termdock 1.4.194 → 1.4.196

package/dist/server/agent/collaborationPrompt.js

@@ -1,3 +1,4 @@
+import { canonicalShortId } from './collaborationProtocol.js';
 import { sanitizeCollaborationRole } from './collaborationStore.js';
 const SHELL_RULE = '─'.repeat(30);
 /** Body larger than this (in UTF-8 bytes) is replaced by a retrieval pointer
@@ -25,39 +26,78 @@ export function sanitizeCollaborationName(name, max = 40) {
         .trim();
     return cleaned.length > max ? `${cleaned.slice(0, max - 1)}…` : cleaned;
 }
+/** The id form a delivery shows and the confirm gate searches for, per message.
+ *  Canonical UUIDs shorten to their 8-character prefix (a 36-character id wraps
+ *  in a narrow pane and has to be retyped by whoever answers it); ids that are
+ *  not canonical UUIDs pass through untouched. A prefix shared by two messages
+ *  in the same delivery would make a `includes` search match the wrong block —
+ *  including against the other one's line still sitting in terminal history —
+ *  so every colliding message falls back to its full id. The batch is the unit
+ *  because one delivery is what a confirm search scans against.
+ *
+ *  Delivered text and the confirm gate must both derive the token here: if the
+ *  text carried a short id while the gate searched the full one, the gate could
+ *  never match a delivery again and would re-write it until the attempt bound
+ *  (the "one message arrived three times" regression). */
+export function collaborationMessageAnchorTokens(messages) {
+    const counts = new Map();
+    for (const message of messages) {
+        const short = canonicalShortId(message.id);
+        counts.set(short, (counts.get(short) ?? 0) + 1);
+    }
+    return new Map(messages.map((message) => {
+        const short = canonicalShortId(message.id);
+        return [message.id, counts.get(short) === 1 ? short : message.id];
+    }));
+}
+/** The one line of a delivered block that carries the message's id, chosen by
+ *  what the recipient can actually do with it: an agent-sourced message gets the
+ *  reply command, a user message gets the read-back command (`td collab reply`
+ *  refuses user messages — NO_REPLY_TARGET — so naming it there would be a dead
+ *  command). Both routes accept the short form (the CLI resolves id prefixes),
+ *  so whichever token collaborationMessageAnchorTokens picks for this delivery is what
+ *  the recipient can paste back. Every message must carry its token regardless
+ *  of source: the invariant is pinned by the "carries its id" test in
+ *  collaborationPrompt.test.ts. */
+export function collaborationMessageAnchorLine(message, token = canonicalShortId(message.id)) {
+    return message.fromSessionId
+        ? `回复:td collab reply ${token} "回复内容" --text`
+        : `详情:td collab message get ${token} --json`;
+}
 /** A single delivered message: `来自:X · kind` over a fenced body, with the
- * reply route for agent-sourced messages kept outside the fence. A fan-out
+ * anchor line (reply route / read-back route) kept outside the fence. A fan-out
  * dispatch (message.fanOutIds present) is flagged `· 群发` and names the
  * sibling recipients on their own line, so a broadcast is never mistaken for
  * a one-to-one assignment — raw ids fall back to the sanitized id itself. */
-function formatCollaborationMessage(message, source, fannedNames, fence) {
+function formatCollaborationMessage(message, source, fannedNames, fence, token) {
     const lines = [`来自:${source} · ${message.kind}${fannedNames.length ? ' · 群发' : ''}`];
     if (fannedNames.length)
         lines.push(`同时发给了:${fannedNames.join('、')}`);
     lines.push('', fence, message.content, fence);
     if (message.task)
         lines.push('', `任务上报:${JSON.stringify(message.task)}`);
-    if (message.fromSessionId)
-        lines.push('', `回复:td collab reply ${message.id} "回复内容" --text`);
+    lines.push('', collaborationMessageAnchorLine(message, token));
     return lines.join('\n');
 }
 export function formatCollaborationDelivery(input) {
     const groupsById = new Map(input.groups.map((group) => [group.id, group]));
     const sessionsById = new Map(input.sessions.map((session) => [session.sessionId, session]));
+    const tokens = collaborationMessageAnchorTokens(input.messages);
     const blocks = [];
     for (const message of input.messages) {
         const sourceSession = message.fromSessionId ? sessionsById.get(message.fromSessionId) : null;
         const source = message.fromSessionId
             ? sanitizeCollaborationName(sourceSession?.name ?? message.fromSessionId)
             : '用户';
+        const token = tokens.get(message.id) ?? message.id;
         const bytes = Buffer.byteLength(message.content);
         const body = bytes > MAX_INLINE_BODY_BYTES
-            ? `大消息已完整保存（${bytes} 字节）。使用 td collab message get ${message.id} --json 获取正文；不要把这条提示当作消息正文。`
+            ? `大消息已完整保存（${bytes} 字节）。使用 td collab message get ${token} --json 获取正文；不要把这条提示当作消息正文。`
             : message.content;
         const fence = '`'.repeat(Math.max(3, ...Array.from(body.matchAll(/`+/g), (match) => match[0].length + 1)));
         const fannedNames = (message.fanOutIds ?? [])
             .map((sessionId) => sanitizeCollaborationName(sessionsById.get(sessionId)?.name ?? sessionId));
-        blocks.push(formatCollaborationMessage({ ...message, content: body }, source, fannedNames, fence));
+        blocks.push(formatCollaborationMessage({ ...message, content: body }, source, fannedNames, fence, token));
     }
     // The shell header names the group only when every block belongs to one;
     // a mixed batch drops the header entirely (no single-group claim to make).

package/dist/server/agent/collaborationProtocol.js

@@ -18,6 +18,43 @@ export class CollaborationError extends Error {
         this.httpStatus = httpStatus;
     }
 }
+/** Canonical message and group ids are UUIDs; a delivered terminal shows only
+ *  the first 8 characters, because a 36-character id wraps in a narrow pane
+ *  and has to be retyped by whoever answers it. Shortening is display-only and
+ *  one-way: storage, wire format, receipts and federation always carry the
+ *  full id, and every lookup resolves a prefix back to it. Ids that are not
+ *  canonical UUIDs pass through untouched — a hand-written session id
+ *  (`40bc89py`), a `remote:<origin>:<id>` address or a `cross-<uuid>` federated
+ *  group are either already short or decoded by their own structural rules
+ *  (`split(':')`), so truncating them would corrupt the parse. */
+export const SHORT_ID_LENGTH = 8;
+/** Shortest input accepted as a prefix; below this a lookup is exact-match
+ *  only, so a one-character typo never turns into an ambiguity error. */
+export const MIN_ID_PREFIX_LENGTH = 4;
+const CANONICAL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function canonicalShortId(id) {
+    return CANONICAL_ID.test(id) ? id.slice(0, SHORT_ID_LENGTH) : id;
+}
+/** Resolve what a user typed against the ids that exist, git-style: an exact
+ *  match always wins, otherwise a prefix of at least MIN_ID_PREFIX_LENGTH
+ *  characters resolves when it is unique. Callers turn 'ambiguous' into an
+ *  error built by ambiguousIdMessage. */
+export function resolveIdPrefix(ids, input) {
+    if (ids.includes(input))
+        return { status: 'ok', id: input };
+    if (input.length < MIN_ID_PREFIX_LENGTH)
+        return { status: 'not-found' };
+    const matches = ids.filter((id) => id.startsWith(input));
+    if (matches.length === 1)
+        return { status: 'ok', id: matches[0] };
+    return matches.length ? { status: 'ambiguous', matches } : { status: 'not-found' };
+}
+/** Both message and group lookups answer an ambiguous prefix the same way: say
+ *  how many matched, never which ones (a prefix search can reach another
+ *  session's ids), and name the way out. */
+export function ambiguousIdMessage(kind, count) {
+    return `${kind} id 前缀匹配到 ${count} 个对象，请提供更长的前缀或完整 id`;
+}
 export function validateExtras(input) {
     if (input.idempotencyKey !== undefined && (typeof input.idempotencyKey !== 'string' || !input.idempotencyKey.trim() || input.idempotencyKey.length > 256)) {
         throw new CollaborationError('INVALID_IDEMPOTENCY_KEY', 'idempotency key must contain 1–256 characters');

package/dist/server/agent/collaborationRoutes.js

@@ -1,5 +1,5 @@
 import { Router } from 'express';
-import { COLLAB_LIMITS, CollaborationError, extrasFromBody } from './collaborationProtocol.js';
+import { COLLAB_LIMITS, CollaborationError, ambiguousIdMessage, extrasFromBody } from './collaborationProtocol.js';
 /** Member names arrive agent-authored over a CLI; control characters would
  * corrupt terminal shells, tmux options and persisted records. Fold them to
  * spaces, collapse runs, and cap the length (display sanitization for the
@@ -30,8 +30,17 @@ export function collaborationRoutes({ store, resolveSession, deliver, rebind, re
         }
         res.json({ ok: true, route: await rebind(sessionId, pane ?? null) });
     }));
+    /** Accepts the 8-character id a terminal shows as well as the full one; an
+     *  ambiguous prefix is refused rather than guessed, so a reply can never
+     *  land on the wrong thread. */
+    const resolveMessage = (id) => {
+        const resolved = store.resolveMessageId(id);
+        if (resolved.status === 'ambiguous')
+            throw new CollaborationError('MESSAGE_ID_AMBIGUOUS', ambiguousIdMessage('消息', resolved.matches.length));
+        return resolved.status === 'ok' ? store.getMessage(resolved.id) : null;
+    };
     const ownMessage = (id, sessionId, recipientOnly = false) => {
-        const message = store.getMessage(id);
+        const message = resolveMessage(id);
         if (!message || (message.toSessionId !== sessionId && (recipientOnly || message.fromSessionId !== sessionId)))
             throw new CollaborationError('MESSAGE_NOT_FOUND', 'Message does not belong to this session', 404);
         return message;
@@ -83,8 +92,18 @@ export function collaborationRoutes({ store, resolveSession, deliver, rebind, re
         const targets = requestedTargets.length > 0 ? requestedTargets : (target ? [target] : []);
         if (!targets.length)
             throw new CollaborationError('NO_TARGET', 'send requires a targetSessionId (or toSessionIds for a fan-out)', 400);
+        // `--group` may be the 8-character id; an unresolvable one must stay a
+        // GROUP_NOT_FOUND below instead of silently falling back to the only
+        // shared group, which would send to a set the sender did not name.
+        let requestedGroupId = typeof req.body.group_id === 'string' ? req.body.group_id : '';
+        if (requestedGroupId) {
+            const resolved = store.resolveGroupId(requestedGroupId);
+            if (resolved.status === 'ambiguous')
+                throw new CollaborationError('GROUP_ID_AMBIGUOUS', ambiguousIdMessage('协作组', resolved.matches.length));
+            requestedGroupId = resolved.status === 'ok' ? resolved.id : requestedGroupId;
+        }
         const groups = store.groupsForSession(sessionId)
-            .filter((group) => targets.every((candidate) => group.sessionIds.includes(candidate)) && (!req.body.group_id || group.id === req.body.group_id));
+            .filter((group) => targets.every((candidate) => group.sessionIds.includes(candidate)) && (!requestedGroupId || group.id === requestedGroupId));
         if (!groups.length)
             throw new CollaborationError('GROUP_NOT_FOUND', 'Sender and recipients must share the specified group');
         if (groups.length > 1 && !req.body.group_id)
@@ -129,9 +148,24 @@ export function collaborationRoutes({ store, resolveSession, deliver, rebind, re
         const since = sinceText === undefined ? undefined : /^\d+$/.test(sinceText) ? Number(sinceText) : Date.parse(sinceText);
         if (since !== undefined && !Number.isFinite(since))
             throw new CollaborationError('INVALID_SINCE', 'since must be an ISO timestamp or epoch milliseconds');
+        // `--group` accepts the 8-character id; an unresolvable or ambiguous one
+        // keeps the caller's text, which matches no group and yields an empty page
+        // (the pre-existing behavior for an unknown group filter).
+        let groupFilter = string('group');
+        if (groupFilter) {
+            const resolved = store.resolveGroupId(groupFilter);
+            if (resolved.status === 'ok')
+                groupFilter = resolved.id;
+        }
+        let threadFilter = string('thread');
+        if (threadFilter) {
+            const resolved = store.resolveThreadId(threadFilter);
+            if (resolved.status === 'ok')
+                threadFilter = resolved.id;
+        }
         const page = store.page(sessionId, { unread: string('unread') === 'true', since, afterId: string('after_id'), cursor: string('cursor'),
             consumer: string('consumer'), limit: string('limit') ? Number(string('limit')) : undefined,
-            from: string('from'), group: string('group'), thread: string('thread'), kind: string('kind'), responseKind: string('response_kind'), order: string('order') });
+            from: string('from'), group: groupFilter, thread: threadFilter, kind: string('kind'), responseKind: string('response_kind'), order: string('order') });
         // Fan-out edges carry sibling recipients; the names map lets the CLI text
         // renderer show 同时发给了:… as people instead of bare session ids. The
         // fallback to the raw id stays server-side agnostic (federated/offline).
@@ -143,7 +177,10 @@ export function collaborationRoutes({ store, resolveSession, deliver, rebind, re
         res.json({ ok: true, consumer: req.body.consumer, cursor: req.body.cursor });
     }));
     const groupOf = (id, sessionId) => {
-        const group = store.getGroup(id);
+        const resolved = store.resolveGroupId(id);
+        if (resolved.status === 'ambiguous')
+            throw new CollaborationError('GROUP_ID_AMBIGUOUS', ambiguousIdMessage('协作组', resolved.matches.length));
+        const group = resolved.status === 'ok' ? store.getGroup(resolved.id) : null;
         if (!group || group.deleted)
             throw new CollaborationError('GROUP_NOT_FOUND', 'Collaboration group not found', 404);
         if (!group.sessionIds.includes(sessionId))

package/dist/server/agent/collaborationStore.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
-import { COLLAB_LIMITS, CollaborationError, STATUS_RANK, validateExtras } from './collaborationProtocol.js';
+import { COLLAB_LIMITS, CollaborationError, STATUS_RANK, resolveIdPrefix, validateExtras } from './collaborationProtocol.js';
 /** Characters that would corrupt a role line injected into the delivery shell
  * (`你的定位:...`) or smuggle terminal output. Unlike names, roles are plain
  * prose — 「」 and · are harmless there — so only control sequences are barred. */
@@ -57,6 +57,13 @@ export class CollaborationStore {
     getGroup(id) {
         return this.document.groups.find((group) => group.id === id) ?? null;
     }
+    /** Typed lookups accept the 8-character id a terminal shows as well as the
+     *  full one: exact match first, then a unique prefix. Ambiguity is reported,
+     *  never guessed at, and resolution happens before any send so the
+     *  idempotency payload hash still sees the full id. */
+    resolveGroupId(id) {
+        return resolveIdPrefix(this.document.groups.map((group) => group.id), id);
+    }
     save(input) {
         const now = Date.now();
         const existing = input.id ? this.document.groups.find((group) => group.id === input.id) : null;
@@ -222,6 +229,16 @@ export class CollaborationStore {
         this.expire();
         return this.document.messages.find((message) => message.id === id) ?? null;
     }
+    resolveMessageId(id) {
+        this.expire();
+        return resolveIdPrefix(this.document.messages.map((message) => message.id), id);
+    }
+    /** Thread ids are shown shortened alongside message ids, so the `--thread`
+     *  filter has to take one back the same way. */
+    resolveThreadId(id) {
+        this.expire();
+        return resolveIdPrefix([...new Set(this.document.messages.map((message) => message.threadId).filter((threadId) => Boolean(threadId)))], id);
+    }
     inbox(sessionId, options = {}) {
         this.expire();
         const matches = this.document.messages.filter((message) => message.toSessionId === sessionId && (!options.pendingOnly || message.status === 'pending'));

package/dist/server/agent/collaborationTmuxDelivery.js

@@ -47,7 +47,16 @@ async function assertSamePane(run, pane) {
 /** Unique-per-process buffer name so concurrent deliveries to different panes
  *  never share (or clobber) a buffer. */
 let bufferSequence = 0;
-export async function writeCollaborationTmuxPane(run, pane, prompt) {
+export async function writeCollaborationTmuxPane(run, pane, prompt, 
+/** Sends `input` to the tmux client's stdin. The steps below are one `\;`
+ *  chain (see the comment inside), and a chain is argv, so the body must not
+ *  ride in argv: tmux treats an element that is exactly `;` as a separator
+ *  even after `--`, and its backslash unescaping is version-dependent
+ *  (`\\` survives verbatim while `\;` collapses to `;`). Reading the body
+ *  from stdin sidesteps both — every byte round-trips unchanged. Required,
+ *  not optional: a run() that ignored the payload would load an empty buffer
+ *  and fail the delivery rather than deliver the wrong thing. */
+stdin) {
     await assertSamePane(run, pane);
     // A fixed pane target is independent of the current window, keyboard focus
     // and browser presence. Delivery goes through a named tmux buffer rather
@@ -67,16 +76,27 @@ export async function writeCollaborationTmuxPane(run, pane, prompt) {
     // every tmux version.
     const buffer = `termdock-collab-${process.pid}-${bufferSequence++}`;
     try {
-        await run(['set-buffer', '-b', buffer, '--', normalizePromptForPaste(prompt)]);
-        // -r keeps LF as LF rather than the separator default of CR. The
-        // normalizer already folded every line break to CR, so no LF is left for
-        // it to rewrite — the flag is insurance, not the mechanism.
-        await run(['paste-buffer', '-p', '-r', '-d', '-b', buffer, '-t', pane.paneId]);
-        // The submit key rides outside the paste block: inside it, an editor
-        // inserts a pasted CR as text instead of acting on it. Pasting the bare
-        // CR (no -p) keeps the key in the same mode-proof channel as the text.
-        await run(['set-buffer', '-b', buffer, '--', '\r']);
-        await run(['paste-buffer', '-d', '-b', buffer, '-t', pane.paneId]);
+        // The four steps ride one client invocation joined by tmux's `\;`: the
+        // server runs them back to back in a single queue item, so no other
+        // client's paste can interleave between our text and our submit CR
+        // (measured: one contiguous block, 0ms apart, versus two invocations
+        // ~14ms apart). A failing step stops the rest — verified on 3.4 and 3.7 —
+        // which is the safe direction: a failed text paste is never followed by a
+        // bare CR into whatever the input box already held.
+        await stdin([
+            // The body arrives on stdin, not argv: it is user content, and in a
+            // `\;` chain argv is a language where `;` and `\` mean something.
+            'load-buffer', '-b', buffer, '-', ';',
+            // -r keeps LF as LF rather than the separator default of CR. The
+            // normalizer already folded every line break to CR, so no LF is left
+            // for it to rewrite — the flag is insurance, not the mechanism.
+            'paste-buffer', '-p', '-r', '-d', '-b', buffer, '-t', pane.paneId, ';',
+            // The submit key rides outside the paste block: inside it, an editor
+            // inserts a pasted CR as text instead of acting on it. Pasting the bare
+            // CR (no -p) keeps the key in the same mode-proof channel as the text.
+            'set-buffer', '-b', buffer, '--', '\r', ';',
+            'paste-buffer', '-d', '-b', buffer, '-t', pane.paneId,
+        ], normalizePromptForPaste(prompt));
     }
     finally {
         // -d consumed the buffer on the happy path; this sweeps up after a failed

package/dist/server/routes/terminal.js

@@ -40,6 +40,7 @@ import { collaborationRoutes } from '../agent/collaborationRoutes.js';
 import { COLLAB_LIMITS, extrasFromBody } from '../agent/collaborationProtocol.js';
 import { CollaborationStore } from '../agent/collaborationStore.js';
 import { COLLAB_NAME_FORBIDDEN, formatCollaborationDelivery } from '../agent/collaborationPrompt.js';
+import { ambiguousIdMessage } from '../agent/collaborationProtocol.js';
 import { buildCollaborationSpawnCommand, resolveCollaborationSpawnMode } from '../agent/collaborationSpawn.js';
 import { SessionSearchStore } from '../agent/sessionSearchStore.js';
 import { resolveCollaborationBackend, resolveCollaborationSessionId } from '../agent/sessionBindingRecovery.js';
@@ -1610,7 +1611,7 @@ async function resolveCollaborationRoute(frontendSessionId) {
         return { state: 'ready', capture: async () => (await captureTmuxPane(pinned.paneId)).content, write: async (messages) => {
                 if (!globalSessionState.sessions.some((candidate) => candidate.sessionId === frontendSessionId))
                     throw new Error('SESSION_REMOVED');
-                await writeCollaborationTmuxPane(runTmux, pinned, formatLocalCollaborationMessages(frontendSessionId, messages));
+                await writeCollaborationTmuxPane(runTmux, pinned, formatLocalCollaborationMessages(frontendSessionId, messages), runTmuxStdin);
                 backend.lastActivity = Date.now();
                 // First-delivery confirm: history proves the agent rendered our
                 // message (boot sequences clear only the screen, never the history a
@@ -1735,6 +1736,32 @@ async function runTmux(args) {
     });
     return stdout;
 }
+/** runTmux with a payload on the client's stdin — how delivery hands user
+ *  content to `load-buffer -`. Kept separate from runTmux so the many callers
+ *  that never pipe anything are untouched. */
+async function runTmuxStdin(args, input) {
+    const child = execFile(getTmuxBinary(), args, {
+        timeout: 5000,
+        maxBuffer: 2 * 1024 * 1024,
+        env: buildInteractiveColorEnvironment(process.env),
+    });
+    // Write then end: tmux reads stdin to EOF for `load-buffer -`.
+    child.stdin?.end(input);
+    const { stdout } = await new Promise((resolve, reject) => {
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (chunk) => { stdout += chunk; });
+        child.stderr?.on('data', (chunk) => { stderr += chunk; });
+        child.on('error', reject);
+        child.on('close', (code) => (code === 0
+            ? resolve({ stdout })
+            // Carry tmux's own message: it names the failing step ("no buffer X",
+            // "target pane has exited"), which is what makes a delivery failure
+            // diagnosable from the transport diagnostic alone.
+            : reject(new Error(`tmux exited with ${code}${stderr.trim() ? `: ${stderr.trim()}` : ''}`))));
+    });
+    return stdout;
+}
 // ---- Persistent tmux control-mode connection ----
 // Instead of spawning a new `tmux` process per command (execFile overhead),
 // maintain a single `tmux -C attach` child process per session.  Commands
@@ -5493,8 +5520,20 @@ router.post('/operations/collaboration-federation', (req, res) => {
 });
 router.use('/operations', collaborationGroupRoutes({ store: collaborationStore,
     sessions: () => globalSessionState.sessions.map(orchestrationSessionSnapshot) }));
+/** Group id from a URL param: the 8-character id a terminal shows resolves to
+ *  its full id, an ambiguous prefix is refused with 409, and anything else is
+ *  simply "no such group" — the same 404 each route already answers. */
+function resolveGroupParam(id) {
+    const resolved = collaborationStore.resolveGroupId(id);
+    if (resolved.status === 'ambiguous')
+        return { group: null, ambiguous: resolved.matches.length };
+    return { group: resolved.status === 'ok' ? collaborationStore.getGroup(resolved.id) : null, ambiguous: 0 };
+}
+const ambiguousGroupResponse = (res, count) => res.status(409).json({ error: ambiguousIdMessage('协作组', count), code: 'GROUP_ID_AMBIGUOUS' });
 router.post('/operations/collaboration-groups/:groupId/spawn', async (req, res) => {
-    const group = collaborationStore.getGroup(req.params.groupId);
+    const { group, ambiguous } = resolveGroupParam(req.params.groupId);
+    if (ambiguous)
+        return ambiguousGroupResponse(res, ambiguous);
     if (!group)
         return res.status(404).json({ error: '协作组不存在' });
     try {
@@ -5507,14 +5546,18 @@ router.post('/operations/collaboration-groups/:groupId/spawn', async (req, res)
     }
 });
 router.get('/operations/collaboration-groups/:groupId/messages', (req, res) => {
-    const group = collaborationStore.getGroup(req.params.groupId);
+    const { group, ambiguous } = resolveGroupParam(req.params.groupId);
+    if (ambiguous)
+        return ambiguousGroupResponse(res, ambiguous);
     if (!group)
         return res.status(404).json({ error: '协作组不存在' });
     res.json({ messages: collaborationStore.listMessages(group.id, Number(req.query.limit) || 200) });
 });
 router.post('/operations/collaboration-groups/:groupId/messages', (req, res) => {
     try {
-        const group = collaborationStore.getGroup(req.params.groupId);
+        const { group, ambiguous } = resolveGroupParam(req.params.groupId);
+        if (ambiguous)
+            return ambiguousGroupResponse(res, ambiguous);
         if (!group)
             return res.status(404).json({ error: '协作组不存在' });
         const fromSessionId = resolveFrontendSessionId(req.body ?? {});
@@ -5566,7 +5609,9 @@ router.post('/operations/orchestration/members', (req, res) => {
     const groupId = typeof req.body?.groupId === 'string' ? req.body.groupId.trim() : '';
     const targetSessionId = typeof req.body?.targetSessionId === 'string' ? req.body.targetSessionId.trim() : '';
     const action = req.body?.action === 'remove' ? 'remove' : req.body?.action === 'add' ? 'add' : null;
-    const group = collaborationStore.getGroup(groupId);
+    const { group, ambiguous } = resolveGroupParam(groupId);
+    if (ambiguous)
+        return ambiguousGroupResponse(res, ambiguous);
     if (!sourceSessionId)
         return res.status(400).json({ error: '无法识别当前会话；请从 Termdock 会话内运行 td collab' });
     if (!group || !group.sessionIds.includes(sourceSessionId))
@@ -5587,7 +5632,9 @@ router.post('/operations/orchestration/members', (req, res) => {
 router.post('/operations/orchestration/spawn', async (req, res) => {
     const sourceSessionId = resolveFrontendSessionId(req.body ?? {});
     const groupId = typeof req.body?.groupId === 'string' ? req.body.groupId.trim() : '';
-    const group = collaborationStore.getGroup(groupId);
+    const { group, ambiguous } = resolveGroupParam(groupId);
+    if (ambiguous)
+        return ambiguousGroupResponse(res, ambiguous);
     if (!sourceSessionId)
         return res.status(400).json({ error: '无法识别当前会话；请从 Termdock 会话内运行 td collab' });
     if (!group || !group.sessionIds.includes(sourceSessionId))
@@ -5781,7 +5828,7 @@ router.post('/operations/orchestration/drive', async (req, res) => {
                 return res.status(400).json({ error: 'run 文本过长（上限 10000 字符）；需要更多内容请走 td collab send 投递' });
             // Same bracketed-paste write path deliveries use: one line, one submit,
             // embedded newlines stay inside the recipient's editor.
-            await writeCollaborationTmuxPane(runTmux, pane, text);
+            await writeCollaborationTmuxPane(runTmux, pane, text, runTmuxStdin);
             const snapshot = await captureTmuxPaneText(runTmux, pane);
             return res.json({ ok: true, action, sessionId: target, text, snapshot });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.194",
+  "version": "1.4.196",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.194",
+  "version": "1.4.196",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-K4KyYJuVoQDpZsBM8ZX1Rw3MddOxAzVdp/cPm0iGZz0=",
-  "serverBundleHash": "sha256-2Y3XSbsDOzYXhEe57Szt3L16aZzGBDb1ZA/6TsYIiOQ=",
-  "clientBundleHash": "sha256-wpGsT/oJup/G4MyJSKqpHBJlzc2Ha3wFIWmtp4vc/Wc=",
+  "serverBundleHash": "sha256-T/KLnvRkLhdOmsag6ksQv7ZoSL8RTw328UNIFTUC3/4=",
+  "clientBundleHash": "sha256-EQPT/w33vRGcZlyZoRHKmtgmEPWiRSGjRGHBx2SAwOw=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }

package/dist/client/assets/channel-Bkfq4dnz.js

@@ -1 +0,0 @@
-import{c as a,C as n}from"./mermaid.core-Ny4ifEul.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/client/assets/classDiagram-ZZMXUADV-Dahb2o7K.js

@@ -1 +0,0 @@
-import{s as a,a as s,c as t,C as e}from"./chunk-TICWLB2K-N3OPIvmU.js";import{d as i}from"./mermaid.core-Ny4ifEul.js";import"./chunk-5VM5RSS4-BofAFEcC.js";import"./chunk-XXDRQBXY-IurIojt5.js";import"./chunk-POPQ4Y6H-MXmTC-sG.js";import"./chunk-F27PBJKO-CLNw1JDM.js";import"./purify.es-4eNOHKSq.js";import"./app-5zC_J9mq.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var g={parser:t,get db(){return new e},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{g as diagram};

package/dist/client/assets/classDiagram-v2-VYDZK3BY-Dahb2o7K.js

@@ -1 +0,0 @@
-import{s as a,a as s,c as t,C as e}from"./chunk-TICWLB2K-N3OPIvmU.js";import{d as i}from"./mermaid.core-Ny4ifEul.js";import"./chunk-5VM5RSS4-BofAFEcC.js";import"./chunk-XXDRQBXY-IurIojt5.js";import"./chunk-POPQ4Y6H-MXmTC-sG.js";import"./chunk-F27PBJKO-CLNw1JDM.js";import"./purify.es-4eNOHKSq.js";import"./app-5zC_J9mq.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var g={parser:t,get db(){return new e},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{g as diagram};