netizen-cli 0.11.4__tar.gz → 0.12.0__tar.gz

{netizen_cli-0.11.4/netizen_cli.egg-info → netizen_cli-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: netizen-cli
-Version: 0.11.4
+Version: 0.12.0
 Summary: Use native Codex threads through a Feishu Channel.
 Requires-Python: <3.15,>=3.11
 Requires-Dist: h11==0.16.0

{netizen_cli-0.11.4 → netizen_cli-0.12.0}/README.md

@@ -36,19 +36,19 @@
 - **把任务交给 Codex。** 在飞书中阅读代码、修改项目、整理资料；任务由官方 Codex SDK
   管理的原生会话执行，沿用运行主机上的工具和工作目录。
 - **边做边沟通。** 普通任务执行时继续发消息，可以补充条件或调整方向；也可以开启
-  [过程卡](skills/netizen-user-guide/references/user-guide.md#飞书中的运行反馈)查看进展。
+  [过程卡](skills/netizen-user-guide/references/feedback-and-files.md#飞书中的运行反馈)查看进展。
 - **带上图片与讨论背景。** 支持图片、逐条引用，以及可选的
-  [群聊上下文](skills/netizen-user-guide/references/user-guide.md#发送消息引用与图片)。
+  [群聊上下文](skills/netizen-user-guide/references/messages.md#发送消息引用与图片)。
 - **取回本轮文件。** 完成后从回复卡片中按需发送有原生执行记录的文件；发送的是点击时
-  的当前内容，详见[文件说明](skills/netizen-user-guide/references/user-guide.md#查看和发送本轮文件)。
+  的当前内容，详见[文件说明](skills/netizen-user-guide/references/feedback-and-files.md#查看和发送本轮文件)。
 - **保留上下文，另开一条讨论。** 用
-  [持久分支](skills/netizen-user-guide/references/user-guide.md#fork-持久分支)在当前聊天或其他群
+  [持久分支](skills/netizen-user-guide/references/fork-side-goal.md#fork-持久分支)在当前聊天或其他群
   创建普通话题，之后独立继续。
 - **展开临时讨论，推进持续目标。** 用
-  [Side](skills/netizen-user-guide/references/user-guide.md#side-临时话题)另开临时话题，或用
-  [Goal](skills/netizen-user-guide/references/user-guide.md#goal)让 Codex 围绕目标持续推进。
+  [Side](skills/netizen-user-guide/references/fork-side-goal.md#side-临时话题)另开临时话题，或用
+  [Goal](skills/netizen-user-guide/references/fork-side-goal.md#goal)让 Codex 围绕目标持续推进。
 - **让任务按时开始。** 用自然语言或 `/cron` 创建
-  [定时任务](skills/netizen-user-guide/references/user-guide.md#定时任务)，可每次在独立话题执行，也可在原会话定时继续。
+  [定时任务](skills/netizen-user-guide/references/scheduled-tasks.md#定时任务)，可每次在独立话题执行，也可在原会话定时继续。
 
 普通会话的历史由 Codex 保存，可在 Codex App/CLI 中继续使用；App/CLI 中新增的消息不会
 自动回填飞书。多个会话可以并行，同一项目的文件目录共享，修改会相互可见。
@@ -109,7 +109,7 @@ Agent／脚本使用 `netizen update --json`：stdout 只输出最终 JSON，进
 5. 收到回复后继续交流；如果出现“本轮文件”，点击“发送”取回需要的文件。
 
 不确定下一步时发送 `/help` 查看快速开始。通过 `/defaults` 或 Admin 配好
-[会话默认配置](skills/netizen-user-guide/references/user-guide.md#默认会话配置与自动创建)后，
+[会话默认配置](skills/netizen-user-guide/references/sessions.md#默认会话配置与自动创建)后，
 没有当前会话时也可直接发送任务：机器人会在消息所在主线或话题创建会话并执行。
 没有可用默认配置时，机器人仍会提示准备步骤；被拦下的任务需在准备好后重新发送。
 
@@ -117,7 +117,7 @@ Agent／脚本使用 `netizen update --json`：stdout 只输出最终 JSON，进
 不接受参数。普通任务执行中发来的新消息用于调整当前任务，不会排队成下一个任务。
 
 安装遇到问题可从[部署文档](docs/deployment.md)继续；已能对话时，常见疑问见
-[使用 FAQ](skills/netizen-user-guide/references/user-guide.md#常见问题)。
+[使用 FAQ](skills/netizen-user-guide/references/faq.md#常见问题)。
 
 ## 命令
 
@@ -133,12 +133,12 @@ Agent／脚本使用 `netizen update --json`：stdout 只输出最终 JSON，进
 | 调整模型、思考强度和过程卡 | `/config`，当前会话空闲时使用 |
 | 查看当前任务和上下文用量 | `/status` |
 | 查看共享 Codex 账号额度和重置时间 | `/usage` |
-| 中断当前任务 | `/stop`；不保证前台工具进程退出，见[停止说明](skills/netizen-user-guide/references/user-guide.md#stop) |
+| 中断当前任务 | `/stop`；不保证前台工具进程退出，见[停止说明](skills/netizen-user-guide/references/status-and-control.md#stop) |
 | 查找当前机器人的管理入口 | `/admin`；返回实际管理 URL 和实例根目录，不返回登录凭据 |
 | 管理定时任务 | `/cron`，也可以直接用自然语言描述计划 |
 | 查看当前实例提供的命令 | `/help` |
 
-重命名、归档、恢复、删除等完整用法见[命令索引](skills/netizen-user-guide/references/user-guide.md#完整命令索引)。
+重命名、归档、恢复、删除等完整用法见[命令索引](skills/netizen-user-guide/references/commands.md#完整命令索引)。
 当前实例的命令开放情况以 `/help` 为准，任务状态以 `/status` 和卡片提示为准。
 
 ### 两个常见场景
@@ -159,7 +159,7 @@ Side 会在同一聊天中新建话题，可继续多轮讨论。它与原会话
 ```
 
 计划每次创建独立执行话题；暂停计划不会停止已经触发的任务。
-[定时任务用法](skills/netizen-user-guide/references/user-guide.md#定时任务)
+[定时任务用法](skills/netizen-user-guide/references/scheduled-tasks.md#定时任务)
 
 <a id="admin-web"></a>
 
@@ -183,12 +183,12 @@ Admin 是实例必备能力；管理员可在“系统管理 → 权限管理
 - **共享环境。** 飞书应用的可用范围和群成员关系控制谁能访问；同一实例复用服务账号，
   不提供按用户或项目隔离的权限体系。Admin Web 面向受信内网，名单中的管理员权限相同。
 - **输入与输出。** 支持文本、普通图片和富文本图片，也可提供飞书 2.0 卡片、合并转发与转发话题作为
-  [背景材料](skills/netizen-user-guide/references/user-guide.md#卡片合并转发与转发话题)。材料内部的媒体只提供未读附件描述；直接文件和音视频仍不支持。
+  [背景材料](skills/netizen-user-guide/references/messages.md#卡片合并转发与转发话题)。材料内部的媒体只提供未读附件描述；直接文件和音视频仍不支持。
   飞书 1.0 卡片明确不支持。
   输出文件按本轮原生记录发现，不扫描工作区补齐，也不自动上传。
 - **Codex 能力有宿主差异。** 飞书复用原生会话和工具，但并非每个 App/CLI 控件都可用；
   全新会话采用 `auto_review`，持久分支沿用原生继承权限；不提供 App 的 Ask/Custom 选择器。
-  [完整差异与当前限制](skills/netizen-user-guide/references/user-guide.md#与-codex-appcli-的差异)
+  [完整差异与当前限制](skills/netizen-user-guide/references/native-capabilities.md#与-codex-appcli-的差异)
 
 <a id="用户指南-skill"></a>
 

{netizen_cli-0.11.4 → netizen_cli-0.12.0}/config.example.yaml

@@ -15,6 +15,17 @@ projects:
 channel:
   securityMode: audit
 
+# Optional collaboration-tool ranges; both default to all when omitted.
+# Admin can update these at runtime. These rules do not restrict ordinary chat input.
+# Each mode is all, only, exclude, or disabled; only/exclude use exact chat IDs.
+sessionTools:
+  discovery:
+    mode: all
+    chatIds: []
+  readSend:
+    mode: all
+    chatIds: []
+
 # Required management UI, using this app's Feishu administrator identities.
 # It listens on all interfaces for direct access inside the trusted private network.
 adminWeb:

{netizen_cli-0.11.4 → netizen_cli-0.12.0}/netizen_cli/__init__.py

@@ -1,3 +1,3 @@
 """Netizen: a thin Feishu Channel for native Codex Threads."""
 
-__version__ = "0.11.4"
+__version__ = "0.12.0"

{netizen_cli-0.11.4 → netizen_cli-0.12.0}/netizen_cli/admin/port_config.py

@@ -52,7 +52,7 @@ def _identity(metadata: os.stat_result) -> tuple[int, ...]:
     )
 
 
-def persist_admin_port(snapshot: ConfigFileSnapshot, port: int) -> None:
+def persist_admin_port(snapshot: ConfigFileSnapshot, port: int) -> ConfigFileSnapshot:
     """Preserve all YAML values and refuse a detected concurrent human edit.
 
     The caller retains its listening socket and instance lifetime lock. This
@@ -72,7 +72,7 @@ def persist_admin_port(snapshot: ConfigFileSnapshot, port: int) -> None:
     values = dict(values)
     loaded["adminWeb"] = values
     values["port"] = port
-    _write_configuration(snapshot, loaded)
+    return write_configuration(snapshot, loaded)
 
 
 def _validate_port(port: int) -> None:
@@ -80,10 +80,11 @@ def _validate_port(port: int) -> None:
         raise AdminPortConfigurationError("Admin port must be from 1 to 65535")
 
 
-def _write_configuration(snapshot: ConfigFileSnapshot, loaded: dict) -> None:
+def write_configuration(snapshot: ConfigFileSnapshot, loaded: dict) -> ConfigFileSnapshot:
+    """Replace the existing instance YAML after checking its exact snapshot."""
     content = yaml.safe_dump(loaded, allow_unicode=True, sort_keys=False).encode("utf-8")
     snapshot.require_unchanged()
-    descriptor, temporary_name = tempfile.mkstemp(prefix=".admin-port-", dir=snapshot.path.parent)
+    descriptor, temporary_name = tempfile.mkstemp(prefix=".netizen-config-", dir=snapshot.path.parent)
     temporary = Path(temporary_name)
     try:
         with os.fdopen(descriptor, "wb") as output:
@@ -96,3 +97,4 @@ def _write_configuration(snapshot: ConfigFileSnapshot, loaded: dict) -> None:
     finally:
         with contextlib.suppress(FileNotFoundError):
             temporary.unlink()
+    return ConfigFileSnapshot.read(snapshot.path)

{netizen_cli-0.11.4 → netizen_cli-0.12.0}/netizen_cli/admin/static/admin.css

@@ -378,6 +378,12 @@ body.schedule-detail-open { overflow: hidden; }
 .system-tabs { width: fit-content; margin: 22px 0; }
 .admin-users { padding: 0; margin: 0; list-style: none; }
 .admin-users > li { display: flex; justify-content: space-between; align-items: center; gap: 16px; border-top: 1px solid var(--line); padding: 16px 0; }
+.session-access { margin-top: 32px; padding-top: 18px; border-top: 1px solid var(--line); }
+.session-access-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(300px, 100%), 1fr)); gap: 24px; }
+.session-access-grid h4 { margin: 0 0 8px; }
+.session-access-grid p { min-height: 48px; color: var(--muted); line-height: 1.6; }
+.session-access-grid textarea { width: 100%; resize: vertical; font-family: monospace; }
+.session-access-grid [hidden] { display: none; }
 .identity-panel { max-width: 480px; border: 1px solid var(--line); border-radius: 14px; margin-bottom: 24px; padding: 20px; color: var(--ink); }
 .identity-panel h3 { margin: 0; }
 .identity-panel > p { margin: 20px 0; }

{netizen_cli-0.11.4 → netizen_cli-0.12.0}/netizen_cli/admin/static/admin.js

@@ -61,6 +61,7 @@ function expireAdminSession() {
   const notice = document.querySelector("#auth-expired");
   if (notice) notice.hidden = false;
   window.NetizenIdentity?.expire();
+  window.NetizenSessionAccess?.expire();
   setStatus("登录已过期，请重新登录。", true);
 }
 
@@ -404,7 +405,7 @@ function actionsCell(row) {
 function confirmMaterializedDelete(session) {
   const name = session.nativeTitle || "未命名 Session";
   return window.confirm(
-    `确认永久删除这个会话？\n\n会话：${name}\nScope：${session.scopeKey}\nShort ID：${session.shortId}`
+    `确认永久删除这个会话？\n\n会话：${name}\nScope：${session.scopeKey}\nNetizen 会话编号：${session.shortId}`
     + "\n\n原生 Thread、spawned descendants、Codex App/CLI 历史和本地 Binding 都会永久消失，无法恢复。",
   );
 }
@@ -1608,15 +1609,16 @@ function sessionIdentityCell(row, session) {
   }
   const bindingId = document.createElement("div");
   bindingId.className = "id";
-  bindingId.textContent = `Binding ${session.shortId}`;
+  bindingId.textContent = `Netizen 会话编号：${session.shortId}`;
   td.append(bindingId);
   const details = document.createElement("details");
   details.className = "session-identities";
   const summary = document.createElement("summary");
   summary.textContent = "会话标识";
   details.append(summary);
-  for (const [label, value] of [["Chat", session.chatId], ["Topic", session.topicId],
-    ["Binding", session.bindingId], ["Thread", session.nativeThreadId]]) {
+  for (const [label, value] of [["飞书聊天 ID（位置）", session.chatId], ["飞书话题 ID（位置）", session.topicId],
+    ["Netizen 会话编号（Binding ID，管理与切换）", session.bindingId],
+    ["Codex 会话 ID（Thread ID，跨会话工具）", session.nativeThreadId]]) {
     if (!value) continue;
     const field = document.createElement("label");
     field.textContent = label;
@@ -1624,15 +1626,21 @@ function sessionIdentityCell(row, session) {
     input.type = "text";
     input.readOnly = true;
     input.value = value;
-    input.setAttribute("aria-label", `${label} ID，选中后可复制`);
+    input.setAttribute("aria-label", `${label}，完整值，选中后可复制`);
     input.addEventListener("focus", () => input.select());
     input.addEventListener("click", () => input.select());
     field.append(input);
     details.append(field);
   }
   const hint = document.createElement("small");
-  hint.textContent = "点击标识全选，再按 Ctrl/Cmd+C 复制。";
+  hint.textContent = "点击标识全选，再按 Ctrl/Cmd+C 复制。跨会话工具使用完整 Codex 会话 ID；现有管理与 /resume 使用 Netizen 编号。";
   details.append(hint);
+  if (!session.nativeThreadId) {
+    const pending = document.createElement("p");
+    pending.className = "meta-line";
+    pending.textContent = "Codex 会话 ID 尚未生成，首条消息后创建。";
+    details.append(pending);
+  }
   td.append(details);
   row.append(td);
 }
@@ -1862,20 +1870,6 @@ function wireSessionActions(actions, session) {
   });
   const schedule = actionButton("创建定时任务", () => openScheduleForSession(session, schedule));
   secondary.append(schedule);
-  if (a.createLazy) secondary.append(actionButton("新建 Lazy", async () => {
-    if (!state.projects) await loadProjects();
-    const alias = window.prompt("Project alias");
-    if (!alias) return;
-    const project = state.projects.items.find((item) => item.alias === alias && item.enabled);
-    if (!project) return setStatus("未找到当前页中已启用的 Project，请先刷新 Projects。", true);
-    const activate = window.confirm("是否立即设为当前会话？");
-    await mutate("/api/v1/sessions/create-lazy", a.createLazy, {
-      projectAlias: alias,
-      projectRevision: project.revision,
-      activate,
-      turnSettings: null,
-    });
-  }));
   if (a.configure) {
     const button = actionButton("配置", () => openSessionSettingsEditor(session, button));
     actions.append(button);
@@ -2047,7 +2041,7 @@ function openSessionSettingsEditor(session, returnFocus) {
     privateChat, contextAvailable: !privateChat && base.message_context_mode === "catch-up",
     loading: true, saving: false, optionsSerial: 0 };
   sessionSettingsInput("editor").hidden = false;
-  sessionSettingsInput("identity").textContent = `${session.nativeTitle || "未命名 Session"} · ${session.shortId} · ${session.projectAlias}`;
+  sessionSettingsInput("identity").textContent = `${session.nativeTitle || "未命名 Session"} · Netizen 会话编号：${session.shortId} · ${session.projectAlias}`;
   renderSessionSettingsEditor();
   if (!sessionSettingsInput("drawer").open) sessionSettingsInput("drawer").showModal();
   document.body.classList.toggle("session-settings-drawer-open", true);
@@ -2647,18 +2641,20 @@ function confirmDiscardChanges(changed) {
 
 function hasUnsavedEditors() {
   return sessionSettingsHasChanges() || defaultEditorHasChanges() || scheduleEditorHasChanges()
-    || Boolean(pendingScheduleDraft?.dirty);
+    || Boolean(pendingScheduleDraft?.dirty) || Boolean(window.NetizenSessionAccess?.dirty());
 }
 
 // Navigation asks once before closing any editor. Busy submissions retain the
 // existing fail-closed boundary; this helper never cancels or repeats a POST.
 function confirmDiscardEditors() {
-  if (sessionSettingsEditor?.saving || defaultsBusy || (scheduleEditor && scheduleInput("fields").disabled)) return false;
+  if (sessionSettingsEditor?.saving || defaultsBusy || (scheduleEditor && scheduleInput("fields").disabled)
+      || window.NetizenSessionAccess?.busy()) return false;
   if (!confirmDiscardChanges(hasUnsavedEditors())) return false;
   closeSessionSettingsEditor({ confirmed: true });
   closeDefaultEditor({ confirmed: true });
   if (scheduleEditor) closeScheduleEditor({ confirmed: true });
   cancelScheduleSelection({ confirmed: true });
+  window.NetizenSessionAccess?.discard();
   return true;
 }
 
@@ -2891,7 +2887,7 @@ function renderScheduleTarget() {
   scheduleInput("binding").value = selected;
   scheduleInput("select-session").hidden = Boolean(selected);
   scheduleInput("binding-summary").textContent = target
-    ? `${target.nativeTitle || target.shortId || "未命名会话"}\n${target.chatLabel || target.chatId} · ${target.projectAlias}\n会话 ${target.shortId || target.bindingId.slice(0, 8)}${target.topicId ? ` · 话题 ${target.topicId}` : ""}`
+    ? `${target.nativeTitle || target.shortId || "未命名会话"}\n${target.chatLabel || target.chatId} · ${target.projectAlias}\nNetizen 会话编号：${target.shortId || target.bindingId.slice(0, 8)}${target.topicId ? ` · 话题 ${target.topicId}` : ""}`
       + (target.pointerState !== "current" || target.catalogState === "archived" ? "\n目标当前不是可执行的当前会话，计划将自动暂停；不会自动切换或恢复会话。" : "")
     : selected ? `${editor.plan.target_label || selected}\n${editor.plan.chat?.chatLabel || editor.plan.chat_id} · ${editor.plan.project_alias}`
       : "请前往 Sessions 找到具体会话，再点击该行的“创建定时任务”。已填写内容会在当前页面保留。";
@@ -3927,7 +3923,10 @@ async function refresh(tab, cursor = undefined) {
     if (tab === "updates") await loadUpdates();
     if (tab === "schedules" && await loadSchedules(cursor) === false) return false;
     if (tab === "defaults") await loadDefaults();
-    if (tab === "system") await window.NetizenIdentity.loadUsers();
+    if (tab === "system") {
+      const results = await Promise.all([window.NetizenIdentity.loadUsers(), window.NetizenSessionAccess?.load()]);
+      if (results[1] === false) return false;
+    }
     if (state.authExpired) return false;
     if (isCurrentView()) setStatus("已更新。");
     return true;

{netizen_cli-0.11.4 → netizen_cli-0.12.0}/netizen_cli/admin/static/index.html

@@ -8,6 +8,7 @@
   <link rel="stylesheet" href="/static/chat-picker.css">
   <script src="/static/chat-picker.js" defer></script>
   <script src="/static/identity.js" defer></script>
+  <script src="/static/session-access.js" defer></script>
   <script src="/static/admin.js" defer></script>
 </head>
 <body>
@@ -389,6 +390,35 @@
           <div class="identity-panel-actions"><button id="admin-selector-retry" class="refresh" hidden>重试加载</button><button id="admin-selector-reload" class="refresh" hidden>重新加载页面</button><button id="admin-user-confirm" class="action" disabled>确认添加</button></div>
         </section>
         <ul id="admin-users" class="admin-users" aria-label="管理员名单"></ul>
+        <section class="session-access" aria-labelledby="session-access-heading">
+          <h3 id="session-access-heading">跨会话工具权限</h3>
+          <p class="defaults-help">仅控制 Agent 对本实例普通会话的跨会话访问。所有来源聊天共用规则，范围按目标聊天匹配，包含其中的主会话与话题。两组权限互不依赖。</p>
+          <form id="session-access-form" class="card-form">
+            <fieldset id="session-access-fields" disabled>
+              <div class="session-access-grid">
+                <section>
+                  <h4>发现</h4><p>允许列出、搜索会话标识及位置；不能单独授权读取消息正文。</p>
+                  <label>目标范围<select id="session-access-discovery-mode"><option value="all">全部</option><option value="only">仅指定聊天</option><option value="exclude">排除指定聊天（黑名单）</option><option value="disabled">关闭</option></select></label>
+                  <div id="session-access-discovery-targets" hidden>
+                    <div id="session-access-discovery-picker"></div>
+                    <label>聊天 ID，每行一个<textarea id="session-access-discovery-chats" rows="5" maxlength="257000" placeholder="oc_…" aria-describedby="session-access-chat-help"></textarea></label>
+                  </div>
+                </section>
+                <section>
+                  <h4>读取与发送</h4><p>允许读取、发送和等待结果；在当前聊天创建话题并启动任务也检查此范围。关闭发现后仍可凭完整 Codex 会话 ID 操作。</p>
+                  <label>目标范围<select id="session-access-readSend-mode"><option value="all">全部</option><option value="only">仅指定聊天</option><option value="exclude">排除指定聊天（黑名单）</option><option value="disabled">关闭</option></select></label>
+                  <div id="session-access-readSend-targets" hidden>
+                    <div id="session-access-readSend-picker"></div>
+                    <label>聊天 ID，每行一个<textarea id="session-access-readSend-chats" rows="5" maxlength="257000" placeholder="oc_…" aria-describedby="session-access-chat-help"></textarea></label>
+                  </div>
+                </section>
+              </div>
+              <p id="session-access-chat-help" class="defaults-field-help">可选择群聊加入名单，或填写聊天 ID（单聊也用聊天 ID，不是用户 ID）。聊天 ID 可在会话列表的“会话标识”中复制。名单为空时，“仅指定聊天”不允许任何目标，“排除指定聊天”允许全部目标。</p>
+            </fieldset>
+            <p id="session-access-note" class="defaults-field-help" role="status"></p>
+            <div class="actions"><button id="session-access-cancel" class="refresh" type="button" disabled>放弃修改</button><button id="session-access-save" class="action" type="submit" disabled>保存权限</button></div>
+          </form>
+        </section>
       </div>
     </section>
     <section id="updates" class="panel" aria-labelledby="updates-heading" hidden>

netizen_cli-0.12.0/netizen_cli/admin/static/session-access.js

@@ -0,0 +1,127 @@
+"use strict";
+
+window.NetizenSessionAccess = (() => {
+  const node = (id) => document.querySelector(`#session-access-${id}`);
+  const groups = ["discovery", "readSend"];
+  const pickers = new Map();
+  let snapshot = null;
+  let baseline = "";
+  let pending = false;
+  let expired = false;
+  let generation = 0;
+
+  function rule(group) {
+    const mode = node(`${group}-mode`).value;
+    return { mode, chatIds: ["only", "exclude"].includes(mode)
+      ? [...new Set(node(`${group}-chats`).value.split(/\s+/).filter(Boolean))].sort() : [] };
+  }
+
+  function definition() {
+    return Object.fromEntries(groups.map((group) => [group, rule(group)]));
+  }
+
+  function dirty() {
+    return Boolean(snapshot) && JSON.stringify(definition()) !== baseline;
+  }
+
+  function renderControls() {
+    node("fields").disabled = expired || pending || !snapshot;
+    for (const group of groups) {
+      const listed = ["only", "exclude"].includes(node(`${group}-mode`).value);
+      node(`${group}-targets`).hidden = !listed;
+      node(`${group}-chats`).disabled = expired || pending || !snapshot || !listed;
+      pickers.get(group)?.setDisabled(expired || pending || !snapshot || !listed);
+    }
+    node("save").disabled = expired || pending || !snapshot?.saveAction || !dirty();
+    node("cancel").disabled = expired || pending || !dirty();
+  }
+
+  function discard() {
+    generation += 1;
+    for (const group of groups) {
+      if (snapshot) {
+        node(`${group}-mode`).value = snapshot[group].mode;
+        node(`${group}-chats`).value = snapshot[group].chatIds.join("\n");
+      }
+      pickers.get(group)?.close();
+    }
+    baseline = JSON.stringify(definition());
+    renderControls();
+  }
+
+  function initializePickers() {
+    for (const group of groups) {
+      if (pickers.has(group)) continue;
+      pickers.set(group, window.createChatPicker(node(`${group}-picker`), {
+        id: `session-access-${group}-group`, label: "添加群聊", fetchPage: fetchChatPage,
+        onChange(chat) {
+          if (chat && !pending && !expired) {
+            generation += 1;
+            const ids = new Set(node(`${group}-chats`).value.split(/\s+/).filter(Boolean));
+            ids.add(chat.chatId);
+            node(`${group}-chats`).value = [...ids].join("\n");
+            pickers.get(group).reset();
+            renderControls();
+          }
+        },
+      }));
+    }
+  }
+
+  async function load() {
+    if (expired || pending || !confirmDiscardChanges(dirty())) return false;
+    initializePickers();
+    const version = ++generation;
+    const value = await api("/api/v1/session-tool-access");
+    // A late refresh must not overwrite edits made while the GET was pending.
+    if (expired || version !== generation) return false;
+    snapshot = value;
+    discard();
+    node("note").textContent = value.saveAction ? "保存后立即应用于新的工具访问。" : "实例配置不可编辑。";
+    return true;
+  }
+
+  async function save(event) {
+    event.preventDefault();
+    if (expired || pending || !snapshot?.saveAction || !dirty()) return;
+    const body = actionPayload(snapshot.saveAction, definition());
+    pending = true;
+    generation += 1;
+    renderControls();
+    try {
+      const value = await api("/api/v1/session-tool-access/save", {
+        method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
+      });
+      if (expired) return;
+      snapshot = value;
+      discard();
+      node("note").textContent = "跨会话工具权限已保存并生效。";
+      setStatus("跨会话工具权限已保存。");
+    } catch (error) {
+      if (!expired) {
+        // A consumed grant or unknown result is never silently replayed.
+        snapshot.saveAction = null;
+        node("note").textContent = "请刷新核对当前权限后再保存；本次修改未自动重试。";
+        setStatus(error.message, true);
+      }
+    } finally {
+      pending = false;
+      renderControls();
+    }
+  }
+
+  for (const group of groups) {
+    for (const field of ["mode", "chats"]) {
+      node(`${group}-${field}`).addEventListener(field === "mode" ? "change" : "input", () => {
+        generation += 1;
+        renderControls();
+      });
+    }
+  }
+  node("form").addEventListener("submit", save);
+  node("cancel").addEventListener("click", discard);
+  return {
+    load, dirty, discard, busy: () => pending,
+    expire() { expired = true; generation += 1; renderControls(); },
+  };
+})();