wezard 2.5.1 → 2.6.0

package/dist/daemon/approval.js

@@ -1,4 +1,6 @@
 import { closeSync, fstatSync, openSync, readFileSync, readSync } from "node:fs";
+import { defaultChatOfBot } from "../shared/config.js";
+import { botTagOf } from "./bot-mux.js";
 import { createPending, getPending, getResolvedSnapshot, resolvePending, resolvePendingsByChat, failPending, stashResolved, markCardSent, isReloadError } from "./pending.js";
 import { cacheGet, cachePut, cacheKey, isAutoWindowActive, autoWindowRemainingMs, setAutoWindow, clearAutoWindow, getWindowMeta, } from "./session-cache.js";
 import { evaluateAllow, ruleMatchesAny, alwaysAllowRulesFor, splitSegments, NEVER_RULE_ALLOW } from "../shared/allow-rules.js";
@@ -6,9 +8,9 @@ import { redact } from "./redact.js";
 import { dangerOf, dangerEarlyExit, selfConfigWriteOf } from "./danger.js";
 import { appendUnique } from "../shared/config-writer.js";
 import { claudeConfigWrite } from "../shared/claude-config-path.js";
-import { recordApproval, recordApprovalDecision, buildDetailUrl, getDetail, openTurnsOf } from "./detail.js";
+import { recordApproval, recordApprovalDecision, buildDetailUrl, getDetail, openTurnsOf, targetOfSession } from "./detail.js";
 import { json, readBody } from "./http.js";
-import { tagBadge, tagOfKey, withTagHeader } from "../shared/session-label.js";
+import { botOfKey, tagBadge, tagOfKey, withTagHeader, withBot } from "../shared/session-label.js";
 import { chatPolicyOf } from "./chat-name.js";
 import { makeStewardGuard } from "./steward-guard.js";
 import { sessionNameFor } from "./session-name.js";
@@ -32,13 +34,18 @@ const targetChatId = (key) => {
 };
 /** 卡片真正要去的那个聊天 (按频道换算之后) 此刻送得到吗 —— 微信 chat 不看企微长连接。 */
 const canReach = (client, key) => reachable(client, targetChatId(key));
+// 绑了镜像的会话, 卡片发到它的聊天 —— 机器人随会话 key 走。没绑镜像的不属于任何聊天、任何机器人:
+// 先全局 (主机器人), 全局都空才按配置顺序借副机器人自己的审批人 / 默认聊天 (挂上它的 `~<bot>`,
+// 卡片才从那个机器人推出去)。
 const pickApprover = (cfg) => {
     if (cfg.approval.approvers.length > 0)
         return cfg.approval.approvers[0];
     if (cfg.defaultChat)
         return cfg.defaultChat;
-    return undefined;
+    return cfg.bots.flatMap((b) => [...b.approvers, b.defaultChat].filter(Boolean).map((p) => withBot(p, b.id)))[0];
 };
+/** 副机器人 `bot` 自己的审批人 / 默认聊天 (挂 `~bot`); 都没配 = undefined —— 不回落主机器人, 那是冒用它的连接。 */
+const botApprover = (cfg, bot) => ((b) => (b ? [...b.approvers, b.defaultChat].filter(Boolean).map((p) => withBot(p, bot))[0] : undefined))(cfg.bots.find((x) => x.id === bot));
 const TRUNC = (s, n) => (s.length > n ? `${s.slice(0, n - 1)}…` : s);
 const HOME_RE = /^\/Users\/[^/]+/;
 const fmtPath = (p) => p.replace(HOME_RE, "~");
@@ -390,7 +397,7 @@ const evictBatches = () => {
     }
 };
 const newBatchId = () => `b${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
-const batchKeyOf = (sessionId, toolName) => `${sessionId}|${toolName}`;
+const batchKeyOf = (sessionId, toolName, chatId) => JSON.stringify([sessionId, toolName, chatId]);
 // 单条成员渲染: 展开第 N 项的输入摘要, 单行化以适配批量列表的紧凑布局。
 const PER_MEMBER_MAX = 120;
 const BATCH_MAX_VISIBLE = 8;
@@ -1450,7 +1457,12 @@ const fallback = (cfg, reason, forceSingle) => ({
 });
 const resolveApprover = (cfg, sessionId, getMirrorTarget) => {
     const mirror = sessionId ? getMirrorTarget?.(sessionId) : undefined;
-    return mirror || pickApprover(cfg);
+    if (mirror)
+        return mirror;
+    // 镜像对不上时, 这个会话跑过的轮次还记得它在谁名下: 归副机器人就按那个机器人兑。认不出 / 归主机器人 =
+    // 原样 (pickApprover, 主机器人优先)。单机器人时 bot 恒为 "", 不变。
+    const bot = sessionId ? botOfKey(targetOfSession(sessionId) ?? "") : "";
+    return bot ? botApprover(cfg, bot) : pickApprover(cfg);
 };
 // ── Subagent 归属解析 ──────────────────────────────────────────────────
 // CC / CodeBuddy 正常把子代理工具调用的 hook session_id 上报成**父会话** id
@@ -1518,7 +1530,7 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
             return;
         const text = cmd.length > cap ? `${cmd.slice(0, cap)}\n…（已截断，完整命令共 ${cmd.length} 字）` : cmd;
         const chunks = chunkText(text, FULLCMD_CHUNK_CHARS);
-        const target = targetChatId(batch.approver);
+        const target = batch.chatId;
         for (let i = 0; i < chunks.length; i++) {
             const head = i === 0
                 ? `🔐 待审批完整命令（${cmd.length} 字${chunks.length > 1 ? `，${i + 1}/${chunks.length}` : ""}）：\n`
@@ -1600,7 +1612,7 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
         if (batch.flushed)
             return;
         batch.flushed = true;
-        activeBatches.delete(batchKeyOf(batch.sessionId, batch.toolName));
+        activeBatches.delete(batchKeyOf(batch.sessionId, batch.toolName, batch.chatId));
         const isMulti = batch.members.length > 1;
         const card = isMulti
             ? buildBatchCard(batch, batch.members[0]?.transcriptTail ?? "")
@@ -1644,13 +1656,13 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
             catch (e) {
                 log.warn({ batchId: batch.batchId, err: e.message }, "command prelude send failed");
             }
-            const sendCard = (c) => client.sendMessage(targetChatId(batch.approver), { msgtype: "template_card", template_card: c });
+            const sendCard = (c) => client.sendMessage(batch.chatId, { msgtype: "template_card", template_card: c });
             try {
                 await sendCard(card);
             }
             catch (e) {
                 // quote 体可能超平台未公开的长度上限 — 缩到安全值重试一次, 保住审批流。
-                log.warn({ batchId: batch.batchId, err: e.message }, "card send failed — retrying with shrunk quote");
+                log.warn({ batchId: batch.batchId, approver: batch.approver, chatId: batch.chatId, err: e.message ?? e.errmsg }, "card send failed — retrying with shrunk quote");
                 await sendCard(shrinkQuote(card));
             }
             log.info({ batchId: batch.batchId, count: batch.members.length, multi: isMulti, approver: batch.approver, tool: batch.toolName }, "batch flushed");
@@ -1661,8 +1673,9 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
                 markCardSent(batch.members[0].reqId);
         }
         catch (e) {
-            log.error({ batchId: batch.batchId, err: e.message }, "batch send failed");
-            const err = new Error(`send_card_fail:${e.message}`);
+            const message = e.message ?? e.errmsg ?? String(e);
+            log.error({ batchId: batch.batchId, approver: batch.approver, chatId: batch.chatId, err: message }, "batch send failed");
+            const err = new Error(`send_card_fail:${message}`);
             for (const m of batch.members)
                 failPending(m.reqId, err);
             // 单成员 batch 摘除自己的 batchById 条目, 多成员保留 (后续 click 兜底
@@ -1677,6 +1690,7 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
             return;
         }
         const body = (await readBody(req));
+        const nativePermission = body.cli_backend === "codex" && body.hook_event_name === "PermissionRequest";
         let sessionId = body.session_id ?? "";
         const { toolName, toolInput } = unwrapDeferredTool(body.tool_name ?? "", body.tool_input ?? {});
         const cwd = body.cwd ?? "";
@@ -1720,7 +1734,7 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
         // wezard 自改配置的写 (见 selfConfigWriteOf): matcher 也放不掉它。
         const selfWrite = selfConfigWriteOf(toolName, toolInput);
         // Matcher: only intercept matching tools — others pass.
-        if (!selfWrite && !new RegExp(cfg.approval.matcher).test(toolName)) {
+        if (!nativePermission && !selfWrite && !new RegExp(cfg.approval.matcher).test(toolName)) {
             json(res, 200, { decision: "allow", reason: "matcher_skip" });
             return;
         }
@@ -1744,12 +1758,13 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
         // ⏱窗口 / 会话缓存), 批准后 settleClaudeConfigModal 去把框按掉。
         // 没有活 pane (未镜像的本地会话) → 不介入: 那种情形用户就在键盘前,
         // 自己按掉即可, 拦下来只是挡工作。
-        const guardHit = cfg.approval.claudeConfigGuard ? claudeConfigWrite(toolName, toolInput) : undefined;
+        const guardHit = cfg.approval.claudeConfigGuard && body.cli_backend !== "codex" ? claudeConfigWrite(toolName, toolInput) : undefined;
         const guardActive = Boolean(guardHit && nativeModal?.hasPane(sessionId));
         if (guardHit) {
             log.info({ toolName, sessionId, path: guardHit.path, why: guardHit.why, guardActive }, guardActive ? "claude-config guard armed" : "claude-config write detected (no live pane, passing through)");
         }
         const approver = resolveApprover(cfg, sessionId, getMirrorTarget);
+        const chatId = approver ? targetChatId(approver) : "";
         // 守卫的收尾 = 把 CC 那个不过 hook 的原生确认框按掉。它挂在**每一条 allow 出口**
         // 上, 而不是靠"强制发卡 + 人工点"来触发 —— 死锁的成因是没人按框, 不是没人点卡。
         //
@@ -1774,7 +1789,7 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
             log.info({ toolName, sessionId, rule: danger.rule }, "danger hit — forcing single approval");
         // 必发卡 = 危险名单 或 askRules 命中。这两者的语义是「每次都要人单独看一眼」,
         // 所以压过放行/窗口/缓存。守卫不在其列 —— 见上面 settleGuard 的注释。
-        const mustCard = Boolean(danger) || Boolean(askHit);
+        const mustCard = nativePermission || Boolean(danger) || Boolean(askHit);
         // allowRules: matcher 拦下的工具里再挖细粒度豁免 (Bash 可按命令前缀区分)。
         // 交互卡工具 (AskUserQuestion 等) 在引擎内部硬保护, 规则写了也不放行。
         // 用 evaluateAllow 而非 ruleAllows: 未命中时要把"因为哪一段"带到卡上,
@@ -1853,7 +1868,7 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
         // 否则请求挂在长轮询上等一张子代理场景下没人点的卡, 最终 ask 回退成远端看不见的
         // 原生 picker。denyRules 已在上方生效 (拒绝不是审批), AskUserQuestion / ExitPlanMode
         // 的交互卡也已在上方分支返回, 均不受影响。
-        if (BYPASS_MODES.has(body.permission_mode ?? "")) {
+        if (!nativePermission && BYPASS_MODES.has(body.permission_mode ?? "")) {
             log.info({ toolName, sessionId, mode: body.permission_mode }, "permission-mode bypass auto allow");
             json(res, 200, { decision: "allow", reason: `permission_mode:${body.permission_mode}` });
             settleGuard();
@@ -1863,7 +1878,7 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
         // 名单 / askRules / ⏱窗口 / 会话缓存 (与 danger.skip 的区别: 那个只豁免命中
         // 名单的调用, 普通调用照审)。denyRules / EnterPlanMode 拦截在前面已生效
         // (拒绝不是审批); AskUserQuestion / ExitPlanMode 交互卡在上方分支已返回, 不受影响。
-        if (cfg.approval.danger.skipAll) {
+        if (!nativePermission && cfg.approval.danger.skipAll) {
             log.info({ toolName, sessionId }, "danger.skipAll auto allow");
             json(res, 200, { decision: "allow", reason: "danger_skip_all" });
             settleGuard();
@@ -1881,7 +1896,7 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
         // danger.skip / danger 模式的早退。第三个参数是「除 danger 外还有没有别的必发卡
         // 理由」—— askRules 不能被 danger 的开关顺带关掉。守卫不在其列: 它要的是事后按框,
         // 早退照样能给 (settleGuard), 拿它挡早退等于把 danger 的开关废掉。
-        const earlyExit = dangerEarlyExit(cfg, danger, Boolean(askHit) || Boolean(selfWrite));
+        const earlyExit = dangerEarlyExit(cfg, danger, nativePermission || Boolean(askHit) || Boolean(selfWrite));
         if (earlyExit) {
             log.info({ toolName, sessionId, reason: earlyExit }, "danger switch early exit");
             json(res, 200, { decision: "allow", reason: earlyExit });
@@ -1982,14 +1997,14 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
         // 选择普通 buildCard 或 buildBatchCard。0 = 关闭聚合, 立即 flush。
         // 续接的请求不再进 batch: 卡已经在群里, 重发就是重复轰炸。
         const member = { reqId, toolInput: display, originalToolInput: toolInput, toolInputStr, cwd, transcriptTail };
-        const bk = batchKeyOf(sessionId, toolName);
+        const bk = batchKeyOf(sessionId, toolName, chatId);
         // 必发卡请求既不 join 也不被 join — 一次这样的操作 = 一张卡 = 一次点击。
         // 合流会把它塞进带「⏱全过 / ✅总是」的批量卡, 一次点击就连它一起放行了。
         const existing = mustCard ? undefined : activeBatches.get(bk);
         if (resumeId) {
             // no-op: 直接进下面的长轮询, 等旧卡上的点击。
         }
-        else if (existing && !existing.flushed) {
+        else if (existing && !existing.flushed && existing.chatId === chatId) {
             existing.members.push(member);
             log.info({ batchId: existing.batchId, count: existing.members.length, reqId }, "batch joined");
         }
@@ -1999,6 +2014,7 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
                 sessionId,
                 toolName,
                 approver,
+                chatId,
                 windowMinutes: cfg.approval.windowMinutes,
                 danger: danger?.rule,
                 forceSingle: mustCard,
@@ -2031,7 +2047,8 @@ export const makeApproveHandler = ({ cfg, log, client, sourcePath, getMirrorTarg
                 return;
             }
             log.warn({ err: e.message, reqId }, "approval timed out");
-            json(res, 200, fallback(cfg, "approver_timeout", mustCard || guardActive));
+            const failure = e.message?.startsWith("send_card_fail:") ? e.message : "approver_timeout";
+            json(res, 200, fallback(cfg, failure, mustCard || guardActive));
             return;
         }
         // 必发卡的决策一律不留痕: 不写 session cache、不开自动窗口 (卡上本就没这两个
@@ -2159,9 +2176,15 @@ export const installApprovalEventListener = (client, log, cfg, onApproved) => {
             // 回复目标: 待决时在 pending 里, 已决时 pending 已删 —— 回落到 resolved
             // 暂存。两个都没有才用 defaultChat (`#tag` 会话会因此回到主会话, 不理想,
             // 但那已经是记录过期的边缘情形)。
+            // 最后一档按点击帧是哪个机器人收的兑到它自己的默认聊天 (副机器人没配 = 不回), 不回落主机器人的
+            // 全局 defaultChat; 单机器人时 botTagOf 恒 "", 就是原来的 cfg.defaultChat。
             const target = getPending(reqId)?.chatKey
                 ?? getResolvedSnapshot(reqId)?.meta.chatKey
-                ?? cfg.defaultChat;
+                ?? defaultChatOfBot(cfg, botTagOf(frame));
+            if (!target) {
+                log.info({ reqId, bot: botTagOf(frame) }, "full command: 记录已过期且该机器人没有默认聊天, 不回");
+                return;
+            }
             const cmd = rec && rec.kind === "approval" ? commandOf(rec.toolName, rec.toolInput) : "";
             // 只能走主动 markdown 分块 (≤1800 字单条)。曾试过对点击事件做 stream 被动
             // 回复 (单条 20480 字节) —— 企微服务端拒绝: errcode=846605 invalid req_id,