chatccc 0.2.28 → 0.2.30

package/README.md

@@ -12,17 +12,17 @@ ChatCCC 把 Claude Code、Cursor Agent、Codex (OpenAI) 接入了飞书群聊：
 
 - **手机上也能用 Claude Code / Cursor / Codex** —— 在飞书群里发消息就等于在终端输入指令，AI 的思考和回复会流式展示在群卡片里
 - **多会话并行** —— 一个群就是一个 AI 会话，完全隔离、互不干扰，并行工作效率更高
-- **多工具切换** —— `/new` 使用默认 Agent 创建会话，也可用 `/new claude`、`/new cursor`、`/new codex` 指定工具，各取所长
+- **多工具切换** —— `/new` 使用默认 Agent 创建会话，也可用 `/new claude`、`/new cursor`、`/new codex` 指定工具，各取所长
 
 一句话：**在任何设备上打开飞书，就能让 Claude Code / Cursor / Codex 帮你写代码、排查问题、分析项目。**
 
-<p align="center">
-  <img src="images/img_readme_messages.jpg" alt="飞书会话列表" width="220" align="top" />
-  &nbsp;
-  <img src="images/img_readme_0.jpg" alt="飞书群聊中使用 ChatCCC" width="220" align="top" />
-  &nbsp;
-  <img src="images/img_readme_1.jpg" alt="思考过程和工具调用" width="220" align="top" />
-</p>
+<p align="center">
+  <img src="images/img_readme_messages.jpg" alt="飞书会话列表" width="220" align="top" />
+  &nbsp;
+  <img src="images/img_readme_0.jpg" alt="飞书群聊中使用 ChatCCC" width="220" align="top" />
+  &nbsp;
+  <img src="images/img_readme_1.jpg" alt="思考过程和工具调用" width="220" align="top" />
+</p>
 
 ---
 
@@ -120,7 +120,7 @@ ChatCCC 启动时会按以下顺序确定 Cursor Agent CLI：
 
 > 旧版字段 `cursor.command` 仍可读取（启动时会打印一次 warning 提示改名），新配置请统一使用 `cursor.path`。
 
-> **说明**：只使用 Claude Code（`/new claude`，或把 Claude Code 设为默认 Agent 后使用 `/new`）的用户无需安装 Cursor CLI。
+> **说明**：只使用 Claude Code（`/new claude`，或把 Claude Code 设为默认 Agent 后使用 `/new`）的用户无需安装 Cursor CLI。
 
 #### Codex CLI（使用 Codex 会话时需要）
 
@@ -217,24 +217,24 @@ ChatCCC 的所有运行参数都集中在包根目录的 `config.json`。
   },
   "port": 18080,
   "gitTimeoutSeconds": 180,
-  "claude": {
-    "enabled": false,
-    "defaultAgent": true,
-    "model": "",
+  "claude": {
+    "enabled": false,
+    "defaultAgent": true,
+    "model": "",
     "effort": "",
     "apiKey": "",
     "baseUrl": ""
   },
-  "cursor": {
-    "enabled": false,
-    "defaultAgent": false,
-    "path": "",
+  "cursor": {
+    "enabled": false,
+    "defaultAgent": false,
+    "path": "",
     "model": ""
   },
-  "codex": {
-    "enabled": false,
-    "defaultAgent": false,
-    "path": "",
+  "codex": {
+    "enabled": false,
+    "defaultAgent": false,
+    "path": "",
     "model": "",
     "effort": ""
   }
@@ -247,10 +247,10 @@ ChatCCC 的所有运行参数都集中在包根目录的 `config.json`。
 | --- | --- | --- |
 | `feishu.appId` / `feishu.appSecret` | 是 | 飞书应用「凭证与基础信息」中的 App ID / App Secret |
 | `port` | 否 | 本地 WebSocket 中继 + Web 向导监听端口，默认 `18080`；同机多实例时改成不同值即可 |
-| `gitTimeoutSeconds` | 否 | `/git` 命令在会话工作目录执行时的单次超时秒数，默认 `180`，允许范围 `1–3600`，超时会被 `SIGKILL` 强制终止 |
-| `claude.enabled` / `cursor.enabled` / `codex.enabled` | 否 | 是否启用对应 AI Agent；Web 向导/管理页只展示 `enabled: true` 的 agent 卡片。字段缺省时按「任一配置字段非空」自动判定（向后兼容） |
-| `claude.defaultAgent` / `cursor.defaultAgent` / `codex.defaultAgent` | 否 | `/new` 未指定具体 Agent 时使用哪个默认 Agent；同一时间应只有一个为 `true`。Web 配置页切换某个 Agent 为默认时会自动关闭其它 Agent 的默认开关 |
-| `claude.model` | 否 | Claude Code 会话使用的模型；留空（`""` / 全空白）→ 不向 SDK 传 `model`，由 SDK / 服务商默认决定 |
+| `gitTimeoutSeconds` | 否 | `/git` 命令在会话工作目录执行时的单次超时秒数，默认 `180`，允许范围 `1–3600`，超时会被 `SIGKILL` 强制终止 |
+| `claude.enabled` / `cursor.enabled` / `codex.enabled` | 否 | 是否启用对应 AI Agent；Web 向导/管理页只展示 `enabled: true` 的 agent 卡片。字段缺省时按「任一配置字段非空」自动判定（向后兼容） |
+| `claude.defaultAgent` / `cursor.defaultAgent` / `codex.defaultAgent` | 否 | `/new` 未指定具体 Agent 时使用哪个默认 Agent；同一时间应只有一个为 `true`。Web 配置页切换某个 Agent 为默认时会自动关闭其它 Agent 的默认开关 |
+| `claude.model` | 否 | Claude Code 会话使用的模型；留空（`""` / 全空白）→ 不向 SDK 传 `model`，由 SDK / 服务商默认决定 |
 | `claude.effort` | 否 | Claude 思考深度（如 `low` / `medium` / `high` / `max`）；留空 → 不向 SDK 传 `effort` |
 | `claude.apiKey` | 否 | 第三方 Anthropic 兼容网关的 API 密钥；**官方 Claude 用户保持 `""` 即可**，详见下文「第三方 API」一节 |
 | `claude.baseUrl` | 否 | 第三方 Anthropic 兼容网关的 base URL（例如 `https://api.deepseek.com/anthropic`）；**官方 Claude 用户保持 `""` 即可** |
@@ -295,20 +295,20 @@ ChatCCC 的所有运行参数都集中在包根目录的 `config.json`。
 
 ### 5. 开始使用
 
-在飞书中找到你的机器人，发送 `/new`（使用 `config.json` 中 `defaultAgent: true` 的默认 Agent）或 `/new claude` / `/new cursor` / `/new codex`，机器人会自动创建一个群聊并把 AI 会话绑定到该群。之后直接在群里发消息就能对话。
+在飞书中找到你的机器人，发送 `/new`（使用 `config.json` 中 `defaultAgent: true` 的默认 Agent）或 `/new claude` / `/new cursor` / `/new codex`，机器人会自动创建一个群聊并把 AI 会话绑定到该群。之后直接在群里发消息就能对话。
 
 ### 可用指令
 
 
 | 指令            | 作用                           |
 | --------------- | ---------------------------- |
-| `/new`          | 使用默认 Agent 创建新会话            |
+| `/new`          | 使用默认 Agent 创建新会话            |
 | `/new claude`   | 创建新的 Claude Code 会话          |
 | `/new cursor`   | 创建新的 Cursor 会话               |
 | `/new codex`    | 创建新的 Codex 会话（OpenAI）         |
 | `/stop`         | 停止当前正在生成的回复                  |
 | `/status`       | 查看当前会话的状态（轮数、模型、上下文 token 等） |
-| `/cd`           | 查看/切换工作目录                    |
+| `/cd`           | 查看/设置当前会话的默认工作目录            |
 | `/sessions`     | 查看所有会话状态                    |
 | `/forget`       | 重置当前会话（创建新 Session，保留工作目录，同一群内继续） |
 | `/git <子命令>` | 在**当前会话工作目录**执行 `git ...` 并把 stdout/stderr 回发到群里（仅会话群内可用，超时见 `config.json` 的 `gitTimeoutSeconds` 字段） |
@@ -319,4 +319,4 @@ ChatCCC 的所有运行参数都集中在包根目录的 `config.json`。
 
 ## 技术栈
 
-TypeScript / Node.js >= 20 / tsx / Anthropic Claude Agent SDK / Cursor Agent CLI / Codex CLI (OpenAI) / 飞书 WebSocket API / CardKit
+TypeScript / Node.js >= 20 / tsx / Anthropic Claude Agent SDK / Cursor Agent CLI / Codex CLI (OpenAI) / 飞书 WebSocket API / CardKit

package/im-skills/feishu-skill/receive-send-file.md

@@ -4,17 +4,22 @@
 
 Videos are sent as regular files (not media), which looks cleaner in Feishu.
 
-### Script (recommended)
+First, query the current send token:
+```bash
+curl "{{session_grants_url}}?sid={{session_id}}"
+```
+
+Then send with the returned url and token:
 
+### Script (recommended)
 ```bash
-node "{{send_file_script}}" --url "{{send_file_url}}" --token "{{send_file_token}}" --path "<absolute file path>" --caption "<optional caption>"
+node "{{send_file_script}}" --url <url_from_query> --token <token_from_query> --path "<absolute file path>" --caption "<optional caption>"
 ```
 
 ### Direct HTTP
-
 ```http
-POST {{send_file_url}}
-Authorization: Bearer {{send_file_token}}
+POST <url_from_query>
+Authorization: Bearer <token_from_query>
 Content-Type: application/json; charset=utf-8
 
 {"path":"<absolute file path>","caption":"<optional caption>"}
@@ -24,10 +29,35 @@ Content-Type: application/json; charset=utf-8
 
 - Save or choose a local file first.
 - Use an absolute local path.
-- Max file size: 100MB.
+- Max file size: 30MB.
 - Supported formats: .mp4 .mov .avi .mkv .webm .flv .mp3 .wav .ogg .aac .m4a .pdf .doc .docx .xls .xlsx .csv .ppt .pptx .txt .zip .tar .gz.
 - Only send a file/video when the user asked for one or when it materially helps the answer.
 
+### Video Compression (when file > 30MB)
+
+If the video exceeds 30MB, compress it with ffmpeg before sending.
+
+**Ensure ffmpeg is available** (install if missing):
+
+| OS | Install command |
+|----|----------------|
+| macOS | `brew install ffmpeg` |
+| Linux (Debian/Ubuntu) | `sudo apt install ffmpeg` |
+| Linux (RHEL/Fedora) | `sudo dnf install ffmpeg` |
+| Windows | `winget install Gyan.FFmpeg` |
+
+**Two-pass compression** (target ~28MB for 30s video, adjust `b:v` for other durations):
+
+```bash
+ffmpeg -y -i "<input>" -c:v libx264 -b:v <bitrate>k -pass 1 -f mp4 NUL
+ffmpeg -y -i "<input>" -c:v libx264 -b:v <bitrate>k -pass 2 -c:a aac -b:a 128k "<output>"
+```
+
+Bitrate formula: `bitrate = 28 × 8 × 1000 ÷ duration_seconds - 128` (target ~28MB, safe under 30MB).
+On Windows replace `NUL` with `NUL` (same); on Linux/macOS use `/dev/null`.
+
+If the compressed file still exceeds 30MB, explain to the user that automatic compression wasn't enough and suggest they manually trim or re-encode the source.
+
 ## Download Files or Videos
 
 When the user sends a file or video to the bot, the message contains `message_id` and `file_key`. Download it with:

package/im-skills/feishu-skill/receive-send-image.md

@@ -2,17 +2,22 @@
 
 ## Send Images
 
-### Script (recommended)
+First, query the current send token:
+```bash
+curl "{{session_grants_url}}?sid={{session_id}}"
+```
 
+Then send with the returned url and token:
+
+### Script (recommended)
 ```bash
-node "{{send_image_script}}" --url "{{send_image_url}}" --token "{{send_image_token}}" --path "<absolute image path>" --caption "<optional caption>"
+node "{{send_image_script}}" --url <url_from_query> --token <token_from_query> --path "<absolute image path>" --caption "<optional caption>"
 ```
 
 ### Direct HTTP
-
 ```http
-POST {{send_image_url}}
-Authorization: Bearer {{send_image_token}}
+POST <url_from_query>
+Authorization: Bearer <token_from_query>
 Content-Type: application/json; charset=utf-8
 
 {"path":"<absolute image path>","caption":"<optional caption>"}

package/im-skills/feishu-skill/skill.md

@@ -7,5 +7,6 @@ Current working directory: {{cwd}}
 
 Use local endpoints instead of calling Feishu Open Platform directly.
 
+- **Get send tokens**: `GET {{session_grants_url}}?sid={{session_id}}` — returns `{ image: {url,token}, file: {url,token} }`
 - **Images** (send & receive): read `{{im_skills_cache_dir}}/feishu-skill/receive-send-image.md`
 - **Files & Videos** (send & download): read `{{im_skills_cache_dir}}/feishu-skill/receive-send-file.md`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chatccc",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "description": "Feishu bot bridge for Claude Code",
   "license": "Apache-2.0",
   "type": "module",

package/src/__tests__/cards.test.ts

@@ -232,7 +232,7 @@ describe("buildCdCard", () => {
   it("shows current working directory in markdown", () => {
     const card = buildCdCard("/home/project", entries, []);
     const parsed = JSON.parse(card);
-    const cwdContent = mdContents(parsed).find((c) => c.includes("新会话默认工作路径"));
+    const cwdContent = mdContents(parsed).find((c) => c.includes("本会话默认工作路径"));
     expect(cwdContent).toBeDefined();
     expect(cwdContent).toContain("/home/project");
   });

package/src/__tests__/im-skills.test.ts

@@ -23,9 +23,7 @@ describe("IM skills prompt rendering", () => {
         "---",
         "name: feishu-skill",
         "---",
-        "POST {{send_image_url}}",
-        "Authorization: Bearer {{send_image_token}}",
-        "Content-Type: application/json; charset=utf-8",
+        "GET {{session_grants_url}}?sid={{session_id}}",
         "cwd={{cwd}}",
       ].join("\n"),
       "utf-8",
@@ -35,15 +33,13 @@ describe("IM skills prompt rendering", () => {
       skillsDir: tempRoot,
       variables: {
         cwd: "C:/work",
-        send_image_url: "http://127.0.0.1:18080/api/agent/send-image",
-        send_image_token: "tok_test",
+        session_grants_url: "http://127.0.0.1:18080/api/agent/session-grants",
+        session_id: "sid_test",
       },
     });
 
     expect(prompt).toContain("[ChatCCC IM skill: feishu-skill]");
-    expect(prompt).toContain("POST http://127.0.0.1:18080/api/agent/send-image");
-    expect(prompt).toContain("Authorization: Bearer tok_test");
-    expect(prompt).toContain("Content-Type: application/json; charset=utf-8");
+    expect(prompt).toContain("GET http://127.0.0.1:18080/api/agent/session-grants?sid=sid_test");
     expect(prompt).toContain("cwd=C:/work");
     expect(prompt).not.toContain("{{");
   });

package/src/agent-grants-rpc.ts

@@ -0,0 +1,71 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+import type { AgentImageGrant } from "./agent-image-rpc.ts";
+import type { AgentFileGrant } from "./agent-file-rpc.ts";
+import { ts } from "./config.ts";
+
+export const AGENT_SESSION_GRANTS_PATH = "/api/agent/session-grants";
+
+interface SessionGrantsEntry {
+  image: AgentImageGrant;
+  file: AgentFileGrant;
+}
+
+const sessionGrants = new Map<string, SessionGrantsEntry>();
+
+export function setSessionGrants(
+  sessionId: string,
+  imageGrant: AgentImageGrant,
+  fileGrant: AgentFileGrant,
+): void {
+  sessionGrants.set(sessionId, { image: imageGrant, file: fileGrant });
+}
+
+export function clearSessionGrants(sessionId: string): void {
+  sessionGrants.delete(sessionId);
+}
+
+function jsonReply(res: ServerResponse, status: number, data: unknown): void {
+  res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+  res.end(JSON.stringify(data));
+}
+
+export async function handleAgentGrantsRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<boolean> {
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  if (url.pathname !== AGENT_SESSION_GRANTS_PATH) return false;
+
+  if (req.method !== "GET") {
+    jsonReply(res, 405, { ok: false, error: "Method not allowed" });
+    return true;
+  }
+
+  const sid = url.searchParams.get("sid");
+  if (!sid) {
+    jsonReply(res, 400, { ok: false, error: "Missing sid parameter" });
+    return true;
+  }
+
+  const entry = sessionGrants.get(sid);
+  if (!entry) {
+    jsonReply(res, 404, { ok: false, error: "No active grants for this session" });
+    return true;
+  }
+
+  const now = Date.now();
+  if (entry.image.expiresAt <= now || entry.file.expiresAt <= now) {
+    sessionGrants.delete(sid);
+    jsonReply(res, 410, { ok: false, error: "Session grants expired" });
+    return true;
+  }
+
+  console.log(`[${ts()}] [AGENT-GRANTS] query session=${sid}`);
+  jsonReply(res, 200, {
+    ok: true,
+    image: { url: entry.image.url, token: entry.image.token },
+    file: { url: entry.file.url, token: entry.file.token },
+  });
+  return true;
+}

package/src/cards.ts

@@ -108,17 +108,17 @@ export function buildProgressCard(
   });
 }
 
-export function buildHelpCard(
-  userText: string,
-  opts: { greeting?: string; defaultToolLabel?: string } = {},
-): string {
-  const greeting = opts.greeting ?? `你发送了: ${userText}`;
-  const defaultToolLabel = opts.defaultToolLabel ?? "Claude Code";
-  const lines = [
-    `发送 **/new** 创建新会话（默认 ${defaultToolLabel}）`,
-    "发送 **/new claude** 创建新 Claude 对话",
-    "发送 **/new cursor** 创建新 Cursor 会话",
-    "发送 **/new codex** 创建新 Codex 会话",
+export function buildHelpCard(
+  userText: string,
+  opts: { greeting?: string; defaultToolLabel?: string } = {},
+): string {
+  const greeting = opts.greeting ?? `你发送了: ${userText}`;
+  const defaultToolLabel = opts.defaultToolLabel ?? "Claude Code";
+  const lines = [
+    `发送 **/new** 创建新会话（默认 ${defaultToolLabel}）`,
+    "发送 **/new claude** 创建新 Claude 对话",
+    "发送 **/new cursor** 创建新 Cursor 会话",
+    "发送 **/new codex** 创建新 Codex 会话",
     "发送 **/forget** 重置当前会话（保留工作目录，同一群内继续）",
   ].join("\n");
   return JSON.stringify({
@@ -128,7 +128,7 @@ export function buildHelpCard(
       { tag: "div", text: { tag: "lark_md", content: greeting } },
       { tag: "div", text: { tag: "lark_md", content: lines } },
       buildButtons([
-        { text: `新建默认会话（/new，${defaultToolLabel}）`, value: JSON.stringify({ cmd: "new" }), type: "primary" },
+        { text: `新建默认会话（/new，${defaultToolLabel}）`, value: JSON.stringify({ cmd: "new" }), type: "primary" },
         { text: "新建 Cursor 会话（/new cursor）", value: JSON.stringify({ cmd: "new cursor" }), type: "primary" },
         { text: "新建 Codex 会话（/new codex）", value: JSON.stringify({ cmd: "new codex" }), type: "primary" },
         { text: "重启 ChatCCC（/restart）", value: JSON.stringify({ cmd: "restart" }), type: "danger" },
@@ -155,15 +155,15 @@ export function buildCdContent(
     : "";
 
   const statusLine = isUpdate
-    ? `**新会话默认工作路径（已切换）:** \`${dirPath}\``
-    : `**新会话默认工作路径:** \`${dirPath}\``;
+    ? `**本会话默认工作路径（已切换）:** \`${dirPath}\``
+    : `**本会话默认工作路径:** \`${dirPath}\``;
 
   const lines: string[] = [];
   if (currentLine) lines.push(currentLine, "");
   lines.push(
     statusLine,
     ``,
-    `此路径持久化在配置文件中，仅影响**新建会话**的工作路径。`,
+    `此路径仅影响**本会话中新建**的会话工作路径。`,
     ``,
     `---`,
     `**目录内容** (最多 ${maxFiles} 个):`,
@@ -205,7 +205,7 @@ export function buildCdCard(
   }
   elements.push({
     tag: "div",
-    text: { tag: "lark_md", content: `**新会话默认工作路径:** \`${dirPath}\`` },
+    text: { tag: "lark_md", content: `**本会话默认工作路径:** \`${dirPath}\`` },
   });
 
   if (recentDirs.length > 0) {
@@ -252,15 +252,15 @@ export function buildCdCard(
 }
 
 // 所有会话列表卡片（Claude Code 优先，然后 Cursor）
-export function buildSessionsCard(sessions: Array<{
-  sessionId: string;
-  active: boolean;
-  turnCount: number;
-  elapsedSeconds: number | null;
-  model: string;
-  tool: string;
-}>, opts: { defaultToolLabel?: string } = {}): string {
-  const defaultToolLabel = opts.defaultToolLabel ?? "Claude Code";
+export function buildSessionsCard(sessions: Array<{
+  sessionId: string;
+  active: boolean;
+  turnCount: number;
+  elapsedSeconds: number | null;
+  model: string;
+  tool: string;
+}>, opts: { defaultToolLabel?: string } = {}): string {
+  const defaultToolLabel = opts.defaultToolLabel ?? "Claude Code";
   // 按 tool 分组排序：Claude Code 在前，Cursor 其次，Codex 最后
   const claudeCodeSessions = sessions.filter(s => s.tool !== "cursor" && s.tool !== "codex");
   const cursorSessions = sessions.filter(s => s.tool === "cursor");
@@ -274,7 +274,7 @@ export function buildSessionsCard(sessions: Array<{
       config: { wide_screen_mode: true },
       header: { template: "blue", title: { content: "所有会话", tag: "plain_text" } },
       elements: [
-        { tag: "div", text: { tag: "lark_md", content: `当前没有会话记录。\n\n使用 **/new**（默认 ${defaultToolLabel}）、**/new claude**、**/new cursor** 或 **/new codex** 创建新会话。` } },
+        { tag: "div", text: { tag: "lark_md", content: `当前没有会话记录。\n\n使用 **/new**（默认 ${defaultToolLabel}）、**/new claude**、**/new cursor** 或 **/new codex** 创建新会话。` } },
         { tag: "hr" },
         { tag: "action", actions: [{ tag: "button", text: { tag: "plain_text", content: "收起" }, type: "default", value: { action: "close" } }] },
       ],
@@ -360,4 +360,4 @@ export function buildStatusCard(statusText: string, template = "blue"): string {
       },
     ],
   });
-}
+}

package/src/config.ts

@@ -547,9 +547,11 @@ export function reloadConfigFromDisk(): void {
   applyLoadedConfig(loadConfig());
 }
 
-// 新建会话的默认工作路径（/cd 命令设置，持久化到本地文件）
+// 新建会话的默认工作路径（/cd 命令设置，按 chatId 持久化到本地文件）
 // 该路径仅影响通过 /new 新建的会话，不影响已有会话的 resume。
-export const DEFAULT_CWD_FILE = join(USER_DATA_DIR, "state", "working_dir.txt");
+export function getDefaultCwdFile(chatId: string): string {
+  return join(USER_DATA_DIR, "state", `working_dir_${chatId}.txt`);
+}
 
 /** 会话工具类型持久化文件 */
 export const SESSIONS_FILE = join(USER_DATA_DIR, "state", "sessions.json");
@@ -583,24 +585,26 @@ export async function addRecentDir(dir: string): Promise<void> {
   }
 }
 
-/** 读取 /cd 设置的默认工作路径。若文件不存在或路径已失效，回退到用户主目录。 */
-export async function getDefaultCwd(): Promise<string> {
-  try {
-    const content = await readFile(DEFAULT_CWD_FILE, "utf-8");
-    const dir = content.trim();
-    if (dir) {
-      try {
-        const s = await stat(dir);
-        if (s.isDirectory()) return dir;
-      } catch { /* path gone, fall through */ }
-    }
-  } catch { /* file doesn't exist yet */ }
+/** 读取 /cd 设置的默认工作路径。若 chatId 对应的文件不存在或路径已失效，回退到用户主目录。 */
+export async function getDefaultCwd(chatId?: string): Promise<string> {
+  if (chatId) {
+    try {
+      const content = await readFile(getDefaultCwdFile(chatId), "utf-8");
+      const dir = content.trim();
+      if (dir) {
+        try {
+          const s = await stat(dir);
+          if (s.isDirectory()) return dir;
+        } catch { /* path gone, fall through */ }
+      }
+    } catch { /* file doesn't exist yet */ }
+  }
   return homedir();
 }
 
-/** 设置新建会话的默认工作路径（由 /cd 命令调用） */
-export async function setDefaultCwd(dir: string): Promise<void> {
-  await writeFile(DEFAULT_CWD_FILE, dir, "utf-8");
+/** 设置新建会话的默认工作路径（由 /cd 命令调用，按 chatId 持久化） */
+export async function setDefaultCwd(dir: string, chatId: string): Promise<void> {
+  await writeFile(getDefaultCwdFile(chatId), dir, "utf-8");
 }
 
 // ---------------------------------------------------------------------------

package/src/index.ts

@@ -84,6 +84,7 @@ import { buildHelpCard, buildStatusCard, buildProgressCard, buildCdContent, buil
 import { updateCardKitCard } from "./cardkit.ts";
 import { handleAgentImageRequest } from "./agent-image-rpc.ts";
 import { handleAgentFileRequest } from "./agent-file-rpc.ts";
+import { handleAgentGrantsRequest } from "./agent-grants-rpc.ts";
 import { formatGitResult, gitResultHeaderTemplate, runGitCommand } from "./git-command.ts";
 import {
   MAX_PROCESSED,
@@ -275,7 +276,7 @@ async function handleCommand(text: string, chatId: string, openId: string, msgTi
   if (text === "/cd" || text.startsWith("/cd ")) {
     logTrace(tid, "BRANCH", { cmd: "/cd", arg: text.slice(3).trim() || "(none)" });
     const cdToken = await getTenantAccessToken();
-    const currentDir = await getDefaultCwd();
+    const currentDir = await getDefaultCwd(chatId);
 
     // 获取当前会话的实际工作路径（若在会话群内）
     let sessionCwd: string | undefined;
@@ -318,7 +319,7 @@ async function handleCommand(text: string, chatId: string, openId: string, msgTi
     // Change working dir if user provided a path
     const isUpdate = !!arg && targetDir !== currentDir;
     if (isUpdate) {
-      await setDefaultCwd(targetDir);
+      await setDefaultCwd(targetDir, chatId);
       await addRecentDir(targetDir);
     }
 
@@ -395,7 +396,7 @@ async function handleCommand(text: string, chatId: string, openId: string, msgTi
     let sessionId: string;
     let sessionCwd: string;
     try {
-      const init = await initClaudeSession(tool);
+      const init = await initClaudeSession(tool, undefined, chatId);
       sessionId = init.sessionId;
       sessionCwd = init.cwd;
       console.log(`[${ts()}] [STEP 1/4] ${toolLabel} session created: ${sessionId} → OK`);
@@ -476,7 +477,7 @@ async function handleCommand(text: string, chatId: string, openId: string, msgTi
         const prefix = text.slice(0, MAX_PREFIX);
         const adapter = getAdapterForTool(descriptionTool);
         const info = await adapter.getSessionInfo(sessionId).catch(() => undefined);
-        const sessionCwd = info?.cwd ?? (await getDefaultCwd());
+        const sessionCwd = info?.cwd ?? (await getDefaultCwd(chatId));
         const newName = sessionChatName(prefix, sessionCwd);
         try {
           await updateChatInfo(freshToken, chatId, newName, description);
@@ -578,9 +579,9 @@ async function handleCommand(text: string, chatId: string, openId: string, msgTi
         let cwd: string;
         try {
           const info = await adapter.getSessionInfo(sessionId);
-          cwd = info?.cwd ?? (await getDefaultCwd());
+          cwd = info?.cwd ?? (await getDefaultCwd(chatId));
         } catch {
-          cwd = await getDefaultCwd();
+          cwd = await getDefaultCwd(chatId);
         }
 
         const existing = chatSessionMap.get(chatId);
@@ -1058,7 +1059,7 @@ async function main(): Promise<void> {
     });
   });
   setExtraApiHandler(async (req, res) => {
-    return (await handleAgentImageRequest(req, res)) || (await handleAgentFileRequest(req, res));
+    return (await handleAgentGrantsRequest(req, res)) || (await handleAgentImageRequest(req, res)) || (await handleAgentFileRequest(req, res));
   });
 
   console.log(`[启动 2/7] 环境与凭证检查`);

package/src/session.ts

@@ -40,6 +40,7 @@ import {
   createAgentFileGrant,
   revokeAgentFileGrant,
 } from "./agent-file-rpc.ts";
+import { setSessionGrants, clearSessionGrants, AGENT_SESSION_GRANTS_PATH } from "./agent-grants-rpc.ts";
 import { buildImSkillsPrompt, exportSkillSubDocs } from "./im-skills.ts";
 
 // ---------------------------------------------------------------------------
@@ -288,8 +289,8 @@ function formatToolConfigForLog(tool: string, sessionModel?: string): string {
   return `model=${anthropicConfigDisplay(CLAUDE_MODEL)}, effort=${anthropicConfigDisplay(CLAUDE_EFFORT)}`;
 }
 
-export async function initClaudeSession(tool: string, overrideCwd?: string): Promise<{ sessionId: string; cwd: string }> {
-  const cwd = overrideCwd ?? (await getDefaultCwd());
+export async function initClaudeSession(tool: string, overrideCwd?: string, chatId?: string): Promise<{ sessionId: string; cwd: string }> {
+  const cwd = overrideCwd ?? (await getDefaultCwd(chatId));
   const adapter = getAdapterForTool(tool);
   console.log(
     `[${ts()}] [STEP 1/5] Creating ${adapter.displayName} session (${formatToolConfigForLog(tool)}, cwd=${cwd})`
@@ -318,7 +319,7 @@ export async function resumeAndPrompt(
   const tid = traceId ?? "";
   const adapter = getAdapterForTool(tool);
   const info = await adapter.getSessionInfo(sessionId);
-  const cwd = info?.cwd ?? (await getDefaultCwd());
+  const cwd = info?.cwd ?? (await getDefaultCwd(chatId));
   if (tid) logTrace(tid, "SESSION_START", { sessionId, tool, cwd, turn: (sessionInfoMap.get(chatId)?.turnCount ?? 0) + 1 });
   console.log(
     `[${ts()}] Resuming ${adapter.displayName} session: ${sessionId} (${formatToolConfigForLog(tool, info?.model)}, cwd=${cwd})`
@@ -341,15 +342,15 @@ export async function resumeAndPrompt(
   const imSkillsCacheDir = join(USER_DATA_DIR, "im-skills");
   const skillVariables = {
     cwd,
+    session_id: sessionId,
     im_skills_cache_dir: imSkillsCacheDir,
+    session_grants_url: `http://127.0.0.1:${CHATCCC_PORT}${AGENT_SESSION_GRANTS_PATH}`,
     send_image_url: imageGrant.url,
-    send_image_token: imageGrant.token,
-    send_file_url: fileGrant.url,
-    send_file_token: fileGrant.token,
     send_image_script: join(feishuSkillDir, "send-image.mjs"),
     send_file_script: join(feishuSkillDir, "send-file.mjs"),
     download_video_script: join(feishuSkillDir, "download-video.mjs"),
   };
+  setSessionGrants(sessionId, imageGrant, fileGrant);
   const imSkillsPrompt = await buildImSkillsPrompt({ variables: skillVariables });
   // 渲染子文档到缓存目录，供 Agent 按需读取
   await exportSkillSubDocs({ variables: skillVariables }, imSkillsCacheDir);
@@ -516,6 +517,7 @@ export async function resumeAndPrompt(
     if (sendInterval) clearInterval(sendInterval);
     revokeAgentImageGrant(imageGrant.token);
     revokeAgentFileGrant(fileGrant.token);
+    clearSessionGrants(sessionId);
   }
 
   const cEntry = chatSessionMap.get(chatId);