botmux 3.13.0 → 3.14.0

package/dist/core/worker-pool.js

@@ -24,6 +24,7 @@ import { fallbackTurnId, frozenReplyContextForTurn, isSubstituteTurn } from './r
 import { updateMessage, deleteMessage, sendEphemeralCard, sendUserMessage, addReaction, removeReaction, getMessageChatId, MessageWithdrawnError } from '../im/lark/client.js';
 import { buildStreamingCard, buildPrivateSnapshotCard, buildSessionCard, buildTuiPromptCard, buildTuiPromptResolvedCard, buildTuiPromptFailedCard, buildRelayedFrozenCard, getCliDisplayName } from '../im/lark/card-builder.js';
 import { codexServiceTierBadge } from '../services/codex-service-tier.js';
+import { codexModelSupportsReasoningEffort, isCodexReasoningCliId } from '../services/codex-reasoning-effort.js';
 import { loadFrozenCards, saveFrozenCards } from '../services/frozen-card-store.js';
 import { hashUrlForLog } from '../adapters/backend/riff-backend.js';
 import { logger } from '../utils/logger.js';
@@ -33,7 +34,7 @@ import { traeHome } from '../services/traex-paths.js';
 import { botLocale, localeForBot, t as tr } from '../i18n/index.js';
 import { claudeJsonlPathForSession } from '../adapters/cli/claude-code.js';
 import { findUniqueClaudeSessionByCwd } from './session-discovery.js';
-import { buildMarkdownCard, buildContextualReplyCard, } from '../im/lark/md-card.js';
+import { buildCanonicalFinalReplyCard, buildContextualReplyCard, } from '../im/lark/md-card.js';
 import { getSessionUsageSnapshot } from './cost-calculator.js';
 import { renderBrandTemplate } from '../im/lark/brand-template.js';
 import { replyToDocComment, chunkCommentText, unsubscribeDocFile, removeCommentReaction } from '../im/lark/doc-comment.js';
@@ -50,6 +51,7 @@ import { getBot, getAllBots, resolveBrandLabel, getLoadedConfigPath, getLoadedCo
 import { RestartCoordinator } from './restart-coordinator.js';
 import { runtimeBuildIdentity } from '../utils/runtime-build-id.js';
 import { scrubWorkflowWorkerEnv } from '../utils/child-env.js';
+import { resolveFeedbackPolicyForDelivery, resolveFeedbackTeamId } from '../services/feedback-policy-resolver.js';
 /** A random id minted once per daemon process (this lifetime). Stamped onto
  *  isolated persistent panes so a suspend→resume reattach (same id) is
  *  distinguishable from a pane surviving a daemon restart (different id). */
@@ -743,6 +745,9 @@ function sessionAgentConfig(ds, botCfg) {
             ?? botCfg.cliPathOverride;
         ds.session.wrapperCli = ds.session.wrapperCli ?? botCfg.wrapperCli;
         ds.session.model = ds.session.model ?? botCfg.model;
+        ds.session.reasoningEffort = isCodexReasoningCliId(ds.session.cliId)
+            ? ds.session.reasoningEffort ?? botCfg.reasoningEffort
+            : undefined;
         ds.session.agentFrozen = true;
         sessionStore.updateSession(ds.session);
     }
@@ -774,6 +779,11 @@ function sessionAgentConfig(ds, botCfg) {
         if (repaired)
             sessionStore.updateSession(ds.session);
     }
+    if (ds.session.reasoningEffort
+        && !codexModelSupportsReasoningEffort(ds.session.model, ds.session.reasoningEffort)) {
+        ds.session.reasoningEffort = undefined;
+        sessionStore.updateSession(ds.session);
+    }
     return {
         cliId: ds.session.cliId ?? botCfg.cliId,
         cliRuntime: ds.session.cliRuntime,
@@ -807,7 +817,7 @@ function loadKnownBotOpenIdsForApp(larkAppId) {
  *  mircli runner). They can't @-trigger a peer bot themselves, so for bot-to-bot
  *  handoffs the fallback card must carry the real <at> back to the dispatcher. */
 function isRunnerDeliveryCli(cliId) {
-    return cliId === 'mira' || cliId === 'mir';
+    return cliId === 'mira' || cliId === 'mir' || cliId === 'dsh';
 }
 function daemonCardFooterRecipientOpenId(ds, effectiveCliId) {
     const owner = ds.session.ownerOpenId;
@@ -1410,17 +1420,23 @@ export async function deliverSubstituteControlCard(ds) {
  * reply (`reply`). `content` is the card JSON when msgType==='interactive',
  * otherwise the plain text. Topic-group / p2p behavior is unchanged.
  *
- * IMPORTANT: ephemeral is only attempted for flat **chat-scope** sessions. The
+ * IMPORTANT: ephemeral is only attempted for a flat **chat-scope** destination. The
  * ephemeral API (`ephemeral/v1/send`) takes a `chat_id` only — it has no
  * thread/root anchoring — so for a **thread-scope** session (a 话题 inside a
  * 普通群, or a 话题群 topic) an ephemeral card would escape the topic and land at
- * the group top-level. 话题群 happened to reject ephemeral with 18053 and fall
- * back to the in-thread reply, but a 话题 inside a 普通群 succeeds and leaks the
- * card out of the thread. So thread-scope sessions always take the visible
- * `reply()` path, which routes back into the thread (`reply_in_thread`).
+ * the group top-level. The same applies when a chat-scope session is invoked
+ * from a folded thread: callers pass its frozen reply target, and any explicit
+ * thread/quote destination takes the visible `reply()` path.
  */
-export async function deliverEphemeralOrReply(ds, operatorOpenId, content, msgType, reply) {
-    if (operatorOpenId && ds.chatType !== 'p2p' && ds.scope === 'chat') {
+export async function deliverEphemeralOrReply(ds, operatorOpenId, content, msgType, reply, replyTarget) {
+    // A chat-scope session can still be invoked from a folded thread. The
+    // ephemeral API has no root/thread field, so an explicitly frozen thread or
+    // quote target must take the visible reply path even though the session
+    // itself remains chat-scoped.
+    const allowsEphemeral = replyTarget
+        ? replyTarget.mode === 'plain'
+        : ds.scope === 'chat';
+    if (operatorOpenId && ds.chatType !== 'p2p' && allowsEphemeral) {
         try {
             // The ephemeral API is card-only (msg_type=text → 10003), so wrap a plain
             // confirmation line into a minimal markdown card.
@@ -2369,6 +2385,30 @@ function reclaimParkedCrashDiagnostic(ds) {
     }
     catch { /* absent — benign */ }
 }
+/**
+ * Consume a queued suspend claim once its goal state is reached.
+ *
+ * A claim only ever means "suspend the generation that is producing right now".
+ * It is therefore consumed the moment that generation stops running, by ANY
+ * route — the deferred checkpoint itself, a `/cd` or read-isolation switch that
+ * suspended first, or an outright crash. Leaving it set is not a harmless
+ * no-op: `runPendingSuspendIfSettled` fires on the NEXT generation's first
+ * screen checkpoint, and its `ownsGeneration` predicate passes there (that
+ * worker legitimately owns the session), so the replacement gets suspended for
+ * a request that was never about it.
+ *
+ * The old code did have a "worker already gone → drop the flag" branch, but it
+ * lived inside the checkpoint — which by definition stops running once the
+ * session goes quiet. The clear needs to hang off the lifecycle events instead.
+ */
+function clearPendingSuspendClaim(ds, why) {
+    if (ds.pendingSuspendReason === undefined && ds.pendingSuspendGeneration === undefined)
+        return;
+    const reason = ds.pendingSuspendReason;
+    ds.pendingSuspendReason = undefined;
+    ds.pendingSuspendGeneration = undefined;
+    logger.debug(`[${tag(ds)}] Cleared queued suspend claim (${reason ?? 'none'}): ${why}`);
+}
 export function suspendWorker(ds, reason = 'suspended_idle') {
     if (hasProtectedSessionMutationOwnership(ds)) {
         logger.warn(`[${tag(ds)}] Refused worker suspend (${reason}) while Codex App dispatch ownership is non-empty`);
@@ -2444,9 +2484,99 @@ export function suspendWorker(ds, reason = 'suspended_idle') {
             },
         });
     }
+    // Goal state reached. Whoever queued a suspend for this generation got what
+    // they asked for — including the paths that never touch the deferred
+    // checkpoint (`/cd`, read-isolation switch, sweepIdleWorkers).
+    clearPendingSuspendClaim(ds, `suspended (${reason})`);
     logger.info(`[${tag(ds)}] Worker + CLI suspended (${reason}); session stays active, cold-resumes from transcript on next message`);
     return true;
 }
+/**
+ * Cash in a queued suspend. Called once the session leaves the producing states
+ * it was queued for; a no-op during working/analyzing — that IS why it queued.
+ *
+ * Callers MUST defer this out of the status handler's synchronous body
+ * (queueMicrotask) — suspendWorker clears `ds.worker` and `ds.lastScreenStatus`,
+ * and the rest of that handler still reads both to record the usage delta, flip
+ * the turn reaction ✋→✅, emit the state-transition hook, and render the final
+ * card. Running it inline would skip exactly the turn-completion bookkeeping
+ * this whole feature exists to protect.
+ *
+ * `ownsGeneration` is the calling handler's generation check (`ownsWorkerSession`),
+ * and it is **defense-in-depth** — not a guard against a race anyone has shown to
+ * be reachable today. Two earlier drafts of this comment each claimed a concrete
+ * race; both were wrong, so the reasoning is spelled out here to stop a third:
+ *
+ *   - It is NOT "a stale worker's late `idle` reaches `screenshot_uploaded`":
+ *     the message handler's fence (`if (ds.worker !== worker) return`) sits
+ *     BEFORE the switch and already drops every message from a replaced worker.
+ *   - It is NOT "two microtasks in one tick, the first suspends + re-forks and
+ *     the second meets the replacement": `suspendWorker` only nulls `ds.worker`,
+ *     it never re-forks (a re-fork is driven by external input, i.e. a later
+ *     MACROtask), and the microtask queue drains without letting one in. The
+ *     second microtask therefore sees `ds.worker === null` and this predicate
+ *     early-returns on that — a replacement is not what it meets.
+ *
+ * What it does buy: a queued callback can only ever act while its own generation
+ * still owns the session. That keeps this deferral safe against future callers,
+ * new synchronous side effects between enqueue and drain, and any path that
+ * starts re-forking earlier than today. Consuming the claim is a destructive act
+ * on a live worker, so it is worth gating even without a demonstrated race.
+ * A checkpoint from a generation that no longer owns the session keeps the flag
+ * pending; only the owning generation may consume it.
+ *
+ * Deliberately the generation check ALONE, not `ownsLifecycleMutation` (which
+ * also folds in "not transferring"): a routing transfer is a temporary refusal,
+ * not a lost claim, and it is suspendWorker's own guard to make. Screen updates
+ * stop once a session sits quiet, so treating transfer as "not ours" would park
+ * the flag with no later checkpoint to revive it — hence the explicit
+ * transfer-settled retry below.
+ */
+function runPendingSuspendIfSettled(ds, ownsGeneration) {
+    const reason = ds.pendingSuspendReason;
+    if (!reason)
+        return;
+    if (ownsGeneration && !ownsGeneration())
+        return;
+    // A claim belongs to the generation that was producing when it was queued.
+    // Reaching a LATER generation means its own fulfilment checkpoint never ran
+    // (crash, or another path suspended first) — consume it rather than suspend a
+    // worker the request never asked about. clearPendingSuspendClaim covers the
+    // normal exits; this is the backstop for a claim that slipped past them.
+    if (ds.pendingSuspendGeneration !== undefined
+        && ds.workerGeneration !== undefined
+        && ds.pendingSuspendGeneration !== ds.workerGeneration) {
+        clearPendingSuspendClaim(ds, 'generation changed');
+        return;
+    }
+    const st = ds.lastScreenStatus;
+    if (st !== 'idle' && st !== 'limited')
+        return;
+    // Worker already gone (crash / suspended by another path): the goal state is
+    // reached, so drop the flag. Falling through to suspendWorker would take its
+    // no-worker branch and clear managedTurnOrigin/workerReady for a generation
+    // this queued request never owned.
+    if (!ds.worker || ds.worker.killed) {
+        clearPendingSuspendClaim(ds, 'worker already gone');
+        return;
+    }
+    // Clear only on success. suspendWorker refuses mid-routing-transfer (and for a
+    // backend that stopped being suspendable), and that refusal is temporary —
+    // eating the flag would silently drop the request until the next `suspend all`.
+    if (suspendWorker(ds, reason)) {
+        // suspendWorker already consumed the claim (goal state reached); logging
+        // here keeps the "fulfilled by the deferred path" signal distinguishable
+        // from a suspend that came from anywhere else.
+        logger.info(`[${tag(ds)}] Deferred suspend fulfilled (${reason}) after turn completed`);
+        return;
+    }
+    // Refused by an in-flight transfer: keeping the flag is not enough on its own.
+    // A settled session emits no further screen updates, so there may be no next
+    // checkpoint — re-run when the relay gate releases. Returns false when no
+    // transfer is active (a non-transfer refusal, e.g. pty), which needs no retry.
+    deferUntilSessionTransferSettled(ds, () => runPendingSuspendIfSettled(ds, ownsGeneration));
+}
+export const __testOnly_runPendingSuspendIfSettled = runPendingSuspendIfSettled;
 function armWorkerKillBackstop(w, label, sigtermMs = WORKER_SIGTERM_BACKSTOP_MS) {
     const sigterm = setTimeout(() => {
         if (w.exitCode === null && w.signalCode === null) {
@@ -4028,7 +4158,7 @@ export async function forkSession(sessionId, targetChatId, targetRootMessageId,
     //   • model / reasoningEffort / cliPathOverride / wrapperCli / agentFrozen:
     //     without these the child's sessionAgentConfig() sees !agentFrozen and
     //     re-freezes from the CURRENT bot config, silently dropping any per-session
-    //     /model or /effort override the source carried (reasoningEffort has no
+    //     model or effort override the source carried (reasoningEffort has no
     //     botCfg fallback at all → drops to undefined). Copying the frozen tuple
     //     keeps the clone's launch identity == the source's.
     // readIsolation is intentionally NOT copied: it is not a persisted Session
@@ -5523,6 +5653,8 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         });
         // Send init config — use per-bot settings
         const runtimeIdentity = runtimeBuildIdentity();
+        const feedbackPolicy = resolveFeedbackPolicyForDelivery({ dataDir: config.session.dataDir, larkAppId: ds.larkAppId, chatId: ds.chatId, bot: botCfg });
+        ds.feedbackPolicy = feedbackPolicy;
         initMsg = {
             type: 'init',
             sessionId: ds.session.sessionId,
@@ -5609,6 +5741,7 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             // Feishu (uploader/cred-write are also skipped downstream on the same test).
             larkAppSecret: larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }) ? botCfg.larkAppSecret : '',
             apiOnly: botCfg.apiOnly,
+            feedback: feedbackPolicy,
             // Freeze the ACTUAL loaded bots-config path (getLoadedConfigPath) so a
             // no-transport worker's fs-policy denies it from a HOST-owned fact, not a
             // guess off BOTS_CONFIG env (which the agent could see/forge). When it lives
@@ -6583,6 +6716,11 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 updateUsageLimitState(ds, msg.usageLimit);
                 ds.lastScreenContent = msg.content;
                 ds.lastScreenStatus = (msg.usageLimit ?? ds.usageLimit) ? 'limited' : msg.status;
+                // A suspend that arrived mid-turn parked itself here. Defer until this
+                // screen_update has finished using process state — suspendWorker nulls
+                // `worker` + `lastScreenStatus`, which everything below still reads
+                // (usage ledger, turn reactions, transition hook, final card).
+                queueMicrotask(() => runPendingSuspendIfSettled(ds, ownsWorkerSession));
                 // State-boundary clear: the moment we leave `working` (→ idle/limited),
                 // stop the periodic usage refresh immediately — BEFORE the aux-UI /
                 // card-disabled / recovery early-breaks below, which would otherwise
@@ -6771,6 +6909,14 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 const prevStatus = ds.lastScreenStatus;
                 updateUsageLimitState(ds, msg.usageLimit);
                 ds.lastScreenStatus = (msg.usageLimit ?? ds.usageLimit) ? 'limited' : msg.status;
+                // Same deferred-suspend checkpoint as the screen_update branch, and
+                // deferred for the same reason (see runPendingSuspendIfSettled).
+                // The predicate is defense-in-depth here: the handler's fence already
+                // dropped every message from a replaced worker before the switch, so a
+                // stale `idle` cannot reach this case at all. Passing it keeps the
+                // deferred callback from acting on a generation that stopped owning the
+                // session between enqueue and drain.
+                queueMicrotask(() => runPendingSuspendIfSettled(ds, ownsWorkerSession));
                 emitSessionStateTransitionHook(ds, prevStatus, ds.lastScreenStatus, {
                     source: 'screenshot_uploaded',
                     imageKey: msg.imageKey,
@@ -7538,12 +7684,13 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     logger.warn(`[${t}] Dropped managed_turn_origin with mismatched sessionId`);
                     break;
                 }
-                // macOS uses one stable per-session pathname visible inside Seatbelt.
+                // Isolated children use one stable per-session pathname visible through
+                // an exact Seatbelt/bwrap read carve-out.
                 // Only the daemon handler for the CURRENT ChildProcess generation may
                 // replace it. Stale workers can still emit IPC, but the identity guard
                 // above drops them before filesystem mutation, so they cannot overwrite
                 // a successor capability (or unlink it during teardown).
-                if (process.platform === 'darwin' && msg.originChannelId) {
+                if (msg.originChannelId) {
                     if (!/^[a-f0-9]{64}$/.test(msg.originChannelId)) {
                         ds.managedTurnOrigin = undefined;
                         logger.error(`[${t}] Refused managed origin publication with an invalid pane channel`);
@@ -7971,6 +8118,11 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
             ds.worker = null;
             ds.workerReady = false;
             ds.workerPort = null;
+            // A queued suspend for THIS generation is now moot — the worker it was
+            // about is gone. Leaving it set would suspend the replacement on its
+            // first idle (the deferred checkpoint's own "worker gone" branch cannot
+            // help: it only runs on a screen update that will never arrive).
+            clearPendingSuspendClaim(ds, 'worker exited');
             // Dead worker generation — stop the periodic usage refresh immediately
             // instead of waiting a tick for it to self-clear on !workerHasInitialized.
             clearUsageRefreshTimer(ds);
@@ -8038,6 +8190,25 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
 // ─── Bridge final-output delivery (with retry) ──────────────────────────────
 const FINAL_OUTPUT_RETRY_BACKOFF_MS = [0, 5000, 15000]; // immediate, +5s, +15s
 const codexAppFinalSettlementInFlight = new Map();
+/**
+ * Shutdown-only view of the in-flight Codex App final-settlement promises. Each
+ * entry is a `deliverFinalOutput` awaited inside the IPC message handler that
+ * has NOT yet reached its `cb.onTurnTerminal` call; a settlement resolving
+ * enqueues the turn terminal. During graceful shutdown, after all worker IPC
+ * channels have disconnected (so no NEW settlement can be created), the daemon
+ * bounded-waits these to settle BEFORE closing the turn-terminal queue
+ * admission — otherwise a settlement that resolves post-close would have its
+ * terminal refused and lost. Returns a snapshot array (safe to Promise.all).
+ */
+export function snapshotCodexAppFinalSettlements() {
+    return [...codexAppFinalSettlementInFlight.values()];
+}
+/** Current in-flight Codex App final-settlement count. After all worker IPC has
+ *  disconnected the map cannot grow, so a re-read of 0 after awaiting the
+ *  snapshot confirms settlement quiescence. */
+export function codexAppFinalSettlementCount() {
+    return codexAppFinalSettlementInFlight.size;
+}
 function finalOutputDedupeKey(ds, msg) {
     return `${msg.sessionId ?? ds.session.sessionId}:${msg.lastUuid || msg.turnId}`;
 }
@@ -8117,6 +8288,40 @@ async function finishTurnReactions(ds) {
  *  same provider key; the daemon owns bounded transient retries. After 3 attempts we log
  *  and give up — the user's answer is lost; better than leaking memory
  *  via an unbounded retry loop. */
+async function persistFinalOutputFeedback(ds, msg, content, effectiveCliId, messageId, policy, baseCard, requesterSubjectId, webhookDestinations, logTag) {
+    try {
+        const { getSkillFeedbackStore } = await import('../services/skill-feedback-store.js');
+        const feedbackStore = await getSkillFeedbackStore(config.session.dataDir);
+        feedbackStore.recordTurnDelivery({
+            botAppId: ds.larkAppId,
+            sessionId: ds.session.sessionId,
+            turnId: msg.turnId,
+            nativeSessionId: msg.sourceHermesSessionId ?? ds.session.cliSessionId,
+            platform: 'lark',
+            platformAppId: ds.larkAppId,
+            platformMessageId: messageId,
+            chatId: ds.chatId,
+            topicRootId: ds.session.rootMessageId,
+            dispatchAttempt: msg.dispatchAttempt,
+            content,
+            cliId: effectiveCliId,
+            cliVersion: ds.cliVersion,
+            model: ds.session.model,
+            reasoningEffort: ds.session.reasoningEffort,
+            cardMode: 'feedback',
+            status: 'delivered',
+            usage: msg.usage,
+            policy,
+            baseCard,
+            requesterSubjectId,
+            webhookDestinations,
+            context: { ...(resolveFeedbackTeamId({ dataDir: config.session.dataDir, chatId: ds.chatId }) ? { teamId: resolveFeedbackTeamId({ dataDir: config.session.dataDir, chatId: ds.chatId }) } : {}) },
+        });
+    }
+    catch (error) {
+        logger.warn(`[${logTag}] Failed to persist final-output feedback delivery: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 function deliverFinalOutput(ds, msg, t, attempt, onComplete, isStillOwned = () => true, frozenReplyTarget, frozenUsage) {
     if (!isStillOwned()) {
         onComplete?.(false);
@@ -8329,6 +8534,12 @@ function deliverFinalOutput(ds, msg, t, attempt, onComplete, isStillOwned = () =
                 : imOrigin?.replyTargetSenderOpenId
                     ?? daemonCardFooterRecipientOpenId(ds, effectiveCliId);
             const localHomeLinkMode = daemonCardLocalHomeLinkMode(ds);
+            // forkWorker snapshots the effective policy for this worker lifetime.
+            // Keep daemon fallback delivery aligned with the same frozen policy the
+            // worker/Riff environment received; live config applies on the next fork.
+            const feedbackPolicy = managedReceiver ? undefined : ds.feedbackPolicy;
+            const feedbackRequesterSubjectId = recipientOpenId;
+            const feedback = feedbackPolicy && feedbackRequesterSubjectId ? { policy: feedbackPolicy } : undefined;
             cardUsage ??= getDaemonReplyCardUsageSnapshot(ds, effectiveCliId);
             const cardJson = msg.kind === 'local-turn' || msg.kind === 'local-turn-headless'
                 ? buildContextualReplyCard({
@@ -8344,8 +8555,19 @@ function deliverFinalOutput(ds, msg, t, attempt, onComplete, isStillOwned = () =
                     workingDir: ds.workingDir,
                     localHomeLinkMode,
                     usage: cardUsage,
+                    ...(feedback ? { feedback } : {}),
                 })
-                : buildMarkdownCard(safeAssistantText, recipientOpenId, renderBrandTemplate(resolveBrandLabel(ds.larkAppId), ds.workingDir), localeForBot(ds.larkAppId), ds.workingDir, localHomeLinkMode, cardUsage);
+                : buildCanonicalFinalReplyCard({
+                    markdown: safeAssistantText,
+                    ...(feedback ? { feedback } : {}),
+                    recipientOpenId,
+                    brand: renderBrandTemplate(resolveBrandLabel(ds.larkAppId), ds.workingDir),
+                    locale: localeForBot(ds.larkAppId),
+                    workingDir: ds.workingDir,
+                    localHomeLinkMode,
+                    usage: cardUsage,
+                });
+            const baseFeedbackCard = feedback ? JSON.parse(cardJson) : undefined;
             const proposedOutput = {
                 targetChatId: ds.chatId,
                 ...(imOrigin ? { quoteTargetId: imOrigin.larkMessageId } : {}),
@@ -8421,6 +8643,9 @@ function deliverFinalOutput(ds, msg, t, attempt, onComplete, isStillOwned = () =
             };
             if (preparedListenerReply?.kind === 'succeeded' && preparedListenerReply.messageId) {
                 recordPrimaryOutput(preparedListenerReply.messageId);
+                if (feedbackPolicy && baseFeedbackCard) {
+                    await persistFinalOutputFeedback(ds, msg, safeAssistantText, effectiveCliId, preparedListenerReply.messageId, feedbackPolicy, baseFeedbackCard, feedbackRequesterSubjectId, getBot(ds.larkAppId).config.feedbackWebhooks?.destinations, t);
+                }
                 ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
                 logger.info(`[${t}] VC listener fallback replayed existing provider result `
                     + `(turn ${msg.turnId.substring(0, 8)})`);
@@ -8471,6 +8696,9 @@ function deliverFinalOutput(ds, msg, t, attempt, onComplete, isStillOwned = () =
             }
             ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
             logger.info(`[${t}] Bridge final_output forwarded (turn ${msg.turnId.substring(0, 8)}, ${msg.content.length} chars, kind=${msg.kind ?? 'bridge'}, attempt ${attempt + 1})`);
+            if (feedbackPolicy && baseFeedbackCard && messageId) {
+                await persistFinalOutputFeedback(ds, msg, safeAssistantText, effectiveCliId, messageId, feedbackPolicy, baseFeedbackCard, feedbackRequesterSubjectId, getBot(ds.larkAppId).config.feedbackWebhooks?.destinations, t);
+            }
             onComplete?.(true);
         }
         catch (err) {