@modesto_ma/dsh-channels 0.3.0 → 0.5.0-beta.1

package/src/host/attachments.ts

@@ -0,0 +1,210 @@
+/**
+ * Host bridge, attachment surface: the minimal `ctx.attachments` face this
+ * plugin consumes (durable image/file storage) plus the content-block and
+ * prompt-part shapes it produces.
+ *
+ * Everything here is declared locally and structurally. The DSH attachment
+ * packages are never imported at runtime and are not runtime dependencies of
+ * this plugin, so these types mirror their published shapes by convention:
+ * only the members this plugin actually reads or calls are modeled, and every
+ * service lookup tolerates a deployment without the service. The exact
+ * upstream package (`@deepseek-ai/dsh-attachment`, DSH 0.2.1-rc.2) has more
+ * operations (batches, request projection, encoded uploads); add them here
+ * only when a task needs them.
+ *
+ * @module dsh-channels/host/attachments
+ */
+
+// ---- Durable attachment vocabulary --------------------------------------
+
+/** Opaque content-addressed attachment identifier (never a filesystem path). */
+export type AttachmentId = string
+
+/** Raster image formats accepted by the version-one attachment path. */
+export type ImageMediaType = 'image/png' | 'image/jpeg' | 'image/webp' | 'image/gif'
+
+/** Durable, serializable reference to one immutable normalized image. */
+export interface ImageAttachmentRef {
+  /** Opaque storage identifier; never a filesystem path or bearer URL. */
+  attachmentId: AttachmentId
+  /** Media type verified from the stored bytes. */
+  mediaType: ImageMediaType
+  /** Exact encoded byte length. */
+  bytes: number
+  /** Intrinsic encoded width in pixels. */
+  width: number
+  /** Intrinsic encoded height in pixels. */
+  height: number
+  /** Optional display name stripped of local path information. */
+  name?: string
+  /**
+   * Input dimensions after applying EXIF orientation and before normalization
+   * scaling. Present only when normalization reduced the image.
+   */
+  originalDimensions?: {
+    width: number
+    height: number
+  }
+}
+
+/**
+ * Durable, serializable reference to one verbatim stored file. Files are
+ * stored byte-for-byte with no normalization; `attachmentId` is the sha256
+ * digest of exactly those bytes.
+ */
+export interface FileAttachmentRef {
+  /** Opaque content-addressed storage identifier; never a filesystem path. */
+  attachmentId: AttachmentId
+  /** Sanitized display filename, also the stored object's leaf name. */
+  name: string
+  /** Exact byte length. */
+  bytes: number
+}
+
+/** Deployment-resolved image limits used by upload admission. */
+export interface ImageAttachmentLimits {
+  maxImageBytes: number
+  maxImagesPerMessage: number
+  maxMessageImageBytes: number
+  maxImagePixels: number
+  /** Maximum intrinsic width and maximum intrinsic height in pixels for one image. */
+  maxImageDimension: number
+  mediaTypes: readonly ImageMediaType[]
+}
+
+/** Request to validate and durably commit one image. */
+export interface SaveImageAttachment {
+  /** Encoded bytes, checked against the declared media type by the service. */
+  data: Uint8Array
+  /** Caller-declared media type, checked against fully decoded bytes. */
+  mediaType: ImageMediaType
+  /** Optional display name; never interpreted as a path. */
+  name?: string
+}
+
+/** Request to durably commit one file from bounded byte chunks. */
+export interface SaveFileStreamAttachment {
+  /** Exact file bytes in order; providers must not retain the whole sequence. */
+  data: AsyncIterable<Uint8Array>
+  /** Optional cancellation for source reads and storage writes. */
+  signal?: AbortSignal
+  /** Optional display name; never interpreted as a path. */
+  name?: string
+}
+
+/** One text/image part of host prompt content whose images still need admission. */
+export type PromptContentPart = {
+  readonly type: 'text'
+  readonly text: string
+} | {
+  readonly type: 'image'
+  readonly mediaType: ImageMediaType
+  readonly data: string
+  readonly name?: string
+}
+
+/** Host prompt content whose file receipts are resolved and whose image bytes await admission. */
+export type AttachmentAdmissionPart = PromptContentPart | {
+  readonly type: 'file'
+  readonly attachment: FileAttachmentRef
+}
+
+/** Host-admitted prompt content with every attachment represented by its durable reference. */
+export type AdmittedPromptContentPart = {
+  readonly type: 'text'
+  readonly text: string
+} | {
+  readonly type: 'image'
+  readonly attachment: ImageAttachmentRef
+} | {
+  readonly type: 'file'
+  readonly attachment: FileAttachmentRef
+}
+
+// ---- Content blocks -----------------------------------------------------
+
+/**
+ * A durable raster image reference as it appears in model content
+ * (`ImageBlock` in `@deepseek-ai/dsh-llm`). The block is role-neutral; this
+ * plugin only produces it for user content.
+ */
+export interface ImageBlock {
+  type: 'image'
+  /** Immutable bytes and intrinsic display metadata owned by the service. */
+  attachment: ImageAttachmentRef
+}
+
+/**
+ * A durable verbatim file reference as it appears in model content
+ * (`FileBlock` in `@deepseek-ai/dsh-llm`). Files never reach a provider as
+ * bytes: request assembly projects them to handle text, so a channel tool that
+ * cannot deliver this block must fall back to {@link formatFileHandle}-style
+ * text instead.
+ */
+export interface FileBlock {
+  type: 'file'
+  /** Immutable verbatim bytes and display metadata owned by the service. */
+  attachment: FileAttachmentRef
+}
+
+// ---- Failure vocabulary -------------------------------------------------
+
+/**
+ * Stable attachment failure codes the host routes on
+ * (`AttachmentErrorCode` in `@deepseek-ai/dsh-attachment`). Kept as a
+ * type-only union; the runtime classifier lives in the Feishu storage module.
+ */
+export type AttachmentErrorCode =
+  | 'TOO_MANY_IMAGES'
+  | 'IMAGES_TOO_LARGE'
+  | 'UNSUPPORTED_IMAGE_TYPE'
+  | 'INVALID_IMAGE_BASE64'
+  | 'INVALID_IMAGE'
+  | 'IMAGE_TYPE_MISMATCH'
+  | 'IMAGE_TOO_LARGE'
+  | 'IMAGE_TOO_MANY_PIXELS'
+  | 'IMAGE_DIMENSION_TOO_LARGE'
+  | 'INVALID_FILE_BASE64'
+  | 'INVALID_ATTACHMENT_REF'
+  | 'ATTACHMENT_CORRUPT'
+  | 'ATTACHMENT_WRITE_FAILED'
+  | 'ATTACHMENT_NOT_FOUND'
+  | 'ATTACHMENT_READ_FAILED'
+  | 'ATTACHMENT_PROJECTION_UNSUPPORTED'
+  | 'ATTACHMENT_FILES_UNSUPPORTED'
+
+// ---- Service surface ----------------------------------------------------
+
+/**
+ * The narrow `ctx.attachments` service face. Every method mirrors the
+ * upstream contract; callers must go through a module that tolerates absence
+ * (for example `src/feishu/native-attachments.ts`) rather than branching on
+ * this type themselves, so the degradation path exists in exactly one place.
+ */
+export interface AttachmentStore {
+  /** Deployment-resolved image policy; absent on minimal embedding hosts. */
+  readonly imageLimits?: ImageAttachmentLimits
+  /** Validate, normalize, and durably commit one image. */
+  saveImage(input: SaveImageAttachment): Promise<ImageAttachmentRef>
+  /** Durably commit one verbatim file from bounded chunks (backpressure, no full buffering). */
+  saveFileStream(input: SaveFileStreamAttachment): Promise<FileAttachmentRef>
+  /**
+   * Locate the verbatim stored file object in the harness host filesystem.
+   * @returns an absolute host path, or undefined when this backend is not
+   *   host-file-backed.
+   * @throws an attachment error when the durable reference is invalid.
+   */
+  fileHostPath(ref: FileAttachmentRef): string | undefined
+  /**
+   * Locate the provider-owned normalized image object in the harness host
+   * filesystem.
+   * @returns an absolute host path, or undefined when this backend is not
+   *   host-file-backed.
+   * @throws an attachment error when the durable reference is invalid.
+   */
+  imageHostPath(ref: ImageAttachmentRef): string | undefined
+  /** Replace every uploaded image in one host prompt with its durable reference. */
+  admitPromptContent(content: readonly AttachmentAdmissionPart[]): Promise<AdmittedPromptContentPart[]>
+  /** Optional host-provided classifier for attachment failures (cross-install safe). */
+  isAttachmentError?(error: unknown): boolean
+}

package/src/host/index.ts

@@ -7,6 +7,7 @@
 
 export * from './core.ts'
 export * from './agent.ts'
+export * from './attachments.ts'
 export * from './commands.ts'
 export * from './interaction.ts'
 export * from './services.ts'

package/src/index.ts

@@ -41,7 +41,7 @@ export type * from './questions.ts'
 export type * from './settings/contract.ts'
 export * from './access/index.ts'
 export type { AccessGroupRecord, AccessRequestRecord, AccessUserRecord } from './domain.ts'
-export { CATALOG_ROUTE, CLEANUP_ROUTE, CONFIG_ROUTE, CREDENTIALS_ROUTE, EDITABLE_KEYS, PANEL_COPY, PANEL_ROUTE, PICK_DIRECTORY_ROUTE, RECONNECT_ROUTE, RESTART_KEYS, STATUS_ROUTE } from './settings/contract.ts'
+export { CATALOG_ROUTE, CONFIG_ROUTE, CREDENTIALS_ROUTE, EDITABLE_KEYS, PANEL_COPY, PANEL_ROUTE, PICK_DIRECTORY_ROUTE, RECONNECT_ROUTE, RESTART_KEYS, STATUS_ROUTE } from './settings/contract.ts'
 export type { PickDirectoryResponse } from './settings/contract.ts'
 export { defaultOverlayPath, mergeOverlay, normalizeOverlay, OverlayStore, parseOverlay, pickEditable, resolveDshHome } from './settings/overlay.ts'
 export { applyCatalog, emptyCatalog, FIELD_DESCRIPTORS, normalizeCredentialValue, readOnlyFields, SettingsSurface, withDirectoryBrowse } from './settings/surface.ts'
@@ -63,7 +63,7 @@ export { createLogicalSessionExport, DSH_CHANNELS_VERSION, LOGICAL_EXPORT_FORMAT
 export { addUsage, applyProjectionViews, averageDecodeTokensPerSecond, averageTtftMs, cacheHitPct, EMPTY_TOTALS, foldAll, foldEvent, foldSessionStats, measureSessionContext, readProjectionViews, usageFromBuckets } from './stats.ts'
 export { FeishuService } from './service.ts'
 export { TurnStreamer } from './streamer.ts'
-export { ensureWorkspace, legacyTopicWorkspaceRoot, stagingPathFor, topicDirFor, topicTokenFor, workspacePathFor, workspaceTitleFor, worktreeBranchFor } from './workspaces.ts'
+export { ensureWorkspace, stagingPathFor, stagingRoot, topicDirFor, topicTokenFor, workspacePathFor, workspaceTitleFor, worktreeBranchFor } from './workspaces.ts'
 export { accessGroupRecordSchema, accessRequestRecordSchema, accessUserRecordSchema, appendSessionHistory, chatRouteKey, expiredRouteRecordSchema, feishuDomain, normalizeRouteRecord, normalizeSessionHistory, routeRecordSchema, sessionDirOf, sessionHistoryEntrySchema, inflightSnapshotSchema, processedRecordSchema } from './domain.ts'
 
 /** Cordis function-plugin name. */
@@ -105,9 +105,10 @@ export function apply(ctx: HostContext, config?: unknown): void {
   const resolved = resolveConfig(config)
   const factory: ChannelFactory = (config as FeishuPluginOptions | undefined)?.channelFactory
     ?? defaultChannelFactory
-  // Web settings overlay (optional file; degrades to "no overrides").
+  // Web settings overlay at `$DSH_HOME/dsh-channels/settings.json` (optional
+  // file; degrades to "no overrides").
   const overlay = new OverlayStore(
-    resolved.settingsFile ?? defaultOverlayPath(),
+    defaultOverlayPath(),
     { warn: (message, ...args) => ctx.logger?.warn?.(message, ...args) },
   )
   const service = new FeishuService(ctx, resolved, factory, undefined, overlay)

package/src/interactions/approvals.ts

@@ -4,8 +4,16 @@
  *
  * The answerer is registered with `prepend: true` on the plugin context so it
  * runs BEFORE generic answerers: a request for a session this channel routes
- * is claimed here, and the decision card becomes the only way to answer.
- * Requests for sessions the channel does NOT route delegate through `next()`.
+ * is claimed here, and the decision card (or a typed topic reply) becomes the
+ * only way to answer. Requests for sessions the channel does NOT route
+ * delegate through `next()`.
+ *
+ * The host request carries no tool arguments, so the answerer keeps the
+ * current turn's `tool/call` arguments per session (fed from `session/event`)
+ * and looks the asked call up by `callId` to show what will run. Standing
+ * "stop asking in this topic" grants live only in memory, keyed by session,
+ * tool name, and requested sandbox mode; they end with the session (`/renew`),
+ * the topic, or the process.
  *
  * Rendering lives in `cards/approval.ts`; the shared pending-card lifecycle
  * (delivery, owner gating, timeout, settle-once, withdrawal) lives in
@@ -17,7 +25,7 @@
 import { randomUUID } from 'node:crypto'
 import { buildApprovalCard, buildApprovalSettledCard } from '../cards/approval.ts'
 import type { ApprovalCardState, ApprovalQuestion } from '../cards/approval.ts'
-import type { ApprovalOutcome, ApprovalRequest } from '../dsh-types.ts'
+import type { ApprovalOutcome, ApprovalRequest, SessionEvent } from '../dsh-types.ts'
 import type { CardActionEvent, FeishuChannel } from '../feishu-channel.ts'
 import { PendingCardTable } from './pending.ts'
 import type { InteractionRoute, PendingCardEntry } from './pending.ts'
@@ -33,16 +41,87 @@ export interface ApprovalHooks {
   routeFor(sessionId: string): ApprovalRoute | undefined
   /** Log a non-fatal error (delivery/update failures). */
   onError(sessionId: string, error: unknown): void
+  /**
+   * The tool names a session is currently waiting on for approval (empty when
+   * none), called on every open and settle so the streaming card can show it.
+   */
+  onWaitingChange?(sessionId: string, toolNames: readonly string[]): void
 }
 
+/**
+ * How one typed topic reply was consumed by {@link ApprovalAnswerer.submitText}:
+ * a keyword decision (`allowed`, `remembered`, `denied`), or any other text
+ * that rejected every pending request of the session (`superseded`) and must
+ * still be delivered as the next instruction.
+ */
+export type ApprovalTextResult = 'allowed' | 'remembered' | 'denied' | 'superseded'
+
 /** One in-flight approval question: its card content and its resolver. */
 interface Pending extends PendingCardEntry {
   question: ApprovalQuestion
+  /** Standing-grant key for "stop asking in this topic". */
+  grantKey: string
+  /** Open order, so a typed reply answers the newest card. */
+  openedAt: number
   resolve(outcome: ApprovalOutcome): void
 }
 
+/** One recorded `tool/call` of a session's current turn. */
+interface RecordedCall {
+  turn: number
+  name: string
+  arguments: string
+}
+
+const ALLOW_WORDS = new Set(['允许', '同意', '可以', '好', '好的', '行', '确认', 'y', 'yes', 'ok', 'allow', 'approve'])
+const DENY_WORDS = new Set(['拒绝', '不允许', '不行', '不', '否', '不同意', 'n', 'no', 'deny', 'reject'])
+const ALWAYS_WORDS = new Set(['全部允许', '都允许', '允许所有', '允许全部', '总是允许', '始终允许', 'allow all', 'always'])
+
+/**
+ * Classify one typed reply. Trailing punctuation and case are ignored; the
+ * whole message must be the keyword so ordinary sentences never match.
+ * @param text - the reply text with mentions already stripped.
+ * @returns The keyword decision, or `undefined` for any other text.
+ */
+export function classifyApprovalReply(text: string): 'allow' | 'always' | 'deny' | undefined {
+  const word = text.trim().toLowerCase().replace(/[\s。.!！~～]+$/u, '')
+  if (ALWAYS_WORDS.has(word)) return 'always'
+  if (ALLOW_WORDS.has(word)) return 'allow'
+  if (DENY_WORDS.has(word)) return 'deny'
+  return undefined
+}
+
+/**
+ * Read what a call will run and the sandbox mode it asks for. `bash` shows
+ * its `command`; other tools show their raw arguments. Arguments are
+ * model-produced JSON, so a parse failure shows the raw text.
+ */
+function describeCall(call: RecordedCall | undefined): { command?: string; escalateTo?: string } {
+  if (call === undefined) return {}
+  let args: Record<string, unknown> | undefined
+  try {
+    const parsed: unknown = JSON.parse(call.arguments)
+    if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) args = parsed as Record<string, unknown>
+  } catch {
+    // Unparseable arguments: shown verbatim below.
+  }
+  if (args === undefined) return call.arguments === '' ? {} : { command: call.arguments }
+  const escalateTo = typeof args.sandbox_permissions === 'string' && args.sandbox_permissions !== ''
+    ? args.sandbox_permissions
+    : undefined
+  const command = typeof args.command === 'string' && args.command !== ''
+    ? args.command
+    : JSON.stringify(args, null, 2)
+  return { command, ...(escalateTo === undefined ? {} : { escalateTo }) }
+}
+
 export class ApprovalAnswerer {
   private readonly table: PendingCardTable<Pending>
+  /** sessionId → callId → the current turn's recorded tool calls. */
+  private readonly calls = new Map<string, Map<string, RecordedCall>>()
+  /** sessionId → standing "stop asking in this topic" grant keys. */
+  private readonly grants = new Map<string, Set<string>>()
+  private opened = 0
 
   constructor(
     channel: FeishuChannel,
@@ -57,18 +136,52 @@ export class ApprovalAnswerer {
     return this.table.count()
   }
 
+  /** Whether a session currently has an undecided approval card. */
+  hasPendingFor(sessionId: string): boolean {
+    return this.pendingOf(sessionId).length > 0
+  }
+
+  /**
+   * Track the current turn's tool calls so a later approval can show what it
+   * approves. Only `tool/call` and `turn/end` are read; nothing earlier than
+   * the current turn is kept.
+   */
+  onSessionEvent(sessionId: string, event: SessionEvent): void {
+    if (event.type === 'tool/call') {
+      let calls = this.calls.get(sessionId)
+      if (calls === undefined) {
+        calls = new Map()
+        this.calls.set(sessionId, calls)
+      }
+      calls.set(event.data.callId, { turn: event.data.turn, name: event.data.name, arguments: event.data.arguments })
+    } else if (event.type === 'turn/end') {
+      const calls = this.calls.get(sessionId)
+      if (calls === undefined) return
+      for (const [callId, call] of calls) {
+        if (call.turn <= event.data.turn) calls.delete(callId)
+      }
+      if (calls.size === 0) this.calls.delete(sessionId)
+    }
+  }
+
   /**
    * The `approval/request` waterfall listener. Never rejects: the host service
    * already contains answerer failures to the fail-closed `'unavailable'`.
    */
   onRequest(req: ApprovalRequest, next: () => Promise<ApprovalOutcome>): Promise<ApprovalOutcome> {
-    const route = this.hooks.routeFor(req.agent.session.id)
+    const sessionId = req.agent.session.id
+    const route = this.hooks.routeFor(sessionId)
     if (route === undefined) return next()
     // The abort window between the service's own signal check and this
     // listener is closed by settling synchronously: an aborted ask never
     // opens a question.
     if (req.signal?.aborted === true) return Promise.resolve('cancelled')
 
+    const call = req.callId === undefined ? undefined : this.calls.get(sessionId)?.get(req.callId)
+    const described = describeCall(call)
+    const grantKey = `${req.toolName}\u0000${described.escalateTo ?? ''}`
+    if (this.grants.get(sessionId)?.has(grantKey) === true) return Promise.resolve('allowed-once')
+
     const token = randomUUID()
     // `displayReason` (DSH 0.2.0) is presentation-only and locale-aware;
     // `reason` remains the audit-trail fallback.
@@ -77,13 +190,14 @@ export class ApprovalAnswerer {
       token,
       toolName: req.toolName,
       ...(displayReason === undefined ? {} : { reason: displayReason }),
+      ...described,
       timeoutMs: this.timeoutMs,
-      sessionId: req.agent.session.id,
+      sessionId,
     }
     return new Promise<ApprovalOutcome>((resolve) => {
       const entry: Pending = {
         token,
-        sessionId: req.agent.session.id,
+        sessionId,
         route,
         messageId: undefined,
         settled: false,
@@ -92,6 +206,8 @@ export class ApprovalAnswerer {
         onAbort: undefined,
         unauthorizedNoted: false,
         question,
+        grantKey,
+        openedAt: ++this.opened,
         resolve,
       }
       const onAbort = (): void => {
@@ -105,6 +221,7 @@ export class ApprovalAnswerer {
       // discards a late resolution (worst case: the card times out).
       req.signal?.addEventListener('abort', onAbort, { once: true })
       this.table.add(entry)
+      this.notifyWaiting(sessionId)
       void this.table.deliver(entry, {
         card: buildApprovalCard(question),
         onWithdrawn: e => this.table.patch(e, buildApprovalSettledCard(e.question, 'cancelled')),
@@ -114,6 +231,7 @@ export class ApprovalAnswerer {
         // No card → no human answerer → fail closed.
         onFailure: e => {
           this.table.close(e, () => {})
+          this.notifyWaiting(e.sessionId)
           e.resolve('unavailable')
         },
       })
@@ -134,12 +252,72 @@ export class ApprovalAnswerer {
     if (entry === undefined) return
     const decision = (event.action.value as { decision?: unknown } | undefined)?.decision
     if (decision === 'allow') this.settle(entry, 'allowed-once', 'allowed')
+    else if (decision === 'always') this.remember(entry)
     else if (decision === 'deny') this.settle(entry, 'rejected', 'denied')
   }
 
+  /**
+   * Answer a session's pending approvals with one typed topic reply. The
+   * caller has already checked that the sender owns the topic. A keyword
+   * decides the newest card; any other text rejects every pending card of the
+   * session and is reported as `superseded` so the caller still delivers it.
+   * @param sessionId - the session the reply was routed to.
+   * @param text - the reply text.
+   * @returns How the reply was consumed, or `undefined` when nothing is pending.
+   */
+  submitText(sessionId: string, text: string): ApprovalTextResult | undefined {
+    const pending = this.pendingOf(sessionId)
+    const newest = pending.at(-1)
+    if (newest === undefined) return undefined
+    switch (classifyApprovalReply(text)) {
+      case 'allow':
+        this.settle(newest, 'allowed-once', 'allowed-text')
+        return 'allowed'
+      case 'always':
+        this.remember(newest)
+        return 'remembered'
+      case 'deny':
+        this.settle(newest, 'rejected', 'denied-text')
+        return 'denied'
+      case undefined:
+        for (const entry of pending) this.settle(entry, 'rejected', 'superseded')
+        return 'superseded'
+    }
+  }
+
   /** Withdraw every in-flight question (plugin shutdown). */
   dispose(): void {
     this.table.withdrawAll(entry => this.settle(entry, 'cancelled'))
+    this.calls.clear()
+    this.grants.clear()
+  }
+
+  /** Undecided entries of one session, oldest first. */
+  private pendingOf(sessionId: string): Pending[] {
+    return [...this.table.values()]
+      .filter(entry => entry.sessionId === sessionId && !entry.settled)
+      .sort((left, right) => left.openedAt - right.openedAt)
+  }
+
+  /**
+   * Record a standing grant for the entry's tool + mode, allow it, and allow
+   * every other pending card of the session the grant now covers.
+   */
+  private remember(entry: Pending): void {
+    let grants = this.grants.get(entry.sessionId)
+    if (grants === undefined) {
+      grants = new Set()
+      this.grants.set(entry.sessionId, grants)
+    }
+    grants.add(entry.grantKey)
+    for (const candidate of this.pendingOf(entry.sessionId)) {
+      if (candidate.grantKey === entry.grantKey) this.settle(candidate, 'allowed-once', 'remembered')
+    }
+  }
+
+  /** Report the session's remaining waits to the streaming card. */
+  private notifyWaiting(sessionId: string): void {
+    this.hooks.onWaitingChange?.(sessionId, this.pendingOf(sessionId).map(entry => entry.question.toolName))
   }
 
   /** Settle once, then patch the card to its terminal state. */
@@ -149,6 +327,8 @@ export class ApprovalAnswerer {
         this.table.patch(entry, buildApprovalSettledCard(entry.question, cardState))
       }
     })
-    if (closed) entry.resolve(outcome)
+    if (!closed) return
+    this.notifyWaiting(entry.sessionId)
+    entry.resolve(outcome)
   }
 }

package/src/interactions/pending.ts

@@ -20,8 +20,8 @@ export interface InteractionRoute {
   cardMessageId: string
   /** Whether the anchor lives in a real topic (replyInThread). */
   inThread: boolean
-  /** The session owner (open_id) — the only operator allowed to decide. */
-  senderOpenId: string
+  /** The session owner (user_id) — the only operator allowed to decide. */
+  senderUserId: string
 }
 
 /** Fields every pending interaction card carries. */
@@ -96,7 +96,7 @@ export class PendingCardTable<E extends PendingCardEntry> {
       }
     }
     if (entry === undefined || entry.settled) return undefined
-    if (event.operator.openId !== entry.route.senderOpenId) {
+    if (event.operator.userId !== entry.route.senderUserId) {
       onUnauthorized(entry)
       return undefined
     }