chatccc 0.2.267 → 0.2.269

package/dist/src/cards.js

@@ -143,7 +143,10 @@ export function buildHelpCard(userText, opts = {}) {
         "发送 **/ask** 以问答模式提问（只读，不执行写操作）",
         "发送 **/usage** 查看当前 Agent 的用量或余额",
         "发送 **/restart** 重启 ChatCCC 进程",
+        "发送 **/restart safe** 等待现有任务完成后安全重启",
         "发送 **/update** 更新并重启（仅 npm 全局安装可用）",
+        "发送 **/update safe** 等待现有任务完成后安全更新",
+        "发送 **/safestatus** 查看安全维护状态，**/cancelsf** 取消等待中的预约",
         ABD_HELP_LINE,
     ].join("\n");
     return JSON.stringify({

package/dist/src/engines/engine-manager.js

@@ -4,6 +4,7 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { delimiter, dirname, join, relative, resolve } from "node:path";
+import { isSafeMaintenanceAdmissionClosed } from "../safe-maintenance.js";
 const STEP_DEFINITIONS = [
     ["preflight", "检查运行环境"],
     ["prepare", "准备临时目录"],
@@ -100,6 +101,9 @@ export class EngineManager {
     listSpecs() {
         return [...this.specs.values()];
     }
+    getActiveInstallIds() {
+        return [...this.activeInstalls.keys()].sort();
+    }
     getSpec(engineId) {
         const spec = this.specs.get(engineId);
         if (!spec)
@@ -133,6 +137,9 @@ export class EngineManager {
         const running = this.activeInstalls.get(engineId);
         if (running)
             return this.readJob(this.getSpec(engineId)).then((job) => job ?? this.newJob(this.getSpec(engineId)));
+        if (isSafeMaintenanceAdmissionClosed()) {
+            throw new Error("ChatCCC 正在等待安全维护，暂不接受新的依赖安装任务。");
+        }
         const spec = this.getSpec(engineId);
         const job = this.newJob(spec);
         await this.persistJob(spec, job);

package/dist/src/execution-transcript.js

@@ -0,0 +1,110 @@
+export function appendExecutionTranscriptBlock(block, state, at = new Date().toISOString()) {
+    switch (block.type) {
+        case "text_reset":
+            state.transcript = [];
+            return;
+        case "text":
+            appendText(state, block.text, at);
+            return;
+        case "text_final":
+            // Some adapters emit both deltas and an authoritative final snapshot. Keep the
+            // ordered deltas when present, otherwise retain the snapshot as the full reply.
+            if (!state.transcript.some((entry) => entry.type === "text"))
+                appendText(state, block.text, at);
+            return;
+        case "thinking":
+            appendEntry(state, { type: "thinking", at, text: block.thinking });
+            return;
+        case "tool_use":
+            appendEntry(state, {
+                type: "tool_use",
+                at,
+                name: block.name,
+                ...(block.id ? { toolUseId: block.id } : {}),
+                input: stringifyTranscriptValue(block.input),
+            });
+            return;
+        case "tool_result":
+            appendEntry(state, {
+                type: "tool_result",
+                at,
+                ...(findToolName(state.transcript, block.tool_use_id) ? { name: findToolName(state.transcript, block.tool_use_id) } : {}),
+                toolUseId: block.tool_use_id,
+                output: stringifyTranscriptValue(block.content),
+                ...(block.is_error !== undefined ? { isError: block.is_error } : {}),
+            });
+            return;
+        case "search_result":
+            appendEntry(state, { type: "search", at, text: block.query });
+            return;
+        case "compact_boundary":
+            appendEntry(state, {
+                type: "compact",
+                at,
+                text: `${block.trigger === "manual" ? "手动" : "自动"}压缩：${block.pre_tokens} → ${block.post_tokens ?? "?"} tokens`,
+            });
+            return;
+        case "agent_status": {
+            const text = block.status === "compacting" ? "正在压缩上下文" : "正在生成回复";
+            const previous = state.transcript.at(-1);
+            if (previous?.type !== "status" || previous.text !== text)
+                appendEntry(state, { type: "status", at, text });
+            return;
+        }
+        case "redacted_thinking":
+            appendEntry(state, { type: "notice", at, text: "部分思考内容已被安全过滤" });
+            return;
+        case "agent_progress":
+            // Heartbeats carry no content and can occur very frequently. Persisting them
+            // would add noise without helping users reconstruct what happened.
+            return;
+    }
+}
+export function isExecutionTranscriptEntry(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const entry = value;
+    const types = [
+        "prompt", "thinking", "text", "tool_use", "tool_result", "search", "compact", "status", "notice",
+    ];
+    if (!types.includes(entry.type) || typeof entry.at !== "string")
+        return false;
+    for (const field of ["text", "name", "toolUseId", "input", "output"]) {
+        if (entry[field] !== undefined && typeof entry[field] !== "string")
+            return false;
+    }
+    return entry.isError === undefined || typeof entry.isError === "boolean";
+}
+function findToolName(entries, toolUseId) {
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry?.type === "tool_use" && entry.toolUseId === toolUseId)
+            return entry.name;
+    }
+    return undefined;
+}
+function appendText(state, text, at) {
+    if (!text)
+        return;
+    const previous = state.transcript.at(-1);
+    if (previous?.type === "text") {
+        previous.text = (previous.text ?? "") + text;
+        return;
+    }
+    appendEntry(state, { type: "text", at, text });
+}
+function appendEntry(state, entry) {
+    state.transcript.push(entry);
+}
+function stringifyTranscriptValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (value === undefined)
+        return "";
+    try {
+        return JSON.stringify(value, null, 2);
+    }
+    catch {
+        return String(value);
+    }
+}

package/dist/src/im-skills.js

@@ -56,8 +56,8 @@ function promptCacheKey(input) {
     const names = input.enabledSkillNames
         ? [...input.enabledSkillNames].sort().join(",")
         : "*";
-    const { session_id, cwd } = input.variables;
-    return `${input.skillsDir ?? DEFAULT_IM_SKILLS_DIR}|${names}|${session_id}|${cwd}`;
+    const { session_id, cwd, open_id } = input.variables;
+    return `${input.skillsDir ?? DEFAULT_IM_SKILLS_DIR}|${names}|${session_id}|${cwd}|${open_id}`;
 }
 /** 带会话级缓存的 buildImSkillsPrompt。同 session + 同 cwd 时直接返回缓存的渲染结果。 */
 export async function buildImSkillsPromptCached(input) {

package/dist/src/index.js

@@ -40,6 +40,7 @@ import { handleAgentFileRequest } from "./agent-file-rpc.js";
 import { handleAgentDelegateTaskRequest } from "./agent-delegate-task-rpc.js";
 import { handleAgentStopStuckRequest } from "./agent-stop-stuck.js";
 import { handleAgentReloadConfigRequest } from "./agent-reload-config-rpc.js";
+import { handleAgentSetCwdRequest } from "./agent-set-cwd-rpc.js";
 import { handleChatGptSubscriptionRequest } from "./chatgpt-subscription-rpc.js";
 import { applyPrivacy } from "./privacy.js";
 import { createCardKitCard, sendCardKitMessage, updateCardKitCard, } from "./cardkit.js";
@@ -47,7 +48,7 @@ import { loadSessionRegistryForBinding, rebuildBindingsFromRegistry, resetState,
 import { startChromeDevtoolsGuard, stopChromeDevtoolsGuard } from "./chrome-devtools-guard.js";
 import { rebuildSessionChatsFromRegistry, setQueueConsumer, } from "./session-chat-binding.js";
 import { fixStaleStreamStates } from "./stream-state.js";
-import { handleCommand } from "./orchestrator.js";
+import { configureSafeMaintenanceRuntime, handleCommand, recoverSafeMaintenanceAfterStartup, } from "./orchestrator.js";
 import { createWechatAdapter, startWechatPlatform } from "./wechat-platform.js";
 import { handleCodexResetCardAction } from "./codex-reset-actions.js";
 import { resolveFeishuCardActionChatType } from "./card-action-routing.js";
@@ -103,11 +104,12 @@ function createFeishuAdapter() {
 }
 const feishuPlatform = createFeishuAdapter();
 const wechatPlatform = createWechatAdapter();
+configureSafeMaintenanceRuntime([feishuPlatform, wechatPlatform]);
 setSessionPlatform(feishuPlatform);
 configureAgentTeamMainAgent(feishuPlatform);
 // 注册队列消费回调：session 生成完成后自动处理缓存消息
 setQueueConsumer((platform, msg) => {
-    handleCommand(platform, msg.text, msg.chatId, msg.openId, msg.msgTimestamp, msg.chatType, msg.traceId).catch(err => console.error(`[${ts()}] Queue consume failed: ${err.message}`));
+    handleCommand(platform, msg.text, msg.chatId, msg.openId, msg.msgTimestamp, msg.chatType, msg.traceId, undefined, true).catch(err => console.error(`[${ts()}] Queue consume failed: ${err.message}`));
 });
 function getInnerEvent(data) {
     return (data.event ?? data);
@@ -560,6 +562,7 @@ async function main() {
             if (injected)
                 return true;
             return (await handleAgentReloadConfigRequest(req, res))
+                || (await handleAgentSetCwdRequest(req, res))
                 || (await handleAgentImageRequest(req, res))
                 || (await handleAgentFileRequest(req, res))
                 || (await handleAgentDelegateTaskRequest(req, res, feishuPlatform))
@@ -596,6 +599,7 @@ async function main() {
             appendStartupTrace(opened ? "web-ui: opening simulate browser" : "web-ui: simulate browser unavailable", { url });
         }
         installShutdownHandlers(simServer, serviceLifecycle);
+        await recoverSafeMaintenanceAfterStartup();
         return;
     }
     if (Number.isNaN(CHATCCC_PORT) || CHATCCC_PORT < 1 || CHATCCC_PORT > 65535) {
@@ -620,6 +624,7 @@ async function main() {
     });
     setExtraApiHandler(async (req, res) => {
         return (await handleAgentReloadConfigRequest(req, res))
+            || (await handleAgentSetCwdRequest(req, res))
             || (await handleAgentImageRequest(req, res))
             || (await handleAgentFileRequest(req, res))
             || (await handleAgentDelegateTaskRequest(req, res, feishuPlatform))
@@ -647,6 +652,7 @@ async function main() {
                     });
                     try {
                         await startConfiguredPlatforms(httpServer, { failOnFeishuError: true });
+                        await recoverSafeMaintenanceAfterStartup();
                         return { ok: true };
                     }
                     catch (err) {
@@ -714,6 +720,7 @@ async function main() {
         });
     }
     await startConfiguredPlatforms(httpServer, { failOnFeishuError: false });
+    await recoverSafeMaintenanceAfterStartup();
 }
 /**
  * 生命周期健康检查发现 HTTP Server 已停止监听时，优先原地恢复同一个 Server。

package/dist/src/orchestrator.js

@@ -17,7 +17,7 @@ import { CLAUDE_MODEL, GIT_TIMEOUT_MS, PROJECT_ROOT, anthropicConfigDisplay, con
 import { buildHelpCard, buildEffortCard, buildFastModeCard, buildModelCard, buildStatusCard, buildCdContent, buildCdCard, buildSessionsCard, buildQueuedCard, buildQueueFullCard, buildCodexUsageCard, } from "./cards.js";
 import { formatGitResult, gitResultHeaderTemplate, runGitCommand, } from "./git-command.js";
 import { clearSessionModelOverride, clearSessionEffortOverride, getSessionStatus, getAllSessionsStatus, initClaudeSession, lastMsgTimestamps, resumeAndPrompt, sessionInfoMap, setSessionModelOverride, setSessionEffortOverride, switchChatBinding, recordSessionRegistry, getAdapterForTool, getEffectiveModelForTool, getEffectiveEffortForTool, getEffectiveFastModeForTool, setSessionFastModeOverride, stopSession, loadSessionRegistryForBinding, removeSessionRegistryRecord, saveSessionTool, recordChatPlatform, } from "./session.js";
-import { bindChatToSession, unbindChatFromSession, isSessionRunning, displayCards, enqueueMessage, cancelQueuedMessage, } from "./session-chat-binding.js";
+import { bindChatToSession, unbindChatFromSession, isSessionRunning, displayCards, enqueueMessage, cancelQueuedMessage, getSessionDrainSnapshot, } from "./session-chat-binding.js";
 import { getCodexUsageSummary, getTenantAccessToken, sendPostMessage } from "./feishu-platform.js";
 import { getCursorUsageSummary } from "./cursor-usage.js";
 import { getChatGptSubscriptionStatus } from "./chatgpt-subscription.js";
@@ -25,8 +25,10 @@ import { applySharedPrefix } from "./shared-prefix.js";
 import { sessionChatName } from "./session-name.js";
 import { reloadRuntimeConfig } from "./runtime-reload.js";
 import { acquireUpdateCommandGuard } from "./update-command-guard.js";
-import { createInternalRestartEnv } from "./startup-lifecycle.js";
+import { createInternalRestartEnv, INTERNAL_RESTART_ENV_VAR } from "./startup-lifecycle.js";
 import { resolveChatCccRuntimeSpawnSpec } from "./runtime-entry.js";
+import { engineManager } from "./engines/engine-specs.js";
+import { beginSafeMaintenanceTrackedWork, isSafeMaintenanceAdmissionClosed, safeMaintenanceCoordinator, } from "./safe-maintenance.js";
 import { feishuP2pContactStore, isValidFeishuOpenId, } from "./agent-team/repositories/feishu-p2p-contact-store.js";
 // ---------------------------------------------------------------------------
 // 辅助函数
@@ -577,10 +579,11 @@ function updLog(msg) {
     catch { }
 }
 /** 同步更新 npm 全局包并 spawn 新进程重启。不依赖 systemd 或任何服务管理器。 */
-function syncUpdateAndRestart() {
+function syncUpdateAndRestart(options = {}) {
     updLog(`sync update start, pid=${process.pid}`);
     appendStartupTrace("update: sync update start", { pid: process.pid });
     const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
+    let updateSucceeded = false;
     // 1. npm update
     updLog(`running: ${npmCmd} update -g chatccc`);
     appendStartupTrace("update: npm update begin", { npmCmd });
@@ -590,6 +593,7 @@ function syncUpdateAndRestart() {
         const elapsed = Date.now() - t0;
         updLog(`npm update OK (${elapsed}ms): ${out.slice(0, 500)}`);
         appendStartupTrace("update: npm update OK", { elapsedMs: elapsed, outputLen: out.length });
+        updateSucceeded = true;
     }
     catch (e) {
         const elapsed = Date.now() - t0;
@@ -605,6 +609,7 @@ function syncUpdateAndRestart() {
             const elapsed2 = Date.now() - t1;
             updLog(`npm install fallback OK (${elapsed2}ms): ${out2.slice(0, 500)}`);
             appendStartupTrace("update: npm install fallback OK", { elapsedMs: elapsed2, outputLen: out2.length });
+            updateSucceeded = true;
         }
         catch (e2) {
             const elapsed2 = Date.now() - t1;
@@ -613,6 +618,11 @@ function syncUpdateAndRestart() {
             appendStartupTrace("update: npm install fallback failed", { elapsedMs: elapsed2, message: err2.message });
         }
     }
+    if (!updateSucceeded && options.spawnOnUpdateFailure === false) {
+        updLog("safe update aborted: both npm update and fallback install failed");
+        appendStartupTrace("update: safe update aborted before restart", {});
+        return undefined;
+    }
     // 2. resolve bin path
     const npmPrefix = process.env.NPM_PREFIX || "";
     const binName = process.platform === "win32" ? "chatccc.cmd" : "chatccc";
@@ -771,15 +781,106 @@ export async function decideRestartParentExit(child, timeoutMs, pollMs = 500, tr
     trace("restart: child alive after window, parent exiting", { childPid: child.pid });
     return true;
 }
+const safeMaintenancePlatforms = new Map();
+export function configureSafeMaintenanceRuntime(platforms) {
+    safeMaintenancePlatforms.clear();
+    for (const platform of platforms) {
+        if (platform.kind)
+            safeMaintenancePlatforms.set(platform.kind, platform);
+    }
+    safeMaintenanceCoordinator.configure({
+        getSnapshot() {
+            const sessions = getSessionDrainSnapshot();
+            return {
+                ...sessions,
+                activeEngineIds: engineManager.getActiveInstallIds(),
+                activeWorkLabels: [],
+            };
+        },
+        execute(kind) {
+            return kind === "update" ? executeSafeUpdate() : executeSafeRestart();
+        },
+        async notify(requester, message) {
+            const platform = safeMaintenancePlatforms.get(requester.platform);
+            if (!platform)
+                throw new Error(`Unavailable platform: ${requester.platform}`);
+            await platform.sendText(requester.chatId, message);
+        },
+    });
+}
+export function recoverSafeMaintenanceAfterStartup() {
+    return safeMaintenanceCoordinator.recoverAfterStartup(process.env[INTERNAL_RESTART_ENV_VAR] === "1");
+}
+async function executeSafeRestart() {
+    fileLog.flush();
+    appendStartupTrace("safe-maintenance: restart spawn begin", { fromPid: process.pid });
+    const child = spawnRestartChild();
+    child.unref();
+    const shouldExit = await decideRestartParentExit(child, RESTART_CHILD_READY_MS);
+    if (!shouldExit)
+        return false;
+    appendStartupTrace("safe-maintenance: restart parent exit", { childPid: child.pid });
+    process.exit(0);
+}
+async function executeSafeUpdate() {
+    fileLog.flush();
+    appendStartupTrace("safe-maintenance: update begin", { fromPid: process.pid });
+    const child = syncUpdateAndRestart({ spawnOnUpdateFailure: false });
+    if (!child)
+        return false;
+    child.unref();
+    const shouldExit = await decideRestartParentExit(child, RESTART_CHILD_READY_MS);
+    if (!shouldExit)
+        return false;
+    appendStartupTrace("safe-maintenance: update parent exit", { childPid: child.pid });
+    process.exit(0);
+}
+function safeMaintenanceRequester(platform, chatId, openId) {
+    return { platform: platform.kind ?? "feishu", chatId, openId };
+}
+function safeMaintenancePhaseLabel(phase) {
+    const labels = {
+        draining: "等待现有任务结束",
+        executing: "正在执行维护",
+        completed: "已完成",
+        failed: "执行失败",
+    };
+    return labels[phase] ?? phase;
+}
+async function safeMaintenanceStatusText() {
+    const status = await safeMaintenanceCoordinator.status();
+    if (!status.job)
+        return "当前没有安全维护预约。";
+    const snapshot = status.snapshot;
+    return [
+        `安全维护：${status.job.kind === "update" ? "更新并重启" : "重启"}`,
+        `状态：${safeMaintenancePhaseLabel(status.job.phase)}`,
+        `执行中/收尾会话：${snapshot.activeSessionIds.length}`,
+        `已接受的缓存消息：${snapshot.queuedSessionIds.length}`,
+        `依赖安装任务：${snapshot.activeEngineIds.length}`,
+        `其他处理中入口：${Math.max(0, snapshot.activeWorkLabels.length - 1)}`,
+        ...(status.job.lastError ? [`错误：${status.job.lastError}`] : []),
+    ].join("\n");
+}
 // ---------------------------------------------------------------------------
 // handleCommand — 平台无关的命令分发
 // ---------------------------------------------------------------------------
-export async function handleCommand(platform, text, chatId, openId, msgTimestamp, chatType = "group", traceId, commandId) {
+export async function handleCommand(platform, text, chatId, openId, msgTimestamp, chatType = "group", traceId, commandId, acceptedBeforeSafeMaintenance = false) {
+    const release = beginSafeMaintenanceTrackedWork(acceptedBeforeSafeMaintenance ? "accepted-queued-message" : "chat-command");
+    try {
+        await handleCommandInternal(platform, text, chatId, openId, msgTimestamp, chatType, traceId, commandId, acceptedBeforeSafeMaintenance);
+    }
+    finally {
+        release();
+    }
+}
+async function handleCommandInternal(platform, text, chatId, openId, msgTimestamp, chatType = "group", traceId, commandId, acceptedBeforeSafeMaintenance = false) {
     const tid = traceId ?? makeTraceId();
     const sharedPrefix = applySharedPrefix(text);
     const promptText = sharedPrefix.text;
     text = sharedPrefix.body;
     const textLower = text.toLowerCase();
+    const normalizedCommandText = textLower.trim().replace(/\s+/g, " ");
     const isCommandText = !sharedPrefix.matched && textLower.startsWith("/");
     recordChatPlatform(chatId, platform);
     if (platform.kind === "feishu" && chatType === "p2p" && isValidFeishuOpenId(openId)) {
@@ -788,6 +889,77 @@ export async function handleCommand(platform, text, chatId, openId, msgTimestamp
             console.error(`[${ts()}] [AGENT-TEAM] Failed to remember Feishu private contact: ${err.message}`);
         });
     }
+    if (isCommandText && normalizedCommandText === "/safestatus") {
+        logTrace(tid, "BRANCH", { cmd: "/safestatus" });
+        await platform.sendText(chatId, await safeMaintenanceStatusText()).catch(() => { });
+        logTrace(tid, "DONE", { outcome: "safe_maintenance_status" });
+        return;
+    }
+    if (isCommandText && normalizedCommandText === "/cancelsf") {
+        logTrace(tid, "BRANCH", { cmd: "/cancelsf" });
+        const canceled = await safeMaintenanceCoordinator.cancel();
+        if (!canceled) {
+            await platform.sendText(chatId, "当前没有可取消的安全维护预约；已经开始执行的维护也不能取消。").catch(() => { });
+        }
+        logTrace(tid, "DONE", { outcome: canceled ? "safe_maintenance_canceled" : "safe_maintenance_cancel_unavailable" });
+        return;
+    }
+    if (isCommandText && normalizedCommandText === "/restart safe") {
+        logTrace(tid, "BRANCH", { cmd: "/restart safe" });
+        try {
+            const job = await safeMaintenanceCoordinator.schedule("restart", safeMaintenanceRequester(platform, chatId, openId));
+            await platform.sendText(chatId, job.phase === "executing"
+                ? "安全维护已经开始执行，无法重复预约。"
+                : job.kind === "update"
+                    ? "已经存在优先级更高的安全更新预约，将继续等待现有任务完成。发送 /safestatus 查看状态，/cancelsf 取消预约。"
+                    : "已预约安全重启。现有会话、缓存消息和依赖安装会先自然完成；现在起不再接受新的普通任务。发送 /safestatus 查看状态，/cancelsf 取消预约。").catch(() => { });
+            logTrace(tid, "DONE", { outcome: "safe_restart_scheduled", jobId: job.jobId });
+        }
+        catch (error) {
+            await platform.sendText(chatId, `安全重启预约失败：${error.message}`).catch(() => { });
+            logTrace(tid, "DONE", { outcome: "safe_restart_schedule_failed", error: error.message });
+        }
+        return;
+    }
+    if (isCommandText && normalizedCommandText === "/update safe") {
+        logTrace(tid, "BRANCH", { cmd: "/update safe" });
+        const isGlobal = isRunningFromGlobalNpm();
+        if (!isGlobal) {
+            await platform.sendText(chatId, "当前进程非 npm 全局安装，无法使用 /update safe。请通过 npm install -g chatccc 安装后使用。").catch(() => { });
+            logTrace(tid, "DONE", { outcome: "safe_update_not_global" });
+            return;
+        }
+        const updateGuard = acquireUpdateCommandGuard({ commandId });
+        if (!updateGuard.allowed) {
+            if (updateGuard.reason !== "duplicate_id") {
+                await platform.sendText(chatId, "无法写入更新保护状态。为避免连续更新和重启，本次 /update safe 未预约。").catch(() => { });
+            }
+            logTrace(tid, "DONE", { outcome: updateGuard.reason === "duplicate_id" ? "safe_update_duplicate_id" : "safe_update_guard_failed" });
+            return;
+        }
+        try {
+            const job = await safeMaintenanceCoordinator.schedule("update", safeMaintenanceRequester(platform, chatId, openId));
+            await platform.sendText(chatId, job.phase === "executing"
+                ? "安全维护已经开始执行，无法重复预约。"
+                : "已预约安全更新。现有会话、缓存消息和依赖安装会先自然完成；现在起不再接受新的普通任务。发送 /safestatus 查看状态，/cancelsf 取消预约。").catch(() => { });
+            logTrace(tid, "DONE", { outcome: "safe_update_scheduled", jobId: job.jobId });
+        }
+        catch (error) {
+            await platform.sendText(chatId, `安全更新预约失败：${error.message}`).catch(() => { });
+            logTrace(tid, "DONE", { outcome: "safe_update_schedule_failed", error: error.message });
+        }
+        return;
+    }
+    const maintenanceAllowedCommands = new Set([
+        "/stop", "/cancel", "/state", "/sessions", "/usage", "/safestatus", "/cancelsf", "/restart", "/update", "/reload", "/help",
+    ]);
+    if (isSafeMaintenanceAdmissionClosed()
+        && !acceptedBeforeSafeMaintenance
+        && (!isCommandText || !maintenanceAllowedCommands.has(normalizedCommandText))) {
+        await platform.sendText(chatId, "ChatCCC 正在等待安全重启或更新，当前不接受新的任务。请在维护完成后重新发送；可用 /safestatus 查看状态。").catch(() => { });
+        logTrace(tid, "DONE", { outcome: "safe_maintenance_admission_closed" });
+        return;
+    }
     if (isCommandText && textLower === "/reload") {
         logTrace(tid, "BRANCH", { cmd: "/reload" });
         try {
@@ -808,6 +980,14 @@ export async function handleCommand(platform, text, chatId, openId, msgTimestamp
     }
     if (isCommandText && textLower === "/restart") {
         logTrace(tid, "BRANCH", { cmd: "/restart" });
+        const safeStatus = await safeMaintenanceCoordinator.status();
+        if (safeStatus.job?.phase === "executing") {
+            await platform.sendText(chatId, "安全维护已经开始执行，请勿重复重启。").catch(() => { });
+            logTrace(tid, "DONE", { outcome: "restart_blocked_by_executing_safe_maintenance" });
+            return;
+        }
+        if (safeStatus.job?.phase === "draining")
+            await safeMaintenanceCoordinator.cancel(false);
         await platform.sendText(chatId, "重启中...请几秒后发消息唤醒我").catch(() => { });
         logTrace(tid, "DONE", { outcome: "restart" });
         appendStartupTrace("restart: spawn begin", { fromPid: process.pid });
@@ -825,6 +1005,12 @@ export async function handleCommand(platform, text, chatId, openId, msgTimestamp
     }
     if (isCommandText && textLower === "/update") {
         logTrace(tid, "BRANCH", { cmd: "/update" });
+        const safeStatus = await safeMaintenanceCoordinator.status();
+        if (safeStatus.job?.phase === "executing") {
+            await platform.sendText(chatId, "安全维护已经开始执行，请勿重复更新。").catch(() => { });
+            logTrace(tid, "DONE", { outcome: "update_blocked_by_executing_safe_maintenance" });
+            return;
+        }
         const isGlobal = isRunningFromGlobalNpm();
         appendStartupTrace("update: command received", { isGlobal, chatId });
         if (!isGlobal) {
@@ -851,6 +1037,8 @@ export async function handleCommand(platform, text, chatId, openId, msgTimestamp
             logTrace(tid, "DONE", { outcome: "update_guard_write_failed" });
             return;
         }
+        if (safeStatus.job?.phase === "draining")
+            await safeMaintenanceCoordinator.cancel(false);
         await platform.sendText(chatId, "正在更新并重启，请稍候...").catch(() => { });
         logTrace(tid, "DONE", { outcome: "update" });
         appendStartupTrace("update: sync update begin", { fromPid: process.pid });
@@ -1902,7 +2090,7 @@ export async function handleCommand(platform, text, chatId, openId, msgTimestamp
         }
         try {
             logTrace(tid, "RESUME", { sessionId, tool: descriptionTool });
-            const resumeOutcome = await resumeAndPrompt(sessionId, promptText, platform, chatId, msgTimestamp, descriptionTool, tid);
+            const resumeOutcome = await resumeAndPrompt(sessionId, promptText, platform, chatId, msgTimestamp, descriptionTool, tid, openId);
             if (resumeOutcome === "error") {
                 logTrace(tid, "DONE", { outcome: "resume_error", sessionId });
                 console.error(`[${ts()}] [RESUME] Session ${sessionId} ended with an Agent error`);
@@ -2081,7 +2269,7 @@ export async function handleCommand(platform, text, chatId, openId, msgTimestamp
             if (!switchResult.ok) {
                 throw switchResult.error ?? new Error("Failed to bind Feishu private session");
             }
-            await resumeAndPrompt(sessionId, promptText, platform, chatId, msgTimestamp, tool, tid);
+            await resumeAndPrompt(sessionId, promptText, platform, chatId, msgTimestamp, tool, tid, openId);
             logTrace(tid, "DONE", {
                 outcome: "auto_new_feishu_p2p_prompt_done",
                 chatId,