larkin 0.5.16 → 0.5.18

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.5.18
+
+The Feishu processing-eye OnIt reaction is now off by default. New installs and existing configs that omit `processingEye` no longer auto-react on inbound messages after upgrade; there is no migration prompt. Opt back in with `larkin config processing-eye global on`, a per-Agent `on`/`off`/`inherit` override, or the Dashboard 处理中表情 toggle. Explicit `enabled: false` and a missing key both skip the reactions API.
+
 ## 0.5.8
 
 Lark setup now reconciles requested tenant permissions with actual grants and links missing scopes to the same application in the developer console. Required permissions still block setup until granted; optional permissions and event/callback verification are reported separately. Existing-application authorization preserves and checks its App ID before recording any capability state.

package/README.md

@@ -114,6 +114,17 @@ larkin config inbox-audit global off
 
 When enabled, audit only revisits originally wake-eligible human group/topic work and does not wake a model for an empty work list. Reading an audit list does not complete it: the managed Agent follows the returned inspection instructions and explicitly confirms the receipt after checking. A failed check remains retryable; newer messages cannot be completed by an older receipt. Old audit-index records without proven eligibility or observation identity are ignored; ordinary Inbox messages and conversation history are preserved.
 
+### Optional processing eye (OnIt)
+
+The Feishu "processing eye" (OnIt reaction on inbound messages while the Agent works) is **off by default**. A missing `processingEye` key is treated as off, so upgrading to this version stops the auto-reaction without a migration prompt. In the Dashboard, use **Global settings → 处理中表情** or the selected Agent's **Configuration → 处理中表情**. The same settings are available through the CLI:
+
+```bash
+larkin config processing-eye global on
+larkin config processing-eye agent off --agent <App-ID>
+larkin config processing-eye agent inherit --agent <App-ID>
+larkin config processing-eye global off
+```
+
 <details>
 <summary>Windows support and optional autostart</summary>
 

package/dist/agent/config-cli-contract.cjs

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CONFIG_CLI_VALUES = exports.CONFIG_CLI_USAGE = exports.CONFIG_CLI_OPERATIONS = void 0;
-exports.CONFIG_CLI_OPERATIONS = Object.freeze(["show", "runtime", "model", "effort", "mention", "inbox-audit", "apply"]);
+exports.CONFIG_CLI_OPERATIONS = Object.freeze(["show", "runtime", "model", "effort", "mention", "inbox-audit", "processing-eye", "apply"]);
 exports.CONFIG_CLI_USAGE = Object.freeze([
     "larkin config show [--agent <App ID>] [--chat <oc_id>] [--json]",
     "larkin config runtime <runtime> [--model <model>] [--agent <App ID>]",
@@ -12,6 +12,8 @@ exports.CONFIG_CLI_USAGE = Object.freeze([
     "larkin config mention chat <oc_id> <inherit|require|free> [--agent <App ID>]",
     "larkin config inbox-audit global <on|off> [--interval <15m|1h>]",
     "larkin config inbox-audit agent <inherit|on|off> [--agent <App ID>] [--interval <15m|inherit>]",
+    "larkin config processing-eye global <on|off>",
+    "larkin config processing-eye agent <inherit|on|off> [--agent <App ID>]",
     "larkin config apply [--agent <App ID>]",
 ]);
 exports.CONFIG_CLI_VALUES = Object.freeze({

package/dist/agent/config-cli-contract.mjs

@@ -1,4 +1,4 @@
-export const CONFIG_CLI_OPERATIONS = Object.freeze(["show", "runtime", "model", "effort", "mention", "inbox-audit", "apply"]);
+export const CONFIG_CLI_OPERATIONS = Object.freeze(["show", "runtime", "model", "effort", "mention", "inbox-audit", "processing-eye", "apply"]);
 export const CONFIG_CLI_USAGE = Object.freeze([
     "larkin config show [--agent <App ID>] [--chat <oc_id>] [--json]",
     "larkin config runtime <runtime> [--model <model>] [--agent <App ID>]",
@@ -9,6 +9,8 @@ export const CONFIG_CLI_USAGE = Object.freeze([
     "larkin config mention chat <oc_id> <inherit|require|free> [--agent <App ID>]",
     "larkin config inbox-audit global <on|off> [--interval <15m|1h>]",
     "larkin config inbox-audit agent <inherit|on|off> [--agent <App ID>] [--interval <15m|inherit>]",
+    "larkin config processing-eye global <on|off>",
+    "larkin config processing-eye agent <inherit|on|off> [--agent <App ID>]",
     "larkin config apply [--agent <App ID>]",
 ]);
 export const CONFIG_CLI_VALUES = Object.freeze({

package/dist/agent/context-prompt.cjs

@@ -12,11 +12,11 @@ const agent_cli_capabilities_js_1 = require("./agent-cli-capabilities.cjs");
  * 1. 明确目标与边界：每条规则写明“何时触发 / 做什么 / 禁止什么”，避免歧义与过度推断。
  * 2. 结构性信号优先于推断：能用来源/目标字段（如 thread target）做权威判定的，不要依赖模型从措辞推断。
  * 3. 精确 recipe：关键操作给完整命令模板 + 约束（如 exact literal、fail-closed、确定性 --jq 数据流）。
- * 4. 幂等与安全：idempotency、freshness 前置检查、不可重复提交、脱敏、失败可见（fail visibly）。
+ * 4. 幂等与安全：idempotency、非阻塞 freshness 提示、不可重复提交、脱敏、失败可见（fail visibly）。
  * 5. 版本化：每次实质改动 bump LARKIN_STANDING_PROMPT_VERSION，并同步 eval 数据集/graders/断言。
  * 6. 用 eval 验证：行为变化必须配套固定场景 + rubric（evals/*、test/support/*-grader.mjs、live 测试）。
  */
-exports.LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v33";
+exports.LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v34";
 /**
  * Pi 长命令引导的唯一来源。仅在当前工具列表出现 tmux-backed bash 时适用；
  * 不声明 tmux 一定可用，也不复述扩展的工具细节。
@@ -156,7 +156,7 @@ class ContextPromptBuilder {
             "Successful history response messages are always at `data.messages`. Never use a chat-wide fallback for a thread target, never merge stderr with `2>&1` before parsing JSON, and never truncate structured output before parsing it.",
             "If the scoped history read fails or its schema is invalid, fail visibly. Do not reuse remembered or hard-coded text to make the task appear successful.",
             "Only a real Feishu `message_id` beginning with `om_` may be passed to `+messages-reply`; `rem_`, `redeliver_`, and every other synthetic ID must never be replied to. Send with a confirmed `chat_id` and never guess a chat id from a display name.",
-            "Before every send/reply/card/recall write, Larkin probes the exact chat or thread history with the current Bot identity. A nonzero `freshness_conflict` includes bounded unseen context and direct-acks that cursor; reconsider it, then retry the ordinary command. Larkin never saves the blocked operation as a draft.",
+            "Freshness is a non-blocking reminder: a send, reply, card, recall, or urgent write is never rejected for freshness. After a successful write, stderr may contain a `larkin_notice` with `freshness`; the write already happened. Re-read the exact chat or thread with the Larkin command, and send a short follow-up only when newer context changes the answer. Never resend the same content merely because of this notice.",
             "For ordinary plain-text message bodies, use `--text`, including brief one-line replies, multiline status lines, and paragraphs. Use `--markdown` only when you intentionally need Markdown rendering, such as headings, lists, emphasis, blockquotes, fenced code, or Markdown links.",
             "When a URL must be visible, clickable, or openable by the recipient, include the complete bare `https://...` URL as visible text. Do not rely solely on `[label](URL)`, because Feishu client rendering is unreliable. A label may also be included, but the bare URL must remain present.",
             "Use native `--text` for ordinary plain text and for verbatim preservation, such as logs, literal code, or exact whitespace. Both `--markdown` and `--text` remain supported in the Larkin Runtime.",
@@ -166,7 +166,7 @@ class ContextPromptBuilder {
             `For a common exact send with a confirmed chat id, use the complete schematic recipe \`${executable} im +messages-send --chat-id <confirmed_chat_id> --text '<exact_body_as_one_literal_argument>' --json\`; replace each placeholder with the corresponding confirmed or exact literal value.`,
             `A reply's target is governed by the source's thread membership, a structural Inbox fact, not a guess. When the current Inbox event or poll identifies the source as a thread (\`thread:<chat_id>:<thread_id>\` target, or the polled message carries a \`thread_id\`), your reply MUST stay in that same thread: after the required poll use \`${executable} im +messages-reply --message-id <real_om_message_id> --text '<exact_body_as_one_literal_argument>' --reply-in-thread --json\`. For a chat-level source (no thread) with no explicit in-thread request, reply to the main timeline with the same recipe but omit \`--reply-in-thread\`; replace the placeholders only with the real \`om_\` id returned by that poll and the unchanged exact literal.`,
             `Use the \`--reply-in-thread\` recipe only when the source is a thread or the user or current Inbox event explicitly asks for a topic, in-thread, or thread reply. Never invent a topic request from ordinary reply wording or a bare source message id: the thread decision comes only from the source message's actual thread membership (\`thread:\` target or polled \`thread_id\`) or an explicit request, never from wording alone.`,
-            "This exact topic-reply recipe has exactly one post-poll model tool call and must not read or re-read a skill or reference, open help, or perform any other discovery. Without a `freshness_conflict` it uses two total model tool calls including the poll. If the first write instead returns a nonzero pre-commit, provider-not-reached `freshness_conflict`, reconsider its bounded context and, only if the exact operation remains unchanged, retry the identical command once; this is the only allowed extra call and produces exactly three total model tool calls including the poll.",
+            "This exact topic-reply recipe has exactly one post-poll model tool call and must not read or re-read a skill or reference, open help, or perform any other discovery. It uses two total model tool calls including the poll. A later freshness notice is advisory and must not cause a duplicate send.",
             "For tool-sourced exact or verbatim text from a Feishu result, do not copy or retype it into `--text`; you must use the deterministic native `--jq` to `--content` dataflow below.",
             "Choose exactly one source selector from the identifier the task starts with, and never switch selectors after reading. The inner read in the selected composite replaces any separate scoped history read; it must not follow a preview read.",
             "For a task that starts from a known thread and asks for its latest human content, after the required Inbox poll invoke the thread composite directly as the first and only post-poll model tool call. For this thread source, never preview or read the thread separately, extract a message id, switch to `+messages-mget`, or add a second source read.",
@@ -181,10 +181,10 @@ class ContextPromptBuilder {
             `The complete canonical exact send and reply paths above must not be preceded by \`${executable} im +messages-send --help\` or \`${executable} im +messages-reply --help\`; run these two known recipes directly.`,
             "For the known canonical Inbox poll, scoped chat/thread history, and exact send/reply recipes specified here, execute them directly; you must not read or re-read a skill file or reference merely to rediscover or confirm their command syntax.",
             `For a task that starts from an exact group name and asks for user and bot counts, after the required Inbox poll use this known canonical two-read recipe directly: first run \`${executable} im +chat-search --query '<exact_group_name>' --json\`, require one result with an exact name match and confirm its \`oc_\` chat id, then run \`${executable} im chats get --chat-id <confirmed_oc_chat_id> --json\` and answer from its \`user_count\` and \`bot_count\`. This group user/bot counts recipe uses exactly two post-poll business read calls; you must not read or re-read a skill or reference, open help or schema, invoke bare \`lark-cli\`, call \`chat.members\` or \`+chat-members-list\`, fall back to \`+chat-list\`, or add shell filters or output truncation. If the exact name is not a unique visible match, the chat id is not confirmed, or either count is missing, fail visibly without another discovery path or a guess.`,
-            "This narrow direct-recipe rule does not waive required skill safety gates, authorization, identity, freshness, or other safety checks. Unknown commands or high-risk operations still require the applicable skill/reference guidance or help.",
-            `To recall a message after the required explicit user approval, use \`${executable} im messages delete --message-id <bot-owned_om_id> --yes --json\`. Runtime verifies the original sender is this exact Bot, derives the exact chat/thread target, probes freshness before provider commit, and refuses cross-Agent or third-party messages. A \`committed=true\` or \`duplicate=true\` result must not be retried; an ambiguous result fails closed and requires user inspection. Never use generic API or bare \`lark-cli\` to bypass recall protection.`,
+            "This narrow direct-recipe rule does not waive required skill safety gates, authorization, identity, or other safety checks. Unknown commands or high-risk operations still require the applicable skill/reference guidance or help.",
+            `To recall a message after the required explicit user approval, use \`${executable} im messages delete --message-id <bot-owned_om_id> --yes --json\`. Runtime verifies the original sender is this exact Bot, derives the exact chat/thread target, and refuses cross-Agent or third-party messages. A \`committed=true\` or \`duplicate=true\` result must not be retried; an ambiguous result fails closed and requires user inspection. Never use generic API or bare \`lark-cli\` to bypass recall protection.`,
             "The Larkin wrapper derives the stable per-intent idempotency key; do not pass `--idempotency-key` in an ordinary send or reply recipe. A successful write result carrying `duplicate: true` means the provider returned the earlier delivery for the same derived key: the message was already delivered and no new message was created. Do not resend the same command after a `duplicate: true` result; treat the message as delivered. To deliberately send identical content again as a fresh intent (e.g., a new reminder), pass an explicit new `--idempotency-key`, which the wrapper respects instead of deriving its own.",
-            "Both `freshness_unavailable` and `freshness_conflict` are pre-commit, provider-not-reached results. If a retry is warranted for an unchanged exact operation, rerun the identical safe ordinary command: `--text` for a direct literal or the same deterministic `--content` dataflow for a tool source. The wrapper reuses its derived key. If the target or body changes after reconsideration, run the revised ordinary command and let the wrapper derive a new key. A result with `committed=true` must not be repeated; ambiguous termination follows the existing wrapper same-key recovery contract.",
+            "A `larkin_notice` freshness reminder is written to stderr only after the provider write has completed. Keep the successful write; re-read the target before any follow-up, and only send a revised follow-up if the new context materially changes the answer. A result with `committed=true` or `duplicate=true` must not be repeated; ambiguous termination follows the existing wrapper same-key recovery contract.",
             "For multiline `--markdown` or `--text` content in zsh or bash, prefer shell ANSI-C quoting so the command passes one argument with real newline characters: `--markdown $'First line\\nSecond line'` or `--text $'First line\\nSecond line'`. Putting `\"First line\\nSecond line\"` in ordinary double quotes is wrong: ordinary quotes do not decode `\\n`, so lark-cli and Feishu receive a backslash followed by the letter `n`. A literal multiline argument containing real newline characters is also valid. If ANSI-C-quoted content contains an apostrophe, use a safe shell single-quote splice or the literal-newline form; never use `eval`, `echo`, a temporary file, or unsafe variable interpolation to construct the body.",
             ...FEISHU_IM_COMMAND_GROUPS.map(([label, suffixes]) => `- ${label}: ${suffixes.map((suffix) => `\`${executable} ${suffix}\``).join(", ")}.`),
             `- Attachments: for an attachment-only send/reply, use its native attachment flag without a text body flag; download with \`${executable} im +messages-resources-download\`.`,

package/dist/agent/context-prompt.mjs

@@ -9,11 +9,11 @@ import { agentCliPromptCapabilities } from "./agent-cli-capabilities.mjs";
  * 1. 明确目标与边界：每条规则写明“何时触发 / 做什么 / 禁止什么”，避免歧义与过度推断。
  * 2. 结构性信号优先于推断：能用来源/目标字段（如 thread target）做权威判定的，不要依赖模型从措辞推断。
  * 3. 精确 recipe：关键操作给完整命令模板 + 约束（如 exact literal、fail-closed、确定性 --jq 数据流）。
- * 4. 幂等与安全：idempotency、freshness 前置检查、不可重复提交、脱敏、失败可见（fail visibly）。
+ * 4. 幂等与安全：idempotency、非阻塞 freshness 提示、不可重复提交、脱敏、失败可见（fail visibly）。
  * 5. 版本化：每次实质改动 bump LARKIN_STANDING_PROMPT_VERSION，并同步 eval 数据集/graders/断言。
  * 6. 用 eval 验证：行为变化必须配套固定场景 + rubric（evals/*、test/support/*-grader.mjs、live 测试）。
  */
-export const LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v33";
+export const LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v34";
 /**
  * Pi 长命令引导的唯一来源。仅在当前工具列表出现 tmux-backed bash 时适用；
  * 不声明 tmux 一定可用，也不复述扩展的工具细节。
@@ -153,7 +153,7 @@ export class ContextPromptBuilder {
             "Successful history response messages are always at `data.messages`. Never use a chat-wide fallback for a thread target, never merge stderr with `2>&1` before parsing JSON, and never truncate structured output before parsing it.",
             "If the scoped history read fails or its schema is invalid, fail visibly. Do not reuse remembered or hard-coded text to make the task appear successful.",
             "Only a real Feishu `message_id` beginning with `om_` may be passed to `+messages-reply`; `rem_`, `redeliver_`, and every other synthetic ID must never be replied to. Send with a confirmed `chat_id` and never guess a chat id from a display name.",
-            "Before every send/reply/card/recall write, Larkin probes the exact chat or thread history with the current Bot identity. A nonzero `freshness_conflict` includes bounded unseen context and direct-acks that cursor; reconsider it, then retry the ordinary command. Larkin never saves the blocked operation as a draft.",
+            "Freshness is a non-blocking reminder: a send, reply, card, recall, or urgent write is never rejected for freshness. After a successful write, stderr may contain a `larkin_notice` with `freshness`; the write already happened. Re-read the exact chat or thread with the Larkin command, and send a short follow-up only when newer context changes the answer. Never resend the same content merely because of this notice.",
             "For ordinary plain-text message bodies, use `--text`, including brief one-line replies, multiline status lines, and paragraphs. Use `--markdown` only when you intentionally need Markdown rendering, such as headings, lists, emphasis, blockquotes, fenced code, or Markdown links.",
             "When a URL must be visible, clickable, or openable by the recipient, include the complete bare `https://...` URL as visible text. Do not rely solely on `[label](URL)`, because Feishu client rendering is unreliable. A label may also be included, but the bare URL must remain present.",
             "Use native `--text` for ordinary plain text and for verbatim preservation, such as logs, literal code, or exact whitespace. Both `--markdown` and `--text` remain supported in the Larkin Runtime.",
@@ -163,7 +163,7 @@ export class ContextPromptBuilder {
             `For a common exact send with a confirmed chat id, use the complete schematic recipe \`${executable} im +messages-send --chat-id <confirmed_chat_id> --text '<exact_body_as_one_literal_argument>' --json\`; replace each placeholder with the corresponding confirmed or exact literal value.`,
             `A reply's target is governed by the source's thread membership, a structural Inbox fact, not a guess. When the current Inbox event or poll identifies the source as a thread (\`thread:<chat_id>:<thread_id>\` target, or the polled message carries a \`thread_id\`), your reply MUST stay in that same thread: after the required poll use \`${executable} im +messages-reply --message-id <real_om_message_id> --text '<exact_body_as_one_literal_argument>' --reply-in-thread --json\`. For a chat-level source (no thread) with no explicit in-thread request, reply to the main timeline with the same recipe but omit \`--reply-in-thread\`; replace the placeholders only with the real \`om_\` id returned by that poll and the unchanged exact literal.`,
             `Use the \`--reply-in-thread\` recipe only when the source is a thread or the user or current Inbox event explicitly asks for a topic, in-thread, or thread reply. Never invent a topic request from ordinary reply wording or a bare source message id: the thread decision comes only from the source message's actual thread membership (\`thread:\` target or polled \`thread_id\`) or an explicit request, never from wording alone.`,
-            "This exact topic-reply recipe has exactly one post-poll model tool call and must not read or re-read a skill or reference, open help, or perform any other discovery. Without a `freshness_conflict` it uses two total model tool calls including the poll. If the first write instead returns a nonzero pre-commit, provider-not-reached `freshness_conflict`, reconsider its bounded context and, only if the exact operation remains unchanged, retry the identical command once; this is the only allowed extra call and produces exactly three total model tool calls including the poll.",
+            "This exact topic-reply recipe has exactly one post-poll model tool call and must not read or re-read a skill or reference, open help, or perform any other discovery. It uses two total model tool calls including the poll. A later freshness notice is advisory and must not cause a duplicate send.",
             "For tool-sourced exact or verbatim text from a Feishu result, do not copy or retype it into `--text`; you must use the deterministic native `--jq` to `--content` dataflow below.",
             "Choose exactly one source selector from the identifier the task starts with, and never switch selectors after reading. The inner read in the selected composite replaces any separate scoped history read; it must not follow a preview read.",
             "For a task that starts from a known thread and asks for its latest human content, after the required Inbox poll invoke the thread composite directly as the first and only post-poll model tool call. For this thread source, never preview or read the thread separately, extract a message id, switch to `+messages-mget`, or add a second source read.",
@@ -178,10 +178,10 @@ export class ContextPromptBuilder {
             `The complete canonical exact send and reply paths above must not be preceded by \`${executable} im +messages-send --help\` or \`${executable} im +messages-reply --help\`; run these two known recipes directly.`,
             "For the known canonical Inbox poll, scoped chat/thread history, and exact send/reply recipes specified here, execute them directly; you must not read or re-read a skill file or reference merely to rediscover or confirm their command syntax.",
             `For a task that starts from an exact group name and asks for user and bot counts, after the required Inbox poll use this known canonical two-read recipe directly: first run \`${executable} im +chat-search --query '<exact_group_name>' --json\`, require one result with an exact name match and confirm its \`oc_\` chat id, then run \`${executable} im chats get --chat-id <confirmed_oc_chat_id> --json\` and answer from its \`user_count\` and \`bot_count\`. This group user/bot counts recipe uses exactly two post-poll business read calls; you must not read or re-read a skill or reference, open help or schema, invoke bare \`lark-cli\`, call \`chat.members\` or \`+chat-members-list\`, fall back to \`+chat-list\`, or add shell filters or output truncation. If the exact name is not a unique visible match, the chat id is not confirmed, or either count is missing, fail visibly without another discovery path or a guess.`,
-            "This narrow direct-recipe rule does not waive required skill safety gates, authorization, identity, freshness, or other safety checks. Unknown commands or high-risk operations still require the applicable skill/reference guidance or help.",
-            `To recall a message after the required explicit user approval, use \`${executable} im messages delete --message-id <bot-owned_om_id> --yes --json\`. Runtime verifies the original sender is this exact Bot, derives the exact chat/thread target, probes freshness before provider commit, and refuses cross-Agent or third-party messages. A \`committed=true\` or \`duplicate=true\` result must not be retried; an ambiguous result fails closed and requires user inspection. Never use generic API or bare \`lark-cli\` to bypass recall protection.`,
+            "This narrow direct-recipe rule does not waive required skill safety gates, authorization, identity, or other safety checks. Unknown commands or high-risk operations still require the applicable skill/reference guidance or help.",
+            `To recall a message after the required explicit user approval, use \`${executable} im messages delete --message-id <bot-owned_om_id> --yes --json\`. Runtime verifies the original sender is this exact Bot, derives the exact chat/thread target, and refuses cross-Agent or third-party messages. A \`committed=true\` or \`duplicate=true\` result must not be retried; an ambiguous result fails closed and requires user inspection. Never use generic API or bare \`lark-cli\` to bypass recall protection.`,
             "The Larkin wrapper derives the stable per-intent idempotency key; do not pass `--idempotency-key` in an ordinary send or reply recipe. A successful write result carrying `duplicate: true` means the provider returned the earlier delivery for the same derived key: the message was already delivered and no new message was created. Do not resend the same command after a `duplicate: true` result; treat the message as delivered. To deliberately send identical content again as a fresh intent (e.g., a new reminder), pass an explicit new `--idempotency-key`, which the wrapper respects instead of deriving its own.",
-            "Both `freshness_unavailable` and `freshness_conflict` are pre-commit, provider-not-reached results. If a retry is warranted for an unchanged exact operation, rerun the identical safe ordinary command: `--text` for a direct literal or the same deterministic `--content` dataflow for a tool source. The wrapper reuses its derived key. If the target or body changes after reconsideration, run the revised ordinary command and let the wrapper derive a new key. A result with `committed=true` must not be repeated; ambiguous termination follows the existing wrapper same-key recovery contract.",
+            "A `larkin_notice` freshness reminder is written to stderr only after the provider write has completed. Keep the successful write; re-read the target before any follow-up, and only send a revised follow-up if the new context materially changes the answer. A result with `committed=true` or `duplicate=true` must not be repeated; ambiguous termination follows the existing wrapper same-key recovery contract.",
             "For multiline `--markdown` or `--text` content in zsh or bash, prefer shell ANSI-C quoting so the command passes one argument with real newline characters: `--markdown $'First line\\nSecond line'` or `--text $'First line\\nSecond line'`. Putting `\"First line\\nSecond line\"` in ordinary double quotes is wrong: ordinary quotes do not decode `\\n`, so lark-cli and Feishu receive a backslash followed by the letter `n`. A literal multiline argument containing real newline characters is also valid. If ANSI-C-quoted content contains an apostrophe, use a safe shell single-quote splice or the literal-newline form; never use `eval`, `echo`, a temporary file, or unsafe variable interpolation to construct the body.",
             ...FEISHU_IM_COMMAND_GROUPS.map(([label, suffixes]) => `- ${label}: ${suffixes.map((suffix) => `\`${executable} ${suffix}\``).join(", ")}.`),
             `- Attachments: for an attachment-only send/reply, use its native attachment flag without a text body flag; download with \`${executable} im +messages-resources-download\`.`,

package/dist/app/agent-cli.mjs

@@ -119,7 +119,7 @@ function migrationError(group, subcommand) {
     if (group === "server")
         return "server 已移除；飞书（Lark）群与消息信息请通过 `larkin im ...` 查询。";
     if (group === "im")
-        return "请通过 `larkin im ...` 使用飞书（Lark）命令；Runtime 会自动绑定当前 Bot identity，并在写入前执行 freshness gate。可运行 `larkin im --help` 查看帮助。";
+        return "请通过 `larkin im ...` 使用飞书（Lark）命令；Runtime 会自动绑定当前 Bot identity，并在成功写入后给出非阻塞 freshness 提示。可运行 `larkin im --help` 查看帮助。";
     if (group === "profile" && subcommand !== "show") {
         return "profile 只保留只读的 `larkin profile show`；身份和凭证由 `larkin setup` 管理，不支持 update。";
     }
@@ -256,6 +256,23 @@ function agentConfigRequest(argv, env, config, agent, dependencies) {
             agentId: targetId,
         });
     }
+    else if (operation === "processing-eye") {
+        const [scope, first] = options.positionals;
+        if (scope === "global")
+            assertOnlyFlags([]);
+        else if (scope === "agent")
+            assertOnlyFlags(["--agent"]);
+        else
+            assertOnlyFlags([]);
+        if (options.positionals.length !== 2) {
+            throw new Error("用法: larkin config processing-eye global <on|off> | processing-eye agent <inherit|on|off> [--agent <App ID>]");
+        }
+        mutation = larkinConfig.processingEyeMutationFromCli({
+            scope: scope || "",
+            enabled: first,
+            agentId: targetId,
+        });
+    }
     else if (operation === "apply") {
         assertOnlyFlags(["--agent"]);
         if (options.positionals.length)
@@ -269,7 +286,7 @@ function agentConfigRequest(argv, env, config, agent, dependencies) {
         }).catch((error) => { throw new Error(`配置已保存但未应用：${error instanceof Error ? error.message : String(error)}`); });
     }
     else
-        throw new Error("config 只支持 show/runtime/model/effort/mention/inbox-audit/apply；运行 larkin config --help");
+        throw new Error("config 只支持 show/runtime/model/effort/mention/inbox-audit/processing-eye/apply；运行 larkin config --help");
     const result = larkinConfig.mutateConfig(env, mutation, authority);
     return { ok: true, revision: result.revision, persisted: true, applyState: result.applyState, changedScope: result.changedScope };
 }

package/dist/app/agent-config.mjs

@@ -52,7 +52,7 @@ const die = (message) => {
     process.exit(1);
 };
 if (!kind || !["agents", "model", "runtime", "effort", "chats", "config"].includes(kind)) {
-    die("用法: larkin agents | larkin config <show|mention|inbox-audit|apply> | larkin model [<id>] | larkin runtime [<id>] [--model <id>] | larkin effort [<level>|clear] | larkin chats [free|strict <oc_id>]");
+    die("用法: larkin agents | larkin config <show|mention|inbox-audit|processing-eye|apply> | larkin model [<id>] | larkin runtime [<id>] [--model <id>] | larkin effort [<level>|clear] | larkin chats [free|strict <oc_id>]");
 }
 const allowedValueFlags = {
     agents: new Set(), model: new Set(["--agent"]), runtime: new Set(["--agent", "--model"]),
@@ -162,13 +162,23 @@ else if (kind === "config") {
         if (positionals.length !== 3)
             die("用法: larkin config inbox-audit agent <inherit|on|off> [--agent <App ID>] [--interval <15m|inherit>]");
     }
+    else if (operation === "processing-eye" && scope === "global") {
+        assertOnlyFlags([]);
+        if (positionals.length !== 3)
+            die("用法: larkin config processing-eye global <on|off>");
+    }
+    else if (operation === "processing-eye" && scope === "agent") {
+        assertOnlyFlags(["--agent"]);
+        if (positionals.length !== 3)
+            die("用法: larkin config processing-eye agent <inherit|on|off> [--agent <App ID>]");
+    }
     else if (operation === "apply") {
         assertOnlyFlags(["--agent"]);
         if (positionals.length !== 1)
             die("用法: larkin config apply [--agent <App ID>]");
     }
     else {
-        die("config 只支持 show/mention/inbox-audit/apply；运行 larkin config --help");
+        die("config 只支持 show/mention/inbox-audit/processing-eye/apply；运行 larkin config --help");
     }
 }
 const loaded = (() => {
@@ -352,15 +362,20 @@ if (kind === "config") {
             say(`全局群消息策略=${String(view.mentionPolicy)}（free 会唤醒所有继承它的 Agent）`);
             const inboxAudit = view.inboxAudit;
             say(`全局 Inbox Audit=${inboxAudit?.enabled ? "on" : "off"} interval=${larkinConfig.formatInboxAuditInterval(Number(inboxAudit?.intervalMs || larkinConfig.DEFAULT_INBOX_AUDIT_INTERVAL_MS))}（默认关闭；未 @ 的 require 群消息不会进入审计）`);
+            const processingEye = view.processingEye;
+            say(`全局处理中表情=${processingEye?.enabled ? "on" : "off"}（默认关闭；缺 key 视为关闭，升级后不再自动点 OnIt）`);
             for (const item of view.agents) {
                 const mention = item.mention;
                 const agentAudit = item.inboxAudit;
+                const agentEye = item.processingEye;
                 const apply = item.apply;
-                say(`agent=${item.agentId} runtime=${item.runtime} model=${item.model} effort=${item.effort || "default"} mention=${mention.override} inbox-audit=${agentAudit?.override?.enabled || "inherit"} apply=${apply.applyState || "unknown"}`);
+                say(`agent=${item.agentId} runtime=${item.runtime} model=${item.model} effort=${item.effort || "default"} mention=${mention.override} inbox-audit=${agentAudit?.override?.enabled || "inherit"} processing-eye=${agentEye?.override?.enabled || "inherit"} apply=${apply.applyState || "unknown"}`);
                 if (mention.chat)
                     say(`  chat=${mention.chat.chatId} override=${mention.chat.override} effective=${mention.chat.effective} source=${mention.chat.source}`);
                 if (agentAudit?.effective)
                     say(`  inbox-audit effective=${agentAudit.effective.enabled ? "on" : "off"} interval=${larkinConfig.formatInboxAuditInterval(Number(agentAudit.effective.intervalMs || larkinConfig.DEFAULT_INBOX_AUDIT_INTERVAL_MS))}`);
+                if (agentEye?.effective)
+                    say(`  processing-eye effective=${agentEye.effective.enabled ? "on" : "off"}`);
             }
         }
         process.exit(0);
@@ -405,6 +420,20 @@ if (kind === "config") {
         }
         process.exit(0);
     }
+    if (operation === "processing-eye") {
+        try {
+            const result = larkinConfig.mutateConfig(process.env, larkinConfig.processingEyeMutationFromCli({
+                scope: scope || "",
+                enabled: first,
+                agentId: scope === "agent" ? requireTarget() : (selected || keys[0] || ""),
+            }), authority);
+            say(JSON.stringify({ ok: true, revision: result.revision, persisted: result.persisted, applyState: result.applyState, changedScope: result.changedScope }, null, 2));
+        }
+        catch (error) {
+            die(error instanceof Error ? error.message : String(error));
+        }
+        process.exit(0);
+    }
     if (operation === "apply") {
         const agentId = requireTarget();
         const expectedSignature = larkinConfig.runtimeConfigSignature(config, agentId);
@@ -424,7 +453,7 @@ if (kind === "config") {
         }
         process.exit(0);
     }
-    die("config 只支持 show/mention/inbox-audit/apply");
+    die("config 只支持 show/mention/inbox-audit/processing-eye/apply");
 }
 let key = flagAgent;
 if (!key && runtimeAgentId)

package/dist/app/cli.mjs

@@ -8,6 +8,7 @@ import { fileURLToPath } from "node:url";
 import { CONFIG_CLI_USAGE } from "../agent/config-cli-contract.mjs";
 import { internalCommandSpec } from "./internal-command.mjs";
 import { packageVersion } from "../platform/build-info.mjs";
+import { isLarkinRuntimeContext } from "./runtime-context.mjs";
 const command = process.argv[2] || "help";
 let rest = process.argv.slice(3);
 const PACKAGE_VERSION = packageVersion(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../.."));
@@ -36,6 +37,18 @@ const routes = {
 };
 const runtimeAgentAuthority = typeof process.env.LARKIN_AGENT_ID === "string"
     && process.env.LARKIN_AGENT_ID.trim().length > 0;
+const runtimeContext = isLarkinRuntimeContext(process.env);
+// `config` deliberately remains a public operator surface: it supports global
+// and cross-Agent configuration, and it never falls through to `activeAgent`.
+const runtimeScopedCommands = new Set(["inbox", "reminder", "interaction", "profile", "comment"]);
+const missingRuntimeAuthority = (name) => {
+    console.error(`larkin: Runtime Agent authority is missing for "${command}" (LARKIN_AGENT_ID is required). `
+        + `Runtime context was detected (${name}); it will not fall back to the active Agent.`);
+    process.exit(2);
+};
+if (!runtimeAgentAuthority && runtimeScopedCommands.has(command)) {
+    missingRuntimeAuthority("agent-scoped command");
+}
 const runtimeAgentCommand = runtimeAgentAuthority
     && ["inbox", "reminder", "interaction", "profile", "config"].includes(command);
 if (runtimeAgentCommand)
@@ -74,6 +87,7 @@ Examples:
   larkin config runtime pi --agent cli_x --model default
   larkin config mention chat oc_x free --agent cli_x
   larkin config inbox-audit global on --interval 15m
+  larkin config processing-eye global on
 
 Credentials, internal paths, serverId, activeAgent, and raw config are never exposed here.`,
     session: `Usage: larkin session reset --agent <App ID> --json [--wait-ready <seconds>]
@@ -107,6 +121,8 @@ const retiredPublicCommands = new Set(["pi-auth", "pi-distribution"]);
 const wantsHelp = command === "help" || command === "--help" || command === "-h"
     || (!runtimeAgentAuthority && command.startsWith("-"));
 if (!routes[command] && !wantsHelp && !retiredPublicCommands.has(command)) {
+    if (runtimeContext && !runtimeAgentAuthority)
+        missingRuntimeAuthority("Runtime marker");
     routes[command] = runtimeAgentAuthority ? ["lark-cli", command] : ["lark", command];
 }
 if (!routes[command]) {