@modesto_ma/dsh-channels 0.5.0-beta.3 → 0.5.0-beta.4

package/src/index.ts

@@ -51,7 +51,7 @@ export type { CatalogWarn, SettingsCatalog } from './settings/catalog.ts'
 export { createSettingsDirectoryPicker } from './settings/directory-picker.ts'
 export type { HostDirectoryPickerService, SettingsDirectoryPicker } from './settings/directory-picker.ts'
 export { isSameOriginRequest, mountSettingsRoutes, registerSettingsRoutes } from './settings/routes.ts'
-export type { HostWebServer } from './settings/routes.ts'
+export type { HostRequestGate, HostWebServer } from './settings/routes.ts'
 export type { ApprovalOutcome, ApprovalRequest, ApprovalAnswererListener, AssistantStreamFrame, AskUserQuestionAnswer, AskUserQuestionAnswerItem, AskUserQuestionItem, AskUserQuestionRequestEvent, UserQuestionAnswererListener, AgentCancelCause, SessionStatsView, TokenUsageView, ContextPressureView, SessionProjections } from './dsh-types.ts'
 export { buildCard, buildInterruptionCard, cardJsonBytes, CARD_MAX_BYTES, CARD_TARGET_BYTES, REASONING_MAX_BYTES, INTERRUPTION_NOTICE, MAX_TABLES_PER_CARD, PANEL_TITLES, PANEL_CHEVRON_TOKEN, segmentCardContent, splitBodyForCard, stripTables, tableBlocks, TRUNCATION_SUFFIX, buildApprovalCard, buildApprovalSettledCard, buildQuestionCard, buildQuestionSettledCard, MAX_QUESTION_OPTIONS } from './cards.ts'
 export { ApprovalAnswerer } from './approvals.ts'

package/src/interactions/pending.ts

@@ -20,8 +20,13 @@ export interface InteractionRoute {
   cardMessageId: string
   /** Whether the anchor lives in a real topic (replyInThread). */
   inThread: boolean
-  /** The session owner (user_id) — the only operator allowed to decide. */
+  /** The session owner (user_id); the only operator allowed to decide unless `mayDecide` is set. */
   senderUserId: string
+  /**
+   * Decision gate of a group-shared route: replaces the owner-only check with
+   * the route's member admission. Absent = only `senderUserId` decides.
+   */
+  mayDecide?(userId: string): boolean
 }
 
 /** Fields every pending interaction card carries. */
@@ -96,7 +101,11 @@ export class PendingCardTable<E extends PendingCardEntry> {
       }
     }
     if (entry === undefined || entry.settled) return undefined
-    if (event.operator.userId !== entry.route.senderUserId) {
+    const operator = event.operator.userId
+    const allowed = operator !== undefined && (entry.route.mayDecide === undefined
+      ? operator === entry.route.senderUserId
+      : entry.route.mayDecide(operator))
+    if (!allowed) {
       onUnauthorized(entry)
       return undefined
     }

package/src/routing/inbound.ts

@@ -14,7 +14,7 @@ import type {
   AgentHandle, AttachmentStore, ContentBlock, HostContext, SessionId, UserMessage, Workspace,
 } from '../dsh-types.ts'
 import type { AttachmentStoreMode, FeishuConfig } from '../config.ts'
-import { buildCard, buildOnboardingCard, initialStreamingCard } from '../cards.ts'
+import { buildCard, buildOnboardingCard, initialStreamingCard, queuedStreamingCard } from '../cards.ts'
 import { RouteOperationQueue } from '../commands.ts'
 import { chatRouteKey, sessionDirOf } from '../domain.ts'
 import type { FeishuDomainHandle, RouteRecord } from '../domain.ts'
@@ -228,6 +228,21 @@ interface TurnDeliveryOptions {
   excludeMessageIds?: readonly string[]
 }
 
+/**
+ * Register one release gate under `key` in `gates`. The returned closer
+ * resolves the gate and removes it only while it is still the registered one.
+ */
+function openGate(gates: Map<string, { promise: Promise<void>; release(): void }>, key: string): () => void {
+  let settle!: () => void
+  const promise = new Promise<void>((resolve) => { settle = resolve })
+  const release = (): void => {
+    if (gates.get(key)?.promise === promise) gates.delete(key)
+    settle()
+  }
+  gates.set(key, { promise, release })
+  return release
+}
+
 export class InboundRouter {
   /**
    * In-process dedup guard: message id → accept timestamp. Set synchronously
@@ -251,6 +266,13 @@ export class InboundRouter {
    * racing it, otherwise the topic's turns reach the model out of order.
    */
   private readonly firstDeliveries = new Map<string, { promise: Promise<void>; release(): void }>()
+  /**
+   * topic id → reservation by an external starter (the analyze launcher) that
+   * opened the topic but has not published its route yet. A reply in the topic
+   * waits for the release and then routes against the published record, or
+   * falls through as an unbound topic when the start failed.
+   */
+  private readonly reservedTopics = new Map<string, { promise: Promise<void>; release(): void }>()
 
   constructor(private readonly deps: InboundDeps) {}
 
@@ -282,14 +304,7 @@ export class InboundRouter {
    * observes its gate. The returned closer must be called exactly once.
    */
   private openDeliveryGate(key: string): () => void {
-    let settle!: () => void
-    const promise = new Promise<void>((resolve) => { settle = resolve })
-    const release = (): void => {
-      if (this.firstDeliveries.get(key)?.promise === promise) this.firstDeliveries.delete(key)
-      settle()
-    }
-    this.firstDeliveries.set(key, { promise, release })
-    return release
+    return openGate(this.firstDeliveries, key)
   }
 
   /** Wait for the in-flight first followup of a route, when one is pending. */
@@ -298,7 +313,19 @@ export class InboundRouter {
     if (pending !== undefined) await pending.promise.catch(() => undefined)
   }
 
-/**
+  /**
+   * Reserve one topic whose route is about to be published by an external
+   * starter. Replies in the topic wait until the returned closer runs; the
+   * closer must be called exactly once, after the route (and its first turn)
+   * is published or the start was abandoned.
+   * @param threadId - the topic id.
+   * @returns the closer releasing waiting replies.
+   */
+  reserveTopic(threadId: string): () => void {
+    return openGate(this.reservedTopics, threadId)
+  }
+
+  /**
    * Send the one-time onboarding card for a private chat, then remember the
    * chat in the domain global. Best-effort: a storage failure only risks a
    * repeated card, never a blocked session.
@@ -327,6 +354,8 @@ export class InboundRouter {
     // first-turn delivery never stays suspended across a teardown.
     for (const entry of [...this.firstDeliveries.values()]) entry.release()
     this.firstDeliveries.clear()
+    for (const entry of [...this.reservedTopics.values()]) entry.release()
+    this.reservedTopics.clear()
   }
 
   /** Entry point: one normalized inbound message. */
@@ -370,6 +399,14 @@ export class InboundRouter {
     // TTL tombstone, attachment archive, workspace, Session, or model call.
     if (!(await this.access.admit(msg))) return
 
+    // A reserved topic has no route yet: wait for its starter so the TTL,
+    // attachment, mention, and route decisions below see the published record.
+    const reservation = msg.threadId === undefined ? undefined : this.reservedTopics.get(msg.threadId)
+    if (reservation !== undefined) {
+      await reservation.promise
+      if (!this.started) return
+    }
+
     // Enforce TTL at admission as well as in the periodic sweep. A message that
     // arrives after the deadline must not get one chance to revive the route
     // merely because the background GC has not run yet.
@@ -1112,7 +1149,12 @@ export class InboundRouter {
     // deployment follow its next turn (one-time legacy adoption, D12).
     await this.adoptLegacyStagedAttachments(msg, placement.sessionDir, warn)
 
-    const sent = await this.delivery.replyFirstCard(msg, initialStreamingCard(current.sessionId))
+    // A message behind a running turn opens as a queued card whose button can
+    // move it into that turn instead (see `TurnStreamer.mergeQueued`).
+    const firstCard = this.streamer?.hasLiveTurn(current.sessionId) === true
+      ? queuedStreamingCard(current.sessionId)
+      : initialStreamingCard(current.sessionId)
+    const sent = await this.delivery.replyFirstCard(msg, firstCard)
     const typingId = await typingPromise
 
     // Repair snapshot first — same crash-window reasoning as `startSession`.
@@ -1132,9 +1174,10 @@ export class InboundRouter {
       cardMessageId: sent.messageId,
       lastActivityAt: Date.now(),
     })
-    this.streamer?.attach(live.agent.session, sent.messageId, msg.messageId, typingId)
-    live.agent.followup(await this.deliverTurnMessage(msg, current, content, {
+    const message = await this.deliverTurnMessage(msg, current, content, {
       excludeMessageIds: [msg.messageId, sent.messageId],
-    }))
+    })
+    this.streamer?.attach(live.agent.session, sent.messageId, msg.messageId, typingId, { message })
+    live.agent.followup(message)
   }
 }

package/src/service.ts

@@ -39,7 +39,7 @@ import type {
   SessionProjections,
   TokenMeter,
 } from './dsh-types.ts'
-import { buildPickerCard, parsePickAction, standaloneInfoCard, STOP_ACTION } from './cards.ts'
+import { buildPickerCard, parsePickAction, standaloneInfoCard, STEER_ACTION, STOP_ACTION } from './cards.ts'
 import type { PickerOption } from './cards.ts'
 import {
   armEffortCommand, armModelCommand, armRenewCommand, registerModelCommand, commandResultCardKind, parseSlashCommand,
@@ -52,10 +52,13 @@ import type { PermissionPresets, SessionQuery } from './dsh-types.ts'
 import { FEISHU_USER_ID_PATTERN, feishuDomain, sessionDirOf } from './domain.ts'
 import type {
   AccessGroupRecord, AccessRequestRecord, AccessUserRecord,
-  ExpiredRouteRecord, FeishuDomainGlobal, FeishuDomainHandle, InflightSnapshot,
+  AnalyzeRequestRecord, ExpiredRouteRecord, FeishuDomainGlobal, FeishuDomainHandle, InflightSnapshot,
   ProcessedRecord, RawDomainHandle, RouteRecord,
 } from './domain.ts'
 import { RouteStore } from './session/routes.ts'
+import { AnalyzeLauncher } from './analyze/launcher.ts'
+import { startAnalyzeServer } from './analyze/server.ts'
+import type { AnalyzeServer } from './analyze/server.ts'
 import { InflightRepair } from './session/repair.ts'
 import { SessionManager } from './session/manager.ts'
 import type { LiveAgent, RenewCommit } from './session/manager.ts'
@@ -94,7 +97,7 @@ import { ACTIVITY_BUILD_MARKER, TurnStreamer } from './streamer.ts'
 import type { ProjectedStats, StreamerHooks } from './streamer.ts'
 import type { FeishuConfig } from './config.ts'
 import type {
-  AccessMutationResponse, AccessRequestWire, AccessWire, ScopeCheckWire, SlashCommandSyncWire,
+  AccessMutationResponse, AccessRequestWire, AccessUserWire, AccessWire, CredentialField, ScopeCheckWire, SlashCommandSyncWire,
 } from './settings/contract.ts'
 import { checkScopes } from './feishu/scopes.ts'
 import { desiredSlashCommands, syncSlashCommands } from './feishu/slash-commands.ts'
@@ -149,6 +152,7 @@ async function openFeishuDomain(ctx: HostContext): Promise<FeishuDomainHandle> {
   const accessUsersRaw = domain.table('access_users')
   const accessRequestsRaw = domain.table('access_requests')
   const accessWikiUsersRaw = domain.table('access_wiki_users')
+  const analyzeRequestsRaw = domain.table('analyze_requests')
   return {
     routes: {
       get: key => table.get(key) as RouteRecord | undefined,
@@ -198,6 +202,11 @@ async function openFeishuDomain(ctx: HostContext): Promise<FeishuDomainHandle> {
       delete: key => accessWikiUsersRaw.delete(key),
       entries: () => accessWikiUsersRaw.entries() as IterableIterator<[string, AccessUserRecord]>,
     },
+    analyzeRequests: {
+      get: key => analyzeRequestsRaw.get(key) as AnalyzeRequestRecord | undefined,
+      put: (key, value) => analyzeRequestsRaw.put(key, value),
+      entries: () => analyzeRequestsRaw.entries() as IterableIterator<[string, AnalyzeRequestRecord]>,
+    },
     getGlobal: () => (domain.global.get() ?? {}) as FeishuDomainGlobal,
     setGlobal: value => domain.global.set(value),
     close: () => domain.close(),
@@ -230,6 +239,16 @@ async function resolveCredentialRef(ctx: HostContext, ref: string): Promise<stri
 }
 
 /** Best-effort human-readable error text for the settings panel. */
+/** One whitelisted user as the panel shows it. */
+function userWire(record: AccessUserRecord): AccessUserWire {
+  return {
+    userId: record.userId,
+    ...(record.name === undefined ? {} : { name: record.name }),
+    source: record.source,
+    addedAt: record.addedAt,
+  }
+}
+
 function messageOf(error: unknown): string {
   return error instanceof Error ? error.message : String(error)
 }
@@ -270,6 +289,12 @@ export class FeishuService {
   private readonly messageReader = new MessageReader({ channel: () => this.channel })
   /** Inbound routing: dedup, admission, decision tree, session establishment. */
   private readonly inbound: InboundRouter
+  /** Log-platform analyze API business side (requests → shared analysis topics). */
+  private readonly analyzeLauncher: AnalyzeLauncher
+  /** Bound analyze listener while connected with `analyzeListen` set. */
+  private analyzeServer: AnalyzeServer | undefined
+  /** Why the analyze listener could not bind at the last connect. */
+  private analyzeListenError: string | undefined
   /** Agent/session lifecycle: live registry, resume, presets, renew. */
   private readonly sessions: SessionManager
   /**
@@ -425,6 +450,7 @@ export class FeishuService {
           chatId: record.chatId,
           chatType: record.chatType,
           senderUserId: record.senderUserId,
+          ...(record.shared === true ? { shared: true } : {}),
         }
       },
       warn: (message, ...args) => this.ctx.logger?.warn?.(message, ...args),
@@ -441,6 +467,7 @@ export class FeishuService {
           chatId: record.chatId,
           chatType: record.chatType,
           senderUserId: record.senderUserId,
+          ...(record.shared === true ? { shared: true } : {}),
         }
       },
       noteKnownMessage: (route, message, source) => {
@@ -539,6 +566,21 @@ export class FeishuService {
       approvalAnswerer: () => this.approvalAnswerer,
       commands: { handleSlash: (msg, line) => this.handleSlashMessage(msg, line) },
     })
+    this.analyzeLauncher = new AnalyzeLauncher({
+      ctx: this.ctx,
+      config: this.config,
+      started: () => this.started,
+      channel: () => this.channel,
+      domain: () => this.domain,
+      routes: this.routes,
+      repair: this.repair,
+      sessions: this.sessions,
+      streamer: () => this.streamer,
+      queue: this.routeOperations,
+      reserveTopic: threadId => this.inbound.reserveTopic(threadId),
+      mayAnalyzeIn: chatId => this.accessController.mayAnalyzeIn(chatId),
+      resolveToken: () => resolveCredentialRef(this.ctx, this.config.analyzeToken).catch(() => undefined),
+    })
   }
 
   /** Effective inbound attachment backend (matches the inbound router). */
@@ -949,12 +991,8 @@ export class FeishuService {
         source: record.source,
         addedAt: record.addedAt,
       })),
-      users: this.accessStore.userRecords().map(record => ({
-        userId: record.userId,
-        ...(record.name === undefined ? {} : { name: record.name }),
-        source: record.source,
-        addedAt: record.addedAt,
-      })),
+      users: this.accessStore.userRecords().map(userWire),
+      wikiUsers: this.accessStore.wikiUserRecords().map(userWire),
       requests: this.accessStore.pendingRequests().map(record => {
         const wire: AccessRequestWire = {
           token: record.token,
@@ -1010,13 +1048,37 @@ export class FeishuService {
 
   /** Panel: authorize one user (global across authorized groups). */
   async addAccessUser(userId: string, name?: string): Promise<AccessMutationResponse> {
+    return this.addPanelUser(userId, name, id => this.accessStore.hasUser(id), record => this.accessStore.addUser(record))
+  }
+
+  /** Panel: revoke one user. */
+  async removeAccessUser(userId: string): Promise<AccessMutationResponse> {
+    return this.removePanelUser(userId, id => this.accessStore.removeUser(id))
+  }
+
+  /** Panel: add one user to the wiki whitelist. */
+  async addWikiUser(userId: string, name?: string): Promise<AccessMutationResponse> {
+    return this.addPanelUser(userId, name, id => this.accessStore.hasWikiUser(id), record => this.accessStore.addWikiUser(record))
+  }
+
+  /** Panel: remove one user from the wiki whitelist. */
+  async removeWikiUser(userId: string): Promise<AccessMutationResponse> {
+    return this.removePanelUser(userId, id => this.accessStore.removeWikiUser(id))
+  }
+
+  private async addPanelUser(
+    userId: string,
+    name: string | undefined,
+    has: (id: string) => boolean,
+    add: (record: AccessUserRecord) => Promise<AccessUserRecord>,
+  ): Promise<AccessMutationResponse> {
     const id = this.cleanAccessUserId(userId)
     if (id === undefined) return { ok: false, error: 'user_id 不合法（只能包含字母、数字、_ 和 -，不是 ou_ 开头的 open_id）' }
     const admin = this.effectiveAdminUserId()
     if (admin === undefined) return { ok: false, error: '请先在「访问授权」标签页设置管理员 user_id' }
     try {
-      if (!this.accessStore.hasUser(id)) {
-        await this.accessStore.addUser({
+      if (!has(id)) {
+        await add({
           userId: id,
           ...(name === undefined || name.trim() === '' ? {} : { name: name.trim() }),
           source: 'panel',
@@ -1030,12 +1092,11 @@ export class FeishuService {
     }
   }
 
-  /** Panel: revoke one user. */
-  async removeAccessUser(userId: string): Promise<AccessMutationResponse> {
+  private async removePanelUser(userId: string, remove: (id: string) => Promise<boolean>): Promise<AccessMutationResponse> {
     const id = this.cleanAccessUserId(userId)
     if (id === undefined) return { ok: false, error: 'user_id 不合法' }
     try {
-      await this.accessStore.removeUser(id)
+      await remove(id)
       return { ok: true, access: this.accessSnapshot() }
     } catch (error) {
       return { ok: false, error: `撤销授权失败：${messageOf(error)}` }
@@ -1250,10 +1311,10 @@ export class FeishuService {
   health(): HealthSnapshot { return this.healthSnapshot() }
 
   /**
-   * Credential facts for the two Feishu refs. Values are never returned:
+   * Credential facts for the panel's credential refs. Values are never returned:
    * `describe()` reports presence/source/writability only.
    */
-  async credentialStates(): Promise<{ appId: CredentialInfo; appSecret: CredentialInfo }> {
+  async credentialStates(): Promise<Record<CredentialField, CredentialInfo>> {
     const provider = this.credentialProvider()
     const read = async (ref: string): Promise<CredentialInfo> => {
       try {
@@ -1274,8 +1335,10 @@ export class FeishuService {
         return { configured: false, writable: false }
       }
     }
-    const [appId, appSecret] = await Promise.all([read(this.config.appId), read(this.config.appSecret)])
-    return { appId, appSecret }
+    const [appId, appSecret, analyzeToken] = await Promise.all([
+      read(this.config.appId), read(this.config.appSecret), read(this.config.analyzeToken),
+    ])
+    return { appId, appSecret, analyzeToken }
   }
 
   /** The host credentials seam, when mounted. */
@@ -1283,8 +1346,8 @@ export class FeishuService {
     return this.ctx.get?.('credentials') as CredentialProvider | undefined
   }
 
-  /** Store one Feishu credential value through the host seam; the value is never logged. */
-  async setCredential(field: 'appId' | 'appSecret', value: string): Promise<void> {
+  /** Store one credential value through the host seam; the value is never logged. */
+  async setCredential(field: CredentialField, value: string): Promise<void> {
     const provider = this.credentialProvider()
     if (provider?.set === undefined) {
       throw new Error('主机的凭据服务不可写（未挂载 credentials.set，或当前提供方只读）')
@@ -1298,8 +1361,8 @@ export class FeishuService {
     await this.refreshReadiness()
   }
 
-  /** Remove the stored value of one Feishu credential reference. */
-  async clearCredential(field: 'appId' | 'appSecret'): Promise<void> {
+  /** Remove the stored value of one credential reference. */
+  async clearCredential(field: CredentialField): Promise<void> {
     const provider = this.credentialProvider()
     if (provider?.unset === undefined) {
       throw new Error('主机的凭据服务不支持移除凭据')
@@ -1314,8 +1377,12 @@ export class FeishuService {
   }
 
   /** The overlay-independent ref name backing one editable credential slot. */
-  private credentialRef(field: 'appId' | 'appSecret'): string {
-    return field === 'appId' ? this.config.appId : this.config.appSecret
+  private credentialRef(field: CredentialField): string {
+    switch (field) {
+      case 'appId': return this.config.appId
+      case 'appSecret': return this.config.appSecret
+      case 'analyzeToken': return this.config.analyzeToken
+    }
   }
 
   /** Wire events and open the long connection. */
@@ -1417,6 +1484,7 @@ export class FeishuService {
       questions.onCardAction(event)
       this.wikiConsent.onCardAction(event)
       this.onStopAction(event)
+      this.onSteerAction(event)
       void this.onPickAction(event).catch((error: unknown) => {
         this.ctx.logger?.warn?.('dsh-channels: picker card action failed: %s', String(error))
       })
@@ -1449,6 +1517,9 @@ export class FeishuService {
     // Background: the results only feed the panel and the log.
     void this.runScopeCheck(channel, appId, ownerLookup)
     if (this.config.slashCommandPanel) void this.runSlashCommandSync(channel)
+    // Before the listener opens, so every `running` record left is a previous instance's.
+    await this.analyzeLauncher.markInterrupted()
+    await this.openAnalyzeListener()
     // Repair cards a previous instance left mid-flight (best-effort, background).
     void this.repair.repairAll().catch((error: unknown) => {
       this.ctx.logger?.warn?.('dsh-channels: inflight repair failed: %s', String(error))
@@ -1506,12 +1577,38 @@ export class FeishuService {
     )
   }
 
+  /**
+   * Bind the analyze listener when `analyzeListen` is set. A bind failure is
+   * logged and folded into the health snapshot (panel reasons, `/health`); the Feishu connection stays up.
+   */
+  private async openAnalyzeListener(): Promise<void> {
+    this.analyzeListenError = undefined
+    const listen = this.config.analyzeListen
+    if (listen === undefined) return
+    try {
+      this.analyzeServer = await startAnalyzeServer(
+        listen,
+        this.analyzeLauncher,
+        (message, ...args) => this.ctx.logger?.warn?.(message, ...args),
+      )
+      console.info('[dsh-channels] 日志分析接口已监听', listen)
+    } catch (error) {
+      this.analyzeListenError = messageOf(error)
+      this.ctx.logger?.error?.('dsh-channels: analyze listener on %s failed: %s', listen, this.analyzeListenError)
+      console.error('[dsh-channels] 日志分析接口监听失败:', listen, error)
+    }
+  }
+
   /** Tear down: close the connection and dispose all live agents. */
   async shutdown(): Promise<void> {
     // Close admission first. In-flight Host commands receive cancellation
     // before their Agent/channel/storage dependencies are disposed, while
     // already queued route operations observe `started === false` and retire.
     this.started = false
+    const analyzeServer = this.analyzeServer
+    this.analyzeServer = undefined
+    await analyzeServer?.close()
+    await this.analyzeLauncher.drain()
     for (const controller of this.commandControllers) controller.abort()
     await Promise.allSettled([...this.commandOperations])
     this.commandControllers.clear()
@@ -1638,7 +1735,7 @@ export class FeishuService {
       return
     }
 
-    if (msg.senderId !== route.senderUserId) {
+    if (!this.accessController.ownsRoute(msg, route)) {
       await this.delivery.commandCard(msg, {
         kind: 'forbidden', command: parsed.name, text: '无权操作此会话。',
       })
@@ -1648,7 +1745,7 @@ export class FeishuService {
     const operation = this.routeOperations.run(route.key, async () => {
       if (!this.started) return
       const current = this.routes.get(route.key) ?? route
-      if (msg.senderId !== current.senderUserId) {
+      if (!this.accessController.ownsRoute(msg, current)) {
         await this.delivery.commandCard(msg, {
           kind: 'forbidden', command: parsed.name, text: '无权操作此会话。',
         })
@@ -1985,13 +2082,44 @@ export class FeishuService {
     if (sessionId === undefined) return
     const route = this.routes.findBySession(sessionId)
     if (route === undefined) return
-    if (event.operator.userId !== route.senderUserId || event.chatId !== route.chatId) {
+    if (!this.accessController.mayActOnRoute(event.operator.userId, event.chatId, route)) {
       this.streamer?.markStopDenied(sessionId)
       return
     }
     this.cancelTurn(sessionId)
   }
 
+  /**
+   * Queued-card steer button: a user who may act on the route (the owner, or
+   * any admitted member of a group-shared route), clicking inside the
+   * session's own chat, moves the queued message out of the next-turn queue
+   * and into the running turn's next step; another operator gets the
+   * owner-only notice instead. A message the driver already claimed (its turn
+   * started) or a turn that is stopping leaves the card to its own turn.
+   */
+  private onSteerAction(event: CardActionEvent): void {
+    if (!this.started) return
+    if ((event.action.value as { decision?: unknown } | undefined)?.decision !== STEER_ACTION) return
+    const target = this.streamer?.steerTargetOf(event.messageId)
+    if (target === undefined) return
+    const route = this.routes.findBySession(target.sessionId)
+    if (route === undefined) return
+    if (!this.accessController.mayActOnRoute(event.operator.userId, event.chatId, route)) {
+      this.streamer?.markQueuedDenied(event.messageId)
+      return
+    }
+    const agent = this.sessions.get(target.sessionId)?.agent
+      ?? this.ctx.agents.get(target.sessionId as SessionId)
+    if (agent?.status !== 'running') return
+    const merged = this.streamer?.mergeQueued(event.messageId, (_sessionId, message) => {
+      if (!agent.inbox.remove(message.id)) return false
+      agent.steer(message)
+      return true
+    }) === true
+    // The queued card no longer owns a turn: retire its restart-repair snapshot.
+    if (merged) void this.repair.clear(event.messageId)
+  }
+
   /**
    * Picker-card click: run the chosen `/<command> <arg>` exactly as if the
    * operator had typed it under the picker card, so access admission, route
@@ -2006,7 +2134,8 @@ export class FeishuService {
     if (action === undefined) return
     const route = this.routes.findBySession(action.sessionId)
     const userId = event.operator.userId
-    if (route === undefined || route.chatId !== event.chatId || userId !== route.senderUserId) return
+    if (route === undefined || userId === undefined
+      || !this.accessController.mayActOnRoute(userId, event.chatId, route)) return
     const line = `/${action.command} ${action.arg}`
     await this.delivery.replacingCard(event.messageId, () => this.handleSlashMessage({
       messageId: event.messageId,
@@ -2437,6 +2566,7 @@ export class FeishuService {
       routeCount: this.routes.size(),
       liveAgentCount: this.sessions.liveCount(),
       inflightTurnCount,
+      ...(this.analyzeListenError === undefined ? {} : { analyzeListenError: this.analyzeListenError }),
     })
   }
 
@@ -2566,6 +2696,9 @@ export class FeishuService {
       cardMessageId: record.cardMessageId,
       inThread: record.kind === 'thread',
       senderUserId: record.senderUserId,
+      ...(record.shared === true
+        ? { mayDecide: (userId: string) => this.accessController.mayActOnRoute(userId, record.chatId, record) }
+        : {}),
     }
   }