wezard 1.2.12 → 1.2.16

package/dist/daemon/approval.js

@@ -1,11 +1,15 @@
 import { closeSync, fstatSync, openSync, readFileSync, readSync } from "node:fs";
 import { createPending, getPending, getResolvedSnapshot, resolvePending, resolvePendingsByChat, failPending, stashResolved, markCardSent, isReloadError } from "./pending.js";
 import { cacheGet, cachePut, cacheKey, isAutoWindowActive, autoWindowRemainingMs, setAutoWindow, clearAutoWindow, getWindowMeta, } from "./session-cache.js";
+import { evaluateAllow, ruleMatchesAny, alwaysAllowRulesFor, splitSegments, NEVER_RULE_ALLOW } from "../shared/allow-rules.js";
 import { redact } from "./redact.js";
-import { dangerOf, dangerModeSkips, dangerSkips } from "./danger.js";
-import { recordApproval, recordApprovalDecision, buildDetailUrl } from "./detail.js";
+import { dangerOf, dangerEarlyExit } from "./danger.js";
+import { appendUnique } from "../shared/config-writer.js";
+import { claudeConfigWrite } from "../shared/claude-config-path.js";
+import { recordApproval, recordApprovalDecision, buildDetailUrl, getDetail } from "./detail.js";
 import { json, readBody } from "./http.js";
 import { tagBadge, withTagHeader } from "../shared/session-label.js";
+import { sessionNameFor } from "./session-name.js";
 // ── Routing helpers ────────────────────────────────────────────────────
 const targetChatId = (principal) => {
     // "user:abc" → "abc" (DM chatid == userid for aibot)
@@ -41,16 +45,15 @@ const takeFirstLines = (s, lines, maxChars) => TRUNC(s.split("\n").slice(0, line
 const EDIT_SNIPPET_LEN = 160;
 const WRITE_PREVIEW_LINES = 4;
 const WRITE_PREVIEW_CHARS = 200;
-const SOURCE_BASE = {
-    icon_url: "https://wwcdn.weixin.qq.com/node/wework/images/3d-claude-ai-logo.bce0ddae70.jpg",
-    desc: "Claude Code",
-    desc_color: 0,
-};
-// Source bar sits ABOVE main_title — only place we can hoist transcript context.
-const buildSource = (tail) => {
-    const desc = tail ? TRUNC(tail, 80) : SOURCE_BASE.desc;
-    return { ...SOURCE_BASE, desc };
-};
+const SOURCE_ICON = "https://wwcdn.weixin.qq.com/node/wework/images/3d-claude-ai-logo.bce0ddae70.jpg";
+// Source 行 = 会话身份位: 放会话名 (谁在请求), 让 main_title 整块 13×2 字腾给
+// "想干什么"。危险卡只把这行文字变红 (desc_color: 2), 不换文案不加图标 ——
+// 红色本身就是信号。会话名缺失时回落品牌名, 不留空行。
+const buildSource = (danger, sessionName) => ({
+    icon_url: SOURCE_ICON,
+    desc: TRUNC(sessionName || "Claude Code", 13),
+    desc_color: danger ? 2 : 0,
+});
 const prefixLines = (s, prefix) => s.split("\n").map((l) => `${prefix} ${l}`).join("\n");
 // Flat key:val summary for unknown tools — never dump raw JSON.
 const UNKNOWN_VAL_LEN = 140;
@@ -76,7 +79,25 @@ const summarizeUnknown = (i, cwd) => {
     }
     return lines.join("\n");
 };
-const QUOTE_MAX = 600;
+// 卡片 quote 体上限 — 由 approval.cardQuoteMaxChars 注入 (渲染函数调用点太多,
+// 模块级注入一次比层层穿参干净)。发送失败时缩到 SAFE_QUOTE_MAX 重试, 见 flushBatch。
+let QUOTE_MAX = 600;
+export const setCardQuoteMax = (n) => { QUOTE_MAX = n; };
+const SAFE_QUOTE_MAX = 600;
+// 发送失败缩容重试: 正文主体如今在 sub_title_text (v2 布局), quote_area 仅存于
+// 历史路径 —— 两处都缩, 保住审批流比保住展示量重要。
+const shrinkQuote = (c) => {
+    let out = c;
+    const q = c.quote_area;
+    if (q?.quote_text && q.quote_text.length > SAFE_QUOTE_MAX) {
+        out = { ...out, quote_area: { ...q, quote_text: TRUNC(q.quote_text, SAFE_QUOTE_MAX) } };
+    }
+    const st = out.sub_title_text;
+    if (st && st.length > SAFE_QUOTE_MAX) {
+        out = { ...out, sub_title_text: TRUNC(st, SAFE_QUOTE_MAX) };
+    }
+    return out;
+};
 const join = (...parts) => parts.filter(Boolean).join("\n");
 // Render tool input as a multi-line "code-block / quote" body.
 const renderInput = (toolName, toolInput, _toolInputStr, cwd) => {
@@ -128,11 +149,18 @@ const renderInput = (toolName, toolInput, _toolInputStr, cwd) => {
     }
     return { body: summarizeUnknown(i, cwd) };
 };
-const quoteArea = (text) => ({ type: 0, quote_text: text });
+// Bash/Shell 的原始命令 — 判断卡片正文是否被截断、以及「展开完整命令」取哪一段。
+const commandOf = (toolName, toolInput) => {
+    if (toolName !== "Bash" && toolName !== "Shell")
+        return "";
+    const i = toolInput;
+    return i && typeof i.command === "string" ? i.command : "";
+};
 const MAIN_DESC_MAX = 30;
 const mainTitle = (title, desc) => desc ? { title, desc: TRUNC(desc, MAIN_DESC_MAX) } : { title };
 const dirName = (cwd) => cwd.replace(/^.*\//, "") || cwd;
-const detailJumpList = (url) => url ? [{ type: 1, title: "🔍 详情", url }] : undefined;
+// quote_area 弃用后, jump_list 是卡上唯一的 PC 跳转位 (13 字上限)。
+const detailJumpList = (url) => url ? [{ type: 1, title: "🔍 完整命令 · 详情", url }] : undefined;
 // Stable per-session animal emoji, matching list_claude_sessions, so the user
 // can tell which session a card belongs to when several un-mirrored sessions
 // fall back to the same WeCom chat. Needs the FULL sessionId; returns "" when
@@ -145,9 +173,70 @@ const detailJumpList = (url) => url ? [{ type: 1, title: "🔍 详情", url }] :
 // prefix that outbound mirror bubbles carry — one visual per tag, regardless
 // of how many times `/clear` rotates the underlying sessionId.
 const emojiFor = tagBadge;
-const tagOf = (a) => emojiFor(a.chatKey);
-// 危险卡: 只有 ❌ / ✅ — 不给「N 分钟全过」的入口, 否则一次点击就把后续
-// 所有危险操作也放行了, 名单等于失效。
+// ── v3 布局 (2026-07-31 两轮真机反馈后定稿) ──────────────────────────
+// 信息优先级: 谁在问(会话名) > 想干什么(desc) > 具体命令 > 上下文。
+//   source        品牌位; 危险卡文字变红 (仅变色, 不换文案)
+//   main_title    <会话名> · <工具> — 无锁/无 emoji, 纯文字
+//   quote_area    命令主体 — 无标题, 整块可点跳详情页 (PC); 3 行截断由
+//                 右上⋯展开与详情页兜底
+//   horizontal    上文 (最近用户消息); 危险卡多一行规则名
+//   jump_list     「🔍 完整命令·详情」
+// 会话名: #tag (企微发起) > CC 会话名 (本地发起, sessions 注册表) > 首条消息。
+const HMETA_VAL_MAX = 26;
+// 一级标题 = Claude 自己写的意图 (tool_input.description), 回答"想干什么" ——
+// 13×2 字里最值钱的内容。没有 description 的工具 (Read/Write/Edit…) 回落
+// 「工具 · 目录/」, 因为具体路径在下面的引用区里已经有了。
+const cardTitle = (a, r) => r.desc || `${shortTool(a.toolName)} · ${dirName(a.cwd)}/`;
+// 「审核」行: 说清这条命令为什么没被白名单放行 —— 与「危险」行同一种表达方式。
+// 能算出「总是」将生成的规则时直接给规则 (点总是会发生什么), 否则给段落定位。
+const denyReasonText = (d) => {
+    switch (d.kind) {
+        case "segment_unmatched":
+            return d.rule
+                ? `${d.index}/${d.total}段 → ${d.rule}`
+                : `${d.index}/${d.total}段 ${d.segment}`;
+        case "substitution": return "含 $() 动态构造，无法白名单";
+        case "unparsable": return "引号未闭合或含后台符 &";
+        case "tool_not_listed": return `${shortTool(d.tool)} 未在白名单`;
+        case "never_allow": return "交互工具，永不免审";
+        // 没配白名单规则 = 用户没在用这套机制, 每张卡都挂这行纯噪声。
+        case "no_rules": return undefined;
+    }
+};
+// mcp__server__tool → server:tool — 标题里的长工具名压短。
+const shortTool = (toolName) => TRUNC(toolName.replace(/^mcp__/, "").replace(/__/g, ":"), 16);
+const metaRows = (a) => {
+    const rows = [];
+    const tail = oneLine(a.transcriptTail).trim();
+    if (tail)
+        rows.push({ keyname: "上文", value: TRUNC(tail, HMETA_VAL_MAX) });
+    // 为什么要人来点这一下 —— 优先级 危险 > 未白名单。danger 命中时命令很可能
+    // 本来就在白名单里, 再报"未放行"是误导。
+    if (a.danger) {
+        rows.push({ keyname: "危险", value: TRUNC(`命中「${a.danger}」`, HMETA_VAL_MAX) });
+    }
+    else if (a.denyReason) {
+        const why = denyReasonText(a.denyReason);
+        if (why)
+            rows.push({ keyname: "审核", value: TRUNC(why, HMETA_VAL_MAX) });
+    }
+    return rows.length > 0 ? rows : undefined;
+};
+// 命令主体 (引用区, 可点) + 元信息行, 各卡共用的中段。
+const bodyBlocks = (a, r) => {
+    const rows = metaRows(a);
+    return {
+        ...(r.body ? { quote_area: quoteArea(r.body, a.detailUrl) } : {}),
+        ...(rows ? { horizontal_content_list: rows } : {}),
+    };
+};
+// 引用区: 无标题 (省一行), 挂 type:1 + url 整块可点 → 详情页看全文 (PC 好用;
+// 回环链接手机打不开是已知取舍, 手机走右上⋯展开)。
+const quoteArea = (text, url) => (url
+    ? { type: 1, url, quote_text: text }
+    : { type: 0, quote_text: text });
+// 危险卡: 只有 ❌ / ✅ — 不给「N 分钟全过」「✅总是」的入口, 否则一次点击就把
+// 后续所有危险操作也放行了, 名单等于失效。
 const approveButtons = (a) => a.danger
     ? [
         { text: "❌", style: 4, key: encodeKey(a.reqId, "deny") },
@@ -156,19 +245,42 @@ const approveButtons = (a) => a.danger
     : [
         { text: "❌", style: 4, key: encodeKey(a.reqId, "deny") },
         { text: fmtWindow(a.windowMinutes), style: 3, key: encodeKey(a.reqId, "allow_window") },
+        // 「总是」= 由本次调用生成一条 allowRules 并落盘, 对齐 Claude Code 原生
+        // 弹窗的 Always allow。危险卡上没有这个入口 (与「⏱全过」同理)。
+        { text: "✅总是", style: 4, key: encodeKey(a.reqId, "allow_always") },
         { text: "✅", style: 4, key: encodeKey(a.reqId, "allow") },
     ];
+// 正文放不下时的两条出路, 都挂在卡片自己身上 (不再额外发一条完整命令的文本消息):
+//   • 引用区可点 → 详情页 (HTML, 有高亮, 但要跳浏览器)
+//   • 右上角「⋯」菜单「📄 展开完整命令」→ 按需在群里发全文 (不跳出企微)
+// action_menu 只在正文确实被截断时才挂, 免得短命令的卡也多一个没用的入口。
+const FULLCMD_PREFIX = "FULLCMD|";
+const encodeFullCmdKey = (reqId) => `${FULLCMD_PREFIX}${reqId}`;
+// WeCom markdown 单条上限约 2048 字节, 留出标题与 tag 头的余量。
+const FULLCMD_CHUNK_CHARS = 1800;
+const chunkText = (s, size) => {
+    const out = [];
+    for (let i = 0; i < s.length; i += size)
+        out.push(s.slice(i, i + size));
+    return out.length > 0 ? out : [""];
+};
+/** 带命令的卡一律给「看全文」入口, 待决卡与已决卡共用 (已决卡也要能回看批了
+ *  什么), 不按长度区分 —— 短命令多一个菜单项无害。
+ *  右上「⋯」→ 群里发全文 (哪端都能用); jump_list「🔍 完整命令·详情」→ 详情页
+ *  (PC 端好用, 回环链接手机打不开是已知取舍)。 */
+const fullCmdMenu = (a) => commandOf(a.toolName, a.toolInput)
+    ? { desc: "更多", action_list: [{ text: "📄 展开完整命令", key: encodeFullCmdKey(a.reqId) }] }
+    : undefined;
 const buildCard = (a) => {
     const r = renderInput(a.toolName, a.toolInput, a.toolInputStr, a.cwd);
-    const dir = dirName(a.cwd);
-    const tail = oneLine(a.transcriptTail).trim();
     const jl = detailJumpList(a.detailUrl);
+    const menu = fullCmdMenu(a);
     return {
         card_type: "button_interaction",
-        source: buildSource(tail),
-        main_title: mainTitle(`${a.danger ? "⚠️ 危险" : "🔐 授权"} · ${tagOf(a)}${a.toolName} · ${dir}/`, r.desc),
-        ...(a.danger ? { sub_title_text: `命中危险名单「${a.danger}」· 需单独确认,不进入自动放行` } : {}),
-        ...(r.body ? { quote_area: quoteArea(r.body) } : {}),
+        source: buildSource(a.danger, a.sessionName),
+        main_title: { title: TRUNC(cardTitle(a, r), 26) },
+        ...bodyBlocks(a, r),
+        ...(menu ? { action_menu: menu } : {}),
         ...(jl ? { jump_list: jl } : {}),
         task_id: a.reqId,
         button_list: approveButtons(a),
@@ -180,6 +292,7 @@ const verbOf = (d, windowMinutes) => {
         case "deny": return "已拒绝";
         case "allow_window": return `${fmtWindow(windowMinutes)}会话内全过`;
         case "allow_session": return "本会话通过";
+        case "allow_always": return "已通过·规则已保存";
         default: return "已通过";
     }
 };
@@ -201,14 +314,16 @@ const resolvedButton = (d, windowMinutes, reqId, chatKey) => {
 };
 const buildResolvedCard = (a) => {
     const r = renderInput(a.toolName, a.toolInput, a.toolInputStr, a.cwd);
-    const dir = dirName(a.cwd);
-    const tail = oneLine(a.transcriptTail).trim();
     const jl = detailJumpList(a.detailUrl);
+    // 已决卡同样保留「看全文」入口 —— 回头想确认"我刚才批的到底是什么"是常态,
+    // 而 detail 记录留存 24h, 点了照样能展开。
+    const menu = fullCmdMenu(a);
     return {
         card_type: "button_interaction",
-        source: buildSource(tail),
-        main_title: mainTitle(`${a.danger ? "⚠️ " : ""}${tagOf(a)}${a.toolName} · ${dir}/`, r.desc),
-        ...(r.body ? { quote_area: quoteArea(r.body) } : {}),
+        source: buildSource(a.danger, a.sessionName),
+        main_title: { title: TRUNC(cardTitle(a, r), 26) },
+        ...bodyBlocks(a, r),
+        ...(menu ? { action_menu: menu } : {}),
         ...(jl ? { jump_list: jl } : {}),
         task_id: a.reqId,
         button_list: [resolvedButton(a.decision, a.windowMinutes, a.reqId, a.chatKey ?? "")],
@@ -216,14 +331,12 @@ const buildResolvedCard = (a) => {
 };
 const buildCancelledCard = (a) => {
     const r = renderInput(a.toolName, a.toolInput, a.toolInputStr, a.cwd);
-    const dir = dirName(a.cwd);
-    const tail = oneLine(a.transcriptTail).trim();
     const jl = detailJumpList(a.detailUrl);
     return {
         card_type: "button_interaction",
-        source: buildSource(tail),
-        main_title: mainTitle(`${tagOf(a)}${a.toolName} · ${dir}/`, r.desc),
-        ...(r.body ? { quote_area: quoteArea(r.body) } : {}),
+        source: buildSource(a.danger, a.sessionName),
+        main_title: { title: TRUNC(cardTitle(a, r), 26) },
+        ...bodyBlocks(a, r),
         ...(jl ? { jump_list: jl } : {}),
         task_id: a.reqId,
         button_list: [
@@ -234,14 +347,12 @@ const buildCancelledCard = (a) => {
 // 已 resolved 的卡再次被点击 — 仅作视觉反馈, 不改变任何状态。
 const buildAlreadyResolvedCard = (a) => {
     const r = renderInput(a.toolName, a.toolInput, a.toolInputStr, a.cwd);
-    const dir = dirName(a.cwd);
-    const tail = oneLine(a.transcriptTail).trim();
     const jl = detailJumpList(a.detailUrl);
     return {
         card_type: "button_interaction",
-        source: buildSource(tail),
-        main_title: mainTitle(`${tagOf(a)}${a.toolName} · ${dir}/`, r.desc),
-        ...(r.body ? { quote_area: quoteArea(r.body) } : {}),
+        source: buildSource(a.danger, a.sessionName),
+        main_title: { title: TRUNC(cardTitle(a, r), 26) },
+        ...bodyBlocks(a, r),
         ...(jl ? { jump_list: jl } : {}),
         task_id: a.reqId,
         button_list: [{ text: "已经放行", style: 4, key: `noop:${a.reqId}` }],
@@ -280,26 +391,33 @@ const renderBatchBody = (batch) => {
         lines.push(`…还有 ${overflow} 项`);
     return TRUNC(lines.join("\n"), QUOTE_MAX);
 };
-const buildBatchCard = (batch, transcriptTail) => {
-    const dir = dirName(batch.members[0]?.cwd ?? "");
+// 批量卡的标题/中段与单卡同构 (会话名 + 工具×N / 成员列表进引用区)。
+const batchTitle = (batch) => `${batch.sessionName || batch.sessionId.slice(-8)} · ${shortTool(batch.toolName)} ×${batch.members.length}`;
+const batchBlocks = (batch, transcriptTail) => {
+    const rows = [];
     const tail = oneLine(transcriptTail).trim();
-    const emoji = emojiFor(batch.approver);
+    if (tail)
+        rows.push({ keyname: "上文", value: TRUNC(tail, HMETA_VAL_MAX) });
+    if (batch.danger)
+        rows.push({ keyname: "危险", value: TRUNC(`命中「${batch.danger}」`, HMETA_VAL_MAX) });
     return {
-        card_type: "button_interaction",
-        source: buildSource(tail),
-        main_title: { title: `🔐 授权 · ${emoji}${batch.toolName} ×${batch.members.length} · ${dir}/` },
         quote_area: quoteArea(renderBatchBody(batch)),
-        task_id: batch.batchId,
-        button_list: [
-            { text: "❌", style: 4, key: encodeBatchKey(batch.batchId, "deny") },
-            { text: fmtWindow(batch.windowMinutes), style: 3, key: encodeBatchKey(batch.batchId, "allow_window") },
-            { text: "✅", style: 4, key: encodeBatchKey(batch.batchId, "allow") },
-        ],
+        ...(rows.length > 0 ? { horizontal_content_list: rows } : {}),
     };
 };
+const buildBatchCard = (batch, transcriptTail) => ({
+    card_type: "button_interaction",
+    source: buildSource(batch.danger, batch.sessionName),
+    main_title: { title: batchTitle(batch) },
+    ...batchBlocks(batch, transcriptTail),
+    task_id: batch.batchId,
+    button_list: [
+        { text: "❌", style: 4, key: encodeBatchKey(batch.batchId, "deny") },
+        { text: fmtWindow(batch.windowMinutes), style: 3, key: encodeBatchKey(batch.batchId, "allow_window") },
+        { text: `✅ ×${batch.members.length}`, style: 4, key: encodeBatchKey(batch.batchId, "allow") },
+    ],
+});
 const buildBatchResolvedCard = (batch, decision, transcriptTail) => {
-    const dir = dirName(batch.members[0]?.cwd ?? "");
-    const tail = oneLine(transcriptTail).trim();
     const button = decision === "allow_window"
         ? {
             text: `${verbOf(decision, batch.windowMinutes)} · 点击取消`,
@@ -313,25 +431,21 @@ const buildBatchResolvedCard = (batch, decision, transcriptTail) => {
         };
     return {
         card_type: "button_interaction",
-        source: buildSource(tail),
-        main_title: { title: `${emojiFor(batch.approver)}${batch.toolName} ×${batch.members.length} · ${dir}/` },
-        quote_area: quoteArea(renderBatchBody(batch)),
+        source: buildSource(batch.danger, batch.sessionName),
+        main_title: { title: batchTitle(batch) },
+        ...batchBlocks(batch, transcriptTail),
         task_id: batch.batchId,
         button_list: [button],
     };
 };
-const buildBatchAlreadyResolvedCard = (batch, transcriptTail) => {
-    const dir = dirName(batch.members[0]?.cwd ?? "");
-    const tail = oneLine(transcriptTail).trim();
-    return {
-        card_type: "button_interaction",
-        source: buildSource(tail),
-        main_title: { title: `${emojiFor(batch.approver)}${batch.toolName} ×${batch.members.length} · ${dir}/` },
-        quote_area: quoteArea(renderBatchBody(batch)),
-        task_id: batch.batchId,
-        button_list: [{ text: "已经放行", style: 4, key: encodeBatchNoopKey(batch.batchId) }],
-    };
-};
+const buildBatchAlreadyResolvedCard = (batch, transcriptTail) => ({
+    card_type: "button_interaction",
+    source: buildSource(batch.danger, batch.sessionName),
+    main_title: { title: batchTitle(batch) },
+    ...batchBlocks(batch, transcriptTail),
+    task_id: batch.batchId,
+    button_list: [{ text: "已经放行", style: 4, key: encodeBatchNoopKey(batch.batchId) }],
+});
 const encodeKey = (reqId, decision) => `${reqId}|${decision}`;
 const NOOP_PREFIX = "noop:";
 const CANCEL_PREFIX = "cancel_window:";
@@ -346,7 +460,7 @@ const decodeBatchKey = (key) => {
     const [batchId, d] = key.slice(BATCH_PREFIX.length).split("|");
     if (!batchId || !d)
         return undefined;
-    if (d !== "allow" && d !== "allow_session" && d !== "allow_window" && d !== "deny")
+    if (d !== "allow" && d !== "allow_session" && d !== "allow_window" && d !== "allow_always" && d !== "deny")
         return undefined;
     return { batchId, decision: d };
 };
@@ -362,7 +476,7 @@ const decodeKey = (key) => {
     const [reqId, d] = key.split("|");
     if (!reqId || !d)
         return {};
-    if (d !== "allow" && d !== "allow_session" && d !== "allow_window" && d !== "deny")
+    if (d !== "allow" && d !== "allow_session" && d !== "allow_window" && d !== "allow_always" && d !== "deny")
         return {};
     return { reqId, decision: d };
 };
@@ -1118,18 +1232,94 @@ const handleAskUserQuestion = async ({ cfg, log, client, body, getMirrorTarget,
     return { decision: "deny", reason };
 };
 const decisionToHook = (d) => (d === "deny" ? "deny" : "allow");
-// 危险操作永不走 fallbackOnError:"allow" — 超时/断线时降级为 ask, 交回本地 CLI
-// 由人来确认, 而不是静默放行一次 rm。
-const fallback = (cfg, reason, danger) => ({
-    decision: danger && cfg.approval.fallbackOnError === "allow" ? "ask" : cfg.approval.fallbackOnError,
-    reason: danger ? `${reason}:danger` : reason,
+// 必发卡的请求 (危险名单 / askRules / `.claude/**` 守卫) 永不走 fallbackOnError:
+// "allow" — 超时/断线时降级为 ask, 交回本地 CLI 由人来确认, 而不是静默放行一次
+// rm。只判 danger 的话, 用户自己配的 askRules 在 daemon 挂掉时反而失效。
+const fallback = (cfg, reason, forceSingle) => ({
+    decision: forceSingle && cfg.approval.fallbackOnError === "allow" ? "ask" : cfg.approval.fallbackOnError,
+    reason: forceSingle ? `${reason}:force_single` : reason,
 });
 const resolveApprover = (cfg, sessionId, getMirrorTarget) => {
     const mirror = sessionId ? getMirrorTarget?.(sessionId) : undefined;
     return mirror || pickApprover(cfg);
 };
-export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBeforeCard }) => {
+export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarget, flushBeforeCard, nativeModal }) => {
+    setCardQuoteMax(cfg.approval.cardQuoteMaxChars);
     const detailUrlFor = (id, approver) => buildDetailUrl(cfg.daemon.detailPublicBase, cfg.daemon.host, cfg.daemon.port, id, approver ? targetChatId(approver) : undefined);
+    // 手机端卡片 quote 区实测只渲染前 2~3 行 —— 长命令在卡上看不全。默认解法已经
+    // 挪到卡片自身 (引用区可点进详情页 + 右上角「📄 展开完整命令」按需发全文), 所以
+    // fullCommandPreludeChars 默认为 0 = 不自动前置。留着这条路是给两种情况兜底:
+    // 客户端不渲染 action_menu, 或者就是想让全文无条件出现在群里 (设成正数即可)。
+    // 用 display(已脱敏)副本, token 类不外泄。仅单成员卡触发 (批量卡逐成员推会刷屏)。
+    const PRELUDE_TRIGGER_CHARS = 200;
+    const sendCommandPrelude = async (batch) => {
+        const cap = cfg.approval.fullCommandPreludeChars;
+        if (cap <= 0 || batch.members.length !== 1)
+            return;
+        const cmd = commandOf(batch.toolName, batch.members[0].toolInput);
+        if (cmd.length <= PRELUDE_TRIGGER_CHARS)
+            return;
+        const text = cmd.length > cap ? `${cmd.slice(0, cap)}\n…（已截断，完整命令共 ${cmd.length} 字）` : cmd;
+        const chunks = chunkText(text, FULLCMD_CHUNK_CHARS);
+        const target = targetChatId(batch.approver);
+        for (let i = 0; i < chunks.length; i++) {
+            const head = i === 0
+                ? `🔐 待审批完整命令（${cmd.length} 字${chunks.length > 1 ? `，${i + 1}/${chunks.length}` : ""}）：\n`
+                : `（${i + 1}/${chunks.length}）\n`;
+            await client.sendMessage(target, {
+                msgtype: "markdown",
+                markdown: { content: withTagHeader(batch.approver, head + chunks[i]) },
+            });
+        }
+    };
+    // 「总是」的回执/说明走独立 markdown 消息: 卡片本身已被 updateTemplateCard 收成
+    // 终态, 没有位置再讲"为什么这条规则没存下来"。
+    const notify = async (approver, content) => {
+        try {
+            // withTagHeader: 同一 chat 可能并行跑着多个 `#tag` 会话, 裸消息看不出归属。
+            await client.sendMessage(targetChatId(approver), { msgtype: "markdown", markdown: { content: withTagHeader(approver, content) } });
+        }
+        catch (e) {
+            log.warn({ err: e.message }, "notify send failed");
+        }
+    };
+    // 批准一次 `.claude/**` 写操作之后的收尾: 把 CC 那个不过 hook 的原生确认框按掉。
+    //
+    // 必须在 json(res) **之后**跑 —— CC 只有等 hook 进程退出才会继续走它自己的守卫、
+    // 才会把框渲染出来。所以这里是 fire-and-forget, 由 answer() 内部轮询等框出现。
+    //
+    // 按不掉时不干等: Esc 取消掉这次调用, 再把原因作为一条用户消息注入 pane。模型
+    // 收到的就是明确的"这条路走不通 + 该怎么绕", 而不是静默卡住 —— 等价于预拦截
+    // deny + reason, 只是走镜像通道传达。
+    const settleClaudeConfigModal = async (sessionId, approver, hit) => {
+        const nm = nativeModal;
+        if (!nm)
+            return;
+        const r = await nm.answer(sessionId, { waitMs: cfg.approval.claudeConfigModalWaitMs });
+        if (r.status === "answered") {
+            log.info({ sessionId, path: hit.path, pressed: `${r.index}. ${r.label}` }, "claude-config modal answered");
+            await notify(approver, `🔓 已代按 CLI 原生确认框「${r.title ?? "确认"}」→ 选项 ${r.index}. ${r.label}（${hit.path}）`);
+            return;
+        }
+        if (r.status === "no_modal") {
+            log.info({ sessionId, path: hit.path }, "claude-config modal never appeared (nothing to press)");
+            return;
+        }
+        // unparsable / still_modal / no_pane —— 走取消 + 告知。
+        log.warn({ sessionId, path: hit.path, status: r.status }, "claude-config modal not answered, cancelling");
+        const cancelled = await nm.cancel(sessionId);
+        // Esc 之后 TUI 要一拍才回到输入框; 注入本身还有 modal 守卫兜底(框没退就拒绝注入)。
+        if (cancelled.ok)
+            await new Promise((res) => setTimeout(res, 800));
+        const why = `⚠️ 刚才那步（写 \`${hit.path}\`）被 wezard 取消了：`
+            + `改动 \`.claude/**\` 会让 Claude Code 弹它自己的原生确认框，那个框不经过 PreToolUse hook、`
+            + `企微端点不到，我这次也没能安全代按（${r.status}）。`
+            + `请改用实体真实路径（例如把 skill 实体放在别处再软链回 \`.claude/skills/\`），`
+            + `或让我在你本地终端旁边时再做这一步。`;
+        const told = cancelled.ok ? await nm.tell(sessionId, why) : { ok: false, reason: cancelled.reason };
+        await notify(approver, `⚠️ 原生确认框未能代按（${r.status}）。已${cancelled.ok ? "" : "尝试"}发 Esc 取消本次调用`
+            + `${told.ok ? "，并把原因告知了会话" : `（原因注入失败：${told.reason ?? "unknown"}，请到 tmux 里看一眼）`}。`);
+    };
     // Flush 一个 batch: 单成员 → 普通卡 (与未启用聚合一致); 多成员 → 批量卡。
     // 发送失败时调用 failPending 让每位成员的 handler 走 fallbackOnError 路径,
     // 与单卡路径上 sendMessage 抛错时的语义一致。
@@ -1158,6 +1348,8 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
                     transcriptTail: m.transcriptTail,
                     windowMinutes: batch.windowMinutes,
                     danger: batch.danger,
+                    sessionName: batch.sessionName,
+                    denyReason: batch.denyReason,
                     detailUrl: detailUrlFor(m.reqId, batch.approver),
                 });
             })();
@@ -1171,10 +1363,22 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
             catch (e) {
                 log.warn({ batchId: batch.batchId, err: e.message }, "flushBatch flushBeforeCard failed; sending card anyway");
             }
-            await client.sendMessage(targetChatId(batch.approver), {
-                msgtype: "template_card",
-                template_card: card,
-            });
+            // 前置完整命令消息 (best-effort, 失败不阻断发卡)
+            try {
+                await sendCommandPrelude(batch);
+            }
+            catch (e) {
+                log.warn({ batchId: batch.batchId, err: e.message }, "command prelude send failed");
+            }
+            const sendCard = (c) => client.sendMessage(targetChatId(batch.approver), { msgtype: "template_card", template_card: c });
+            try {
+                await sendCard(card);
+            }
+            catch (e) {
+                // quote 体可能超平台未公开的长度上限 — 缩到安全值重试一次, 保住审批流。
+                log.warn({ batchId: batch.batchId, err: e.message }, "card send failed — retrying with shrunk quote");
+                await sendCard(shrinkQuote(card));
+            }
             log.info({ batchId: batch.batchId, count: batch.members.length, multi: isMulti, approver: batch.approver, tool: batch.toolName }, "batch flushed");
             // 只给单卡打「可续接」标: 批量卡的点击要靠内存里的 batchById 才能一次
             // resolve N 个成员, 那张表撑不过重启 —— 续接了反而会让成员干等一张点了
@@ -1213,6 +1417,52 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
             json(res, 200, { decision: "allow", reason: "matcher_skip" });
             return;
         }
+        // Claude-Code 三层规则语义: deny > ask > allow (语法同源, 见 allow-rules.ts)。
+        // denyRules: 命中直接拒, 不发卡 (Bash 复合命令任一段命中即拒)。
+        const denyHit = ruleMatchesAny(cfg.approval.denyRules, toolName, toolInput);
+        if (denyHit) {
+            log.info({ toolName, sessionId, rule: denyHit }, "deny-rule reject");
+            json(res, 200, { decision: "deny", reason: `deny_rule:${denyHit}` });
+            return;
+        }
+        // askRules: 命中必发卡 — 压过 allowRules、自动放行窗口与会话缓存 (对齐
+        // Claude permissions.ask 的"即使 allowlist 命中也要确认"语义)。
+        const askHit = ruleMatchesAny(cfg.approval.askRules, toolName, toolInput);
+        if (askHit) {
+            log.info({ toolName, sessionId, rule: askHit }, "ask-rule force card");
+        }
+        // `.claude/**` 写守卫 (见 shared/claude-config-path.ts): 这类改动会让 CC 立起
+        // 它自己的原生确认框, 那个框不过 hook —— 规则一放行就是"不发卡 + pane 阻塞"的
+        // 静默死锁。命中且该 session 有活 pane 可代按时强制发卡 (压过 allowRules /
+        // ⏱窗口 / 会话缓存), 批准后 settleClaudeConfigModal 去把框按掉。
+        // 没有活 pane (headless / 未镜像的本地会话) → 不介入: 那种情形用户就在键盘前,
+        // 自己按掉即可, 拦下来只是挡工作。
+        const guardHit = cfg.approval.claudeConfigGuard ? claudeConfigWrite(toolName, toolInput) : undefined;
+        const guardActive = Boolean(guardHit && nativeModal?.hasPane(sessionId));
+        if (guardHit) {
+            log.info({ toolName, sessionId, path: guardHit.path, why: guardHit.why, guardActive }, guardActive ? "claude-config guard force card" : "claude-config write detected (no live pane, passing through)");
+        }
+        // 危险名单 (daemon/danger.ts): 内置的 rm / 强推 / DROP / 敏感路径等。语义上
+        // 是「出厂自带的 askRules」—— 所以它必须和用户写的 askRules 站在同一层, 排在
+        // allowRules 之前。放在后面的话, 一条 `Bash(git *)` 这样的宽 allow 规则 (尤其
+        // 是从 Claude settings.json 批量导入来的) 就能让整份危险名单失效。
+        const danger = dangerOf(cfg, toolName, toolInput);
+        if (danger)
+            log.info({ toolName, sessionId, rule: danger.rule }, "danger hit — forcing single approval");
+        // 必发卡 = 危险名单 或 askRules 命中 或 守卫生效。三者都要压过放行/窗口/缓存。
+        const mustCard = Boolean(danger) || Boolean(askHit) || guardActive;
+        // allowRules: matcher 拦下的工具里再挖细粒度豁免 (Bash 可按命令前缀区分)。
+        // 交互卡工具 (AskUserQuestion 等) 在引擎内部硬保护, 规则写了也不放行。
+        // 用 evaluateAllow 而非 ruleAllows: 未命中时要把"因为哪一段"带到卡上,
+        // 光知道"没放行"帮不了用户判断。判定本身零额外开销 (原本就要跑这一次)。
+        const verdict = evaluateAllow(cfg.approval.allowRules, toolName, toolInput);
+        if (!mustCard && verdict.allowed) {
+            const ruleHit = [...new Set(verdict.hits)].join(" + ");
+            log.info({ toolName, sessionId, rule: ruleHit }, "allow-rule skip");
+            json(res, 200, { decision: "allow", reason: `allow_rule:${ruleHit}` });
+            return;
+        }
+        const denyReason = verdict.allowed ? undefined : verdict.reason;
         // EnterPlanMode: block model-initiated plan mode. deny + reason 回传 model,
         // 让它别进 plan mode、直接干活。用户仍可在本地 Shift+Tab 手动进 plan mode
         // (那条路径不过 hook)。由 config.approval.blockAutoPlanMode 控制(默认 true)。
@@ -1277,22 +1527,18 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
         // 检查要拿到 chatKey (= approver principal) 才能查。approver 缺失时 window
         // 检查跳过 (window 需要一个 chat 才存在), 走后面的 no_approver fallback。
         const approver = resolveApprover(cfg, sessionId, getMirrorTarget);
-        // 危险名单: 命中者跳过 auto-window / session cache / 批量合流, 每次都单独发卡。
-        const danger = dangerOf(cfg, toolName, toolInput);
-        if (danger)
-            log.info({ toolName, sessionId, rule: danger.rule }, "danger hit — forcing single approval");
-        // danger.skip: 命中危险名单也直接放行 (跳过 danger)。
-        if (dangerSkips(cfg, danger)) {
-            json(res, 200, { decision: "allow", reason: "danger_skip" });
-            return;
-        }
-        // danger 模式: 名单之外的调用不打扰人, 直接放行 (卡只留给真正危险的操作)。
-        if (dangerModeSkips(cfg, danger)) {
-            json(res, 200, { decision: "allow", reason: "danger_mode_skip" });
+        // danger.skip / danger 模式的早退。第三个参数是「除 danger 外还有没有别的必发卡
+        // 理由」—— askRules 与 `.claude/**` 守卫不能被 danger 的开关顺带关掉, 判定与
+        // 理由见 dangerEarlyExit 的注释 (守卫被绕过会让 pane 死锁)。
+        const earlyExit = dangerEarlyExit(cfg, danger, Boolean(askHit) || guardActive);
+        if (earlyExit) {
+            log.info({ toolName, sessionId, reason: earlyExit }, "danger switch early exit");
+            json(res, 200, { decision: "allow", reason: earlyExit });
             return;
         }
         // Auto-approve window: while active for THIS chat, requests short-circuit to allow.
-        if (!danger && approver && isAutoWindowActive(approver)) {
+        // mustCard (危险名单 / askRules / `.claude/**` 守卫) 的请求不吃窗口 — 即使开着 ⏱ 也逐条确认。
+        if (!mustCard && approver && isAutoWindowActive(approver)) {
             const remainSec = Math.ceil(autoWindowRemainingMs(approver) / 1000);
             log.info({ toolName, sessionId, chatKey: approver, remainSec }, "auto-window allow");
             json(res, 200, {
@@ -1301,9 +1547,11 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
             });
             return;
         }
-        // Session cache
+        // Session cache (mustCard 的请求同样不吃缓存)
         const ck = cacheKey(sessionId, toolName, toolInput);
-        const cached = danger ? undefined : cacheGet(ck);
+        // mustCard(危险名单 / askRules / 守卫)一律不吃缓存 —— 缓存的语义是「这个调用批过一次
+        // 就不再问」, 与「每次都要单独确认」直接冲突。
+        const cached = mustCard ? undefined : cacheGet(ck);
         if (cached) {
             log.info({ ck, cached }, "cache hit");
             json(res, 200, {
@@ -1314,12 +1562,12 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
         }
         if (!approver) {
             log.warn("no approver configured");
-            json(res, 200, fallback(cfg, "no_approver", danger));
+            json(res, 200, fallback(cfg, "no_approver", mustCard));
             return;
         }
         if (!client.isConnected) {
             log.warn("ws not connected");
-            json(res, 200, fallback(cfg, "ws_disconnected", danger));
+            json(res, 200, fallback(cfg, "ws_disconnected", mustCard));
             return;
         }
         // Build pending + card
@@ -1333,6 +1581,9 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
             }
         })();
         const longPollMs = cfg.approval.longPollSec * 1000;
+        // 卡片标题上的会话身份 — 发卡前算一次, 存进 meta 供 resolved 卡复用
+        // (#tag 直接取; 否则读 transcript 首条用户消息, 带缓存)。
+        const sessionName = sessionNameFor(approver, body.transcript_path, sessionId);
         // Reload 续接: hook 带着上一轮的 req_id 回来, 复用同一个 id 重新挂起 ——
         // WeCom 上那张卡的按钮编的就是它, 于是旧卡的点击照样能 resolve 这次长轮询。
         const resumeId = (body.resume_req_id ?? "").trim();
@@ -1347,6 +1598,9 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
                 chatKey: approver,
                 transcriptTail,
                 danger: danger?.rule,
+                forceSingle: mustCard,
+                sessionName,
+                denyReason,
                 cardSent: Boolean(resumeId), // 续接的前提就是卡已经在群里
             },
             timeoutMs: longPollMs,
@@ -1366,8 +1620,9 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
         // 续接的请求不再进 batch: 卡已经在群里, 重发就是重复轰炸。
         const member = { reqId, toolInput: display, originalToolInput: toolInput, toolInputStr, cwd, transcriptTail };
         const bk = batchKeyOf(sessionId, toolName);
-        // 危险请求既不 join 也不被 join — 一次危险操作 = 一张卡 = 一次点击。
-        const existing = danger ? undefined : activeBatches.get(bk);
+        // 必发卡请求既不 join 也不被 join — 一次这样的操作 = 一张卡 = 一次点击。
+        // 合流会把它塞进带「⏱全过 / ✅总是」的批量卡, 一次点击就连它一起放行了。
+        const existing = mustCard ? undefined : activeBatches.get(bk);
         if (resumeId) {
             // no-op: 直接进下面的长轮询, 等旧卡上的点击。
         }
@@ -1383,14 +1638,16 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
                 approver,
                 windowMinutes: cfg.approval.windowMinutes,
                 danger: danger?.rule,
+                sessionName,
+                denyReason,
                 members: [member],
                 flushed: false,
                 flushTimer: undefined, // set below
             };
-            const coalesceMs = danger ? 0 : cfg.approval.batchCoalesceMs;
+            const coalesceMs = mustCard ? 0 : cfg.approval.batchCoalesceMs;
             const fire = () => void flushBatch(batch);
             batch.flushTimer = coalesceMs > 0 ? setTimeout(fire, coalesceMs) : setImmediate(fire);
-            if (!danger)
+            if (!mustCard)
                 activeBatches.set(bk, batch);
             batchById.set(batch.batchId, batch);
             evictBatches();
@@ -1410,15 +1667,63 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
                 return;
             }
             log.warn({ err: e.message, reqId }, "approval timed out");
-            json(res, 200, fallback(cfg, "approver_timeout", danger));
+            json(res, 200, fallback(cfg, "approver_timeout", mustCard));
             return;
         }
-        // 危险决策一律不留痕: 不写 session cache、不开自动窗口 (卡上本就没这两个
+        // 必发卡的决策一律不留痕: 不写 session cache、不开自动窗口 (卡上本就没这两个
         // 按钮, 这里是防御性兜底 —— 决策也可能来自 sweep / 旧卡)。
-        if (!danger && decision === "allow_session" && cfg.approval.sessionCacheMinutes > 0) {
+        if (!mustCard && decision === "allow_session" && cfg.approval.sessionCacheMinutes > 0) {
             cachePut(ck, decision, cfg.approval.sessionCacheMinutes * 60_000);
         }
-        if (!danger && decision === "allow_window" && cfg.approval.windowMinutes > 0) {
+        // 「✅ 总是」: 由本次调用生成规则, 热生效 + 写回 config.jsonc (对齐 Claude Code
+        // 原生弹窗的 Always allow)。规则生成必须用**未脱敏**的原始 toolInput —— display
+        // 可能被 sensitiveArgRedact 改写过, 拿它生成的前缀匹配不上真实命令。
+        if (decision === "allow_always") {
+            // 命中 askRules 的调用: allow 规则永远被 ask 压过, 存了也是死规则。提示真实
+            // 的生效路径, 而不是静默写入一条永不生效的配置。
+            if (askHit) {
+                await notify(approver, `⚠️ 该命令命中强制审批规则 \`${askHit}\`（askRules 优先于放行规则），「总是」不会生效，本次已放行。如确要永久放行，需从 config.jsonc 的 askRules 移除该规则。`);
+            }
+            // 危险名单同理 (与 askRules 同层, allow 压不过它)。危险卡上本就没有「总是」
+            // 按钮, 这里是防御性兜底 —— 决策也可能来自 sweep / 旧卡。
+            if (!askHit && danger) {
+                await notify(approver, `⚠️ 该操作命中危险名单「${danger.rule}」，不支持「总是」：这类操作每次都要单独确认。`
+                    + `本次已放行。如确要长期免审，请在 config.jsonc 的 \`approval.danger.allowPatterns\` 里加豁免正则。`);
+            }
+            const gen = askHit || danger ? [] : alwaysAllowRulesFor(toolName, toolInput, cfg.approval.allowRules);
+            const added = gen.filter((r) => !cfg.approval.allowRules.includes(r));
+            if (added.length > 0) {
+                cfg.approval.allowRules.push(...added); // 先热生效; 文件写失败也不回滚内存
+                if (sourcePath) {
+                    try {
+                        for (const r of added)
+                            appendUnique(sourcePath, ["approval", "allowRules"], r);
+                    }
+                    catch (e) {
+                        log.warn({ err: e.message }, "allow_always persist failed (in-memory only)");
+                    }
+                }
+                log.info({ toolName, added, persisted: Boolean(sourcePath) }, "allow_always rules saved");
+                await notify(approver, `📌 已保存永久放行规则：${added.map((r) => `\`${r}\``).join("、")}`);
+            }
+            else if (!askHit && !danger && gen.length === 0) {
+                // 提炼不出可靠字面规则 —— 本次一次性放行并告知。文案必须指对排查方向:
+                // 成因有四种, 笼统说"引号/结构有问题"会把用户带偏 (例如真凶是 fd 重定向
+                // 的 `&` 被当成后台执行符时, 用户会去查引号)。
+                const cmdStr = typeof toolInput?.command === "string"
+                    ? toolInput.command
+                    : "";
+                const why = NEVER_RULE_ALLOW.has(toolName)
+                    ? `\`${toolName}\` 是交互工具，永不支持免审（引擎内部硬保护）`
+                    : /[`]|\$\(/.test(cmdStr)
+                        ? "该命令含动态构造（$() / 反引号），字面规则无法可靠描述其行为"
+                        : splitSegments(cmdStr) === undefined
+                            ? "该命令含未闭合引号或后台执行符 `&`，无法安全分段"
+                            : "该命令的结构提炼不出可靠前缀（异形段首、或解释器头部拿不到子命令）";
+                await notify(approver, `📌 ${why}，本次已一次性放行（未保存规则）。`);
+            }
+        }
+        if (!mustCard && decision === "allow_window" && cfg.approval.windowMinutes > 0) {
             setAutoWindow(approver, cfg.approval.windowMinutes * 60_000, {
                 toolName,
                 toolInput: display,
@@ -1453,6 +1758,14 @@ export const makeApproveHandler = ({ cfg, log, client, getMirrorTarget, flushBef
             decision: decisionToHook(decision),
             reason: decision,
         });
+        // 放行 `.claude/**` 写操作后, CC 会在 hook 退出后立起自己的原生确认框 —— 必须
+        // 等响应发出去才能去按 (框此刻还不存在)。fire-and-forget: 这条 HTTP 请求已经
+        // 结束, 失败也只能靠告知, 不能再改判决。
+        if (guardActive && guardHit && decisionToHook(decision) === "allow") {
+            void settleClaudeConfigModal(sessionId, approver, guardHit).catch((e) => {
+                log.warn({ err: e.message, sessionId }, "settleClaudeConfigModal failed");
+            });
+        }
     };
 };
 // ── Card click event → resolvePending + update card in place ────────────
@@ -1472,6 +1785,47 @@ export const installApprovalEventListener = (client, log, cfg, onApproved) => {
         const key = ev?.template_card_event?.event_key ?? ev?.event_key ?? "";
         // Update 时 task_id 必须跟回调里的一致，否则微信会拒掉更新。
         const cbTaskId = ev?.template_card_event?.task_id ?? ev?.task_id ?? "";
+        // ── action_menu「📄 展开完整命令」: 纯展示, 不改判决、不 resolve pending。
+        // 取 detail store 而不是 pending —— 用户很可能是点完 ✅ 之后回头想看全文,
+        // 那时 pending 早被删了; detail 记录留存 24h, 且卡片解决后依然可点。
+        if (key.startsWith(FULLCMD_PREFIX)) {
+            const reqId = key.slice(FULLCMD_PREFIX.length);
+            const rec = getDetail(reqId);
+            // 回复目标: 待决时在 pending 里, 已决时 pending 已删 —— 回落到 resolved
+            // 暂存。两个都没有才用 defaultChat (`#tag` 会话会因此回到主会话, 不理想,
+            // 但那已经是记录过期的边缘情形)。
+            const target = getPending(reqId)?.chatKey
+                ?? getResolvedSnapshot(reqId)?.meta.chatKey
+                ?? cfg.defaultChat;
+            const cmd = rec && rec.kind === "approval" ? commandOf(rec.toolName, rec.toolInput) : "";
+            // 只能走主动 markdown 分块 (≤1800 字单条)。曾试过对点击事件做 stream 被动
+            // 回复 (单条 20480 字节) —— 企微服务端拒绝: errcode=846605 invalid req_id,
+            // 卡片事件的 req_id 仅可用于 updateTemplateCard, 不进被动回复通道。
+            void (async () => {
+                try {
+                    if (!cmd) {
+                        await client.sendMessage(targetChatId(target), {
+                            msgtype: "markdown",
+                            markdown: { content: withTagHeader(target, "⌛ 该命令的详情已过期（记录只保留 24 小时），无法展开。") },
+                        });
+                        return;
+                    }
+                    for (const [i, chunk] of chunkText(cmd, FULLCMD_CHUNK_CHARS).entries()) {
+                        const n = Math.ceil(cmd.length / FULLCMD_CHUNK_CHARS);
+                        const head = n > 1 ? `📄 完整命令（${cmd.length} 字，${i + 1}/${n}）：\n` : `📄 完整命令（${cmd.length} 字）：\n`;
+                        await client.sendMessage(targetChatId(target), {
+                            msgtype: "markdown",
+                            markdown: { content: withTagHeader(target, head + chunk) },
+                        });
+                    }
+                    log.info({ reqId, len: cmd.length, target }, "full command expanded on demand");
+                }
+                catch (e) {
+                    log.warn({ err: e.message, reqId }, "full command expand failed");
+                }
+            })();
+            return;
+        }
         // ── AskUserQuestion 投票卡: 在普通 approval 解码前先匹配 ASKQ| 前缀。
         const askq = decodeAskqKey(key);
         if (askq) {
@@ -1698,6 +2052,8 @@ export const installApprovalEventListener = (client, log, cfg, onApproved) => {
                     chatKey: meta?.chatKey ?? "",
                     transcriptTail: meta?.transcriptTail ?? "",
                     windowMinutes: cfg.approval.windowMinutes,
+                    sessionName: meta?.sessionName,
+                    denyReason: meta?.denyReason,
                     detailUrl: detailUrlFor(reqId, meta?.chatKey),
                 })
                 : buildResolvedCard({
@@ -1714,6 +2070,8 @@ export const installApprovalEventListener = (client, log, cfg, onApproved) => {
                     sessionId: meta?.sessionId ?? "",
                     chatKey: meta?.chatKey ?? "",
                     danger: meta?.danger,
+                    sessionName: meta?.sessionName,
+                    denyReason: meta?.denyReason,
                     detailUrl: detailUrlFor(reqId, meta?.chatKey),
                 });
             await client.updateTemplateCard(frame, card);