openclaw-lark-multi-agent 1.4.11 → 1.4.13

package/dist/feishu-bot.js

@@ -6,6 +6,7 @@ import { InactiveRunObservation } from "./openclaw-client.js";
 import { SessionWaitPaused, isWaitTimeout, normalizeSessionRuntimeStatus, formatSessionFooter, FOREGROUND_WAIT_MS } from "./session-status.js";
 import { LiveStatusController } from "./live-status.js";
 import { CompactProgressController } from "./compact-progress.js";
+import { errorIdentity } from "./terminal-errors.js";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { basename, extname, join, resolve } from "path";
 import { getBridgeAttachmentsDir, getDataDir } from "./paths.js";
@@ -117,6 +118,8 @@ export class FeishuBot {
      * message falls back to a normal run, cancel these before submission so a
      * later identical steer cannot consume the stale observer/correlation. */
     pendingSteerCleanups = new Map();
+    errorNoticeTimers = new Map();
+    errorNoticeChecks = new Map();
     adminOpenId;
     locale;
     configPath;
@@ -249,6 +252,19 @@ export class FeishuBot {
         this.openclawClient.setVerboseTranscriptDelivery(sessionKey, this.store.getBotVerbose(this.config.name, chatId));
         await this.openclawClient.subscribeSession(sessionKey, async (text, meta) => {
             try {
+                let provenance = meta?.error;
+                if (!provenance && meta?.genericErrorCandidate && meta.runId && meta.sessionKey) {
+                    provenance = this.store.getErrorNotice(this.config.name, chatId, errorIdentity(meta.sessionKey, meta.runId))?.provenance;
+                }
+                if (meta?.sourceType === "run_error" || provenance) {
+                    if (provenance) {
+                        this.store.observeRunError(this.config.name, chatId, provenance);
+                        await this.reconcileErrorNotices(chatId);
+                    }
+                    else
+                        console.warn(`[${this.config.name}] Uncorrelated run_error retained in logs; no finality evidence`);
+                    return; // errors never cancel pending results or complete live cards
+                }
                 const sourceType = meta?.sourceType === "verbose_transcript" ? "verbose_transcript" : "assistant_visible";
                 console.log(`[${this.config.name}] ${sourceType === "verbose_transcript" ? "Verbose transcript" : "Proactive message"} for ${chatId.slice(-8)}`);
                 const parsed = this.extractBridgeAttachments(text);
@@ -260,7 +276,7 @@ export class FeishuBot {
                     ? candidateTarget
                     : undefined);
                 try {
-                    await this.enqueueAndDispatchDelivery(chatId, sourceType, this.deliverySourceId(sourceType === "verbose_transcript" ? "verbose" : "proactive", `${Date.now()}:${Math.random()}:${parsed.text.trim()}|${JSON.stringify(parsed.attachments)}`), parsed.text.trim(), parsed.attachments, activeTarget?.messageId, activeTarget ? `trigger:${activeTarget.triggerId}` : undefined, sourceType === "verbose_transcript" ? undefined : this.config.model);
+                    await this.enqueueAndDispatchDelivery(chatId, sourceType, this.deliverySourceId(sourceType === "verbose_transcript" ? "verbose" : "proactive", `${Date.now()}:${Math.random()}:${parsed.text.trim()}|${JSON.stringify(parsed.attachments)}`), parsed.text.trim(), parsed.attachments, activeTarget?.messageId, activeTarget ? `trigger:${activeTarget.triggerId}` : undefined, sourceType === "verbose_transcript" ? undefined : this.config.model, meta);
                     if (sourceType !== "verbose_transcript" && (parsed.text.trim() || parsed.attachments.length > 0)) {
                         await activeTarget?.liveStatus?.complete().catch(() => { });
                         if (meta?.runId && runTarget)
@@ -363,6 +379,7 @@ export class FeishuBot {
                 }
                 // Re-subscribe to existing sessions
                 await this.ensureSession(chat.chatId);
+                drainTasks.push(this.reconcileErrorNotices(chat.chatId));
                 // Drain only messages that were explicitly marked as reply triggers.
                 // Context-only messages should not start an OpenClaw run after restart.
                 const pendingTriggerIds = this.store.getPendingTriggerIds(this.config.name, chat.chatId);
@@ -414,15 +431,8 @@ export class FeishuBot {
             const messageType = message.message_type;
             const messageId = message.message_id;
             const isBot = sender?.sender_type === "app";
-            // Extract bot open_id from mentions
-            if (message.mentions) {
-                for (const m of message.mentions) {
-                    const bot = FeishuBot.allBots.get(m.id?.app_id || "");
-                    if (bot && m.id?.open_id) {
-                        bot.botOpenId = m.id.open_id;
-                    }
-                }
-            }
+            // Identity comes from the startup probe, never from message mentions:
+            // a conflicting app_id/open_id pair must not overwrite a known identity.
             if (messageType !== "text" && messageType !== "image" && messageType !== "file" && messageType !== "audio" && messageType !== "sticker" && messageType !== "post" && messageType !== "share_doc")
                 return;
             // --- Dedup: atomically claim this message for this bot before any await.
@@ -512,7 +522,7 @@ export class FeishuBot {
             cleanText = await this.hydrateFeishuDocsInMessage(cleanText, content, messageId);
             if (!cleanText.trim())
                 return;
-            const routing = this.getRoutingIntent(chatType, message, messageType === "text" ? (content.text || "") : "");
+            const routing = this.getRoutingIntent(chatType, message, messageType === "text" ? (content.text || "") : "", content);
             // Commands may be prefixed by @all / @bot in group chats. Strip those
             // leading routing mentions before deciding whether this is a bridge command
             // or an escaped OpenClaw command.
@@ -551,6 +561,10 @@ export class FeishuBot {
             });
             if (insertedId < 0)
                 insertedId = this.store.getMessageId(messageId) || -1;
+            // Target exclusivity precedes ALL group command/coordinator, broadcast,
+            // single-bot, mute, Free and Discuss paths. Unknown targets are not self.
+            if (chatType !== "p2p" && routing.hasTargetedMention && !routing.isCurrentBotMentioned)
+                return;
             // --- Commands: in p2p always respond; in group, check shouldRespond first ---
             // Single slash commands are handled by the bridge. Double slash commands were
             // already unescaped above and should pass through to OpenClaw instead.
@@ -589,35 +603,28 @@ export class FeishuBot {
                         }
                     }
                     else if (isChairmanCommand) {
-                        // /chairman @Bot is owned by the mentioned bot itself. This avoids
-                        // requiring a coordinator to parse another bot's mention metadata,
-                        // which can vary across Feishu clients/bridges. Untargeted/status,
-                        // @all, and clear/off remain coordinator-owned group commands.
-                        //
-                        // Target resolution uses both Feishu mention metadata AND a text
-                        // fallback (parsing "@Bot" / "Bot" from the raw message), so a
-                        // /chairman that arrives without mention metadata still routes to
-                        // the intended bot instead of silently failing.
+                        // Verified mentions belong to the targeted bot. Bare configured
+                        // names remain local management arguments, not mention identity.
                         const chairmanArg = this.stripLeadingCommandMentions(this.cleanMentions(rawText)).replace(/^\s*\/chairman\b/i, "").trim().toLowerCase();
                         const isClearArg = ["off", "clear", "none"].includes(chairmanArg.split(/\s+/)[0] || "");
                         const hasMentionMeta = (message.mentions || []).some((m) => !this.isAllMentionItem(m));
-                        const targets = this.resolveChairmanTargets(message.mentions || [], cleanText, rawText);
+                        const targets = routing.hasTargetedMention ? routing.targetedBotNames : this.resolveChairmanTargets(message.mentions || [], cleanText, rawText);
                         // A pure status query: no clear keyword, no mention metadata, and no
                         // textual argument at all. Anything else is a set/route attempt.
                         const isStatusArg = !isClearArg && !hasMentionMeta && chairmanArg.length === 0;
                         if (isClearArg || isStatusArg) {
-                            // Group-level status/clear: one coordinator handles it.
-                            if (!this.isDiscussionCoordinator())
+                            // One eligible owner: first verified target, or bare coordinator.
+                            if (routing.hasTargetedMention ? routing.targetedBotNames[0] !== this.config.name : !this.isDiscussionCoordinator())
                                 return;
                         }
                         else if (targets.length >= 1) {
                             // Targets resolved: only the (single) targeted bot acts. If
-                            // multiple distinct targets resolved, the coordinator handles
-                            // the "only one chairman" error once.
+                            // multiple distinct targets resolved, the first target handles
+                            // the "only one chairman" error once (never an unmentioned bot).
                             const uniqueTargets = Array.from(new Set(targets));
                             const targetedSelf = uniqueTargets.includes(this.config.name);
                             if (uniqueTargets.length > 1) {
-                                if (!this.isDiscussionCoordinator())
+                                if (uniqueTargets[0] !== this.config.name)
                                     return;
                             }
                             else if (!targetedSelf) {
@@ -800,6 +807,7 @@ export class FeishuBot {
                     if (next === "free") {
                         await this.replyMessage(messageId, `🔓 ${this.config.name} 已切换到 free 模式
 不需要 @ 也可以回复普通人类消息；如果消息明确 @ 了其他 bot 或普通人，我不会抢答。
+需先设置本群 Chairman，Free 才会回答无 @ 的普通消息。
 如需多轮自动讨论，请使用群级命令 /discuss on。`);
                     }
                     else {
@@ -845,7 +853,7 @@ export class FeishuBot {
                     return;
                 }
                 if (commandName === "/chairman") {
-                    await this.handleChairmanCommand(chatId, chatType, messageId, message.mentions || [], cleanText.trim(), rawText);
+                    await this.handleChairmanCommand(chatId, chatType, messageId, message.mentions || [], cleanText.trim(), rawText, routing.hasTargetedMention ? routing.targetedBotNames : undefined);
                     markCommandSynced();
                     return;
                 }
@@ -855,11 +863,16 @@ export class FeishuBot {
                     return;
                 }
             }
+            // Local management commands above can restore Chairman. Only NEW
+            // unmentioned human triggers are gated; existing queue/delivery owners stay.
+            if (chatType !== "p2p" && !isBot && !routing.hasTargetedMention && !routing.isAllMention
+                && !this.store.getChairmanBot(chatId))
+                return;
             // --- Discuss mode: group-level multi-bot round scheduler. It takes over
             // plain human messages so normal Free mode does not duplicate Round 1.
             // Targeted mentions must fall through to normal routing so @GPT still
             // works while discuss mode is enabled.
-            if (chatType !== "p2p" && !isBot && this.store.getChatInfo(chatId)?.discuss) {
+            if (chatType !== "p2p" && !isBot && this.store.getChairmanBot(chatId) && this.store.getChatInfo(chatId)?.discuss) {
                 // Discuss mode owns ordinary and @all human messages. Explicit @bot/@human
                 // falls through to normal targeted routing.
                 if (!routing.hasTargetedMention) {
@@ -1702,10 +1715,8 @@ export class FeishuBot {
             return !isBot;
         if (isBot)
             return false;
-        const mentions = message.mentions || [];
-        if (this.isAllMention(rawText, mentions))
-            return true;
-        return this.isMentioned(mentions);
+        const routing = this.getRoutingIntent(chatType, message, rawText);
+        return routing.hasTargetedMention ? routing.isCurrentBotMentioned : routing.isAllMention;
     }
     shouldRespond(chatType, _message, isBot, chatId, routing) {
         if (chatType === "p2p")
@@ -1713,17 +1724,16 @@ export class FeishuBot {
         // Bot messages: only respond if this bot is explicitly mentioned.
         if (isBot)
             return routing.isCurrentBotMentioned;
-        // @all is an explicit broadcast to all non-muted bots.
-        if (routing.isAllMention)
-            return true;
         // Explicit targeted mentions are exclusive. If this bot is not one of the
         // mentioned bots, free/chairman must not steal the turn.
         if (routing.hasTargetedMention)
             return routing.isCurrentBotMentioned;
-        // Human-only mentions are also exclusive; free/chairman should not jump in.
-        if (routing.hasHumanMention)
-            return false;
+        // @all alone is an explicit broadcast, not an unmentioned message.
+        if (routing.isAllMention)
+            return true;
         if (chatId) {
+            if (!this.store.getChairmanBot(chatId))
+                return false;
             if (this.store.getBotMode(this.config.name, chatId) === "free")
                 return true;
             // Chairman fallback: if nobody is in free mode, the unique chairman
@@ -1734,12 +1744,46 @@ export class FeishuBot {
         }
         return false;
     }
-    getRoutingIntent(chatType, message, rawText) {
-        const mentions = message.mentions || [];
+    getRoutingIntent(chatType, message, rawText = "", content) {
+        const metadata = message.mentions || [];
+        const mentions = [...metadata];
+        const mentionTexts = [rawText];
+        if (message.message_type === "post") {
+            // Only structured post nodes carry mention semantics; do not interpret
+            // arbitrary JSON strings as identity or broaden attachment handling.
+            const posts = [content, ...Object.values(content || {})];
+            for (const post of posts) {
+                if (!Array.isArray(post?.content))
+                    continue;
+                if (typeof post.title === "string")
+                    mentionTexts.push(post.title);
+                for (const paragraph of post.content) {
+                    if (!Array.isArray(paragraph))
+                        continue;
+                    for (const node of paragraph) {
+                        if (node?.tag === "text" && typeof node.text === "string")
+                            mentionTexts.push(node.text);
+                        if (node?.tag !== "at")
+                            continue;
+                        // Rich-post user_id is matched only to an already probed open_id.
+                        mentions.push({ id: { open_id: node.user_id }, name: node.user_name });
+                    }
+                }
+            }
+        }
         const isAllMention = chatType !== "p2p" && this.isAllMention(rawText, mentions);
-        const targetedBotNames = this.mentionedBotNames(mentions);
+        // Structured nodes fill missing metadata, not override conflicting metadata.
+        const targetedBotNames = this.mentionedBotNames(metadata.length ? metadata : mentions);
+        // Missing metadata must not turn a platform placeholder or standalone @name
+        // into an unmentioned Free/Chairman trigger. This grants NO identity. Emails
+        // and embedded @ characters remain ordinary text, not commands or mentions.
+        const unresolvedTextMention = mentionTexts.some(text => {
+            const withoutAllPlaceholders = text.replace(/@_user_\d+/g, key => metadata.some(m => m.key === key && this.isAllMentionItem(m)) ? " " : key);
+            return /@_user_\d+/.test(withoutAllPlaceholders)
+                || /(^|\s)@(?!(?:_all|all|所有人)(?=\s|$))[^\s@]+/iu.test(withoutAllPlaceholders);
+        });
         const hasHumanMention = mentions.some((m) => !this.isAllMentionItem(m) && !this.mentionedBotName(m));
-        const hasTargetedMention = targetedBotNames.length > 0 || hasHumanMention;
+        const hasTargetedMention = targetedBotNames.length > 0 || hasHumanMention || unresolvedTextMention;
         return {
             isAllMention,
             targetedBotNames,
@@ -1757,44 +1801,32 @@ export class FeishuBot {
         return mentions.some((m) => this.isAllMentionItem(m));
     }
     isAllMentionItem(mention) {
-        return mention.key === "all" || mention.key === "@_all" || mention.id?.user_id === "all" || mention.id?.open_id === "all" || mention.name === "所有人";
+        const id = mention.id || {};
+        // A display name cannot override a concrete non-broadcast identity.
+        if (id.app_id || (id.open_id && id.open_id !== "all") || (id.user_id && id.user_id !== "all"))
+            return false;
+        return mention.key === "all" || mention.key === "@_all" || id.user_id === "all" || id.open_id === "all";
     }
     mentionedBotName(mention) {
         if (this.isAllMentionItem(mention))
             return null;
-        const candidates = [this, ...Array.from(FeishuBot.allBots.values()).filter((bot) => bot !== this)];
-        for (const bot of candidates) {
-            if (mention.id?.app_id && mention.id.app_id === bot.config.appId)
-                return bot.config.name;
-            if (bot.botOpenId && mention.id?.open_id && mention.id.open_id === bot.botOpenId)
-                return bot.config.name;
-        }
-        // Name is only a fallback because Feishu should normally provide app_id/open_id.
-        // Keep it exact to avoid shared-prefix bots like 万万（GPT） / 万万（Claude）
-        // stealing each other's mentions.
-        if (typeof mention.name === "string") {
-            const raw = mention.name.trim().replace(/^@+/, "").replace(/\s+/g, "").toLowerCase();
-            for (const bot of candidates) {
-                const botName = bot.config.name.trim().replace(/\s+/g, "").toLowerCase();
-                const exactNames = [
-                    botName,
-                    `万万（${botName}）`,
-                    `万万(${botName})`,
-                ];
-                if (exactNames.includes(raw))
-                    return bot.config.name;
-                // Generic display-name fallback: many deployments name bots like
-                // "光子 (Claude)" or "万万（GPT）". Match only when the parenthesized
-                // suffix is exactly the configured bot name, avoiding loose substring
-                // matches that caused shared-prefix bots to steal each other's mentions.
-                if (new RegExp(`^[^()（）]+[（(]${this.escapeRegExp(botName)}[）)]$`, "i").test(raw))
-                    return bot.config.name;
-            }
-        }
-        return null;
-    }
-    escapeRegExp(value) {
-        return value.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
+        const id = mention.id || {};
+        const candidates = [this, ...Array.from(FeishuBot.allBots.values()).filter((bot) => bot !== this && bot.store === this.store)];
+        const matches = candidates.filter((bot) => {
+            // Known conflicting app/open credentials veto, regardless of order. An
+            // unprobed open_id cannot establish identity, but a matching app_id can.
+            if (id.app_id && id.app_id !== bot.config.appId)
+                return false;
+            if (id.open_id && bot.botOpenId && id.open_id !== bot.botOpenId)
+                return false;
+            if (id.open_id && candidates.some((other) => other !== bot && other.botOpenId === id.open_id))
+                return false;
+            return (id.app_id && id.app_id === bot.config.appId)
+                || (id.open_id && bot.botOpenId && id.open_id === bot.botOpenId);
+        });
+        // Names (including exact/parenthesized suffixes) and unverified user/union
+        // IDs never establish bot identity. Ambiguous matches fail closed.
+        return matches.length === 1 ? matches[0].config.name : null;
     }
     resolveBotName(sender) {
         const openId = sender?.sender_id?.open_id;
@@ -2248,23 +2280,33 @@ export class FeishuBot {
         const sourceId = `discussion-system:${Date.now()}:${Math.random().toString(36).slice(2)}`;
         await this.enqueueAndDispatchDelivery(chatId, "discussion_system", sourceId, text);
     }
-    async enqueueAndDispatchDelivery(chatId, sourceType, sourceId, text, attachments = [], replyToMessageId, deliveryKey, finalReplyModel) {
+    async enqueueAndDispatchDelivery(chatId, sourceType, sourceId, text, attachments = [], replyToMessageId, deliveryKey, finalReplyModel, provenance, errorNoticeId) {
         if (!text.trim() && attachments.length === 0)
             return;
         const attachmentsJson = JSON.stringify(attachments);
         const normalizedPayload = `${text.trim()}|${attachmentsJson}`;
         const contentHash = this.stableHash(normalizedPayload);
         const finalDeliveryKey = deliveryKey || sourceId;
-        const deliveryMetaJson = finalReplyModel?.trim()
-            ? JSON.stringify({ model: finalReplyModel.trim() })
-            : "{}";
+        const deliveryMetaJson = JSON.stringify({
+            ...(finalReplyModel?.trim() ? { model: finalReplyModel.trim() } : {}),
+            ...(provenance ? { provenance } : {}), ...(errorNoticeId ? { errorNoticeId } : {}),
+        });
+        const correlatedFinal = sourceType === "assistant_visible" && provenance?.final && Boolean(provenance.runId && provenance.sessionKey);
+        if (correlatedFinal) {
+            const identity = { sessionKey: provenance.sessionKey, runId: provenance.runId };
+            this.store.promoteExactRunFinal(this.config.name, chatId, identity.sessionKey, identity.runId, contentHash, text, attachmentsJson);
+            if (!deliveryKey && this.store.hasExactRunFinalPayload(this.config.name, chatId, identity, text, attachmentsJson)) {
+                await this.dispatchPendingDeliveries(chatId);
+                return;
+            }
+        }
         if (sourceType === "verbose_transcript") {
             if (this.store.hasRecentSimilarDelivery(this.config.name, chatId, contentHash, 60_000, ["verbose_transcript"]))
                 return;
             if (this.store.hasRecentOverlappingDelivery(this.config.name, chatId, text, attachmentsJson, 60_000, 8, ["verbose_transcript"]))
                 return;
         }
-        else if (!deliveryKey) {
+        else if (!deliveryKey && !correlatedFinal) {
             if (this.store.hasRecentSimilarDelivery(this.config.name, chatId, contentHash, 60_000, [sourceType]))
                 return;
             if (this.store.hasRecentOverlappingDelivery(this.config.name, chatId, text, attachmentsJson, 60_000, 8, [sourceType]))
@@ -2291,6 +2333,15 @@ export class FeishuBot {
             // answer again on a second card. The original outbox row remains the sole
             // owner of text delivery; a different newly-frozen card is only collapsed.
             const existing = this.store.getDeliveryByKey(this.config.name, chatId, finalDeliveryKey);
+            if (sourceType === "run_error") {
+                // A withdrawn unsent notice may become terminal later. Keep its one
+                // task key; never use the result recovery/correction/attachment paths.
+                if (existing?.status === "failed" && !existing.textDelivered && existing.attempts < DELIVERY_MAX_ATTEMPTS) {
+                    this.store.renewUnsentErrorDelivery(existing.id, text, contentHash, deliveryMetaJson);
+                }
+                await this.dispatchPendingDeliveries(chatId);
+                return;
+            }
             // A failed owner must not permanently poison a logical trigger. Re-enqueue
             // the payload under a deterministic recovery key so a later authoritative
             // delivery gets a fresh retry budget.
@@ -2393,6 +2444,124 @@ export class FeishuBot {
             this.lastRealDeliveryAt.set(chatId, Date.now());
         }
     }
+    async inspectErrorNotice(record) {
+        if (this.store.hasRunFinalDelivery(this.config.name, record.chatId, record.provenance, true)) {
+            return { state: "suppressed", reason: "exact_run_final_platform_delivery_confirmed" };
+        }
+        if (this.store.hasRunFinalDelivery(this.config.name, record.chatId, record.provenance, false)) {
+            return { state: "pending", reason: "exact_run_final_delivery_pending" };
+        }
+        let verdict;
+        try {
+            verdict = await this.openclawClient.inspectRunError(record.provenance);
+        }
+        catch {
+            verdict = { state: "pending", reason: "inspection_unavailable" };
+        }
+        // A stop or final may have arrived during the read-only lookup.
+        const latest = this.store.getErrorNotice(this.config.name, record.chatId, record.noticeId);
+        if (latest?.provenance.userStop) {
+            record.provenance.userStop = true;
+            return { state: "stopped", reason: "explicit_bridge_stop" };
+        }
+        if (latest && (latest.provenance.source !== record.provenance.source || latest.provenance.state !== record.provenance.state || latest.provenance.stopReason !== record.provenance.stopReason)) {
+            record.provenance = latest.provenance;
+            record.checks = latest.checks;
+            return { state: "pending", reason: "stronger_terminal_evidence_observed" };
+        }
+        if (this.store.hasRunFinalDelivery(this.config.name, record.chatId, record.provenance, true)) {
+            return { state: "suppressed", reason: "exact_run_final_platform_delivery_confirmed" };
+        }
+        if (this.store.hasRunFinalDelivery(this.config.name, record.chatId, record.provenance, false)) {
+            return { state: "pending", reason: "exact_run_final_delivery_pending" };
+        }
+        return verdict;
+    }
+    deferErrorNotice(record, verdict) {
+        const delays = [15_000, 60_000, 120_000, 300_000, FOREGROUND_WAIT_MS];
+        record.verdict = verdict;
+        // Known-live task/delivery state is not an unknown diagnosis. Continue
+        // low-frequency checks across the Gateway's 30-minute retry window, bounded
+        // by the existing 24-hour observation horizon. Unknown evidence stays capped.
+        if (verdict.reason === "matching_task_or_delivery_continuing")
+            record.hasObservedContinuingTask = true;
+        const continuing = record.hasObservedContinuingTask === true;
+        const budget = continuing ? 300 : 6;
+        record.status = record.checks >= budget || Date.now() - record.createdAt >= 24 * 60 * 60_000 ? "parked" : "pending";
+        record.nextCheckAt = Date.now() + (continuing && record.checks >= 4 ? 300_000 : (delays[Math.max(0, record.checks - 1)] || FOREGROUND_WAIT_MS));
+        this.store.saveErrorNotice(record);
+        this.scheduleErrorNoticeCheck(record.chatId);
+    }
+    scheduleErrorNoticeCheck(chatId) {
+        const previous = this.errorNoticeTimers.get(chatId);
+        if (previous)
+            clearTimeout(previous);
+        this.errorNoticeTimers.delete(chatId);
+        const next = this.store.listPendingErrorNotices(this.config.name, chatId)[0];
+        if (!next)
+            return;
+        const timer = setTimeout(() => {
+            this.errorNoticeTimers.delete(chatId);
+            void this.reconcileErrorNotices(chatId).catch(err => console.warn(`[${this.config.name}] Error notice check unavailable:`, this.errorSummary(err)));
+        }, Math.max(1000, next.nextCheckAt - Date.now()));
+        timer.unref?.();
+        this.errorNoticeTimers.set(chatId, timer);
+    }
+    /** Bounded read-only diagnosis; known live tasks retain low-frequency observation. */
+    async reconcileErrorNotices(chatId) {
+        const running = this.errorNoticeChecks.get(chatId);
+        if (running)
+            return running;
+        const work = async () => {
+            const timer = this.errorNoticeTimers.get(chatId);
+            if (timer)
+                clearTimeout(timer);
+            this.errorNoticeTimers.delete(chatId);
+            for (const snapshot of this.store.listPendingErrorNotices(this.config.name, chatId)) {
+                // Earlier awaits may have observed a stop/stronger envelope for this row.
+                const record = this.store.getErrorNotice(this.config.name, chatId, snapshot.noticeId);
+                if (!record || record.status !== "pending")
+                    continue;
+                if (record.nextCheckAt > Date.now())
+                    continue;
+                if (record.checks >= (record.hasObservedContinuingTask || record.verdict?.reason === "matching_task_or_delivery_continuing" ? 300 : 6)) {
+                    // Normal exhausted checks are already parked. A still-pending row at
+                    // the cap can be a crash after budget reservation / before verdict or
+                    // outbox creation. Reserve one durable recovery probe, never per boot.
+                    if (record.recoveryProbeUsed) {
+                        this.deferErrorNotice(record, record.verdict || { state: "pending", reason: "budget_exhausted" });
+                        continue;
+                    }
+                    record.recoveryProbeUsed = true;
+                }
+                record.checks++;
+                // Reserve the budget before awaiting RPC, including crash/disconnect.
+                this.store.saveErrorNotice(record);
+                const verdict = await this.inspectErrorNotice(record);
+                console.log(`[${this.config.name}] Error notice ${record.noticeId}: ${verdict.state}/${verdict.reason}`);
+                if (verdict.state === "pending") {
+                    this.deferErrorNotice(record, verdict);
+                    continue;
+                }
+                record.verdict = verdict;
+                this.store.saveErrorNotice(record);
+                if (verdict.state === "terminal" && verdict.terminalKey && verdict.text) {
+                    // Independent identity: never take the result's trigger/final key.
+                    await this.enqueueAndDispatchDelivery(chatId, "run_error", verdict.terminalKey, verdict.text, [], undefined, verdict.terminalKey, undefined, { sourceType: "run_error", runId: record.provenance.runId, error: record.provenance, terminalEvidence: verdict }, record.noticeId);
+                    // The send-time recheck may have parked or suppressed the observation.
+                    const refreshed = this.store.getErrorNotice(this.config.name, chatId, record.noticeId);
+                    if (refreshed?.verdict && ["pending", "suppressed", "stopped"].includes(refreshed.verdict.state))
+                        continue;
+                }
+                record.status = verdict.state;
+                this.store.saveErrorNotice(record);
+            }
+            this.scheduleErrorNoticeCheck(chatId);
+        };
+        const promise = work().finally(() => { this.errorNoticeChecks.delete(chatId); });
+        this.errorNoticeChecks.set(chatId, promise);
+        return promise;
+    }
     scheduleDeliveryRetry(chatId, attempt) {
         if (this.deliveryRetryTimers.has(chatId))
             return;
@@ -2439,7 +2608,32 @@ export class FeishuBot {
                             const finalStatus = needsStatus ? formatSessionFooter(await this.readSessionStatus(chatId)) : undefined;
                             if (needsStatus && !finalModel)
                                 finalModel = this.config.model;
-                            if (shouldReplyToSource) {
+                            if (item.sourceType === "run_error") {
+                                const meta = JSON.parse(item.deliveryMetaJson || "{}");
+                                const record = this.store.getErrorNotice(this.config.name, chatId, meta.errorNoticeId || "");
+                                const verdict = record ? await this.inspectErrorNotice(record) : { state: "pending", reason: "missing_persisted_provenance" };
+                                if (verdict.state !== "terminal" || verdict.terminalKey !== item.deliveryKey || verdict.text !== item.content) {
+                                    this.store.withdrawErrorDelivery(item.id);
+                                    if (record) {
+                                        if (verdict.state === "pending" || verdict.state === "terminal")
+                                            this.deferErrorNotice(record, { ...verdict, state: "pending" });
+                                        else {
+                                            record.status = verdict.state;
+                                            record.verdict = verdict;
+                                            this.store.saveErrorNotice(record);
+                                        }
+                                    }
+                                    return;
+                                }
+                                record.verdict = verdict;
+                                this.store.saveErrorNotice(record);
+                            }
+                            if (item.sourceType === "run_error") {
+                                // Exactly one platform operation per guarded attempt. A card/text
+                                // fallback must not bypass a fresh finality check.
+                                await this.sendErrorNotice(chatId, item.content);
+                            }
+                            else if (shouldReplyToSource) {
                                 try {
                                     await this.replyFinalMessage(replyTarget, item.content, finalModel, finalStatus);
                                 }
@@ -2500,6 +2694,8 @@ export class FeishuBot {
                             return;
                         }
                         this.store.markDeliveryFailed(item.id);
+                        if (item.sourceType === "run_error")
+                            return;
                         const label = failureStage === "attachment" ? "附件发送失败" : "最终回复发送失败";
                         const errorText = `⚠️ ${label}（已重试 ${DELIVERY_MAX_ATTEMPTS} 次）：${this.errorSummary(err)}`;
                         const replyTarget = item.replyToMessageId || replyToMessageId;
@@ -2531,48 +2727,17 @@ export class FeishuBot {
             .filter((name) => Boolean(name));
         return Array.from(new Set(names));
     }
-    mentionedBotNamesFromChairmanText(...texts) {
-        const normalizedTexts = texts
-            .filter(Boolean)
-            .map((text) => text.replace(/^\s*\/chairman\b/i, "").trim())
-            .filter(Boolean)
-            .map((text) => text.replace(/^@+/, "").replace(/\s+/g, "").toLowerCase());
-        if (normalizedTexts.length === 0)
-            return [];
-        const names = [];
-        const candidates = [this, ...Array.from(FeishuBot.allBots.values()).filter((bot) => bot !== this && bot.store === this.store)];
-        for (const raw of normalizedTexts) {
-            for (const bot of candidates) {
-                const botName = bot.config.name.trim().replace(/\s+/g, "").toLowerCase();
-                const displayNames = [
-                    botName,
-                    `@${botName}`,
-                    `万万（${botName}）`,
-                    `@万万（${botName}）`,
-                    `万万(${botName})`,
-                    `@万万(${botName})`,
-                ];
-                if (displayNames.includes(raw) || new RegExp(`^@?[^()（）]+[（(]${this.escapeRegExp(botName)}[）)]$`, "i").test(raw)) {
-                    names.push(bot.config.name);
-                }
-            }
-        }
-        return Array.from(new Set(names));
-    }
-    /**
-     * Resolve the target bot name(s) for a /chairman command using every signal
-     * available, in priority order:
-     *   1. Feishu mention metadata (app_id / open_id / name).
-     *   2. Text fallback: "@Bot" or "Bot" written in the message body.
-     *
-     * This keeps /chairman working even when a Feishu client or bridge omits
-     * mention metadata. Returns a de-duplicated, order-preserving list.
-     */
     resolveChairmanTargets(mentions, text, rawText = "") {
-        const fromMeta = this.mentionedBotNames(mentions);
-        if (fromMeta.length > 0)
-            return fromMeta;
-        return this.mentionedBotNamesFromChairmanText(text, rawText);
+        if (mentions.some((m) => !this.isAllMentionItem(m)))
+            return this.mentionedBotNames(mentions);
+        // Only a bare, exact configured name is a local management argument. Never
+        // reinterpret an unresolved @name/placeholder as authority to target a bot.
+        const argument = text.replace(/^\s*\/chairman\b/i, "").trim().toLowerCase();
+        if (/(^|\s)@(?!(?:_all|all|所有人)(?=\s|$))[^\s@]+/iu.test(rawText) || argument.includes("@"))
+            return [];
+        return [this, ...Array.from(FeishuBot.allBots.values()).filter((bot) => bot !== this && bot.store === this.store)]
+            .filter((bot) => bot.config.name.toLowerCase() === argument)
+            .map((bot) => bot.config.name);
     }
     isDiscussionCoordinator() {
         const bots = Array.from(FeishuBot.allBots.values()).filter((bot) => bot.store === this.store);
@@ -3296,6 +3461,16 @@ export class FeishuBot {
     /**
      * Send a proactive message to a chat (not a reply).
      */
+    async sendErrorNotice(chatId, text) {
+        const res = await this.client.im.message.create({
+            params: { receive_id_type: "chat_id" },
+            data: { receive_id: chatId, msg_type: "text", content: JSON.stringify({ text }) },
+        });
+        const id = res?.data?.message_id || res?.message_id;
+        if (!id)
+            throw new Error("Error notice send returned no confirmed message id");
+        return id;
+    }
     async sendFinalMessage(chatId, text, model, status) {
         if (!model?.trim())
             return this.sendMessage(chatId, text);
@@ -3480,7 +3655,7 @@ export class FeishuBot {
             active ? `运行中：第 ${active.currentRound}/${active.maxRounds} 轮，topic=${active.topic.slice(0, 80)}` : "运行中：无",
         ].join("\n"));
     }
-    async handleChairmanCommand(chatId, chatType, messageId, mentions, text, rawText = "") {
+    async handleChairmanCommand(chatId, chatType, messageId, mentions, text, rawText = "", routedTargets) {
         if (chatType === "p2p") {
             await this.replyMessage(messageId, "❌ Chairman 只在群聊中可用");
             return;
@@ -3490,10 +3665,12 @@ export class FeishuBot {
         if (["off", "clear", "none"].includes(action)) {
             const previous = this.store.getChairmanBot(chatId);
             this.store.clearChairmanBot(chatId);
-            await this.replyMessage(messageId, previous ? `✅ 已清除当前群 Chairman（原 ${previous}）` : "✅ 当前群没有 Chairman");
+            discussionManager.stop(chatId); // Stop future turns; never abort in-flight agents.
+            await this.replyMessage(messageId, (previous ? `✅ 已清除当前群 Chairman（原 ${previous}）` : "✅ 当前群没有 Chairman")
+                + "\nDiscuss 已关闭；无 @ 的普通新消息不再触发回复（含 Free）。这不是 mute，明确 @ 仍按原规则处理；已执行任务不被中止。");
             return;
         }
-        const resolvedBotNames = this.resolveChairmanTargets(mentions, text, rawText);
+        const resolvedBotNames = routedTargets ?? this.resolveChairmanTargets(mentions, text, rawText);
         if (resolvedBotNames.length === 0) {
             // /chairman is intentionally not a status query. Status lives in /status;
             // this command is only for switching or clearing the Chairman. Keeping the