botmux 3.5.0 → 3.6.0

package/dist/daemon.js

@@ -2,8 +2,9 @@ import { execFileSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync, existsSync, mkdirSync, unlinkSync } from 'node:fs';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
+import { readAllowedUsersResolveCache, writeAllowedUsersResolveCache } from './utils/allowed-users-cache.js';
 import { join, dirname } from 'node:path';
-import { homedir } from 'node:os';
+import { homedir, loadavg, cpus, totalmem, freemem } from 'node:os';
 import { fileURLToPath } from 'node:url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -14,19 +15,24 @@ import { resolveBotmuxDataDir } from './core/data-dir.js';
 import { reloadExactDaemonBotConfig } from './core/daemon-config-fence.js';
 import { writeHeartbeat } from './core/daemon-heartbeat.js';
 import { botmuxWrapperFiles } from './core/botmux-wrapper.js';
+import { evaluateOverload, formatOverloadAlert, buildOverloadAlertCard, buildOverloadRecoveredCard, initialOverloadCardState, DEFAULT_OVERLOAD_THRESHOLDS, INITIAL_OVERLOAD_STATE, } from './core/host-overload-alert.js';
+import { registerOverloadNonce } from './im/lark/overload-nonce.js';
+import { countHostOverload } from './im/lark/card-handler.js';
 import { startMaintenance, stopMaintenance } from './core/maintenance.js';
 import { selectCodexRuntimeUpdateTargets, startCliRuntimeUpdateMonitor, stopCliRuntimeUpdateMonitor, } from './core/cli-runtime-update.js';
 import { sendRestartReportIfPending } from './core/restart-report.js';
 import { statSync } from 'node:fs';
 import { addReaction, getChatMode, getChatNameAndMode, getMessageChatId, listChatMemberOpenIds, MessageWithdrawnError, replyMessage, resolveAllowedUsersWithMap, sendMessage, sendUserMessage, updateMessage } from './im/lark/client.js';
 import { resolveGroupJoinPrompt, waitForAllowedUserInChat } from './core/auto-start.js';
-import { loadBotConfigAtIndex, loadBotConfigs, isManagedActivationStartingAtIndex, registerBot, getBot, getAllBots, getOwnerOpenId, findOncallChat, effectiveDefaultWorkingDir, effectiveBotDisplayName, resolveVcMeetingConsumerProfiles, } from './bot-registry.js';
+import { loadBotConfigAtIndex, loadBotConfigs, isManagedActivationStartingAtIndex, registerBot, getBot, getAllBots, getOwnerOpenId, findOncallChat, effectiveDefaultWorkingDir, effectiveBotDisplayName, resolveVcMeetingConsumerProfiles, setResolvedAllowedUsersRepublishHook, setAllowedUsersResolveRetryHook, } from './bot-registry.js';
 import { setDisplayNameRefresher, findConfigField, applyConfigField } from './services/bot-config-store.js';
 import { renameBotOnOpenPlatform, changeBotAvatarOnOpenPlatform } from './services/open-platform-rename.js';
+import { migrateSandboxConfigAtStartup } from './services/sandbox-migration.js';
 import * as sessionStore from './services/session-store.js';
 import * as chatFirstSeenStore from './services/chat-first-seen-store.js';
 import { ensureDefaultOncallBound } from './services/oncall-store.js';
 import * as scheduleStore from './services/schedule-store.js';
+import { migrateSharedSchedulesAtStartup } from './services/schedule-split-migration.js';
 import * as messageQueue from './services/message-queue.js';
 import { emitHookEvent, emitHookEventLocal, HOOK_EVENTS } from './services/hook-runner.js';
 import { setSessionLifecycleShutdown } from './services/session-lifecycle-hooks.js';
@@ -35,7 +41,8 @@ import { expandMergeForward } from './im/lark/merge-forward.js';
 import { bindResourcesToMessage, composeForwardFollowupContent, mergeMessageMentions } from './im/lark/forward-followup-content.js';
 import { buildQuoteHint } from './im/lark/quote-hint.js';
 import { logger } from './utils/logger.js';
-import { withFileLock } from './utils/file-lock.js';
+import { applyAllowedUsersResolve } from './utils/allowed-users-apply.js';
+import { withFileLock, withFileLockSync } from './utils/file-lock.js';
 import { delay } from './utils/timing.js';
 import { BoundedMap } from './utils/bounded-map.js';
 import { checkAllowedChatGroupsConfig } from './services/allowed-chat-groups.js';
@@ -115,8 +122,30 @@ let selfV3BootInstanceId;
 /** Generic daemon identity used by internal receiver endpoints. Unlike the
  *  VC listener switch, every agent daemon may receive a fenced membership. */
 let selfDaemonLarkAppId;
+/**
+ * Live dashboard descriptor for THIS daemon's single bot. Held module-level so
+ * the deferred allowedUsers resolve retry (a detached setTimeout that has no
+ * `desc` in scope) can patch `resolvedAllowedUsers` and republish coherently —
+ * and so the 30s heartbeat, which rewrites this same object, never clobbers a
+ * healed value back to stale. One daemon per bot, so a single ref is correct.
+ */
+let selfDaemonDescriptor;
+/**
+ * Patch the live descriptor's `resolvedAllowedUsers` (ou_ only) and rewrite it.
+ * Safe to call from the deferred resolve retry. Best-effort.
+ */
+function republishResolvedAllowedUsers(larkAppId, resolved) {
+    const desc = selfDaemonDescriptor;
+    if (!desc || desc.larkAppId !== larkAppId)
+        return;
+    desc.resolvedAllowedUsers = resolved.filter(u => u.startsWith('ou_'));
+    try {
+        writeDaemonDescriptor(desc);
+    }
+    catch { /* best effort */ }
+}
 let vcMeetingTerminalReconciler;
-import { isBotMentioned, probeBotOpenId, startLarkEventDispatcher, markForwardFollowupsSessionsReady, writeBotInfoFile, canOperate, evaluateTalk, grantCommandRestriction, isKnownPeerBot, checkRequiredScopes } from './im/lark/event-dispatcher.js';
+import { isBotMentioned, probeBotOpenId, startLarkEventDispatcher, markForwardFollowupsSessionsReady, writeBotInfoFile, canOperate, canRunDaemonCommand, evaluateTalk, grantCommandRestriction, isKnownPeerBot, checkRequiredScopes } from './im/lark/event-dispatcher.js';
 import { getDocSubscription, listAllDocSubscriptions, removeDocSubscription, setDocCommentPollCursor } from './services/doc-subs-store.js';
 import { BOT_REPLY_SENTINEL, subscribeDocFile, unsubscribeDocFile, addCommentReaction, hasBotSentinel, isBotAuthoredReply, listDocComments } from './im/lark/doc-comment.js';
 import { learnFromMentions, resolveSender, flushIdentityCacheSync } from './im/lark/identity-cache.js';
@@ -142,7 +171,7 @@ import { createGroupWithBots } from './services/group-creator.js';
 import { addBotToChat, isInChat } from './services/groups-store.js';
 import { setChatReplyMode } from './services/chat-reply-mode-store.js';
 import { hasVcMeetingEndedTombstone, listVcMeetingRuntimeSessionsByListenerAndAgent, listVcMeetingRuntimeSessions, pruneExpiredVcMeetingRuntimeSessions, recordVcMeetingEndedTombstone, recordVcMeetingRuntimeSession, removeVcMeetingRuntimeSession, } from './services/vc-meeting-runtime-store.js';
-import { computeVcMeetingConsumerProfileHash } from './services/vc-meeting-profile-instructions.js';
+import { computeVcMeetingConsumerProfileHash, normalizeVcMeetingProfileInstructions, } from './services/vc-meeting-profile-instructions.js';
 import { bootstrapVcMeetingDefaultConsumerProfile } from './services/vc-meeting-consumer-profile-bootstrap.js';
 import { getVcMeetingPreparation, normalizeVcMeetingNumber, } from './services/vc-meeting-preparations-store.js';
 import { abandonPoisonedVcMeetingDelivery, getVcMeetingDeliveryStatus, handleVcMeetingTurnTerminal, handleVcMeetingWorkerGenerationExit, receiveVcMeetingDelivery, registerVcMeetingMember, retryPoisonedVcMeetingDelivery, } from './services/vc-meeting-delivery-receiver.js';
@@ -153,6 +182,7 @@ import { applyVcMeetingHubMemberProjection, freezeVcMeetingHubDeliveryAssignment
 import { getVcMeetingFeedMetadataState, ingestVcMeetingFeedMetadata, } from './services/vc-meeting-feed-metadata-store.js';
 import { VcMeetingTerminalReconciler } from './services/vc-meeting-terminal-reconciler.js';
 import { resolveVcMeetingImTurnOrigin, verifyVcMeetingManagedOriginClaim, } from './services/vc-meeting-send-policy.js';
+import { ensureVcMeetingListenerTopicRoot, } from './services/vc-meeting-listener-topic-store.js';
 import { finishVcMeetingManagedActionProvider, finishVcMeetingManagedApprovalCard, requestVcMeetingManagedImAction, requestVcMeetingManagedAction, resolveVcMeetingManagedActionApproval, } from './services/vc-meeting-action-gate.js';
 import { claimVcMeetingApprovalCardAttempt, findVcMeetingAction, listVcMeetingActionScopes, listVcMeetingActions, reconcileVcMeetingActionsOnBoot, } from './services/vc-meeting-action-store.js';
 import { authorizeVcMeetingDaemonControlRequest, ensureVcMeetingDaemonAuthToken, withVcMeetingDaemonAuthHeader, } from './services/vc-meeting-daemon-auth.js';
@@ -802,6 +832,8 @@ const VC_MEETING_SYNC_INTERVAL_OPTIONS_MS = [15_000, 30_000, 60_000, 90_000];
 const VC_MEETING_CUSTOM_SYNC_INTERVAL_MIN_SECONDS = 10;
 const VC_MEETING_CUSTOM_SYNC_INTERVAL_MAX_SECONDS = 3_600;
 const VC_MEETING_CUSTOM_SYNC_INTERVAL_FIELD = 'vc_meeting_custom_interval_seconds';
+const VC_MEETING_ACTIVATION_CONTEXT_FIELD = 'vc_meeting_activation_context';
+const VC_MEETING_ACTIVATION_CONTEXT_MAX_CHARS = 2_000;
 const vcMeetingEndedTombstones = new BoundedMap(2_000);
 const vcMeetingPendingInvites = new BoundedMap(2_000);
 function vcMeetingSessionKey(larkAppId, meetingId) {
@@ -898,6 +930,26 @@ function normalizeVcMeetingCustomSyncIntervalMs(value) {
 function vcMeetingCustomSyncIntervalFromCard(data) {
     return normalizeVcMeetingCustomSyncIntervalMs(data.action?.form_value?.[VC_MEETING_CUSTOM_SYNC_INTERVAL_FIELD]);
 }
+function normalizeVcMeetingActivationContext(value) {
+    if (value === undefined || value === null)
+        return { ok: true };
+    const text = (Array.isArray(value) ? String(value[0] ?? '') : String(value))
+        .replace(/\r\n?/g, '\n')
+        .trim();
+    if (!text)
+        return { ok: true };
+    if (text.length > VC_MEETING_ACTIVATION_CONTEXT_MAX_CHARS) {
+        return { ok: false, error: `本次会议补充说明不能超过 ${VC_MEETING_ACTIVATION_CONTEXT_MAX_CHARS} 个字符` };
+    }
+    const normalized = normalizeVcMeetingProfileInstructions(text);
+    if (!normalized.ok) {
+        return { ok: false, error: `本次会议补充说明无效：${normalized.error}` };
+    }
+    return { ok: true, context: normalized.instructions };
+}
+function vcMeetingActivationContextFromCard(data) {
+    return normalizeVcMeetingActivationContext(data.action?.form_value?.[VC_MEETING_ACTIVATION_CONTEXT_FIELD]);
+}
 function vcMeetingSessionFlushIntervalMs(session, cfg) {
     return session.syncIntervalMs ?? cfg.flushIntervalMs ?? DEFAULT_VC_MEETING_FLUSH_INTERVAL_MS;
 }
@@ -1888,6 +1940,20 @@ async function sessionReply(anchor, content, msgType = 'text', larkAppId, turnId
                 return sendWithHookPolicy(chatId, content, msgType, opts.uuid);
             }
         }
+        if (opts?.placement === 'chat') {
+            return sendWithHookPolicy(chatId, content, msgType, opts.uuid);
+        }
+        if (opts?.placement === 'topic') {
+            const topicKey = opts.meetingTopicKey;
+            if (!topicKey || topicKey.targetChatId !== chatId) {
+                throw new Error('meeting topic placement is missing a matching durable topic key');
+            }
+            const root = await ensureVcMeetingListenerTopicRoot(config.session.dataDir, topicKey, () => sendWithHookPolicy(chatId, content, msgType, opts.uuid));
+            if (root.created) {
+                return root.rootMessageId;
+            }
+            return replyWithHookPolicy(root.rootMessageId, content, msgType, true, opts.uuid);
+        }
         if (ds?.scope === 'chat') {
             const fresh = readSessionFreshFromDisk(ds.session.sessionId, ds.larkAppId);
             if (fresh)
@@ -2102,6 +2168,123 @@ function removeDaemonDescriptor(larkAppId) {
         catch { /* ignore */ }
     }
 }
+/**
+ * Persistent last-known-good `raw entry → ou_` cache for allowedUsers. The
+ * read/write primitives live in utils/allowed-users-cache.ts so the runtime
+ * set/revoke paths (services layer) write through the same sidecar and it never
+ * diverges from the live allowlist. These thin wrappers bind the data dir.
+ */
+function readAllowedUsersCache(larkAppId) {
+    return readAllowedUsersResolveCache(config.session.dataDir, larkAppId);
+}
+function writeAllowedUsersCache(larkAppId, map, opts = {}) {
+    writeAllowedUsersResolveCache(config.session.dataDir, larkAppId, { map, ...opts });
+}
+/** Raw entries the resolver flagged as definitively gone (safe to prune from cache). */
+function definitiveEntriesOf(entryStatus) {
+    if (!entryStatus)
+        return [];
+    const out = [];
+    for (const [entry, status] of entryStatus.entries()) {
+        if (status === 'definitive')
+            out.push(entry);
+    }
+    return out;
+}
+function notifyAllowedUsersResolveFailure(larkAppId, notice, recipients) {
+    logger.error(`[${larkAppId}] ${notice}`);
+    const unique = [...new Set(recipients.filter(u => typeof u === 'string' && u.startsWith('ou_')))];
+    if (unique.length === 0) {
+        logger.error(`[${larkAppId}] allowedUsers resolve failed with no open_id recipient available for DM; ` +
+            `check daemon logs and Feishu contact API, then restart this bot.`);
+        return;
+    }
+    // Fire-and-forget: the owner DM must NOT block daemon startup. sendUserMessage
+    // uses an untimed SDK path; awaiting it on the boot-critical path (before the
+    // WS listener starts) would stall the bot coming online during the very
+    // contact/network partition that triggered this notice. Bound each attempt
+    // with a deadline and detach.
+    void (async () => {
+        for (const openId of unique.slice(0, 5)) {
+            try {
+                await sendUserMessage(larkAppId, openId, `⚠️ Botmux allowedUsers 解析告警\n\n${notice}`, 'text', undefined, { timeoutMs: 10_000 });
+            }
+            catch (err) {
+                logger.warn(`[${larkAppId}] failed to DM allowedUsers resolve notice to ${openId.slice(0, 12)}: ${err?.message ?? err}`);
+            }
+        }
+    })();
+}
+function scheduleAllowedUsersResolveRetry(larkAppId, attempt = 1) {
+    if (attempt > 3)
+        return;
+    const delayMs = attempt === 1 ? 30_000 : attempt === 2 ? 120_000 : 300_000;
+    const timer = setTimeout(() => {
+        void (async () => {
+            let bot;
+            try {
+                bot = getBot(larkAppId);
+            }
+            catch {
+                return;
+            }
+            const configured = bot.config.allowedUsers ?? [];
+            if (configured.length === 0)
+                return;
+            // Fingerprint the config we resolve against. A /revoke or `set allowedUsers`
+            // can land during the cross-network resolve await below; without this fence
+            // the stale retry result would clobber the newer runtime/cache/descriptor —
+            // reviving a just-revoked guest, or forking runtime from the persisted
+            // config until the next restart. If the config changed, drop this result
+            // (the mutation path already wrote through, and if it needs a retry it
+            // schedules its own).
+            const fingerprint = JSON.stringify(configured);
+            try {
+                const resolveResult = await resolveAllowedUsersWithMap(larkAppId, configured);
+                let liveBot;
+                try {
+                    liveBot = getBot(larkAppId);
+                }
+                catch {
+                    return;
+                }
+                if (JSON.stringify(liveBot.config.allowedUsers ?? []) !== fingerprint) {
+                    logger.info(`[${larkAppId}] allowedUsers resolve retry #${attempt} discarded: config changed during resolve`);
+                    return;
+                }
+                const applied = applyAllowedUsersResolve({
+                    rawEntries: configured,
+                    previousResolvedMap: readAllowedUsersCache(larkAppId),
+                    resolveResult,
+                });
+                liveBot.resolvedAllowedUsers = applied.resolved;
+                liveBot.rawAllowedUserResolution = applied.map;
+                // Persist the recovered map + republish the descriptor so the dashboard
+                // (create-group creator picker) and the next boot both see the healed
+                // open_ids — otherwise a successful retry only heals in-memory state.
+                // Prune definitively-gone entries + keys no longer configured so a stale
+                // owner can't be revived later.
+                writeAllowedUsersCache(larkAppId, applied.map, {
+                    deleteEntries: definitiveEntriesOf(resolveResult.entryStatus),
+                    retainKeys: configured,
+                });
+                republishResolvedAllowedUsers(larkAppId, applied.resolved);
+                if (!applied.failed) {
+                    logger.info(`[${larkAppId}] allowedUsers resolve retry succeeded: ${applied.resolved.join(', ') || '(empty — entries definitively gone)'}`);
+                    return;
+                }
+                logger.warn(`[${larkAppId}] allowedUsers resolve retry #${attempt} still degraded` +
+                    `${applied.usedFallback ? ' (on cache)' : applied.resolved.length ? '' : ' (allowlist empty)'}`);
+                scheduleAllowedUsersResolveRetry(larkAppId, attempt + 1);
+            }
+            catch (err) {
+                logger.warn(`[${larkAppId}] allowedUsers resolve retry #${attempt} threw: ${err?.message ?? err}`);
+                scheduleAllowedUsersResolveRetry(larkAppId, attempt + 1);
+            }
+        })();
+    }, delayMs);
+    timer.unref?.();
+}
 // ─── Version tracking ────────────────────────────────────────────────────────
 function refreshCliVersion(cliId, cliPathOverride) {
     const now = Date.now();
@@ -7580,11 +7763,29 @@ function vcMeetingRuntimeAgentForProfile(profile, status, opts = {}) {
         ...(opts.activationError ? { activationError: opts.activationError.slice(0, 500) } : {}),
         ...(filter ? { filter } : {}),
         responseMode: profile.responseMode,
+        listenerPlacement: profile.listenerDelivery?.placement ?? 'auto',
         capabilities: vcMeetingCanonicalProfileCapabilities(profile),
         ownedSinks: vcMeetingCanonicalProfileOwnedSinks(profile),
         deliveryProfileHash: opts.deliveryProfileHash ?? vcMeetingConsumerProfileHash(profile),
     };
 }
+function vcMeetingProfileWithActivationContext(profile, activationContext) {
+    if (!activationContext)
+        return profile;
+    const contextSection = [
+        '本次会议补充说明（仅适用于本次会议，不修改角色预设）：',
+        activationContext,
+    ].join('\n');
+    const combined = profile.instructions
+        ? `${profile.instructions}\n\n${contextSection}`
+        : contextSection;
+    const normalized = normalizeVcMeetingProfileInstructions(combined);
+    if (!normalized.ok || !normalized.instructions) {
+        throw new Error(`profile ${profile.id} 的预设职责与本次会议补充说明无法合并：`
+            + `${normalized.ok ? '内容为空' : normalized.error}`);
+    }
+    return { ...profile, instructions: normalized.instructions };
+}
 /** Rehydrate the exact immutable profile snapshot selected for this member
  * epoch. Current bots.json is only authoritative for a first join/re-add; an
  * edit or deletion must not rewrite an in-flight meeting after restart. */
@@ -7597,6 +7798,9 @@ function vcMeetingProfileFromRuntimeAgent(selected) {
         ...(selected.instructions ? { instructions: selected.instructions } : {}),
         ...(selected.filter ? { filter: selected.filter } : {}),
         responseMode: selected.responseMode,
+        ...(selected.listenerPlacement !== 'auto'
+            ? { listenerDelivery: { placement: selected.listenerPlacement } }
+            : {}),
         capabilities: [...selected.capabilities],
         ...(selected.ownedSinks.length > 0 ? { ownedSinks: [...selected.ownedSinks] } : {}),
     };
@@ -7664,6 +7868,7 @@ async function ensureVcMeetingProfileMember(session, profile, listenerChatId, op
         && JSON.stringify(prior.ownedSinks) === JSON.stringify(canonicalOwnedSinks);
     const samePolicy = sameStreamSemantics
         && prior.responseMode === profile.responseMode
+        && prior.outputPlacement === (profile.listenerDelivery?.placement ?? 'auto')
         && JSON.stringify(prior.capabilities) === JSON.stringify(canonicalCapabilities)
         && sameOwnedSinks;
     // Receiver registration commits before the hub projection. A crash in that
@@ -7680,6 +7885,7 @@ async function ensureVcMeetingProfileMember(session, profile, listenerChatId, op
         && receiverPrior.instructions === instructions
         && receiverPrior.outputChatId === listenerChatId
         && receiverPrior.responseMode === profile.responseMode
+        && receiverPrior.outputPlacement === (profile.listenerDelivery?.placement ?? 'auto')
         && JSON.stringify(receiverPrior.filter ?? {}) === JSON.stringify(canonicalFilter ?? {})
         && JSON.stringify(receiverPrior.capabilities) === JSON.stringify(canonicalCapabilities)
         && JSON.stringify(receiverPrior.ownedSinks) === JSON.stringify(canonicalOwnedSinks)
@@ -7744,7 +7950,10 @@ async function ensureVcMeetingProfileMember(session, profile, listenerChatId, op
             responseMode: orphanedReceiver?.responseMode ?? profile.responseMode,
             ...policy,
         },
-        outputRoute: { chatId: orphanedReceiver?.outputChatId ?? listenerChatId },
+        outputRoute: {
+            chatId: orphanedReceiver?.outputChatId ?? listenerChatId,
+            placement: orphanedReceiver?.outputPlacement ?? profile.listenerDelivery?.placement ?? 'auto',
+        },
     };
     const receiver = await postVcMeetingMemberProjection(profile.agentAppId, projection);
     const body = vcMeetingResponseRecord(receiver.body);
@@ -7777,6 +7986,7 @@ async function ensureVcMeetingProfileMember(session, profile, listenerChatId, op
         membershipGeneration,
         status: 'active',
         responseMode: orphanedReceiver?.responseMode ?? profile.responseMode,
+        outputPlacement: orphanedReceiver?.outputPlacement ?? profile.listenerDelivery?.placement ?? 'auto',
         ...policy,
         joinedAtIngestSeq,
         receiverSessionId,
@@ -7889,6 +8099,7 @@ async function pauseVcMeetingSingleConsumerMembership(session) {
         membershipGeneration,
         status: 'paused',
         responseMode: prior.responseMode,
+        outputPlacement: prior.outputPlacement ?? 'auto',
         joinedAtIngestSeq: prior.joinedAtIngestSeq,
         receiverSessionId: prior.receiverSessionId,
         outputChatId: prior.outputChatId,
@@ -7914,7 +8125,7 @@ async function pauseVcMeetingSingleConsumerMembership(session) {
             joinedAtIngestSeq: prior.joinedAtIngestSeq,
             responseMode: prior.responseMode,
         },
-        outputRoute: { chatId: prior.outputChatId },
+        outputRoute: { chatId: prior.outputChatId, placement: prior.outputPlacement ?? 'auto' },
     });
     const body = vcMeetingResponseRecord(receiver.body);
     if (receiver.status < 200 || receiver.status >= 300 || body?.ok !== true) {
@@ -7960,6 +8171,7 @@ async function pauseVcMeetingProfileMembership(session, selected) {
         membershipGeneration,
         status: 'paused',
         responseMode: prior.responseMode,
+        outputPlacement: prior.outputPlacement ?? 'auto',
         ...policy,
         joinedAtIngestSeq: prior.joinedAtIngestSeq,
         receiverSessionId: prior.receiverSessionId,
@@ -7987,7 +8199,7 @@ async function pauseVcMeetingProfileMembership(session, selected) {
             responseMode: prior.responseMode,
             ...policy,
         },
-        outputRoute: { chatId: prior.outputChatId },
+        outputRoute: { chatId: prior.outputChatId, placement: prior.outputPlacement ?? 'auto' },
     });
     const body = vcMeetingResponseRecord(receiver.body);
     if (receiver.status < 200 || receiver.status >= 300 || body?.ok !== true) {
@@ -8018,6 +8230,7 @@ function retireVcMeetingSingleConsumerForRecovery(session, reason) {
         membershipGeneration,
         status: 'removed',
         responseMode: member.responseMode,
+        outputPlacement: member.outputPlacement ?? 'auto',
         joinedAtIngestSeq: member.joinedAtIngestSeq,
         receiverSessionId: member.receiverSessionId,
         outputChatId: member.outputChatId,
@@ -8037,6 +8250,7 @@ function retireVcMeetingSingleConsumerForRecovery(session, reason) {
         membershipGeneration,
         status: 'removed',
         responseMode: member.responseMode,
+        outputPlacement: member.outputPlacement ?? 'auto',
         joinedAtIngestSeq: member.joinedAtIngestSeq,
         receiverSessionId: member.receiverSessionId,
         outputChatId: member.outputChatId,
@@ -8078,6 +8292,7 @@ function retireVcMeetingProfileMemberForRecovery(member, reason) {
         membershipGeneration,
         status: 'removed',
         responseMode: member.responseMode,
+        outputPlacement: member.outputPlacement ?? 'auto',
         ...policy,
         joinedAtIngestSeq: member.joinedAtIngestSeq,
         receiverSessionId: member.receiverSessionId,
@@ -8099,6 +8314,7 @@ function retireVcMeetingProfileMemberForRecovery(member, reason) {
         membershipGeneration,
         status: 'removed',
         responseMode: member.responseMode,
+        outputPlacement: member.outputPlacement ?? 'auto',
         ...policy,
         joinedAtIngestSeq: member.joinedAtIngestSeq,
         receiverSessionId: member.receiverSessionId,
@@ -8269,6 +8485,7 @@ function vcMeetingProfileMemberSemanticsMatchRuntime(member, selected, listenerC
         && member.outputChatId === listenerChatId
         && member.deliveryProfileHash === selected.deliveryProfileHash
         && member.responseMode === selected.responseMode
+        && (member.outputPlacement ?? 'auto') === selected.listenerPlacement
         && JSON.stringify(member.filter ?? {}) === JSON.stringify(selected.filter ?? {})
         && JSON.stringify(member.capabilities) === JSON.stringify(selected.capabilities)
         && JSON.stringify(member.ownedSinks) === JSON.stringify(selected.ownedSinks);
@@ -8310,6 +8527,7 @@ function refreshVcMeetingProfileOwnerBoot(session) {
                 joinedAtIngestSeq: member.joinedAtIngestSeq,
                 receiverSessionId: member.receiverSessionId,
                 outputChatId: member.outputChatId,
+                outputPlacement: member.outputPlacement ?? 'auto',
             });
             if (!applied.ok)
                 throw new Error(`receiver ${member.memberId}: ${applied.reason}`);
@@ -8335,6 +8553,7 @@ function refreshVcMeetingProfileOwnerBoot(session) {
                 membershipGeneration: member.membershipGeneration,
                 status: member.status,
                 responseMode: member.responseMode,
+                outputPlacement: member.outputPlacement ?? 'auto',
                 ...policy,
                 joinedAtIngestSeq: member.joinedAtIngestSeq,
                 receiverSessionId: member.receiverSessionId,
@@ -9515,7 +9734,7 @@ async function removeVcMeetingProfileMember(session, selected) {
             ownedSinks: prior.ownedSinks,
             sinkOwnerGeneration: prior.sinkOwnerGeneration,
         },
-        outputRoute: { chatId: prior.outputChatId },
+        outputRoute: { chatId: prior.outputChatId, placement: prior.outputPlacement ?? 'auto' },
     };
     const receiver = await postVcMeetingMemberProjection(prior.agentAppId, projection);
     const body = vcMeetingResponseRecord(receiver.body);
@@ -9536,6 +9755,7 @@ async function removeVcMeetingProfileMember(session, selected) {
         membershipGeneration,
         status: 'removed',
         responseMode: prior.responseMode,
+        outputPlacement: prior.outputPlacement ?? 'auto',
         ...(prior.filter ? { filter: prior.filter } : {}),
         capabilities: prior.capabilities,
         ownedSinks: prior.ownedSinks,
@@ -9742,7 +9962,9 @@ async function applyVcMeetingConsumerProfileSelection(key, session, cfg, selecte
         const existingByProfileId = new Map(session.selectedAgents.map(selected => [selected.profileId, selected]));
         const requestedProfiles = resolution.selectedProfiles.map((profile) => {
             const existing = existingByProfileId.get(profile.id);
-            return existing ? vcMeetingProfileFromRuntimeAgent(existing) : profile;
+            return existing
+                ? vcMeetingProfileFromRuntimeAgent(existing)
+                : vcMeetingProfileWithActivationContext(profile, opts.activationContext);
         });
         const retainedAfterRemovalFailure = [];
         const removalErrors = [];
@@ -9835,6 +10057,7 @@ async function applyVcMeetingConsumerProfileSelection(key, session, cfg, selecte
         session.consumerSelectionApplying = false;
         session.consumerPendingProfileIds = undefined;
         session.consumerPendingIntervalMs = undefined;
+        session.consumerPendingActivationContext = undefined;
     }
 }
 async function activateVcMeetingPreparationBinding(session, cfg, preparation) {
@@ -9982,9 +10205,10 @@ async function applyVcMeetingConsumerProfileStagedState(key, session, cfg, fallb
     const selectedProfileIds = session.consumerPendingProfileIds
         ?? (fallbackProfileIds ? [...fallbackProfileIds] : undefined);
     const stagedIntervalMs = session.consumerPendingIntervalMs;
+    const activationContext = session.consumerPendingActivationContext;
     if (stagedIntervalMs)
         session.syncIntervalMs = stagedIntervalMs;
-    let result = await applyVcMeetingConsumerProfileSelection(key, session, cfg, selectedProfileIds, opts);
+    let result = await applyVcMeetingConsumerProfileSelection(key, session, cfg, selectedProfileIds, { ...opts, ...(activationContext ? { activationContext } : {}) });
     if (!result.ok && selectedProfileIds === undefined && session.consumerMode === 'pending') {
         // A conflicting/invalid hand-edited default must never leave a pending
         // timer retrying or partially activate a subset. Fail closed to
@@ -11565,6 +11789,11 @@ async function handleVcMeetingCardAction(data, larkAppId) {
                     session.consumerSelectionApplying = false;
                 }
             }
+            const activationContext = vcMeetingActivationContextFromCard(data);
+            if (!activationContext.ok) {
+                return { toast: { type: 'error', content: activationContext.error } };
+            }
+            session.consumerPendingActivationContext = activationContext.context;
             return applyVcMeetingConsumerSelectionInBackground(key, session, cfg, () => applyVcMeetingConsumerProfileStagedState(key, session, cfg, undefined, { claimed: true }), { cardMessageId: data.context?.open_message_id ?? data.open_message_id });
         }
         const selection = session.consumerPendingChoice ?? { mode: 'default' };
@@ -12193,7 +12422,7 @@ async function startInitialPassthroughSession(args) {
     const botCfg = getBot(larkAppId).config;
     refreshCliVersion(botCfg.cliId, botCfg.cliPathOverride);
     const directChatSender = chatType === 'p2p'
-        ? await resolveSender(larkAppId, senderOpenId, parsed.senderType)
+        ? await resolveSender(larkAppId, senderOpenId, parsed.senderType, { messageId })
         : undefined;
     // Group cold-start passthroughs only need a stable caller identity while the
     // repo picker is pending. Avoid adding a contact lookup to every /goal start;
@@ -12512,7 +12741,9 @@ async function handleNewTopic(data, ctx) {
             // chat-granted users (who only pass canTalk) management commands like
             // /cd /restart /oncall bind. Previously this gate only fired in oncall chats,
             // which left a hole once per-chat grants flow through canTalk.
-            if (!canOperate(larkAppId, chatId, senderOpenId, teamTrustUnionId)) {
+            // canRunDaemonCommand = canOperate ∪（cmd ∈ canTalkDaemonCommands && canTalk）：
+            // bot 可通过名单把选定命令（如 /status）降到 canTalk；未配置时与 canOperate 全等。
+            if (!canRunDaemonCommand(larkAppId, chatId, senderOpenId, teamTrustUnionId, cmd, senderUnionId, chatType)) {
                 await sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
                 return;
             }
@@ -12546,7 +12777,7 @@ async function handleNewTopic(data, ctx) {
             const session = sessionStore.createSession(chatId, cmdRootIdForStore, cmdContent.substring(0, 50), chatType);
             const now = Date.now();
             if (chatType === 'p2p') {
-                setDirectChatDisplayNameFromSender(session, chatType, await resolveSender(larkAppId, senderOpenId, parsed.senderType));
+                setDirectChatDisplayNameFromSender(session, chatType, await resolveSender(larkAppId, senderOpenId, parsed.senderType, { messageId }));
             }
             session.larkAppId = larkAppId;
             session.ownerOpenId = senderOpenId;
@@ -12621,7 +12852,7 @@ async function handleNewTopic(data, ctx) {
     // resolveSender for an unseen open_id may await contact.v3.user.get with a
     // short budget; subsequent calls hit the cache and are sync-fast.
     const groupChatNamePromise = resolveGroupChatNameForNativeTitle(larkAppId, chatId, chatType, botCfg.cliId, parsed.content, parsed.mentions);
-    const newTopicSender = await resolveSender(larkAppId, senderOpenId, parsed.senderType);
+    const newTopicSender = await resolveSender(larkAppId, senderOpenId, parsed.senderType, { messageId });
     refreshCliVersion(botCfg.cliId, botCfg.cliPathOverride);
     // Pin the working dir via the layered oncall / inherit / default lookup
     // (auto-binds a defaultOncall chat as a side effect). Shared with the
@@ -13083,7 +13314,9 @@ async function handleThreadReply(data, ctx) {
         if (threadSenderResolved)
             return threadSenderCached;
         threadSenderResolved = true;
-        threadSenderCached = await resolveSender(larkAppId, senderOpenIdForPrefix, parsed.senderType, isForeignBot ? { type: 'bot', name: foreignBotName !== 'Bot' ? foreignBotName : undefined } : undefined);
+        threadSenderCached = await resolveSender(larkAppId, senderOpenIdForPrefix, parsed.senderType, isForeignBot
+            ? { type: 'bot', name: foreignBotName !== 'Bot' ? foreignBotName : undefined, messageId: parsed.messageId }
+            : { messageId: parsed.messageId });
         return threadSenderCached;
     };
     const content = parsed.content.trim();
@@ -13285,7 +13518,9 @@ async function handleThreadReply(data, ctx) {
             }
             // canOperate gate for thread-reply daemon commands — required in every chat
             // (see spawn-path gate above). Denies chat-granted users management commands.
-            if (!canOperate(larkAppId, effectiveThreadChatId, threadSenderOpenId, threadTeamTrustUnionId)) {
+            // canRunDaemonCommand：canTalkDaemonCommands 名单内的命令降到 canTalk，
+            // 与 new-topic 路径的统一闸同款（未配置时与 canOperate 全等）。
+            if (!canRunDaemonCommand(larkAppId, effectiveThreadChatId, threadSenderOpenId, threadTeamTrustUnionId, cmd, threadSenderUnionId, ctxChatType)) {
                 sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
                 return;
             }
@@ -14198,6 +14433,111 @@ function resolvePrimaryOwnerOpenId(larkAppId) {
         return undefined;
     }
 }
+/** Parse a positive float env override, falling back to `dflt` when unset/invalid. */
+function envFloat(name, dflt) {
+    const raw = process.env[name];
+    if (raw === undefined || raw.trim() === '')
+        return dflt;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : dflt;
+}
+/**
+ * Host-overload thresholds, seeded from module defaults and overridable via env
+ * so an operator can tune sensitivity without a code change:
+ *   BOTMUX_OVERLOAD_ENTER_LOAD_RATIO / _EXIT_LOAD_RATIO   (× logical CPU count)
+ *   BOTMUX_OVERLOAD_ENTER_MEM_FRAC   / _EXIT_MEM_FRAC      (0..1)
+ *   BOTMUX_OVERLOAD_MIN_REALERT_MS
+ * Setting BOTMUX_OVERLOAD_ALERT=0 disables the watcher entirely (checked at the
+ * call site). Swap is not read on this platform, so its thresholds stay default
+ * but are inert (reading passes swap=undefined).
+ */
+function resolveOverloadThresholds() {
+    const cpuCount = Math.max(1, cpus().length || 1);
+    const enterLoadRatio = envFloat('BOTMUX_OVERLOAD_ENTER_LOAD_RATIO', DEFAULT_OVERLOAD_THRESHOLDS.enterLoadRatio);
+    let exitLoadRatio = envFloat('BOTMUX_OVERLOAD_EXIT_LOAD_RATIO', DEFAULT_OVERLOAD_THRESHOLDS.exitLoadRatio);
+    const enterMemUsedFrac = envFloat('BOTMUX_OVERLOAD_ENTER_MEM_FRAC', DEFAULT_OVERLOAD_THRESHOLDS.enterMemUsedFrac);
+    let exitMemUsedFrac = envFloat('BOTMUX_OVERLOAD_EXIT_MEM_FRAC', DEFAULT_OVERLOAD_THRESHOLDS.exitMemUsedFrac);
+    // Hysteresis only works when the recover line sits STRICTLY below the enter
+    // line. Clamping a misconfigured exit down to *equal* enter is not enough: at
+    // enter == exit the enter test (mem `>=`) and the recover test (mem `<=`) both
+    // fire at the exact threshold, so a reading pinned there flaps entered/
+    // recovered every tick. Force a small gap below enter (5%) and warn.
+    const HYSTERESIS_MARGIN = 0.95; // exit = 95% of enter when misconfigured
+    if (exitLoadRatio >= enterLoadRatio) {
+        const clamped = enterLoadRatio * HYSTERESIS_MARGIN;
+        logger.warn(`[overload] BOTMUX_OVERLOAD_EXIT_LOAD_RATIO (${exitLoadRatio}) >= ENTER (${enterLoadRatio}); clamping exit to ${clamped}`);
+        exitLoadRatio = clamped;
+    }
+    if (exitMemUsedFrac >= enterMemUsedFrac) {
+        const clamped = enterMemUsedFrac * HYSTERESIS_MARGIN;
+        logger.warn(`[overload] BOTMUX_OVERLOAD_EXIT_MEM_FRAC (${exitMemUsedFrac}) >= ENTER (${enterMemUsedFrac}); clamping exit to ${clamped}`);
+        exitMemUsedFrac = clamped;
+    }
+    return {
+        cpuCount,
+        enterLoadRatio,
+        exitLoadRatio,
+        enterMemUsedFrac,
+        exitMemUsedFrac,
+        enterSwapUsedFrac: DEFAULT_OVERLOAD_THRESHOLDS.enterSwapUsedFrac,
+        exitSwapUsedFrac: DEFAULT_OVERLOAD_THRESHOLDS.exitSwapUsedFrac,
+        minReAlertMs: envFloat('BOTMUX_OVERLOAD_MIN_REALERT_MS', DEFAULT_OVERLOAD_THRESHOLDS.minReAlertMs),
+    };
+}
+/**
+ * Machine-wide de-dup for the host-overload alert. load/mem are host-wide, so if
+ * more than one bot has the `overloadAlert` toggle on, every such daemon would
+ * independently detect the same edge and DM its owner. This claims a short-lived
+ * episode marker in the shared botmux data dir so only the first daemon to see a
+ * given edge actually sends; siblings within the dedup window back off.
+ *
+ * The key is just the edge kind (`entered` / `recovered`): within DEDUP_WINDOW_MS
+ * the first daemon to see an edge claims it and siblings back off. (An earlier
+ * version bucketed `entered` by `Math.round(load15)`, but sibling daemons
+ * sampling load15 either side of an X.5 boundary rounded to different bands,
+ * got different keys, and each DMed — so the band is dropped.)
+ *
+ * The claim is a real mutual exclusion: the ENTIRE read-check-write runs inside
+ * one `withFileLockSync` critical section on the marker. An earlier version used
+ * `openSync(marker, 'wx')`, but that only serializes the FIRST claim — once the
+ * marker exists (it persists after the first alert), every later edge
+ * (recovered / expired) fell back to an unlocked read→replace, so two daemons
+ * both detecting the same `recovered` edge could both read the stale key, both
+ * replace it, and each DM. Serializing the whole section closes that hole. Best-
+ * effort: if the lock itself can't be taken (FS error), allow the DM (better a
+ * rare duplicate than a silent miss).
+ */
+function claimOverloadEpisode(kind) {
+    const DEDUP_WINDOW_MS = 60_000; // ≥ two 30s ticks; covers sibling daemons racing the same edge.
+    const marker = join(config.session.dataDir, '.overload-episode.json');
+    const key = kind;
+    try {
+        return withFileLockSync(marker, () => {
+            const now = Date.now();
+            if (existsSync(marker)) {
+                try {
+                    const prev = JSON.parse(readFileSync(marker, 'utf8'));
+                    if (prev.key === key && typeof prev.at === 'number' && now - prev.at < DEDUP_WINDOW_MS) {
+                        return false; // Same edge already claimed within the window.
+                    }
+                }
+                catch {
+                    // Corrupt marker → fall through and take it over.
+                }
+            }
+            // Winner: claim the episode. atomicWriteFileSync is fine here — the lock,
+            // not the write, provides mutual exclusion.
+            atomicWriteFileSync(marker, JSON.stringify({ key, at: now }));
+            return true;
+        }, { maxWaitMs: 2_000 });
+    }
+    catch (err) {
+        // Couldn't acquire the lock (timeout / FS error) → don't silently drop the
+        // edge; allow this DM (a rare duplicate is better than a missed alert).
+        logger.warn(`[overload] episode claim lock failed (${kind}): ${err instanceof Error ? err.message : String(err)}; allowing DM`);
+        return true;
+    }
+}
 /** Build the current dashboard URL (active token, not a rotation) from the
  *  dashboard process's persisted `.dashboard-port` / `.dashboard-token`. Falls
  *  back to a token-less base URL if the dashboard hasn't published a token yet. */
@@ -14253,6 +14593,11 @@ export async function startDaemon(botIndex) {
     // 首次启动时后台尝试安装 CJK 字体（Debian/Ubuntu），避免截图中文显示豆腐块。
     // 不阻塞：首张截图可能仍是豆腐块，装完重启 daemon 即可正常。
     ensureCjkFontsInstalled();
+    // Auto-migrate legacy sandbox fields (readIsolation / sandboxHidePaths /
+    // sandboxReadonlyPaths / readDenyExtraPaths → sandbox + sandboxPaths) BEFORE
+    // loading, so the parsed configs below already carry the new model. Writes
+    // new fields, keeps old ones (downgrade = zero-op), backs up once. Idempotent.
+    await migrateSandboxConfigAtStartup();
     // Load the assigned bot (one daemon per bot)
     let botConfigs = loadBotConfigs();
     const idx = botIndex ?? 0;
@@ -14393,8 +14738,12 @@ export async function startDaemon(botIndex) {
         }
     }, VC_MEETING_DELIVERY_LEASE_SCAN_MS);
     vcMeetingDeliveryLeaseTimer.unref?.();
-    // Watch schedules.json for external writes (e.g. `botmux schedule add`
+    // Bind the schedule store to this daemon's bot (per-bot stores live in each
+    // BOT_HOME), split a legacy shared data/schedules.json if one still exists,
+    // then watch our own store for external writes (e.g. `botmux schedule add`
     // running in a separate node process) so dashboard event bus stays in sync.
+    scheduleStore.setScheduleScope(cfg.larkAppId);
+    migrateSharedSchedulesAtStartup(botConfigs.map(b => b.larkAppId), botConfigs[0]?.larkAppId ?? cfg.larkAppId);
     scheduleStore.startExternalWriteWatcher();
     logger.info(`Bot ${idx}/${botConfigs.length}: ${cfg.larkAppId} (cli: ${cfg.cliId})`);
     setAskCardDispatcher(createLarkAskCardDispatcher());
@@ -14428,6 +14777,16 @@ export async function startDaemon(botIndex) {
         // briefly sees an unusable on_/email (the resolution below rewrites this field).
         resolvedAllowedUsers: getBot(cfg.larkAppId).resolvedAllowedUsers.filter(u => u.startsWith('ou_')),
     };
+    // Expose the live descriptor module-level so the deferred allowedUsers resolve
+    // retry can republish healed open_ids coherently (see republishResolvedAllowedUsers).
+    selfDaemonDescriptor = desc;
+    // Let runtime allowedUsers mutations (set / revoke, in the services layer)
+    // republish the descriptor through the same path without importing daemon
+    // internals. Registered once per daemon; one daemon per bot.
+    setResolvedAllowedUsersRepublishHook(republishResolvedAllowedUsers);
+    // And let a mutation that hit a transient contact failure schedule the same
+    // background resolve-retry the startup path uses (heal-when-API-recovers).
+    setAllowedUsersResolveRetryHook((appId) => scheduleAllowedUsersResolveRetry(appId));
     // 名称状态刷新：displayName 或飞书真名变化后，用有效展示名刷新 descriptor +
     // SessionRow.botName，无需重启 daemon。displayName 路径经 bot-config-store 的
     // 钩子触发；真·改名路径在下面的 renamer 里直接调用。
@@ -14677,22 +15036,68 @@ export async function startDaemon(botIndex) {
         // Refresh CLI version per bot's cliId
         refreshCliVersion(cfg.cliId, cfg.cliPathOverride);
         // Resolve allowed users per bot
-        if (bot.resolvedAllowedUsers.length > 0) {
+        if ((bot.config.allowedUsers?.length ?? 0) > 0 || bot.resolvedAllowedUsers.length > 0) {
             // 含邮箱或 union_id(on_) 都要重解析成本 app 的 open_id —— 否则 canTalk/canOperate
             // 拿 sender 的 ou_ 对不上 on_，owner 会被自己的 bot 锁死（PR#72）。
             // literal ou_ 也走 best-effort 校验，用于诊断把其他 app 视角 open_id
             // 误填到本 bot 的配置。
-            const needsResolve = bot.resolvedAllowedUsers.some(u => u.includes('@') || u.startsWith('on_') || u.startsWith('ou_'));
+            //
+            // Transient contact failures must NOT blank the runtime list: an empty
+            // resolved allowlist under a configured allowedUsers is fail-closed and
+            // silently drops even the real owner (@ with no group reply). Reuse the
+            // last-known-good `raw → ou_` cache PER ENTRY (only for still-configured,
+            // transient-failed entries), log loudly, DM owners (fire-and-forget), and
+            // schedule retries. The cache is a persistent sidecar — NOT the dashboard
+            // descriptor, which is overwritten early in boot and deleted on shutdown.
+            const configured = bot.config.allowedUsers ?? bot.resolvedAllowedUsers;
+            const needsResolve = configured.some(u => u.includes('@') || u.startsWith('on_') || u.startsWith('ou_'));
             if (needsResolve) {
+                const previousResolvedMap = readAllowedUsersCache(cfg.larkAppId);
                 try {
-                    // 同时拿到 raw→open_id 映射，供 /revoke 反查删除 email 形式的 raw 条目（R2#2）。
-                    const { resolved, map } = await resolveAllowedUsersWithMap(cfg.larkAppId, bot.resolvedAllowedUsers);
-                    bot.resolvedAllowedUsers = resolved;
-                    bot.rawAllowedUserResolution = map;
-                    logger.info(`[${cfg.larkAppId}] Resolved allowedUsers: ${bot.resolvedAllowedUsers.join(', ')}`);
+                    // 同时拿到 raw→open_id 映射,供 /revoke 反查删除 email 形式的 raw 条目(R2#2)。
+                    const resolveResult = await resolveAllowedUsersWithMap(cfg.larkAppId, configured);
+                    const applied = applyAllowedUsersResolve({
+                        rawEntries: configured,
+                        previousResolvedMap,
+                        resolveResult,
+                    });
+                    bot.resolvedAllowedUsers = applied.resolved;
+                    bot.rawAllowedUserResolution = applied.map;
+                    // Persist the fresh/recovered map so the next boot (and a clean
+                    // restart, which deletes the descriptor) can fall back per-entry.
+                    // Prune definitively-gone entries + keys no longer configured.
+                    writeAllowedUsersCache(cfg.larkAppId, applied.map, {
+                        deleteEntries: definitiveEntriesOf(resolveResult.entryStatus),
+                        retainKeys: configured,
+                    });
+                    logger.info(`[${cfg.larkAppId}] Resolved allowedUsers: ${bot.resolvedAllowedUsers.join(', ') || '(empty)'}${applied.usedFallback ? ' [some from cache]' : ''}`);
+                    if (applied.failed && applied.notice) {
+                        notifyAllowedUsersResolveFailure(cfg.larkAppId, applied.notice, applied.resolved);
+                        scheduleAllowedUsersResolveRetry(cfg.larkAppId);
+                    }
                 }
                 catch (err) {
-                    logger.warn(`[${cfg.larkAppId}] Failed to resolve allowedUsers: ${err.message}`);
+                    // A full throw is a transient outage: mark every contact-resolvable
+                    // entry transient so the pure fn can recover each from cache.
+                    const throwStatus = new Map();
+                    for (const e of configured) {
+                        if (e.includes('@') || e.startsWith('on_') || e.startsWith('ou_'))
+                            throwStatus.set(e, 'transient');
+                    }
+                    const applied = applyAllowedUsersResolve({
+                        rawEntries: configured,
+                        previousResolvedMap,
+                        resolveResult: { resolved: [], map: new Map(), errored: true, entryStatus: throwStatus },
+                    });
+                    bot.resolvedAllowedUsers = applied.resolved;
+                    bot.rawAllowedUserResolution = applied.map;
+                    if (applied.usedFallback) {
+                        writeAllowedUsersCache(cfg.larkAppId, applied.map, { retainKeys: configured });
+                    }
+                    const notice = applied.notice
+                        ?? `Failed to resolve allowedUsers: ${err?.message ?? err}`;
+                    notifyAllowedUsersResolveFailure(cfg.larkAppId, `${notice} (throw: ${err?.message ?? err})`, applied.resolved);
+                    scheduleAllowedUsersResolveRetry(cfg.larkAppId);
                 }
             }
             // Republish the descriptor with the post-resolution open_ids so the
@@ -14892,10 +15297,10 @@ export async function startDaemon(botIndex) {
     }, 5_000);
     docCommentPollTimer.unref?.();
     void pollWatchedDocComments(cfg.larkAppId);
-    // Sweep orphan sandbox overlays left by a previous run's crash/kill: any
+    // Sweep orphan sandbox trees left by a previous run's crash/kill: any
     // <dataDir>/sandboxes/<sid> whose session is no longer active gets its
-    // overlays unmounted and its dirs removed (plus the /var/tmp home scratch).
-    // Active sessions keep theirs — a same-topic worker reuses the upper changeset.
+    // deny-mask mountpoints reclaimed and its dirs removed.
+    // Active sessions keep theirs — a same-topic worker reuses the tree.
     try {
         sweepOrphanSandboxes(config.session.dataDir, new Set([...activeSessions.values()].map(ds => ds.session.sessionId)));
     }
@@ -14909,12 +15314,12 @@ export async function startDaemon(botIndex) {
     }, 60_000);
     idleWorkerSweepTimer.unref?.();
     // Periodic sandbox reconciler: the daemon's SIGKILL straggler-reaper (and any
-    // worker SIGKILL) bypasses worker-side killCli(), so the overlay mounts +
-    // upper/work dirs of a killed-but-still-active sandboxed session would leak for
-    // the rest of this daemon's lifetime (one daemon per bot can run for days). The
-    // startup sweep alone can't catch a session that dies AFTER boot. This re-runs
-    // the sweep on a timer: it reclaims active sessions whose overlays are already
-    // unmounted (= worker/CLI dead) without ever tearing down a live mount.
+    // worker SIGKILL) bypasses worker-side killCli(), so the pre-created deny-mask
+    // mountpoints + per-session tree of a killed-but-still-active sandboxed session
+    // would leak for the rest of this daemon's lifetime (one daemon per bot can run
+    // for days). The startup sweep alone can't catch a session that dies AFTER boot.
+    // This re-runs the sweep on a timer: it reclaims sessions whose worker/CLI is
+    // dead without ever tearing down a live one.
     const sandboxReconcileTimer = setInterval(() => {
         try {
             sweepOrphanSandboxes(config.session.dataDir, new Set([...activeSessions.values()].map(ds => ds.session.sessionId)));
@@ -14984,6 +15389,92 @@ export async function startDaemon(botIndex) {
             });
         }, 5_000).unref?.();
     }
+    // Host-overload watcher. Enabled per-bot via the `overloadAlert` config toggle
+    // (dashboard → Groups & Bots → bot card), NOT hardcoded to the primary daemon:
+    // any one bot can be designated the machine's alerter. load/mem are host-wide,
+    // so if more than one bot has it on, a cross-process file lock keyed on the
+    // overload episode ensures the machine only DMs once per edge (whichever bot's
+    // daemon wins the lock speaks). Reads os.loadavg()[2] + mem every 30s; on a
+    // healthy→overloaded or overloaded→healthy edge it DMs that bot's owner.
+    // Hysteresis + a min re-alert window (see host-overload-alert.ts) keep a load
+    // hovering near the line from spamming. Set BOTMUX_OVERLOAD_ALERT=0 to force
+    // the whole feature off regardless of per-bot config.
+    if (process.env.BOTMUX_OVERLOAD_ALERT !== '0') {
+        const overloadThresholds = resolveOverloadThresholds();
+        let overloadState = INITIAL_OVERLOAD_STATE;
+        const overloadTimer = setInterval(() => {
+            void (async () => {
+                try {
+                    // Per-bot热开关：关了就不采样，但 timer 常驻，用户在 web 打开后下个 tick 即生效。
+                    let enabled = false;
+                    try {
+                        enabled = getBot(cfg.larkAppId).config.overloadAlert === true;
+                    }
+                    catch {
+                        enabled = false;
+                    }
+                    if (!enabled) {
+                        overloadState = INITIAL_OVERLOAD_STATE;
+                        return;
+                    }
+                    const reading = {
+                        load15: loadavg()[2] ?? 0,
+                        memTotalBytes: totalmem(),
+                        memFreeBytes: freemem(),
+                    };
+                    const { nextState, action } = evaluateOverload(overloadState, reading, overloadThresholds, Date.now());
+                    overloadState = nextState;
+                    if (!action)
+                        return;
+                    // Machine-wide de-dup: multiple bots may have the toggle on, but the
+                    // host is one machine. Claim a short-lived episode lock so only one bot
+                    // DMs per edge. Losing the claim = another bot already alerted this edge.
+                    if (!claimOverloadEpisode(action.kind)) {
+                        logger.info(`[overload] ${action.kind} edge already claimed by a sibling bot; skipping DM (${cfg.larkAppId})`);
+                        return;
+                    }
+                    const ownerOpenId = resolvePrimaryOwnerOpenId(cfg.larkAppId);
+                    logger.info(`[overload] ${action.kind}: load15=${action.metrics.load15.toFixed(2)} `
+                        + `perCpu=${action.metrics.loadPerCpu.toFixed(2)} mem=${(action.metrics.memUsedFrac * 100).toFixed(0)}% `
+                        + `reasons=[${action.reasons.join(',')}] owner=${ownerOpenId ? 'yes' : 'none'} bot=${cfg.larkAppId}`);
+                    if (!ownerOpenId)
+                        return; // No resolvable owner to DM; the log above still records the edge.
+                    // Interactive card. `entered`: register a one-shot nonce, count the
+                    // machine-wide zombie/idle candidates so the buttons can show「(N)」
+                    // before a click, and send the stateful two-button card (clicking one
+                    // never removes the other — the handler rebuilds this same card).
+                    // `recovered`: display-only card. On any send failure, fall back to the
+                    // plain-text alert so the owner still hears about it.
+                    let cardJson;
+                    if (action.kind === 'entered') {
+                        const nonce = randomUUID();
+                        registerOverloadNonce(nonce);
+                        let counts = { stopped: 0, idle: 0 };
+                        try {
+                            counts = await countHostOverload();
+                        }
+                        catch (err) {
+                            logger.warn(`[overload] count failed, showing 0: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                        cardJson = buildOverloadAlertCard(initialOverloadCardState(action, counts, nonce));
+                    }
+                    else {
+                        cardJson = buildOverloadRecoveredCard(action);
+                    }
+                    void sendUserMessage(cfg.larkAppId, ownerOpenId, cardJson, 'interactive')
+                        .catch((err) => {
+                        logger.warn(`[overload] card DM failed, falling back to text: ${err instanceof Error ? err.message : String(err)}`);
+                        return sendUserMessage(cfg.larkAppId, ownerOpenId, formatOverloadAlert(action));
+                    })
+                        .catch((err) => logger.warn(`[overload] text fallback DM also failed: ${err instanceof Error ? err.message : String(err)}`));
+                }
+                catch (err) {
+                    logger.warn(`[overload] sample failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            })();
+        }, 30_000);
+        overloadTimer.unref?.();
+    }
     // Graceful shutdown. Sends SIGTERM (or `{type:'close'}` IPC via killWorker)
     // to every worker, then waits up to SHUTDOWN_GRACE_MS for them to exit
     // before sending SIGKILL to stragglers. Without the wait, daemon