larkin 0.4.21 → 0.4.23

package/dist/agent/agent-cli-capabilities.cjs

@@ -12,7 +12,7 @@ const internal_command_js_1 = require("../app/internal-command.cjs");
 exports.AGENT_CLI_CAPABILITIES = Object.freeze({
     version: 1,
     commands: Object.freeze({
-        inbox: Object.freeze(["check", "poll"]),
+        inbox: Object.freeze(["check", "poll", "audit"]),
         comment: Object.freeze(["reply"]),
         reminder: Object.freeze(["schedule", "list", "snooze", "update", "cancel", "log"]),
         interaction: Object.freeze(["callback-status", "callback-probe", "create", "get", "resolve"]),
@@ -31,7 +31,9 @@ function resolveAgentCliExecutable(cliPath, runtimeExecutable = node_process_1.d
 function agentCliPromptCapabilities(executable = "larkin") {
     const commands = Object.entries(exports.AGENT_CLI_CAPABILITIES.commands).flatMap(([group, operations]) => operations.map((operation) => ({
         command: `${group} ${operation}`,
-        purpose: group === "inbox" ? (operation === "check" ? "Read pending target summaries without consuming messages." : "Poll full messages and direct-ack the returned batch.") :
+        purpose: group === "inbox" ? (operation === "check" ? "Read pending target summaries without consuming messages."
+            : operation === "audit" ? "Read bounded observed group/topic audit targets and instructions."
+                : "Poll full messages and direct-ack the returned batch.") :
             group === "comment" ? "Reply once to the exact cloud-document comment bound by a polled Inbox message id." :
                 group === "reminder" ? "Manage this Agent's durable reminders." :
                     group === "interaction" ? "Create, inspect, or resolve a durable interactive card run." :

package/dist/agent/agent-cli-capabilities.mjs

@@ -4,7 +4,7 @@ import { INTERNAL_AGENT_CLI, internalCommandShell } from "../app/internal-comman
 export const AGENT_CLI_CAPABILITIES = Object.freeze({
     version: 1,
     commands: Object.freeze({
-        inbox: Object.freeze(["check", "poll"]),
+        inbox: Object.freeze(["check", "poll", "audit"]),
         comment: Object.freeze(["reply"]),
         reminder: Object.freeze(["schedule", "list", "snooze", "update", "cancel", "log"]),
         interaction: Object.freeze(["callback-status", "callback-probe", "create", "get", "resolve"]),
@@ -23,7 +23,9 @@ export function resolveAgentCliExecutable(cliPath, runtimeExecutable = process.e
 export function agentCliPromptCapabilities(executable = "larkin") {
     const commands = Object.entries(AGENT_CLI_CAPABILITIES.commands).flatMap(([group, operations]) => operations.map((operation) => ({
         command: `${group} ${operation}`,
-        purpose: group === "inbox" ? (operation === "check" ? "Read pending target summaries without consuming messages." : "Poll full messages and direct-ack the returned batch.") :
+        purpose: group === "inbox" ? (operation === "check" ? "Read pending target summaries without consuming messages."
+            : operation === "audit" ? "Read bounded observed group/topic audit targets and instructions."
+                : "Poll full messages and direct-ack the returned batch.") :
             group === "comment" ? "Reply once to the exact cloud-document comment bound by a polled Inbox message id." :
                 group === "reminder" ? "Manage this Agent's durable reminders." :
                     group === "interaction" ? "Create, inspect, or resolve a durable interactive card run." :

package/dist/agent/context-prompt.cjs

@@ -16,7 +16,7 @@ const agent_cli_capabilities_js_1 = require("./agent-cli-capabilities.cjs");
  * 5. 版本化：每次实质改动 bump LARKIN_STANDING_PROMPT_VERSION，并同步 eval 数据集/graders/断言。
  * 6. 用 eval 验证：行为变化必须配套固定场景 + rubric（evals/*、test/support/*-grader.mjs、live 测试）。
  */
-exports.LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v25";
+exports.LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v27";
 /**
  * Agent 间协作唤醒引导（issue #75）：纯文本 @ 不会产生飞书 mention 事件，
  * 必须由模型直接构造真实的 mention 元素；`--mention` 扩展参数已移除。
@@ -29,7 +29,7 @@ exports.AGENT_MENTION_GUIDANCE = [
     "Only mention another Agent when it genuinely needs to act again; keep the existing loop-prevention boundary.",
 ];
 const FEISHU_IM_COMMAND_GROUPS = [
-    ["Messages", ["im +messages-send", "im +messages-reply", "im +chat-messages-list", "im +threads-messages-list", "im +messages-mget"]],
+    ["Messages", ["im +messages-send", "im +messages-reply", "im messages delete", "im +chat-messages-list", "im +threads-messages-list", "im +messages-mget"]],
     ["Chats", ["im +chat-list", "im +chat-search", "im chats get"]],
 ];
 function clean(value) {
@@ -133,13 +133,13 @@ class ContextPromptBuilder {
             "Successful history response messages are always at `data.messages`. Never use a chat-wide fallback for a thread target, never merge stderr with `2>&1` before parsing JSON, and never truncate structured output before parsing it.",
             "If the scoped history read fails or its schema is invalid, fail visibly. Do not reuse remembered or hard-coded text to make the task appear successful.",
             "Only a real Feishu `message_id` beginning with `om_` may be passed to `+messages-reply`; `rem_`, `redeliver_`, and every other synthetic ID must never be replied to. Send with a confirmed `chat_id` and never guess a chat id from a display name.",
-            "Before every send/reply/card write, Larkin probes the exact chat or thread history with the current Bot identity. A nonzero `freshness_conflict` includes bounded unseen context and direct-acks that cursor; reconsider it, then retry the ordinary command. Larkin never saves the blocked message body as a draft.",
-            "For regular textual message bodies, default to `--markdown`, including brief single-line replies, so Feishu renders Markdown structure instead of showing its markers literally.",
+            "Before every send/reply/card/recall write, Larkin probes the exact chat or thread history with the current Bot identity. A nonzero `freshness_conflict` includes bounded unseen context and direct-acks that cursor; reconsider it, then retry the ordinary command. Larkin never saves the blocked operation as a draft.",
+            "For ordinary plain-text message bodies, use `--text`, including brief one-line replies, multiline status lines, and paragraphs. Use `--markdown` only when you intentionally need Markdown rendering, such as headings, lists, emphasis, blockquotes, fenced code, or Markdown links.",
             "When a URL must be visible, clickable, or openable by the recipient, include the complete bare `https://...` URL as visible text. Do not rely solely on `[label](URL)`, because Feishu client rendering is unreliable. A label may also be included, but the bare URL must remain present.",
-            "Use native `--text` only when plain text or verbatim preservation is explicitly needed, such as logs, code, or exact whitespace. Both `--markdown` and `--text` remain supported in the Larkin Runtime.",
+            "Use native `--text` for ordinary plain text and for verbatim preservation, such as logs, literal code, or exact whitespace. Both `--markdown` and `--text` remain supported in the Larkin Runtime.",
             "Never rewrite or normalize an exact or verbatim user-supplied body to expose a URL; the existing exact-content paths remain authoritative and preserve the supplied body unchanged.",
             "For exact text supplied directly in the current instruction or Inbox event, pass the body unchanged as one literal `--text` argument. A direct literal must not use command substitution, backticks, `eval`, `echo`, or an unquoted variable; if it cannot be represented safely, stop and report the limitation instead of normalizing it.",
-            "An explicit exact or verbatim direct literal uses `--text` and overrides the regular markdown default.",
+            "An explicit exact or verbatim direct literal uses `--text` and overrides the ordinary-body guidance.",
             `For a common exact send with a confirmed chat id, use the complete schematic recipe \`${executable} im +messages-send --chat-id <confirmed_chat_id> --text '<exact_body_as_one_literal_argument>' --json\`; replace each placeholder with the corresponding confirmed or exact literal value.`,
             `A reply's target is governed by the source's thread membership, a structural Inbox fact, not a guess. When the current Inbox event or poll identifies the source as a thread (\`thread:<chat_id>:<thread_id>\` target, or the polled message carries a \`thread_id\`), your reply MUST stay in that same thread: after the required poll use \`${executable} im +messages-reply --message-id <real_om_message_id> --text '<exact_body_as_one_literal_argument>' --reply-in-thread --json\`. For a chat-level source (no thread) with no explicit in-thread request, reply to the main timeline with the same recipe but omit \`--reply-in-thread\`; replace the placeholders only with the real \`om_\` id returned by that poll and the unchanged exact literal.`,
             `Use the \`--reply-in-thread\` recipe only when the source is a thread or the user or current Inbox event explicitly asks for a topic, in-thread, or thread reply. Never invent a topic request from ordinary reply wording or a bare source message id: the thread decision comes only from the source message's actual thread membership (\`thread:\` target or polled \`thread_id\`) or an explicit request, never from wording alone.`,
@@ -159,6 +159,7 @@ class ContextPromptBuilder {
             "For the known canonical Inbox poll, scoped chat/thread history, and exact send/reply recipes specified here, execute them directly; you must not read or re-read a skill file or reference merely to rediscover or confirm their command syntax.",
             `For a task that starts from an exact group name and asks for user and bot counts, after the required Inbox poll use this known canonical two-read recipe directly: first run \`${executable} im +chat-search --query '<exact_group_name>' --json\`, require one result with an exact name match and confirm its \`oc_\` chat id, then run \`${executable} im chats get --chat-id <confirmed_oc_chat_id> --json\` and answer from its \`user_count\` and \`bot_count\`. This group user/bot counts recipe uses exactly two post-poll business read calls; you must not read or re-read a skill or reference, open help or schema, invoke bare \`lark-cli\`, call \`chat.members\` or \`+chat-members-list\`, fall back to \`+chat-list\`, or add shell filters or output truncation. If the exact name is not a unique visible match, the chat id is not confirmed, or either count is missing, fail visibly without another discovery path or a guess.`,
             "This narrow direct-recipe rule does not waive required skill safety gates, authorization, identity, freshness, or other safety checks. Unknown commands or high-risk operations still require the applicable skill/reference guidance or help.",
+            `To recall a message after the required explicit user approval, use \`${executable} im messages delete --message-id <bot-owned_om_id> --yes --json\`. Runtime verifies the original sender is this exact Bot, derives the exact chat/thread target, probes freshness before provider commit, and refuses cross-Agent or third-party messages. A \`committed=true\` or \`duplicate=true\` result must not be retried; an ambiguous result fails closed and requires user inspection. Never use generic API or bare \`lark-cli\` to bypass recall protection.`,
             "The Larkin wrapper derives the stable per-intent idempotency key; do not pass `--idempotency-key` in an ordinary send or reply recipe. A successful write result carrying `duplicate: true` means the provider returned the earlier delivery for the same derived key: the message was already delivered and no new message was created. Do not resend the same command after a `duplicate: true` result; treat the message as delivered. To deliberately send identical content again as a fresh intent (e.g., a new reminder), pass an explicit new `--idempotency-key`, which the wrapper respects instead of deriving its own.",
             "Both `freshness_unavailable` and `freshness_conflict` are pre-commit, provider-not-reached results. If a retry is warranted for an unchanged exact operation, rerun the identical safe ordinary command: `--text` for a direct literal or the same deterministic `--content` dataflow for a tool source. The wrapper reuses its derived key. If the target or body changes after reconsideration, run the revised ordinary command and let the wrapper derive a new key. A result with `committed=true` must not be repeated; ambiguous termination follows the existing wrapper same-key recovery contract.",
             "For multiline `--markdown` or `--text` content in zsh or bash, prefer shell ANSI-C quoting so the command passes one argument with real newline characters: `--markdown $'First line\\nSecond line'` or `--text $'First line\\nSecond line'`. Putting `\"First line\\nSecond line\"` in ordinary double quotes is wrong: ordinary quotes do not decode `\\n`, so lark-cli and Feishu receive a backslash followed by the letter `n`. A literal multiline argument containing real newline characters is also valid. If ANSI-C-quoted content contains an apostrophe, use a safe shell single-quote splice or the literal-newline form; never use `eval`, `echo`, a temporary file, or unsafe variable interpolation to construct the body.",

package/dist/agent/context-prompt.mjs

@@ -13,7 +13,7 @@ import { agentCliPromptCapabilities } from "./agent-cli-capabilities.mjs";
  * 5. 版本化：每次实质改动 bump LARKIN_STANDING_PROMPT_VERSION，并同步 eval 数据集/graders/断言。
  * 6. 用 eval 验证：行为变化必须配套固定场景 + rubric（evals/*、test/support/*-grader.mjs、live 测试）。
  */
-export const LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v25";
+export const LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v27";
 /**
  * Agent 间协作唤醒引导（issue #75）：纯文本 @ 不会产生飞书 mention 事件，
  * 必须由模型直接构造真实的 mention 元素；`--mention` 扩展参数已移除。
@@ -26,7 +26,7 @@ export const AGENT_MENTION_GUIDANCE = [
     "Only mention another Agent when it genuinely needs to act again; keep the existing loop-prevention boundary.",
 ];
 const FEISHU_IM_COMMAND_GROUPS = [
-    ["Messages", ["im +messages-send", "im +messages-reply", "im +chat-messages-list", "im +threads-messages-list", "im +messages-mget"]],
+    ["Messages", ["im +messages-send", "im +messages-reply", "im messages delete", "im +chat-messages-list", "im +threads-messages-list", "im +messages-mget"]],
     ["Chats", ["im +chat-list", "im +chat-search", "im chats get"]],
 ];
 function clean(value) {
@@ -130,13 +130,13 @@ export class ContextPromptBuilder {
             "Successful history response messages are always at `data.messages`. Never use a chat-wide fallback for a thread target, never merge stderr with `2>&1` before parsing JSON, and never truncate structured output before parsing it.",
             "If the scoped history read fails or its schema is invalid, fail visibly. Do not reuse remembered or hard-coded text to make the task appear successful.",
             "Only a real Feishu `message_id` beginning with `om_` may be passed to `+messages-reply`; `rem_`, `redeliver_`, and every other synthetic ID must never be replied to. Send with a confirmed `chat_id` and never guess a chat id from a display name.",
-            "Before every send/reply/card write, Larkin probes the exact chat or thread history with the current Bot identity. A nonzero `freshness_conflict` includes bounded unseen context and direct-acks that cursor; reconsider it, then retry the ordinary command. Larkin never saves the blocked message body as a draft.",
-            "For regular textual message bodies, default to `--markdown`, including brief single-line replies, so Feishu renders Markdown structure instead of showing its markers literally.",
+            "Before every send/reply/card/recall write, Larkin probes the exact chat or thread history with the current Bot identity. A nonzero `freshness_conflict` includes bounded unseen context and direct-acks that cursor; reconsider it, then retry the ordinary command. Larkin never saves the blocked operation as a draft.",
+            "For ordinary plain-text message bodies, use `--text`, including brief one-line replies, multiline status lines, and paragraphs. Use `--markdown` only when you intentionally need Markdown rendering, such as headings, lists, emphasis, blockquotes, fenced code, or Markdown links.",
             "When a URL must be visible, clickable, or openable by the recipient, include the complete bare `https://...` URL as visible text. Do not rely solely on `[label](URL)`, because Feishu client rendering is unreliable. A label may also be included, but the bare URL must remain present.",
-            "Use native `--text` only when plain text or verbatim preservation is explicitly needed, such as logs, code, or exact whitespace. Both `--markdown` and `--text` remain supported in the Larkin Runtime.",
+            "Use native `--text` for ordinary plain text and for verbatim preservation, such as logs, literal code, or exact whitespace. Both `--markdown` and `--text` remain supported in the Larkin Runtime.",
             "Never rewrite or normalize an exact or verbatim user-supplied body to expose a URL; the existing exact-content paths remain authoritative and preserve the supplied body unchanged.",
             "For exact text supplied directly in the current instruction or Inbox event, pass the body unchanged as one literal `--text` argument. A direct literal must not use command substitution, backticks, `eval`, `echo`, or an unquoted variable; if it cannot be represented safely, stop and report the limitation instead of normalizing it.",
-            "An explicit exact or verbatim direct literal uses `--text` and overrides the regular markdown default.",
+            "An explicit exact or verbatim direct literal uses `--text` and overrides the ordinary-body guidance.",
             `For a common exact send with a confirmed chat id, use the complete schematic recipe \`${executable} im +messages-send --chat-id <confirmed_chat_id> --text '<exact_body_as_one_literal_argument>' --json\`; replace each placeholder with the corresponding confirmed or exact literal value.`,
             `A reply's target is governed by the source's thread membership, a structural Inbox fact, not a guess. When the current Inbox event or poll identifies the source as a thread (\`thread:<chat_id>:<thread_id>\` target, or the polled message carries a \`thread_id\`), your reply MUST stay in that same thread: after the required poll use \`${executable} im +messages-reply --message-id <real_om_message_id> --text '<exact_body_as_one_literal_argument>' --reply-in-thread --json\`. For a chat-level source (no thread) with no explicit in-thread request, reply to the main timeline with the same recipe but omit \`--reply-in-thread\`; replace the placeholders only with the real \`om_\` id returned by that poll and the unchanged exact literal.`,
             `Use the \`--reply-in-thread\` recipe only when the source is a thread or the user or current Inbox event explicitly asks for a topic, in-thread, or thread reply. Never invent a topic request from ordinary reply wording or a bare source message id: the thread decision comes only from the source message's actual thread membership (\`thread:\` target or polled \`thread_id\`) or an explicit request, never from wording alone.`,
@@ -156,6 +156,7 @@ export class ContextPromptBuilder {
             "For the known canonical Inbox poll, scoped chat/thread history, and exact send/reply recipes specified here, execute them directly; you must not read or re-read a skill file or reference merely to rediscover or confirm their command syntax.",
             `For a task that starts from an exact group name and asks for user and bot counts, after the required Inbox poll use this known canonical two-read recipe directly: first run \`${executable} im +chat-search --query '<exact_group_name>' --json\`, require one result with an exact name match and confirm its \`oc_\` chat id, then run \`${executable} im chats get --chat-id <confirmed_oc_chat_id> --json\` and answer from its \`user_count\` and \`bot_count\`. This group user/bot counts recipe uses exactly two post-poll business read calls; you must not read or re-read a skill or reference, open help or schema, invoke bare \`lark-cli\`, call \`chat.members\` or \`+chat-members-list\`, fall back to \`+chat-list\`, or add shell filters or output truncation. If the exact name is not a unique visible match, the chat id is not confirmed, or either count is missing, fail visibly without another discovery path or a guess.`,
             "This narrow direct-recipe rule does not waive required skill safety gates, authorization, identity, freshness, or other safety checks. Unknown commands or high-risk operations still require the applicable skill/reference guidance or help.",
+            `To recall a message after the required explicit user approval, use \`${executable} im messages delete --message-id <bot-owned_om_id> --yes --json\`. Runtime verifies the original sender is this exact Bot, derives the exact chat/thread target, probes freshness before provider commit, and refuses cross-Agent or third-party messages. A \`committed=true\` or \`duplicate=true\` result must not be retried; an ambiguous result fails closed and requires user inspection. Never use generic API or bare \`lark-cli\` to bypass recall protection.`,
             "The Larkin wrapper derives the stable per-intent idempotency key; do not pass `--idempotency-key` in an ordinary send or reply recipe. A successful write result carrying `duplicate: true` means the provider returned the earlier delivery for the same derived key: the message was already delivered and no new message was created. Do not resend the same command after a `duplicate: true` result; treat the message as delivered. To deliberately send identical content again as a fresh intent (e.g., a new reminder), pass an explicit new `--idempotency-key`, which the wrapper respects instead of deriving its own.",
             "Both `freshness_unavailable` and `freshness_conflict` are pre-commit, provider-not-reached results. If a retry is warranted for an unchanged exact operation, rerun the identical safe ordinary command: `--text` for a direct literal or the same deterministic `--content` dataflow for a tool source. The wrapper reuses its derived key. If the target or body changes after reconsideration, run the revised ordinary command and let the wrapper derive a new key. A result with `committed=true` must not be repeated; ambiguous termination follows the existing wrapper same-key recovery contract.",
             "For multiline `--markdown` or `--text` content in zsh or bash, prefer shell ANSI-C quoting so the command passes one argument with real newline characters: `--markdown $'First line\\nSecond line'` or `--text $'First line\\nSecond line'`. Putting `\"First line\\nSecond line\"` in ordinary double quotes is wrong: ordinary quotes do not decode `\\n`, so lark-cli and Feishu receive a backslash followed by the letter `n`. A literal multiline argument containing real newline characters is also valid. If ANSI-C-quoted content contains an apostrophe, use a safe shell single-quote splice or the literal-newline form; never use `eval`, `echo`, a temporary file, or unsafe variable interpolation to construct the body.",

package/dist/agent/inbox-audit-heartbeat.cjs

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InboxAuditHeartbeat = exports.INBOX_AUDIT_CADENCE_MS = void 0;
+const inbox_projection_js_1 = require("./inbox-projection.cjs");
+exports.INBOX_AUDIT_CADENCE_MS = 15 * 60_000;
+/** One Host-owned timer fans a targetless internal wake to each active Agent. */
+class InboxAuditHeartbeat {
+    options;
+    timer = null;
+    running = false;
+    sequence = 0;
+    cadenceMs;
+    constructor(options) {
+        this.options = options;
+        this.cadenceMs = options.cadenceMs ?? exports.INBOX_AUDIT_CADENCE_MS;
+        if (!Number.isSafeInteger(this.cadenceMs) || this.cadenceMs < 1)
+            throw new Error("inbox audit cadence must be a positive integer");
+    }
+    start() {
+        if (this.running)
+            return;
+        this.running = true;
+        this.schedule();
+    }
+    stop() {
+        this.running = false;
+        if (this.timer)
+            (this.options.clearTimer ?? clearTimeout)(this.timer);
+        this.timer = null;
+    }
+    schedule() {
+        if (!this.running || this.timer)
+            return;
+        this.timer = (this.options.setTimer ?? setTimeout)(() => {
+            this.timer = null;
+            return this.fire().finally(() => { if (this.running)
+                this.schedule(); });
+        }, this.cadenceMs);
+        this.timer.unref?.();
+    }
+    async fire() {
+        const now = this.options.now ?? Date.now;
+        for (const agent of this.options.agents) {
+            const message_id = `rem_inbox_audit_${now()}_${++this.sequence}_${agent.agentId}`;
+            const envelope = {
+                kind: "reminder",
+                message_id,
+                target: inbox_projection_js_1.RUNTIME_REMINDER_TARGET,
+                wake: true,
+                content: "Internal inbox audit wake. Poll runtime:reminder, then run larkin inbox audit --json. No finding stays silent.",
+            };
+            try {
+                const appended = this.options.stateStore(agent).appendCanonicalInboxOnce(envelope);
+                if (appended.status === "appended")
+                    await this.options.runtimeHost.deliver(agent.agentId, appended.envelope);
+            }
+            catch (error) {
+                this.options.log?.(`inbox audit heartbeat failed agent=${agent.agentId}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+}
+exports.InboxAuditHeartbeat = InboxAuditHeartbeat;

package/dist/agent/inbox-audit-heartbeat.mjs

@@ -0,0 +1,59 @@
+import { RUNTIME_REMINDER_TARGET } from "./inbox-projection.mjs";
+export const INBOX_AUDIT_CADENCE_MS = 15 * 60_000;
+/** One Host-owned timer fans a targetless internal wake to each active Agent. */
+export class InboxAuditHeartbeat {
+    options;
+    timer = null;
+    running = false;
+    sequence = 0;
+    cadenceMs;
+    constructor(options) {
+        this.options = options;
+        this.cadenceMs = options.cadenceMs ?? INBOX_AUDIT_CADENCE_MS;
+        if (!Number.isSafeInteger(this.cadenceMs) || this.cadenceMs < 1)
+            throw new Error("inbox audit cadence must be a positive integer");
+    }
+    start() {
+        if (this.running)
+            return;
+        this.running = true;
+        this.schedule();
+    }
+    stop() {
+        this.running = false;
+        if (this.timer)
+            (this.options.clearTimer ?? clearTimeout)(this.timer);
+        this.timer = null;
+    }
+    schedule() {
+        if (!this.running || this.timer)
+            return;
+        this.timer = (this.options.setTimer ?? setTimeout)(() => {
+            this.timer = null;
+            return this.fire().finally(() => { if (this.running)
+                this.schedule(); });
+        }, this.cadenceMs);
+        this.timer.unref?.();
+    }
+    async fire() {
+        const now = this.options.now ?? Date.now;
+        for (const agent of this.options.agents) {
+            const message_id = `rem_inbox_audit_${now()}_${++this.sequence}_${agent.agentId}`;
+            const envelope = {
+                kind: "reminder",
+                message_id,
+                target: RUNTIME_REMINDER_TARGET,
+                wake: true,
+                content: "Internal inbox audit wake. Poll runtime:reminder, then run larkin inbox audit --json. No finding stays silent.",
+            };
+            try {
+                const appended = this.options.stateStore(agent).appendCanonicalInboxOnce(envelope);
+                if (appended.status === "appended")
+                    await this.options.runtimeHost.deliver(agent.agentId, appended.envelope);
+            }
+            catch (error) {
+                this.options.log?.(`inbox audit heartbeat failed agent=${agent.agentId}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+}

package/dist/agent/missed-outbound-scan.cjs

@@ -1,123 +1,133 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_MISSED_OUTBOUND_REPEAT = exports.DEFAULT_MISSED_OUTBOUND_TITLE = void 0;
-exports.parseOmMessageId = parseOmMessageId;
-exports.parseScanDeliveryTarget = parseScanDeliveryTarget;
-exports.isDefaultMissedOutboundReminder = isDefaultMissedOutboundReminder;
-exports.ensureDefaultMissedOutboundScanReminder = ensureDefaultMissedOutboundScanReminder;
-exports.persistInboundScanTarget = persistInboundScanTarget;
-const node_path_1 = __importDefault(require("node:path"));
-const reminder_store_js_1 = require("./reminder-store.cjs");
-exports.DEFAULT_MISSED_OUTBOUND_TITLE = "Read scoped history from this reminder envelope's persisted deliveryTarget (chat: +chat-messages-list; thread: +threads-messages-list). Judge unanswered asks, undelivered follow-ups, and stalled work. On a hit, post a short status in the same conversation using that persisted deliveryTarget/anchor; otherwise stay silent. Never infer recipients from the title.";
-exports.DEFAULT_MISSED_OUTBOUND_REPEAT = "every:15m";
-const CHAT_TARGET = /^chat:(oc_[A-Za-z0-9]+)$/;
-const THREAD_TARGET = /^thread:(oc_[A-Za-z0-9]+):(omt_[A-Za-z0-9]+)$/;
-const OM_ID = /^om_[A-Za-z0-9]+$/;
-function parseOmMessageId(value, label = "message-id") {
-    const id = String(value || "").trim();
-    if (!OM_ID.test(id))
-        throw new Error(`${label} 必须是严格 om_ 语法`);
-    return id;
-}
-function parseScanDeliveryTarget(target, anchor) {
-    const deliveryTarget = String(target || "").trim();
-    if (!deliveryTarget) {
-        throw new Error("user-facing reminder 必须显式指定 delivery target，不得从标题推断收件人");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
     }
-    const chat = deliveryTarget.match(CHAT_TARGET);
-    if (chat) {
-        return {
-            deliveryTarget,
-            scope: "chat",
-            chatId: chat[1],
-            threadId: null,
-            deliveryAnchor: anchor ? parseOmMessageId(anchor, "delivery anchor") : null,
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
         };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_INBOX_AUDIT_TARGETS = exports.INBOX_AUDIT_LEGACY_MIGRATION_NON_GOAL = void 0;
+exports.inboxAuditRegistryFile = inboxAuditRegistryFile;
+exports.observeInboxAuditTarget = observeInboxAuditTarget;
+exports.readInboxAuditTargets = readInboxAuditTargets;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/**
+ * #169's host-owned heartbeat no longer creates per-target missed-outbound loops.
+ * Pre-v0.4.21 records have no unique ownership marker and can collide exactly
+ * with user reminders, so existing indistinguishable loops are never migrated
+ * or deleted automatically.
+ */
+exports.INBOX_AUDIT_LEGACY_MIGRATION_NON_GOAL = "New versions no longer create missed-outbound loops; existing indistinguishable historical loops are not migrated or deleted automatically.";
+// Audits return every retained target. Storage remains bounded so a heartbeat
+// cannot accumulate an unbounded work list.
+exports.MAX_INBOX_AUDIT_TARGETS = 96;
+const MAX_STORED_TARGETS = exports.MAX_INBOX_AUDIT_TARGETS;
+const CHAT = /^oc_[A-Za-z0-9]+$/;
+const THREAD = /^omt_[A-Za-z0-9]+$/;
+const ANCHOR = /^om_[A-Za-z0-9_-]+$/;
+function inboxAuditRegistryFile(larkinHome) {
+    return path.join(larkinHome, "inbox-audit.json");
+}
+function parseTarget(event) {
+    const chatId = String(event.chat_id || "");
+    const threadId = event.thread_id ? String(event.thread_id) : "";
+    const anchor = String(event.message_id || "");
+    if (!CHAT.test(chatId) || !ANCHOR.test(anchor) || (threadId && !THREAD.test(threadId)))
+        return null;
+    return { target: threadId ? `thread:${chatId}:${threadId}` : `chat:${chatId}`, anchor };
+}
+function load(file) {
+    let value;
+    try {
+        value = JSON.parse(fs.readFileSync(file, "utf8"));
     }
-    const thread = deliveryTarget.match(THREAD_TARGET);
-    if (thread) {
-        return {
-            deliveryTarget,
-            scope: "thread",
-            chatId: thread[1],
-            threadId: thread[2],
-            deliveryAnchor: parseOmMessageId(anchor, "delivery anchor"),
-        };
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { version: 1, targets: [] };
+        throw error;
     }
-    throw new Error("delivery target 必须是 chat:oc_… 或 thread:oc_…:omt_…，禁止推断 DM");
+    if (value?.version !== 1 || !Array.isArray(value.targets))
+        return { version: 1, targets: [] };
+    return { version: 1, targets: value.targets.flatMap((row) => {
+            if (!row || typeof row !== "object")
+                return [];
+            const candidate = row;
+            if (typeof candidate.target !== "string" || typeof candidate.anchor !== "string")
+                return [];
+            const parsed = parseTarget({
+                chat_id: candidate.target.startsWith("chat:") ? candidate.target.slice(5) : candidate.target.split(":")[1],
+                thread_id: candidate.target.startsWith("thread:") ? candidate.target.split(":")[2] : null,
+                message_id: candidate.anchor,
+            });
+            return typeof candidate.agent_id === "string" && candidate.agent_id && parsed && candidate.target === parsed.target
+                && typeof candidate.observed_at === "string" && Number.isFinite(Date.parse(candidate.observed_at))
+                ? [{ agent_id: candidate.agent_id, ...parsed, observed_at: candidate.observed_at }] : [];
+        }) };
 }
-function isDefaultMissedOutboundReminder(reminder) {
-    return reminder?.title === exports.DEFAULT_MISSED_OUTBOUND_TITLE
-        && reminder.repeat === exports.DEFAULT_MISSED_OUTBOUND_REPEAT
-        && reminder.deliveryMode === "user"
-        && reminder.status === "scheduled";
+function save(file, registry) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);
+    fs.writeFileSync(temporary, `${JSON.stringify(registry)}\n`, { mode: 0o600 });
+    fs.renameSync(temporary, file);
+    fs.chmodSync(file, 0o600);
 }
-function ensureDefaultMissedOutboundScanReminder(input) {
-    const parsed = parseScanDeliveryTarget(input.deliveryTarget, input.deliveryAnchor);
-    const recurrence = (0, reminder_store_js_1.parseRepeat)(exports.DEFAULT_MISSED_OUTBOUND_REPEAT);
-    if ("error" in recurrence)
-        throw new Error(recurrence.error);
-    const now = input.nowMs ?? Date.now();
-    const wantedAnchor = parsed.deliveryAnchor;
-    return (0, reminder_store_js_1.mutate)(input.storeFile, (store) => {
-        const sameIdentity = (reminder) => reminder.ownerAgentId === input.agentId
-            && reminder.title === exports.DEFAULT_MISSED_OUTBOUND_TITLE
-            && reminder.repeat === exports.DEFAULT_MISSED_OUTBOUND_REPEAT
-            && reminder.deliveryMode === "user"
-            && reminder.deliveryTarget === parsed.deliveryTarget;
-        const scheduled = store.reminders.find((reminder) => sameIdentity(reminder) && reminder.status === "scheduled");
-        if (scheduled) {
-            if ((scheduled.deliveryAnchor || null) !== wantedAnchor)
-                scheduled.deliveryAnchor = wantedAnchor;
-            return { created: false, reminderId: scheduled.reminderId, rebuilt: false };
-        }
-        const canceled = store.reminders.find((reminder) => sameIdentity(reminder) && reminder.status === "canceled");
-        if (canceled)
-            return { created: false, reminderId: canceled.reminderId, rebuilt: false };
-        const hadFired = store.reminders.some((reminder) => sameIdentity(reminder) && reminder.status === "fired");
-        store.reminders = store.reminders.filter((reminder) => !(sameIdentity(reminder) && reminder.status === "fired"));
-        const reminderId = (0, reminder_store_js_1.newId)();
-        store.reminders.push({
-            reminderId,
-            ownerAgentId: input.agentId,
-            title: exports.DEFAULT_MISSED_OUTBOUND_TITLE,
-            fireAt: (0, reminder_store_js_1.nowIso)(now + 15 * 60_000),
-            firedAt: null,
-            createdAt: (0, reminder_store_js_1.nowIso)(now),
-            status: "scheduled",
-            version: 1,
-            events: [],
-            deliveryTarget: parsed.deliveryTarget,
-            deliveryAnchor: wantedAnchor,
-            deliveryMode: "user",
-            repeat: exports.DEFAULT_MISSED_OUTBOUND_REPEAT,
-        });
-        return { created: true, reminderId, rebuilt: hadFired };
-    });
+/** Record only an authoritative human group/topic source; DMs and bots are ignored. */
+function observeInboxAuditTarget(file, agentId, event, now = new Date()) {
+    if (event._scan_authority !== true || event._sender_is_bot !== false || event.chat_type !== "group")
+        return false;
+    const parsed = parseTarget(event);
+    if (!parsed)
+        return false;
+    const registry = load(file);
+    const observed_at = now.toISOString();
+    registry.targets = registry.targets.filter((row) => row.agent_id !== agentId || row.target !== parsed.target);
+    registry.targets.unshift({ agent_id: agentId, ...parsed, observed_at });
+    registry.targets = registry.targets.slice(0, MAX_STORED_TARGETS);
+    save(file, registry);
+    return true;
 }
-function persistInboundScanTarget(stateDir, event, agentId, storeFile = node_path_1.default.join(stateDir, "reminders.json")) {
-    if (event._sender_is_bot)
-        throw new Error("scan reminder 只接受 human inbound");
-    if (event._scan_authority !== true)
-        throw new Error("scan reminder 需要权威 chatType/senderIsBot");
-    if (event.chat_type !== "group")
-        throw new Error("scan reminder 只接受 group/thread，禁止 DM");
-    const chatId = String(event.chat_id || "");
-    if (!/^oc_[A-Za-z0-9]+$/.test(chatId)) {
-        throw new Error("user-facing reminder 必须显式指定 delivery target，不得从标题推断收件人");
-    }
-    const threadId = event.thread_id ? String(event.thread_id) : "";
-    const parsed = threadId
-        ? parseScanDeliveryTarget(`thread:${chatId}:${threadId}`, event.message_id)
-        : parseScanDeliveryTarget(`chat:${chatId}`, event.message_id || null);
-    ensureDefaultMissedOutboundScanReminder({
-        storeFile,
-        agentId,
-        deliveryTarget: parsed.deliveryTarget,
-        deliveryAnchor: parsed.deliveryAnchor,
-    });
-    return parsed;
+function instruction(target) {
+    const history = target.target.startsWith("thread:")
+        ? "Use larkin im +threads-messages-list for this exact thread."
+        : "Use larkin im +chat-messages-list for this exact chat.";
+    return `${history} If a real missed outbound finding requires a response, use the existing guarded larkin im reply path anchored at ${target.anchor}; otherwise stay silent.`;
+}
+/** Content-free, bounded audit work list consumed by the Agent CLI. */
+function readInboxAuditTargets(file, agentId) {
+    const rows = load(file).targets.filter((row) => row.agent_id === agentId)
+        .sort((left, right) => right.observed_at.localeCompare(left.observed_at));
+    return {
+        version: 1,
+        targets: rows.slice(0, exports.MAX_INBOX_AUDIT_TARGETS).map(({ agent_id: _agentId, ...target }) => ({ ...target, instruction: instruction(target) })),
+        has_more: rows.length > exports.MAX_INBOX_AUDIT_TARGETS,
+        no_finding: "stay_silent",
+    };
 }

package/dist/agent/missed-outbound-scan.mjs

@@ -1,112 +1,94 @@
-import path from "node:path";
-import { mutate, newId, nowIso, parseRepeat } from "./reminder-store.mjs";
-export const DEFAULT_MISSED_OUTBOUND_TITLE = "Read scoped history from this reminder envelope's persisted deliveryTarget (chat: +chat-messages-list; thread: +threads-messages-list). Judge unanswered asks, undelivered follow-ups, and stalled work. On a hit, post a short status in the same conversation using that persisted deliveryTarget/anchor; otherwise stay silent. Never infer recipients from the title.";
-export const DEFAULT_MISSED_OUTBOUND_REPEAT = "every:15m";
-const CHAT_TARGET = /^chat:(oc_[A-Za-z0-9]+)$/;
-const THREAD_TARGET = /^thread:(oc_[A-Za-z0-9]+):(omt_[A-Za-z0-9]+)$/;
-const OM_ID = /^om_[A-Za-z0-9]+$/;
-export function parseOmMessageId(value, label = "message-id") {
-    const id = String(value || "").trim();
-    if (!OM_ID.test(id))
-        throw new Error(`${label} 必须是严格 om_ 语法`);
-    return id;
+import * as fs from "node:fs";
+import * as path from "node:path";
+/**
+ * #169's host-owned heartbeat no longer creates per-target missed-outbound loops.
+ * Pre-v0.4.21 records have no unique ownership marker and can collide exactly
+ * with user reminders, so existing indistinguishable loops are never migrated
+ * or deleted automatically.
+ */
+export const INBOX_AUDIT_LEGACY_MIGRATION_NON_GOAL = "New versions no longer create missed-outbound loops; existing indistinguishable historical loops are not migrated or deleted automatically.";
+// Audits return every retained target. Storage remains bounded so a heartbeat
+// cannot accumulate an unbounded work list.
+export const MAX_INBOX_AUDIT_TARGETS = 96;
+const MAX_STORED_TARGETS = MAX_INBOX_AUDIT_TARGETS;
+const CHAT = /^oc_[A-Za-z0-9]+$/;
+const THREAD = /^omt_[A-Za-z0-9]+$/;
+const ANCHOR = /^om_[A-Za-z0-9_-]+$/;
+export function inboxAuditRegistryFile(larkinHome) {
+    return path.join(larkinHome, "inbox-audit.json");
 }
-export function parseScanDeliveryTarget(target, anchor) {
-    const deliveryTarget = String(target || "").trim();
-    if (!deliveryTarget) {
-        throw new Error("user-facing reminder 必须显式指定 delivery target，不得从标题推断收件人");
-    }
-    const chat = deliveryTarget.match(CHAT_TARGET);
-    if (chat) {
-        return {
-            deliveryTarget,
-            scope: "chat",
-            chatId: chat[1],
-            threadId: null,
-            deliveryAnchor: anchor ? parseOmMessageId(anchor, "delivery anchor") : null,
-        };
+function parseTarget(event) {
+    const chatId = String(event.chat_id || "");
+    const threadId = event.thread_id ? String(event.thread_id) : "";
+    const anchor = String(event.message_id || "");
+    if (!CHAT.test(chatId) || !ANCHOR.test(anchor) || (threadId && !THREAD.test(threadId)))
+        return null;
+    return { target: threadId ? `thread:${chatId}:${threadId}` : `chat:${chatId}`, anchor };
+}
+function load(file) {
+    let value;
+    try {
+        value = JSON.parse(fs.readFileSync(file, "utf8"));
     }
-    const thread = deliveryTarget.match(THREAD_TARGET);
-    if (thread) {
-        return {
-            deliveryTarget,
-            scope: "thread",
-            chatId: thread[1],
-            threadId: thread[2],
-            deliveryAnchor: parseOmMessageId(anchor, "delivery anchor"),
-        };
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { version: 1, targets: [] };
+        throw error;
     }
-    throw new Error("delivery target 必须是 chat:oc_… 或 thread:oc_…:omt_…，禁止推断 DM");
+    if (value?.version !== 1 || !Array.isArray(value.targets))
+        return { version: 1, targets: [] };
+    return { version: 1, targets: value.targets.flatMap((row) => {
+            if (!row || typeof row !== "object")
+                return [];
+            const candidate = row;
+            if (typeof candidate.target !== "string" || typeof candidate.anchor !== "string")
+                return [];
+            const parsed = parseTarget({
+                chat_id: candidate.target.startsWith("chat:") ? candidate.target.slice(5) : candidate.target.split(":")[1],
+                thread_id: candidate.target.startsWith("thread:") ? candidate.target.split(":")[2] : null,
+                message_id: candidate.anchor,
+            });
+            return typeof candidate.agent_id === "string" && candidate.agent_id && parsed && candidate.target === parsed.target
+                && typeof candidate.observed_at === "string" && Number.isFinite(Date.parse(candidate.observed_at))
+                ? [{ agent_id: candidate.agent_id, ...parsed, observed_at: candidate.observed_at }] : [];
+        }) };
 }
-export function isDefaultMissedOutboundReminder(reminder) {
-    return reminder?.title === DEFAULT_MISSED_OUTBOUND_TITLE
-        && reminder.repeat === DEFAULT_MISSED_OUTBOUND_REPEAT
-        && reminder.deliveryMode === "user"
-        && reminder.status === "scheduled";
+function save(file, registry) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);
+    fs.writeFileSync(temporary, `${JSON.stringify(registry)}\n`, { mode: 0o600 });
+    fs.renameSync(temporary, file);
+    fs.chmodSync(file, 0o600);
 }
-export function ensureDefaultMissedOutboundScanReminder(input) {
-    const parsed = parseScanDeliveryTarget(input.deliveryTarget, input.deliveryAnchor);
-    const recurrence = parseRepeat(DEFAULT_MISSED_OUTBOUND_REPEAT);
-    if ("error" in recurrence)
-        throw new Error(recurrence.error);
-    const now = input.nowMs ?? Date.now();
-    const wantedAnchor = parsed.deliveryAnchor;
-    return mutate(input.storeFile, (store) => {
-        const sameIdentity = (reminder) => reminder.ownerAgentId === input.agentId
-            && reminder.title === DEFAULT_MISSED_OUTBOUND_TITLE
-            && reminder.repeat === DEFAULT_MISSED_OUTBOUND_REPEAT
-            && reminder.deliveryMode === "user"
-            && reminder.deliveryTarget === parsed.deliveryTarget;
-        const scheduled = store.reminders.find((reminder) => sameIdentity(reminder) && reminder.status === "scheduled");
-        if (scheduled) {
-            if ((scheduled.deliveryAnchor || null) !== wantedAnchor)
-                scheduled.deliveryAnchor = wantedAnchor;
-            return { created: false, reminderId: scheduled.reminderId, rebuilt: false };
-        }
-        const canceled = store.reminders.find((reminder) => sameIdentity(reminder) && reminder.status === "canceled");
-        if (canceled)
-            return { created: false, reminderId: canceled.reminderId, rebuilt: false };
-        const hadFired = store.reminders.some((reminder) => sameIdentity(reminder) && reminder.status === "fired");
-        store.reminders = store.reminders.filter((reminder) => !(sameIdentity(reminder) && reminder.status === "fired"));
-        const reminderId = newId();
-        store.reminders.push({
-            reminderId,
-            ownerAgentId: input.agentId,
-            title: DEFAULT_MISSED_OUTBOUND_TITLE,
-            fireAt: nowIso(now + 15 * 60_000),
-            firedAt: null,
-            createdAt: nowIso(now),
-            status: "scheduled",
-            version: 1,
-            events: [],
-            deliveryTarget: parsed.deliveryTarget,
-            deliveryAnchor: wantedAnchor,
-            deliveryMode: "user",
-            repeat: DEFAULT_MISSED_OUTBOUND_REPEAT,
-        });
-        return { created: true, reminderId, rebuilt: hadFired };
-    });
+/** Record only an authoritative human group/topic source; DMs and bots are ignored. */
+export function observeInboxAuditTarget(file, agentId, event, now = new Date()) {
+    if (event._scan_authority !== true || event._sender_is_bot !== false || event.chat_type !== "group")
+        return false;
+    const parsed = parseTarget(event);
+    if (!parsed)
+        return false;
+    const registry = load(file);
+    const observed_at = now.toISOString();
+    registry.targets = registry.targets.filter((row) => row.agent_id !== agentId || row.target !== parsed.target);
+    registry.targets.unshift({ agent_id: agentId, ...parsed, observed_at });
+    registry.targets = registry.targets.slice(0, MAX_STORED_TARGETS);
+    save(file, registry);
+    return true;
 }
-export function persistInboundScanTarget(stateDir, event, agentId, storeFile = path.join(stateDir, "reminders.json")) {
-    if (event._sender_is_bot)
-        throw new Error("scan reminder 只接受 human inbound");
-    if (event._scan_authority !== true)
-        throw new Error("scan reminder 需要权威 chatType/senderIsBot");
-    if (event.chat_type !== "group")
-        throw new Error("scan reminder 只接受 group/thread，禁止 DM");
-    const chatId = String(event.chat_id || "");
-    if (!/^oc_[A-Za-z0-9]+$/.test(chatId)) {
-        throw new Error("user-facing reminder 必须显式指定 delivery target，不得从标题推断收件人");
-    }
-    const threadId = event.thread_id ? String(event.thread_id) : "";
-    const parsed = threadId
-        ? parseScanDeliveryTarget(`thread:${chatId}:${threadId}`, event.message_id)
-        : parseScanDeliveryTarget(`chat:${chatId}`, event.message_id || null);
-    ensureDefaultMissedOutboundScanReminder({
-        storeFile,
-        agentId,
-        deliveryTarget: parsed.deliveryTarget,
-        deliveryAnchor: parsed.deliveryAnchor,
-    });
-    return parsed;
+function instruction(target) {
+    const history = target.target.startsWith("thread:")
+        ? "Use larkin im +threads-messages-list for this exact thread."
+        : "Use larkin im +chat-messages-list for this exact chat.";
+    return `${history} If a real missed outbound finding requires a response, use the existing guarded larkin im reply path anchored at ${target.anchor}; otherwise stay silent.`;
+}
+/** Content-free, bounded audit work list consumed by the Agent CLI. */
+export function readInboxAuditTargets(file, agentId) {
+    const rows = load(file).targets.filter((row) => row.agent_id === agentId)
+        .sort((left, right) => right.observed_at.localeCompare(left.observed_at));
+    return {
+        version: 1,
+        targets: rows.slice(0, MAX_INBOX_AUDIT_TARGETS).map(({ agent_id: _agentId, ...target }) => ({ ...target, instruction: instruction(target) })),
+        has_more: rows.length > MAX_INBOX_AUDIT_TARGETS,
+        no_finding: "stay_silent",
+    };
 }

package/dist/app/agent-cli.mjs

@@ -7,6 +7,7 @@ import * as path from "node:path";
 import { createAgentStateStore } from "../agent/agent-state-store.mjs";
 import * as larkinConfig from "../platform/config.mjs";
 import { projectInboxCheck, projectInboxEvents } from "../agent/inbox-projection.mjs";
+import { inboxAuditRegistryFile, readInboxAuditTargets } from "../agent/missed-outbound-scan.mjs";
 import { createReminderRoutes } from "../agent/reminder-routes.mjs";
 import { InteractionStateMachine } from "../agent/interaction-state-machine.mjs";
 import { issueCallbackProbe, readCallbackCapability } from "../platform/callback-capability.mjs";
@@ -501,10 +502,17 @@ export function runAgentCli(argv, env = process.env, dependencies = {}) {
         const { config, agent } = requireAgent(env);
         const stateStore = dependencies.stateStore ?? createAgentStateStore(config.larkinHome, agent.agentId);
         if (group === "inbox") {
-            if (!["check", "poll"].includes(subcommand || "")) {
-                throw new Error("inbox 只支持 `larkin inbox check` 与 `larkin inbox poll`");
+            if (!["check", "poll", "audit"].includes(subcommand || "")) {
+                throw new Error("inbox 只支持 `larkin inbox check`、`larkin inbox poll` 与 `larkin inbox audit`");
             }
             const options = parseOptions(rest, new Set(["--json"]));
+            if (subcommand === "audit") {
+                if (options.positionals.length || options.values.size || options.booleans.size > 1) {
+                    throw new Error("inbox audit 只接受 --json");
+                }
+                emitJson(io, readInboxAuditTargets(inboxAuditRegistryFile(config.larkinHome), agent.agentId));
+                return 0;
+            }
             if (options.positionals.length || [...options.values.keys()].some((flag) => !["--target", "--limit"].includes(flag))) {
                 throw new Error(`inbox ${subcommand} 只接受 --target、${subcommand === "poll" ? "--limit、" : ""}--json`);
             }

package/dist/app/lark-cli.mjs

@@ -209,6 +209,11 @@ export function classifyLarkCliCommand(argv) {
             ? (parsed.commandArgv.includes("--dry-run") || parsed.help ? { kind: "passthrough" } : { kind: "guarded", operation: "urgent-app" })
             : noncanonicalProtectedDecision();
     }
+    if (exactPath(parsed.commandArgv, ["im", "messages", "delete"])) {
+        return uniqueProtectedOperation(protectedPaths, "raw-delete")
+            ? (parsed.commandArgv.includes("--dry-run") || parsed.help ? { kind: "passthrough" } : { kind: "guarded", operation: "recall" })
+            : noncanonicalProtectedDecision();
+    }
     if (exactPath(parsed.commandArgv, ["im", "messages", "patch"]) || exactPath(parsed.commandArgv, ["im", "messages", "update"])) {
         const expected = parsed.commandArgv[2] === "patch" ? "card-patch" : "card-update";
         return uniqueProtectedOperation(protectedPaths, expected)
@@ -221,7 +226,7 @@ export function classifyLarkCliCommand(argv) {
             ? { kind: "denied", reason: "该原始 IM 写入口会旁路 target freshness；请使用 +messages-send/+messages-reply" }
             : noncanonicalProtectedDecision();
     }
-    if (["forward", "merge_forward", "delete", "urgent_phone", "urgent_sms"]
+    if (["forward", "merge_forward", "urgent_phone", "urgent_sms"]
         .some((operation) => exactPath(parsed.commandArgv, ["im", "messages", operation]))) {
         const expected = `raw-${parsed.commandArgv[2]}`;
         return uniqueProtectedOperation(protectedPaths, expected)
@@ -492,6 +497,40 @@ function guardedTarget(decision, argv, store) {
         throw new Error(`无法从 Inbox 状态确定 ${messageId} 的 target；先 poll 对应消息，禁止旁路 freshness`);
     return feishuImTarget(target);
 }
+function recallLedgerEntry(store, messageId) {
+    const state = store.readJson("freshnessState", { version: 1, cursors: {} });
+    const entry = state.message_recalls?.[messageId];
+    return entry && typeof entry === "object" ? entry : null;
+}
+function claimRecall(store, messageId, target) {
+    return store.mutateJson("freshnessState", { version: 1, cursors: {} }, (state) => {
+        state.message_recalls ??= {};
+        const prior = state.message_recalls[messageId];
+        if (prior?.status === "deleted")
+            return "deleted";
+        if (prior?.status === "deleting")
+            return "ambiguous";
+        state.message_recalls[messageId] = { status: "deleting", target, updated_at: new Date().toISOString() };
+        return "ready";
+    });
+}
+function finalizeFailedRecall(store, messageId, target) {
+    store.mutateJson("freshnessState", { version: 1, cursors: {} }, (state) => {
+        state.message_recalls ??= {};
+        state.message_recalls[messageId] = { status: "failed", target, updated_at: new Date().toISOString() };
+    });
+}
+function finalizeSuccessfulRecall(store, messageId, target, cursor, generation) {
+    store.mutateJson("freshnessState", { version: 1, cursors: {} }, (state) => {
+        state.cursors ??= {};
+        if (cursor)
+            state.cursors[target] = { generation, cursor };
+        else
+            delete state.cursors[target];
+        state.message_recalls ??= {};
+        state.message_recalls[messageId] = { status: "deleted", target, updated_at: new Date().toISOString() };
+    });
+}
 function uniqueRawFlagValue(argv, flag) {
     const nativeArgv = nativeArgvBeforeBoundary(argv);
     const values = [];
@@ -509,6 +548,57 @@ function uniqueRawFlagValue(argv, flag) {
         throw new Error(`Runtime im messages urgent_app 不允许重复 ${flag}；官方 CLI 会采用最后一次赋值`);
     return values[0] || null;
 }
+function assertRecallSyntax(argv) {
+    const messageId = policyFlagValue(argv, "--message-id");
+    if (!messageId || !/^om_[A-Za-z0-9_-]+$/.test(messageId)) {
+        throw new Error("Runtime im messages delete 只接受真实 Feishu om_ message_id");
+    }
+    const yesCount = nativeArgvBeforeBoundary(argv).filter((argument) => argument === "--yes").length;
+    if (yesCount !== 1)
+        throw new Error("Runtime im messages delete 必须且只能指定一次 --yes 显式确认");
+    if (policyFlagValue(argv, "--idempotency-key")) {
+        throw new Error("Runtime im messages delete 不接受 provider idempotency key；Runtime 使用本地 recall ledger 防止重复提交");
+    }
+    return messageId;
+}
+function resolveOwnedRecallTarget(messageId, feishuAppId, env, io, dependencies) {
+    const result = callNative([
+        "im", "+messages-mget", "--message-ids", messageId, "--no-reactions", "--json", "--as", "bot",
+    ], env, io, dependencies);
+    if (result.error)
+        throw new Error(`recall message lookup failed: ${result.error.message}`);
+    if (result.status !== 0)
+        throw new Error(`recall message lookup exited ${result.status ?? "without status"}: ${result.stderr || "no details"}`);
+    let value;
+    try {
+        value = JSON.parse(result.stdout || "");
+    }
+    catch {
+        throw new Error("recall message lookup returned non-JSON output");
+    }
+    const root = value;
+    if (!root || root.ok !== true || !root.data)
+        throw new Error("recall message lookup returned an unsuccessful payload");
+    if (root.identity !== "bot")
+        throw new Error("recall message lookup did not confirm Bot identity");
+    if (!Array.isArray(root.data.messages))
+        throw new Error("recall message lookup omitted messages");
+    const matches = root.data.messages.filter((row) => row && typeof row === "object" && !Array.isArray(row)
+        && row.message_id === messageId);
+    if (matches.length !== 1)
+        throw new Error(`无法唯一确认 ${messageId} 的原始消息；禁止旁路 recall ownership`);
+    const message = matches[0];
+    if (typeof message.chat_id !== "string" || !message.chat_id) {
+        throw new Error(`无法从官方 +messages-mget 确认 ${messageId} 的 chat；禁止旁路 recall freshness`);
+    }
+    if (!isOwnBotMessage(message, feishuAppId)) {
+        throw new Error("Runtime im messages delete 只能撤回当前 Runtime Bot 自己发出的消息；拒绝跨 Agent 或第三方消息");
+    }
+    const target = typeof message.thread_id === "string" && message.thread_id
+        ? feishuImTarget(`thread:${message.chat_id}:${message.thread_id}`)
+        : feishuImTarget(`chat:${message.chat_id}`);
+    return { target, message };
+}
 function resolveUrgentAppTarget(argv, env, io, dependencies) {
     const messageId = policyFlagValue(argv, "--message-id");
     if (!messageId || !/^om_/.test(messageId)) {
@@ -555,10 +645,11 @@ function botArgv(argv, intentId, decision) {
     const injected = [];
     if (!parsed.flags.has("--as"))
         injected.push("--as", "bot");
-    if (decision?.operation !== "urgent-app" && !parsed.flags.has("--idempotency-key"))
+    const supportsProviderIdempotency = decision?.operation !== "urgent-app" && decision?.operation !== "recall";
+    if (supportsProviderIdempotency && !parsed.flags.has("--idempotency-key"))
         injected.push("--idempotency-key", intentId);
     next.splice(insertion, 0, ...injected);
-    if (decision?.operation !== "urgent-app")
+    if (supportsProviderIdempotency)
         return next;
     const rewritten = [];
     for (let index = 0; index < next.length; index += 1) {
@@ -768,7 +859,7 @@ function emitFreshnessError(io, input) {
         target: input.target,
         ...(input.current ? { current_cursor: input.current } : {}),
         ...(input.messages ? { unseen_messages: input.messages } : {}),
-        next: "Reconsider the returned context, then retry the ordinary send/reply/card command; history is probed again before every write.",
+        next: "Reconsider the returned context, then retry the ordinary send/reply/card/recall command; history is probed again before every write.",
     })}\n`);
 }
 function freshnessGeneration(env) {
@@ -984,6 +1075,17 @@ function emitDuplicatedWrite(result, io, input) {
     })}\n`);
     return 0;
 }
+function emitDuplicatedRecall(io, messageId, target) {
+    io.stdout(`${JSON.stringify({
+        ok: true,
+        identity: "bot",
+        committed: true,
+        duplicate: true,
+        message_id: messageId,
+        target,
+    })}\n`);
+    return 0;
+}
 function emitCommittedUnverified(result, io, input) {
     let providerResponse;
     try {
@@ -1074,10 +1176,20 @@ export function runLarkCli(argv, env = process.env, dependencies = {}) {
     if (decision.kind === "passthrough")
         return passthroughWithObservation(effectiveArgv, privateEnv, io, nativeDependencies, store);
     try {
+        const recallMessageId = decision.operation === "recall" ? assertRecallSyntax(effectiveArgv) : null;
+        const priorRecall = recallMessageId ? recallLedgerEntry(store, recallMessageId) : null;
+        if (priorRecall?.status === "deleted")
+            return emitDuplicatedRecall(io, recallMessageId, priorRecall.target);
+        if (priorRecall?.status === "deleting") {
+            throw new Error("message recall 上次 provider 结果不明确，已 fail-closed 以避免重复撤回；请由用户检查原会话");
+        }
+        const recall = recallMessageId
+            ? resolveOwnedRecallTarget(recallMessageId, agent.feishuAppId, privateEnv, io, nativeDependencies)
+            : null;
         const urgent = decision.operation === "urgent-app"
             ? resolveUrgentAppTarget(effectiveArgv, privateEnv, io, nativeDependencies)
             : null;
-        const target = urgent?.target ?? guardedTarget(decision, effectiveArgv, store);
+        const target = recall?.target ?? urgent?.target ?? guardedTarget(decision, effectiveArgv, store);
         const targetKey = serializeFeishuImTarget(target);
         const generation = freshnessGeneration(privateEnv);
         const seen = store.readFreshnessCursor(targetKey, generation);
@@ -1095,6 +1207,26 @@ export function runLarkCli(argv, env = process.env, dependencies = {}) {
             store.mergeFreshnessCursor(targetKey, gated.current, mergeFeishuImCursor, generation);
             return 3;
         }
+        if (decision.operation === "recall") {
+            const claim = claimRecall(store, recallMessageId, targetKey);
+            if (claim === "deleted")
+                return emitDuplicatedRecall(io, recallMessageId, targetKey);
+            if (claim === "ambiguous") {
+                throw new Error("message recall 上次 provider 结果不明确，已 fail-closed 以避免重复撤回；请由用户检查原会话");
+            }
+            const recallWrite = callNative(botArgv(effectiveArgv, "", decision), privateEnv, io, nativeDependencies);
+            if (!recallWrite.error && recallWrite.status === 0) {
+                const predictedSnapshot = {
+                    messages: gated.snapshot.messages.filter((message) => message.message_id !== recallMessageId),
+                };
+                const predictedCursor = feishuImFreshnessAdapter.cursor(predictedSnapshot);
+                finalizeSuccessfulRecall(store, recallMessageId, targetKey, predictedCursor, generation);
+            }
+            else if (definitiveProviderRejection(recallWrite)) {
+                finalizeFailedRecall(store, recallMessageId, targetKey);
+            }
+            return emitNativeResult(recallWrite, io);
+        }
         if (decision.operation === "urgent-app") {
             const userIds = assertUrgentAppPreconditions(effectiveArgv, urgent.message, target, agent.feishuAppId);
             assertUrgentAppMembers(effectiveArgv, target, userIds, privateEnv, io, nativeDependencies);

package/dist/feishu/host-shell.cjs

@@ -51,6 +51,7 @@ const host_business_state_js_1 = require("./host-business-state.cjs");
 const host_processing_eye_js_1 = require("./host-processing-eye.cjs");
 const inbox_projection_js_1 = require("../agent/inbox-projection.cjs");
 const host_reminder_orchestrator_js_1 = require("../agent/host-reminder-orchestrator.cjs");
+const inbox_audit_heartbeat_js_1 = require("../agent/inbox-audit-heartbeat.cjs");
 const missed_outbound_scan_js_1 = require("../agent/missed-outbound-scan.cjs");
 const host_channel_business_js_1 = require("./host-channel-business.cjs");
 const interaction_orchestrator_js_1 = require("./interaction-orchestrator.cjs");
@@ -340,6 +341,13 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
     for (const agent of agents)
         prepareAgentState(agent);
     const reminder = new host_reminder_orchestrator_js_1.HostReminderOrchestrator({ agents, stateStore, envelopeProjector, deliveryTarget: runtimeHost, log });
+    const inboxAudit = new inbox_audit_heartbeat_js_1.InboxAuditHeartbeat({
+        agents,
+        stateStore,
+        runtimeHost,
+        log,
+    });
+    const auditRegistry = (0, missed_outbound_scan_js_1.inboxAuditRegistryFile)(larkinHome);
     const seenEventIds = new Set();
     const inFlightEventIds = new Set();
     const onFeishuMessage = async (agent, event, options) => {
@@ -386,13 +394,11 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
                 // append/dedupe decision is durable. Agent model-seen state is untouched.
                 if (event.event_id)
                     seenEventIds.add(eventKey);
-                if (!event._sender_is_bot && event._scan_authority) {
-                    try {
-                        (0, missed_outbound_scan_js_1.persistInboundScanTarget)(agent.stateDir, event, agent.agentId);
-                    }
-                    catch (error) {
-                        log(`inbound scan target 未持久化: ${error.message}`);
-                    }
+                try {
+                    (0, missed_outbound_scan_js_1.observeInboxAuditTarget)(auditRegistry, agent.agentId, event);
+                }
+                catch (error) {
+                    log(`inbox audit target 未持久化: ${error.message}`);
                 }
                 if (append.status === "duplicate_consumed")
                     return null;
@@ -1345,6 +1351,7 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
             eventSourceStartTimer = null;
             await Promise.resolve(eventSourceStop());
             reminder.stopSync();
+            inboxAudit.stop();
             interaction.stopSync();
             await runtimeHost.shutdown(reason);
         })();
@@ -1559,6 +1566,7 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
                     sessionId: agentStates.get(agent.agentId)?.state.sessions[agent.runtime] || null,
                 })));
                 reminder.startSync();
+                inboxAudit.start();
                 interaction.startSync();
                 eventSourceStartTimer = setTimeout(() => { eventSourceStartTimer = null; startEventSource(); }, eventSourceStartDelayMs);
             }

package/dist/feishu/host-shell.mjs

@@ -11,7 +11,8 @@ import { HostEnvelopeProjector, HostStateProjection, SenderIdentityCache, projec
 import { ProcessingEyeOrchestrator } from "./host-processing-eye.mjs";
 import { projectInboxEnvelope, targetKeyOfInboxEnvelope } from "../agent/inbox-projection.mjs";
 import { HostReminderOrchestrator } from "../agent/host-reminder-orchestrator.mjs";
-import { persistInboundScanTarget } from "../agent/missed-outbound-scan.mjs";
+import { InboxAuditHeartbeat } from "../agent/inbox-audit-heartbeat.mjs";
+import { inboxAuditRegistryFile, observeInboxAuditTarget } from "../agent/missed-outbound-scan.mjs";
 import { HostChannelBusiness } from "./host-channel-business.mjs";
 import { HostInteractionOrchestrator } from "./interaction-orchestrator.mjs";
 import { targetFor } from "./message-policy.mjs";
@@ -300,6 +301,13 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
     for (const agent of agents)
         prepareAgentState(agent);
     const reminder = new HostReminderOrchestrator({ agents, stateStore, envelopeProjector, deliveryTarget: runtimeHost, log });
+    const inboxAudit = new InboxAuditHeartbeat({
+        agents,
+        stateStore,
+        runtimeHost,
+        log,
+    });
+    const auditRegistry = inboxAuditRegistryFile(larkinHome);
     const seenEventIds = new Set();
     const inFlightEventIds = new Set();
     const onFeishuMessage = async (agent, event, options) => {
@@ -346,13 +354,11 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
                 // append/dedupe decision is durable. Agent model-seen state is untouched.
                 if (event.event_id)
                     seenEventIds.add(eventKey);
-                if (!event._sender_is_bot && event._scan_authority) {
-                    try {
-                        persistInboundScanTarget(agent.stateDir, event, agent.agentId);
-                    }
-                    catch (error) {
-                        log(`inbound scan target 未持久化: ${error.message}`);
-                    }
+                try {
+                    observeInboxAuditTarget(auditRegistry, agent.agentId, event);
+                }
+                catch (error) {
+                    log(`inbox audit target 未持久化: ${error.message}`);
                 }
                 if (append.status === "duplicate_consumed")
                     return null;
@@ -1305,6 +1311,7 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
             eventSourceStartTimer = null;
             await Promise.resolve(eventSourceStop());
             reminder.stopSync();
+            inboxAudit.stop();
             interaction.stopSync();
             await runtimeHost.shutdown(reason);
         })();
@@ -1519,6 +1526,7 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
                     sessionId: agentStates.get(agent.agentId)?.state.sessions[agent.runtime] || null,
                 })));
                 reminder.startSync();
+                inboxAudit.start();
                 interaction.startSync();
                 eventSourceStartTimer = setTimeout(() => { eventSourceStartTimer = null; startEventSource(); }, eventSourceStartDelayMs);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "larkin",
-  "version": "0.4.21",
+  "version": "0.4.23",
   "private": false,
   "larkinPackageRole": "npm-published",
   "files": [
@@ -73,9 +73,12 @@
     "test:eval:pi-bash-timeout": "bun run build && bun test --max-concurrency 1 test/live/pi-bash-timeout-live.test.mjs",
     "test:eval:runtime-agent-interface-v2": "bun test --max-concurrency 1 test/unit/evals/runtime-agent-interface-v2.test.mjs",
     "test:eval:authoritative-freshness-gate": "bun test --max-concurrency 1 test/unit/evals/authoritative-freshness-gate.test.mjs",
+    "test:eval:protected-message-recall": "bun run build && bun test --max-concurrency 1 test/unit/evals/protected-message-recall.test.mjs test/unit/app/lark-cli-launcher.test.mjs",
     "test:eval:agent-experience-v6": "bun test --max-concurrency 1 test/unit/evals/agent-experience-v6.test.mjs",
     "test:eval:mention-construction": "bun run build && LARKIN_RUN_MENTION_CONSTRUCTION_EVAL=1 bun test --max-concurrency 1 test/live/mention-construction-agent-eval.test.mjs",
     "test:eval:clickable-link-delivery": "bun run build && bun test --max-concurrency 1 test/unit/evals/clickable-link-delivery.test.mjs",
+    "test:eval:im-body-mode": "bun run build && bun test --max-concurrency 1 test/unit/evals/im-body-mode.test.mjs",
+    "test:eval:im-body-mode:native": "bun run build && LARKIN_RUN_IM_BODY_MODE_EVAL=1 bun test --max-concurrency 1 test/live/im-body-mode-agent-eval.test.mjs",
     "test:eval:clickable-link-delivery:native": "bun run build && LARKIN_RUN_CLICKABLE_LINK_DELIVERY_EVAL=1 bun test --max-concurrency 1 test/live/clickable-link-delivery-agent-eval.test.mjs",
     "test:eval:public-contribution-governance": "bun test --max-concurrency 1 test/unit/evals/public-contribution-governance.test.mjs",
     "test:live:public-contribution-governance": "bun test --max-concurrency 1 test/live/public-contribution-governance-live.test.mjs",