wezard 2.5.0 → 2.6.0

package/dist/daemon/index.js

@@ -5,13 +5,14 @@ import { timingSafeEqual } from "node:crypto";
 import { loadOrCreateSvrToken } from "../shared/svr-token.js";
 import { DAEMON_TOKEN_FILE, DAEMON_TOKEN_HEADER } from "../shared/daemon-token.js";
 import { homedir } from "node:os";
-import { TIERS, loadConfig } from "../shared/config.js";
+import { TIERS, defaultChatFor, tiersForBackend, loadConfig } from "../shared/config.js";
 import { makeLogger } from "../shared/log.js";
 import { clipLine, sleep, truncate } from "../shared/std.js";
 import { patchJsonc } from "../shared/config-writer.js";
 import { EFFORTS, parseEffort } from "../shared/effort.js";
 import { bindCliBackends, projectDirsFor } from "../shared/cli-backends.js";
-import { startWs } from "./ws.js";
+import { bindCodexStateDir } from "../shared/codex.js";
+import { startMux } from "./bot-mux.js";
 import { startWeixin } from "./weixin.js";
 import { installWeixinPort } from "./weixin-port.js";
 import { bindWxCommands, makeOnBound, makeWxCommands, routeSendMedia, wecomBindSink, weixinSendMedia, wxAdmins, wxRoutes } from "./weixin-cmd.js";
@@ -20,13 +21,13 @@ import { aibotSendMedia } from "./aibot-media.js";
 import { startNetWatch } from "./net-watch.js";
 import { startHttp, json, readBody } from "./http.js";
 import { parsePath } from "../shared/config-meta.js";
-import { applyHot, patchedTop, configGet, fromLegacy, legacyGet, pickTier, planSet, renderPlan, tierEvidence } from "./config-api.js";
+import { applyHot, cfgSeenBy, patchedTop, pinChatKeys, configGet, fromLegacy, legacyGet, pickTier, planSet, renderPlan, tierEvidence } from "./config-api.js";
 import { computeUsage, costOf, fmtCost, fmtTokens, sumTotal } from "./usage.js";
 import { installInboundRouter } from "./inbound.js";
 import { loadMirrorStore } from "./mirror-store.js";
 import { startMirror, installMirrorEventListener } from "./mirror-bridge.js";
-import { runTmux, setTmuxTimeoutReporter, spawnTmuxClaude } from "./spawn-tmux.js";
-import { installApprovalEventListener, makeApproveHandler, requestConfirm } from "./approval.js";
+import { backendFor, runTmux, setTmuxTimeoutReporter, spawnTmuxClaude } from "./spawn-tmux.js";
+import { bindCardChannel, installApprovalEventListener, makeApproveHandler, requestConfirm } from "./approval.js";
 import { initDetailPersistence, makeDetailHandler, chatHandlers, configureRemoteForward, chatUrlFor, setWorldFactsProvider, currentHumanQueryOf, recordPost, recordCharter, backfillCharter } from "./detail.js";
 import { EMPTY_FACTS } from "../shared/world.js";
 import { clearAutoWindow, initAutoWindowPersistence, setAutoWindow } from "./session-cache.js";
@@ -41,7 +42,7 @@ import { startScheduler, migrateLegacySchedules, promptWantsFreshWizard, renderT
 import { openTaskRegistry } from "./task-registry.js";
 import { describeTrigger, nextFire, parseTrigger, WHEN_HELP } from "../shared/trigger.js";
 import { isQuiet, slugify, uniqueId } from "../shared/task-file.js";
-import { baseOfKey, bindTagLinker, headed, ownHead, isInternalKey, keyOf, linkTags, normalizeTag, speakerHead, tagFromCwd, tagHead, tagLink, tagOfKey, uniqueTag, withTagHeader } from "../shared/session-label.js";
+import { baseOfKey, bindMultiBot, bindTagLinker, botOfKey, headed, ownHead, isInternalKey, keyOf, linkTags, normalizeTag, sameBot, speakerHead, tagFromCwd, tagHead, tagLink, tagOfKey, uniqueTag, withTagHeader } from "../shared/session-label.js";
 import { appendEpisode, clipForCharter, cwdOfMd, episodePath, inboxPath, mdsOf, proposedCwds, memoryPath, memoryRoot, proposeMemory, readMemory } from "./wizard-memory.js";
 import { retireStewardTask, startSteward, stewardEnvelope, STEWARD_ID, STEWARD_RUN_MS, STEWARD_TARGET } from "./memory-steward.js";
 import { applyChatNames, chatBaseOf, chatNameOf, chatPolicyOf, clearChatName, listChatNames, normChatName, peerAddress, planChatNames, setChatName, stewardTierOf } from "./chat-name.js";
@@ -58,9 +59,9 @@ import { loadJsonMap } from "../shared/json-map-store.js";
 import { createReceipts, deadlineOf, kAttr, kOfAttr, newTurn } from "./receipts.js";
 import { renderInFlight } from "../shared/turn-state.js";
 import { startIdleNudge } from "./idle-nudge.js";
-import { renderReminder } from "../shared/reminder.js";
+import { askerFromEnvelope, renderReminder } from "../shared/reminder.js";
 import { createHandoffs, handedOff, handingOff } from "./handoff.js";
-import { coldGateOf, decide, rankCandidates, renderCandidates, tierFor, wakeCostOf, wakeNoteOf } from "./route.js";
+import { coldGateOf, decide, rankCandidates, renderCandidates, routeDutiesOf, tierFor, wakeCostOf, wakeNoteOf } from "./route.js";
 import { parseWhen, renderChatLog, UNKNOWN_HUMAN } from "./chat-log.js";
 import { audienceOf } from "../shared/role-view.js";
 import { startGraph, stopRun, getRun, listRuns, validateSpec, waitForIdle, waitForQuorum, } from "./graph.js";
@@ -73,6 +74,7 @@ const fatalExit = (msg, extra) => {
 };
 const main = async () => {
     const { config: cfg, sourcePath } = loadConfig();
+    bindMultiBot(cfg.bots.length > 0);
     const log = makeLogger({
         logFile: cfg.daemon.logFile,
         logLevel: cfg.daemon.logLevel,
@@ -91,6 +93,7 @@ const main = async () => {
     // derives its dialect from its own jsonl path. Must run BEFORE any mirror
     // attach / tmux spawn.
     const { primary, backends } = bindCliBackends({ ...cfg.wrc, projectsDirOverride: cfg.wrc.mirror.projectsDir });
+    bindCodexStateDir(cfg.daemon.stateDir);
     log.info({ primary: primary.name, bin: primary.bin, backends: backends.map((b) => b.name) }, "cli backends bound");
     // A killed-on-timeout tmux call is the ONLY externally visible symptom of a
     // wedged tmux server, and the exec helper has no logger of its own. Wire it
@@ -103,7 +106,9 @@ const main = async () => {
     // links from messages already on the user's WeCom timeline.
     initDetailPersistence(cfg.daemon.stateDir, log.child({ mod: "detail" }));
     configureRemoteForward(cfg.daemon.detailRemoteBase, cfg.daemon.detailRemoteToken);
-    const ws = startWs(cfg, log);
+    // 一个或多个企微机器人 (bot + bots): 对下面所有模块只露主机器人那个 client, 分流在 bot-mux 里。
+    // 必须先于 weixin-port / response-tracker 建好 —— 它们包在 mux 外层。
+    const ws = startMux(cfg, log);
     // 切网 (换 WiFi / VPN 起停) 后原地重建 WS, 等价于自动做了一次 reload 的
     // 联通性部分 — 但保留全部内存态 (graph 运行、pending 长轮询、镜像绑定),
     // 也不依赖 launchd/systemd 的 respawn 策略 (nohup fallback 没有 supervisor)。
@@ -166,9 +171,9 @@ const main = async () => {
     // 名册在下面的 mirror 块里才绑 (bindWizardStore) —— 这里全走 wizardStore() 惰性取。
     bindTagLinker({
         urlOf: (t) => chatUrlFor(cfg.daemon, t),
-        resolve: (name) => {
+        resolve: (name, from) => {
             const t = wizardStore()?.byName(name)?.target;
-            return t && known(t) ? t : undefined;
+            return t && known(t) && sameBot(from, t) ? t : undefined;
         },
         nameOf: (t) => settleName(wizardStore(), chatNameOf(cfg, t), t),
         voiceOf: (t) => wizardStore()?.get(t)?.voiceOf,
@@ -334,7 +339,7 @@ const main = async () => {
                 return;
             }
             const spawnLog = log.child({ mod: "mirror", sub: "spawn-init", target });
-            const r = await spawnTmuxClaude({ cfg, log: spawnLog, windowName: target, systemPrompt: charterFor(target, {}) });
+            const r = await spawnTmuxClaude({ cfg, log: spawnLog, windowName: target, systemPrompt: charterFor(target, { cli: backendFor(cfg).name }) });
             if (!r.ok) {
                 json(res, 500, { ok: false, reason: r.reason });
                 return;
@@ -342,21 +347,16 @@ const main = async () => {
             const att = m.attach({ sessionId: r.sessionId, jsonlPath: r.jsonlPath, target, tmuxPane: r.tmuxPane, tmuxSession: r.tmuxSession });
             json(res, att.ok ? 200 : 500, att.ok ? { ok: true, sessionId: r.sessionId, tmuxSession: r.tmuxSession, tmuxPane: r.tmuxPane, target } : { ok: false, reason: att.reason });
         });
-        // Which chat is the caller? An MCP tool can only see its own process, so
-        // every route an agent drives has to be told: explicit target → sessionId
-        // → tmuxPane (stable across `/clear`, which rotates sessionId) → the
-        // configured defaultChat. Same precedence as /mirror/workspace.
+        // A missing agent identity is an error, never an invitation to impersonate defaultChat.
+        // Pane wins across native session switches; the MCP session id is a spawn-time snapshot.
         const resolveSelf = (b) => {
             const explicit = (b.target ?? "").trim();
             if (explicit)
                 return explicit;
-            const bySid = b.sessionId?.trim() ? m.targetForSession(b.sessionId.trim()) : undefined;
-            if (bySid)
-                return bySid;
-            const byPane = b.tmuxPane?.trim() ? m.targetForPane(b.tmuxPane.trim()) : undefined;
-            if (byPane)
-                return byPane;
-            return (cfg.defaultChat ?? "").trim();
+            const pane = b.tmuxPane?.trim();
+            if (pane)
+                return m.targetForPane(pane) ?? "";
+            return b.sessionId?.trim() ? m.targetForSession(b.sessionId.trim()) ?? "" : "";
         };
         // ── Session discovery / switching (conversational, via MCP tools) ───────
         // GET /sessions/list — enumerate live claude sessions in tmux + a one-line
@@ -395,7 +395,8 @@ const main = async () => {
                 return;
             }
             const sessions = await scanClaudeSessions();
-            const hit = sessions.find((s) => s.sessionId === sessionId);
+            // 已绑在别的机器人聊天上的会话与不存在同形。
+            const hit = sessions.find((s) => s.sessionId === sessionId && ((t) => !t || sameBot(target, t))(m.targetForSession(s.sessionId)));
             if (!hit) {
                 json(res, 404, { ok: false, reason: `session ${sessionId} not found among live tmux sessions` });
                 return;
@@ -437,16 +438,16 @@ const main = async () => {
             }
             const self = resolveSelf(body);
             if (!self) {
-                json(res, 400, { ok: false, reason: "cannot resolve caller chat (pass target/sessionId/tmuxPane, or set cfg.defaultChat)" });
+                json(res, 400, { ok: false, reason: "cannot resolve caller chat (pass target/sessionId/tmuxPane)" });
                 return;
             }
             const wantChat = (body.chat ?? "").toString().trim();
-            const base = wantChat ? chatBaseOf(cfg, wantChat) : baseOfKey(self);
+            const base = ((b) => (b && sameBot(self, b) ? b : ""))(wantChat ? chatBaseOf(cfg, wantChat) : baseOfKey(self));
             if (!base) {
                 json(res, 404, {
                     ok: false,
                     reason: `unknown chat '${wantChat}' — only NAMED chats can be spawned into; have someone run \`/name ${normChatName(wantChat) || "<name>"}\` there first`,
-                    candidates: listChatNames(cfg).map((c) => c.name),
+                    candidates: chatNamesFor(self),
                 });
                 return;
             }
@@ -508,29 +509,14 @@ const main = async () => {
         // One-shot project switch: bind the chat-wide cwd AND apply it right here
         // by walking the exact /new path (kill pane → respawn in pendingCwd →
         // attach → "📂 当前项目" push). Resolved target
-        // precedence: explicit body.target → sessionId-derived (so MCP can omit
-        // it) → tmuxPane (stable across /clear) → cfg.defaultChat. When the caller
+        // precedence follows resolveSelf (explicit target, then stable pane, then session). When the caller
         // IS the session being replaced, its pane dies mid-tool-call — the
         // project-info bubble is the receipt. On spawn failure the pendingCwd
         // stays queued, so a manual /new from WeCom still completes the switch.
         http.register("POST /mirror/workspace", async (req, res) => {
             const body = (await readBody(req));
             const cwd = (body.cwd ?? "").toString();
-            let target = (body.target ?? "").trim();
-            if (!target && body.sessionId) {
-                const t = m.targetForSession(body.sessionId.trim());
-                if (t)
-                    target = t;
-            }
-            // sessionId rotates on /clear; the MCP caller's env sessionId may be stale.
-            // Pane id is stable, so resolve by it before falling back to defaultChat.
-            if (!target && body.tmuxPane) {
-                const t = m.targetForPane(body.tmuxPane.trim());
-                if (t)
-                    target = t;
-            }
-            if (!target)
-                target = (cfg.defaultChat ?? "").trim();
+            const target = resolveSelf(body);
             if (!target) {
                 json(res, 400, { ok: false, reason: "target required (or pass sessionId of an attached chat)" });
                 return;
@@ -567,12 +553,18 @@ const main = async () => {
         // 地址语义见 mirror-bridge.resolvePeerTag: "" = 本聊天的默认 wizard (它是正当的
         // 协作对象 ——「回去跟主会话汇报」); 裸 `fix` 先找本聊天、再退回全机唯一的那个;
         // `daily#fix` 直接指名聊天, 不要求任何唯一性。
+        // 多机器人隔离: 别的机器人名下的 wizard 由 resolvePeerTag 当作查无此名 (同形、candidates 只列
+        // 同机器人的) —— 点名寻址 (peek / tell / wait / stop / clone from / handoff / set_model / pending /
+        // schedule) 全过这一道。
         const resolvePeer = (self, tag) => {
             const r = m.resolvePeerTag(self, tag);
             if (r.ok)
                 return r;
             return { ok: false, status: 404, reason: r.reason, candidates: r.candidates };
         };
+        /** 聊天名候选只列与调用方同机器人的 —— 别的机器人的聊天名也是它的存在。指名别的机器人的聊天,
+         *  各路由一律走它们自己「认不出这个聊天」的分支 (同状态码同原话), 不说「那边有, 但归别人」。 */
+        const chatNamesFor = (self) => listChatNames(cfg).filter((c) => sameBot(self, c.base)).map((c) => c.name);
         // ── Chat naming ────────────────────────────────────────────────────
         // A WeCom chat's identity is an unreadable `chat:wrkS…` id. Naming it is
         // what makes cross-chat addressing (`daily#fix`) and cross-chat spawning
@@ -581,7 +573,7 @@ const main = async () => {
             const { self } = await readPeerBody(req);
             if (self)
                 ensureChatNames(self);
-            const roster = self ? m.chatRoster(self) : listChatNames(cfg).map((c) => ({ ...c, self: false, targets: [] }));
+            const roster = self ? m.chatRoster(self).filter((c) => sameBot(self, c.base)) : listChatNames(cfg).map((c) => ({ ...c, self: false, targets: [] }));
             json(res, 200, {
                 ok: true,
                 self,
@@ -735,7 +727,7 @@ const main = async () => {
             rebound: async (x, why) => (await m.injectText(x.to, `（守护进程代 ${displayName(x.from)} 打回一次: 这件活是工单里的一份, 你的回复${why}。请按约定收口 —— 末尾一行 \`RESULT: <结论>\`, 交付了文件每个加一行 \`ARTIFACT: <路径> — 一句话\`; 真缺信息就 \`NEED: <问题>\`。）`, undefined, {
                 from: { kind: "peer", from: x.from, turn: x.turn, ...(x.asker ? { asker: x.asker } : {}) },
                 channel: x.channel,
-                envelope: envelopeFor(x.from, x.channel, { turn: x.turn, legs: x.legs, re: true }),
+                envelope: envelopeFor(x.from, x.channel, { turn: x.turn, legs: x.legs, re: true, asker: x.asker }),
             })).ok,
             untilIdle: m.untilIdle,
             paneLive: m.paneLive,
@@ -760,6 +752,7 @@ const main = async () => {
                 envelope: renderReceiptEnvelope(displayName(meta.from), meta.channel ? chatNameOf(cfg, meta.channel) : undefined, meta.job ? { job: meta.job, done: meta.done, total: meta.total, closed: jobs.get(meta.job)?.status !== "open", ...(jobs.get(meta.job)?.kind === "req" ? { req: true } : {}) } : undefined, meta.status, meta.turn || undefined, {
                     ...(meta.replyTo ? { replyTo: meta.replyTo.kind === "chat" ? chatNameOf(cfg, meta.replyTo.channel) : displayName(meta.replyTo.from) } : {}),
                     ...(meta.k ? { k: kAttr(meta.k) } : {}),
+                    ...(meta.asker ? { asker: meta.asker } : {}),
                     ...(meta.pending ? { pending: meta.pending } : {}),
                     ...(audienceName(meta.channel, meta.asker) ? { audience: audienceName(meta.channel, meta.asker) } : {}),
                 }),
@@ -815,7 +808,7 @@ const main = async () => {
             return {
                 from: { kind: "peer", from: o.from, ...(o.turn ? { turn: o.turn } : {}), ...(o.channel ? { public: true } : {}), ...(o.asker ? { asker: o.asker } : {}) },
                 channel: o.channel,
-                envelope: envelopeFor(o.from, o.channel, o.turn ? { turn: o.turn } : undefined),
+                envelope: envelopeFor(o.from, o.channel, { turn: o.turn ?? "", asker: o.asker }),
             };
         }
         /** 简报那一轮之后, 余下的欠账一份一轮: 等它接住上一句 (至多 20s 动起来) 并答完, 再贴下一份。 */
@@ -873,13 +866,12 @@ const main = async () => {
             const env = openingOfSelf(self)?.env;
             const home = baseOfKey(self);
             if (!env)
-                return home.startsWith("user:") ? { who: home, chat: home } : undefined;
-            if (env.kind === "human") {
-                const chat = env.chat ? chatBaseOf(cfg, env.chat) : home;
-                return chat ? { who: `user:${env.from}`, chat } : undefined;
-            }
-            return env.kind === "peer" ? receipts.askerOf(self, env) : undefined;
+                return m.currentAsker(self);
+            return askerFromEnvelope(env, (chat) => chat ? chatBaseOf(cfg, chat) : home)
+                ?? (env.kind === "peer" ? receipts.askerOf(self, env) : undefined);
         };
+        // A private dispatch keeps its human origin even though its output channel is empty.
+        bindCardChannel((key) => askerOf(key)?.chat || m.currentChannel(key));
         // 交接先续做: 它的闸要在回执续守之前立起来, 否则续守的 watcher 会读到换了一半的会话。
         void m.restored.then(() => { handoffs.resume(); receipts.resume(); });
         // 闲置追问 (见 idle-nudge.ts): 对方持续闲着又没回执 → 代发话方同件号问一句进展, 答复照常回执。
@@ -898,7 +890,7 @@ const main = async () => {
                 return (await m.injectText(to, text, undefined, {
                     from: { kind: "peer", from, turn, ...(x.asker ? { asker: x.asker } : {}) },
                     channel: x.channel,
-                    envelope: envelopeFor(from, x.channel, { turn, legs: x.legs, re: true }),
+                    envelope: envelopeFor(from, x.channel, { turn, legs: x.legs, re: true, asker: x.asker }),
                 })).ok;
             },
             nameOf: displayName,
@@ -927,6 +919,11 @@ const main = async () => {
         const claimSlot = async (base, want, fallback, keep = []) => {
             const asked = normalizeTag(want);
             const clash = asked ? wizards.byName(asked) : undefined;
+            // 名字全机唯一, 撞上别的机器人的 wizard 照样拒 —— 但不顶掉它、不复用它的槽, 也不报它的死活:
+            // 那边的 wizard 在这个机器人眼里不存在, 只剩「名字被占了」这一个事实。
+            if (clash && !sameBot(base, clash.target)) {
+                return { ok: false, status: 409, body: { ok: false, reason: `名字 '.${clash.name}' 已被占用 (名字全局唯一) —— 换个名字`, name: clash.name } };
+            }
             const bound = !!clash && m.chatTargets(baseOfKey(clash.target)).includes(clash.target);
             if (clash && !bound && baseOfKey(clash.target) === base && tagOfKey(clash.target)) {
                 return { ok: true, target: clash.target, slot: tagOfKey(clash.target) };
@@ -996,7 +993,7 @@ const main = async () => {
             // 认不出的名字原样报回去, 绝不静默跳过 ——「发了但没人收到」是这类工具最难查
             // 的故障; 有一个收件人错了整条就不发, 部分送达比不送达更难对账。
             const refs = (b.to ?? []).map((r) => (r ?? "").trim()).filter(Boolean);
-            const bad = refs.filter((r) => !chatBaseOf(cfg, r));
+            const bad = refs.filter((r) => ((b) => !b || !sameBot(self, b))(chatBaseOf(cfg, r)));
             if (bad.length) {
                 json(res, 400, { ok: false, reason: `认不出这些聊天: ${bad.join(", ")} (wizard_roster 每行有 home 聊天名, 人侧 /chats; 没起名的聊天寻址不到)` });
                 return;
@@ -1040,7 +1037,7 @@ const main = async () => {
             ensureChatNames(self);
             const ref = (b.to ?? "").trim();
             const dest = ref ? chatBaseOf(cfg, ref) : channelOf(self);
-            if (!dest) {
+            if (!dest || !sameBot(self, dest)) {
                 json(res, 400, { ok: false, reason: `认不出聊天: ${ref} (wizard_roster 每行有 home 聊天名, 人侧 /chats; 没起名的聊天寻址不到)` });
                 return;
             }
@@ -1137,7 +1134,8 @@ const main = async () => {
             const [roleRef, chatRef, targetRef, sinceRef, untilRef] = [b.role, b.chat, b.with, b.since, b.until].map((x) => (x ?? "").toString().trim());
             // 什么都没给 = 调用方这一轮所在的群; 只给 target = 调用方与它的往来。
             const base = chatRef ? chatBaseOf(cfg, chatRef) : roleRef || targetRef ? "" : channelOf(self);
-            if (chatRef && !base) {
+            // 别的机器人的聊天与认不出同形 (不说它在)。
+            if (chatRef && (!base || !sameBot(self, base))) {
                 json(res, 404, { ok: false, reason: `认不出聊天 '${chatRef}' (wizard_roster 每行有 home 聊天名, 人侧 /chats)` });
                 return;
             }
@@ -1152,7 +1150,8 @@ const main = async () => {
             const limit = Math.min(Math.max(Number(b.limit ?? 30) || 30, 1), 200);
             const per = Math.min(Math.max(Number(b.per ?? 500) || 500, 40), 4000);
             const pinned = new Set([self, role?.target, target?.target]);
-            const all = m.transcripts();
+            // 只读与调用方同机器人的会话 —— 别的机器人那边的往来连条数都不该露出来。
+            const all = m.transcripts().filter((t) => sameBot(self, t.target));
             // 两方之间的话只可能落在这两方里的 wizard 自己的 transcript 里 (人没有 transcript)
             // —— 不必去翻别的会话, 「往回还有没有」也因此答得准。
             const between = [role?.target, target?.target].filter((t) => !!t);
@@ -1234,7 +1233,10 @@ const main = async () => {
             // 件号先于一切: `re` 续问沿用那件活的件号、工单与频道 (见 receipts.prepare)。
             const re = (body.re ?? "").toString().trim();
             // 放行一件停放着的 (after): 件号 / 频道 / 父 k / 链头都沿用停放那一刻定的 —— 依赖边不改 k。
-            const turn = held ? { turn: held.turn, legs: 1, channel: held.channel } : receipts.prepare(self, target, re || undefined);
+            const turn = held ? { turn: held.turn, legs: 1, channel: held.channel, asker: held.asker, k: held.k } : receipts.prepare(self, target, re || undefined);
+            // Capture the origin before waiting for another pane; our own turn may change meanwhile.
+            const asker = held ? held.asker : turn.legs > 1 ? turn.asker : askerOf(self);
+            const k = held ? held.k : body.chain === false ? undefined : turn.legs > 1 ? turn.k : parentKOf(self);
             // 续问只在那个工单还开着时沿用它: 收了工的工单不再收成员, 续问照样能发。
             // 没带工单的一句顶掉一份还没落定的工单活, 也算在那张工单上 (receipts.register 同理
             // 继承): 不然换个不带 job 的 tell_peer 就绕开了预算。
@@ -1337,11 +1339,9 @@ const main = async () => {
             // 放行时原样沿用; 工单成员与预算也现在就记, 「齐了吗」照常数。
             if (parkIt) {
                 const bp = body;
-                const pk = bp.chain === false ? undefined : parentKOf(self);
-                const pasker = askerOf(self);
                 receipts.hold({
                     from: self, to: target, turn: turn.turn, at: Date.now(), after: afters, channel, job: jobId,
-                    ...(pk ? { k: pk } : {}), ...(pasker ? { asker: pasker } : {}),
+                    ...(k ? { k } : {}), ...(asker ? { asker } : {}),
                     // force: 冷门控上面已过一遍, 放行时缓存又凉了也不再退回。
                     body: { name: peerAddress(cfg, self, target), text, kind, force: true, ...(jobId ? { job: jobId } : {}), ...(bp.role ? { role: bp.role } : {}), ...(bp.priority ? { priority: bp.priority } : {}), ...(bp.waitSec ? { waitSec: bp.waitSec } : {}), ...(bp.deadline !== undefined ? { deadline: bp.deadline } : {}), ...(bp.receipt === false ? { receipt: false } : {}) },
                 });
@@ -1390,12 +1390,12 @@ const main = async () => {
             // 是"放出去就不管了"的那种派活; fyi 一定不要。对方的信封据此改口, 不再让它收口。
             const wantReceipt = kind !== "fyi" && body.receipt !== false;
             const deadlineAt = deadlineOf(at, deadlineSec === undefined ? undefined : Number(deadlineSec));
-            const asker = held ? held.asker : askerOf(self);
             const inj = await m.injectText(target, text, undefined, {
                 from: { kind: "peer", from: self, turn: turn.turn, ...(jobId ? { job: jobId } : {}), ...(isPublic ? { public: true } : {}), ...(asker ? { asker } : {}) },
                 channel,
                 envelope: envelopeFor(self, channel, {
                     turn: turn.turn,
+                    asker,
                     legs: turn.legs,
                     ...(turn.legs > 1 ? { re: true } : {}),
                     // 期限只在发话方明说时写给对方看: 默认的一小时不值得每轮多一句。
@@ -1408,7 +1408,6 @@ const main = async () => {
             // 一份不守的槽会以同一对的 key 顶掉发话方还在等它答的那件活, 那件的回执就再也来不了。
             // 父 k: 默认这件活算发话方此刻在答的那件的子活 (链式续回); `chain:false` = 旁支,
             // 回执照常回来, 但不挂住它给上游的交代 —— 只有发话方知道这件活是不是为上游派的。
-            const k = held ? held.k : body.chain === false ? undefined : parentKOf(self);
             if (inj.ok && wantReceipt)
                 receipts.register({ from: self, to: target, channel, job: jobId, at, turn: turn.turn, legs: turn.legs, deadlineAt, ...(k ? { k } : {}), ...(asker ? { asker } : {}) });
             if (inj.ok && wantReceipt) {
@@ -1543,12 +1542,14 @@ const main = async () => {
         });
         // 交接的「重开」一步: 走 /new (杀旧 pane、起新进程) 而不是往原 pane 注入 /clear。
         // /clear 只换会话不换进程 —— MCP 子进程、charter 都还是旧的, 新工具拿不到; 镜像
-        // 还得靠 sid 轮换探测才跟得上。CLI / cwd / keepalive 照旧沿用; 模型也沿用, 管家除外 ——
+        // 还得靠 sid 轮换探测才跟得上。CLI 使用 cfg 的默认 backend; cwd / keepalive 照旧沿用。
+        // 同 backend 时模型也沿用, 管家除外 ——
         // 它换上此刻的管家档 (newSession 里定), 改了 models.steward 后交接一次就是让它生效的那一下。
         const restartFresh = (target) => {
             const info = m.sessionInfo(target);
-            const model = stewardTierOf(cfg, target) ? undefined : info?.model || undefined;
-            return m.newSession(target, displayName(target) || tagOfKey(target) || target, info?.cli, { model, silent: true, warm: true });
+            const cli = cfg.wrc.defaultCli ?? primary.name;
+            const model = stewardTierOf(cfg, target) || info?.cli !== cli ? undefined : info?.model || undefined;
+            return m.newSession(target, displayName(target) || tagOfKey(target) || target, cli, { model, silent: true, warm: true });
         };
         // POST /handoff — 交接一个 pane 的会话给一个全新会话。先让目标会话把当前工作
         // 压成一份"零上下文也能接手"的交接简报,等它写完并抓取,再 restartFresh 换一个
@@ -1575,7 +1576,8 @@ const main = async () => {
             let target;
             if (pane) {
                 target = m.targetForPane(pane);
-                if (!target) {
+                // 别的机器人的 pane 与没绑定同形 —— pane 号是另一条绕过 resolvePeer 的寻址。
+                if (!target || !sameBot(self, target)) {
                     json(res, 404, { ok: false, reason: `no mirror session bound to pane ${pane}` });
                     return;
                 }
@@ -1752,7 +1754,8 @@ const main = async () => {
             log.warn({ err: e.message }, "accept nudge failed");
         } }, NUDGE_TICK_MS).unref();
         /** `who` = 这次变动的当事人 (见 hears): 不给 = 聊天自己的事 (改名), 全群都听。 */
-        const postRoster = (base, except, n, who) => notices.post(chatAudience(m.chatTargets(base), base, except).filter(who ? hears(who) : () => true), n);
+        // 听众只在主角那个聊天里 (同 base ⇒ 同机器人); sameBot 再写一遍是隔离的明文, 不靠 key 的拼法兜着。
+        const postRoster = (base, except, n, who) => notices.post(chatAudience(m.chatTargets(base), base, except).filter((t) => sameBot(base, t)).filter(who ? hears(who) : () => true), n);
         /** 注册表里的当事人。要在 forget 抹掉记录之前取; 没有记录 = 谁也不告诉。 */
         const subjectOf = (w) => (w
             ? { parent: w.parent, description: w.description, owners: jobs.all().filter((j) => j.status === "open" && j.members.some((x) => x.target === w.target)).map((j) => j.owner) }
@@ -1923,7 +1926,7 @@ const main = async () => {
                     const loadError = tasks.errors()[x.id];
                     return {
                         id: x.id,
-                        target: x.target || (cfg.defaultChat ?? ""),
+                        target: x.target || defaultChatFor(cfg, x.owner || (cfg.defaultChat ?? "")),
                         when: describeTrigger(x.trigger),
                         nextAt: nextFire(x.trigger, sinceOf(st), nowDate),
                         lastFired: st.lastFired,
@@ -1971,8 +1974,8 @@ const main = async () => {
         });
         /** 自己的地址 = 全局名字, 与住在哪个群无关。 */
         const selfAddress = (target) => settleName(wizards, chatNameOf(cfg, target), target);
-        const sharedMemory = (scope, key) => {
-            const path = memoryPath(cfg.daemon.stateDir, scope, key);
+        const sharedMemory = (scope, key, bot = "") => {
+            const path = memoryPath(cfg.daemon.stateDir, scope, key, bot);
             return clipForCharter(readMemory(path), path);
         };
         /** transcript 最后写入的时刻; 没有会话 / 读不到 = 0。 */
@@ -2007,17 +2010,18 @@ const main = async () => {
             // 最近动过的排前面: 名册只点名前几个, 截掉的该是早就停了的那些。
             // 没有 transcript 的冷记录按 bornAt 算, 刚生下还没开口的照样在。
             siblings: m.chatTargets(baseOfKey(target))
-                .filter((t) => t !== target)
+                // 同 base 即同机器人; 显式再滤一道, 宪章名册的隔离不依赖 key 的拼法。
+                .filter((t) => t !== target && sameBot(target, t))
                 .map((t) => [t, Math.max(lastTouched(t), wizards.get(t)?.bornAt ?? 0)])
                 .filter(([, at]) => Date.now() - at <= ROSTER_FRESH_MS)
                 .sort((x, y) => y[1] - x[1])
                 .map(([t]) => briefOf(target, t)),
             memory: wizards.get(target)?.memory ?? [],
-            tiers: forDiff ? [] : TIERS.map((n) => { const s = cfg.models.tiers[n]; return `${n}=${s.model || "默认"}${s.effort ? `·${s.effort}` : ""}`; }),
+            tiers: forDiff ? [] : TIERS.map((n) => { const s = tiersForBackend(cfg, o.cli ?? m.sessionInfo(target)?.cli)[n]; return `${n}=${s.model || "默认"}${s.effort ? `·${s.effort}` : ""}`; }),
             chatMemory: sharedMemory("chat", baseOfKey(target)),
             workspaceMemory: (() => {
                 const cwd = o.cwd || m.getCwd(target).runningCwd || m.getCwd(target).defaultCwd;
-                return cwd ? sharedMemory("workspace", cwd) : "";
+                return cwd ? sharedMemory("workspace", cwd, botOfKey(target)) : "";
             })(),
             steward: !tagOfKey(target),
             stewardBudget: chatPolicyOf(cfg, target).stewardBudget,
@@ -2062,7 +2066,7 @@ const main = async () => {
             // 信箱里装的是相对上一份宪章的变化; 新宪章一渲染就都过期了 (名册、记忆都已在里面)。
             notices.drain(target);
             notices.forget(target);
-            return charterFor(target, charterOptsOf(target, ctx?.cwd));
+            return charterFor(target, { ...charterOptsOf(target, ctx?.cwd), cli: ctx?.cli });
         });
         // 宪章记录是后来才有的: 已经在跑的 wizard 拿 spawn 落盘的那份 (state/charters/<sid>.md) 补上,
         // 否则要等它下次重生, rolepage 的「宪章」入口才出现。与自动命名同一个延迟: 等附着表恢复完。
@@ -2089,10 +2093,11 @@ const main = async () => {
                 log.warn({ err: e.message }, "boot auto-name failed");
             }
         }, 15_000).unref();
+        // 家谱只列与观察者同机器人的 (跨机器人的分身生不出来, 这是给老数据 / 手改注册表兜的底)。
         const kinOf = (self, all, target) => ({
-            parent: wizards.get(target)?.parent ? briefOf(self, wizards.get(target).parent) : undefined,
-            ancestors: ancestorsOf(all, target).map((t) => briefOf(self, t)),
-            clones: childrenOf(all, target).map((w) => briefOf(self, w.target)),
+            parent: ((p) => (p && sameBot(self, p) ? briefOf(self, p) : undefined))(wizards.get(target)?.parent),
+            ancestors: ancestorsOf(all, target).filter((t) => sameBot(self, t)).map((t) => briefOf(self, t)),
+            clones: childrenOf(all, target).filter((w) => sameBot(self, w.target)).map((w) => briefOf(self, w.target)),
         });
         const identityOf = (self, target) => {
             const rec = wizards.get(target);
@@ -2143,8 +2148,9 @@ const main = async () => {
                 };
             });
             const seen = new Set(live.map((r) => r.target));
+            // live 已由 peers (同 base) / foreignPeers (sameBot) 收窄; 冷记录在这里按机器人滤。
             const cold = all
-                .filter((w) => !seen.has(w.target))
+                .filter((w) => !seen.has(w.target) && sameBot(self, w.target))
                 .map((w) => ({
                 ...briefOf(self, w.target),
                 target: w.target,
@@ -2269,13 +2275,18 @@ const main = async () => {
         const routeRowsOf = async (self) => {
             ensureChatNames(self);
             const warm = keepalivePingSigs(cfg.wrc.mirror.keepalive.ping);
-            return (await rosterOf(self))
+            const roster = await rosterOf(self);
+            const openJobs = jobs.all();
+            const inflight = receipts.states();
+            return roster
                 .filter((r) => !r.self)
                 .map((r) => {
                 const live = r.jsonlPath ? r.jsonlPath : "";
                 const ttl = live ? cacheTtlSec(live) : 0;
                 return {
                     ...r,
+                    lead: wizards.get(r.target)?.lead === true,
+                    duties: routeDutiesOf(openJobs, r.target, inflight),
                     contextTokens: live ? lastContextTokens(live) : 0,
                     ...(ttl ? { cacheTtlMs: ttl * 1000 } : {}),
                     ...(live ? { cacheAt: cacheTouchMs(live) } : {}),
@@ -2321,15 +2332,20 @@ const main = async () => {
             const to = (b.to ?? "").toString().trim();
             const now = Date.now();
             const ttlMs = cfg.wrc.mirror.keepalive.ttlSec * 1000;
-            // 自动选只在这些里选: 在线的 (没 pane 的 ctx 量不出, 成本门会盲过)、不是哪个群的管家、
-            // 不是别人开着的工单里的队员 —— 点名 (`to`) 不受此限。
-            const inOthersJob = (t) => jobs.openOf(baseOfKey(t)).some((j) => j.owner !== self && j.members.some((mm) => mm.target === t));
-            const pool = to || b.spawn || lead ? [] : (await routeRowsOf(self)).filter((r) => r.alive && !!tagOfKey(r.target) && !inOthersJob(r.target));
-            const cands = rankCandidates(task, m.getCwd(self).runningCwd, pool, { now, ttlMs }).slice(0, 5);
+            // 占用保护由 decide 统一判断, 留在候选表里说明为什么不能自动复用。
+            // 显式 to 保留人为选定; force 只影响成本门, 不绕 lead/工单/连续性保护。
+            const pool = to || b.spawn || lead ? [] : (await routeRowsOf(self)).filter((r) => r.alive && !!tagOfKey(r.target));
+            const tierArg = (b.tier ?? "").toString().trim();
+            if (tierArg && !TIERS.includes(tierArg)) {
+                json(res, 400, { ok: false, reason: `unknown tier: ${tierArg}` });
+                return;
+            }
+            const taskTier = (tierArg || tierFor(task, lead));
+            const cands = rankCandidates(task, m.getCwd(self).runningCwd, pool, { now, ttlMs });
             let d = to ? { kind: "existing", why: `你点名了 ${to}` }
                 : b.spawn ? { kind: "spawn", why: "你要了新的" }
                     : lead ? { kind: "spawn", why: "复杂活: 白板起一个 hard 档的 lead, 由它组队" }
-                        : decide(task, cands, now, ttlMs, force);
+                        : decide(task, cands, now, ttlMs, force, taskTier);
             // 复杂活 (lead:true) 是一件「需求」: 先开需求根单 (账本, 不占 pane), 这一句带它派下去, lead 记成根单成员。
             // 小活不开单。dryRun 不落账, 所以放在它后面开 (见下)。
             const criteria = (b.criteria ?? "").toString().trim();
@@ -2342,7 +2358,7 @@ const main = async () => {
             }, extra);
             const shown = cands.slice(0, 3).map((e) => `.${e.row.address || e.row.name}${e.row.busy ? " 忙" : ""}`);
             if (b.dryRun) {
-                json(res, 200, { ok: true, dryRun: true, decision: d.kind, reason: d.why, ...(d.kind === "existing" ? { name: to || (d.kind === "existing" && d.row ? d.row.address || d.row.name : "") } : { tier: (b.tier ?? "").toString().trim() || tierFor(task, lead) }), ...(shown.length ? { candidates: shown } : {}) });
+                json(res, 200, { ok: true, dryRun: true, decision: d.kind, reason: d.why, ...(d.kind === "existing" ? { name: to || (d.kind === "existing" && d.row ? d.row.address || d.row.name : "") } : { tier: taskTier }), ...(shown.length ? { candidates: shown } : {}) });
                 return;
             }
             if (lead) {
@@ -2388,7 +2404,7 @@ const main = async () => {
                 json(res, 400, { ok: false, decision: "spawn", reason: `${d.why} —— 要新生一个, 带上 name (这件事的短名) 与 description (它的职责) 重发`, ...(shown.length ? { candidates: shown } : {}) });
                 return;
             }
-            const tier = (b.tier ?? "").toString().trim() || tierFor(task, lead);
+            const tier = taskTier;
             const born = await bearAs(self, { inherit: false, name, description, tier, ...(lead ? { lead: true } : {}) });
             if (born.status !== 200) {
                 settleRoot(false);
@@ -2434,8 +2450,10 @@ const main = async () => {
                     json(res, 400, { ok: false, reason: "note 和 forget 至少给一个" });
                     return;
                 }
-                const path = memoryPath(cfg.daemon.stateDir, scope, key);
-                const queued = proposeMemory(inboxPath(cfg.daemon.stateDir, scope, key), {
+                // 工作区记忆按机器人分份 (见 wizard-memory.fileOf); chat 的 key 本身就带机器人。
+                const bot = botOfKey(self);
+                const path = memoryPath(cfg.daemon.stateDir, scope, key, bot);
+                const queued = proposeMemory(inboxPath(cfg.daemon.stateDir, scope, key, bot), {
                     at: Date.now(),
                     by: selfAddress(self),
                     ...(scope === "workspace" ? { cwd: key } : {}),
@@ -2476,15 +2494,12 @@ const main = async () => {
         /** spawn_wizard / clone_wizard 的本体 —— HTTP 路由与 dispatch 共用。 */
         const bearAs = async (self, body) => {
             const b = body;
+            const asker = b.task?.trim() ? askerOf(self) : undefined;
+            const k = body.chain === false ? undefined : parentKOf(self);
             const askedEffort = parseEffort(b.effort);
             if (b.effort !== undefined && !askedEffort) {
                 return { status: 400, body: { ok: false, reason: `effort 只有这几档: ${EFFORTS.join(" / ")}` } };
             }
-            const pick = pickTier(cfg.models, b.tier, { cli: b.cli, model: b.model, effort: askedEffort }, b.inherit === true);
-            if (!pick.ok) {
-                return { status: 400, body: pick };
-            }
-            const effort = pick.effort;
             // 工单先验: 生完分身才发现工单号打错了, 那个分身就成了没人认领的孤儿。
             const jobId = (b.job ?? "").trim();
             if (jobId) {
@@ -2524,6 +2539,12 @@ const main = async () => {
             }
             const source = fromR.target;
             const sourceInfo = m.sessionInfo(source);
+            const forkBackend = inherit && sourceInfo && existsSync(sourceInfo.jsonlPath)
+                && (!b.cwd?.trim() || expandHome(b.cwd.trim()) === sourceInfo.cwd) ? sourceInfo.cli : undefined;
+            const pick = pickTier(cfg, b.tier, { cli: b.cli, model: b.model, effort: askedEffort }, inherit, forkBackend);
+            if (!pick.ok)
+                return { status: 400, body: pick };
+            const effort = pick.effort;
             // 别人的会话 fork 不出来就是失败, 不能像克隆自己那样悄悄退化成白板 —— 调用方
             // 要的恰恰是它的上下文, 给一张白纸等于答非所问。
             if (source !== self && !sourceInfo?.sessionId) {
@@ -2554,12 +2575,12 @@ const main = async () => {
                 log.info({ self, slept: idle.map((pp) => pp.target) }, "clone cap: idle clones put to sleep");
             }
             const wantChat = (b.chat ?? "").toString().trim();
-            const base = wantChat ? chatBaseOf(cfg, wantChat) : baseOfKey(self);
+            const base = ((b) => (b && sameBot(self, b) ? b : ""))(wantChat ? chatBaseOf(cfg, wantChat) : baseOfKey(self));
             if (!base) {
                 return { status: 404, body: {
                         ok: false,
                         reason: `unknown chat '${wantChat}' — 只有起过名字的聊天能被指名; 让那边先 /name`,
-                        candidates: listChatNames(cfg).map((c) => c.name),
+                        candidates: chatNamesFor(self),
                     } };
             }
             const askedName = String(b.name ?? b.tag ?? "");
@@ -2592,7 +2613,7 @@ const main = async () => {
                 spawning: BOOT_ID,
             });
             const name = wizards.rename(target, normalizeTag(askedName) || tag);
-            const charter = charterFor(target, { ...(detached ? {} : { parent: self }), forkOf, inherited: inherit });
+            const charter = charterFor(target, { ...(detached ? {} : { parent: self }), forkOf, inherited: inherit, cli: pick.cli });
             const task = (b.task ?? "").toString().trim();
             // 没点名就按配置的 keepalive.spawnDefault 来 —— 调用方明说的永远优先。
             const keepalive = typeof b.keepalive === "boolean" ? b.keepalive : cfg.wrc.mirror.keepalive.spawnDefault;
@@ -2600,7 +2621,6 @@ const main = async () => {
             // wait_peer 才不会把它们当成分身对这件活的答复。
             const taskAt = Date.now();
             const taskTurn = newTurn();
-            const asker = task ? askerOf(self) : undefined;
             const r = await m.cloneSession({
                 parent: source,
                 target,
@@ -2614,7 +2634,7 @@ const main = async () => {
                 // 继承路径上第一句话是分叉的触发器, 所以直接把活当开场白 —— 少一次往返,
                 // 也少一次"就位了但没事干"的空转。
                 // 子 lead 的宪章只有层级规矩, 打法跟第一句的信封走 (同 dispatch 对已有 wizard 的做法)。
-                bootstrap: task ? task + envelopeFor(self, "", { turn: taskTurn }) + (b.lead === true ? renderReminder({ wezard: "lead" }, renderLeadPlaybook()) : "") : undefined,
+                bootstrap: task ? task + envelopeFor(self, "", { turn: taskTurn, asker }) + (b.lead === true ? renderReminder({ wezard: "lead" }, renderLeadPlaybook()) : "") : undefined,
                 ...(task ? { bootstrapFrom: { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, query: task } } : {}),
                 keepalive,
             }).catch((e) => ({ ok: false, reason: `spawn threw: ${String(e)}`, inherited: false }));
@@ -2641,7 +2661,7 @@ const main = async () => {
             // 继承路径上活已经随开场白进去了, 空白分身才需要在这里补一次注入 (私聊)。
             let dispatched = r.inherited && !!task;
             if (task && !r.inherited) {
-                const inj = await m.injectText(target, task, undefined, { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, channel: "", envelope: envelopeFor(self, "", { turn: taskTurn }) });
+                const inj = await m.injectText(target, task, undefined, { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, channel: "", envelope: envelopeFor(self, "", { turn: taskTurn, asker }) });
                 dispatched = inj.ok;
             }
             if (jobId) {
@@ -2653,7 +2673,6 @@ const main = async () => {
                 jobs.spend(jobId);
             // 分身的第一件活也守回执: fan-out 最常见的形状就是 clone_wizard({task}) × N,
             // 让它们干完自己把结论送回来, 发起方不必挂在 wait_peer 上。
-            const k = body.chain === false ? undefined : parentKOf(self);
             if (dispatched)
                 receipts.register({ from: self, to: target, channel: "", job: jobId, at: taskAt, turn: taskTurn, ...(k ? { k } : {}), ...(asker ? { asker } : {}) });
             if (dispatched)
@@ -2687,7 +2706,7 @@ const main = async () => {
             const r = resolvePeer(self, addrOf(b));
             // 有身份没会话 (冷记录 / 生到一半的僵尸): resolvePeer 够不着它, 但收它不需要
             // 会话 —— end 视为早已结束, forget 删掉记录、腾出名字。interrupt 无从谈起。
-            const found = r.ok || r.candidates?.length ? undefined : wizards.byName(addrOf(b));
+            const found = r.ok || r.candidates?.length ? undefined : ((w) => (w && sameBot(self, w.target) ? w : undefined))(wizards.byName(addrOf(b)));
             const cold = found && !m.chatTargets(baseOfKey(found.target)).includes(found.target) ? found : undefined;
             if (cold && (b.mode ?? "end") === "end") {
                 const detached = b.forget ? forgetWizard(cold.target) : [];
@@ -2999,7 +3018,7 @@ const main = async () => {
                     openedAt: j.openedAt,
                     ...jobs.tally(j.id),
                     ...(j.maxTurns ? { budget: `${j.turns ?? 0}/${j.maxTurns}` } : {}),
-                    members: j.members.map((mm) => ({
+                    members: j.members.filter((mm) => sameBot(self, mm.target)).map((mm) => ({
                         address: peerAddress(cfg, self, mm.target),
                         role: mm.role ?? "exec",
                         task: mm.task.split("\n")[0] ?? "",
@@ -3047,6 +3066,11 @@ const main = async () => {
                 }
                 target = r.target;
             }
+            // owner = self; resolvePeer 已拦住别的机器人的名字, 这一道是给以后别的取 target 的路兜底。
+            if (!sameBot(self, target)) {
+                json(res, 404, { ok: false, reason: `no wizard named '.${tag}' — wizard_roster lists every name` });
+                return;
+            }
             // 到点是新建还是续用, 在**排班时**就定死。两条都指向新建:
             //   · 没点名 wizard —— 定时的 prompt 本就要求零上下文自洽, 没理由挑一个会话挤进去;
             //   · prompt 自己就在说「建两个 wizard 去干 xxx」—— 这时 tag 只是「在谁的聊天/
@@ -3078,10 +3102,10 @@ const main = async () => {
             const now = new Date();
             const errs = tasks.errors();
             const rows = tasks.list()
-                .filter((t) => !mineOnly || ownerOf(t) === self)
+                .filter((t) => sameBot(self, ownerOf(t)) && (!mineOnly || ownerOf(t) === self))
                 .map((t) => ({
                 ...renderTask(t, tasks.stateOf(t.id), now, errs[t.id]),
-                address: peerAddress(cfg, self, t.target || (cfg.defaultChat ?? "")),
+                address: peerAddress(cfg, self, t.target || defaultChatFor(cfg, ownerOf(t))),
                 owner: peerAddress(cfg, self, ownerOf(t)),
             }));
             // 加载失败的那些没有记录可回显, 但必须出现在列表里 —— 否则 wizard 改错了
@@ -3102,6 +3126,12 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: "id required (list_tasks 里那个 id)" });
                 return;
             }
+            // 别的机器人的日程与不存在同形。
+            const rec = tasks.get(id);
+            if (rec && !sameBot(self, ownerOf(rec))) {
+                json(res, 404, { ok: false, reason: `no schedule with id ${id}` });
+                return;
+            }
             const state = tasks.stateOf(id);
             const gone = tasks.remove(id);
             if (!gone) {
@@ -3141,7 +3171,7 @@ const main = async () => {
             ];
         };
         const configEvidence = (p) => [
-            ...tierEvidence(cfg.models, p, tierUsage, (tier) => wizards.all().filter((w) => w.tier === tier).length, { tokens: fmtTokens, cost: fmtCost }),
+            ...tierEvidence(cfg, p, tierUsage, (tier) => wizards.all().filter((w) => w.tier === tier).length, { tokens: fmtTokens, cost: fmtCost }),
             ...chatPolicyEvidence(p),
         ];
         // ── 改配置会不会动到宪章 ─────────────────────────────────────────
@@ -3190,10 +3220,14 @@ const main = async () => {
             const others = hits.filter((h) => h.target !== c.self);
             others.forEach((h) => notices.post([h.target], `${c.what} 改动了你的宪章 (系统提示, 变了的段: ${h.sections.join(" / ")}); 已在跑的你看不见新规矩 —— ${ask}${lag(h.target)}`));
             const mine = hits.find((h) => h.target === c.self);
+            // 提醒照旧全机发 (各收各的); 回给调用方的名单与人数只含它看得见的 (sameBot) —— 别的机器人的 wizard
+            // 连名字带个数都不报。没有调用方 (人 /name、自动补名) = 主机器人视角, 单机器人时就是全部。
+            const shown = hits.filter((h) => sameBot(c.self ?? "", h.target));
+            const shownOthers = shown.filter((h) => h.target !== c.self);
             return [
                 "",
-                `⚠ 这次改动进了宪章 (系统提示): 已在跑的 wizard 看不见, 要 handoff 才换上。受影响 ${hits.length} 个: ${hits.map((h) => displayName(h.target)).join(" ")}`,
-                ...(others.length ? [`已给其余 ${others.length} 个各挂一条提醒 (随它们下一条消息到), 让它们${ask}`] : []),
+                `⚠ 这次改动进了宪章 (系统提示): 已在跑的 wizard 看不见, 要 handoff 才换上。受影响 ${shown.length} 个: ${shown.map((h) => displayName(h.target)).join(" ")}`,
+                ...(shownOthers.length ? [`已给其余 ${shownOthers.length} 个各挂一条提醒 (随它们下一条消息到), 让它们${ask}`] : []),
                 ...(mine ? [`**你自己也在其中** (变了的段: ${mine.sections.join(" / ")}): 这一轮收尾后${ask}${lag(mine.target)}`] : []),
             ].join("\n");
         };
@@ -3219,41 +3253,24 @@ const main = async () => {
                 return { r, note: Promise.resolve(fail(e)) };
             }
         };
+        /** 配置的调用方: 只认 sessionId / pane, 不回落 defaultChat (同 config_set 的 caller)。认不出 = "" (主机器人)。 */
+        const configCaller = (b) => (b.sessionId?.trim() && m.targetForSession(b.sessionId.trim())) || (b.tmuxPane?.trim() && m.targetForPane(b.tmuxPane.trim())) || "";
         // POST /config/get —— 新 MCP 带 `path` (可空) 拿渲染好的文本; 老 MCP 带 `key` 拿 {key, value}。
         http.register("POST /config/get", async (req, res) => {
             const body = (await readBody(req));
+            const seen = cfgSeenBy(cfg, configCaller(body));
             if (typeof body.key === "string") {
-                const r = legacyGet(cfg, body.key);
+                const r = legacyGet(seen, body.key);
                 json(res, r.ok ? 200 : 400, r);
                 return;
             }
             // chatPolicy.<聊天名>… 换成它指向的 principal 再查 (同 config_set 的 pinChatKeys); 认不出的原样查。
+            // 名字按调用方看得见的表解析: 别的机器人的聊天名认不出, principal 写法在 seen 里也查无此键。
             const p = parsePath(body.path);
-            const base = p[0] === "chatPolicy" && p[1] ? chatBaseOf(cfg, p[1]) : "";
-            const r = configGet(cfg, sourcePath, base ? ["chatPolicy", base, ...p.slice(2)].join(".") : body.path, configEvidence);
+            const base = p[0] === "chatPolicy" && p[1] ? chatBaseOf(seen, p[1]) : "";
+            const r = configGet(seen, sourcePath, base ? ["chatPolicy", base, ...p.slice(2)].join(".") : body.path, configEvidence);
             json(res, r.ok ? 200 : 400, r);
         });
-        // chatPolicy 的键一律落成 base principal: 聊天名会改, 拿它当键一改名策略就悄悄失效。写名字照收,
-        // 换成它此刻指向的 principal; 认不出的拒写 (写错的键静默无效, 比报错难查)。unset 一个盘上原样存在的
-        // 键不换 —— 留给清理老写法 / 失效的键。
-        const pinChatKeys = (req) => {
-            const p = parsePath(req.path);
-            if (p[0] !== "chatPolicy")
-                return req;
-            const bad = (k) => ({ ok: false, reason: `认不出聊天 \`${k}\`: 键写 base principal (\`chat:wr…\` / \`user:…\`) 或聊天名 (/chats)` });
-            if (p.length === 1) {
-                if (req.value === undefined || typeof req.value !== "object" || Array.isArray(req.value))
-                    return req;
-                const pairs = Object.entries(req.value).map(([k, v]) => [k, chatBaseOf(cfg, k), v]);
-                const miss = pairs.find(([, b]) => !b);
-                return miss ? bad(miss[0]) : { ...req, value: Object.fromEntries(pairs.map(([, b, v]) => [b, v])) };
-            }
-            const key = p[1];
-            if (req.op === "unset" && p.length === 2 && key in cfg.chatPolicy)
-                return req;
-            const base = chatBaseOf(cfg, key);
-            return base ? { ...req, path: ["chatPolicy", base, ...p.slice(2)].join(".") } : bad(key);
-        };
         // POST /config/set —— 口令门见 `guarded`。分级在这里而不在 hook: `card` 项由守护进程
         // 自己推确认卡, 所以 danger.skipAll / ⏱窗口 都放不掉它。卡等 CONFIRM_INLINE_MS 还没人点
         // 就先回 pending (fetch 默认 5 分钟收不到头就断), 卡仍有效, 迟到的确认照常落盘并捎一句给调用方。
@@ -3265,7 +3282,7 @@ const main = async () => {
                 json(res, 400, asked);
                 return;
             }
-            const ask = pinChatKeys(asked);
+            const ask = pinChatKeys(cfg, asked, configCaller(body));
             if ("ok" in ask) {
                 json(res, 400, ask);
                 return;
@@ -3284,8 +3301,7 @@ const main = async () => {
             }
             // 落盘时重算一遍: 等卡期间文件可能被别人改过, 按那一刻的文件打补丁、再校验。
             // 宪章快照取在落盘之前 (守卫里): hot 项一 applyHot, 活的 cfg 就已经是新的了。
-            // 不用 resolveSelf: 它最后回落到 defaultChat, 会把认不出的调用方当成那个群的管家。
-            const caller = (body.sessionId?.trim() && m.targetForSession(body.sessionId.trim())) || (body.tmuxPane?.trim() && m.targetForPane(body.tmuxPane.trim())) || undefined;
+            const caller = resolveSelf({ sessionId: body.sessionId, tmuxPane: body.tmuxPane }) || undefined;
             // 人发起 = 调用方这一轮的链头是人 (人在群里 / 单聊里叫它改的)。
             const byHuman = !!caller && !!askerOf(caller)?.who.startsWith("user:");
             const commit = async () => {
@@ -3368,6 +3384,12 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: bad });
                 return;
             }
+            // 节点是 base 下的 tag, 构造上与调用方同机器人; 这一道防的是 tag 里夹带别的机器人的 key。
+            const xnode = spec.nodes.find((n) => !sameBot(self, keyOf(spec.base, n.tag)));
+            if (xnode) {
+                json(res, 400, { ok: false, reason: `node.tag \`${xnode.tag}\` 不是一个合法的 tag` });
+                return;
+            }
             const graphLog = log.child({ mod: "graph", base: spec.base });
             // 每一步、每条进度都在发起这次 run 的那一轮的频道里: 人在群里叫它发起的才进群,
             // 私聊轮里发起的整场只进 rolepage —— 步骤不带频道就等于在节点的 home 群里开口。
@@ -3413,6 +3435,12 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: "runId required" });
                 return;
             }
+            // 别的机器人那边跑的流水线与不存在同形。
+            const run = getRun(runId);
+            if (run && !sameBot(resolveSelf(body), run.base)) {
+                json(res, 404, { ok: false, reason: `run ${runId} not found or already finished` });
+                return;
+            }
             const stopped = stopRun(runId);
             json(res, stopped ? 200 : 404, stopped ? { ok: true, runId } : { ok: false, reason: `run ${runId} not found or already finished` });
         });
@@ -3446,6 +3474,10 @@ const main = async () => {
         // 跑完自动收掉。只有排班时点名了某个 wizard (fresh=false) 且它此刻闲着,
         // 才把这句话直接投进它那一轮 —— 「在已有会话里继续」是要求出来的, 不是默认。
         scheduledTaskInject = async (target, text, { taskId, fresh, quiet }) => {
+            // 日程文件是可手改的源码: target 与排班者不同机器人就不放枪 (schedule_task 那头已拦, 这里拦手改的)。
+            const owner = ((r) => (r ? ownerOf(r) : target))(tasks.get(taskId));
+            if (!sameBot(owner, target))
+                return { ok: false, reason: `日程 ${taskId} 的目标与排班者归不同的企微机器人, 不跨机器人放枪` };
             // 安静任务私下跑 (channel ""): 镜像不推它的任何一句, 终句由 relayUnlessQuiet 判断要不要进群。
             const inNamed = async () => {
                 const at = Date.now();
@@ -3605,7 +3637,7 @@ const main = async () => {
             refsOf: (md) => {
                 // cwd 候选: 提议里带的 (提议者可能早收工了) + 在场绑定的; 再正向算出 md 比对。
                 const cwds = [...new Set([...proposedCwds(stateDir), ...boundTargets().map(cwdOfTarget)].filter(Boolean))];
-                const cwd = cwdOfMd(stateDir, md, cwds);
+                const cwd = cwdOfMd(stateDir, md, cwds, ["", ...cfg.bots.map((b) => b.id)]);
                 if (!cwd)
                     return [];
                 return [...PROJECT_DOCS.map((f) => join(cwd, f)), ...projectDirsFor(cwd).map((d) => join(d.dir, "memory", "MEMORY.md"))].filter((f) => existsSync(f));
@@ -3638,7 +3670,8 @@ const main = async () => {
         inject: scheduledTaskInject,
         // gate 里的 `sh` 默认就在目标 wizard 此刻的工作区跑 —— 任务文件里不必写死绝对路径。
         cwdOf: (t) => { const c = bridge.getCwd(t); return c.runningCwd || c.pendingCwd || c.defaultCwd; },
-        fallbackTarget: () => (cfg.defaultChat ?? "").trim(),
+        // 没写 target 的日程兜底到排班者那个机器人的默认聊天 (副机器人没配就不放枪, 不冒用主机器人)。
+        fallbackTarget: (t) => defaultChatFor(cfg, t.owner),
     });
     // 共享记忆整理 — daemon 内建, 不进任务表 / 日程, 不出任何气泡。
     const steward = stewardRun
@@ -3664,6 +3697,15 @@ const main = async () => {
                 log.info({ reaped: r.reaped.length, targets: r.reaped, orphans: r.orphans.length, max }, "pane cap sweep");
         };
         bridge.onSpawn(() => void sweep().catch((e) => log.warn({ err: e.message }, "pane cap sweep failed")));
+        // 定时清扫: 无绑定孤儿 (restore 丢绑定留下的老 window) 不靠 spawn 也会攒, 只在
+        // onSpawn 数等于没人收。绑定在 store 里启动即读, 新生 pane 有 ORPHAN_GRACE 宽限,
+        // 所以启动后扫一次是安全的。
+        const periodSec = cfg.wrc.mirror.paneSweepSec;
+        if (periodSec > 0) {
+            const timer = setInterval(() => void sweep().catch((e) => log.warn({ err: e.message }, "pane cap sweep failed")), periodSec * 1000);
+            timer.unref();
+        }
+        setTimeout(() => void sweep().catch((e) => log.warn({ err: e.message }, "pane cap sweep failed")), 15_000).unref();
     }
     const shutdown = async (signal) => {
         log.info({ signal }, "shutdown signal");