botmux 3.5.0 → 3.6.0

package/dist/im/lark/card-handler.js

@@ -3,13 +3,16 @@ import { config } from '../../config.js';
 import { getBot, getAllBots, getOwnerOpenId } from '../../bot-registry.js';
 import { canOperate, canTalk } from './event-dispatcher.js';
 import { updateMessage, deleteMessage, replyMessage, sendMessage, sendUserMessage, sendEphemeralCard, getMessageDetail, isHumanOpenId, resolveUserUnionId as defaultResolveUserUnionId } from './client.js';
-import { buildSessionCard, buildStreamingCard, buildTuiPromptCard, buildTuiPromptProcessingCard, buildTuiPromptResolvedCard, buildGrantResultCard, buildGrantNotifyCard, getCliDisplayName, truncateContent, buildConfigCard, buildConfigTextCard, CONFIG_UNSET, buildLandResultCard, buildRepoSelectCard } from './card-builder.js';
-import { computeSandboxDiff, applySandboxDiff } from '../../services/sandbox-land.js';
+import { buildSessionCard, buildStreamingCard, buildTuiPromptCard, buildTuiPromptProcessingCard, buildTuiPromptResolvedCard, buildGrantResultCard, buildGrantNotifyCard, getCliDisplayName, truncateContent, buildConfigCard, buildConfigTextCard, CONFIG_UNSET, buildRepoSelectCard } from './card-builder.js';
 import { findConfigField, applyConfigField, coerceConfigValue, getConfigCardData } from '../../services/bot-config-store.js';
 import { updateBotGrantPrefs } from '../../services/grant-prefs-store.js';
 import { writeTeamRoleFile, deleteTeamRoleFile } from '../../core/role-resolver.js';
 import { addChatGrant, addGlobalGrant } from '../../services/grant-store.js';
 import { checkNonce, clearPending, markDenied, getPendingQuota, getPendingMessage } from './grant-pending.js';
+import { claimOverloadNonce, releaseOverloadNonce } from './overload-nonce.js';
+import { buildOverloadAlertCard, buildOverloadExpiredCard, OVERLOAD_ACTION_CLEAN_STOPPED, OVERLOAD_ACTION_SUSPEND_IDLE, OVERLOAD_ACTION_NOOP, } from '../../core/host-overload-alert.js';
+import { listOnlineDaemons } from '../../utils/daemon-discovery.js';
+import { fetchDaemonIpc } from '../../core/daemon-ipc-auth.js';
 import { recordObservedBots } from '../../services/observed-bots-store.js';
 import { handleV3GateAction, isV3GateAction, } from './v3-gate-card-handler.js';
 import { handleV3BlockedAction, isV3BlockedAction, } from './v3-blocked-card-handler.js';
@@ -24,7 +27,7 @@ import { ttadkConfigModelChoices } from '../../setup/cli-selection.js';
 import { logger } from '../../utils/logger.js';
 import * as sessionStore from '../../services/session-store.js';
 import { loadFrozenCards, saveFrozenCards } from '../../services/frozen-card-store.js';
-import { forkWorker, sendWorkerInput, killWorker, scheduleCardPatch, parkStreamCard, clearUsageLimitState, cardUsageLimit, writableTerminalLinkFor, resolvePrivateCardAudience, deliverWriteLinkCard, deliverEphemeralOrReply, CARD_POSTING_SENTINEL } from '../../core/worker-pool.js';
+import { forkWorker, sendWorkerInput, killWorker, scheduleCardPatch, parkStreamCard, clearUsageLimitState, cardUsageLimit, writableTerminalLinkFor, resolvePrivateCardAudience, deliverWriteLinkCard, deliverEphemeralOrReply, CARD_POSTING_SENTINEL, requestSessionRestart } from '../../core/worker-pool.js';
 import { getSessionWorkingDir, buildNewTopicCliInput, getAvailableBots, persistStreamCardState, resumeSession, rememberLastCliInput, ensureSessionWhiteboard } from '../../core/session-manager.js';
 import { publishAttentionPatch, announcePendingRepoSession } from '../../core/session-activity.js';
 import { fallbackTurnId } from '../../core/reply-target.js';
@@ -520,6 +523,92 @@ export async function runAutoWorktreeCommit(deps) {
     }
 }
 // ─── Main handler ─────────────────────────────────────────────────────────
+/**
+ * Drive a host-overload降压 sweep across daemons.
+ *
+ * `suspend_idle` fans out to EVERY online daemon and sums the affected counts —
+ * live workers only exist in their owning daemon's process, so each must sweep
+ * its own. `clean_stopped` operates on the SHARED, machine-wide session store,
+ * so ONE daemon does the whole job: it tries daemons in order until the first
+ * one succeeds (not a fixed `daemons[0]`, so a single flaky descriptor doesn't
+ * sink the action while healthy siblings sit idle). Fanning clean_stopped out
+ * would make siblings race the same zombies and double-count them.
+ *
+ * Throws when there are no online daemons, or when every attempt failed — so
+ * the caller rolls back the nonce instead of burning the button on an action
+ * that never ran. A partial success (≥1 daemon ok) returns normally.
+ */
+async function sweepHostOverload(mode) {
+    const daemons = listOnlineDaemons();
+    if (daemons.length === 0)
+        throw new Error(`sweep ${mode}: no online daemon`);
+    const postSweep = async (d) => {
+        try {
+            const res = await fetchDaemonIpc(d.ipcPort, '/api/host-overload/sweep', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ mode }),
+            });
+            const body = await res.json().catch(() => ({}));
+            if (res.ok && body?.ok && typeof body.affected === 'number')
+                return body.affected;
+            logger.warn(`[overload-sweep] daemon ${d.larkAppId} returned ${res.status} ${JSON.stringify(body)}`);
+            return null;
+        }
+        catch (err) {
+            logger.warn(`[overload-sweep] daemon ${d.larkAppId} unreachable: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+    };
+    if (mode === 'clean_stopped') {
+        // Machine-wide (shared store): try daemons in order, stop at the first
+        // success. Only if EVERY daemon failed do we throw (→ nonce rollback).
+        for (const d of daemons) {
+            const n = await postSweep(d);
+            if (n !== null)
+                return n;
+        }
+        throw new Error(`sweep clean_stopped reached no daemon (${daemons.length} failed)`);
+    }
+    // suspend_idle: fan out to all daemons and sum. Throw only if not one acked.
+    let affected = 0;
+    let ok = 0;
+    const results = await Promise.all(daemons.map(postSweep));
+    for (const n of results) {
+        if (n !== null) {
+            affected += n;
+            ok++;
+        }
+    }
+    if (ok === 0)
+        throw new Error(`sweep suspend_idle reached no daemon (${daemons.length} failed)`);
+    return affected;
+}
+/**
+ * Machine-wide counts for the overload alert preview. `stopped` (zombies) reads
+ * the SHARED session store, so every daemon returns the same number → take the
+ * max (any one authoritative). `idle` live workers are per-owning-daemon → sum.
+ * Best-effort: an unreachable daemon just contributes 0.
+ */
+export async function countHostOverload() {
+    const daemons = listOnlineDaemons();
+    let stopped = 0;
+    let idle = 0;
+    await Promise.all(daemons.map(async (d) => {
+        try {
+            const res = await fetchDaemonIpc(d.ipcPort, '/api/host-overload/counts', { method: 'GET' });
+            const body = await res.json().catch(() => ({}));
+            if (res.ok && body?.ok) {
+                if (typeof body.stopped === 'number')
+                    stopped = Math.max(stopped, body.stopped);
+                if (typeof body.idle === 'number')
+                    idle += body.idle;
+            }
+        }
+        catch { /* unreachable daemon contributes 0 */ }
+    }));
+    return { stopped, idle };
+}
 export async function handleCardAction(data, deps, larkAppId) {
     const { activeSessions, lastRepoScan } = deps;
     // turnId is forwarded only when the caller actually has a turn anchor
@@ -538,33 +627,68 @@ export async function handleCardAction(data, deps, larkAppId) {
     // Use the receiving bot's allowedUsers — the operator open_id in card actions
     // is scoped to the app that received the callback.
     const operatorOpenId = data?.operator?.open_id;
-    // ─── 沙盒落盘卡（land_apply / land_discard）──────────────────────────────────
-    // 不绑 session（sessionId + workingDir 都在 value 里）。owner 强闸门：只有 owner 能把
-    // 隔离副本的改动应用回真实磁盘。agent 在沙盒里无感，不参与。
-    if (value?.action && (value.action === 'land_apply' || value.action === 'land_discard') && larkAppId) {
-        const loc = localeForBot(larkAppId);
+    // ─── 机器过载告警卡动作（overload_clean_stopped / overload_suspend_idle / noop）──
+    // 不绑 session。owner 强闸门 + nonce 一次性核销（每按钮各一次，防重复点/超时重投/旧卡）。
+    // 点完不替换成死卡：重建同一张卡，把点过的按钮标 done+数量并 disabled，另一个仍可点。
+    if (value?.action === OVERLOAD_ACTION_NOOP) {
+        // 已完成的按钮（disabled 兜底）——个别客户端仍会回调，给个 toast 不做任何事。
+        return { toast: { type: 'info', content: '该操作已执行过' } };
+    }
+    if (value?.action && (value.action === OVERLOAD_ACTION_CLEAN_STOPPED || value.action === OVERLOAD_ACTION_SUSPEND_IDLE) && larkAppId) {
         const owner = getOwnerOpenId(larkAppId);
         if (!operatorOpenId || operatorOpenId !== owner) {
-            logger.info(`Land action "${value.action}" blocked for non-owner: ${operatorOpenId}`);
-            return { toast: { type: 'error', content: t('card.land.toast_owner_only', undefined, loc) } };
-        }
-        if (value.action === 'land_discard') {
-            return JSON.parse(buildLandResultCard('discarded', '', loc));
-        }
-        const sid = value.sessionId;
-        const wd = value.workingDir;
-        if (!sid || !wd)
-            return JSON.parse(buildLandResultCard('failed', t('card.land.stale', undefined, loc), loc));
-        const d = computeSandboxDiff(config.session.dataDir, sid, loc);
-        if (!d.ok)
-            return JSON.parse(buildLandResultCard('failed', d.error, loc));
-        if (d.empty)
-            return JSON.parse(buildLandResultCard('discarded', '', loc));
-        const a = applySandboxDiff(wd, config.session.dataDir, sid, loc);
-        if (!a.ok)
-            return JSON.parse(buildLandResultCard('failed', a.error, loc));
-        logger.info(`Land applied: ${d.files} files (+${d.insertions}/-${d.deletions}) → ${wd}`);
-        return JSON.parse(buildLandResultCard('applied', t('card.land.applied_body', { files: d.files, ins: d.insertions, del: d.deletions, dir: wd }, loc), loc));
+            logger.info(`Overload action "${value.action}" blocked for non-owner: ${operatorOpenId}`);
+            return { toast: { type: 'error', content: '仅管理员可操作' } };
+        }
+        // Parse the card state carried on the button. Missing/corrupt → treat as a
+        // stale card (daemon restart drops the nonce too).
+        let st;
+        try {
+            st = JSON.parse(value.st ?? '');
+        }
+        catch {
+            return JSON.parse(buildOverloadExpiredCard());
+        }
+        if (!st?.nonce)
+            return JSON.parse(buildOverloadExpiredCard());
+        // One-shot per (nonce, action): the OTHER button on the same card stays
+        // clickable (different action), but this button can't re-fire.
+        if (!claimOverloadNonce(st.nonce, value.action)) {
+            return JSON.parse(buildOverloadExpiredCard('这个按钮已点过，或该告警卡已过期。'));
+        }
+        const mode = value.action === OVERLOAD_ACTION_CLEAN_STOPPED ? 'clean_stopped' : 'suspend_idle';
+        let affected;
+        try {
+            affected = await sweepHostOverload(mode);
+        }
+        catch (err) {
+            logger.warn(`[overload] ${value.action} failed: ${err instanceof Error ? err.message : String(err)}`);
+            // Only the destructive sweep is guarded here: roll back the claim so a
+            // transient sweep failure doesn't permanently burn the button — the owner
+            // can click it again to retry. (The post-sweep count refresh below is
+            // deliberately outside this try: once the sweep has run, its failure must
+            // not re-open the button for a second destructive run.)
+            releaseOverloadNonce(st.nonce, value.action);
+            return { toast: { type: 'error', content: '执行失败，请稍后重试或用 CLI 手动处理' } };
+        }
+        if (mode === 'clean_stopped')
+            st.cleanedN = affected;
+        else
+            st.suspendedN = affected;
+        // Refresh the machine-wide candidate counts so the still-live button and
+        // the header reflect what's left after this sweep. Best-effort: the sweep
+        // already succeeded, so a count failure must not roll back the nonce.
+        try {
+            const counts = await countHostOverload();
+            st.stopped = counts.stopped;
+            st.idle = counts.idle;
+        }
+        catch (err) {
+            logger.warn(`[overload] post-sweep count refresh failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        logger.info(`[overload] ${value.action} by owner ${operatorOpenId}: affected=${affected}, remaining stopped=${st.stopped} idle=${st.idle}`);
+        // Rebuild the SAME card: clicked button → ✓done+disabled, other → still live.
+        return JSON.parse(buildOverloadAlertCard(st));
     }
     // ─── 群内授权卡片动作（grant_chat / grant_global / grant_deny，talk-only）─────
     // 不绑定 session，必须在 session 解析之前处理。owner 强闸门 + nonce 校验。
@@ -1418,23 +1542,16 @@ export async function handleCardAction(data, deps, larkAppId) {
                 await sessionReply(rootId, t('card.action.adopt_no_restart', undefined, locDs));
                 return;
             }
-            const botCfg = getBot(ds.larkAppId).config;
             const effectiveCliId = sessionCliId(ds);
-            if (ds.worker) {
-                logger.info(`[${tag(ds)}] Restart via card button`);
-                ds.worker.send({ type: 'restart' });
-                const cliName = getCliDisplayName(effectiveCliId);
-                const restartedMsg = t('card.action.restarted', { cliName }, locDs);
-                await deliverEphemeralOrReply(ds, operatorOpenId, restartedMsg, 'text', () => sessionReply(rootId, restartedMsg));
-            }
-            else {
-                logger.info(`[${tag(ds)}] Re-forking worker via card button`);
-                forkWorker(ds, '', ds.hasHistory);
-                const cliName = getCliDisplayName(effectiveCliId);
-                const restartedFreshMsg = t('card.action.restarted_fresh', { cliName }, locDs);
-                await deliverEphemeralOrReply(ds, operatorOpenId, restartedFreshMsg, 'text', () => sessionReply(rootId, restartedFreshMsg));
-                // DM card will be sent by the ready handler when worker starts
-            }
+            const cliName = getCliDisplayName(effectiveCliId);
+            logger.info(`[${tag(ds)}] Correlated restart via card button`);
+            requestSessionRestart(ds, {
+                source: 'card',
+                notify: status => {
+                    const content = t(`cmd.restart.${status}`, { cliName }, locDs);
+                    return deliverEphemeralOrReply(ds, operatorOpenId, content, 'text', () => sessionReply(rootId, content));
+                },
+            });
         }
         if (actionType === 'close') {
             if (!ds) {