openclaw-lark-multi-agent 1.5.1 → 1.7.0

package/dist/feishu-bot.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as lark from "@larksuiteoapi/node-sdk";
 import { createRequire } from "module";
 import { persistBotModel } from "./config.js";
@@ -6,7 +7,9 @@ import { InactiveRunObservation } from "./openclaw-client.js";
 import { SessionWaitPaused, isWaitTimeout, normalizeSessionRuntimeStatus, formatSessionFooter, FOREGROUND_WAIT_MS } from "./session-status.js";
 import { LiveStatusController } from "./live-status.js";
 import { CompactProgressController } from "./compact-progress.js";
+import { GoController } from "./go-controller.js";
 import { errorIdentity } from "./terminal-errors.js";
+import { formatProviderError, safeErrorSummary } from "./provider-errors.js";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { basename, extname, join, resolve } from "path";
 import { getBridgeAttachmentsDir, getDataDir } from "./paths.js";
@@ -137,6 +140,97 @@ export class FeishuBot {
     sendModelFooters = new Map();
     replyStatusFooters = new Map();
     sendStatusFooters = new Map();
+    /** Batch-scoped run-failure observers: steered inputs whose owning batch
+     * fails restore their durable fallback. Fired in processQueueInner's
+     * failure arms; dropped at each new batch top and on queue exit. */
+    runFailureObservers = new Map();
+    /** Steered messages admitted into the CURRENT batch (per chat). Flipped to
+     * DONE when that batch completes successfully; cleared (unflipped) when the
+     * batch scope ends any other way. */
+    admittedSteerAcks = new Map();
+    /** Go / Go-Checker supervision controller (per-bot instance). */
+    goDeliveryReceipts = new AsyncLocalStorage();
+    goReceiptApis = new WeakSet();
+    installGoReceiptCapture() {
+        const docx = this.client.docx;
+        const candidates = [
+            ...Array.from(new Set([this.client.im.message, this.client.im.v1?.message].filter(Boolean))).map(api => ({ api, operations: ["create", "reply"], visible: true })),
+            { api: this.client.im.file, operations: ["create"], visible: false },
+            { api: this.client.im.image, operations: ["create"], visible: false },
+            { api: docx?.document, operations: ["create", "convert"], visible: false },
+            { api: docx?.documentBlockDescendant, operations: ["create"], visible: false },
+        ];
+        for (const { api, operations, visible } of candidates) {
+            if (!api || this.goReceiptApis.has(api))
+                continue;
+            this.goReceiptApis.add(api);
+            for (const operation of operations) {
+                const original = api[operation]?.bind(api);
+                if (!original)
+                    continue;
+                api[operation] = async (params) => {
+                    const context = this.goDeliveryReceipts.getStore();
+                    const ordinal = context?.ordinals.get(context.stage) ?? 0;
+                    context?.ordinals.set(context.stage, ordinal + 1);
+                    const key = `outbox:${context?.outboxId}:${context?.stage}:${ordinal}`;
+                    const previous = context?.goId ? this.store.getGoDeliveryOperation(context.goId, key) : null;
+                    if (previous?.state === "rejected") {
+                        const failure = JSON.parse(previous.response_json);
+                        throw Object.assign(new Error(failure.message), { code: failure.code, response: { data: { code: failure.code, msg: failure.message } } });
+                    }
+                    if (context?.blocked || (previous && previous.state !== "accepted")) {
+                        // Carry a durable unknown fence across *all* fallback operations after
+                        // restart too, not merely the original failed card/attachment ordinal.
+                        if (context)
+                            context.blocked = true;
+                        throw new Error("Go delivery outcome unknown; original operation cannot be replayed");
+                    }
+                    let result;
+                    if (previous?.state === "accepted")
+                        result = JSON.parse(previous.response_json).result;
+                    else {
+                        if (context?.goId)
+                            this.store.recordGoDeliveryOperation(context.goId, key, "attempted");
+                        try {
+                            result = await original(params);
+                        }
+                        catch (err) {
+                            if (context?.goId) {
+                                const error = err;
+                                const code = error?.response?.data?.code ?? error?.data?.code ?? error?.code;
+                                const status = error?.response?.status;
+                                // A documented API rejection is not a lost response. Cache it so
+                                // deterministic card/text fallback can proceed without repeating it.
+                                if (Number.isFinite(Number(code)) && Number(code) > 0 || Number.isInteger(status) && status >= 400 && status < 500) {
+                                    this.store.recordGoDeliveryOperation(context.goId, key, "rejected", { code, message: error?.response?.data?.msg ?? error?.message ?? "platform rejected" });
+                                }
+                                else {
+                                    this.store.recordGoDeliveryOperation(context.goId, key, "unknown");
+                                    context.blocked = true;
+                                }
+                            }
+                            throw err;
+                        }
+                    }
+                    const id = result?.data?.message_id ?? result?.message_id;
+                    if (visible && context?.goId && !id) {
+                        this.store.recordGoDeliveryOperation(context.goId, key, "unknown");
+                        context.blocked = true;
+                        throw new Error("Missing actual Go platform message receipt");
+                    }
+                    if (context?.goId)
+                        this.store.recordGoDeliveryOperation(context.goId, key, "accepted", { result, payload: visible ? params.data : undefined, operation });
+                    if (visible && context && typeof id === "string" && id) {
+                        if (!context.receipts.some(r => r.messageId === id))
+                            context.receipts.push({ messageId: id, operation: previous?.state === "accepted" ? JSON.parse(previous.response_json).operation : operation, payload: previous?.state === "accepted" ? JSON.parse(previous.response_json).payload : params.data });
+                        context.onReceipt(); // Persist before the next chunk or attachment operation.
+                    }
+                    return result;
+                };
+            }
+        }
+    }
+    goController = null;
     /** Per-chat durable outbox retry timer. */
     deliveryRetryTimers = new Map();
     /** Last time a real assistant-visible reply was successfully handed to the delivery pipeline. */
@@ -173,6 +267,7 @@ export class FeishuBot {
             appSecret: config.appSecret,
             appType: lark.AppType.SelfBuild,
         });
+        this.installGoReceiptCapture();
         this.wsClient = new lark.WSClient({
             appId: config.appId,
             appSecret: config.appSecret,
@@ -182,6 +277,55 @@ export class FeishuBot {
             "im.message.receive_v1": this.handleMessage.bind(this),
             "im.message.recalled_v1": this.handleMessageRecalled.bind(this),
         });
+        // Go / Go-Checker supervision (design: lma-go-checker-design-20260917).
+        this.goController = new GoController({
+            botName: config.name,
+            fallbackModel: config.model,
+            store,
+            client: openclawClient,
+            executorSessionKeyFor: (chatId) => this.getSessionKey(chatId),
+            notify: (chatId, text) => this.sendOrdered(chatId, () => this.sendMessage(chatId, text)),
+            reply: (messageId, text) => this.replyMessage(messageId, text),
+            deliverExecutorResult: (chatId, result, goId) => this.deliverGoExecutorResult(chatId, result, goId),
+            log: (msg) => console.log(msg),
+        });
+        const unobserveGo = this.openclawClient.observeGoEvidence?.(({ channel, payload }) => {
+            const event = payload;
+            const exactKey = event?.sessionKey;
+            const sessionId = event?.sessionId;
+            const runId = event?.runId;
+            // Never infer generation or run identity from a prefix or current-session lookup.
+            if (typeof exactKey !== "string" || typeof sessionId !== "string" || typeof runId !== "string")
+                return;
+            for (const job of this.store.listActiveGoJobs(this.config.name)) {
+                if (exactKey !== job.executorSessionKey && exactKey !== `agent:main:${job.executorSessionKey}`)
+                    continue;
+                if (sessionId !== job.executorSessionId)
+                    continue;
+                const sourceKey = `${channel}:${runId}:${event.message?.id ?? event.id ?? event.seq ?? "unidentified"}`;
+                if (sourceKey.endsWith(":unidentified"))
+                    continue;
+                const message = event.message;
+                const text = message?.role === "assistant" && Array.isArray(message.content)
+                    ? message.content.filter((part) => part.type === "text").map((part) => part.text ?? "").join("\n")
+                    : event.stream === "assistant" ? (event.data?.text ?? event.data?.delta ?? "") : "";
+                const terminal = event.stream === "lifecycle" && ["end", "error"].includes(event.data?.phase);
+                if (!text && !terminal && !event.attachments?.length)
+                    continue;
+                this.store.recordGoVisibleEvidence(job.id, sourceKey, { sessionId, runId, kind: channel,
+                    text, attachments: event.attachments ?? message?.attachments ?? [] });
+                if (terminal)
+                    this.goController?.notifyRunOutcome(job.chatId, "no_reply", sourceKey, "精确 run 终局状态更新；不等于投递/验收通过");
+            }
+        });
+        this.store.onClose(() => unobserveGo?.());
+        // Recovery runs shortly after boot: verify executor session generations
+        // for active Go jobs and re-arm pending checks.
+        const recoverTimer = setTimeout(() => {
+            void this.goController?.recoverOnStartup().catch((err) => console.warn(`[${config.name}] Go recovery failed:`, err.message));
+        }, 5000);
+        recoverTimer.unref?.();
+        this.store.onClose(() => { clearTimeout(recoverTimer); this.goController?.dispose(); });
     }
     async handleMessageRecalled(data) {
         console.log(`[${this.config.name}] Message recalled event:`, JSON.stringify(data));
@@ -276,7 +420,7 @@ export class FeishuBot {
         catch (err) {
             // Session/model setup is authoritative. Propagate policy/capability errors
             // so the queue can notify the user and never continue on the wrong model.
-            console.warn(`[${this.config.name}] ensureSession error:`, err.message);
+            console.warn(`[${this.config.name}] ensureSession error:`, safeErrorSummary(err));
             throw err;
         }
         this.initializedSessions.add(sessionKey);
@@ -284,6 +428,11 @@ export class FeishuBot {
         this.openclawClient.setVerboseTranscriptDelivery(sessionKey, this.store.getBotVerbose(this.config.name, chatId));
         await this.openclawClient.subscribeSession(sessionKey, async (text, meta) => {
             try {
+                // The Controller owns exact Go executor finals. Streams/proactive callbacks
+                // can race collection (including after a bridge restart); never let that
+                // second path create a second body/attachment outbox owner.
+                if (meta?.runId && meta?.sessionId && this.store.ownsGoExecutorRun(this.config.name, chatId, meta.sessionKey || "", meta.sessionId, meta.runId))
+                    return;
                 let provenance = meta?.error;
                 if (!provenance && meta?.genericErrorCandidate && meta.runId && meta.sessionKey) {
                     provenance = this.store.getErrorNotice(this.config.name, chatId, errorIdentity(meta.sessionKey, meta.runId))?.provenance;
@@ -570,7 +719,7 @@ export class FeishuBot {
                 cleanText = commandText;
             }
             const preliminaryCommandName = cleanText.trim().split(/\s+/)[0]?.toLowerCase() || "";
-            const preliminaryBridgeCommands = new Set(["/help", "/status", "/compact", "/reset", "/stop", "/verbose", "/livestatus", "/free", "/mute", "/mode", "/model", "/models", "/discuss", "/chairman", "/locale"]);
+            const preliminaryBridgeCommands = new Set(["/help", "/status", "/compact", "/reset", "/stop", "/verbose", "/livestatus", "/free", "/mute", "/mode", "/model", "/models", "/discuss", "/chairman", "/locale", "/go"]);
             const isPreliminaryBridgeCommand = !isNativeOpenClawCommand && preliminaryBridgeCommands.has(preliminaryCommandName);
             // --- Record to local store (ALL messages, before command/response checks) ---
             const senderName = isBot
@@ -748,6 +897,7 @@ export class FeishuBot {
                         `🤖 /model [id] — 查看/切换当前 bot 绑定模型（持久化）`,
                         `💬 /discuss on|off|status|stop|rounds N — 群级多 bot 连续讨论（所有非 mute bot + Chairman 参与，忽略 free）`,
                         `👑 /chairman @Bot|off — 设置/清除本群唯一 Chairman（状态见 /status）`,
+                        `🎯 /go <目标>|status|pause|resume|stop — 独立 Go Checker 验收监督（执行 Agent 自称完成不等于验收通过）`,
                         `🌐 /locale zh|en — 设置/查看当前群语言`,
                         `❓ /help    — 显示此帮助信息`,
                         ``,
@@ -799,6 +949,27 @@ export class FeishuBot {
                     markCommandSynced();
                     return;
                 }
+                if (commandName === "/go") {
+                    // Go supervision targets one bot's executor session: groups require an
+                    // explicit mention (single-bot group is the implicit target), p2p always.
+                    const groupBotCount = Array.from(FeishuBot.allBots.values()).filter((bot) => bot.store === this.store).length;
+                    const goRoutedForMe = chatType === "p2p"
+                        || (routing.hasTargetedMention ? routing.isCurrentBotMentioned : groupBotCount === 1);
+                    if (goRoutedForMe) {
+                        const goArgs = cleanText.trim().split(/\s+/).slice(1).join(" ").trim();
+                        try {
+                            const control = /^(?:status|pause|resume|stop|model)(?:\s|$)/i.test(goArgs) || !goArgs;
+                            if (!control)
+                                await this.ensureSession(chatId);
+                            await this.goController?.handleGoCommand(chatId, messageId, goArgs);
+                        }
+                        finally {
+                            markCommandSynced();
+                            this.goController?.onCommandSettled(chatId);
+                        }
+                        return;
+                    }
+                }
                 if (rejectModelAll) {
                     await this.replyMessage(messageId, "❌ /model 是单 bot 设置，不能 @所有人。请明确 @ 一个 bot，例如：@Claude /model provider/model-id");
                     markCommandSynced();
@@ -987,6 +1158,7 @@ export class FeishuBot {
             if (!this.shouldRespond(chatType, message, isBot, chatId, routing))
                 return;
             if (!isBot && insertedId > 0) {
+                this.goController?.onHumanInput(chatId);
                 this.store.markPendingTrigger(this.config.name, chatId, insertedId);
             }
             // Track this message for reaction status updates
@@ -1044,17 +1216,68 @@ export class FeishuBot {
                 });
                 const steer = await this.openclawClient.steer(sessionKeyForSteer, steerWrapped, cleanText).catch(() => ({ status: "unavailable" }));
                 if (steer.status === "steered") {
+                    // OpenClaw 2026.9.9 no longer mirrors plugin-injected user messages as
+                    // session.message events, so the transcript-consumption observer may
+                    // never fire. Custody transfers to the active run at admission: clear
+                    // the durable trigger now (prevents the duplicate re-send after this
+                    // run ends) and arm an abnormal-end fallback that restores it.
+                    if (insertedId > 0) {
+                        // Consumption can land before admission returns (fast mirror) or
+                        // never (2026.9.9 removed mirrors); either way the message belongs
+                        // to this batch for the Get -> DONE flip.
+                        const steerAckList = this.admittedSteerAcks.get(chatId) || [];
+                        steerAckList.push({ messageId, insertedId });
+                        this.admittedSteerAcks.set(chatId, steerAckList);
+                    }
                     if (insertedId > 0 && !consumedBeforeAck) {
+                        const steerStopEpoch = this.stopEpoch.get(chatId) || 0;
+                        this.store.clearPendingTrigger(this.config.name, chatId, insertedId);
                         this.pendingSteerCleanups.set(insertedId, () => {
                             stopWatchingConsumption();
                             if ("cancelPending" in steer)
                                 steer.cancelPending?.();
                         });
+                        // The owning batch's failure restores the durable fallback. The
+                        // queue promise itself never rejects (processQueueInner isolates
+                        // errors), so failures are observed via runFailureObservers.
+                        const observers = this.runFailureObservers.get(chatId) || [];
+                        observers.push(() => {
+                            if (consumedBeforeAck)
+                                return;
+                            // A /stop during the run must not resurrect stopped input.
+                            if ((this.stopEpoch.get(chatId) || 0) !== steerStopEpoch)
+                                return;
+                            this.store.markPendingTrigger(this.config.name, chatId, insertedId);
+                            // The restored input takes the ordinary queue path: drop its
+                            // admitted-steer ack so only the new batch's DONE applies.
+                            this.admittedSteerAcks.set(chatId, (this.admittedSteerAcks.get(chatId) || []).filter((a) => a.insertedId !== insertedId));
+                            console.log(`[${this.config.name}] steer fallback restored after failed run for ${chatId.slice(-8)}: "${cleanText.substring(0, 40)}..."`);
+                            // Deferred: the current queue run is still active here; a fresh
+                            // drain must start after its finally releases the chat.
+                            setTimeout(() => { void this.processQueue(chatId).catch(() => { }); }, 0).unref?.();
+                        });
+                        this.runFailureObservers.set(chatId, observers);
+                        const owner = this.queueRuns.get(chatId);
+                        if (owner) {
+                            void owner.then(() => {
+                                // Queue ended without a batch failure: the steered input was
+                                // admitted into its batch; release the provisional correlation.
+                                stopWatchingConsumption();
+                                this.pendingSteerCleanups.delete(insertedId);
+                            }).catch(() => { });
+                        }
                     }
+                    // Custody transferred: acknowledge on Feishu immediately.
+                    void this.removeReaction(messageId, "Typing").catch(() => { });
+                    void this.addReaction(messageId, "Get").catch(() => { });
+                    const acks = this.pendingAckMessages.get(chatId) || [];
+                    for (const a of acks)
+                        if (a.messageId === messageId)
+                            a.emoji = "Get";
+                    this.pendingAckMessages.set(chatId, acks);
                     // The plugin confirmed queueing into the existing embedded run. Keep
-                    // that run's original delivery target and retain the durable trigger
-                    // until session.message proves this specific input was consumed.
-                    console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)}, plugin steer accepted (awaiting transcript consumption): "${cleanText.substring(0, 50)}..."`);
+                    // that run's original delivery target.
+                    console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)}, plugin steer accepted (custody transferred to active run): "${cleanText.substring(0, 50)}..."`);
                     return;
                 }
                 // Plugin missing/no active run/rejected: keep the durable trigger for
@@ -1086,7 +1309,7 @@ export class FeishuBot {
             await this.processQueue(chatId);
         }
         catch (err) {
-            console.error(`[${this.config.name}] Error:`, err);
+            console.error(`[${this.config.name}] Error:`, safeErrorSummary(err));
         }
     }
     shouldUseLiveStatus(chatId, isNativeCommandTrigger = false) {
@@ -1194,6 +1417,19 @@ export class FeishuBot {
      * Process queued messages for a chat: batch all unsynced messages and send to OpenClaw.
      * Loops until no more unsynced human messages remain.
      */
+    /** Fire and clear run-failure observers for a chat (isolated callbacks). */
+    fireRunFailureObservers(chatId) {
+        const obs = this.runFailureObservers.get(chatId);
+        if (!obs || obs.length === 0)
+            return;
+        this.runFailureObservers.delete(chatId);
+        for (const cb of obs) {
+            try {
+                cb();
+            }
+            catch { /* observer failures are isolated */ }
+        }
+    }
     async processQueue(chatId) {
         const existing = this.queueRuns.get(chatId);
         if (existing) {
@@ -1202,12 +1438,18 @@ export class FeishuBot {
         }
         const run = this.processQueueInner(chatId).finally(() => {
             this.queueRuns.delete(chatId);
+            this.runFailureObservers.delete(chatId);
+            this.admittedSteerAcks.delete(chatId);
         });
         this.queueRuns.set(chatId, run);
         return run;
     }
     async processQueueInner(chatId) {
         while (true) {
+            // A fresh batch starts: steered inputs admitted into the PREVIOUS batch
+            // completed with it (consumed or not); their failure observers are stale.
+            this.runFailureObservers.delete(chatId);
+            this.admittedSteerAcks.delete(chatId);
             const pendingMessages = this.store.getPendingTriggerMessages(this.config.name, chatId);
             const pendingTriggerIds = this.store.getPendingTriggerIds(this.config.name, chatId);
             // Only proceed if there are pending human messages that should actively trigger this bot.
@@ -1364,7 +1606,7 @@ export class FeishuBot {
                 // busy marker, report the actionable error, and retire only this batch
                 // so the chat cannot remain wedged indefinitely.
                 this.busyChats.set(chatId, 0);
-                const errorText = this.formatUserVisibleError(err);
+                const errorText = this.formatUserVisibleError(err, chatId);
                 if (lastHuman.messageId) {
                     await this.enqueueAndDispatchDelivery(chatId, "provider_error", `trigger:${triggerId}:session-setup-error`, errorText, [], lastHuman.messageId, `trigger:${triggerId}:session-setup-error`).catch(() => { });
                 }
@@ -1387,6 +1629,8 @@ export class FeishuBot {
                     ack.emoji = "Get";
                 }
             }
+            let foregroundRunId;
+            const foregroundSessionId = this.store.getActiveGoJob(this.config.name, chatId)?.executorSessionId;
             let runAcceptedByOpenClaw = false;
             let liveStatus;
             try {
@@ -1442,6 +1686,7 @@ export class FeishuBot {
                             markSubmittedBatch("send-attempt");
                         },
                         onSubmitted: (runId) => {
+                            foregroundRunId = runId;
                             runAcceptedByOpenClaw = true;
                             const target = this.activeDeliveryTargets.get(chatId);
                             if (target?.triggerId === triggerId) {
@@ -1593,7 +1838,7 @@ export class FeishuBot {
                             // Keep live status and final answer as separate messages. The final
                             // answer is created at completion time so it remains at the bottom
                             // even when the user inserted more messages during the run.
-                            await this.enqueueAndDispatchDelivery(chatId, "assistant_visible", this.deliverySourceId("visible", `${triggerId}|${(shouldReply ? visibleReply : "").trim()}|${JSON.stringify(parsedReply.attachments)}`), shouldReply ? visibleReply : "", parsedReply.attachments, lastHuman.messageId, `trigger:${triggerId}`, this.config.model);
+                            await this.enqueueAndDispatchDelivery(chatId, "assistant_visible", this.deliverySourceId("visible", `${triggerId}|${(shouldReply ? visibleReply : "").trim()}|${JSON.stringify(parsedReply.attachments)}`), shouldReply ? visibleReply : "", parsedReply.attachments, lastHuman.messageId, `trigger:${triggerId}`, this.config.model, foregroundRunId && foregroundSessionId ? { runId: foregroundRunId, sessionKey, sessionId: foregroundSessionId, final: true } : undefined);
                             await liveStatus?.complete();
                             // Mark every merged trigger as delivered so retries/restarts do
                             // not re-process any of them.
@@ -1601,6 +1846,9 @@ export class FeishuBot {
                                 this.store.markDeliveredReply(this.config.name, chatId, id, lastHuman.messageId);
                             // After a successful reply, warn the user once if context is high.
                             void this.maybeAlertHighContext(chatId);
+                            // Go supervision: record the delivered final reply as evidence and
+                            // arm a debounced checker round (busy gates apply inside).
+                            // Actual body/attachment receipts are recorded by dispatchPendingDeliveries.
                         }
                         catch (err) {
                             // enqueueAndDispatchDelivery already sent a user-visible delivery
@@ -1614,6 +1862,8 @@ export class FeishuBot {
                 if (isRuntimeFailure && lastHuman.messageId) {
                     await liveStatus?.fail().catch(() => { });
                     this.scheduleDelayedFailure(chatId, lastHuman.messageId, visibleReply, triggerId);
+                    // Go supervision: terminal runtime failure is still checkable evidence.
+                    this.goController?.notifyRunOutcome(chatId, "run_error", `trigger:${triggerId}`, visibleReply || "(运行失败，无用户可见正文)");
                 }
                 else if (!shouldReply && !hasAttachments) {
                     // A proactive session.message may already own this trigger and carry
@@ -1654,6 +1904,9 @@ export class FeishuBot {
                             await liveStatus?.noReply().catch(() => { });
                         }
                     }
+                    // Go supervision: an explicit NO_REPLY round is still a terminal
+                    // outcome the checker may need to see (e.g. executor stayed silent).
+                    this.goController?.notifyRunOutcome(chatId, "no_reply", `trigger:${triggerId}`, "(本轮无用户可见回复 NO_REPLY)");
                 }
                 console.log(`[${this.config.name}] [${new Date().toISOString()}] ${shouldReply || hasAttachments ? 'Replied' : 'Skipped (empty/NO_REPLY)'} (${reply.length} chars, attachments=${parsedReply.attachments.length})`);
                 // Replace ack reactions with DONE only for trigger messages actually
@@ -1671,6 +1924,18 @@ export class FeishuBot {
                     }
                 }
                 this.pendingAckMessages.set(chatId, remainingAcks);
+                // Steered messages admitted into THIS batch were consumed with it:
+                // flip their Get → DONE alongside the batch's own triggers.
+                const admittedSteers = this.admittedSteerAcks.get(chatId) || [];
+                if (admittedSteers.length > 0) {
+                    this.admittedSteerAcks.delete(chatId);
+                    for (const s of admittedSteers) {
+                        await this.removeReaction(s.messageId, "Get").catch(() => { });
+                        await this.addReaction(s.messageId, "DONE").catch(() => { });
+                    }
+                    const acksAfter = this.pendingAckMessages.get(chatId) || [];
+                    this.pendingAckMessages.set(chatId, acksAfter.filter((a) => !admittedSteers.some((s) => a.messageId === s.messageId)));
+                }
             }
             catch (err) {
                 let pause = err instanceof SessionWaitPaused ? err : undefined;
@@ -1698,6 +1963,7 @@ export class FeishuBot {
                     break;
                 }
                 if (err instanceof InactiveRunObservation) {
+                    this.fireRunFailureObservers(chatId);
                     await liveStatus?.pauseForUnconfirmedResult(err.message).catch(() => { });
                     if (!liveStatus?.id && lastHuman.messageId)
                         await this.replyMessage(lastHuman.messageId, `ℹ️ ${err.message}`).catch(() => { });
@@ -1711,6 +1977,7 @@ export class FeishuBot {
                     break;
                 }
                 if (err instanceof UnhealthySessionError) {
+                    this.fireRunFailureObservers(chatId);
                     // stopForUnhealthySession already warned the user; mark the live
                     // status as interrupted. The user can send another message to retry
                     // without being forced through /reset.
@@ -1718,8 +1985,9 @@ export class FeishuBot {
                     console.warn(`[${this.config.name}] processQueue stopped because session became unhealthy: ${err.status}`);
                     break;
                 }
-                console.error(`[${this.config.name}] processQueue error:`, err);
-                const errorText = this.formatUserVisibleError(err);
+                console.error(`[${this.config.name}] processQueue error:`, safeErrorSummary(err));
+                this.fireRunFailureObservers(chatId);
+                const errorText = this.formatUserVisibleError(err, chatId);
                 if (lastHuman.messageId) {
                     // Error message goes through the normal delivery path; the live status
                     // is a separate message that we mark interrupted afterwards.
@@ -1978,25 +2246,10 @@ export class FeishuBot {
         const key = triggerId ? `trigger:${triggerId}:wait-paused` : `wait-paused:${notice.snapshot.checkedAt}`;
         await this.enqueueAndDispatchDelivery(chatId, "wait_paused", key, notice.message, [], messageId, key, this.config.model);
     }
-    formatUserVisibleError(err) {
+    formatUserVisibleError(err, chatId) {
         if (err instanceof SessionWaitPaused)
             return err.message;
-        const raw = err instanceof Error ? err.message : String(err);
-        let reason = raw.replace(/\s+/g, " ").trim();
-        if (/quota/i.test(reason) || /exceeded/i.test(reason)) {
-            const reset = reason.match(/reset at ([^.;]+)/i)?.[1];
-            reason = reset ? `模型/供应商额度已用尽，重置时间：${reset}` : "模型/供应商额度已用尽，请稍后重试或切换模型";
-        }
-        else if (/timeout/i.test(reason)) {
-            reason = "模型响应超时，请稍后重试";
-        }
-        else if (/schema|tool payload|rejected/i.test(reason)) {
-            reason = "模型供应商拒绝了请求格式或工具参数，需要调整模型/工具调用";
-        }
-        else if (reason.length > 220) {
-            reason = reason.slice(0, 220) + "...";
-        }
-        return `⚠️ ${this.config.name} 这次没有完成回复。\n原因：${reason}`;
+        return formatProviderError(err, this.config.name, this.config.model, this.chatLocale(chatId));
     }
     isBridgeControlReply(text) {
         const t = text.trim();
@@ -2023,7 +2276,7 @@ export class FeishuBot {
         const t = text.trim();
         if (!t)
             return false;
-        return /^\/(help|status|compact|reset|stop|verbose|livestatus|free|mute|mode|model|models|discuss|chairman|locale)(\s|$)/i.test(t)
+        return /^\/(help|status|compact|reset|stop|verbose|livestatus|free|mute|mode|model|models|discuss|chairman|locale|go)(\s|$)/i.test(t)
             || this.isBridgeControlReply(t);
     }
     isRuntimeFailureText(text) {
@@ -2494,7 +2747,7 @@ export class FeishuBot {
                     replyToMessageId: replyToMessageId || "",
                     deliveryMode: "send",
                     targetMessageId: "",
-                    deliveryMetaJson: "{}",
+                    deliveryMetaJson,
                 });
             }
             // Dispatch recovery/correction/supplement rows together in creation order.
@@ -2520,6 +2773,11 @@ export class FeishuBot {
         catch {
             verdict = { state: "pending", reason: "inspection_unavailable" };
         }
+        // Presentation only: leave exact-run finality, stop suppression and durable
+        // outbox keys owned by the existing verdict; no retry/model fallback here.
+        if (verdict.state === "terminal" && verdict.reason === "ordinary_gateway_error") {
+            verdict = { ...verdict, text: this.formatUserVisibleError(record.provenance.detail, record.chatId) };
+        }
         // A stop or final may have arrived during the read-only lookup.
         const latest = this.store.getErrorNotice(this.config.name, record.chatId, record.noticeId);
         if (latest?.provenance.userStop) {
@@ -2637,18 +2895,56 @@ export class FeishuBot {
         timer.unref?.();
         this.deliveryRetryTimers.set(chatId, timer);
     }
+    /** Both initial and CONTINUE results enter the same ordinary LMA outbox.
+     * No host proactive-send assumption, no fake platform receipt. */
+    async deliverGoExecutorResult(chatId, result, goId) {
+        const source = `go-run:${result.sessionId}:${result.runId}`;
+        if (result.disposition === "silent" || result.disposition === "empty") {
+            this.goController?.notifyExactRunOutcome(goId, "no_reply", source, result.disposition === "silent" ? "精确执行 run 已终局：NO_REPLY（无用户可见正文）" : "精确执行 run 已终局：terminalReply.empty（真无正文，非未确认）", result.sessionId, result.runId);
+            return;
+        }
+        const failure = result.disposition === "error";
+        const parsed = this.extractBridgeAttachments(failure ? `⚠️ Go 执行运行已确认终局错误\n原因：${result.error || "unknown"}` : result.text);
+        if (parsed.text.trim() === "NO_REPLY")
+            parsed.text = "";
+        if (!parsed.text.trim() && !parsed.attachments.length) {
+            this.goController?.notifyExactRunOutcome(goId, "no_reply", source, "精确执行 run 已终局，但解析后无正文/附件", result.sessionId, result.runId);
+            return;
+        }
+        await this.enqueueAndDispatchDelivery(chatId, failure ? "go_executor_error" : "assistant_visible", source, parsed.text.trim(), parsed.attachments, undefined, source, this.config.model, { sessionKey: result.sessionKey, sessionId: result.sessionId, runId: result.runId, final: true, goJobId: goId });
+        // Pending/rejected/unknown platform responses must not be mistaken for
+        // visible evidence. The outbox retains its own safe receipt recovery path.
+        if (this.store.getDeliveryByKey(this.config.name, chatId, source)?.status !== "delivered")
+            throw new Error("Go executor outbox delivery pending/unconfirmed");
+    }
     async dispatchPendingDeliveries(chatId, replyToMessageId) {
+        this.installGoReceiptCapture();
         let retryScheduled = false;
         while (true) {
             const pending = this.store.getPendingDeliveries(chatId, this.config.name, 50);
             if (pending.length === 0)
                 break;
             for (const item of pending) {
-                await this.sendOrdered(chatId, async () => {
+                const ownerId = JSON.parse(item.deliveryMetaJson || "{}").provenance?.goJobId;
+                const deliveryJob = ownerId ? this.store.getGoJobById(ownerId) : this.store.getActiveGoJob(this.config.name, chatId);
+                const receipts = [
+                    ...(deliveryJob ? this.store.listGoVisibleEvidence(deliveryJob.id).find(e => e.sourceKey === `outbox:${item.id}`)?.receipt?.messages ?? [] : []),
+                ];
+                await this.sendOrdered(chatId, () => this.goDeliveryReceipts.run({ receipts, goId: deliveryJob?.id, outboxId: item.id, stage: "body", ordinals: new Map(), onReceipt: () => {
+                        if (deliveryJob)
+                            this.store.recordGoDeliveryReceipt(deliveryJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
+                    } }, async () => {
                     if (!item.id || !this.store.claimDelivery(item.id))
                         return;
                     let failureStage = "text";
                     try {
+                        const job = deliveryJob;
+                        const provenance = JSON.parse(item.deliveryMetaJson || "{}").provenance;
+                        const goSource = `outbox:${item.id}`;
+                        const eligible = job && ["assistant_visible", "verbose_transcript", "run_error", "provider_error", "delayed_error", "proactive", "go_executor_error"].some(k => item.sourceType.startsWith(k));
+                        if (eligible)
+                            this.store.recordGoVisibleEvidence(job.id, goSource, { sessionId: provenance?.sessionId ?? "",
+                                runId: provenance?.runId ?? "", kind: item.sourceType, text: item.content, attachments: JSON.parse(item.attachmentsJson || "[]") });
                         const attachments = JSON.parse(item.attachmentsJson || "[]");
                         // Final text is always sent as a NEW message. Never patch it into the
                         // older live-status card: user messages inserted during the run must
@@ -2721,6 +3017,9 @@ export class FeishuBot {
                         failureStage = "attachment";
                         const cursor = Math.max(0, item.attachmentCursor || 0);
                         for (let i = cursor; i < attachments.length; i++) {
+                            const context = this.goDeliveryReceipts.getStore();
+                            if (context)
+                                context.stage = `attachment:${i}`;
                             await this.sendBridgeAttachment(chatId, attachments[i]);
                             this.store.markDeliveryAttachmentCursor(item.id, i + 1);
                         }
@@ -2735,9 +3034,23 @@ export class FeishuBot {
                             await this.patchLiveStatusDoneSummary(item.targetMessageId, meta, chatId);
                             this.store.markDeliveryCleanupPending(item.id, false);
                         }
+                        if (eligible && receipts.length) {
+                            this.store.recordGoDeliveryReceipt(job.id, goSource, { messages: receipts, outboxId: item.id });
+                            if (provenance?.runId && provenance?.sessionId === job.executorSessionId) {
+                                const kind = ["run_error", "provider_error", "delayed_error", "go_executor_error"].some(k => item.sourceType.startsWith(k)) ? "run_error" : "assistant_reply";
+                                const evidence = JSON.stringify({ text: item.content, attachments, receipt: receipts });
+                                if (ownerId)
+                                    this.goController?.notifyExactRunOutcome(job.id, kind, goSource, evidence, provenance.sessionId, provenance.runId);
+                                else
+                                    this.goController?.notifyRunOutcome(chatId, kind, goSource, evidence);
+                            }
+                        }
                         this.store.markDeliveryDelivered(item.id);
                     }
                     catch (err) {
+                        const activeJob = deliveryJob;
+                        if (activeJob && receipts.length)
+                            this.store.recordGoDeliveryReceipt(activeJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
                         if (this.isOutOfChatError(err))
                             this.markCurrentBotUnavailable(chatId, err);
                         const willRetry = this.store.retryDelivery(item.id, DELIVERY_MAX_ATTEMPTS);
@@ -2771,7 +3084,7 @@ export class FeishuBot {
                             console.warn(`[${this.config.name}] Failed to notify terminal delivery error:`, this.errorSummary(notifyErr));
                         }
                     }
-                });
+                }));
             }
             // Drain subsequent pages immediately after successful batches. If any row
             // was returned to pending, honor its backoff timer instead of hot-looping.
@@ -3186,12 +3499,23 @@ export class FeishuBot {
     async deleteMessageById(messageId) {
         await this.client.im.v1.message.delete({ path: { message_id: messageId } });
     }
+    /** Resolve the Go supervision footer marker for a reply target via the store. */
+    goFooterForReply(messageId) {
+        try {
+            const chatId = this.store.getMessageByMessageId(messageId)?.chatId;
+            return chatId ? this.goController?.footerMarker(chatId) ?? null : null;
+        }
+        catch {
+            return null;
+        }
+    }
     async replyFinalMessage(messageId, text, model, status) {
         if (!model?.trim())
             return this.replyMessage(messageId, text);
         this.replyModelFooters.set(messageId, model.trim());
-        if (status)
-            this.replyStatusFooters.set(messageId, status);
+        const effStatus = [status?.trim(), this.goFooterForReply(messageId)].filter(Boolean).join(" · ") || undefined;
+        if (effStatus)
+            this.replyStatusFooters.set(messageId, effStatus);
         try {
             return await this.replyMessage(messageId, text);
         }
@@ -3591,8 +3915,9 @@ export class FeishuBot {
         if (!model?.trim())
             return this.sendMessage(chatId, text);
         this.sendModelFooters.set(chatId, model.trim());
-        if (status)
-            this.sendStatusFooters.set(chatId, status);
+        const effStatus = [status?.trim(), this.goController?.footerMarker(chatId) ?? null].filter(Boolean).join(" · ") || undefined;
+        if (effStatus)
+            this.sendStatusFooters.set(chatId, effStatus);
         try {
             return await this.sendMessage(chatId, text);
         }
@@ -4135,6 +4460,9 @@ export class FeishuBot {
     async handleResetCommand(chatId, messageId) {
         const sessionKey = this.getSessionKey(chatId);
         try {
+            // Go supervision: a reset replaces the executor session generation; pause
+            // supervision instead of letting the checker judge a wiped transcript.
+            void this.goController?.onExecutorSessionChanged(chatId, "执行会话被 /reset");
             // Fire reset (no response expected)
             this.openclawClient.resetSession(sessionKey).catch(() => { });
             // Wait a moment for it to take effect
@@ -4155,6 +4483,9 @@ export class FeishuBot {
      */
     async handleStopCommand(chatId, messageId) {
         const sessionKey = this.getSessionKey(chatId);
+        // Go supervision: a user stop must also pause related Go, so the checker
+        // cannot wake the just-stopped task back up with a follow-up.
+        void this.goController?.pauseSilently(chatId, "用户执行了 /stop");
         try {
             // Bump the stop generation FIRST so any in-flight auto-retry loop sees the
             // cancellation on its next iteration and stops retrying immediately.