook review). Match by
+                    // the actual keys sent — NOT by optionType, since t is typed 'confirm'
+                    // in the card definition. t/Esc and all ScreenAnalyzer cards never
+                    // set this flag. Also require the source card to be our own.
+                    const isStuckWarningEnter = isActiveStuckCard
+                        && allKeys.length === 1
+                        && allKeys[0] === 'Enter';
+                    // If this click is from a stuck-warning card, forward the nonce,
+                    // cliLifetime, and page type so the worker can re-verify the current
+                    // screen still matches before injecting keys. A stale click (CLI
+                    // recovered) will be dropped at the worker boundary.
+                    const stuckNonce = isActiveStuckCard ? ds.stuckWarningNonce : undefined;
+                    const stuckCliLifetime = isActiveStuckCard ? ds.stuckWarningCliLifetime : undefined;
+                    const stuckPage = isActiveStuckCard ? ds.stuckWarningPageType : undefined;
+                    const effectiveFinal = isFinal || isFinalStuck;
+                    ds.worker.send({ type: 'tui_keys', keys: allKeys, isFinal: effectiveFinal, rearmStuckDetector: isStuckWarningEnter, stuckNonce, stuckCliLifetime, stuckPageType: stuckPage });
+                    logger.info(`[${tag(ds)}] TUI keys: [${allKeys.join(',')}] final=${effectiveFinal} rearmStuck=${isStuckWarningEnter} stuckNonce=${stuckNonce ?? 'none'} — "${selectedText}"`);
                 }
-                if (isFinal) {
-                    const resolveText = ds.tuiToggledIndices?.length
+                if (isFinal || isFinalStuck) {
+                    const resolveText = isActiveTuiCard && ds.tuiToggledIndices?.length
                         ? ds.tuiToggledIndices.map(i => ds.tuiPromptOptions?.[i]?.text).filter(Boolean).join(', ')
                         : selectedText;
                     const finalText = resolveText || selectedText;
                     const locDs = localeForBot(ds.larkAppId);
+                    // For a stuck-warning card, do NOT clear authority or render success
+                    // here. The worker may still reject the keys (stale screen). We show a
+                    // "processing" state to block duplicate clicks, and wait for the
+                    // worker's tui_keys_delivered (success) or stuck_warning_expired
+                    // ("page changed, not sent") ACK before resolving the card.
+                    if (isActiveStuckCard) {
+                        if (cardMessageId) {
+                            const processingCard = buildTuiPromptProcessingCard('处理中…', locDs);
+                            updateMessage(ds.larkAppId, cardMessageId, processingCard).catch(err => logger.debug(`[${tag(ds)}] Failed to set stuck-warning card to processing: ${err}`));
+                        }
+                        publishAttentionPatch(ds);
+                        try {
+                            return JSON.parse(buildTuiPromptProcessingCard('处理中…', locDs));
+                        }
+                        catch { /* fall through */ }
+                    }
+                    // Normal TUI prompt card (ScreenAnalyzer): resolve immediately.
                     if (cardMessageId) {
                         setTimeout(() => {
                             const resolvedCard = buildTuiPromptResolvedCard(finalText, locDs);
                             updateMessage(ds.larkAppId, cardMessageId, resolvedCard).catch(err => logger.debug(`[${tag(ds)}] Failed to update TUI prompt card: ${err}`));
                         }, allKeys.length * 100 + 500);
                     }
-                    ds.tuiPromptCardId = undefined;
-                    ds.tuiPromptOptions = undefined;
-                    ds.tuiPromptMultiSelect = undefined;
-                    ds.tuiToggledIndices = undefined;
+                    // Clear state only for the card that was actually clicked — a stuck
+                    // card click must NOT wipe the ScreenAnalyzer TUI prompt state (or
+                    // vice versa) if both coexist / race.
+                    if (cardMessageId === ds.tuiPromptCardId) {
+                        ds.tuiPromptCardId = undefined;
+                        ds.tuiPromptOptions = undefined;
+                        ds.tuiPromptMultiSelect = undefined;
+                        ds.tuiToggledIndices = undefined;
+                    }
                     publishAttentionPatch(ds);
                     try {
                         return JSON.parse(buildTuiPromptProcessingCard(finalText, locDs));
@@ -1883,8 +1977,7 @@ export async function handleCardAction(data, deps, larkAppId) {
             }
             else {
                 await sessionReply(rootId, t('card.action.continue_using_current_repo', { cwd: getSessionWorkingDir(ds) }, locDs));
-                if (cardMessageId && larkAppId)
-                    deleteMessage(larkAppId, cardMessageId);
+                deferRepoCardWithdraw(larkAppId, cardMessageId);
                 ds.repoCardMessageId = undefined;
             }
         }
@@ -2065,8 +2158,9 @@ export async function handleCardAction(data, deps, larkAppId) {
         catch {
             return;
         }
-        // Re-discover to get full session info and validate. Backend determines
-        // which discovery to run (re-confirms the pane + pid are still alive).
+        // Re-discover to get full session info and validate. Keep the same CLI
+        // filter used to build the card so a stale/tampered option cannot switch
+        // this bot to a different agent implementation.
         const botCfg = getBot(ds.larkAppId).config;
         let target;
         async function resolveAdoptTarget() {
@@ -2080,9 +2174,17 @@ export async function handleCardAction(data, deps, larkAppId) {
                 return discoverAdoptableZellijSessions(botCfg.cliId)
                     .find(s => s.zellijSession === selected.zellijSession && s.zellijPaneId === selected.zellijPaneId);
             }
-            const { discoverAdoptableSessions, adoptTargetKey } = await import('../../core/session-discovery.js');
-            return discoverAdoptableSessions(botCfg.cliId)
-                .find(s => selected.key
+            const { discoverAdoptableSessions, excludeOwnedHerdrAdoptTargets, adoptTargetKey } = await import('../../core/session-discovery.js');
+            const ownedHerdrTargets = [...activeSessions.values()].flatMap(active => {
+                const target = active.session.persistentBackendTarget;
+                return active.session.status === 'active'
+                    && !active.adoptedFrom
+                    && target?.backendType === 'herdr'
+                    && !!target.agentName
+                    ? [{ sessionName: target.sessionName, agentName: target.agentName }]
+                    : [];
+            });
+            return excludeOwnedHerdrAdoptTargets(discoverAdoptableSessions(botCfg.cliId), ownedHerdrTargets).find(s => selected.key
                 ? adoptTargetKey(s) === selected.key
                 : s.tmuxTarget === selected.tmuxTarget && s.cliPid === selected.cliPid);
         }