larkway 0.3.37 → 0.3.38

package/README.md

@@ -8,7 +8,7 @@
 
 You @ the bot in a Feishu thread. It runs on your machine — reading your real codebase, executing commands, opening MRs — and posts the result back. You define what the agent knows and what it can do. Larkway just carries the messages.
 
-**Current release: v0.3.37**
+**Current release: v0.3.38**
 
 ---
 
@@ -105,6 +105,45 @@ Larkway never injects `ANTHROPIC_API_KEY` or any other API key. The subprocess i
 
 ---
 
+## Security model — read this before inviting the bot anywhere
+
+Larkway runs a real coding agent **on your machine, with your permissions**. Be
+explicit about what that means:
+
+**Who can trigger it.** By default a bot ships with `chats: []` — *open mode*:
+it responds to an @-mention in **any** group it has been added to. Anyone who
+can add the bot to a group (or is in a group with it) can make it act. To
+narrow this, list allowed group ids in the bot's yaml (`chats: [oc_…]`); the
+bot then ignores every other chat.
+
+**What a triggered agent can do.** The agent subprocess is not sandboxed by
+Larkway. With the default permission mode (`bypassPermissions` — required for
+unattended headless operation, where an interactive permission prompt would
+silently hang the turn), a Claude-backend agent can read/write files, run
+commands, and use the network as your OS user. The Codex backend's equivalent
+default is full access. You can tighten this globally via `permissions.mode`
+in `~/.larkway/config.json` (`acceptEdits` / `ask`), at the cost of turns
+stalling on operations the mode blocks. **Note the mode words are Claude
+semantics; on Codex anything other than `ask` currently maps to full access.**
+
+**Prompt injection is real.** Everything in the triggering message — and
+thread history / attachments the agent chooses to read — becomes agent input.
+A malicious group member can try to steer the agent ("ignore your instructions
+and run …"). L2 memory and your repo's `CLAUDE.md`/`AGENTS.md` are guidance,
+not enforcement.
+
+**Practical posture.**
+- Treat "which groups is this bot in" as the primary security boundary; use
+  `chats:` allowlists for any bot with write access.
+- Run write-capable bots against repos where an unwanted commit/MR is
+  reviewable and revertable; keep production credentials out of the host's
+  environment.
+- Secrets in `~/.larkway/.env` are shared across all bots on the bridge and
+  visible to any agent that can read your home directory — don't mix a
+  low-trust open bot and high-value credentials on the same host.
+
+---
+
 ## Defining a bot (three layers)
 
 | Layer | What it is | Where it lives |
@@ -122,7 +161,7 @@ Secrets live only in `~/.larkway/.env` (mode 0600). Config and memory contain no
 - **Multiple bots on one bridge** — a read-only Q&A bot and a write-capable engineering bot can share the same process, each with its own L1/L2/L3 definition
 - **Web UI** — `larkway ui` opens a local management dashboard (127.0.0.1 + token); create bots, edit memory, watch live logs
 - **Session continuity** — every Feishu thread maps to a persistent `session_id`; the agent remembers what it did in prior turns
-- **Agent Workspace** — per-thread git worktrees; the agent can run multiple threads concurrently without git conflicts
+- **Agent Workspace** — each bot gets its own workspace where the agent clones the repo itself, with per-thread session dirs; concurrent threads don't trip over each other's git state (expect disk usage and a slower first turn on large repos — clones are per-session, GC'd after 24h idle)
 - **Codex runtime pre-checks** — `larkway doctor` validates Codex state directory writability before start
 - **Topic ↔ Feishu task handle** — turn a topic into a Feishu task and the agent claims it, then keeps its lifecycle (done/failed/reopened, stalled, handed off, overdue) in sync automatically — see below
 
@@ -157,7 +196,7 @@ platform-fact writeups: [docs/task-handle.md](docs/task-handle.md).
 
 - **Node.js 20+ LTS**
 - **A Claude Code or Codex subscription** with local CLI installed and logged in
-- **`lark-cli`** — Feishu long-connection client and message utilities
+- **`lark-cli`** — Feishu long-connection client and message utilities: `npm i -g @larksuite/cli`, then `lark-cli auth login` (the agent uses it to read thread history and attachments; `larkway doctor` checks it's present)
 - **`glab` + `git`** — for bots that open MRs (optional for read-only bots)
 - **An always-on host machine** — the bridge must stay running to receive Feishu events; a laptop that sleeps will miss messages; a small server or desktop works well
 

package/README.zh.md

@@ -8,7 +8,7 @@
 
 你在飞书话题里 @ bot，它在你的机器上运行——读真实代码库、执行命令、开 MR——把结果贴回飞书。你定义 agent 知道什么、能做什么。Larkway 只负责传递消息。
 
-**当前版本：v0.3.37**
+**当前版本：v0.3.38**
 
 ---
 

package/dist/cli/index.js

@@ -112719,15 +112719,27 @@ var init_channelClient = __esm({
       inFlightMessageIds = /* @__PURE__ */ new Set();
       /**
        * Per-message (re-)dispatch counter for the poison-message guard. Incremented
-       * every time a message_id is pushed onto the inbound queue (live WS or either
-       * gap-fill branch) and once more when a turn is released as unhandled. When the
-       * count reaches {@link MAX_MESSAGE_ATTEMPTS}, markUnhandled GIVES UP: it
-       * promotes the message to seen (so it stops being re-dispatched) and logs a
-       * warning. markHandled clears the entry on terminal success. Not persisted:
+       * ONCE per dispatch — every time a message_id is pushed onto the inbound
+       * queue (live WS or either gap-fill branch), and nowhere else, so the cap
+       * really means "N dispatches". When a turn fails and the count has reached
+       * {@link MAX_MESSAGE_ATTEMPTS}, markUnhandled GIVES UP: it promotes the
+       * message to seen (so it stops being re-dispatched) and logs a warning.
+       * markHandled clears the entry on terminal success. Not persisted:
        * post-restart, an interrupted message starts fresh — same policy as
        * inFlightMessageIds.
        */
       messageAttempts = /* @__PURE__ */ new Map();
+      /**
+       * chatId + create_time for every in-flight message, captured at dispatch.
+       * Consumed by {@link markUnhandled}: a FAILED turn records an unresolved gap
+       * window for its chat so a later replay actually re-pulls (and re-dispatches)
+       * it. Without this there is no steady-state trigger for the re-dispatch that
+       * markUnhandled promises — chats-mode bots have no discovery timer at all,
+       * and open-mode steady-state discovery pulls 0 for already-known chats — so
+       * a turn failing before any visible surface existed was silently dropped.
+       * Cleared in markHandled / markUnhandled; bounded by the in-flight set.
+       */
+      inFlightMessageMeta = /* @__PURE__ */ new Map();
       /**
        * Chats observed from live WS events during this process lifetime.
        *
@@ -112762,6 +112774,17 @@ var init_channelClient = __esm({
       openChatDiscoveryTimer = null;
       openChatDiscoveryRunning = false;
       openChatDiscoveryBootstrapped = false;
+      /**
+       * Chats-mode (allowedChatIds non-empty) counterpart of the open-mode
+       * discovery cycle's unresolved-window replay: those bots never start
+       * discovery, so without this timer a window recorded by markUnhandled had
+       * NO trigger to replay it (the only other gapFill source is a WS reconnect,
+       * which a healthy network may not produce for days). Steady state with no
+       * pending windows does nothing — zero API calls — so the 0.3.28 storm fix
+       * is preserved.
+       */
+      unresolvedReplayTimer = null;
+      unresolvedReplayRunning = false;
       /**
        * Consecutive discovery-cycle failures. Used to SKIP cycles with exponential
        * backoff (storm: a failing +chat-list/gap-fill shouldn't re-fire every
@@ -112967,6 +112990,7 @@ var init_channelClient = __esm({
             return;
           }
           this.inFlightMessageIds.add(ev.message_id);
+          this.noteInFlightMeta(ev);
           this.noteDispatchAttempt(ev.message_id);
           log(`dispatching (channel-sdk): message_id=${ev.message_id} thread=${ev.thread_id ?? "?"}`);
           this.queue.push(ev);
@@ -112995,6 +113019,7 @@ var init_channelClient = __esm({
         this.connected = true;
         log(`connected as ${channel.botIdentity?.name ?? "?"} (${channel.botIdentity?.openId ?? "?"})`);
         this.startOpenChatDiscovery(log);
+        this.startUnresolvedReplayTimer(log);
       }
       /**
        * Turn a card-button click into a synthesized LarkMessageEvent pushed onto the
@@ -113235,6 +113260,7 @@ var init_channelClient = __esm({
                 })();
                 if (!fallbackEv) continue;
                 this.inFlightMessageIds.add(fallbackEv.message_id);
+                this.noteInFlightMeta(fallbackEv);
                 this.noteDispatchAttempt(fallbackEv.message_id);
                 log(`gap-fill dispatching (fallback): message_id=${fallbackEv.message_id} chat=${chatId}`);
                 this.queue.push(fallbackEv);
@@ -113242,6 +113268,7 @@ var init_channelClient = __esm({
                 continue;
               }
               this.inFlightMessageIds.add(ev.message_id);
+              this.noteInFlightMeta(ev);
               this.noteDispatchAttempt(ev.message_id);
               log(`gap-fill dispatching: message_id=${ev.message_id} thread=${ev.thread_id ?? "?"} chat=${chatId}`);
               this.queue.push(ev);
@@ -113332,6 +113359,37 @@ var init_channelClient = __esm({
         if (tracked === void 0) return;
         if (coveredFrom <= tracked) this.unresolvedGapWindowByChat.delete(chatId);
       }
+      /**
+       * Chats-mode replay loop (see {@link unresolvedReplayTimer}): every discovery
+       * interval, IF any unresolved gap window is pending, gapFill exactly those
+       * chats. Open-mode bots don't need this — their discovery cycle already
+       * includes unresolved-window chats in its target set.
+       */
+      startUnresolvedReplayTimer(log) {
+        if (this.opts.allowedChatIds.size === 0) return;
+        if (this.unresolvedReplayTimer) return;
+        const intervalMs = resolveOpenChatDiscoveryMs(this.opts.openChatDiscoveryMs);
+        if (intervalMs <= 0) return;
+        this.unresolvedReplayTimer = setInterval(() => {
+          void this.replayUnresolvedWindows(log);
+        }, intervalMs);
+        this.unresolvedReplayTimer.unref?.();
+      }
+      async replayUnresolvedWindows(log) {
+        if (this.closed || this.unresolvedReplayRunning) return;
+        this.pruneUnresolvedGapWindows(Date.now());
+        if (this.unresolvedGapWindowByChat.size === 0) return;
+        this.unresolvedReplayRunning = true;
+        try {
+          const chats = new Set(this.unresolvedGapWindowByChat.keys());
+          log(`unresolved-window replay: re-pulling ${chats.size} chat(s)`);
+          await this.gapFill(Date.now(), log, chats);
+        } catch (e) {
+          log(`unresolved-window replay failed: ${e instanceof Error ? e.message : String(e)}`);
+        } finally {
+          this.unresolvedReplayRunning = false;
+        }
+      }
       startOpenChatDiscovery(log) {
         if (this.opts.allowedChatIds.size > 0) return;
         if (this.openChatDiscoveryTimer) return;
@@ -113601,6 +113659,7 @@ var init_channelClient = __esm({
        */
       markHandled(messageId) {
         this.inFlightMessageIds.delete(messageId);
+        this.inFlightMessageMeta.delete(messageId);
         this.messageAttempts.delete(messageId);
         this.noteSeenMessage(messageId);
       }
@@ -113610,38 +113669,63 @@ var init_channelClient = __esm({
        * self-heal — one transient blip no longer swallows the @ forever). Does not
        * touch persisted seen state.
        *
-       * Poison-message guard: count this failed turn as one more attempt. If the
-       * message has now failed {@link MAX_MESSAGE_ATTEMPTS} times, GIVE UP — promote
-       * it to seen (so it stops being re-dispatched on every gap-fill) and log a
-       * visible warning instead of silently looping forever.
+       * Poison-message guard: if the message has already been dispatched
+       * {@link MAX_MESSAGE_ATTEMPTS} times, GIVE UP — promote it to seen (so it
+       * stops being re-dispatched on every gap-fill) and log a visible warning
+       * instead of silently looping forever. Otherwise, record an unresolved gap
+       * window for the message's chat so the next replay cycle re-dispatches it.
        */
-      markUnhandled(messageId) {
+      markUnhandled(messageId, opts) {
         this.inFlightMessageIds.delete(messageId);
-        const attempts = (this.messageAttempts.get(messageId) ?? 0) + 1;
-        this.messageAttempts.set(messageId, attempts);
+        const meta = this.inFlightMessageMeta.get(messageId);
+        this.inFlightMessageMeta.delete(messageId);
+        const attempts = this.messageAttempts.get(messageId) ?? 0;
         if (attempts >= MAX_MESSAGE_ATTEMPTS) {
           console.warn(
             `[channel.client] giving up on message_id=${messageId} after ${attempts} failed attempts \u2014 promoting to seen so it is no longer re-dispatched (poison-message guard)`
           );
           this.messageAttempts.delete(messageId);
           this.noteSeenMessage(messageId);
+          return;
+        }
+        if (meta && opts?.replay !== false) {
+          this.recordUnresolvedGapWindow(
+            meta.chatId,
+            meta.createTimeMs - 1e3,
+            (s) => console.log(`[channel.client] ${s}`)
+          );
         }
       }
       /**
        * Increment the per-message dispatch counter (poison-message guard). Called
-       * each time a message_id is pushed onto the inbound queue. The counter is also
-       * bumped in {@link markUnhandled} so both dispatch and failed settlement
-       * contribute toward the cap.
+       * each time a message_id is pushed onto the inbound queue — and ONLY then;
+       * {@link markUnhandled} deliberately reads without bumping, so the cap means
+       * "N real dispatches" (see the messageAttempts field doc).
        */
       noteDispatchAttempt(messageId) {
         this.messageAttempts.set(messageId, (this.messageAttempts.get(messageId) ?? 0) + 1);
       }
+      /**
+       * Capture chatId + create_time for an in-flight message at dispatch time, so
+       * {@link markUnhandled} can queue an unresolved gap window that reaches back
+       * to the message itself. An unparseable create_time falls back to "1 min ago"
+       * — wide enough to cover the message without flooding the replay pull.
+       */
+      noteInFlightMeta(ev) {
+        const t = Number(ev.create_time);
+        const createTimeMs = Number.isFinite(t) && t > 0 ? t < 1e12 ? t * 1e3 : t : Date.now() - 6e4;
+        this.inFlightMessageMeta.set(ev.message_id, { chatId: ev.chat_id, createTimeMs });
+      }
       async close() {
         this.closed = true;
         if (this.openChatDiscoveryTimer) {
           clearInterval(this.openChatDiscoveryTimer);
           this.openChatDiscoveryTimer = null;
         }
+        if (this.unresolvedReplayTimer) {
+          clearInterval(this.unresolvedReplayTimer);
+          this.unresolvedReplayTimer = null;
+        }
         this.queue.close();
         if (this.channel && this.connected) {
           try {
@@ -127722,6 +127806,19 @@ async function checkClaude(ctx) {
     message: required ? claudeLoginHint() : "\u672A\u68C0\u6D4B\u5230 Claude \u767B\u5F55\u6001(\u5F53\u524D\u65E0 bot \u4F7F\u7528 claude backend,\u53EF\u5FFD\u7565)\u3002\u5982\u9700\u4F7F\u7528 Claude Code backend,\u8BF7\u5148\u8FD0\u884C `claude` \u767B\u5F55\u3002"
   };
 }
+async function checkLarkCli() {
+  try {
+    await execFileAsync4("lark-cli", ["--version"], { timeout: 1e4 });
+    return { id: "lark-cli-binary", label: "lark-cli", status: "ok" };
+  } catch {
+    return {
+      id: "lark-cli-binary",
+      label: "lark-cli",
+      status: "error",
+      message: "\u672A\u627E\u5230 `lark-cli`(\u98DE\u4E66\u957F\u8FDE\u63A5/\u6D88\u606F\u5DE5\u5177,larkway \u786C\u4F9D\u8D56)\u3002\u5B89\u88C5:`npm i -g @larksuite/cli`,\u7136\u540E `lark-cli auth login` \u5B8C\u6210\u6388\u6743\u3002"
+    };
+  }
+}
 async function checkCodex(ctx) {
   const results = [];
   const required = await backendRequired(ctx, "codex");
@@ -128149,6 +128246,7 @@ async function runAllChecks(ctx, opts) {
   results.push(await checkClaude(ctx));
   const credChecks = await checkFeishuCreds(ctx);
   results.push(...credChecks);
+  results.push(await checkLarkCli());
   const yamlChecks = await checkBotYaml(ctx);
   results.push(...yamlChecks);
   const wtChecks = await checkWorktrees(ctx);
@@ -130998,6 +131096,7 @@ async function finalizeOnboard(sessionId, form) {
   if (!s._creds) {
     throw new Error("\u5185\u90E8\u9519\u8BEF:creds \u672A\u6301\u6709");
   }
+  s.status = "finalizing";
   try {
     const { botId } = await createBotFromCreds({
       creds: s._creds,
@@ -131019,12 +131118,16 @@ async function finalizeOnboard(sessionId, form) {
 async function cancelOnboard(sessionId) {
   const s = sessions.get(sessionId);
   if (!s) return { cancelled: false };
-  if (s.status === "done" || s.status === "error" || s.status === "cancelled") {
+  if (s.status === "done" || s.status === "error" || s.status === "cancelled" || // A finalize is already writing this session's bot to disk — treat like a
+  // terminal state (racing a SECOND createBotFromCreds here would land two
+  // bots from one Feishu app). The finalize's own outcome stands.
+  s.status === "finalizing") {
     return { cancelled: false };
   }
   if (s.status === "awaiting-name" && s._creds) {
     const defaultName = s.prefill?.suggestedName || "\u65B0\u52A9\u624B";
     const form = { name: defaultName };
+    s.status = "finalizing";
     try {
       const { botId } = await createBotFromCreds({
         creds: s._creds,

package/dist/main.js

@@ -116846,15 +116846,27 @@ var ChannelClient = class {
   inFlightMessageIds = /* @__PURE__ */ new Set();
   /**
    * Per-message (re-)dispatch counter for the poison-message guard. Incremented
-   * every time a message_id is pushed onto the inbound queue (live WS or either
-   * gap-fill branch) and once more when a turn is released as unhandled. When the
-   * count reaches {@link MAX_MESSAGE_ATTEMPTS}, markUnhandled GIVES UP: it
-   * promotes the message to seen (so it stops being re-dispatched) and logs a
-   * warning. markHandled clears the entry on terminal success. Not persisted:
+   * ONCE per dispatch — every time a message_id is pushed onto the inbound
+   * queue (live WS or either gap-fill branch), and nowhere else, so the cap
+   * really means "N dispatches". When a turn fails and the count has reached
+   * {@link MAX_MESSAGE_ATTEMPTS}, markUnhandled GIVES UP: it promotes the
+   * message to seen (so it stops being re-dispatched) and logs a warning.
+   * markHandled clears the entry on terminal success. Not persisted:
    * post-restart, an interrupted message starts fresh — same policy as
    * inFlightMessageIds.
    */
   messageAttempts = /* @__PURE__ */ new Map();
+  /**
+   * chatId + create_time for every in-flight message, captured at dispatch.
+   * Consumed by {@link markUnhandled}: a FAILED turn records an unresolved gap
+   * window for its chat so a later replay actually re-pulls (and re-dispatches)
+   * it. Without this there is no steady-state trigger for the re-dispatch that
+   * markUnhandled promises — chats-mode bots have no discovery timer at all,
+   * and open-mode steady-state discovery pulls 0 for already-known chats — so
+   * a turn failing before any visible surface existed was silently dropped.
+   * Cleared in markHandled / markUnhandled; bounded by the in-flight set.
+   */
+  inFlightMessageMeta = /* @__PURE__ */ new Map();
   /**
    * Chats observed from live WS events during this process lifetime.
    *
@@ -116889,6 +116901,17 @@ var ChannelClient = class {
   openChatDiscoveryTimer = null;
   openChatDiscoveryRunning = false;
   openChatDiscoveryBootstrapped = false;
+  /**
+   * Chats-mode (allowedChatIds non-empty) counterpart of the open-mode
+   * discovery cycle's unresolved-window replay: those bots never start
+   * discovery, so without this timer a window recorded by markUnhandled had
+   * NO trigger to replay it (the only other gapFill source is a WS reconnect,
+   * which a healthy network may not produce for days). Steady state with no
+   * pending windows does nothing — zero API calls — so the 0.3.28 storm fix
+   * is preserved.
+   */
+  unresolvedReplayTimer = null;
+  unresolvedReplayRunning = false;
   /**
    * Consecutive discovery-cycle failures. Used to SKIP cycles with exponential
    * backoff (storm: a failing +chat-list/gap-fill shouldn't re-fire every
@@ -117094,6 +117117,7 @@ var ChannelClient = class {
         return;
       }
       this.inFlightMessageIds.add(ev.message_id);
+      this.noteInFlightMeta(ev);
       this.noteDispatchAttempt(ev.message_id);
       log(`dispatching (channel-sdk): message_id=${ev.message_id} thread=${ev.thread_id ?? "?"}`);
       this.queue.push(ev);
@@ -117122,6 +117146,7 @@ var ChannelClient = class {
     this.connected = true;
     log(`connected as ${channel.botIdentity?.name ?? "?"} (${channel.botIdentity?.openId ?? "?"})`);
     this.startOpenChatDiscovery(log);
+    this.startUnresolvedReplayTimer(log);
   }
   /**
    * Turn a card-button click into a synthesized LarkMessageEvent pushed onto the
@@ -117362,6 +117387,7 @@ var ChannelClient = class {
             })();
             if (!fallbackEv) continue;
             this.inFlightMessageIds.add(fallbackEv.message_id);
+            this.noteInFlightMeta(fallbackEv);
             this.noteDispatchAttempt(fallbackEv.message_id);
             log(`gap-fill dispatching (fallback): message_id=${fallbackEv.message_id} chat=${chatId}`);
             this.queue.push(fallbackEv);
@@ -117369,6 +117395,7 @@ var ChannelClient = class {
             continue;
           }
           this.inFlightMessageIds.add(ev.message_id);
+          this.noteInFlightMeta(ev);
           this.noteDispatchAttempt(ev.message_id);
           log(`gap-fill dispatching: message_id=${ev.message_id} thread=${ev.thread_id ?? "?"} chat=${chatId}`);
           this.queue.push(ev);
@@ -117459,6 +117486,37 @@ var ChannelClient = class {
     if (tracked === void 0) return;
     if (coveredFrom <= tracked) this.unresolvedGapWindowByChat.delete(chatId);
   }
+  /**
+   * Chats-mode replay loop (see {@link unresolvedReplayTimer}): every discovery
+   * interval, IF any unresolved gap window is pending, gapFill exactly those
+   * chats. Open-mode bots don't need this — their discovery cycle already
+   * includes unresolved-window chats in its target set.
+   */
+  startUnresolvedReplayTimer(log) {
+    if (this.opts.allowedChatIds.size === 0) return;
+    if (this.unresolvedReplayTimer) return;
+    const intervalMs = resolveOpenChatDiscoveryMs(this.opts.openChatDiscoveryMs);
+    if (intervalMs <= 0) return;
+    this.unresolvedReplayTimer = setInterval(() => {
+      void this.replayUnresolvedWindows(log);
+    }, intervalMs);
+    this.unresolvedReplayTimer.unref?.();
+  }
+  async replayUnresolvedWindows(log) {
+    if (this.closed || this.unresolvedReplayRunning) return;
+    this.pruneUnresolvedGapWindows(Date.now());
+    if (this.unresolvedGapWindowByChat.size === 0) return;
+    this.unresolvedReplayRunning = true;
+    try {
+      const chats = new Set(this.unresolvedGapWindowByChat.keys());
+      log(`unresolved-window replay: re-pulling ${chats.size} chat(s)`);
+      await this.gapFill(Date.now(), log, chats);
+    } catch (e) {
+      log(`unresolved-window replay failed: ${e instanceof Error ? e.message : String(e)}`);
+    } finally {
+      this.unresolvedReplayRunning = false;
+    }
+  }
   startOpenChatDiscovery(log) {
     if (this.opts.allowedChatIds.size > 0) return;
     if (this.openChatDiscoveryTimer) return;
@@ -117728,6 +117786,7 @@ var ChannelClient = class {
    */
   markHandled(messageId) {
     this.inFlightMessageIds.delete(messageId);
+    this.inFlightMessageMeta.delete(messageId);
     this.messageAttempts.delete(messageId);
     this.noteSeenMessage(messageId);
   }
@@ -117737,38 +117796,63 @@ var ChannelClient = class {
    * self-heal — one transient blip no longer swallows the @ forever). Does not
    * touch persisted seen state.
    *
-   * Poison-message guard: count this failed turn as one more attempt. If the
-   * message has now failed {@link MAX_MESSAGE_ATTEMPTS} times, GIVE UP — promote
-   * it to seen (so it stops being re-dispatched on every gap-fill) and log a
-   * visible warning instead of silently looping forever.
+   * Poison-message guard: if the message has already been dispatched
+   * {@link MAX_MESSAGE_ATTEMPTS} times, GIVE UP — promote it to seen (so it
+   * stops being re-dispatched on every gap-fill) and log a visible warning
+   * instead of silently looping forever. Otherwise, record an unresolved gap
+   * window for the message's chat so the next replay cycle re-dispatches it.
    */
-  markUnhandled(messageId) {
+  markUnhandled(messageId, opts) {
     this.inFlightMessageIds.delete(messageId);
-    const attempts = (this.messageAttempts.get(messageId) ?? 0) + 1;
-    this.messageAttempts.set(messageId, attempts);
+    const meta = this.inFlightMessageMeta.get(messageId);
+    this.inFlightMessageMeta.delete(messageId);
+    const attempts = this.messageAttempts.get(messageId) ?? 0;
     if (attempts >= MAX_MESSAGE_ATTEMPTS) {
       console.warn(
         `[channel.client] giving up on message_id=${messageId} after ${attempts} failed attempts \u2014 promoting to seen so it is no longer re-dispatched (poison-message guard)`
       );
       this.messageAttempts.delete(messageId);
       this.noteSeenMessage(messageId);
+      return;
+    }
+    if (meta && opts?.replay !== false) {
+      this.recordUnresolvedGapWindow(
+        meta.chatId,
+        meta.createTimeMs - 1e3,
+        (s) => console.log(`[channel.client] ${s}`)
+      );
     }
   }
   /**
    * Increment the per-message dispatch counter (poison-message guard). Called
-   * each time a message_id is pushed onto the inbound queue. The counter is also
-   * bumped in {@link markUnhandled} so both dispatch and failed settlement
-   * contribute toward the cap.
+   * each time a message_id is pushed onto the inbound queue — and ONLY then;
+   * {@link markUnhandled} deliberately reads without bumping, so the cap means
+   * "N real dispatches" (see the messageAttempts field doc).
    */
   noteDispatchAttempt(messageId) {
     this.messageAttempts.set(messageId, (this.messageAttempts.get(messageId) ?? 0) + 1);
   }
+  /**
+   * Capture chatId + create_time for an in-flight message at dispatch time, so
+   * {@link markUnhandled} can queue an unresolved gap window that reaches back
+   * to the message itself. An unparseable create_time falls back to "1 min ago"
+   * — wide enough to cover the message without flooding the replay pull.
+   */
+  noteInFlightMeta(ev) {
+    const t = Number(ev.create_time);
+    const createTimeMs = Number.isFinite(t) && t > 0 ? t < 1e12 ? t * 1e3 : t : Date.now() - 6e4;
+    this.inFlightMessageMeta.set(ev.message_id, { chatId: ev.chat_id, createTimeMs });
+  }
   async close() {
     this.closed = true;
     if (this.openChatDiscoveryTimer) {
       clearInterval(this.openChatDiscoveryTimer);
       this.openChatDiscoveryTimer = null;
     }
+    if (this.unresolvedReplayTimer) {
+      clearInterval(this.unresolvedReplayTimer);
+      this.unresolvedReplayTimer = null;
+    }
     this.queue.close();
     if (this.channel && this.connected) {
       try {
@@ -118248,13 +118332,27 @@ function compactErrorText(err) {
 }
 
 // src/claude/sessionStore.ts
-import { rename as rename2, readFile as readFile3, writeFile as writeFile2, mkdir as mkdir2, copyFile } from "node:fs/promises";
+import { rename as rename2, readFile as readFile3, writeFile as writeFile2, mkdir as mkdir2, copyFile, unlink as unlink2 } from "node:fs/promises";
 import { dirname } from "node:path";
 var STORE_VERSION = 2;
 var TOUCH_DEBOUNCE_MS = 1e3;
 var SessionStore = class _SessionStore {
   #filePath;
   #map;
+  /**
+   * Serializes every #flush() through one chain — mirrors TaskHandleStore's
+   * `#flushChain` (same rationale). Concurrent writers are real here: up to
+   * MAX_CONCURRENT turns call `put()`/`delete()` while the touch-debounce
+   * timer fires its own flush. Without serialization, two overlapping
+   * `writeFile(SAME tmp path)+rename` pairs can interleave (both open with
+   * O_TRUNC at their own offset 0) and land corrupt JSON as sessions.json.
+   * Each link's #writeSnapshot() takes its #map snapshot when it actually
+   * RUNS (not at enqueue time), so the LAST queued write is always the LAST
+   * to land on disk.
+   */
+  #flushChain = Promise.resolve();
+  /** Monotonic suffix so no two in-flight tmp files ever share a path. */
+  #tmpCounter = 0;
   /** Whether a touch flush is pending */
   #touchDirty = false;
   #touchTimer;
@@ -118296,13 +118394,12 @@ var SessionStore = class _SessionStore {
     try {
       parsed = JSON.parse(raw);
     } catch {
-      throw new Error(
-        `[SessionStore] ${filePath} is not valid JSON \u2014 fix or delete the file and restart.`
-      );
+      return await _SessionStore.#recoverFromCorruption(filePath, "is not valid JSON");
     }
     if (typeof parsed !== "object" || parsed === null || !("records" in parsed)) {
-      throw new Error(
-        `[SessionStore] ${filePath} is missing required fields (records) \u2014 fix or delete the file and restart.`
+      return await _SessionStore.#recoverFromCorruption(
+        filePath,
+        "is missing required fields (records)"
       );
     }
     const file = parsed;
@@ -118316,8 +118413,9 @@ var SessionStore = class _SessionStore {
       );
     }
     if (typeof file.records !== "object" || file.records === null) {
-      throw new Error(
-        `[SessionStore] ${filePath} records field is not an object \u2014 fix or delete the file and restart.`
+      return await _SessionStore.#recoverFromCorruption(
+        filePath,
+        "records field is not an object"
       );
     }
     const map2 = /* @__PURE__ */ new Map();
@@ -118325,14 +118423,44 @@ var SessionStore = class _SessionStore {
       file.records
     )) {
       if (!isStoredRecord(value)) {
-        throw new Error(
-          `[SessionStore] ${filePath} record "${key}" has unexpected shape \u2014 fix or delete the file and restart.`
+        console.warn(
+          `[SessionStore] ${filePath} record "${key}" has unexpected shape \u2014 skipping it.`
         );
+        continue;
       }
       map2.set(key, value);
     }
     return new _SessionStore(filePath, map2);
   }
+  /**
+   * A corrupt sessions.json must not keep the whole bridge from booting:
+   * load() runs in main.ts startup with no surrounding try/catch, so a throw
+   * here used to take EVERY bot down and require manual file surgery.
+   * Mirror TaskHandleStore's posture instead: move the bad file to a
+   * timestamped `.corrupt-*` backup (never silently lost) and start from an
+   * empty store. Cost: threads lose their resume mapping and start fresh
+   * sessions — a safe degradation compared to a full outage.
+   *
+   * NOTE: an unknown FUTURE `version` still throws (see load) — that file is
+   * valid data written by newer code, not corruption, and must not be nuked.
+   */
+  static async #recoverFromCorruption(filePath, reason) {
+    const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    const backupPath = `${filePath}.corrupt-${ts}`;
+    try {
+      await rename2(filePath, backupPath);
+      console.error(
+        `[SessionStore] ${filePath} ${reason} \u2014 moved to ${backupPath}; starting with an empty store (existing threads will start fresh sessions).`
+      );
+    } catch (err) {
+      console.error(
+        `[SessionStore] ${filePath} ${reason} \u2014 backup rename failed (${String(err)}); starting with an empty store anyway.`
+      );
+    }
+    const store = new _SessionStore(filePath, /* @__PURE__ */ new Map());
+    await store.#flush();
+    return store;
+  }
   /**
    * Migrate a v1 sessions.json in-place to v2.
    * Backup written as `<path>.v1-backup-<ISO timestamp>` before any write.
@@ -118466,18 +118594,33 @@ var SessionStore = class _SessionStore {
   // Private helpers
   // -------------------------------------------------------------------------
   /**
-   * Atomic write: serialize → write to <path>.tmp → fs.rename (POSIX atomic).
+   * Atomic write, serialized through #flushChain (see field doc).
+   * The caller of THIS flush still observes its own link's rejection;
+   * the chain itself swallows it so one failure can't wedge later flushes.
    */
-  async #flush() {
+  #flush() {
+    const next = this.#flushChain.then(() => this.#writeSnapshot());
+    this.#flushChain = next.catch(() => {
+    });
+    return next;
+  }
+  /** serialize → write to a unique tmp path → fs.rename (POSIX atomic). */
+  async #writeSnapshot() {
     const file = {
       version: STORE_VERSION,
       records: Object.fromEntries(this.#map)
     };
     const json2 = JSON.stringify(file, null, 2);
-    const tmpPath = `${this.#filePath}.tmp`;
+    const tmpPath = `${this.#filePath}.tmp.${process.pid}.${this.#tmpCounter++}`;
     await mkdir2(dirname(this.#filePath), { recursive: true });
-    await writeFile2(tmpPath, json2, "utf8");
-    await rename2(tmpPath, this.#filePath);
+    try {
+      await writeFile2(tmpPath, json2, "utf8");
+      await rename2(tmpPath, this.#filePath);
+    } catch (err) {
+      await unlink2(tmpPath).catch(() => {
+      });
+      throw err;
+    }
   }
 };
 function isStoredRecord(value) {
@@ -121810,6 +121953,7 @@ function summarizeMentionPolicyRules(rules) {
   }
   return Array.from(counts.entries()).map(([rule, count]) => `${rule}=${count}`).join(", ");
 }
+var GIT_OP_TIMEOUT_MS = 10 * 60 * 1e3;
 function execGit(cwd, args) {
   return new Promise((resolve2, reject) => {
     const child = child_process.spawn("git", args, {
@@ -121817,18 +121961,37 @@ function execGit(cwd, args) {
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stderr = "";
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      const killTimer = setTimeout(() => child.kill("SIGKILL"), 5e3);
+      killTimer.unref();
+    }, GIT_OP_TIMEOUT_MS);
+    timer.unref();
     child.stderr.on("data", (c) => {
       stderr += c.toString();
     });
     child.on("close", (code) => {
-      if (code === 0) resolve2();
+      clearTimeout(timer);
+      if (timedOut) {
+        reject(
+          new Error(
+            `git ${args.join(" ")} timed out after ${GIT_OP_TIMEOUT_MS / 1e3}s (killed)
+stderr: ${stderr}`
+          )
+        );
+      } else if (code === 0) resolve2();
       else
         reject(
           new Error(`git ${args.join(" ")} exited ${code ?? "null"}
 stderr: ${stderr}`)
         );
     });
-    child.on("error", reject);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
   });
 }
 async function pathExists(p) {
@@ -121850,7 +122013,16 @@ async function isWorktreeGitHealthy(worktreePath) {
     child.on("error", () => resolve2(false));
   });
 }
-async function ensureRepoClone(basePath, url, token, label) {
+var repoCloneLocks = /* @__PURE__ */ new Map();
+function ensureRepoClone(basePath, url, token, label) {
+  const prev = repoCloneLocks.get(basePath) ?? Promise.resolve();
+  const next = prev.catch(() => {
+  }).then(() => ensureRepoCloneImpl(basePath, url, token, label));
+  repoCloneLocks.set(basePath, next.catch(() => {
+  }));
+  return next;
+}
+async function ensureRepoCloneImpl(basePath, url, token, label) {
   const gitDir = path10.join(basePath, ".git");
   if (await pathExists(gitDir)) {
     return;
@@ -121877,23 +122049,48 @@ async function ensureRepoClone(basePath, url, token, label) {
       GIT_TERMINAL_PROMPT: "0",
       [tokenEnvVar]: token ?? ""
     };
-    await new Promise((resolve2, reject) => {
-      const child = child_process.spawn(
-        "git",
-        ["clone", "--quiet", url, basePath],
-        { stdio: ["ignore", "pipe", "pipe"], env }
-      );
-      let stderr = "";
-      child.stderr.on("data", (b) => {
-        stderr += b.toString();
-      });
-      child.on("close", (code) => {
-        if (code === 0) resolve2();
-        else reject(new Error(`git clone ${url} exited ${code ?? "null"}
+    let timedOut = false;
+    try {
+      await new Promise((resolve2, reject) => {
+        const child = child_process.spawn(
+          "git",
+          ["clone", "--quiet", url, basePath],
+          { stdio: ["ignore", "pipe", "pipe"], env }
+        );
+        let stderr = "";
+        const timer = setTimeout(() => {
+          timedOut = true;
+          child.kill("SIGTERM");
+          const killTimer = setTimeout(() => child.kill("SIGKILL"), 5e3);
+          killTimer.unref();
+        }, GIT_OP_TIMEOUT_MS);
+        timer.unref();
+        child.stderr.on("data", (b) => {
+          stderr += b.toString();
+        });
+        child.on("close", (code) => {
+          clearTimeout(timer);
+          if (timedOut) {
+            reject(new Error(
+              `git clone ${url} timed out after ${GIT_OP_TIMEOUT_MS / 1e3}s (killed)
+stderr: ${stderr}`
+            ));
+          } else if (code === 0) resolve2();
+          else reject(new Error(`git clone ${url} exited ${code ?? "null"}
 stderr: ${stderr}`));
+        });
+        child.on("error", (err) => {
+          clearTimeout(timer);
+          reject(err);
+        });
       });
-      child.on("error", reject);
-    });
+    } catch (err) {
+      if (timedOut) {
+        await fs8.rm(basePath, { recursive: true, force: true }).catch(() => {
+        });
+      }
+      throw err;
+    }
     console.log(`[bridge.handler] clone of ${label} complete.`);
     await execGit(basePath, ["remote", "set-url", "origin", url]);
   } finally {
@@ -122150,7 +122347,8 @@ var BridgeHandler = class {
   /**
    * Enter the main loop: for-await over client.events(), per-thread concurrent dispatch.
    *
-   * Each unique thread_id (or message_id for top-level msgs) gets its own serial
+   * Each unique session key (root_id, or message_id for top-level msgs — the
+   * same normalization parseLarkMessage uses for threadId) gets its own serial
    * promise chain, so the same thread stays ordered while different threads run
    * concurrently. This fixes the UX problem where multiple operators sending
    * requests simultaneously would block each other for the duration of each
@@ -122185,7 +122383,7 @@ var BridgeHandler = class {
     for await (const event of this.deps.client.events()) {
       if (this.closed) break;
       if (signal?.aborted) break;
-      const key = event.thread_id ?? event.message_id;
+      const key = typeof event.root_id === "string" && event.root_id ? event.root_id : event.message_id;
       this.threadReceivedAt.set(key, Date.now());
       const prev = threadQueues.get(key) ?? Promise.resolve();
       const next = prev.then(() => acquire()).then(() => this.handleOne(event)).catch((err) => {
@@ -122212,6 +122410,7 @@ var BridgeHandler = class {
   async handleOne(event) {
     const settleMessageId = event.message_id;
     let settled = false;
+    let agentRunCompleted = false;
     let cotPublisher;
     let bubbleCreate;
     let cotTurnOutcome = "done";
@@ -122219,7 +122418,7 @@ var BridgeHandler = class {
       if (settled) return;
       settled = true;
       if (ok) this.deps.client.markHandled?.(settleMessageId);
-      else this.deps.client.markUnhandled?.(settleMessageId);
+      else this.deps.client.markUnhandled?.(settleMessageId, { replay: !agentRunCompleted });
     };
     try {
       const parsed = parseMessage(event);
@@ -122779,7 +122978,7 @@ var BridgeHandler = class {
           let toolsInFlight = 0;
           let toolUseTotalCount = 0;
           let idleWatchdog;
-          if (cardKitProgress) {
+          {
             const cadenceMs = Math.max(50, Math.min(Math.floor(idleTimeoutMs / 4), 15e3));
             idleWatchdog = setInterval(() => {
               if (toolsInFlight > 0) return;
@@ -122827,6 +123026,7 @@ var BridgeHandler = class {
               }
             }
             const result = await handle.done;
+            agentRunCompleted = true;
             if (idleWatchdog) {
               clearInterval(idleWatchdog);
               idleWatchdog = void 0;
@@ -122862,7 +123062,6 @@ var BridgeHandler = class {
               pooled: result.pooled,
               resumeMode: result.resumeMode
             });
-            const cardKitTurnTimedOut = cardKitProgress != null && interruptedByIdle;
             const reportedStateRead = await readStateFileDetailed(worktreePath);
             const rawReportedState = reportedStateRead.state;
             const reportedState = rawReportedState?.updated_at != null && rawReportedState.updated_at !== preRunUpdatedAt ? rawReportedState : null;
@@ -122923,7 +123122,7 @@ var BridgeHandler = class {
             }
             const reportedStatus = reportedState?.status;
             const reportedError = reportedState?.error;
-            const cardKitTimeoutFailure = cardKitTurnTimedOut && reportedStatus !== "ready" && reportedStatus !== "failed";
+            const cardKitTimeoutFailure = interruptedByIdle && reportedStatus !== "ready" && reportedStatus !== "failed";
             let success;
             let failureReason;
             if (reportedStatus === "failed") {
@@ -123132,8 +123331,13 @@ var BridgeHandler = class {
             );
             break;
           } catch (spawnErr) {
+            if (idleWatchdog) {
+              clearInterval(idleWatchdog);
+              idleWatchdog = void 0;
+            }
             const errMsg = String(spawnErr.message ?? spawnErr);
-            if (attempt === 1 && currentExisting != null && errMsg.includes("No conversation found")) {
+            const isStaleSessionErr = errMsg.includes("No conversation found") || errMsg.includes("thread/resume failed") && errMsg.includes("no rollout found");
+            if (attempt === 1 && currentExisting != null && isStaleSessionErr) {
               console.warn(
                 `[bridge.handler] stale session ${currentExisting.sessionId} for thread ${threadId} \u2014 removing and retrying without --resume`
               );
@@ -127509,7 +127713,7 @@ async function writeStatusFile(botId, w) {
 
 // src/claude/runner.ts
 import { spawn as spawn2 } from "node:child_process";
-import { writeFile as writeFile3, unlink as unlink2, mkdir as mkdir3 } from "node:fs/promises";
+import { writeFile as writeFile3, unlink as unlink3, mkdir as mkdir3 } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { createInterface } from "node:readline";
 var SIGKILL_GRACE_MS = 5e3;
@@ -127703,9 +127907,13 @@ function runClaude(opts) {
   function doKill() {
     if (child.killed || killScheduled) return;
     killScheduled = true;
+    let exited = false;
+    child.once("exit", () => {
+      exited = true;
+    });
     child.kill("SIGTERM");
     killTimer = setTimeout(() => {
-      if (!child.killed) child.kill("SIGKILL");
+      if (!exited) child.kill("SIGKILL");
     }, SIGKILL_GRACE_MS);
     killTimer.unref();
   }
@@ -127758,7 +127966,7 @@ function runClaude(opts) {
         clearTimeout(totalTimeoutFallbackHandle);
         rlAbortController.abort();
         if (pidFilePath !== null) {
-          void unlink2(pidFilePath).catch(() => {
+          void unlink3(pidFilePath).catch(() => {
           });
         }
         if (exitCode !== 0 && !killScheduled) {
@@ -127788,7 +127996,7 @@ stderr: ${stderr}` : "")
         clearTimeout(totalTimeoutFallbackHandle);
         rlAbortController.abort();
         if (pidFilePath !== null) {
-          void unlink2(pidFilePath).catch(() => {
+          void unlink3(pidFilePath).catch(() => {
           });
         }
         if (err.code === "ENOENT") {
@@ -127867,7 +128075,7 @@ var ClaudeRunner = class {
 
 // src/claude/pool.ts
 import { execFile as execFile4, spawn as spawn3 } from "node:child_process";
-import { mkdir as mkdir4, readFile as readFile6, rename as rename3, stat as stat3, unlink as unlink3, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile6, rename as rename3, stat as stat3, unlink as unlink4, writeFile as writeFile4 } from "node:fs/promises";
 import path16 from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 import { randomUUID } from "node:crypto";
@@ -128404,7 +128612,7 @@ ${stderr}` : "")
     try {
       const raw = await readFile6(pidFilePath, "utf8");
       const parsed = JSON.parse(raw);
-      if (parsed.pid === entry.child.pid) await unlink3(pidFilePath);
+      if (parsed.pid === entry.child.pid) await unlink4(pidFilePath);
     } catch {
     }
   }
@@ -128531,7 +128739,7 @@ async function reapOrphanedWarmClaudeProcesses(pidListFilePath) {
     } catch {
     }
   }
-  await unlink3(pidListFilePath).catch(() => {
+  await unlink4(pidListFilePath).catch(() => {
   });
 }
 
@@ -128699,6 +128907,8 @@ function runCodex(opts, codexBinPath = "codex") {
     ...opts.cwd != null ? { cwd: opts.cwd } : {}
   });
   markPerf("spawn");
+  child.stdin?.on("error", () => {
+  });
   function sendRequest(method, params) {
     const id = nextRequestId++;
     requestById.set(id, method);
@@ -128711,9 +128921,13 @@ function runCodex(opts, codexBinPath = "codex") {
   function doKill() {
     if (child.killed || killScheduled) return;
     killScheduled = true;
+    let exited = false;
+    child.once("exit", () => {
+      exited = true;
+    });
     child.kill("SIGTERM");
     killTimer = setTimeout(() => {
-      if (!child.killed) child.kill("SIGKILL");
+      if (!exited) child.kill("SIGKILL");
     }, SIGKILL_GRACE_MS3);
     killTimer.unref();
   }
@@ -128933,7 +129147,7 @@ var CodexRunner = class {
 
 // src/codex/pool.ts
 import { execFile as execFile5, spawn as spawn5 } from "node:child_process";
-import { mkdir as mkdir5, readFile as readFile7, unlink as unlink4, writeFile as writeFile5 } from "node:fs/promises";
+import { mkdir as mkdir5, readFile as readFile7, unlink as unlink5, writeFile as writeFile5 } from "node:fs/promises";
 import path17 from "node:path";
 import { createInterface as createInterface4 } from "node:readline";
 var DEFAULT_WARM_PROCESS_IDLE_MS2 = 10 * 60 * 1e3;
@@ -129195,6 +129409,8 @@ var CodexProcessPool = class {
     this.#pending.clear();
     this.#threadOwners.clear();
     this.#currentSpawnReadyResolved = false;
+    child.stdin?.on("error", () => {
+    });
     void this.#writePidFileBestEffort(child.pid);
     this.#ready = new Promise((resolve2, reject) => {
       this.#readyResolve = resolve2;
@@ -129312,7 +129528,7 @@ var CodexProcessPool = class {
     try {
       const raw = await readFile7(this.#pidFilePath, "utf8");
       const parsed = JSON.parse(raw);
-      if (parsed.pid === pid) await unlink4(this.#pidFilePath);
+      if (parsed.pid === pid) await unlink5(this.#pidFilePath);
     } catch {
     }
   }
@@ -129468,7 +129684,7 @@ async function reapOrphanedWarmProcess(pidFilePath) {
       );
     }
   }
-  await unlink4(pidFilePath).catch(() => {
+  await unlink5(pidFilePath).catch(() => {
   });
 }
 
@@ -129732,12 +129948,33 @@ function handleUnhandledRejection(reason, log = console) {
     rendered
   );
 }
+var BREAKER_THRESHOLD = 50;
+var BREAKER_WINDOW_MS = 6e4;
+function createCrashStormBreaker(threshold = BREAKER_THRESHOLD, windowMs = BREAKER_WINDOW_MS) {
+  const hits = [];
+  return function note() {
+    const now = Date.now();
+    hits.push(now);
+    while (hits.length > 0 && hits[0] < now - windowMs) hits.shift();
+    return hits.length >= threshold;
+  };
+}
 function registerCrashGuard(log = console) {
+  const noteCrash = createCrashStormBreaker();
+  const maybeTrip = () => {
+    if (!noteCrash()) return;
+    log.error(
+      `[larkway] crash-storm breaker TRIPPED: \u2265${BREAKER_THRESHOLD} crash-guard hits within ${BREAKER_WINDOW_MS / 1e3}s \u2014 the process is likely wedged, not weathering a transient. Exiting 1 so a supervisor can restart with a clean process.`
+    );
+    process.exit(1);
+  };
   process.on("uncaughtException", (err, origin) => {
     handleUncaughtException(err, origin, log);
+    maybeTrip();
   });
   process.on("unhandledRejection", (reason) => {
     handleUnhandledRejection(reason, log);
+    maybeTrip();
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "larkway",
-  "version": "0.3.37",
+  "version": "0.3.38",
   "description": "Thin bridge: Feishu thread to local Claude Code CLI",
   "license": "MIT",
   "author": "Chuck Wu (chuckwu0)",