@xmanrui/dsh-im 4.29.1 → 4.31.0

package/src/channels/feishu/slash-command-registry.mjs

@@ -16,6 +16,17 @@
  * existing "/xxx" text commands.
  */
 
+import {
+  DEFAULT_SLASH_COMMAND_ICON,
+  SLASH_COMMAND_MANIFEST,
+  isCustomSlashPanel,
+  resolveSlashPanelManifest,
+} from './slash-command-panel.mjs';
+
+// The manifest describes the panel, so it lives with the panel's configuration;
+// re-exported here because this is where callers have always imported it from.
+export { SLASH_COMMAND_MANIFEST };
+
 const SLASH_ENDPOINT = '/open-apis/application/v7/app_slash_commands';
 const MISSING_PERMISSION_CODES = new Set(['99991640', '99991672']);
 
@@ -24,50 +35,15 @@ export const SLASH_COMMAND_TENANT_SCOPES = Object.freeze([
   'application:app_slash_command:write',
 ]);
 
-// Icon keys are the documented values in the Feishu Slash Command doc.
-const DEFAULT_ICON = 'ai-agent_outlined';
+const DEFAULT_ICON = DEFAULT_SLASH_COMMAND_ICON;
 
 /**
- * The dsh-im Feishu command manifest. Every entry's `command` is registered
- * WITHOUT the leading slash; Feishu displays it as "/<command>" in the panel
- * and sends "/<command>" back as text, which matches the bridge's regexes.
- *
- * Descriptions should stay short and match what the command actually does in
- * bridge.mjs / the shared command modules.
+ * Feishu returns the panel in creation order (newest first, time to the
+ * second), so a chosen order is only reachable by creating the commands in
+ * reverse, one per second. Anything faster lands in the same second and the
+ * order degrades to the platform's tie-break.
  */
-export const SLASH_COMMAND_MANIFEST = Object.freeze([
-  { command: 'menu', icon: 'skill_outlined', default: '打开功能菜单', en_us: 'Open the feature menu' },
-  { command: 'new', icon: 'ai-deepthink_outlined', default: '开启全新会话', en_us: 'Start a fresh session' },
-  { command: 'help', icon: 'promptword_outlined', default: '查看帮助', en_us: 'Show help' },
-  { command: 'status', icon: 'ai-functions_outlined', default: '查看机器人状态', en_us: 'Show bot status' },
-  { command: 'compact', icon: 'ai-block_outlined', default: '压缩当前会话上下文', en_us: 'Compact the current session' },
-  { command: 'sessionlist', icon: 'chat-ai_outlined', default: '列出会话', en_us: 'List sessions' },
-  { command: 'workspacelist', icon: 'folder_outlined', default: '列出工作区', en_us: 'List workspaces' },
-  { command: 'workspaces', icon: 'folder_outlined', default: '列出工作区', en_us: 'List workspaces' },
-  { command: 'wsl', icon: 'folder_outlined', default: '列出工作区', en_us: 'List workspaces' },
-  { command: 'ws', icon: 'folder_outlined', default: '切换工作区', en_us: 'Switch workspace' },
-  { command: 'watch', icon: 'flag_outlined', default: '关注一个会话', en_us: 'Watch a session' },
-  { command: 'unwatch', icon: 'clear_outlined', default: '取消关注会话', en_us: 'Unwatch a session' },
-  { command: 'watchlist', icon: 'flag_outlined', default: '查看关注列表', en_us: 'List watched sessions' },
-  { command: 'archived', icon: 'folder_outlined', default: '设置归档会话显隐（on/off）', en_us: 'Show or hide archived sessions (on/off)' },
-  { command: 'history', icon: 'chat-ai_outlined', default: '查看最近历史消息（仅私聊）', en_us: 'Show recent history (private chats only)' },
-  { command: 'workspace', icon: 'folder_outlined', default: '切换工作区', en_us: 'Switch workspace' },
-  { command: 'conv', icon: 'folder_outlined', default: '设置当前对话专属工作区', en_us: 'Set the workspace for this conversation' },
-  { command: 'session', icon: 'chat-ai_outlined', default: '绑定已有会话', en_us: 'Bind an existing session' },
-  { command: 'models', icon: 'ai-functions_outlined', default: '列出可用模型', en_us: 'List available models' },
-  { command: 'model', icon: 'ai-agent_outlined', default: '查看或切换当前模型', en_us: 'Show or switch the current model' },
-  { command: 'reasoninglist', icon: 'ai-deepthink_outlined', default: '列出可用推理等级', en_us: 'List available reasoning efforts' },
-  { command: 'reasoning', icon: 'ai-deepthink_outlined', default: '查看或切换推理等级', en_us: 'Show or switch the reasoning effort' },
-  { command: 'presetlist', icon: 'skill_outlined', default: '列出可用 Agent 预设', en_us: 'List available Agent Presets' },
-  { command: 'preset', icon: 'skill_outlined', default: '查看或切换 Agent 预设', en_us: 'Show or switch the Agent Preset' },
-  { command: 'stop', icon: 'clear_outlined', default: '停止当前任务', en_us: 'Stop the current task' },
-  { command: 'steer', icon: 'promptword_outlined', default: '给当前任务补充指令', en_us: 'Send additional instructions to the current task' },
-  { command: 'batch', icon: 'chat-ai_outlined', default: '开始批量输入（仅私聊）', en_us: 'Start batch input (private chats only)' },
-  { command: 'send', icon: 'chat-ai_outlined', default: '提交当前批次（仅私聊）', en_us: 'Submit the current batch (private chats only)' },
-  { command: 'cancel', icon: 'clear_outlined', default: '取消当前批次（仅私聊）', en_us: 'Cancel the current batch (private chats only)' },
-  { command: 'version', icon: 'ai-functions_outlined', default: '查看插件版本', en_us: 'Show the plugin version' },
-  { command: 'repair', icon: 'ai-functions_outlined', default: '补全飞书权限与卡片回调（仅私聊）', en_us: 'Complete Feishu permissions and card callbacks (private chats only)' },
-]);
+export const SLASH_PANEL_CREATE_INTERVAL_MS = 1_100;
 
 // Commands that require a parameter are registered too, so the user can type
 // "/watch <session ID>" from the panel. A leading placeholder hint is not part of
@@ -276,4 +252,244 @@ export async function registerSlashCommands({
   };
 }
 
+/** Delete one registered command with an already-fetched tenant token. */
+async function deleteSlashCommandWithToken({
+  tenantAccessToken, domain, httpInstance, timeoutMs, signal, commandId,
+}) {
+  await requestJson(httpInstance, {
+    method: 'DELETE',
+    url: endpointFor(domain, `${SLASH_ENDPOINT}/${commandId}`).href,
+    headers: { authorization: `Bearer ${tenantAccessToken}` },
+    signal: requestSignal(signal, timeoutMs),
+    timeout: timeoutMs,
+  }, 'Feishu slash command delete');
+}
+
+/** Plain timer used between creates; tests inject their own. */
+function defaultWait(ms, signal) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    signal?.addEventListener('abort', () => {
+      clearTimeout(timer);
+      resolve();
+    }, { once: true });
+  });
+}
+
+function commandNameOf(item) {
+  return typeof item?.command === 'string' && item.command ? item.command : null;
+}
+
+/**
+ * The commands of ours in panel order. Feishu returns the list newest-first
+ * with second precision, so `create_time` is the panel order and `command_id`
+ * only breaks ties inside the same second.
+ */
+function orderedOwnedNames(items, owned) {
+  return items
+    .map((item, index) => ({ item, index }))
+    .filter(({ item }) => owned.has(commandNameOf(item)))
+    .sort((a, b) => {
+      const aTime = Number(a.item.create_time);
+      const bTime = Number(b.item.create_time);
+      if (Number.isFinite(aTime) && Number.isFinite(bTime) && aTime !== bTime) return bTime - aTime;
+      const aId = Number(a.item.command_id);
+      const bId = Number(b.item.command_id);
+      if (Number.isFinite(aId) && Number.isFinite(bId) && aId !== bId) return bId - aId;
+      return a.index - b.index;
+    })
+    .map(({ item }) => commandNameOf(item))
+    .filter(Boolean);
+}
+
+function slashPanelDescription(entry, command) {
+  return {
+    default_value: entry.default ?? entry.en_us ?? command,
+    i18n: {
+      zh_cn: entry.default ?? command,
+      en_us: entry.en_us ?? entry.default ?? command,
+    },
+  };
+}
+
+/**
+ * Sync one bot's "/" panel with its configured manifest.
+ *
+ * `default` mode is the pre-configurable behaviour: create what is missing and
+ * leave everything else alone. `custom` mode converges the app to the
+ * configured commands *and order*:
+ *
+ *   1. read the registered commands (with command_id and create_time);
+ *   2. stop when the panel already holds exactly that order — Feishu reports the
+ *      panel in creation order, so a matching order needs no calls at all;
+ *   3. otherwise delete our commands and recreate the configured ones
+ *      newest-first, one per `intervalMs`, because the order *is* the creation
+ *      order.
+ *
+ * Commands registered outside the manifest are never deleted: dsh-im does not
+ * own them, and their position is the platform's business.
+ *
+ * @returns {{ created: Array<{command,command_id}>, deleted: string[],
+ *   existing: string[], external: string[], failed: Array<{command,error}>,
+ *   changed: boolean, superseded: boolean }} `superseded` marks a run that
+ *   stopped early because a newer panel config took over; it reports what it
+ *   managed to do, and the newer run converges the panel from there.
+ */
+export async function syncSlashCommands({
+  appId, appSecret, domain = 'feishu', httpInstance, timeoutMs = 15000,
+  signal, manifest = SLASH_COMMAND_MANIFEST, config = null,
+  intervalMs = SLASH_PANEL_CREATE_INTERVAL_MS, wait = defaultWait,
+}) {
+  // A superseded run — the runtime aborts this signal when a newer panel config
+  // arrives — must not send further create/delete calls: the newer run re-reads
+  // the panel and converges it, and letting both write would leave the older
+  // plan's commands behind. Requests already in flight are left to finish.
+  const stopped = () => signal?.aborted === true;
+  const tenantAccessToken = await fetchTenantAccessToken({
+    appId, appSecret, domain, httpInstance, timeoutMs, signal,
+  });
+  const items = await listSlashCommandsWithToken({
+    tenantAccessToken, domain, httpInstance, timeoutMs, signal,
+  });
+  const owned = new Set(manifest.map((entry) => commandNameOf(entry)).filter(Boolean));
+  const external = items
+    .map((item) => commandNameOf(item))
+    .filter((name) => name && !owned.has(name));
+  const registered = new Set(
+    items.map((item) => commandNameOf(item)).filter(Boolean),
+  );
+
+  if (!isCustomSlashPanel(config)) {
+    const created = [];
+    const failed = [];
+    for (const entry of resolveSlashPanelManifest(config, manifest)) {
+      if (stopped()) break;
+      const command = commandNameOf(entry);
+      if (!command || registered.has(command)) continue;
+      try {
+        const commandId = await createSlashCommandWithToken({
+          tenantAccessToken, domain, httpInstance, timeoutMs, signal,
+          command,
+          description: slashPanelDescription(entry, command),
+          icon: entry.icon ?? DEFAULT_ICON,
+        });
+        created.push({ command, command_id: commandId });
+        registered.add(command);
+      } catch (error) {
+        if (stopped()) break;
+        if (error?.code === '40000000' && /already exists/i.test(error?.msg ?? '')) {
+          registered.add(command);
+          continue;
+        }
+        failed.push({ command, error: error?.message ?? String(error) });
+        if (MISSING_PERMISSION_CODES.has(error?.code)
+          || /(?:lacks permission|access denied)/i.test(error?.msg ?? '')) {
+          break;
+        }
+      }
+    }
+    return {
+      created,
+      deleted: [],
+      existing: [...registered].filter(Boolean),
+      external,
+      failed,
+      changed: created.length > 0,
+      superseded: stopped(),
+    };
+  }
+
+  const current = orderedOwnedNames(items, owned);
+  const plannedEntries = resolveSlashPanelManifest(config, manifest)
+    .filter((entry) => commandNameOf(entry));
+  const plannedNames = plannedEntries.map((entry) => commandNameOf(entry));
+  if (current.length === plannedNames.length
+    && plannedNames.every((name, index) => name === current[index])) {
+    return {
+      created: [], deleted: [], existing: current, external, failed: [], changed: false,
+    };
+  }
+
+  // A newer config took over while we were reading the panel: leave the rebuild
+  // to its run rather than deleting commands for a plan nobody wants anymore.
+  if (stopped()) {
+    return {
+      created: [], deleted: [], existing: current, external, failed: [], changed: false, superseded: true,
+    };
+  }
+
+  const byName = new Map(
+    items.map((item) => [commandNameOf(item), item]).filter(([name]) => name && owned.has(name)),
+  );
+  const deleted = [];
+  const failed = [];
+  for (const name of current) {
+    if (stopped()) break;
+    const item = byName.get(name);
+    if (!item?.command_id) {
+      failed.push({ command: name, error: 'the registered command reports no command_id' });
+      continue;
+    }
+    try {
+      await deleteSlashCommandWithToken({
+        tenantAccessToken, domain, httpInstance, timeoutMs, signal, commandId: item.command_id,
+      });
+      deleted.push(name);
+    } catch (error) {
+      if (stopped()) break;
+      failed.push({ command: name, error: error?.message ?? String(error) });
+    }
+  }
+  // A superseded run stops before rebuilding: the newer run owns the panel now.
+  if (stopped()) {
+    return {
+      created: [], deleted, existing: current, external, failed, changed: deleted.length > 0, superseded: true,
+    };
+  }
+  // Deleting only part of the panel would leave it half-converged, and
+  // recreating a name that still exists is rejected as a duplicate. Stop here;
+  // the next sync (config change, reconnect, or a later start) converges.
+  if (failed.length > 0) {
+    return { created: [], deleted, existing: current, external, failed, changed: deleted.length > 0 };
+  }
+
+  const created = [];
+  for (const [index, entry] of [...plannedEntries].reverse().entries()) {
+    if (stopped()) break;
+    const command = commandNameOf(entry);
+    try {
+      if (index > 0) {
+        await wait(intervalMs, signal);
+        // The wait wakes on abort as well, so re-check instead of recording a
+        // superseded run as a failed create.
+        if (stopped()) break;
+      }
+      const commandId = await createSlashCommandWithToken({
+        tenantAccessToken, domain, httpInstance, timeoutMs, signal,
+        command,
+        description: slashPanelDescription(entry, command),
+        icon: entry.icon ?? DEFAULT_ICON,
+      });
+      created.push({ command, command_id: commandId });
+    } catch (error) {
+      if (stopped()) break;
+      failed.push({ command, error: error?.message ?? String(error) });
+      if (MISSING_PERMISSION_CODES.has(error?.code)
+        || /(?:lacks permission|access denied)/i.test(error?.msg ?? '')) {
+        break;
+      }
+    }
+  }
+
+  return {
+    created,
+    deleted,
+    existing: [],
+    external,
+    failed,
+    changed: created.length > 0 || deleted.length > 0,
+    superseded: stopped(),
+  };
+}
+
 export default registerSlashCommands;

package/src/channels/shared/context-enhancement.mjs

@@ -1,7 +1,7 @@
 // Shared by the Host and settings UI; keep this module browser-compatible.
 export const CONTEXT_ENHANCEMENT_FIELDS = Object.freeze([
   'channel', 'conversationType', 'senderId', 'senderName', 'conversationTitle',
-  'chatId', 'threadId', 'botId',
+  'chatId', 'threadId', 'botId', 'sentAt',
 ]);
 
 /**
@@ -56,7 +56,7 @@ const CHANNELS = new Set([
 ]);
 const SOURCE_LIMITS = {
   channel: 16, conversationType: 6, senderId: 256, senderName: 256,
-  conversationTitle: 256, chatId: 256, threadId: 256, botId: 128,
+  conversationTitle: 256, chatId: 256, threadId: 256, botId: 128, sentAt: 32,
 };
 const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g;
 
@@ -82,7 +82,7 @@ function validateContextEnhancementScope(input) {
     throw invalidConfig('群聊和私聊开关必须是布尔值。');
   }
   if (!Array.isArray(fields) || ![...fields].every((field) => CONTEXT_ENHANCEMENT_FIELDS.includes(field))) {
-    throw invalidConfig('来源字段只能选择已定义的八个字段。');
+    throw invalidConfig('来源字段只能选择已定义的字段。');
   }
   if (typeof guidance !== 'string' || guidance.length > CONTEXT_ENHANCEMENT_GUIDANCE_MAX_LENGTH) {
     throw invalidConfig(`增强提示词不得超过 ${CONTEXT_ENHANCEMENT_GUIDANCE_MAX_LENGTH} 个字符。`);
@@ -155,6 +155,70 @@ export function captureContextEnhancement(provider, conversationType) {
   }
 }
 
+/**
+ * Property a channel hangs its captured moment on, using `withSentAt`.
+ *
+ * It sits on the source factory instead of being read out of it, because a
+ * factory reads the inbound event's fields -- sometimes through throwing
+ * getters -- and only a prompt that actually renders a source block may do
+ * that. Local commands (`/help`, `/new`, `/steer`) take the enhancement to keep
+ * its privacy rules but never read a source, and that must stay true.
+ */
+const SENT_AT = 'sentAt';
+
+/** One-shot latch: a wiring bug is worth saying once, not once per message. */
+let warnedMissingSentAt = false;
+
+/**
+ * Wrap one channel source factory so it also publishes the moment of the
+ * message, without reading any of the message's fields yet.
+ *
+ * `value` may itself be a thunk: a channel that derives the moment from the
+ * inbound event (a `create_time_ms` field, a message-id decode) should pass one,
+ * because evaluating it here would read the inbound message even when the scope
+ * is disabled or the `sentAt` field is not selected -- and a disabled scope must
+ * read nothing at all.
+ *
+ * @param factory - the channel's source factory, or nothing.
+ * @param value - platform send time (epoch ms or ISO-8601), or a thunk
+ *   returning one. It is evaluated only when a rendered block selects `sentAt`;
+ *   an unusable value, or a thunk that throws, omits the field.
+ * @returns the same shape, plus `sentAt` when a usable value was supplied.
+ */
+export function withSentAt(factory, value) {
+  const wrapped = typeof factory === 'function' ? (...args) => factory(...args) : () => factory;
+  const published = typeof value === 'function' ? value : () => value;
+  Object.defineProperty(wrapped, SENT_AT, { value: published, enumerable: false });
+  return wrapped;
+}
+
+/**
+ * Evaluate the moment a channel published, without invoking its source factory.
+ *
+ * Called only while a prompt is rendering a block that selected `sentAt` --
+ * never at capture time -- so an unselected field, a disabled scope, a missing
+ * provider or a local command never reads the inbound message's clock. A
+ * throwing accessor (for example a getter on the inbound event) is contained
+ * here: it costs this one field, not the message.
+ *
+ * @param source - a source factory carrying `sentAt`, or a plain source object.
+ * @returns `{ published, ms }`: whether a moment was published at all, and its
+ *   epoch milliseconds when it was usable.
+ */
+function readPublishedSentAt(source) {
+  const own = typeof source === 'function' || (source !== null && typeof source === 'object')
+    ? source?.[SENT_AT]
+    : undefined;
+  if (typeof own !== 'function') return { published: false, ms: undefined };
+  let value;
+  try {
+    value = own();
+  } catch {
+    return { published: true, ms: undefined };
+  }
+  return { published: true, ms: timestampMs(value) ?? undefined };
+}
+
 /**
  * Capture the enhancement one prompt replays, together with the source factory
  * that fills its selected fields.
@@ -167,12 +231,55 @@ export function captureContextEnhancement(provider, conversationType) {
  *
  * @param provider - the bot's enhancement provider.
  * @param conversationType - the inbound message's scope.
- * @param source - factory for the currently selected source fields.
+ * @param source - factory for the currently selected source fields; attach the
+ *   moment with `withSentAt` to publish a platform send time.
  * @returns the enhancement to apply, or null when the scope is off.
  */
 export function captureContextEnhancementSource(provider, conversationType, source) {
+  // No provider means enhancement is not configured for this channel at all, so
+  // there is nothing to capture -- and the thunk a channel published must not be
+  // evaluated. Answering null here is what lets every channel call this
+  // unconditionally, including bots with no enhancement settings.
+  if (typeof provider?.getSettings !== 'function') return null;
   const snapshot = captureContextEnhancement(provider, conversationType);
-  return snapshot === null ? null : Object.freeze({ snapshot, source });
+  if (snapshot === null) return null;
+  // Nothing is read here -- not the message's fields and not the moment a
+  // channel published through `withSentAt`. Local commands capture too (to keep
+  // the privacy rules for a later prompt) but never render, and a capture whose
+  // scope does not select `sentAt` must never touch the clock; the moment is
+  // evaluated only by the render that actually needs it.
+  return Object.freeze({ snapshot, source });
+}
+
+/** Accept a millisecond epoch or an ISO-8601 string; anything else yields null. */
+function timestampMs(value) {
+  if (value === undefined || value === null || value === '') return null;
+  if (typeof value === 'bigint') value = Number(value);
+  if (typeof value === 'number') return Number.isSafeInteger(value) ? value : null;
+  if (typeof value === 'string') {
+    const parsed = Date.parse(value);
+    return Number.isSafeInteger(parsed) ? parsed : null;
+  }
+  return null;
+}
+
+/**
+ * Render one epoch instant as `YYYY-MM-DD HH:mm:ss` in local time. The zone is
+ * deliberately omitted: four independent components already carry the digits,
+ * and the guidance text is the place to name the timezone.
+ *
+ * Padding is spelled out per component instead of calling a module-level
+ * helper: `sourceBlock` can run while this module is still initializing, and
+ * reading a `const` declared below would throw a temporal-dead-zone error that
+ * the caller's catch silently swallows -- dropping the entire prefix.
+ */
+function formatTimestamp(ms) {
+  const date = new Date(ms);
+  const year = date.getFullYear();
+  if (!Number.isInteger(year)) return undefined;
+  const pad = (value) => String(value).padStart(2, '0');
+  return `${year}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`
+    + ` ${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
 }
 
 function sourceString(value, field) {
@@ -193,6 +300,25 @@ function sourceBlock(snapshot, sourceFactory) {
   const source = needsSource ? sourceFactory?.() : null;
   const projected = {};
   for (const field of fields) {
+    if (field === 'sentAt') {
+      // Only a channel that published a moment through `withSentAt` renders
+      // this field, and the moment is evaluated here, the first and only time
+      // it is needed. A field the factory returns is never read for it: a
+      // channel that did not wire a moment omits the field rather than fall
+      // back to the local clock, which the model could not tell apart.
+      const { published, ms } = readPublishedSentAt(sourceFactory);
+      const formatted = ms === undefined ? undefined : formatTimestamp(ms);
+      if (typeof formatted === 'string' && formatted) {
+        projected[field] = formatted.slice(0, SOURCE_LIMITS[field]);
+      } else if (published && !warnedMissingSentAt) {
+        // The channel did publish a moment but it was unusable or failed to
+        // read: say so once, because the omitted field is otherwise
+        // indistinguishable from a channel that supplies none.
+        warnedMissingSentAt = true;
+        console.warn('[dsh-im] a published sentAt was unusable and was omitted from the block');
+      }
+      continue;
+    }
     const value = field === 'botId' || field === 'conversationType'
       ? snapshot[field] : source?.[field];
     const normalized = sourceString(value, field);
@@ -213,11 +339,26 @@ function guidanceBlock(guidance) {
   return `${INJECTED_CONTEXT_TAGS.guidanceOpen}\n${body}\n${INJECTED_CONTEXT_TAGS.guidanceClose}`;
 }
 
-/** Add one text prefix; never inspect sources, format or copy content when off. */
+/**
+ * Add one text prefix; never inspect sources, format or copy content when off.
+ *
+ * @param content - the message body the channel is about to send.
+ * @param snapshot - either a capture from `captureContextEnhancementSource`
+ *   (which already carries the moment and its own source) or a bare scope
+ *   snapshot from `captureContextEnhancement`.
+ * @param sourceFactory - the channel's source factory, when the caller holds it
+ *   separately from the capture. Omit it for a capture: the capture's own
+ *   factory and moment are used, so a `sentAt` selection cannot be lost by
+ *   passing only its `.snapshot`.
+ */
 export function enhanceContextContent(content, snapshot, sourceFactory) {
   if (!snapshot) return content;
+  // A capture is `{snapshot, source}`; a bare scope is `{config, ...}`.
+  const scope = snapshot.config ? snapshot : snapshot.snapshot;
+  if (!scope?.config) return content;
+  const factory = sourceFactory ?? (snapshot.config ? undefined : snapshot.source);
   try {
-    const blocks = [sourceBlock(snapshot, sourceFactory), guidanceBlock(snapshot.config.guidance)]
+    const blocks = [sourceBlock(scope, factory), guidanceBlock(scope.config.guidance)]
       .filter(Boolean);
     if (blocks.length === 0) return content;
     const prefix = blocks.join(INJECTED_CONTEXT_SEPARATOR);

package/src/channels/shared/i18n-en/feishu.mjs

@@ -1,5 +1,10 @@
 // English translations (feishu area). Keys are exact Chinese literals passed to t().
 export default {
+  '已结束本轮提问，将在当前会话中继续处理图片。':
+    'The questions have been closed. Your image will be processed in this conversation.',
+  '图片已排队，但暂时无法结束当前提问。请先回答问题或发送 /stop，结束后会继续处理图片。':
+    'Your image is queued, but the current questions could not be closed. Answer them or send /stop; your image will be processed afterward.',
+  '⏹ 提问已结束{progress}': '⏹ Questions closed{progress}',
   '内容已合并至后续消息。': 'Content has been consolidated into the following messages.',
   // feishu/bridge.mjs — welcome / help
   '北汇星河 AIOS 已连接 DeepSeek Harness。':

package/src/channels/weixin/weixin-bridge.mjs

@@ -40,6 +40,7 @@ import {
   captureContextEnhancement,
   captureContextEnhancementSource,
   enhanceContextContent,
+  withSentAt,
 } from '../shared/context-enhancement.mjs';
 import {
   hasInboundImages,
@@ -398,9 +399,20 @@ export class WeixinHarnessBridge {
       this.#acceptedMessageIds.set(messageId, null);
       return this.#finishAccessDecision(messageId, sender, message, access);
     }
-    this.#acceptedMessageIds.set(messageId, captureContextEnhancement(
+    // Capture through the *source* entry point, not the bare config snapshot:
+    // the enhancement that renders the user message is read back from this map
+    // at prompt time, and a rendered `sentAt` selection needs the factory that
+    // carries the moment. Nothing is read here; the thunk runs only when that
+    // render selects `sentAt`.
+    this.#acceptedMessageIds.set(messageId, captureContextEnhancementSource(
       this.#contextEnhancement,
       'direct',
+      withSentAt(
+        () => ({ channel: 'weixin', senderId: sender, chatId: sender }),
+        // A thunk: the platform send time (falling back to the iLink message-id
+        // clock) is only decoded when a `sentAt` selection actually renders.
+        () => message?.create_time_ms ?? weixinMessageTimestampMs(messageId),
+      ),
     ));
     if (sender === this.#ownerUserId) {
       rememberConnectionTestTarget(this.#state, { toUserId: sender });
@@ -717,7 +729,14 @@ export class WeixinHarnessBridge {
       enhancement: captureContextEnhancementSource(
         this.#contextEnhancement,
         'direct',
-        () => ({ channel: 'weixin', senderId: sender, chatId: sender }),
+        // The moment rides on the factory as a thunk, so a local command that
+        // never renders a source block -- and a scope that is off or does not
+        // select `sentAt` -- reads nothing from the inbound message.
+        withSentAt(
+          () => ({ channel: 'weixin', senderId: sender, chatId: sender }),
+          // Platform send time, falling back to the iLink message-id clock.
+          () => message?.create_time_ms ?? weixinMessageTimestampMs(messageId),
+        ),
       ),
     });
     if (result?.stopped) {
@@ -817,15 +836,14 @@ export class WeixinHarnessBridge {
         let content = hasImages || hasReply
           ? await promptContentForInboundMessage(promptMessage, { signal: this.#signal, deferImages: true })
           : undefined;
-        const snapshot = this.#acceptedMessageIds.get(messageId);
+        const captured = this.#acceptedMessageIds.get(messageId);
         let contextEnhanced = false;
-        if (snapshot) {
+        if (captured) {
           const originalContent = content ?? text;
-          content = enhanceContextContent(originalContent, snapshot, () => ({
-            channel: 'weixin',
-            senderId: sender,
-            chatId: sender,
-          }));
+          // The capture already carries the moment its own source published, so
+          // `enhanceContextContent` accepts it as-is: passing only `.snapshot`
+          // here would drop `sentAt` and silently render no block at all.
+          content = enhanceContextContent(originalContent, captured);
           contextEnhanced = content !== originalContent;
         }
         await this.#state.markSeen(messageId);
@@ -838,7 +856,7 @@ export class WeixinHarnessBridge {
           text,
           content,
           titleText: batchSubmission?.title,
-          sourceGuidance: snapshot?.config?.guidance,
+          sourceGuidance: captured?.snapshot?.config?.guidance,
           contextEnhanced,
           createOptions: { signal: this.#signal },
           existsOptions: { signal: this.#signal },