botmux 3.5.0 → 3.6.0

package/dist/dashboard/web/bot-defaults-page.js

@@ -273,7 +273,7 @@ function BotDefaultsCard(props) {
         return (_jsxs("article", { className: "bd-card bd-profile", "data-appid": bot.larkAppId, children: [_jsxs("header", { className: "bd-profile-head", children: [_jsx(Html, { html: botAvatarHtml({ name, larkAppId: bot.larkAppId }) }), _jsxs("div", { className: "bd-profile-id", children: [_jsx("strong", { children: name }), _jsx("code", { children: bot.larkAppId })] })] }), _jsxs("p", { className: "hint-warn-inline", children: ["\u67E5\u8BE2\u5931\u8D25\uFF1A", bot.error] })] }));
     }
     const def = bot.defaultOncall ?? { enabled: false, workingDir: '', since: 0 };
-    return (_jsxs("article", { className: "bd-card bd-profile", "data-appid": bot.larkAppId, children: [_jsxs("header", { className: "bd-profile-head", children: [_jsx(BotAvatarControl, { bot: bot, name: name, patchBot: patchBot }), _jsx("div", { className: "bd-profile-main", children: _jsx(BotProfileIdentity, { bot: bot, cli: cli, patchBot: patchBot, meta: (_jsxs(_Fragment, { children: [_jsxs("small", { className: "bd-meta-ok", children: ["\u25CF ", tr('botDefaults.metaOnline')] }), _jsxs("small", { "data-oncall-since": true, children: [tr('botDefaults.lastEnabled'), ": ", fmtSince(def.since ?? 0)] }), _jsx("small", { children: tr('botDefaults.autobound', { count: bot.autoboundChatCount ?? 0 }) })] })) }) })] }), _jsxs("div", { className: "bd-body bd-grid", children: [_jsxs("div", { className: "bd-column", children: [_jsxs("section", { className: "bd-tile", children: [_jsx(BotAgentSection, { bot: bot, sessionFallback: cli, cliState: cliState, patchBot: patchBot }), _jsx(WorkingDirSection, { bot: bot, patchBot: patchBot, putCardPref: putCardPref }), bot.cliId !== 'riff' && _jsx(SandboxSection, { bot: bot, patchBot: patchBot }), bot.cliId !== 'riff' && _jsx(BackendTypeSection, { bot: bot, patchBot: patchBot })] }), _jsx("section", { className: "bd-tile", children: _jsx(RuntimeEnvironmentSection, { bot: bot, patchBot: patchBot }) }), _jsx("section", { className: "bd-tile", children: _jsx(GrantSection, { bot: bot, patchBot: patchBot }) })] }), _jsxs("div", { className: "bd-column", children: [_jsxs("section", { className: "bd-tile", children: [_jsx(SessionModeSection, { bot: bot, patchBot: patchBot, putCardPref: putCardPref }), _jsx(SubstituteModeSection, { bot: bot, patchBot: patchBot }), _jsx(CrossBotSection, { bot: bot, putCardPref: putCardPref }), _jsx(SessionCapSection, { bot: bot, patchBot: patchBot })] }), _jsxs("section", { className: "bd-tile", children: [_jsx(CardBehaviorSection, { bot: bot, putCardPref: putCardPref }), _jsx(CodexAppDisplaySection, { bot: bot, putCardPref: putCardPref }), _jsx(SummaryTriggerSection, { bot: bot, patchBot: patchBot }), _jsx(BrandSection, { bot: bot, patchBot: patchBot })] }), _jsx("section", { className: "bd-tile", children: _jsx(RoleSection, { bot: bot, patchBot: patchBot }) })] })] })] }));
+    return (_jsxs("article", { className: "bd-card bd-profile", "data-appid": bot.larkAppId, children: [_jsxs("header", { className: "bd-profile-head", children: [_jsx(BotAvatarControl, { bot: bot, name: name, patchBot: patchBot }), _jsx("div", { className: "bd-profile-main", children: _jsx(BotProfileIdentity, { bot: bot, cli: cli, patchBot: patchBot, meta: (_jsxs(_Fragment, { children: [_jsxs("small", { className: "bd-meta-ok", children: ["\u25CF ", tr('botDefaults.metaOnline')] }), _jsxs("small", { "data-oncall-since": true, children: [tr('botDefaults.lastEnabled'), ": ", fmtSince(def.since ?? 0)] }), _jsx("small", { children: tr('botDefaults.autobound', { count: bot.autoboundChatCount ?? 0 }) })] })) }) })] }), _jsxs("div", { className: "bd-body bd-grid", children: [_jsxs("div", { className: "bd-column", children: [_jsxs("section", { className: "bd-tile", children: [_jsx(BotAgentSection, { bot: bot, sessionFallback: cli, cliState: cliState, patchBot: patchBot }), _jsx(WorkingDirSection, { bot: bot, patchBot: patchBot, putCardPref: putCardPref }), bot.cliId !== 'riff' && _jsx(SandboxSection, { bot: bot, patchBot: patchBot }), bot.cliId !== 'riff' && bot.sandbox === true && _jsx(SandboxPathsSection, { bot: bot, patchBot: patchBot }), bot.cliId !== 'riff' && _jsx(BackendTypeSection, { bot: bot, patchBot: patchBot })] }), _jsx("section", { className: "bd-tile", children: _jsx(RuntimeEnvironmentSection, { bot: bot, patchBot: patchBot }) }), _jsx("section", { className: "bd-tile", children: _jsx(GrantSection, { bot: bot, patchBot: patchBot }) }), _jsx("section", { className: "bd-tile", children: _jsx(SlashCommandPermissionsSection, { bot: bot, patchBot: patchBot }) })] }), _jsxs("div", { className: "bd-column", children: [_jsxs("section", { className: "bd-tile", children: [_jsx(SessionModeSection, { bot: bot, patchBot: patchBot, putCardPref: putCardPref }), _jsx(SubstituteModeSection, { bot: bot, patchBot: patchBot }), _jsx(CrossBotSection, { bot: bot, putCardPref: putCardPref }), _jsx(SessionCapSection, { bot: bot, patchBot: patchBot, putCardPref: putCardPref })] }), _jsxs("section", { className: "bd-tile", children: [_jsx(CardBehaviorSection, { bot: bot, putCardPref: putCardPref }), _jsx(CodexAppDisplaySection, { bot: bot, putCardPref: putCardPref }), _jsx(SummaryTriggerSection, { bot: bot, patchBot: patchBot }), _jsx(BrandSection, { bot: bot, patchBot: patchBot })] }), _jsx("section", { className: "bd-tile", children: _jsx(RoleSection, { bot: bot, patchBot: patchBot }) })] })] })] }));
 }
 function RuntimeEnvironmentSection(props) {
     const tr = useT();
@@ -833,14 +833,204 @@ function SandboxSection(props) {
             setBusy(false);
         }
     }
-    // Read isolation rides the SAME toggle: it applies additionally wherever the
-    // CLI + platform can enforce it (claude/codex on macOS/Linux, no wrapper). Show a
-    // capability line so the owner sees whether THIS bot's sandbox also read-isolates
-    // (the "labelled separately" requirement) — best-effort: write protection always
-    // applies; read isolation only where supported.
+    // The unified fs-policy always provides deny-by-default file read/write
+    // isolation. This capability line is narrower: whether the CLI's global data
+    // root can additionally be redirected into this bot's private BOT_HOME
+    // (claude/codex, no wrapper), keeping CLI credentials/config/history separate
+    // from sibling bots. Keep that distinction explicit in the UI copy.
     const readIsoSupported = bot.readIsolationSupported === true;
     return (_jsxs("section", { className: "bd-section", children: [_jsx("h3", { className: "bd-section-title", children: tr('botDefaults.sectionSandbox') }), _jsx(ToggleRow, { checked: enabled, disabled: busy, dataAction: "toggle-sandbox", title: tr('botDefaults.sandboxToggle'), help: tr('botDefaults.sandboxHelp'), onChange: checked => void toggle(checked) }), _jsx("p", { className: "bd-section-note", "data-read-iso-capability": readIsoSupported ? 'yes' : 'no', children: readIsoSupported ? `＋ ${tr('botDefaults.sandboxReadIsoOn')}` : tr('botDefaults.sandboxReadIsoOff') }), _jsx("div", { className: "actions", children: _jsx(StatusSpan, { status: status, attr: { 'data-sandbox-status': '' } }) })] }));
 }
+/** Restrictiveness ranking — mirrors fs-policy.ts RESTRICTIVENESS so a same-path
+ *  cross-tier conflict resolves the SAME way the sandbox will (deny > ro > rw). */
+const SBX_RESTRICTIVENESS = { readWrite: 0, readOnly: 1, deny: 2 };
+/** Effective access for `path` under the three tiers: DEEPEST (longest-prefix)
+ *  matching rule wins; at equal depth (same path across tiers) the MORE
+ *  RESTRICTIVE tier wins — mirrors fs-policy.ts accessForPath + mergeFsRules so
+ *  the UI's live labels + path tester agree with what the sandbox enforces.
+ *  `home` expands a leading `~` the same way the worker does before matching, so
+ *  `~`-relative entries line up with absolute tree nodes. */
+export function effectiveAccess(tiers, path, home) {
+    const expand = (p) => (p === '~' || p.startsWith('~/')) ? home.replace(/\/+$/, '') + p.slice(1) : p;
+    const norm = (p) => expand(p).replace(/\/+$/, '') || '/';
+    const target = norm(path);
+    const covers = (parent, child) => {
+        const a = norm(parent), b = norm(child);
+        return a === b || b.startsWith(a === '/' ? '/' : a + '/');
+    };
+    const depth = (p) => norm(p) === '/' ? 0 : norm(p).split('/').filter(Boolean).length;
+    let best;
+    const consider = (access, rule) => {
+        if (!covers(rule, target))
+            return;
+        const d = depth(rule);
+        if (!best || d > best.ruleDepth
+            || (d === best.ruleDepth && SBX_RESTRICTIVENESS[access] > SBX_RESTRICTIVENESS[best.access])) {
+            best = { access, ruleDepth: d, rule };
+        }
+    };
+    for (const p of tiers.readWrite)
+        consider('readWrite', p);
+    for (const p of tiers.readOnly)
+        consider('readOnly', p);
+    for (const p of tiers.deny)
+        consider('deny', p);
+    return best ? { access: best.access, rule: best.rule } : { access: 'none' };
+}
+function emptyTiers() { return { readWrite: [], readOnly: [], deny: [] }; }
+function normTiers(t) {
+    if (!t)
+        return emptyTiers();
+    return { readWrite: [...(t.readWrite ?? [])], readOnly: [...(t.readOnly ?? [])], deny: [...(t.deny ?? [])] };
+}
+function tiersEqual(a, b) {
+    const k = (x) => [...x].sort().join('\n');
+    return k(a.readWrite) === k(b.readWrite) && k(a.readOnly) === k(b.readOnly) && k(a.deny) === k(b.deny);
+}
+/** Serialize tiers to the copy-paste text form (one path per line, tier-tagged). */
+function tiersToText(t) {
+    const lines = [];
+    for (const p of t.readWrite)
+        lines.push(`rw  ${p}`);
+    for (const p of t.readOnly)
+        lines.push(`ro  ${p}`);
+    for (const p of t.deny)
+        lines.push(`deny ${p}`);
+    return lines.join('\n');
+}
+/** Parse the copy-paste text form back into tiers. Tolerates `rw`/`readWrite`,
+ *  `ro`/`readOnly`, `deny`/`-`; blank lines and `#` comments are ignored. */
+function textToTiers(text) {
+    const t = emptyTiers();
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const m = /^(\S+)\s+(.+)$/.exec(line);
+        if (!m)
+            continue;
+        const tag = m[1].toLowerCase();
+        const path = m[2].trim();
+        if (tag === 'rw' || tag === 'readwrite' || tag === 'rw:')
+            t.readWrite.push(path);
+        else if (tag === 'ro' || tag === 'readonly' || tag === 'ro:')
+            t.readOnly.push(path);
+        else if (tag === 'deny' || tag === '-' || tag === 'deny:')
+            t.deny.push(path);
+    }
+    return t;
+}
+function SandboxPathsSection(props) {
+    const tr = useT();
+    const { bot, patchBot } = props;
+    const [tiers, setTiers] = useState(() => normTiers(bot.sandboxPaths));
+    const [text, setText] = useState(() => tiersToText(normTiers(bot.sandboxPaths)));
+    const [textMode, setTextMode] = useState(false);
+    const [status, setStatus] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const [testPath, setTestPath] = useState('');
+    // Lazy directory tree: path → child dir list (undefined = not yet loaded).
+    const [children, setChildren] = useState({});
+    const [expanded, setExpanded] = useState(new Set());
+    const [roots, setRoots] = useState([]);
+    // Canonical $HOME (first fs-list root) — used to expand `~` in tiers/tester
+    // the SAME way the worker does, so `~`-relative entries match absolute tree
+    // nodes and effective-access labels are accurate.
+    const [homeRoot, setHomeRoot] = useState('~');
+    const saved = useMemo(() => normTiers(bot.sandboxPaths), [bot.sandboxPaths]);
+    useEffect(() => { setTiers(normTiers(bot.sandboxPaths)); setText(tiersToText(normTiers(bot.sandboxPaths))); }, [bot.sandboxPaths]);
+    const dirty = !tiersEqual(tiers, saved);
+    const loadDir = useCallback(async (path) => {
+        try {
+            const q = path ? `?path=${encodeURIComponent(path)}` : '';
+            const r = await fetch(`/api/fs/list${q}`);
+            const j = await r.json();
+            if (!j.ok)
+                return;
+            if (!path) {
+                setRoots(j.entries.map((e) => ({ name: e.name, path: e.path })));
+                // Backend returns canonical $HOME explicitly (realpath'd) so `~` expansion
+                // here matches the realpath'd child nodes + the worker's sandbox binds.
+                if (typeof j.home === 'string' && j.home.startsWith('/'))
+                    setHomeRoot(j.home);
+            }
+            else
+                setChildren(prev => ({ ...prev, [path]: j.entries.map((e) => ({ name: e.name, path: e.path })) }));
+        }
+        catch { /* listing is best-effort; manual/text entry still works */ }
+    }, []);
+    useEffect(() => { if (!textMode && roots.length === 0)
+        void loadDir(''); }, [textMode, roots.length, loadDir]);
+    // The tier a path is EXPLICITLY set to (undefined = inherits from ancestor).
+    const explicitTier = useCallback((path) => {
+        const n = path.replace(/\/+$/, '') || '/';
+        if (tiers.readWrite.some(p => (p.replace(/\/+$/, '') || '/') === n))
+            return 'readWrite';
+        if (tiers.readOnly.some(p => (p.replace(/\/+$/, '') || '/') === n))
+            return 'readOnly';
+        if (tiers.deny.some(p => (p.replace(/\/+$/, '') || '/') === n))
+            return 'deny';
+        return undefined;
+    }, [tiers]);
+    // Cycle a node: inherit → readWrite → readOnly → deny → inherit.
+    const cycleNode = useCallback((path) => {
+        setStatus(null);
+        const n = path.replace(/\/+$/, '') || '/';
+        const cur = explicitTier(path);
+        const next = cur === undefined ? 'readWrite' : cur === 'readWrite' ? 'readOnly' : cur === 'readOnly' ? 'deny' : undefined;
+        setTiers(prev => {
+            const strip = (arr) => arr.filter(p => (p.replace(/\/+$/, '') || '/') !== n);
+            const t = { readWrite: strip(prev.readWrite), readOnly: strip(prev.readOnly), deny: strip(prev.deny) };
+            if (next)
+                t[next].push(path);
+            setText(tiersToText(t));
+            return t;
+        });
+    }, [explicitTier]);
+    function syncFromText(next) {
+        setText(next);
+        setTiers(textToTiers(next));
+        setStatus(null);
+    }
+    async function save() {
+        setBusy(true);
+        setStatus(null);
+        try {
+            const res = await sendJson('PUT', `/api/bots/${encodeURIComponent(bot.larkAppId)}/sandbox-paths`, tiers);
+            if (res.ok && res.body.ok) {
+                setStatus({ text: `✓ ${tr('botDefaults.sbxPathsSaved')}`, ok: true });
+                patchBot(bot.larkAppId, { sandboxPaths: res.body.sandboxPaths ?? { readWrite: [], readOnly: [], deny: [] } });
+            }
+            else {
+                setStatus({ text: `✗ ${responseErrorText(res)}` });
+            }
+        }
+        catch (e) {
+            setStatus({ text: `✗ ${caughtErrorText(e)}` });
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    const tierBadge = (a) => a === 'readWrite' ? tr('botDefaults.sbxRw')
+        : a === 'readOnly' ? tr('botDefaults.sbxRo')
+            : a === 'deny' ? tr('botDefaults.sbxDeny')
+                : tr('botDefaults.sbxNone');
+    function TreeNode(props) {
+        const { name, path, depth } = props;
+        const isOpen = expanded.has(path);
+        const explicit = explicitTier(path);
+        const eff = effectiveAccess(tiers, path, homeRoot);
+        const kids = children[path];
+        return (_jsxs("div", { className: "bd-sbx-node", children: [_jsxs("div", { className: "bd-sbx-row", style: { paddingLeft: depth * 16 }, children: [_jsx("span", { className: "bd-sbx-twisty", onClick: () => {
+                                setExpanded(prev => { const s = new Set(prev); s.has(path) ? s.delete(path) : s.add(path); return s; });
+                                if (!kids)
+                                    void loadDir(path);
+                            }, children: isOpen ? '▾' : '▸' }), _jsx("span", { className: "bd-sbx-name", title: path, children: name }), _jsx("button", { type: "button", className: `bd-sbx-state bd-sbx-state-${explicit ?? 'inherit'}`, "data-action": "cycle-sandbox-path", "data-path": path, title: explicit ? undefined : `${tr('botDefaults.sbxInherit')}: ${tierBadge(eff.access)}`, onClick: () => cycleNode(path), children: explicit ? tierBadge(explicit) : `↳ ${tierBadge(eff.access)}` })] }), isOpen && (_jsxs("div", { className: "bd-sbx-kids", children: [kids?.map(c => _jsx(TreeNode, { name: c.name, path: c.path, depth: depth + 1 }, c.path)), kids && kids.length === 0 && (_jsx("div", { className: "bd-sbx-empty", style: { paddingLeft: (depth + 1) * 16 + 20 }, children: tr('botDefaults.sbxNoSubdirs') }))] }))] }));
+    }
+    const testResult = testPath.trim() ? effectiveAccess(tiers, testPath.trim(), homeRoot) : null;
+    return (_jsxs("section", { className: "bd-section", children: [_jsx("h3", { className: "bd-section-title", children: tr('botDefaults.sectionSandboxPaths') }), _jsx("p", { className: "bd-section-note", children: tr('botDefaults.sbxPathsHelp') }), _jsx("div", { className: "actions", style: { gap: 8, flexWrap: 'wrap' }, children: _jsx("button", { type: "button", className: "bd-btn", onClick: () => setTextMode(m => !m), children: textMode ? tr('botDefaults.sbxPathsTreeMode') : tr('botDefaults.sbxPathsTextMode') }) }), textMode ? (_jsx("textarea", { className: "bd-sbx-text", "data-field": "sandbox-paths-text", rows: 8, value: text, spellCheck: false, placeholder: 'rw  ~/my-data\nro  ~/reference-repos\ndeny ~/my-data/secrets', onChange: e => syncFromText(e.target.value) })) : (_jsx("div", { className: "bd-sbx-tree", "data-field": "sandbox-paths-tree", children: roots.map(r => _jsx(TreeNode, { name: r.name, path: r.path, depth: 0 }, r.path)) })), _jsxs("div", { className: "bd-sbx-tester", children: [_jsx("input", { className: "bd-sbx-test-input", "data-field": "sandbox-path-test", placeholder: tr('botDefaults.sbxTestPlaceholder'), value: testPath, onChange: e => setTestPath(e.target.value) }), testResult && (_jsxs("span", { className: `bd-sbx-test-out bd-sbx-state-${testResult.access}`, "data-test-access": testResult.access, children: [tierBadge(testResult.access), testResult.rule ? ` ← ${testResult.rule}` : ''] }))] }), _jsxs("div", { className: "actions", children: [_jsx("button", { type: "button", className: "bd-btn bd-btn-primary", "data-action": "save-sandbox-paths", disabled: busy || !dirty, onClick: () => void save(), children: tr('botDefaults.sbxPathsSave') }), _jsx(StatusSpan, { status: status, attr: { 'data-sandbox-paths-status': '' } })] })] }));
+}
 const BACKEND_TYPE_OPTIONS = [
     { value: '', labelKey: 'botDefaults.backendAuto' },
     { value: 'tmux', labelKey: 'botDefaults.backendTmux' },
@@ -1539,11 +1729,39 @@ function SessionCapSection(props) {
     const [input, setInput] = useState(initial == null ? '' : String(initial));
     const [status, setStatus] = useState(null);
     const [busy, setBusy] = useState(false);
+    const [overloadAlert, setOverloadAlert] = useState(props.bot.overloadAlert === true);
+    const [overloadBusy, setOverloadBusy] = useState(false);
     useEffect(() => {
         const next = typeof props.bot.maxLiveWorkers === 'number' ? props.bot.maxLiveWorkers : null;
         setCap(next);
         setInput(next == null ? '' : String(next));
     }, [props.bot.maxLiveWorkers]);
+    useEffect(() => {
+        setOverloadAlert(props.bot.overloadAlert === true);
+    }, [props.bot.overloadAlert]);
+    async function saveOverloadAlert(next) {
+        setOverloadBusy(true);
+        setStatus(null);
+        setOverloadAlert(next); // optimistic
+        try {
+            const res = await props.putCardPref({ overloadAlert: next });
+            if (res.ok && res.body.ok) {
+                props.patchBot(props.bot.larkAppId, { overloadAlert: next });
+                setStatus({ text: `✓ ${tr('botDefaults.cardPrefSaved')}`, ok: true });
+            }
+            else {
+                setOverloadAlert(!next); // revert
+                setStatus({ text: `✗ ${responseErrorText(res)}` });
+            }
+        }
+        catch (e) {
+            setOverloadAlert(!next); // revert
+            setStatus({ text: `✗ ${caughtErrorText(e)}` });
+        }
+        finally {
+            setOverloadBusy(false);
+        }
+    }
     async function save(value) {
         setStatus(null);
         setBusy(true);
@@ -1580,7 +1798,7 @@ function SessionCapSection(props) {
                             cap: effectiveCap,
                             dormant,
                             logical,
-                        }) })] }), _jsxs("div", { className: "actions", children: [_jsx("button", { type: "button", className: "primary", "data-action": "save-session-cap", disabled: busy, onClick: saveInput, children: tr('botDefaults.maxLiveWorkersSave') }), _jsx("button", { type: "button", "data-action": "off-session-cap", disabled: busy, onClick: () => { setInput(''); void save(null); }, children: tr('botDefaults.maxLiveWorkersOff') }), _jsx(StatusSpan, { status: status, attr: { 'data-session-cap-status': '' } })] })] }));
+                        }) })] }), _jsxs("div", { className: "actions", children: [_jsx("button", { type: "button", className: "primary", "data-action": "save-session-cap", disabled: busy, onClick: saveInput, children: tr('botDefaults.maxLiveWorkersSave') }), _jsx("button", { type: "button", "data-action": "off-session-cap", disabled: busy, onClick: () => { setInput(''); void save(null); }, children: tr('botDefaults.maxLiveWorkersOff') }), _jsx(StatusSpan, { status: status, attr: { 'data-session-cap-status': '' } })] }), _jsx(ToggleRow, { checked: overloadAlert, disabled: overloadBusy, dataAction: "toggle-overload-alert", title: tr('botDefaults.overloadAlert'), help: tr('botDefaults.overloadAlertHelp'), onChange: checked => void saveOverloadAlert(checked) })] }));
 }
 function StartupCommandsSection(props) {
     const tr = useT();
@@ -1612,6 +1830,69 @@ function StartupCommandsSection(props) {
     }
     return (_jsxs("div", { className: "bd-subsection", children: [_jsx("h4", { className: "bd-subsection-title", children: _jsx(FieldTitle, { help: tr('botDefaults.startupCommandsHelp'), children: tr('botDefaults.sectionStartupCommands') }) }), _jsx("textarea", { "data-input": "startupCommands", rows: 3, placeholder: tr('botDefaults.startupCommandsPlaceholder'), value: value, disabled: busy, onChange: event => setValue(event.currentTarget.value) }), _jsxs("div", { className: "actions", children: [_jsx("button", { type: "button", className: "primary", "data-action": "save-startup-commands", disabled: busy, onClick: () => void save(), children: tr('botDefaults.startupCommandsSave') }), _jsx(StatusSpan, { status: status, attr: { 'data-startup-commands-status': '' } })] })] }));
 }
+// Slash 命令权限：把 /botconfig 的 customPassthroughCommands（透传给 CLI）与
+// canTalkDaemonCommands（daemon 命令降到 canTalk）搬到 Dashboard 可视化编辑。
+// 两者都是 stringList immediate 字段，走各自的 PUT 代理路由，空串＝清除回默认。
+function SlashCommandPermissionsSection(props) {
+    const tr = useT();
+    const [passthrough, setPassthrough] = useState(typeof props.bot.customPassthroughCommands === 'string' ? props.bot.customPassthroughCommands : '');
+    const [canTalk, setCanTalk] = useState(typeof props.bot.canTalkDaemonCommands === 'string' ? props.bot.canTalkDaemonCommands : '');
+    const [status, setStatus] = useState(null);
+    const [busy, setBusy] = useState(null);
+    useEffect(() => {
+        setPassthrough(typeof props.bot.customPassthroughCommands === 'string' ? props.bot.customPassthroughCommands : '');
+    }, [props.bot.customPassthroughCommands]);
+    // 分开两个 effect：只让「被保存的那个字段」的 prop 变化重置对应输入框，否则保存
+    // 一个字段触发 patchBot 重渲染会连带把另一个字段的未保存草稿一并清空。
+    useEffect(() => {
+        setCanTalk(typeof props.bot.canTalkDaemonCommands === 'string' ? props.bot.canTalkDaemonCommands : '');
+    }, [props.bot.canTalkDaemonCommands]);
+    async function savePassthrough() {
+        setStatus(null);
+        setBusy('passthrough');
+        try {
+            const res = await sendJson('PUT', `/api/bots/${encodeURIComponent(props.bot.larkAppId)}/custom-passthrough`, { customPassthroughCommands: passthrough });
+            if (res.ok && res.body.ok) {
+                const next = typeof res.body.customPassthroughCommands === 'string' ? res.body.customPassthroughCommands : '';
+                setPassthrough(next);
+                props.patchBot(props.bot.larkAppId, { customPassthroughCommands: next });
+                setStatus({ text: `✓ ${tr('botDefaults.cardPrefSaved')}`, ok: true });
+            }
+            else {
+                setStatus({ text: `✗ ${responseErrorText(res)}` });
+            }
+        }
+        catch (e) {
+            setStatus({ text: `✗ ${caughtErrorText(e)}` });
+        }
+        finally {
+            setBusy(null);
+        }
+    }
+    async function saveCanTalk() {
+        setStatus(null);
+        setBusy('cantalk');
+        try {
+            const res = await sendJson('PUT', `/api/bots/${encodeURIComponent(props.bot.larkAppId)}/cantalk-daemon-commands`, { canTalkDaemonCommands: canTalk });
+            if (res.ok && res.body.ok) {
+                const next = typeof res.body.canTalkDaemonCommands === 'string' ? res.body.canTalkDaemonCommands : '';
+                setCanTalk(next);
+                props.patchBot(props.bot.larkAppId, { canTalkDaemonCommands: next });
+                setStatus({ text: `✓ ${tr('botDefaults.cardPrefSaved')}`, ok: true });
+            }
+            else {
+                setStatus({ text: `✗ ${responseErrorText(res)}` });
+            }
+        }
+        catch (e) {
+            setStatus({ text: `✗ ${caughtErrorText(e)}` });
+        }
+        finally {
+            setBusy(null);
+        }
+    }
+    return (_jsxs("section", { className: "bd-section", children: [_jsx("h3", { className: "bd-section-title", children: _jsx(FieldTitle, { help: tr('botDefaults.sectionSlashCommandsHelp'), children: tr('botDefaults.sectionSlashCommands') }) }), _jsxs("div", { className: "bd-subsection", children: [_jsx("h4", { className: "bd-subsection-title", children: _jsx(FieldTitle, { help: tr('botDefaults.customPassthroughHelp'), children: tr('botDefaults.customPassthrough') }) }), _jsx("textarea", { "data-input": "customPassthroughCommands", rows: 2, placeholder: tr('botDefaults.customPassthroughPlaceholder'), value: passthrough, disabled: busy === 'passthrough', onChange: event => setPassthrough(event.currentTarget.value) }), _jsx("div", { className: "actions", children: _jsx("button", { type: "button", className: "primary", "data-action": "save-custom-passthrough", disabled: busy === 'passthrough', onClick: () => void savePassthrough(), children: tr('botDefaults.customPassthroughSave') }) })] }), _jsxs("div", { className: "bd-subsection", children: [_jsx("h4", { className: "bd-subsection-title", children: _jsx(FieldTitle, { help: tr('botDefaults.canTalkDaemonHelp'), children: tr('botDefaults.canTalkDaemon') }) }), _jsx("textarea", { "data-input": "canTalkDaemonCommands", rows: 2, placeholder: tr('botDefaults.canTalkDaemonPlaceholder'), value: canTalk, disabled: busy === 'cantalk', onChange: event => setCanTalk(event.currentTarget.value) }), _jsx("div", { className: "actions", children: _jsx("button", { type: "button", className: "primary", "data-action": "save-cantalk-daemon", disabled: busy === 'cantalk', onClick: () => void saveCanTalk(), children: tr('botDefaults.canTalkDaemonSave') }) })] }), _jsx(StatusSpan, { status: status, attr: { 'data-slash-commands-status': '' } })] }));
+}
 function LaunchShellSection(props) {
     const tr = useT();
     const [value, setValue] = useState(typeof props.bot.launchShell === 'string' ? props.bot.launchShell : '');