larkin 0.4.12 → 0.4.14

package/dist/app/local-control.mjs

@@ -462,11 +462,15 @@ export function removeControlAuthority(larkinHome, expectedToken) {
             throw error;
     }
 }
-export function createSupervisorControlServer({ larkinHome, authorityToken, ensureDashboard, }) {
+export function createSupervisorControlServer({ larkinHome, authorityToken, ensureDashboard, onAgentUpserted, }) {
     let socket = "";
     let socketRoot = "";
     let socketIdentity = null;
     const completed = new Map();
+    const operationConflict = (operationId, agentId) => ({
+        ok: false, operationId, ...(agentId ? { agentId } : {}), code: "operation_conflict",
+        error: "operationId 已绑定其他 Agent 或操作",
+    });
     let server = null;
     return {
         async start() {
@@ -490,9 +494,15 @@ export function createSupervisorControlServer({ larkinHome, authorityToken, ensu
                         let request;
                         try {
                             request = JSON.parse(line);
-                            if (!OPERATION_ID.test(String(request.operationId || "")) || request.operation !== "ensure-dashboard"
+                            const isDashboardRecovery = request.operation === "ensure-dashboard";
+                            const isAgentUpsert = request.operation === "agent-upserted";
+                            const allowedKeys = isDashboardRecovery
+                                ? ["operationId", "operation", "authorization"]
+                                : isAgentUpsert ? ["operationId", "operation", "authorization", "agentId"] : [];
+                            if (!OPERATION_ID.test(String(request.operationId || "")) || (!isDashboardRecovery && !isAgentUpsert)
                                 || !AUTHORIZATION.test(String(request.authorization || ""))
-                                || Object.keys(request).some((key) => !["operationId", "operation", "authorization"].includes(key))) {
+                                || (isAgentUpsert && !AGENT_ID.test(String(request.agentId || "")))
+                                || Object.keys(request).some((key) => !allowedKeys.includes(key))) {
                                 throw new Error("invalid supervisor control request");
                             }
                             const authority = assertSupervisorAuthority(larkinHome, authorityToken);
@@ -505,17 +515,28 @@ export function createSupervisorControlServer({ larkinHome, authorityToken, ensu
                         }
                         const replay = completed.get(request.operationId);
                         if (replay) {
-                            connection.end(`${JSON.stringify(replay)}\n`);
+                            const sameRequest = replay.operation === request.operation
+                                && replay.agentId === request.agentId;
+                            const response = sameRequest ? replay.response : operationConflict(request.operationId, request.agentId);
+                            connection.end(`${JSON.stringify(response)}\n`);
                             return;
                         }
                         let response;
                         try {
-                            response = { ok: true, operationId: request.operationId, state: await ensureDashboard() };
+                            if (request.operation === "agent-upserted") {
+                                await onAgentUpserted?.(request.agentId);
+                                response = { ok: true, operationId: request.operationId, state: "agent-recorded" };
+                            }
+                            else {
+                                response = { ok: true, operationId: request.operationId, state: await ensureDashboard() };
+                            }
                         }
                         catch (error) {
                             response = { ok: false, operationId: request.operationId, error: error instanceof Error ? error.message : String(error) };
                         }
-                        completed.set(request.operationId, response);
+                        completed.set(request.operationId, {
+                            operation: request.operation, agentId: request.agentId, response,
+                        });
                         while (completed.size > 256)
                             completed.delete(completed.keys().next().value);
                         connection.end(`${JSON.stringify(response)}\n`);
@@ -812,6 +833,43 @@ async function sendSupervisorRecovery(larkinHome, operationId, timeoutMs) {
         });
     });
 }
+async function sendSupervisorAgentUpsert(larkinHome, agentId, operationId, timeoutMs) {
+    const authority = assertSupervisorAuthority(larkinHome);
+    assertSecureSocketDirectory(authority.socketRoot);
+    const socket = authority.supervisorSocketPath;
+    const stat = fs.lstatSync(socket);
+    if (!stat.isSocket() || stat.isSymbolicLink()
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        || !notGroupOrWorldAccessible(stat))
+        throw new Error("supervisor control socket 不安全");
+    return await new Promise((resolve, reject) => {
+        const client = net.createConnection(socket);
+        const timer = setTimeout(() => { client.destroy(); reject(new Error("supervisor agent upsert control timeout")); }, timeoutMs);
+        let input = "";
+        client.setEncoding("utf8");
+        client.once("error", (error) => { clearTimeout(timer); reject(error); });
+        client.once("connect", () => client.write(`${JSON.stringify({
+            operationId, operation: "agent-upserted", agentId, authorization: authority.token,
+        })}\n`));
+        client.on("data", (chunk) => {
+            input += chunk;
+            const newline = input.indexOf("\n");
+            if (newline < 0)
+                return;
+            clearTimeout(timer);
+            client.end();
+            try {
+                resolve(JSON.parse(input.slice(0, newline)));
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+    });
+}
+export async function requestSupervisorAgentUpsert({ larkinHome, agentId, operationId = crypto.randomUUID(), timeoutMs = 30_000, }) {
+    return sendSupervisorAgentUpsert(larkinHome, agentId, operationId, timeoutMs);
+}
 export async function requestDashboardRecovery({ larkinHome, operationId = crypto.randomUUID(), timeoutMs = 30_000, }) {
     const deadline = Date.now() + timeoutMs;
     let lastError;

package/dist/app/run.mjs

@@ -8,7 +8,7 @@ import { fileURLToPath } from "node:url";
 import * as larkinConfig from "../platform/config.mjs";
 import { currentProcessMetadata } from "../platform/process-inspect.cjs";
 import { acquireProcessLock, readProcessState, terminateOwnedProcess, waitForProcessExit, } from "../platform/process-state.mjs";
-import { hydrateRuntimeAgent, syncAgentProfile } from "./runtime-agent-config.mjs";
+import { hydrateRuntimeAgent, syncAgentProfile, validateAgentProfile } from "./runtime-agent-config.mjs";
 import { cleanupStaleAgentControlSocket, createSupervisorControlServer, initializeControlAuthority, removeControlAuthority, requestDashboardRecovery, } from "./local-control.mjs";
 import { internalCommandSpec, processCommandToken } from "./internal-command.mjs";
 import { traceProcessBoundary } from "../platform/process-boundary-trace.mjs";
@@ -80,6 +80,9 @@ export async function main() {
     catch (error) {
         return die(error.message);
     }
+    // Capture this supervisor's startup membership before setup can persist a new
+    // Agent. Unqualified selection must not expand from later durable config.
+    const initialNames = new Set(names);
     const before = readProcessState(configDir);
     if (before.supervisor.state === "owned") {
         if (before.dashboard.state !== "owned") {
@@ -124,11 +127,16 @@ export async function main() {
         die("无法取得 supervisor start identity");
     }
     const controlToken = initializeControlAuthority(configDir, { pid: process.pid, processStartToken: supervisorStartToken });
+    // This supervisor's successful hot-attaches are the only membership additions
+    // that survive a daemon crash. Durable config apply state describes freshness,
+    // not which Agents this explicitly selected supervisor owns.
+    const hotAttachedNames = new Set();
     let ensureDashboardHandler = () => "starting";
     const supervisorControl = createSupervisorControlServer({
         larkinHome: configDir,
         authorityToken: controlToken,
         ensureDashboard: () => ensureDashboardHandler(),
+        onAgentUpserted: (agentId) => { hotAttachedNames.add(agentId); },
     });
     try {
         await supervisorControl.start();
@@ -141,16 +149,53 @@ export async function main() {
         catch { /* best effort */ }
         die(`supervisor control 启动失败：${error instanceof Error ? error.message : String(error)}`);
     }
-    const agents = [];
-    try {
-        for (const name of names) {
-            const stored = config.agents[name];
+    let agents = [];
+    const serverId = config.serverId;
+    if (!serverId)
+        die("配置缺少 serverId");
+    const runtimeEnv = {
+        ...process.env,
+        LARKIN_HOME: configDir,
+        LARKIN_CONFIG_DIR: configDir,
+        LARKIN_AGENT_TRANSPORT_MODULE: path.join(HERE, "..", "agent", "agent-transport.cjs"),
+        LARKIN_SERVER_ID: String(serverId),
+        LARKIN_AGENTS_CONFIG: "[]",
+        LARKIN_CONTROL_AUTHORIZATION: controlToken,
+    };
+    if (argv.includes("--dry-run"))
+        runtimeEnv.LARKIN_FEISHU_DRYRUN = "1";
+    // Re-read durable config for every daemon launch instead of reusing the startup
+    // snapshot: a hot attach updates the child and durable config, but cannot mutate
+    // this supervisor's old closure. Membership remains initialNames plus successful
+    // hot attaches recorded during this supervisor lifetime.
+    const refreshDaemonAgents = (reuseExistingProfiles) => {
+        const latest = larkinConfig.loadConfig(process.env);
+        if (latest.configDir !== configDir)
+            throw new Error("配置目录在 supervisor 运行期间发生变化");
+        if (!latest.config.serverId || !Object.keys(latest.config.agents).length)
+            throw new Error("配置缺少 serverId/agents");
+        const latestNames = [...new Set([...initialNames, ...hotAttachedNames])];
+        const refreshed = [];
+        for (const name of latestNames) {
+            const stored = latest.config.agents[name];
             if (!stored)
                 throw new Error(`Agent ${name} 不存在`);
             const agent = hydrateRuntimeAgent(configDir, stored);
-            syncAgentProfile(agent, { ...process.env, LARKIN_CONFIG_DIR: configDir });
-            agents.push(agent);
+            if (reuseExistingProfiles)
+                validateAgentProfile(agent);
+            else
+                syncAgentProfile(agent, { ...process.env, LARKIN_CONFIG_DIR: configDir });
+            refreshed.push(agent);
         }
+        agents = refreshed;
+        names = latestNames;
+        runtimeEnv.LARKIN_SERVER_ID = String(latest.config.serverId);
+        runtimeEnv.LARKIN_AGENTS_CONFIG = JSON.stringify(agents);
+        for (const agent of agents)
+            traceProcessBoundary(runtimeEnv, "supervisor:daemon-env-prepared", { configDir, agentId: agent.agentId, targetDir: path.join(configDir, "providers", "pi", agent.agentId) });
+    };
+    try {
+        refreshDaemonAgents(false);
     }
     catch (error) {
         await supervisorControl.close().catch(() => { });
@@ -183,22 +228,6 @@ export async function main() {
         launchLock.release();
         die(`dashboard PID ${before.dashboard.pid} 身份无法确认；拒绝替换`);
     }
-    const serverId = config.serverId;
-    if (!serverId)
-        die("配置缺少 serverId");
-    const runtimeEnv = {
-        ...process.env,
-        LARKIN_HOME: configDir,
-        LARKIN_CONFIG_DIR: configDir,
-        LARKIN_AGENT_TRANSPORT_MODULE: path.join(HERE, "..", "agent", "agent-transport.cjs"),
-        LARKIN_SERVER_ID: String(serverId),
-        LARKIN_AGENTS_CONFIG: JSON.stringify(agents),
-        LARKIN_CONTROL_AUTHORIZATION: controlToken,
-    };
-    if (argv.includes("--dry-run"))
-        runtimeEnv.LARKIN_FEISHU_DRYRUN = "1";
-    for (const agent of agents)
-        traceProcessBoundary(runtimeEnv, "supervisor:daemon-env-prepared", { configDir, agentId: agent.agentId, targetDir: path.join(configDir, "providers", "pi", agent.agentId) });
     let stopping = false;
     let dashboard = null;
     // Set when the daemon-restart path stops the dashboard on purpose (port
@@ -222,7 +251,19 @@ export async function main() {
     // exiting on transient failures (e.g. network/proxy ECONNRESET during Feishu
     // auth). Only when the budget is exhausted does the supervisor exit so the
     // external process manager (launchd) takes over as the final respawn layer.
+    let initialRefreshPending = true;
     const launchDaemon = () => {
+        if (initialRefreshPending)
+            initialRefreshPending = false;
+        else
+            try {
+                refreshDaemonAgents(true);
+            }
+            catch (error) {
+                console.error(`✗ daemon 启动前重新加载配置失败：${error instanceof Error ? error.message : String(error)}`);
+                resolveDaemonFinal?.({ code: null, signal: null });
+                return;
+            }
         daemon = spawn(daemonSpec.command, daemonSpec.args, { env: runtimeEnv, stdio: "inherit" });
         for (const agent of agents)
             traceProcessBoundary(runtimeEnv, "supervisor:daemon-spawned", { configDir, agentId: agent.agentId, targetDir: path.join(configDir, "providers", "pi", agent.agentId), childPid: daemon.pid ?? null });
@@ -257,7 +298,6 @@ export async function main() {
                 const oldDashboard = dashboard;
                 if (oldDashboard && oldDashboard.exitCode === null && oldDashboard.signalCode === null) {
                     intentionalDashboardExit = oldDashboard;
-                    dashboard = null;
                     oldDashboard.kill("SIGTERM");
                     // If the old dashboard ignores SIGTERM (observed in production holding
                     // the dashboard port for minutes), escalate so the port is released

package/dist/app/runtime-agent-config.mjs

@@ -17,6 +17,13 @@ function assertSecureProfileDirectory(directory) {
         || !exactMode(stat, 0o700))
         throw new Error("lark-cli profile 目录不安全");
 }
+function assertValidProfileDirectory(directory) {
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        || (!exactMode(stat, 0o700) && !exactMode(stat, 0o500)))
+        throw new Error("lark-cli profile 目录不安全");
+}
 function captureProfileSnapshot(file) {
     let fd = null;
     try {
@@ -233,22 +240,44 @@ function runOfficialLarkCliAsync(command, args, env, dependencies) {
         });
     });
 }
+function expectedRuntimeCommandShim() {
+    const standalone = process.env.LARKIN_STANDALONE === "1";
+    const binaryEntry = fileURLToPath(new URL("./binary-entry.mjs", import.meta.url));
+    const argumentsPrefix = standalone ? [] : [binaryEntry];
+    const command = [process.execPath, ...argumentsPrefix].map(shellQuote).join(" ");
+    return `#!/bin/sh\nexec ${command} "$@"\n`;
+}
 export function installRuntimeCommandShims(agent) {
     const stateDir = path.resolve(agent.stateDir);
     const commandDir = path.join(stateDir, "runtime-bin");
     assertSecureRuntimeCommandDirectory(commandDir);
-    const standalone = process.env.LARKIN_STANDALONE === "1";
-    const binaryEntry = fileURLToPath(new URL("./binary-entry.mjs", import.meta.url));
-    for (const [name, argumentsPrefix] of [["larkin", standalone ? [] : [binaryEntry]]]) {
+    const fileContents = expectedRuntimeCommandShim();
+    for (const name of ["larkin"]) {
         const file = path.join(commandDir, name);
         const temporary = path.join(commandDir, `.${name}.${process.pid}.${crypto.randomUUID()}.tmp`);
-        const command = [process.execPath, ...argumentsPrefix].map(shellQuote).join(" ");
-        fs.writeFileSync(temporary, `#!/bin/sh\nexec ${command} "$@"\n`, { mode: 0o700, flag: "wx" });
+        fs.writeFileSync(temporary, fileContents, { mode: 0o700, flag: "wx" });
         fs.renameSync(temporary, file);
         fs.chmodSync(file, 0o700);
     }
     return commandDir;
 }
+function validateRuntimeCommandShims(agent) {
+    const commandDir = path.join(path.resolve(agent.stateDir), "runtime-bin");
+    const directory = fs.lstatSync(commandDir);
+    if (!directory.isDirectory() || directory.isSymbolicLink()
+        || (typeof process.getuid === "function" && directory.uid !== process.getuid())
+        || (!exactMode(directory, 0o700) && !exactMode(directory, 0o500)))
+        throw new Error("Runtime command shim 目录不安全");
+    const file = path.join(commandDir, "larkin");
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink()
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        || (!exactMode(stat, 0o700) && !exactMode(stat, 0o500)))
+        throw new Error("Runtime command shim 不安全");
+    if (fs.readFileSync(file, "utf8") !== expectedRuntimeCommandShim()) {
+        throw new Error("Runtime command shim 内容无效");
+    }
+}
 export function sourceProjection(agent, env) {
     const configDir = path.resolve(env.LARKIN_CONFIG_DIR || "");
     if (!configDir)
@@ -299,7 +328,31 @@ function validateSourceProjection(file, agent) {
         throw new Error(`Agent ${agent.agentId} lark-channel source projection tenant mismatch`);
     }
 }
+export function validateAgentProfile(agent) {
+    // Validate the profile root before resolving any leaf paths. The supervisor's
+    // restart fast path must not follow a replaced symlink or unsafe root.
+    assertValidProfileDirectory(agent.larkConfigDir);
+    const sourceFile = larkChannelSourceConfigPath(agent);
+    const workspaceFile = larkChannelWorkspaceConfigPath(agent);
+    const source = captureProfileSnapshot(sourceFile);
+    if (!source)
+        throw new Error(`Agent ${agent.agentId} lark-channel source projection missing`);
+    validateSourceProjection(sourceFile, agent);
+    const workspace = captureProfileSnapshot(workspaceFile);
+    if (!workspace)
+        throw new Error(`Agent ${agent.agentId} lark-channel workspace config missing`);
+    validateExclusiveBotProfile(workspace, agent);
+    validateRuntimeCommandShims(agent);
+    assertAgentWorkspaceBound(agent);
+}
 export function syncAgentProfile(agent, env, dependencies = {}) {
+    if (!dependencies.forceRebind) {
+        try {
+            validateAgentProfile(agent);
+            return;
+        }
+        catch { /* absent or stale state requires exactly one bind */ }
+    }
     const expected = path.join(path.resolve(env.LARKIN_CONFIG_DIR || ""), "state", "agents", agent.agentId, "lark-cli-config");
     if (path.resolve(agent.larkConfigDir) !== expected)
         throw new Error("lark-cli profile 路径不是 canonical contained 路径");

package/dist/app/runtime-process.mjs

@@ -8,7 +8,7 @@ import { createRuntimeHost } from "../runtime/runtime-host.mjs";
 import { createAgentStateStore } from "../agent/agent-state-store.mjs";
 import { loadConfig, markConfigApplied, runtimeConfigSignature } from "../platform/config.mjs";
 import { traceProcessBoundary } from "../platform/process-boundary-trace.mjs";
-import { createAgentControlServer } from "./local-control.mjs";
+import { createAgentControlServer, requestSupervisorAgentUpsert } from "./local-control.mjs";
 import { hydrateRuntimeAgent, syncAgentProfile } from "./runtime-agent-config.mjs";
 import { loadTelemetryConfig } from "../platform/telemetry-config.mjs";
 import { telemetrySingleton } from "../platform/telemetry-tracing.mjs";
@@ -104,6 +104,11 @@ export async function main(env = process.env, overrides = {}) {
             // Only the selected profile is synchronized; active profiles and their directory
             // are never quarantined or rebuilt during hot attach.
             await hostShell.upsertAgent(agent);
+            const tracked = await requestSupervisorAgentUpsert({
+                larkinHome: env.LARKIN_HOME, agentId: agent.agentId, operationId: request.operationId,
+            });
+            if (!tracked.ok)
+                throw new Error(tracked.error || "supervisor 未记录 Agent 热挂载");
         },
         async resetSession(request) {
             const result = await hostShell.resetSession(request.agentId, request.waitReadyMs);

package/dist/feishu/host-business-state.cjs

@@ -316,31 +316,50 @@ class HostEnvelopeProjector {
     }
     createReminderEnvelope(agentId, reminder, overdueMs, repeatDescription) {
         const seq = this.nextSequence(agentId);
-        const anchorMessageId = typeof reminder.msgRef === "string" && /^om_[A-Za-z0-9_-]+$/.test(reminder.msgRef)
-            ? reminder.msgRef
-            : null;
+        const legacyChannel = typeof reminder.channel === "string" ? reminder.channel.trim() : "";
+        const legacyChatTarget = /^oc_[A-Za-z0-9_-]+$/.test(legacyChannel) ? `chat:${legacyChannel}` : null;
+        const deliveryTarget = typeof reminder.deliveryTarget === "string" && reminder.deliveryTarget
+            ? reminder.deliveryTarget : legacyChatTarget;
+        const anchorMessageId = typeof reminder.deliveryAnchor === "string" && /^om_[A-Za-z0-9_-]+$/.test(reminder.deliveryAnchor)
+            ? reminder.deliveryAnchor
+            : typeof reminder.msgRef === "string" && /^om_[A-Za-z0-9_-]+$/.test(reminder.msgRef)
+                ? reminder.msgRef
+                : null;
+        const commentAnchorId = deliveryTarget?.startsWith("document-comment:") && typeof reminder.deliveryAnchor === "string"
+            && /^doc_comment_[A-Za-z0-9_-]+$/.test(reminder.deliveryAnchor) ? reminder.deliveryAnchor : null;
+        const anchorId = anchorMessageId || commentAnchorId;
+        const chatId = deliveryTarget?.match(/^chat:(oc_[A-Za-z0-9_-]+)$/)?.[1] || null;
         const lines = [
             `[定时提醒触发] ${reminder.title}`,
             `提醒ID: #${reminder.reminderId.slice(0, 8)}` + (reminder.repeat && repeatDescription
                 ? `　重复: ${repeatDescription}（下次已自动排在 ${reminder.fireAt}）`
                 : "　类型: 一次性"),
             overdueMs > 120_000 ? `注意: 原定时间已过 ${Math.round(overdueMs / 60_000)} 分钟（Runtime Host 离线期间错过，现补触发）` : null,
-            anchorMessageId ? `锚定消息: ${anchorMessageId}` : reminder.msgRef ? `历史锚点 ${String(reminder.msgRef)} 不是飞书 om_ message_id，不能用于回复` : null,
+            deliveryTarget ? `原始 deliveryTarget: ${deliveryTarget}`
+                : anchorId ? "这是升级前存量 user-facing reminder，优先回复其安全锚点；不得向标题中的任何人或第三方发送消息"
+                    : "本条为 internal/no-delivery reminder，不得向标题中的任何人或第三方发送消息",
+            anchorId ? `锚定消息: ${anchorId}` : reminder.msgRef ? `历史锚点 ${String(reminder.msgRef)} 不是可用的 delivery anchor，不能用于回复` : null,
             anchorMessageId
-                ? `回复原会话: ${this.larkCommand(`im +messages-reply --message-id ${anchorMessageId} ...`)}`
-                : null,
-            reminder.channel && /^oc_[A-Za-z0-9_-]+$/.test(reminder.channel)
-                ? `发送到原群: ${this.larkCommand(`im +messages-send --chat-id ${reminder.channel} ...`)}`
-                : reminder.channel
-                    ? `历史目标 ${reminder.channel} 不是 chat_id；${anchorMessageId ? "若不回复锚定消息，" : ""}先用 ${this.larkCommand("im +chat-search")} 查询并确认 oc_ chat_id，禁止按名称猜测发送目标`
-                    : anchorMessageId
-                        ? null
-                        : `本条存量提醒缺少可用的飞书 message_id/chat_id，无法安全推断原会话；请先用 ${this.larkCommand("im +chat-search")} 确认目标，禁止猜测发送`,
+                ? [
+                    `回复原会话: ${this.larkCommand(`im +messages-reply --message-id ${anchorMessageId}${deliveryTarget?.startsWith("thread:") ? " --reply-in-thread" : ""} ...`)}`,
+                    chatId ? `若 ${anchorMessageId} 无法由当前 Inbox 解析（例如 interaction_* 卡片锚点或已淘汰的历史消息），改用聊天兜底发送: ${this.larkCommand(`im +messages-send --chat-id ${chatId} ...`)}；仅使用这个持久化 chat_id，不得猜测收件人` : null,
+                ].filter((line) => Boolean(line)).join("\n")
+                : commentAnchorId
+                    ? `回复原文档评论: ${this.agentCommand(`comment reply --message-id ${commentAnchorId} --text ...`)}`
+                    : deliveryTarget
+                        ? chatId
+                            ? `发送到原始 target: ${deliveryTarget}: ${this.larkCommand(`im +messages-send --chat-id ${chatId} ...`)}（不得从提醒标题推断收件人）`
+                            : `发送到原始 target: ${deliveryTarget}（不得从提醒标题推断收件人）`
+                        : null,
             `这是你之前用 ${this.agentCommand("reminder schedule")} 设置的提醒，请按标题执行相应动作。管理: ${this.agentCommand("reminder list")} / ${this.agentCommand("reminder snooze")} / ${this.agentCommand("reminder cancel")}`,
         ].filter((line) => Boolean(line));
         const envelope = {
             kind: "reminder",
-            message_id: `rem_${reminder.reminderId.slice(0, 16)}_${seq}`,
+            // The random suffix keeps each firing's occurrence identity unique across
+            // Host restarts: the in-memory seq restarts at 1 and would otherwise let a
+            // recurring reminder reuse a prior occurrenceId in the delivery audit.
+            message_id: `rem_${reminder.reminderId.slice(0, 16)}_${seq}_${this.randomHex(6)}`,
+            reminderId: reminder.reminderId,
             seq,
             sender_name: "定时提醒",
             sender_type: "system",
@@ -350,6 +369,8 @@ class HostEnvelopeProjector {
             timestamp: this.now().toISOString(),
             thread_id: null,
             wake: true,
+            deliveryTarget,
+            deliveryAnchor: anchorId,
         };
         return { ...envelope, target: inbox_projection_js_1.RUNTIME_REMINDER_TARGET };
     }

package/dist/feishu/host-business-state.mjs

@@ -302,31 +302,50 @@ export class HostEnvelopeProjector {
     }
     createReminderEnvelope(agentId, reminder, overdueMs, repeatDescription) {
         const seq = this.nextSequence(agentId);
-        const anchorMessageId = typeof reminder.msgRef === "string" && /^om_[A-Za-z0-9_-]+$/.test(reminder.msgRef)
-            ? reminder.msgRef
-            : null;
+        const legacyChannel = typeof reminder.channel === "string" ? reminder.channel.trim() : "";
+        const legacyChatTarget = /^oc_[A-Za-z0-9_-]+$/.test(legacyChannel) ? `chat:${legacyChannel}` : null;
+        const deliveryTarget = typeof reminder.deliveryTarget === "string" && reminder.deliveryTarget
+            ? reminder.deliveryTarget : legacyChatTarget;
+        const anchorMessageId = typeof reminder.deliveryAnchor === "string" && /^om_[A-Za-z0-9_-]+$/.test(reminder.deliveryAnchor)
+            ? reminder.deliveryAnchor
+            : typeof reminder.msgRef === "string" && /^om_[A-Za-z0-9_-]+$/.test(reminder.msgRef)
+                ? reminder.msgRef
+                : null;
+        const commentAnchorId = deliveryTarget?.startsWith("document-comment:") && typeof reminder.deliveryAnchor === "string"
+            && /^doc_comment_[A-Za-z0-9_-]+$/.test(reminder.deliveryAnchor) ? reminder.deliveryAnchor : null;
+        const anchorId = anchorMessageId || commentAnchorId;
+        const chatId = deliveryTarget?.match(/^chat:(oc_[A-Za-z0-9_-]+)$/)?.[1] || null;
         const lines = [
             `[定时提醒触发] ${reminder.title}`,
             `提醒ID: #${reminder.reminderId.slice(0, 8)}` + (reminder.repeat && repeatDescription
                 ? `　重复: ${repeatDescription}（下次已自动排在 ${reminder.fireAt}）`
                 : "　类型: 一次性"),
             overdueMs > 120_000 ? `注意: 原定时间已过 ${Math.round(overdueMs / 60_000)} 分钟（Runtime Host 离线期间错过，现补触发）` : null,
-            anchorMessageId ? `锚定消息: ${anchorMessageId}` : reminder.msgRef ? `历史锚点 ${String(reminder.msgRef)} 不是飞书 om_ message_id，不能用于回复` : null,
+            deliveryTarget ? `原始 deliveryTarget: ${deliveryTarget}`
+                : anchorId ? "这是升级前存量 user-facing reminder，优先回复其安全锚点；不得向标题中的任何人或第三方发送消息"
+                    : "本条为 internal/no-delivery reminder，不得向标题中的任何人或第三方发送消息",
+            anchorId ? `锚定消息: ${anchorId}` : reminder.msgRef ? `历史锚点 ${String(reminder.msgRef)} 不是可用的 delivery anchor，不能用于回复` : null,
             anchorMessageId
-                ? `回复原会话: ${this.larkCommand(`im +messages-reply --message-id ${anchorMessageId} ...`)}`
-                : null,
-            reminder.channel && /^oc_[A-Za-z0-9_-]+$/.test(reminder.channel)
-                ? `发送到原群: ${this.larkCommand(`im +messages-send --chat-id ${reminder.channel} ...`)}`
-                : reminder.channel
-                    ? `历史目标 ${reminder.channel} 不是 chat_id；${anchorMessageId ? "若不回复锚定消息，" : ""}先用 ${this.larkCommand("im +chat-search")} 查询并确认 oc_ chat_id，禁止按名称猜测发送目标`
-                    : anchorMessageId
-                        ? null
-                        : `本条存量提醒缺少可用的飞书 message_id/chat_id，无法安全推断原会话；请先用 ${this.larkCommand("im +chat-search")} 确认目标，禁止猜测发送`,
+                ? [
+                    `回复原会话: ${this.larkCommand(`im +messages-reply --message-id ${anchorMessageId}${deliveryTarget?.startsWith("thread:") ? " --reply-in-thread" : ""} ...`)}`,
+                    chatId ? `若 ${anchorMessageId} 无法由当前 Inbox 解析（例如 interaction_* 卡片锚点或已淘汰的历史消息），改用聊天兜底发送: ${this.larkCommand(`im +messages-send --chat-id ${chatId} ...`)}；仅使用这个持久化 chat_id，不得猜测收件人` : null,
+                ].filter((line) => Boolean(line)).join("\n")
+                : commentAnchorId
+                    ? `回复原文档评论: ${this.agentCommand(`comment reply --message-id ${commentAnchorId} --text ...`)}`
+                    : deliveryTarget
+                        ? chatId
+                            ? `发送到原始 target: ${deliveryTarget}: ${this.larkCommand(`im +messages-send --chat-id ${chatId} ...`)}（不得从提醒标题推断收件人）`
+                            : `发送到原始 target: ${deliveryTarget}（不得从提醒标题推断收件人）`
+                        : null,
             `这是你之前用 ${this.agentCommand("reminder schedule")} 设置的提醒，请按标题执行相应动作。管理: ${this.agentCommand("reminder list")} / ${this.agentCommand("reminder snooze")} / ${this.agentCommand("reminder cancel")}`,
         ].filter((line) => Boolean(line));
         const envelope = {
             kind: "reminder",
-            message_id: `rem_${reminder.reminderId.slice(0, 16)}_${seq}`,
+            // The random suffix keeps each firing's occurrence identity unique across
+            // Host restarts: the in-memory seq restarts at 1 and would otherwise let a
+            // recurring reminder reuse a prior occurrenceId in the delivery audit.
+            message_id: `rem_${reminder.reminderId.slice(0, 16)}_${seq}_${this.randomHex(6)}`,
+            reminderId: reminder.reminderId,
             seq,
             sender_name: "定时提醒",
             sender_type: "system",
@@ -336,6 +355,8 @@ export class HostEnvelopeProjector {
             timestamp: this.now().toISOString(),
             thread_id: null,
             wake: true,
+            deliveryTarget,
+            deliveryAnchor: anchorId,
         };
         return { ...envelope, target: RUNTIME_REMINDER_TARGET };
     }

package/dist/feishu/interaction-orchestrator.cjs

@@ -93,6 +93,8 @@ class HostInteractionOrchestrator {
             const reminderId = `int_${(0, node_crypto_1.createHash)("sha256").update(run.run_id).digest("hex").slice(0, 24)}`;
             const current = this.now();
             const fireAt = effect.args.fire_at ? Date.parse(effect.args.fire_at) : current + Number(effect.args.delay_seconds) * 1_000;
+            const deliveryTarget = typeof run.chat_id === "string" && run.chat_id ? `chat:${run.chat_id}` : null;
+            const deliveryAnchor = typeof run.message_id === "string" && /^om_[A-Za-z0-9_-]+$/.test(run.message_id) ? run.message_id : null;
             const reminder = ReminderStore.mutate(file, (store) => {
                 const existing = store.reminders.find((candidate) => candidate.reminderId === reminderId);
                 if (existing)
@@ -107,6 +109,9 @@ class HostInteractionOrchestrator {
                     status: "scheduled",
                     msgRef: run.message_id,
                     msgPermalink: null,
+                    deliveryTarget,
+                    deliveryAnchor,
+                    deliveryMode: "user",
                     repeat: null,
                     tz: null,
                     channel: run.chat_id,
@@ -114,7 +119,9 @@ class HostInteractionOrchestrator {
                     version: 1,
                     events: [],
                 };
-                ReminderStore.appendEvent(created, "scheduled", "interaction", run.run_id, created.fireAt, current);
+                ReminderStore.appendEvent(created, "scheduled", "interaction", run.run_id, created.fireAt, current, {
+                    deliveryTarget, deliveryAnchor, deliveryMode: "user",
+                });
                 store.reminders.push(created);
                 return created;
             }, Math.max(1, Math.min(350, deadline - this.now() - 100)));

package/dist/feishu/interaction-orchestrator.mjs

@@ -57,6 +57,8 @@ export class HostInteractionOrchestrator {
             const reminderId = `int_${createHash("sha256").update(run.run_id).digest("hex").slice(0, 24)}`;
             const current = this.now();
             const fireAt = effect.args.fire_at ? Date.parse(effect.args.fire_at) : current + Number(effect.args.delay_seconds) * 1_000;
+            const deliveryTarget = typeof run.chat_id === "string" && run.chat_id ? `chat:${run.chat_id}` : null;
+            const deliveryAnchor = typeof run.message_id === "string" && /^om_[A-Za-z0-9_-]+$/.test(run.message_id) ? run.message_id : null;
             const reminder = ReminderStore.mutate(file, (store) => {
                 const existing = store.reminders.find((candidate) => candidate.reminderId === reminderId);
                 if (existing)
@@ -71,6 +73,9 @@ export class HostInteractionOrchestrator {
                     status: "scheduled",
                     msgRef: run.message_id,
                     msgPermalink: null,
+                    deliveryTarget,
+                    deliveryAnchor,
+                    deliveryMode: "user",
                     repeat: null,
                     tz: null,
                     channel: run.chat_id,
@@ -78,7 +83,9 @@ export class HostInteractionOrchestrator {
                     version: 1,
                     events: [],
                 };
-                ReminderStore.appendEvent(created, "scheduled", "interaction", run.run_id, created.fireAt, current);
+                ReminderStore.appendEvent(created, "scheduled", "interaction", run.run_id, created.fireAt, current, {
+                    deliveryTarget, deliveryAnchor, deliveryMode: "user",
+                });
                 store.reminders.push(created);
                 return created;
             }, Math.max(1, Math.min(350, deadline - this.now() - 100)));