botmux 3.7.1 → 3.8.0

package/dist/im/lark/card-handler.js

@@ -3,12 +3,13 @@ import { config } from '../../config.js';
 import { getBot, getAllBots, getOwnerOpenId } from '../../bot-registry.js';
 import { canOperate, canTalk } from './event-dispatcher.js';
 import { updateMessage, deleteMessage, replyMessage, sendMessage, sendUserMessage, sendEphemeralCard, getMessageDetail, isHumanOpenId, resolveUserUnionId as defaultResolveUserUnionId } from './client.js';
-import { buildSessionCard, buildStreamingCard, buildTuiPromptCard, buildTuiPromptProcessingCard, buildTuiPromptResolvedCard, buildGrantResultCard, buildGrantNotifyCard, getCliDisplayName, truncateContent, buildConfigCard, buildConfigTextCard, CONFIG_UNSET, buildRepoSelectCard } from './card-builder.js';
-import { findConfigField, applyConfigField, coerceConfigValue, getConfigCardData } from '../../services/bot-config-store.js';
+import { buildSessionCard, buildStreamingCard, buildTuiPromptCard, buildTuiPromptProcessingCard, buildGrantResultCard, getCliDisplayName, truncateContent, buildConfigCard, buildConfigTextCard, CONFIG_UNSET, buildRepoSelectCard } from './card-builder.js';
+import { findConfigField, applyConfigField, coerceConfigValue, getConfigCardData, } from '../../services/bot-config-store.js';
 import { updateBotGrantPrefs } from '../../services/grant-prefs-store.js';
 import { writeTeamRoleFile, deleteTeamRoleFile } from '../../core/role-resolver.js';
 import { addChatGrant, addGlobalGrant } from '../../services/grant-store.js';
-import { checkNonce, clearPending, markDenied, getPendingQuota, getPendingMessage } from './grant-pending.js';
+import { checkNonce, clearPending, getPendingGrantLimits, getPendingMessage, markDenied, updatePendingGrantLimits, } from './grant-pending.js';
+import { normalizeGrantDurationOption, normalizeGrantQuotaOption } from '../../services/grant-policy.js';
 import { claimOverloadNonce, releaseOverloadNonce } from './overload-nonce.js';
 import { buildOverloadAlertCard, buildOverloadExpiredCard, OVERLOAD_ACTION_CLEAN_STOPPED, OVERLOAD_ACTION_SUSPEND_IDLE, OVERLOAD_ACTION_NOOP, } from '../../core/host-overload-alert.js';
 import { listOnlineDaemons } from '../../utils/daemon-discovery.js';
@@ -27,11 +28,12 @@ import { ttadkConfigModelChoices } from '../../setup/cli-selection.js';
 import { logger } from '../../utils/logger.js';
 import * as sessionStore from '../../services/session-store.js';
 import { loadFrozenCards, saveFrozenCards } from '../../services/frozen-card-store.js';
-import { forkWorker, sendWorkerInput, killWorker, scheduleCardPatch, parkStreamCard, clearUsageLimitState, cardUsageLimit, writableTerminalLinkFor, resolvePrivateCardAudience, deliverWriteLinkCard, deliverEphemeralOrReply, CARD_POSTING_SENTINEL, requestSessionRestart } from '../../core/worker-pool.js';
+import { forkWorker, sendWorkerInput, sendWorkerSessionInput, killWorker, closeSession, teardownAuthoritativePersistentBackingBeforeClose, scheduleCardPatch, parkStreamCard, clearUsageLimitState, cardUsageLimit, writableTerminalLinkFor, workerHasInitialized, sessionSupportsWebTerminal, readableTerminalUrlFor, resolvePrivateCardAudience, deliverWriteLinkCard, deliverEphemeralOrReply, CARD_POSTING_SENTINEL, requestSessionRestart, isSessionTransferring, getDaemonStreamingCardUsageSnapshot } from '../../core/worker-pool.js';
 import { getSessionWorkingDir, buildNewTopicCliInput, getAvailableBots, persistStreamCardState, resumeSession, rememberLastCliInput, ensureSessionWhiteboard } from '../../core/session-manager.js';
 import { markInitialUserTurnPending } from '../../core/initial-user-turn.js';
-import { publishAttentionPatch, announcePendingRepoSession } from '../../core/session-activity.js';
+import { publishAttentionPatch, publishClosedSessionPatch, announcePendingRepoSession } from '../../core/session-activity.js';
 import { fallbackTurnId } from '../../core/reply-target.js';
+import { sendWorkerIpc } from '../../core/worker-ipc.js';
 import { validateWorkingDir } from '../../core/working-dir.js';
 import { sessionKey, sessionAnchorId, frozenDisplayMode, markRepoCardConsumed, isActiveRepoCard, claimCurrentRepoCard } from '../../core/types.js';
 import { buildTerminalUrl } from '../../core/terminal-url.js';
@@ -402,6 +404,23 @@ opts) {
     }
     else {
         // Mid-session repo switch — close old session, start fresh.
+        // ZMX close is identity/generation verified and may refuse. Prove teardown
+        // before claiming the card or mutating any old-session state; on refusal
+        // the current session and card remain fully retryable.
+        try {
+            teardownAuthoritativePersistentBackingBeforeClose(ds);
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            logger.warn(`[${tag(ds)}] Repo switch refused because backing teardown was not proven: ${reason}`);
+            try {
+                await sessionReply(rootId, t('cmd.repo.switch_close_failed', { error: reason }, locTarget));
+            }
+            catch (replyErr) {
+                logger.warn(`[${tag(ds)}] Repo-switch teardown failure reply failed: ${replyErr instanceof Error ? replyErr.message : replyErr}`);
+            }
+            return;
+        }
         // Claim the current card BEFORE killWorker / any await. A concurrent click
         // on the same Feishu card must not pass a second kill+fork while the first
         // switch is still awaiting confirm replies. Correctness does not depend on
@@ -423,6 +442,7 @@ opts) {
         // the displaced session's stored workingDir (and the closed card), so
         // `claude --resume` later would reopen the old context in the new repo's
         // cwd. The new repo is pinned onto the fresh session below instead.
+        const oldSession = ds.session;
         const closedCard = buildClosedSessionCard(ds, locTarget);
         killWorker(ds);
         // Park the current card in `frozenCards` so the next POST under the new
@@ -433,8 +453,15 @@ opts) {
         // stays in the thread instead of vanishing prematurely.
         parkStreamCard(ds);
         sessionStore.closeSession(ds.session.sessionId);
+        publishClosedSessionPatch(ds.session.sessionId, ds.session.closedAt ? Date.parse(ds.session.closedAt) : undefined);
         await deliverEphemeralOrReply(ds, operatorOpenId, closedCard, 'interactive', () => sessionReply(rootId, closedCard, 'interactive'));
-        const oldSession = ds.session;
+        // The close card delivery yields to inbound routing and dashboard IPC. If
+        // the user closed/replaced this generation during that await, do not mint a
+        // fresh active row from the stale continuation.
+        if (!sessionStillActive() || ds.session !== oldSession) {
+            logger.warn(`[${tag(ds)}] Repo switch cancelled after old-session close; routing generation changed during card delivery`);
+            return;
+        }
         // `rootId` is the routing anchor. For chat-scope sessions it is the
         // `oc_...` chat id, not the traceable `om_...` message root stored on
         // Session. Preserve the old identity and explicitly persist scope so card
@@ -519,6 +546,18 @@ export async function runAutoWorktreeCommit(deps) {
         const wt = await maybeCreateDefaultWorktree(larkAppId, baseDir, {
             isBotDefaultDir: true, title, prompt, locale: localeForBot(larkAppId), notify,
         });
+        // The pendingRepo placeholder can legitimately be consumed WHILE this
+        // up-to-30s build runs — e.g. the Codex-notifier「继续处理」callback adopts
+        // the same DM session and clears pendingRepo before we get here. If we now
+        // funneled into commitRepoSelection, its mid-session branch would kill the
+        // freshly-adopted worker and replace it with a botmux-owned worktree
+        // session. Bail on the late result instead: the takeover already owns the
+        // session. (commitRepoSelection also re-checks pendingRepo under its claim,
+        // but that check runs after an await — fence here before any mutation.)
+        if (!ds.pendingRepo) {
+            logger.info(`[${tag(ds)}] auto-worktree completion ignored — pendingRepo already consumed (session taken over)`);
+            return;
+        }
         // Commit even on fallback (wt.dir === baseDir) — the session must still start.
         // commitRepoSelection has its own /close + generation guards and, for a
         // pendingRepo session, folds any messages buffered during creation (pendingPrompt
@@ -546,17 +585,19 @@ export async function runAutoWorktreeCommit(deps) {
 /**
  * Drive a host-overload降压 sweep across daemons.
  *
- * `suspend_idle` fans out to EVERY online daemon and sums the affected counts —
- * live workers only exist in their owning daemon's process, so each must sweep
- * its own. `clean_stopped` operates on the SHARED, machine-wide session store,
- * so ONE daemon does the whole job: it tries daemons in order until the first
- * one succeeds (not a fixed `daemons[0]`, so a single flaky descriptor doesn't
- * sink the action while healthy siblings sit idle). Fanning clean_stopped out
- * would make siblings race the same zombies and double-count them.
+ * Both modes fan out to EVERY online daemon and sum the affected counts. Each
+ * daemon owns one bot-scoped session store and its own live workers, so neither
+ * stopped sessions nor idle workers can be swept through a sibling daemon.
  *
- * Throws when there are no online daemons, or when every attempt failed — so
- * the caller rolls back the nonce instead of burning the button on an action
- * that never ran. A partial success (≥1 daemon ok) returns normally.
+ * Fail-closed on partial failure: if ANY discovered daemon doesn't ACK, throw —
+ * the caller then rolls back the nonce (releaseOverloadNonce) so the owner can
+ * retry, instead of burning the button on a card that reports「已清理 0」while
+ * the daemon that actually held the zombies never ran. Both sweeps are
+ * idempotent (an already-closed session leaves the stopped set; an already-
+ * suspended worker leaves the idle set), so a retry only re-hits whatever
+ * failed. Reporting a partial count as a completed action would resurrect the
+ * exact "显示 0、实际没清" symptom this fix exists to kill — just triggered by
+ * "the daemon holding the zombies failed" instead of "the first daemon had none".
  */
 async function sweepHostOverload(mode) {
     const daemons = listOnlineDaemons();
@@ -580,35 +621,20 @@ async function sweepHostOverload(mode) {
             return null;
         }
     };
-    if (mode === 'clean_stopped') {
-        // Machine-wide (shared store): try daemons in order, stop at the first
-        // success. Only if EVERY daemon failed do we throw (→ nonce rollback).
-        for (const d of daemons) {
-            const n = await postSweep(d);
-            if (n !== null)
-                return n;
-        }
-        throw new Error(`sweep clean_stopped reached no daemon (${daemons.length} failed)`);
-    }
-    // suspend_idle: fan out to all daemons and sum. Throw only if not one acked.
-    let affected = 0;
-    let ok = 0;
+    // Fan out to all daemons and sum. Fail the whole action if ANY didn't ACK, so
+    // the caller keeps the button retriable rather than reporting a partial sweep
+    // as complete.
     const results = await Promise.all(daemons.map(postSweep));
-    for (const n of results) {
-        if (n !== null) {
-            affected += n;
-            ok++;
-        }
+    const failed = results.filter(n => n === null).length;
+    if (failed > 0) {
+        throw new Error(`sweep ${mode}: ${failed}/${daemons.length} daemon(s) did not ack — retriable`);
     }
-    if (ok === 0)
-        throw new Error(`sweep suspend_idle reached no daemon (${daemons.length} failed)`);
-    return affected;
+    return results.reduce((sum, n) => sum + (n ?? 0), 0);
 }
 /**
- * Machine-wide counts for the overload alert preview. `stopped` (zombies) reads
- * the SHARED session store, so every daemon returns the same number → take the
- * max (any one authoritative). `idle` live workers are per-owning-daemon → sum.
- * Best-effort: an unreachable daemon just contributes 0.
+ * Machine-wide counts for the overload alert preview. Each daemon reports its
+ * bot-scoped stopped sessions and its own live workers, so both fields must be
+ * summed. Best-effort: an unreachable daemon just contributes 0.
  */
 export async function countHostOverload() {
     const daemons = listOnlineDaemons();
@@ -620,7 +646,7 @@ export async function countHostOverload() {
             const body = await res.json().catch(() => ({}));
             if (res.ok && body?.ok) {
                 if (typeof body.stopped === 'number')
-                    stopped = Math.max(stopped, body.stopped);
+                    stopped += body.stopped;
                 if (typeof body.idle === 'number')
                     idle += body.idle;
             }
@@ -710,9 +736,13 @@ export async function handleCardAction(data, deps, larkAppId) {
         // Rebuild the SAME card: clicked button → ✓done+disabled, other → still live.
         return JSON.parse(buildOverloadAlertCard(st));
     }
-    // ─── 群内授权卡片动作（grant_chat / grant_global / grant_deny，talk-only）─────
+    // ─── 群内授权卡片动作（限制提交 + grant/revoke，talk-only）──────────────────
     // 不绑定 session，必须在 session 解析之前处理。owner 强闸门 + nonce 校验。
-    if (value?.action && (value.action === 'grant_chat' || value.action === 'grant_global' || value.action === 'grant_deny') && larkAppId) {
+    if (value?.action && (value.action === 'grant_chat'
+        || value.action === 'grant_global'
+        || value.action === 'grant_deny'
+        || value.action === 'grant_set_duration'
+        || value.action === 'grant_set_quota') && larkAppId) {
         const loc = localeForBot(larkAppId);
         const owner = getOwnerOpenId(larkAppId);
         // owner 强闸门：必须是当前 app 的 owner 本人（比 canOperate 更严）
@@ -731,6 +761,23 @@ export async function handleCardAction(data, deps, larkAppId) {
         if (!targets.length || !grantChatId || !nonce || !targets.every(tt => checkNonce(larkAppId, grantChatId, tt, nonce))) {
             return { toast: { type: 'error', content: t('card.grant.toast_expired', undefined, loc) } };
         }
+        // 兼容已发出的旧卡：旧卡用下拉 callback 暂存限制，新卡在授权按钮的 form_submit
+        // 中一次提交有效期和额度。两条路径都必须走服务端校验，不能信任卡片输入。
+        if (value.action === 'grant_set_duration' || value.action === 'grant_set_quota') {
+            const selected = action?.option;
+            const parsed = value.action === 'grant_set_duration'
+                ? normalizeGrantDurationOption(selected)
+                : normalizeGrantQuotaOption(selected);
+            if (parsed === null) {
+                return { toast: { type: 'error', content: t('card.grant.toast_bad_limit', undefined, loc) } };
+            }
+            const updated = updatePendingGrantLimits(larkAppId, grantChatId, targets, nonce, value.action === 'grant_set_duration'
+                ? { durationMs: parsed ?? null }
+                : { quota: parsed ?? null });
+            return updated
+                ? { toast: { type: 'success', content: t('card.grant.toast_limit_staged', undefined, loc) } }
+                : { toast: { type: 'error', content: t('card.grant.toast_expired', undefined, loc) } };
+        }
         // 拒绝：只把卡更新成「已拒绝」+ 全部目标进 deny 冷却，绝不触碰 grant-store。
         // 返回原始卡 body，由 dispatcher 包成 in-place patch（不再走 updateMessage 双写）。
         if (value.action === 'grant_deny') {
@@ -738,14 +785,36 @@ export async function handleCardAction(data, deps, larkAppId) {
                 markDenied(larkAppId, grantChatId, tt);
             return JSON.parse(buildGrantResultCard('deny', loc));
         }
+        const formValue = action?.form_value;
+        if (formValue) {
+            const duration = normalizeGrantDurationOption(formValue.grant_duration);
+            const quota = normalizeGrantQuotaOption(typeof formValue.grant_quota === 'string' ? formValue.grant_quota.trim() : formValue.grant_quota);
+            if (quota === null) {
+                return { toast: { type: 'error', content: t('card.grant.toast_bad_quota', undefined, loc) } };
+            }
+            if (duration === null) {
+                return { toast: { type: 'error', content: t('card.grant.toast_bad_limit', undefined, loc) } };
+            }
+            if (!updatePendingGrantLimits(larkAppId, grantChatId, targets, nonce, {
+                durationMs: duration ?? null,
+                quota: quota ?? null,
+            })) {
+                return { toast: { type: 'error', content: t('card.grant.toast_expired', undefined, loc) } };
+            }
+        }
         // 授权（talk-only）：grant_chat 写本群 chatGrants，grant_global 写全局 globalGrants，
         // 两者都绝不碰 allowedUsers（operate 只由 bots.json 配）。逐个落库，统计成功/失败。
         const kind = value.action === 'grant_global' ? 'global' : 'chat';
         const names = Array.isArray(value.target_names) ? value.target_names : [];
         const idToName = new Map();
         targets.forEach((tt, i) => idToName.set(tt, names[i] ?? ''));
-        // 额度挂在 pending 上（/grant @x N 解析所得；多目标共用同一额度）；clearPending 前先读出来。
-        const quota = getPendingQuota(larkAppId, grantChatId, targets[0]);
+        // 限制挂在 pending 上；确认时生成绝对 expiresAt，多目标共享同一组限制。
+        const limits = getPendingGrantLimits(larkAppId, grantChatId, targets[0]);
+        if (!limits) {
+            return { toast: { type: 'error', content: t('card.grant.toast_expired', undefined, loc) } };
+        }
+        const quota = limits.quota;
+        const expiresAt = limits.durationMs === undefined ? undefined : Date.now() + limits.durationMs;
         // 触发本次授权申请的原始消息事件：授权成功后重放，用户无需再 @ 一遍。
         // 自助申请卡每次只对应一个 target，取第一个即可。
         const pendingMessage = getPendingMessage(larkAppId, grantChatId, targets[0]);
@@ -753,8 +822,8 @@ export async function handleCardAction(data, deps, larkAppId) {
         const failed = [];
         for (const tt of targets) {
             const res = kind === 'global'
-                ? await addGlobalGrant(larkAppId, tt, quota)
-                : await addChatGrant(larkAppId, grantChatId, tt, quota);
+                ? await addGlobalGrant(larkAppId, tt, quota, expiresAt)
+                : await addChatGrant(larkAppId, grantChatId, tt, quota, expiresAt);
             if (res.ok) {
                 clearPending(larkAppId, grantChatId, tt);
                 granted.push(tt);
@@ -801,12 +870,12 @@ export async function handleCardAction(data, deps, larkAppId) {
         }
         // 通知卡的 grantee 渲染参数：bot 只用纯文本名字（不 <at>，否则唤醒对方 bot 误拉空会话），真人 @ 点名。
         const notifyTargets = granted.map((id, i) => ({ openId: id, name: idToName.get(id) || undefined, isBot: !humanFlags[i] }));
-        // 授权成功后：
-        //   1. 先同步返回 callback 响应（in-place patch 成「已授权」终态卡），避免飞书等待
-        //      太久或 deleteMessage 与 callback 响应竞态导致客户端 300000 报错；
-        //   2. 通知卡 + 部分失败告知 + 撤回原卡 走后台 fire-and-forget（不阻塞 callback）。
-        const resultCardBody = JSON.parse(buildGrantResultCard(kind, loc));
-        if (cardMessageId) {
+        // 授权成功后：**就地 patch 原卡**为终态（正文直接 @ 被授权人 + 额度/有效期），这一张卡既是
+        // 「已授权」结果态、又 ping 到被授权人——无需再单独发通知卡、也无需撤回原卡（申晗 2026-07-31
+        // 反馈：直接在原卡更新即可）。同步返回该 body 即完成 in-place patch，避免 deleteMessage 与
+        // callback 响应竞态导致客户端 300000。仅「部分失败」仍走后台补一条文字告知。
+        const resultCardBody = JSON.parse(buildGrantResultCard(kind, loc, quota, expiresAt, notifyTargets));
+        if (cardMessageId && failed.length > 0) {
             let replyInThread = true;
             try {
                 const detail = await getMessageDetail(larkAppId, cardMessageId);
@@ -816,31 +885,17 @@ export async function handleCardAction(data, deps, larkAppId) {
                 replyInThread = Boolean(item.thread_id);
             }
             catch (err) {
-                logger.debug(`grant notify thread-mode probe failed, defaulting to thread reply: ${err}`);
+                logger.debug(`grant partial-failure thread-mode probe failed, defaulting to thread reply: ${err}`);
             }
-            // fire-and-forget: 通知卡 + 部分失败文字 + 撤回原卡
+            // fire-and-forget: 仅在有部分目标失败时补一条文字告知（不阻塞 callback）。
             Promise.resolve()
                 .then(async () => {
+                const failNames = failed.map(f => idToName.get(f.openId) || f.openId).join('、');
                 try {
-                    await replyMessage(larkAppId, cardMessageId, buildGrantNotifyCard(kind, notifyTargets, loc, quota), 'interactive', replyInThread);
+                    await replyMessage(larkAppId, cardMessageId, t('card.grant.partial_failed', { names: failNames }, loc), 'text', replyInThread);
                 }
                 catch (err) {
-                    logger.warn(`grant notify failed (grant still applied): ${err}`);
-                }
-                if (failed.length > 0) {
-                    const failNames = failed.map(f => idToName.get(f.openId) || f.openId).join('、');
-                    try {
-                        await replyMessage(larkAppId, cardMessageId, t('card.grant.partial_failed', { names: failNames }, loc), 'text', replyInThread);
-                    }
-                    catch (err) {
-                        logger.warn(`grant partial-failure notice failed: ${err}`);
-                    }
-                }
-                try {
-                    await deleteMessage(larkAppId, cardMessageId);
-                }
-                catch (err) {
-                    logger.debug(`grant card withdraw (post-callback) failed: ${err}`);
+                    logger.warn(`grant partial-failure notice failed: ${err}`);
                 }
             })
                 .catch(err => logger.error(`grant post-callback background tasks failed: ${err}`));
@@ -966,6 +1021,7 @@ export async function handleCardAction(data, deps, larkAppId) {
         // session's chatType for DM targets. Default 'group' covers legacy cards.
         const targetScope = value.target_scope ?? 'chat';
         const targetChatType = value.target_chat_type ?? 'group';
+        const cardVisibility = value.visibility ?? 'public';
         const invokerOpenId = value.invoker_open_id;
         if (!targetChatId || !targetRootId || !operatorOpenId) {
             return { toast: { type: 'error', content: t('card.relay.toast_failed', { error: 'missing_value' }, loc) } };
@@ -1018,7 +1074,32 @@ export async function handleCardAction(data, deps, larkAppId) {
             selectedSessionId: nextSelected,
             searchQuery: nextSearch,
             page: nextPage,
-        }, targetScope, targetChatType);
+        }, targetScope, targetChatType, cardVisibility);
+        // ── Private (ephemeral) picker: delete-then-resend ────────────────────
+        // Ephemeral cards CANNOT be PATCH-updated (Feishu legacy interface), so we
+        // can't return a body for the dispatcher to patch in place. Instead delete
+        // the clicked card and resend a fresh ephemeral one carrying the new state
+        // — the same send→interact→delete→resend pattern Feishu documents for
+        // ephemeral flows. Resend FIRST, then delete the old one, so a resend
+        // failure doesn't leave the user with no card at all. The toast keeps the
+        // callback response non-empty (returning {} would make Lark show nothing).
+        if (cardVisibility === 'private') {
+            const { sendEphemeralCard, deleteEphemeralCard } = await import('./client.js');
+            try {
+                await sendEphemeralCard(larkAppId, targetChatId, invokerOpenId ?? operatorOpenId, cardJson);
+                if (cardMessageId) {
+                    await deleteEphemeralCard(larkAppId, cardMessageId).catch(() => { });
+                }
+                // No card body returned — the replacement is already sent. An empty
+                // response is fine here (the new ephemeral card is the user-visible
+                // result); a toast would double up with the freshly-rendered card.
+                return;
+            }
+            catch (err) {
+                logger.warn(`[card-action] relay private picker re-render failed (${err instanceof Error ? err.message : err}); leaving old card in place`);
+                return { toast: { type: 'error', content: t('card.relay.toast_failed', { error: 'ephemeral_refresh_failed' }, loc) } };
+            }
+        }
         // Return an updated card body — event-dispatcher wraps this as
         // { card: { type: 'raw', data: <body> } } so Lark patches the picker
         // in place rather than appending a new message.
@@ -1167,6 +1248,7 @@ export async function handleCardAction(data, deps, larkAppId) {
         // field and default to 'group' (their pickers never offered DM targets).
         const targetScope = value.target_scope ?? 'chat';
         const targetChatType = value.target_chat_type ?? 'group';
+        const cardVisibility = value.visibility ?? 'public';
         const targetAnchor = targetScope === 'chat' ? targetChatId : targetRootId;
         const invokerOpenId = value.invoker_open_id;
         if (!sourceSessionId || !targetChatId || !targetRootId) {
@@ -1208,22 +1290,20 @@ export async function handleCardAction(data, deps, larkAppId) {
         // collectRelayPickerEntries already filters scratches at render time,
         // but a stale picker (rendered before a scratch was created) could
         // still produce a confirm click; this is the depth defense.
-        {
-            const { isRelayableRealSession } = await import('../../core/worker-pool.js');
-            if (!isRelayableRealSession(sourceDs)) {
-                return { toast: { type: 'error', content: t('card.relay.toast_not_started_yet', undefined, loc) } };
-            }
+        const { isDisposableCommandScratch, isRelayableRealSession } = await import('../../core/worker-pool.js');
+        if (!isRelayableRealSession(sourceDs)) {
+            return { toast: { type: 'error', content: t('card.relay.toast_not_started_yet', undefined, loc) } };
         }
         // Pre-flight target-chat conflict check — done BEFORE sendMessage M1 so
         // a refusal doesn't leave a misleading "已接力" announcement in the
         // target chat (王皓 caught this in testing). Mirror the same predicate
-        // transferSession uses, plus the `!!worker` filter that excludes daemon
-        // command scratch sessions (e.g. the /relay command's own session,
-        // which shares the bot's larkAppId + chatId but has no worker).
+        // transferSession uses. Only a narrowly classified daemon-command scratch
+        // may be ignored; worker-less queued/adopt/deferred/real sessions still own
+        // the anchor and must block before a misleading M1 is sent.
         const targetConflict = [...activeSessions.values()].find(c => c !== sourceDs
             && c.larkAppId === larkAppId
             && sessionAnchorId(c) === targetAnchor
-            && !!c.worker);
+            && !isDisposableCommandScratch(c));
         if (targetConflict) {
             const conflictTitle = targetConflict.session.title || targetConflict.session.sessionId.substring(0, 8);
             // Send as a regular text message in the target chat instead of a
@@ -1291,8 +1371,16 @@ export async function handleCardAction(data, deps, larkAppId) {
             return { toast: { type: 'error', content: t('card.relay.toast_failed', { error: r.error }, loc) } };
         }
         // Best-effort: remove the picker card now that the selection resolved.
+        // Ephemeral (private) pickers need the ephemeral-delete endpoint —
+        // deleteMessage (im/v1/messages) doesn't apply to ephemeral message ids.
         if (cardMessageId && larkAppId) {
-            deleteMessage(larkAppId, cardMessageId).catch(() => { });
+            if (cardVisibility === 'private') {
+                const { deleteEphemeralCard } = await import('./client.js');
+                deleteEphemeralCard(larkAppId, cardMessageId).catch(() => { });
+            }
+            else {
+                deleteMessage(larkAppId, cardMessageId).catch(() => { });
+            }
         }
         return { toast: { type: 'success', content: t('card.relay.toast_success', undefined, loc) } };
     }
@@ -1562,6 +1650,14 @@ export async function handleCardAction(data, deps, larkAppId) {
                 await sessionReply(rootId, t('card.action.adopt_no_restart', undefined, locDs));
                 return;
             }
+            if (isSessionTransferring(ds)) {
+                return {
+                    toast: {
+                        type: 'warning',
+                        content: t('cmd.session.transfer_in_progress', undefined, locDs),
+                    },
+                };
+            }
             const effectiveCliId = sessionCliId(ds);
             const cliName = getCliDisplayName(effectiveCliId);
             logger.info(`[${tag(ds)}] Correlated restart via card button`);
@@ -1583,9 +1679,23 @@ export async function handleCardAction(data, deps, larkAppId) {
             // Build the closed card BEFORE killWorker/closeSession — it reads the
             // live session's identity off `ds`.
             const card = buildClosedSessionCard(ds, localeForBot(ds.larkAppId));
-            killWorker(ds);
-            sessionStore.closeSession(ds.session.sessionId);
-            activeSessions.delete(sKey);
+            try {
+                await closeSession(ds.session.sessionId);
+            }
+            catch (err) {
+                logger.error(`[${tag(ds)}] Refused close because backing teardown was not verified: ${err}`);
+                return {
+                    toast: {
+                        type: 'warning',
+                        content: `会话关闭失败：${err instanceof Error ? err.message : String(err)}`,
+                    },
+                };
+            }
+            // closeSession removes the captured ds before awaiting best-effort remote
+            // cleanup. A new session may claim the same route during that await; only
+            // delete here if this handler still owns the exact object it closed.
+            if (activeSessions.get(sKey) === ds)
+                activeSessions.delete(sKey);
             // The closed card carries session title / CLI name / workingDir / resume
             // command. In private-card mode those must not leak to the group — send the
             // closed card ephemeral to the same owner audience instead. No group
@@ -1637,11 +1747,15 @@ export async function handleCardAction(data, deps, larkAppId) {
                 else if (result.error === 'deferred_unmaterialized') {
                     await sessionReply(rootId, t('card.action.resume_deferred_unmaterialized', undefined, locDsResume));
                 }
+                else if (result.error === 'resume_cancelled') {
+                    await sessionReply(rootId, t('card.action.resume_cancelled', undefined, locDsResume));
+                }
             }
         }
         if (actionType === 'disconnect' && ds) {
             killWorker(ds);
             sessionStore.closeSession(ds.session.sessionId);
+            publishClosedSessionPatch(ds.session.sessionId, ds.session.closedAt ? Date.parse(ds.session.closedAt) : undefined);
             activeSessions.delete(sKey);
             await sessionReply(rootId, t('card.action.disconnected', undefined, localeForBot(ds.larkAppId)));
             logger.info(`[${tag(ds)}] Disconnected (adopt) via card button`);
@@ -1672,9 +1786,9 @@ export async function handleCardAction(data, deps, larkAppId) {
             ds.currentImageKey = undefined;
             persistStreamCardState(ds);
             let cardJson;
-            if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL && ds.workerPort) {
-                const readUrl = buildTerminalUrl(ds);
-                cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, ds.currentTurnTitle, '', 'working', sessionCliId(ds), ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, locDs, undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: sessionCliId(ds) }));
+            if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL && workerHasInitialized(ds)) {
+                const readUrl = readableTerminalUrlFor(ds);
+                cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, ds.currentTurnTitle, '', 'working', sessionCliId(ds), ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, locDs, undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: sessionCliId(ds) }), getDaemonStreamingCardUsageSnapshot(ds, sessionCliId(ds)));
                 scheduleCardPatch(ds, cardJson);
             }
             const retryCodexAppInput = ds.lastCodexAppInput
@@ -1698,6 +1812,14 @@ export async function handleCardAction(data, deps, larkAppId) {
             return;
         }
         if (actionType === 'tui_keys' && ds) {
+            if (isSessionTransferring(ds)) {
+                return {
+                    toast: {
+                        type: 'warning',
+                        content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)),
+                    },
+                };
+            }
             // Fail-closed: only act on a currently-active card (either the
             // ScreenAnalyzer TUI prompt card or our stuck-warning card). A stale
             // click from a resolved/replaced card must NOT send any IPC to the
@@ -1718,6 +1840,10 @@ export async function handleCardAction(data, deps, larkAppId) {
             const optionType = value?.option_type ?? 'select';
             const selectedIndex = Number(value?.selected_index ?? 0);
             const selectedText = value?.selected_text ?? `Option ${selectedIndex + 1}`;
+            if (isActiveTuiCard && ds.tuiPromptProcessing) {
+                logger.info(`[${tag(ds)}] Duplicate TUI prompt card click — dropped (processing already in flight)`);
+                return;
+            }
             if (optionType === 'toggle') {
                 // Only a ScreenAnalyzer TUI card may own toggle state. A stuck-warning
                 // card must never read or mutate the other card's global selections.
@@ -1755,6 +1881,7 @@ export async function handleCardAction(data, deps, larkAppId) {
             if (ds.worker) {
                 let allKeys = [];
                 let isFinalStuck = false;
+                let dispatchedKeys = false;
                 if (isActiveTuiCard && ds.tuiToggledIndices?.length && ds.tuiPromptOptions) {
                     // Send each toggled option's keys in sequence
                     for (const ti of ds.tuiToggledIndices.sort((a, b) => a - b)) {
@@ -1805,6 +1932,7 @@ export async function handleCardAction(data, deps, larkAppId) {
                     allKeys.push(...keys);
                 }
                 if (allKeys.length > 0) {
+                    const effectiveFinal = isFinal || isFinalStuck;
                     // Atomic processing claim: if a previous click is already in flight
                     // (waiting for tui_keys_delivered / stuck_warning_expired ACK), drop
                     // this duplicate. Without this, two rapid clicks could both pass the
@@ -1816,6 +1944,9 @@ export async function handleCardAction(data, deps, larkAppId) {
                         }
                         ds.stuckWarningProcessing = true;
                     }
+                    if (isActiveTuiCard && effectiveFinal) {
+                        ds.tuiPromptProcessing = true;
+                    }
                     // Only the stuck-warning card's Enter action re-arms the detector
                     // (Enter advances from the hook list to a per-hook review). Match by
                     // the actual keys sent — NOT by optionType, since t is typed 'confirm'
@@ -1831,11 +1962,39 @@ export async function handleCardAction(data, deps, larkAppId) {
                     const stuckNonce = isActiveStuckCard ? ds.stuckWarningNonce : undefined;
                     const stuckCliLifetime = isActiveStuckCard ? ds.stuckWarningCliLifetime : undefined;
                     const stuckPage = isActiveStuckCard ? ds.stuckWarningPageType : undefined;
-                    const effectiveFinal = isFinal || isFinalStuck;
-                    ds.worker.send({ type: 'tui_keys', keys: allKeys, isFinal: effectiveFinal, rearmStuckDetector: isStuckWarningEnter, stuckNonce, stuckCliLifetime, stuckPageType: stuckPage });
+                    const resolveText = isActiveTuiCard && ds.tuiToggledIndices?.length
+                        ? ds.tuiToggledIndices.map(i => ds.tuiPromptOptions?.[i]?.text).filter(Boolean).join(', ')
+                        : selectedText;
+                    try {
+                        await sendWorkerIpc(ds.worker, {
+                            type: 'tui_keys',
+                            keys: allKeys,
+                            isFinal: effectiveFinal,
+                            rearmStuckDetector: isStuckWarningEnter,
+                            stuckNonce,
+                            stuckCliLifetime,
+                            stuckPageType: stuckPage,
+                            cardMessageId: isActiveTuiCard ? cardMessageId : undefined,
+                            selectedText: resolveText || selectedText,
+                        });
+                        dispatchedKeys = true;
+                    }
+                    catch (err) {
+                        if (isActiveStuckCard)
+                            ds.stuckWarningProcessing = false;
+                        if (isActiveTuiCard && effectiveFinal)
+                            ds.tuiPromptProcessing = false;
+                        logger.warn(`[${tag(ds)}] TUI key IPC delivery failed: ${err instanceof Error ? err.message : String(err)}`);
+                        return {
+                            toast: {
+                                type: 'warning',
+                                content: t('card.action.tui_ipc_failed', undefined, localeForBot(ds.larkAppId)),
+                            },
+                        };
+                    }
                     logger.info(`[${tag(ds)}] TUI keys: [${allKeys.join(',')}] final=${effectiveFinal} rearmStuck=${isStuckWarningEnter} stuckNonce=${stuckNonce ?? 'none'} — "${selectedText}"`);
                 }
-                if (isFinal || isFinalStuck) {
+                if ((isFinal || isFinalStuck) && dispatchedKeys) {
                     const resolveText = isActiveTuiCard && ds.tuiToggledIndices?.length
                         ? ds.tuiToggledIndices.map(i => ds.tuiPromptOptions?.[i]?.text).filter(Boolean).join(', ')
                         : selectedText;
@@ -1844,8 +2003,9 @@ export async function handleCardAction(data, deps, larkAppId) {
                     // For a stuck-warning card, do NOT clear authority or render success
                     // here. The worker may still reject the keys (stale screen). We show a
                     // "processing" state to block duplicate clicks, and wait for the
-                    // worker's tui_keys_delivered (success) or stuck_warning_expired
-                    // ("page changed, not sent") ACK before resolving the card.
+                    // worker's tui_keys_delivered (success), stuck_warning_expired
+                    // ("page changed, not sent"), or tui_prompt_submit_failed ACK before
+                    // resolving the card.
                     if (isActiveStuckCard) {
                         if (cardMessageId) {
                             const processingCard = buildTuiPromptProcessingCard('处理中…', locDs);
@@ -1857,22 +2017,9 @@ export async function handleCardAction(data, deps, larkAppId) {
                         }
                         catch { /* fall through */ }
                     }
-                    // Normal TUI prompt card (ScreenAnalyzer): resolve immediately.
-                    if (cardMessageId) {
-                        setTimeout(() => {
-                            const resolvedCard = buildTuiPromptResolvedCard(finalText, locDs);
-                            updateMessage(ds.larkAppId, cardMessageId, resolvedCard).catch(err => logger.debug(`[${tag(ds)}] Failed to update TUI prompt card: ${err}`));
-                        }, allKeys.length * 100 + 500);
-                    }
-                    // Clear state only for the card that was actually clicked — a stuck
-                    // card click must NOT wipe the ScreenAnalyzer TUI prompt state (or
-                    // vice versa) if both coexist / race.
-                    if (cardMessageId === ds.tuiPromptCardId) {
-                        ds.tuiPromptCardId = undefined;
-                        ds.tuiPromptOptions = undefined;
-                        ds.tuiPromptMultiSelect = undefined;
-                        ds.tuiToggledIndices = undefined;
-                    }
+                    // Normal TUI prompt cards also remain in processing until the worker
+                    // confirms backend delivery via tui_prompt_resolved. A worker/backend
+                    // rejection produces tui_prompt_submit_failed instead.
                     publishAttentionPatch(ds);
                     try {
                         return JSON.parse(buildTuiPromptProcessingCard(finalText, locDs));
@@ -1882,6 +2029,14 @@ export async function handleCardAction(data, deps, larkAppId) {
             }
         }
         if (actionType === 'tui_text_input' && ds) {
+            if (isSessionTransferring(ds)) {
+                return {
+                    toast: {
+                        type: 'warning',
+                        content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)),
+                    },
+                };
+            }
             const inputTextRaw = action?.form_value?.tui_custom_input;
             const inputText = typeof inputTextRaw === 'string' ? inputTextRaw : '';
             let inputKeys = [];
@@ -1890,20 +2045,49 @@ export async function handleCardAction(data, deps, larkAppId) {
             }
             catch { /* bad json */ }
             const locDs = localeForBot(ds.larkAppId);
-            if (ds.worker && inputText && inputKeys.length > 0) {
-                // Atomic IPC — worker handles keys + text in one flow to avoid race
-                ds.worker.send({ type: 'tui_text_input', keys: inputKeys, text: inputText });
-                logger.info(`[${tag(ds)}] TUI text input: "${inputText}" (keys: ${JSON.stringify(inputKeys)})`);
-                if (cardMessageId) {
-                    const resolvedCard = buildTuiPromptResolvedCard(inputText, locDs);
-                    updateMessage(ds.larkAppId, cardMessageId, resolvedCard).catch(err => logger.debug(`[${tag(ds)}] Failed to update TUI prompt card: ${err}`));
-                }
-                ds.tuiPromptCardId = undefined;
-                ds.tuiPromptOptions = undefined;
-                publishAttentionPatch(ds);
+            const isActiveTuiCard = !!ds.tuiPromptCardId && cardMessageId === ds.tuiPromptCardId;
+            if (!isActiveTuiCard) {
+                logger.info(`[${tag(ds)}] tui_text_input from stale card ${cardMessageId} — ignored`);
+                return;
+            }
+            if (ds.tuiPromptProcessing) {
+                logger.info(`[${tag(ds)}] Duplicate TUI text input — dropped (processing already in flight)`);
+                return;
             }
+            if (!ds.worker || !inputText || inputKeys.length === 0) {
+                logger.info(`[${tag(ds)}] TUI text input not dispatched ` +
+                    `(worker=${!!ds.worker}, text=${!!inputText}, keys=${inputKeys.length})`);
+                return {
+                    toast: {
+                        type: 'warning',
+                        content: t('card.action.tui_ipc_failed', undefined, locDs),
+                    },
+                };
+            }
+            // Atomic IPC — worker handles keys + text in one flow to avoid race
+            ds.tuiPromptProcessing = true;
             try {
-                return JSON.parse(buildTuiPromptResolvedCard(inputText || t('card.action.tui_custom_input', undefined, locDs), locDs));
+                await sendWorkerIpc(ds.worker, {
+                    type: 'tui_text_input',
+                    keys: inputKeys,
+                    text: inputText,
+                    cardMessageId,
+                });
+            }
+            catch (err) {
+                ds.tuiPromptProcessing = false;
+                logger.warn(`[${tag(ds)}] TUI text IPC delivery failed: ${err instanceof Error ? err.message : String(err)}`);
+                return {
+                    toast: {
+                        type: 'warning',
+                        content: t('card.action.tui_ipc_failed', undefined, locDs),
+                    },
+                };
+            }
+            logger.info(`[${tag(ds)}] TUI text input: "${inputText}" (keys: ${JSON.stringify(inputKeys)})`);
+            publishAttentionPatch(ds);
+            try {
+                return JSON.parse(buildTuiPromptProcessingCard(inputText, locDs));
             }
             catch { /* fall through */ }
         }
@@ -1923,10 +2107,20 @@ export async function handleCardAction(data, deps, larkAppId) {
             return launchLocalCli(ds, locDs);
         }
         if (actionType === 'get_write_link' && ds && operatorOpenId) {
-            const botCfg = getBot(ds.larkAppId).config;
             const effectiveCliId = sessionCliId(ds);
             const locDs = localeForBot(ds.larkAppId);
-            if (ds.riffAccessUrl || (ds.workerPort && ds.workerToken)) {
+            if (!sessionSupportsWebTerminal(ds)) {
+                // Old cards can retain a get_write_link callback and stale port/token
+                // fields after the session is restored onto ZMX. This is a permanent
+                // backend capability boundary, not a transient startup delay.
+                const unsupportedCard = JSON.stringify({
+                    config: { wide_screen_mode: true },
+                    elements: [{ tag: 'markdown', content: t('card.action.terminal_unsupported', undefined, locDs) }],
+                });
+                await deliverEphemeralOrReply(ds, operatorOpenId, unsupportedCard, 'interactive', () => sessionReply(rootId, unsupportedCard, 'interactive'));
+                return;
+            }
+            if (sessionSupportsWebTerminal(ds) && (ds.riffAccessUrl || (ds.workerPort && ds.workerToken))) {
                 const writeUrl = buildTerminalUrl(ds, { write: true });
                 const cardJson = buildSessionCard(ds.session.sessionId, sessionAnchorId(ds), writeUrl, ds.session.title || getCliDisplayName(effectiveCliId), effectiveCliId, true, // showManageButtons — write-link card includes restart & close
                 !!ds.adoptedFrom, // adoptMode — disconnect, never close-the-CLI
@@ -1973,13 +2167,13 @@ export async function handleCardAction(data, deps, larkAppId) {
                     const next = nextMode(cur);
                     ds.displayMode = next;
                     persistStreamCardState(ds);
-                    if (ds.worker) {
-                        ds.worker.send({ type: 'set_display_mode', mode: next });
+                    if (ds.worker || isSessionTransferring(ds)) {
+                        sendWorkerSessionInput(ds, { type: 'set_display_mode', mode: next });
                     }
-                    if (cardMessageId && ds.workerPort) {
-                        const readUrl = buildTerminalUrl(ds);
+                    if (cardMessageId && workerHasInitialized(ds)) {
+                        const readUrl = readableTerminalUrlFor(ds);
                         const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                        const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, next, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                        const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, next, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
                         updateMessage(ds.larkAppId, cardMessageId, cardJson).catch(err => logger.debug(`[${tag(ds)}] Failed to migrate unknown frozen card: ${err}`));
                         logger.info(`[${tag(ds)}] Migrated unknown frozen card to ${next} (legacy nonce=${clickedNonce})`);
                         try {
@@ -2000,13 +2194,13 @@ export async function handleCardAction(data, deps, larkAppId) {
                 const next = nextMode(cur);
                 ds.displayMode = next;
                 persistStreamCardState(ds);
-                if (ds.worker) {
-                    ds.worker.send({ type: 'set_display_mode', mode: next });
+                if (ds.worker || isSessionTransferring(ds)) {
+                    sendWorkerSessionInput(ds, { type: 'set_display_mode', mode: next });
                 }
                 const effectiveCliId = sessionCliId(ds);
-                const readUrl = ds.workerPort ? buildTerminalUrl(ds) : '';
+                const readUrl = readableTerminalUrlFor(ds);
                 const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, next, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, next, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
                 updateMessage(ds.larkAppId, frozen.messageId, cardJson).catch(err => logger.debug(`[${tag(ds)}] Failed to migrate frozen card: ${err}`));
                 ds.frozenCards.delete(clickedNonce);
                 saveFrozenCards(ds.session.sessionId, ds.frozenCards);
@@ -2024,13 +2218,13 @@ export async function handleCardAction(data, deps, larkAppId) {
             const next = nextMode(cur);
             ds.displayMode = next;
             persistStreamCardState(ds);
-            if (ds.worker) {
-                ds.worker.send({ type: 'set_display_mode', mode: next });
+            if (ds.worker || isSessionTransferring(ds)) {
+                sendWorkerSessionInput(ds, { type: 'set_display_mode', mode: next });
             }
-            if (ds.streamCardId && ds.workerPort) {
-                const readUrl = buildTerminalUrl(ds);
+            if (ds.streamCardId && workerHasInitialized(ds)) {
+                const readUrl = readableTerminalUrlFor(ds);
                 const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, next, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, next, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
                 if (cardMessageId && cardMessageId !== ds.streamCardId) {
                     updateMessage(ds.larkAppId, cardMessageId, cardJson).catch(err => logger.debug(`[${tag(ds)}] Failed to migrate clicked legacy card: ${err}`));
                 }
@@ -2069,19 +2263,19 @@ export async function handleCardAction(data, deps, larkAppId) {
         }
         // Manual screenshot refresh — force immediate capture bypassing 10s interval + hash dedup.
         if (actionType === 'refresh_screenshot' && ds) {
-            if (ds.worker) {
-                ds.worker.send({ type: 'refresh_screen' });
+            if (ds.worker || isSessionTransferring(ds)) {
+                sendWorkerSessionInput(ds, { type: 'refresh_screen' });
                 logger.info(`[${tag(ds)}] Manual screenshot refresh`);
             }
             // Return the current card JSON so Feishu doesn't revert the displayed
             // image to the originally-POSTed initial frame while waiting for the
             // fresh screenshot PATCH (~1s).
-            if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL && ds.workerPort) {
+            if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL && workerHasInitialized(ds)) {
                 const botCfg = getBot(ds.larkAppId).config;
                 const effectiveCliId = sessionCliId(ds);
-                const readUrl = buildTerminalUrl(ds);
+                const readUrl = readableTerminalUrlFor(ds);
                 const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, ds.displayMode ?? 'screenshot', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, ds.displayMode ?? 'screenshot', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
                 if (cardMessageId && cardMessageId !== ds.streamCardId) {
                     updateMessage(ds.larkAppId, cardMessageId, cardJson).catch(err => logger.debug(`[${tag(ds)}] Failed to migrate clicked legacy card: ${err}`));
                 }
@@ -2094,19 +2288,27 @@ export async function handleCardAction(data, deps, larkAppId) {
         }
         // Quick-action keys (Esc, ^C, Tab, Space, Enter, ←↑↓→, ½ page) — forward to worker.
         if (actionType === 'term_action' && ds) {
+            if (isSessionTransferring(ds)) {
+                return {
+                    toast: {
+                        type: 'warning',
+                        content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)),
+                    },
+                };
+            }
             const key = value?.key;
             if (!key)
                 return;
             if (ds.worker) {
-                ds.worker.send({ type: 'term_action', key });
+                sendWorkerSessionInput(ds, { type: 'term_action', key });
                 logger.info(`[${tag(ds)}] term_action: ${key}`);
             }
-            if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL && ds.workerPort) {
+            if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL && workerHasInitialized(ds)) {
                 const botCfg = getBot(ds.larkAppId).config;
                 const effectiveCliId = sessionCliId(ds);
-                const readUrl = buildTerminalUrl(ds);
+                const readUrl = readableTerminalUrlFor(ds);
                 const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, ds.displayMode ?? 'screenshot', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent || '', ds.lastScreenStatus || 'working', effectiveCliId, ds.displayMode ?? 'screenshot', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
                 try {
                     return JSON.parse(cardJson);
                 }
@@ -2261,6 +2463,10 @@ export async function handleCardAction(data, deps, larkAppId) {
         const ds = activeSessions.get(sKey);
         if (!ds)
             return;
+        const sourceSession = ds.session;
+        if (isSessionTransferring(ds)) {
+            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
+        }
         if (!canOperate(ds.larkAppId, ds.chatId, operatorOpenId)) {
             logger.info(`codex_app_thread_select blocked for non-operator user: ${operatorOpenId} (chat=${ds.chatId})`);
             return { toast: { type: 'error', content: t('card.grant.toast_no_repo_perm', undefined, localeForBot(ds.larkAppId)) } };
@@ -2290,6 +2496,12 @@ export async function handleCardAction(data, deps, larkAppId) {
             await sessionReply(rootId, t('cmd.codex_app_adopt.list_failed', { error: err?.message ?? String(err) }, localeForBot(ds.larkAppId)));
             return;
         }
+        if (ds.session !== sourceSession
+            || ds.session.status !== 'active'
+            || activeSessions.get(sKey) !== ds
+            || isSessionTransferring(ds)) {
+            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
+        }
         const target = threads.find(t => t.threadId === selected.threadId);
         if (!target) {
             await sessionReply(rootId, t('cmd.codex_app_adopt.thread_not_found', { threadId: selected.threadId }, localeForBot(ds.larkAppId)));
@@ -2311,6 +2523,10 @@ export async function handleCardAction(data, deps, larkAppId) {
         const ds = activeSessions.get(sKey);
         if (!ds)
             return;
+        const sourceSession = ds.session;
+        if (isSessionTransferring(ds)) {
+            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
+        }
         // /adopt 是管理动作：下拉入口同样要求 canOperate（命令路径已在 daemon 层 gate）。
         if (!canOperate(ds.larkAppId, ds.chatId, operatorOpenId)) {
             logger.info(`adopt_select blocked for non-operator user: ${operatorOpenId} (chat=${ds.chatId})`);
@@ -2375,6 +2591,12 @@ export async function handleCardAction(data, deps, larkAppId) {
             await new Promise(r => setTimeout(r, 150));
             target = await resolveAdoptTarget();
         }
+        if (ds.session !== sourceSession
+            || ds.session.status !== 'active'
+            || activeSessions.get(sKey) !== ds
+            || isSessionTransferring(ds)) {
+            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
+        }
         if (!target) {
             await sessionReply(rootId, t('cmd.adopt.target_exited', undefined, localeForBot(ds.larkAppId)));
             if (cardMessageId && larkAppId)
@@ -2398,6 +2620,10 @@ export async function handleCardAction(data, deps, larkAppId) {
         const ds = activeSessions.get(sKey);
         if (!ds)
             return;
+        const sourceSession = ds.session;
+        if (isSessionTransferring(ds)) {
+            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
+        }
         if (!canOperate(ds.larkAppId, ds.chatId, operatorOpenId)) {
             logger.info(`adopt_resume_select blocked for non-operator user: ${operatorOpenId} (chat=${ds.chatId})`);
             return { toast: { type: 'error', content: t('card.grant.toast_no_repo_perm', undefined, localeForBot(ds.larkAppId)) } };
@@ -2416,6 +2642,12 @@ export async function handleCardAction(data, deps, larkAppId) {
         const botCfg = getBot(ds.larkAppId).config;
         const { discoverResumableSessionsForBot, startResumeImportSession } = await import('../../core/command-handler.js');
         const resumable = await discoverResumableSessionsForBot(botCfg.cliId, botCfg.cliPathOverride, activeSessions);
+        if (ds.session !== sourceSession
+            || ds.session.status !== 'active'
+            || activeSessions.get(sKey) !== ds
+            || isSessionTransferring(ds)) {
+            return { toast: { type: 'warning', content: t('cmd.session.transfer_in_progress', undefined, localeForBot(ds.larkAppId)) } };
+        }
         const target = resumable.find(r => r.cliSessionId === selected.cliSessionId);
         if (!target) {
             await sessionReply(rootId, t('cmd.adopt.resume_not_found', { id: selected.cliSessionId }, localeForBot(ds.larkAppId)));