@modesto_ma/dsh-channels 0.4.0 → 0.5.0-beta.1

package/src/interactions/approvals.ts

@@ -4,8 +4,16 @@
  *
  * The answerer is registered with `prepend: true` on the plugin context so it
  * runs BEFORE generic answerers: a request for a session this channel routes
- * is claimed here, and the decision card becomes the only way to answer.
- * Requests for sessions the channel does NOT route delegate through `next()`.
+ * is claimed here, and the decision card (or a typed topic reply) becomes the
+ * only way to answer. Requests for sessions the channel does NOT route
+ * delegate through `next()`.
+ *
+ * The host request carries no tool arguments, so the answerer keeps the
+ * current turn's `tool/call` arguments per session (fed from `session/event`)
+ * and looks the asked call up by `callId` to show what will run. Standing
+ * "stop asking in this topic" grants live only in memory, keyed by session,
+ * tool name, and requested sandbox mode; they end with the session (`/renew`),
+ * the topic, or the process.
  *
  * Rendering lives in `cards/approval.ts`; the shared pending-card lifecycle
  * (delivery, owner gating, timeout, settle-once, withdrawal) lives in
@@ -17,7 +25,7 @@
 import { randomUUID } from 'node:crypto'
 import { buildApprovalCard, buildApprovalSettledCard } from '../cards/approval.ts'
 import type { ApprovalCardState, ApprovalQuestion } from '../cards/approval.ts'
-import type { ApprovalOutcome, ApprovalRequest } from '../dsh-types.ts'
+import type { ApprovalOutcome, ApprovalRequest, SessionEvent } from '../dsh-types.ts'
 import type { CardActionEvent, FeishuChannel } from '../feishu-channel.ts'
 import { PendingCardTable } from './pending.ts'
 import type { InteractionRoute, PendingCardEntry } from './pending.ts'
@@ -33,16 +41,87 @@ export interface ApprovalHooks {
   routeFor(sessionId: string): ApprovalRoute | undefined
   /** Log a non-fatal error (delivery/update failures). */
   onError(sessionId: string, error: unknown): void
+  /**
+   * The tool names a session is currently waiting on for approval (empty when
+   * none), called on every open and settle so the streaming card can show it.
+   */
+  onWaitingChange?(sessionId: string, toolNames: readonly string[]): void
 }
 
+/**
+ * How one typed topic reply was consumed by {@link ApprovalAnswerer.submitText}:
+ * a keyword decision (`allowed`, `remembered`, `denied`), or any other text
+ * that rejected every pending request of the session (`superseded`) and must
+ * still be delivered as the next instruction.
+ */
+export type ApprovalTextResult = 'allowed' | 'remembered' | 'denied' | 'superseded'
+
 /** One in-flight approval question: its card content and its resolver. */
 interface Pending extends PendingCardEntry {
   question: ApprovalQuestion
+  /** Standing-grant key for "stop asking in this topic". */
+  grantKey: string
+  /** Open order, so a typed reply answers the newest card. */
+  openedAt: number
   resolve(outcome: ApprovalOutcome): void
 }
 
+/** One recorded `tool/call` of a session's current turn. */
+interface RecordedCall {
+  turn: number
+  name: string
+  arguments: string
+}
+
+const ALLOW_WORDS = new Set(['允许', '同意', '可以', '好', '好的', '行', '确认', 'y', 'yes', 'ok', 'allow', 'approve'])
+const DENY_WORDS = new Set(['拒绝', '不允许', '不行', '不', '否', '不同意', 'n', 'no', 'deny', 'reject'])
+const ALWAYS_WORDS = new Set(['全部允许', '都允许', '允许所有', '允许全部', '总是允许', '始终允许', 'allow all', 'always'])
+
+/**
+ * Classify one typed reply. Trailing punctuation and case are ignored; the
+ * whole message must be the keyword so ordinary sentences never match.
+ * @param text - the reply text with mentions already stripped.
+ * @returns The keyword decision, or `undefined` for any other text.
+ */
+export function classifyApprovalReply(text: string): 'allow' | 'always' | 'deny' | undefined {
+  const word = text.trim().toLowerCase().replace(/[\s。.!！~～]+$/u, '')
+  if (ALWAYS_WORDS.has(word)) return 'always'
+  if (ALLOW_WORDS.has(word)) return 'allow'
+  if (DENY_WORDS.has(word)) return 'deny'
+  return undefined
+}
+
+/**
+ * Read what a call will run and the sandbox mode it asks for. `bash` shows
+ * its `command`; other tools show their raw arguments. Arguments are
+ * model-produced JSON, so a parse failure shows the raw text.
+ */
+function describeCall(call: RecordedCall | undefined): { command?: string; escalateTo?: string } {
+  if (call === undefined) return {}
+  let args: Record<string, unknown> | undefined
+  try {
+    const parsed: unknown = JSON.parse(call.arguments)
+    if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) args = parsed as Record<string, unknown>
+  } catch {
+    // Unparseable arguments: shown verbatim below.
+  }
+  if (args === undefined) return call.arguments === '' ? {} : { command: call.arguments }
+  const escalateTo = typeof args.sandbox_permissions === 'string' && args.sandbox_permissions !== ''
+    ? args.sandbox_permissions
+    : undefined
+  const command = typeof args.command === 'string' && args.command !== ''
+    ? args.command
+    : JSON.stringify(args, null, 2)
+  return { command, ...(escalateTo === undefined ? {} : { escalateTo }) }
+}
+
 export class ApprovalAnswerer {
   private readonly table: PendingCardTable<Pending>
+  /** sessionId → callId → the current turn's recorded tool calls. */
+  private readonly calls = new Map<string, Map<string, RecordedCall>>()
+  /** sessionId → standing "stop asking in this topic" grant keys. */
+  private readonly grants = new Map<string, Set<string>>()
+  private opened = 0
 
   constructor(
     channel: FeishuChannel,
@@ -57,18 +136,52 @@ export class ApprovalAnswerer {
     return this.table.count()
   }
 
+  /** Whether a session currently has an undecided approval card. */
+  hasPendingFor(sessionId: string): boolean {
+    return this.pendingOf(sessionId).length > 0
+  }
+
+  /**
+   * Track the current turn's tool calls so a later approval can show what it
+   * approves. Only `tool/call` and `turn/end` are read; nothing earlier than
+   * the current turn is kept.
+   */
+  onSessionEvent(sessionId: string, event: SessionEvent): void {
+    if (event.type === 'tool/call') {
+      let calls = this.calls.get(sessionId)
+      if (calls === undefined) {
+        calls = new Map()
+        this.calls.set(sessionId, calls)
+      }
+      calls.set(event.data.callId, { turn: event.data.turn, name: event.data.name, arguments: event.data.arguments })
+    } else if (event.type === 'turn/end') {
+      const calls = this.calls.get(sessionId)
+      if (calls === undefined) return
+      for (const [callId, call] of calls) {
+        if (call.turn <= event.data.turn) calls.delete(callId)
+      }
+      if (calls.size === 0) this.calls.delete(sessionId)
+    }
+  }
+
   /**
    * The `approval/request` waterfall listener. Never rejects: the host service
    * already contains answerer failures to the fail-closed `'unavailable'`.
    */
   onRequest(req: ApprovalRequest, next: () => Promise<ApprovalOutcome>): Promise<ApprovalOutcome> {
-    const route = this.hooks.routeFor(req.agent.session.id)
+    const sessionId = req.agent.session.id
+    const route = this.hooks.routeFor(sessionId)
     if (route === undefined) return next()
     // The abort window between the service's own signal check and this
     // listener is closed by settling synchronously: an aborted ask never
     // opens a question.
     if (req.signal?.aborted === true) return Promise.resolve('cancelled')
 
+    const call = req.callId === undefined ? undefined : this.calls.get(sessionId)?.get(req.callId)
+    const described = describeCall(call)
+    const grantKey = `${req.toolName}\u0000${described.escalateTo ?? ''}`
+    if (this.grants.get(sessionId)?.has(grantKey) === true) return Promise.resolve('allowed-once')
+
     const token = randomUUID()
     // `displayReason` (DSH 0.2.0) is presentation-only and locale-aware;
     // `reason` remains the audit-trail fallback.
@@ -77,13 +190,14 @@ export class ApprovalAnswerer {
       token,
       toolName: req.toolName,
       ...(displayReason === undefined ? {} : { reason: displayReason }),
+      ...described,
       timeoutMs: this.timeoutMs,
-      sessionId: req.agent.session.id,
+      sessionId,
     }
     return new Promise<ApprovalOutcome>((resolve) => {
       const entry: Pending = {
         token,
-        sessionId: req.agent.session.id,
+        sessionId,
         route,
         messageId: undefined,
         settled: false,
@@ -92,6 +206,8 @@ export class ApprovalAnswerer {
         onAbort: undefined,
         unauthorizedNoted: false,
         question,
+        grantKey,
+        openedAt: ++this.opened,
         resolve,
       }
       const onAbort = (): void => {
@@ -105,6 +221,7 @@ export class ApprovalAnswerer {
       // discards a late resolution (worst case: the card times out).
       req.signal?.addEventListener('abort', onAbort, { once: true })
       this.table.add(entry)
+      this.notifyWaiting(sessionId)
       void this.table.deliver(entry, {
         card: buildApprovalCard(question),
         onWithdrawn: e => this.table.patch(e, buildApprovalSettledCard(e.question, 'cancelled')),
@@ -114,6 +231,7 @@ export class ApprovalAnswerer {
         // No card → no human answerer → fail closed.
         onFailure: e => {
           this.table.close(e, () => {})
+          this.notifyWaiting(e.sessionId)
           e.resolve('unavailable')
         },
       })
@@ -134,12 +252,72 @@ export class ApprovalAnswerer {
     if (entry === undefined) return
     const decision = (event.action.value as { decision?: unknown } | undefined)?.decision
     if (decision === 'allow') this.settle(entry, 'allowed-once', 'allowed')
+    else if (decision === 'always') this.remember(entry)
     else if (decision === 'deny') this.settle(entry, 'rejected', 'denied')
   }
 
+  /**
+   * Answer a session's pending approvals with one typed topic reply. The
+   * caller has already checked that the sender owns the topic. A keyword
+   * decides the newest card; any other text rejects every pending card of the
+   * session and is reported as `superseded` so the caller still delivers it.
+   * @param sessionId - the session the reply was routed to.
+   * @param text - the reply text.
+   * @returns How the reply was consumed, or `undefined` when nothing is pending.
+   */
+  submitText(sessionId: string, text: string): ApprovalTextResult | undefined {
+    const pending = this.pendingOf(sessionId)
+    const newest = pending.at(-1)
+    if (newest === undefined) return undefined
+    switch (classifyApprovalReply(text)) {
+      case 'allow':
+        this.settle(newest, 'allowed-once', 'allowed-text')
+        return 'allowed'
+      case 'always':
+        this.remember(newest)
+        return 'remembered'
+      case 'deny':
+        this.settle(newest, 'rejected', 'denied-text')
+        return 'denied'
+      case undefined:
+        for (const entry of pending) this.settle(entry, 'rejected', 'superseded')
+        return 'superseded'
+    }
+  }
+
   /** Withdraw every in-flight question (plugin shutdown). */
   dispose(): void {
     this.table.withdrawAll(entry => this.settle(entry, 'cancelled'))
+    this.calls.clear()
+    this.grants.clear()
+  }
+
+  /** Undecided entries of one session, oldest first. */
+  private pendingOf(sessionId: string): Pending[] {
+    return [...this.table.values()]
+      .filter(entry => entry.sessionId === sessionId && !entry.settled)
+      .sort((left, right) => left.openedAt - right.openedAt)
+  }
+
+  /**
+   * Record a standing grant for the entry's tool + mode, allow it, and allow
+   * every other pending card of the session the grant now covers.
+   */
+  private remember(entry: Pending): void {
+    let grants = this.grants.get(entry.sessionId)
+    if (grants === undefined) {
+      grants = new Set()
+      this.grants.set(entry.sessionId, grants)
+    }
+    grants.add(entry.grantKey)
+    for (const candidate of this.pendingOf(entry.sessionId)) {
+      if (candidate.grantKey === entry.grantKey) this.settle(candidate, 'allowed-once', 'remembered')
+    }
+  }
+
+  /** Report the session's remaining waits to the streaming card. */
+  private notifyWaiting(sessionId: string): void {
+    this.hooks.onWaitingChange?.(sessionId, this.pendingOf(sessionId).map(entry => entry.question.toolName))
   }
 
   /** Settle once, then patch the card to its terminal state. */
@@ -149,6 +327,8 @@ export class ApprovalAnswerer {
         this.table.patch(entry, buildApprovalSettledCard(entry.question, cardState))
       }
     })
-    if (closed) entry.resolve(outcome)
+    if (!closed) return
+    this.notifyWaiting(entry.sessionId)
+    entry.resolve(outcome)
   }
 }

package/src/interactions/pending.ts

@@ -20,8 +20,8 @@ export interface InteractionRoute {
   cardMessageId: string
   /** Whether the anchor lives in a real topic (replyInThread). */
   inThread: boolean
-  /** The session owner (open_id) — the only operator allowed to decide. */
-  senderOpenId: string
+  /** The session owner (user_id) — the only operator allowed to decide. */
+  senderUserId: string
 }
 
 /** Fields every pending interaction card carries. */
@@ -96,7 +96,7 @@ export class PendingCardTable<E extends PendingCardEntry> {
       }
     }
     if (entry === undefined || entry.settled) return undefined
-    if (event.operator.openId !== entry.route.senderOpenId) {
+    if (event.operator.userId !== entry.route.senderUserId) {
       onUnauthorized(entry)
       return undefined
     }

package/src/routing/inbound.ts

@@ -17,7 +17,7 @@ import type { AttachmentStoreMode, FeishuConfig } from '../config.ts'
 import { buildCard, buildOnboardingCard, initialStreamingCard } from '../cards.ts'
 import { RouteOperationQueue } from '../commands.ts'
 import { chatRouteKey, sessionDirOf } from '../domain.ts'
-import type { FeishuDomainHandle, PendingAttachmentRecord, RouteRecord } from '../domain.ts'
+import type { FeishuDomainHandle, RouteRecord } from '../domain.ts'
 import type { CardDelivery } from '../feishu/delivery.ts'
 import {
   adoptStagedAttachments, attachmentsDir, attachmentResources, hasAttachmentPayload,
@@ -31,10 +31,10 @@ import {
   InboundAttachmentStore, NativeAttachmentStore, effectiveAttachmentMode,
 } from '../feishu/native-attachments.ts'
 import type { InboundAttachmentStoreResult } from '../feishu/native-attachments.ts'
-import type { PendingAttachmentScope, PendingAttachmentStore } from '../feishu/pending-attachments.ts'
 import type { KnownAttachmentMessageInput, KnownAttachmentSource } from '../feishu/tools.ts'
 import type { FeishuChannel, NormalizedMessage } from '../feishu-channel.ts'
 import type { QuestionAnswerer } from '../interactions/questions.ts'
+import type { ApprovalAnswerer, ApprovalTextResult } from '../interactions/approvals.ts'
 import type { InflightRepair } from '../session/repair.ts'
 import type { SessionManager } from '../session/manager.ts'
 import type { RouteStore } from '../session/routes.ts'
@@ -120,12 +120,10 @@ export interface InboundDeps {
   nativeAttachments(): AttachmentStore | undefined
   /** Backend-selecting archive/fallback store (legacy workspace download). */
   attachmentStore: InboundAttachmentStore
-  /** Durable metadata registry for silently registered attachments. */
-  pendingAttachments: PendingAttachmentStore
   /**
    * Pre-authorize a message's attachments for `feishu_attachment_fetch`:
-   * `trigger` (the triggering message) by default, `quote`/`history` for the
-   * messages this turn's excerpt/history blocks name.
+   * `trigger` (the triggering message) by default, `quote`/`history`/`recent`
+   * for the messages this turn's excerpt, history and manifest blocks name.
    */
   noteKnownAttachments(
     record: RouteRecord,
@@ -133,9 +131,9 @@ export interface InboundDeps {
     source?: KnownAttachmentSource,
   ): void
   /**
-   * Read-only message access: quoted-message excerpt and first-turn topic
-   * history. Failures degrade silently to a `undefined` value (never a throw
-   * into the turn).
+   * Read-only message access: quoted-message excerpt, first-turn topic
+   * history, and recent attachment messages. Failures degrade silently to an
+   * absent value (never a throw into the turn).
    */
   messageRead: InboundMessageReadPort
   /** Live image-prefetch policy for triggering messages. */
@@ -146,9 +144,17 @@ export interface InboundDeps {
   queue: RouteOperationQueue
   streamer(): TurnStreamer | undefined
   questionAnswerer(): QuestionAnswerer | undefined
+  approvalAnswerer(): ApprovalAnswerer | undefined
   commands: CommandPlanePort
 }
 
+/** Confirmation line for each keyword approval reply. */
+const APPROVAL_TEXT_REPLIES: Record<Exclude<ApprovalTextResult, 'superseded'>, string> = {
+  allowed: '已允许本次操作。',
+  remembered: '已允许，本话题内同类操作不再询问。',
+  denied: '已拒绝本次操作。',
+}
+
 /**
  * User-facing text for attachments that could not be archived. Delivered as a
  * plain reply (never a card) so the user learns why the Agent cannot read a
@@ -194,7 +200,7 @@ export function knownAttachmentMessageOf(msg: NormalizedMessage): KnownAttachmen
     messageId: msg.messageId,
     kind: forwarded ? 'merge_forward' : 'message',
     resources,
-    senderOpenId: msg.senderId,
+    senderUserId: msg.senderId,
   }
 }
 
@@ -211,11 +217,14 @@ interface TurnReadContext {
   historyBlock?: string
 }
 
-/** First-turn-only inputs of the prompt assembly. */
+/** Per-turn inputs of the prompt assembly. */
 interface TurnDeliveryOptions {
   /** New Session's first turn: attach the bounded topic history bootstrap. */
   firstTurn?: boolean
-  /** Message ids never shown in the history block (trigger + streaming card). */
+  /**
+   * Message ids never shown in the history block or listed as recent
+   * attachments (trigger + streaming card).
+   */
   excludeMessageIds?: readonly string[]
 }
 
@@ -253,10 +262,10 @@ export class InboundRouter {
   private get delivery(): CardDelivery { return this.deps.delivery }
   private get sessions(): SessionManager { return this.deps.sessions }
   private get attachmentStore(): InboundAttachmentStore { return this.deps.attachmentStore }
-  private get pendingAttachments(): PendingAttachmentStore { return this.deps.pendingAttachments }
   private get routeOperations(): RouteOperationQueue { return this.deps.queue }
   private get streamer(): TurnStreamer | undefined { return this.deps.streamer() }
   private get questionAnswerer(): QuestionAnswerer | undefined { return this.deps.questionAnswerer() }
+  private get approvalAnswerer(): ApprovalAnswerer | undefined { return this.deps.approvalAnswerer() }
   private get domain(): FeishuDomainHandle | undefined { return this.deps.domain() }
   private get access(): InboundAccessPort { return this.deps.access }
 
@@ -322,8 +331,6 @@ export class InboundRouter {
 
   /** Entry point: one normalized inbound message. */
   async handle(msg: NormalizedMessage): Promise<void> {
-    const botId = this.delivery.requireChannel().botOpenId()
-    if (botId !== undefined && msg.senderId === botId) return
     if (msg.chatType !== 'p2p' && msg.chatType !== 'group') return
     let content = (msg.content ?? '').trim()
     if (content === '') return
@@ -399,24 +406,26 @@ export class InboundRouter {
       }
     } else {
       // Native pipeline: classify without downloading. Attachment-only
-      // messages and messages that cannot start a turn are silently registered
-      // (no reply, no reaction, no Session); a mixed caption becomes the prompt
-      // with its placeholders stripped.
+      // messages and messages that cannot start a turn stay inert (no reply,
+      // no reaction, no Session); a mixed caption becomes the prompt with its
+      // placeholders stripped.
       const state = inboundAttachmentState(msg)
       if (state.hasPayload) {
-        const resolution = await this.resolveNativeAttachmentMessage(msg, state)
+        const resolution = this.resolveNativeAttachmentMessage(msg, state)
         if (resolution.kind === 'silent') return
         content = resolution.text
         if (content === '') return
       }
     }
 
+    // A session blocked on an approval card reads the owner's reply as the
+    // decision; any other text rejects the card and continues below as the
+    // next instruction.
+    if (await this.tryAnswerPendingApproval(msg, content)) return
+
     // A session blocked on `ask_user_question` has no other use for an inbound
     // text message: the next reply becomes the free-text answer.
-    if (await this.tryAnswerPendingQuestion(msg, content)) {
-      await this.registerConsumedTriggerAttachments(msg)
-      return
-    }
+    if (await this.tryAnswerPendingQuestion(msg, content)) return
 
     // 1. Real topic route first (works without a mention, per product spec).
     if (msg.threadId !== undefined) {
@@ -571,75 +580,31 @@ export class InboundRouter {
   /**
    * Native-pipeline attachment decision for one message, without downloading.
    *
-   * Returns `{ kind: 'silent' }` when the message must stay inert (metadata
-   * registration only: no reply, no reaction, no Session, no download) and
-   * `{ kind: 'prompt', text }` when a model turn starts with this text. The
-   * caller keeps the message flowing through the normal route decision tree.
+   * Returns `{ kind: 'silent' }` when the message must stay inert (no reply,
+   * no reaction, no Session, no download, no local state; a later turn finds
+   * it through the recent-attachment read) and `{ kind: 'prompt', text }` when
+   * a model turn starts with this text. The caller keeps the message flowing
+   * through the normal route decision tree.
    */
-  private async resolveNativeAttachmentMessage(
+  private resolveNativeAttachmentMessage(
     msg: NormalizedMessage,
     state: InboundAttachmentState,
-  ): Promise<{ kind: 'silent' } | { kind: 'prompt'; text: string }> {
-    // A foreign sender's attachment never registers (and is dropped later by
-    // the route-ownership checks): silent metadata must stay per-sender.
-    const threadRecord = msg.threadId === undefined ? undefined : this.routes.get(msg.threadId)
-    const chatKey = chatRouteKey(msg.chatType, msg.chatId, msg.senderId)
-    const chatRecord = threadRecord === undefined ? this.routes.get(chatKey) : undefined
-    const foreign = (threadRecord !== undefined && !this.access.ownsRoute(msg, threadRecord))
-      || (chatRecord !== undefined && !this.access.ownsRoute(msg, chatRecord))
-    if (foreign) return { kind: 'prompt', text: state.text }
-
-    if (!this.config.acceptAttachments && state.attachmentOnly) return { kind: 'silent' }
-    if (state.attachmentOnly) {
-      await this.registerSilentAttachment(msg)
-      return { kind: 'silent' }
-    }
+  ): { kind: 'silent' } | { kind: 'prompt'; text: string } {
+    if (state.attachmentOnly) return { kind: 'silent' }
     if (!this.config.acceptAttachments) return { kind: 'prompt', text: state.text }
 
     // Group messages without an @-mention (and without an already-bound topic)
-    // never start a turn, but their attachments must remain discoverable from
-    // the topic a later @-mentioned message creates (Roadmap AC-4).
-    const pendingEstablishment = this.establishing.get(chatKey)
+    // never start a turn; their attachments stay discoverable from the topic a
+    // later @-mentioned message creates (Roadmap AC-4).
+    const threadRecord = msg.threadId === undefined ? undefined : this.routes.get(msg.threadId)
+    const chatKey = chatRouteKey(msg.chatType, msg.chatId, msg.senderId)
+    const chatRecord = threadRecord === undefined ? this.routes.get(chatKey) : undefined
     const requiresMention = msg.chatType === 'group' && this.config.requireMention && !msg.mentionedBot
     const triggers = threadRecord !== undefined || chatRecord !== undefined
-      || pendingEstablishment !== undefined || !requiresMention
-    if (!triggers) {
-      await this.registerSilentAttachment(msg)
-      return { kind: 'silent' }
-    }
-    return { kind: 'prompt', text: state.text }
-  }
-
-  /**
-   * Record attachment metadata without any side effect beyond the durable
-   * registry write. Never replies, reacts, downloads, or establishes a Session.
-   */
-  private async registerSilentAttachment(msg: NormalizedMessage): Promise<void> {
-    if (!this.config.acceptAttachments) return
-    // `admitted: true` is safe because every call site runs after
-    // `access.admit` returned true; the registry itself has no admission policy.
-    try {
-      await this.pendingAttachments.registerMessage(msg, { admitted: true })
-    } catch (error) {
-      // Metadata only: a registry failure must never fail the inbound pipeline.
-      this.ctx.logger?.warn?.(
-        'dsh-channels: registering pending attachment metadata for %s failed: %s',
-        msg.messageId, String(error),
-      )
-    }
+      || this.establishing.has(chatKey) || !requiresMention
+    return triggers ? { kind: 'prompt', text: state.text } : { kind: 'silent' }
   }
 
-  /**
-   * A native-pipeline message whose caption was consumed as a structured
-   * question answer starts no model turn, so its attachments would otherwise
-   * vanish from the conversation. Register them silently for later turns;
-   * the archive backend already downloaded them before question interception.
-   */
-  private async registerConsumedTriggerAttachments(msg: NormalizedMessage): Promise<void> {
-    if (this.attachmentBackend() !== 'native') return
-    if (!inboundAttachmentState(msg).hasPayload) return
-    await this.registerSilentAttachment(msg)
-  }
   /**
    * Build the first-turn user message for the native pipeline: the caption
    * text, the quoted-message excerpt, the prefetched trigger images, the
@@ -715,17 +680,6 @@ export class InboundRouter {
     if (context.quoteBlock !== undefined) blocks.push({ type: 'text', text: context.quoteBlock })
     blocks.push(...prefetchedBlocks)
 
-    let pending: readonly PendingAttachmentRecord[] = []
-    if (attachmentPipeline) {
-      try {
-        pending = this.pendingAttachments.list(this.pendingScopeOfRecord(record))
-      } catch (error) {
-        this.ctx.logger?.warn?.(
-          'dsh-channels: listing pending attachments for %s failed: %s',
-          record.key, String(error),
-        )
-      }
-    }
     const manifest = attachmentPipeline
       ? buildFeishuContextBlock({
         trigger: triggerManifestAttachments(msg, loadedFileKeys),
@@ -735,7 +689,6 @@ export class InboundRouter {
         ...(context.quoteMessage === undefined
           ? {}
           : { quote: manifestEntriesOfKnownMessage(context.quoteMessage) }),
-        pending,
       })
       : ''
     if (manifest !== '') blocks.push({ type: 'text', text: manifest })
@@ -903,16 +856,6 @@ export class InboundRouter {
     }
   }
 
-
-  /** Pending-registry isolation scope for one persisted route. */
-  private pendingScopeOfRecord(record: RouteRecord): PendingAttachmentScope {
-    return {
-      chatId: record.chatId,
-      senderOpenId: record.senderOpenId,
-      ...(record.kind === 'thread' ? { threadId: record.key } : {}),
-    }
-  }
-
   /** Live channel accessor for best-effort prefetch; undefined when gone. */
   private liveChannel(): FeishuChannel | undefined {
     try {
@@ -922,6 +865,28 @@ export class InboundRouter {
     }
   }
 
+  /**
+   * Consume one plain reply as an approval decision. Only the topic owner's
+   * replies in a session with an undecided approval card are intercepted.
+   * @returns true when the reply was a keyword decision and is fully handled;
+   * false when nothing was pending or the reply rejected the pending cards and
+   * must still be delivered as the next instruction.
+   */
+  private async tryAnswerPendingApproval(msg: NormalizedMessage, content: string): Promise<boolean> {
+    const answerer = this.approvalAnswerer
+    if (answerer === undefined || answerer.pendingCount() === 0) return false
+    const route = await this.commandRoute(msg)
+    if (route === undefined || !this.access.ownsRoute(msg, route)) return false
+    if (!answerer.hasPendingFor(route.sessionId)) return false
+    const result = answerer.submitText(route.sessionId, content)
+    if (result === undefined || result === 'superseded') return false
+    await this.delivery.commandCard(msg, {
+      kind: 'success', command: 'approval', sessionId: route.sessionId,
+      text: APPROVAL_TEXT_REPLIES[result],
+    }, { createThread: false })
+    return true
+  }
+
   /**
    * Consume one plain reply as an `ask_user_question` free-text answer.
    *
@@ -1086,7 +1051,7 @@ export class InboundRouter {
       sessionId,
       chatId: msg.chatId,
       chatType: msg.chatType,
-      senderOpenId: msg.senderId,
+      senderUserId: msg.senderId,
       workspacePath: workspace.path,
       sessionDir: placement.sessionDir,
       ...(placement.worktreeBranch === undefined ? {} : { worktreeBranch: placement.worktreeBranch }),
@@ -1168,6 +1133,8 @@ export class InboundRouter {
       lastActivityAt: Date.now(),
     })
     this.streamer?.attach(live.agent.session, sent.messageId, msg.messageId, typingId)
-    live.agent.followup(await this.deliverTurnMessage(msg, current, content))
+    live.agent.followup(await this.deliverTurnMessage(msg, current, content, {
+      excludeMessageIds: [msg.messageId, sent.messageId],
+    }))
   }
 }