openclaw-lark-multi-agent 1.8.0 → 1.8.2

package/dist/feishu-bot.d.ts

@@ -137,6 +137,14 @@ export declare class FeishuBot {
     /** Fire and clear run-failure observers for a chat (isolated callbacks). */
     private fireRunFailureObservers;
     private processQueue;
+    /**
+     * Force-release a stuck queue owner after the gateway authoritatively
+     * reported the session idle (no active run). The zombie owner's deep waits
+     * can otherwise hold chat custody forever: completion events routed through
+     * the proactive path are invisible to them. Steer-fallback triggers are
+     * restored via the failure observers so their input drains normally.
+     */
+    private forceExpireQueueOwner;
     private processQueueInner;
     private shouldHandleBridgeCommand;
     private shouldRespond;

package/dist/feishu-bot.js

@@ -5,6 +5,7 @@ import { persistBotModel } from "./config.js";
 import { getI18n, normalizeLocale } from "./i18n.js";
 import { InactiveRunObservation } from "./openclaw-client.js";
 import { SessionWaitPaused, isWaitTimeout, normalizeSessionRuntimeStatus, formatSessionFooter, FOREGROUND_WAIT_MS } from "./session-status.js";
+import { SupersededObservation } from "./openclaw-client.js";
 import { LiveStatusController } from "./live-status.js";
 import { CompactProgressController } from "./compact-progress.js";
 import { GoController } from "./go-controller.js";
@@ -1253,8 +1254,17 @@ export class FeishuBot {
                             this.admittedSteerAcks.set(chatId, (this.admittedSteerAcks.get(chatId) || []).filter((a) => a.insertedId !== insertedId));
                             console.log(`[${this.config.name}] steer fallback restored after failed run for ${chatId.slice(-8)}: "${cleanText.substring(0, 40)}..."`);
                             // Deferred: the current queue run is still active here; a fresh
-                            // drain must start after its finally releases the chat.
-                            setTimeout(() => { void this.processQueue(chatId).catch(() => { }); }, 0).unref?.();
+                            // drain must start after its finally releases the chat. A 0ms
+                            // timer is NOT enough — the owner's catch block still has
+                            // in-flight awaits (error delivery), so processQueue would join
+                            // the dying owner and return, stranding the restored trigger
+                            // until the next user message (2026-10-16 audit finding).
+                            const ownerNow = this.queueRuns.get(chatId);
+                            const drainRestored = () => { void this.processQueue(chatId).catch(() => { }); };
+                            if (ownerNow)
+                                void ownerNow.then(drainRestored, drainRestored).catch(() => { });
+                            else
+                                setTimeout(drainRestored, 0).unref?.();
                         });
                         this.runFailureObservers.set(chatId, observers);
                         const owner = this.queueRuns.get(chatId);
@@ -1286,7 +1296,39 @@ export class FeishuBot {
                 stopWatchingConsumption();
                 if ("cancelPending" in steer)
                     steer.cancelPending?.();
-                console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)} (steer=${steer.status}), queuing: "${cleanText.substring(0, 50)}..."`);
+                // Zombie-owner detection (2026-10-15 guangzi incident): steer found no
+                // active run while our in-memory owner still holds the chat. Ask the
+                // gateway for the authoritative session status: if it is idle, the owner
+                // is a zombie (its completion event was routed through the proactive
+                // path and it will never settle). Force-expire it and process this input
+                // NOW instead of queueing behind a dead promise forever.
+                if (steer.status === "no_active_run" && this.queueRuns.has(chatId)) {
+                    const live = await this.openclawClient.getSessionRuntimeStatus(sessionKeyForSteer).catch(() => null);
+                    if (live && !live.running) {
+                        console.warn(`[${this.config.name}] gateway reports session idle while queue owner exists for ${chatId.slice(-8)} — expiring zombie owner (status=${live.status})`);
+                        this.forceExpireQueueOwner(chatId, `gateway idle (steer=${steer.status}, session=${live.status})`);
+                        // Fall through to the normal send path below; the durable trigger
+                        // for this input is still set, so the fresh processQueue drains it.
+                    }
+                    else {
+                        console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)} (steer=${steer.status}, session running=${live?.running}), queuing: "${cleanText.substring(0, 50)}..."`);
+                    }
+                }
+                else {
+                    console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)} (steer=${steer.status}), queuing: "${cleanText.substring(0, 50)}..."`);
+                }
+                if (!this.queueRuns.has(chatId)) {
+                    // Owner gone (force-expired or settled during the steer RPC): send now.
+                    await this.removeReaction(messageId, "Typing").catch(() => { });
+                    await this.addReaction(messageId, "Get").catch(() => { });
+                    const acksNow = this.pendingAckMessages.get(chatId) || [];
+                    for (const a of acksNow)
+                        if (a.messageId === messageId)
+                            a.emoji = "Get";
+                    this.pendingAckMessages.set(chatId, acksNow);
+                    await this.processQueue(chatId);
+                    return;
+                }
                 // Reconciliation may have finished the old owner during the steer RPC.
                 // Ensure this new, still-pending input is drained even when that owner
                 // exited through an error path. Already-consumed input is never replayed.
@@ -1437,13 +1479,43 @@ export class FeishuBot {
             return existing;
         }
         const run = this.processQueueInner(chatId).finally(() => {
-            this.queueRuns.delete(chatId);
-            this.runFailureObservers.delete(chatId);
-            this.admittedSteerAcks.delete(chatId);
+            // Ownership token guard: only the CURRENT owner may release the slot. A
+            // zombie owner that settles after forceExpireQueueOwner must not delete
+            // the replacement owner's entry (that would open a concurrent-run window).
+            if (this.queueRuns.get(chatId) === run) {
+                this.queueRuns.delete(chatId);
+                this.runFailureObservers.delete(chatId);
+                this.admittedSteerAcks.delete(chatId);
+            }
         });
         this.queueRuns.set(chatId, run);
         return run;
     }
+    /**
+     * Force-release a stuck queue owner after the gateway authoritatively
+     * reported the session idle (no active run). The zombie owner's deep waits
+     * can otherwise hold chat custody forever: completion events routed through
+     * the proactive path are invisible to them. Steer-fallback triggers are
+     * restored via the failure observers so their input drains normally.
+     */
+    forceExpireQueueOwner(chatId, reason) {
+        const owner = this.queueRuns.get(chatId);
+        if (!owner)
+            return false;
+        console.warn(`[${this.config.name}] force-expiring zombie queue owner for ${chatId.slice(-8)}: ${reason}`);
+        // Fence the stale batch's local observation BEFORE releasing custody: an
+        // alive old poller would keep destructively consuming the replacement
+        // batch's frames from the shared session bucket (2026-10-16 regression).
+        try {
+            this.openclawClient.revokeSessionCollectors(this.getSessionKey(chatId), `queue owner force-expired: ${reason}`);
+        }
+        catch { /* isolated */ }
+        this.queueRuns.delete(chatId);
+        this.fireRunFailureObservers(chatId);
+        this.runFailureObservers.delete(chatId);
+        this.admittedSteerAcks.delete(chatId);
+        return true;
+    }
     async processQueueInner(chatId) {
         while (true) {
             // A fresh batch starts: steered inputs admitted into the PREVIOUS batch
@@ -1938,6 +2010,14 @@ export class FeishuBot {
                 }
             }
             catch (err) {
+                if (err instanceof SupersededObservation) {
+                    // This batch's local observation was fenced by a newer batch (or a
+                    // custody revocation). The new owner handles delivery from here; end
+                    // quietly — no error notice, no replay, no Gateway abort. The old
+                    // run's eventual reply still flows through the proactive path.
+                    console.log(`[${this.config.name}] batch observation superseded for ${chatId.slice(-8)}; ending quietly`);
+                    break;
+                }
                 let pause = err instanceof SessionWaitPaused ? err : undefined;
                 if (!pause && isWaitTimeout(err instanceof Error ? err.message : String(err))) {
                     const state = await this.readSessionStatus(chatId);

package/dist/openclaw-client.d.ts

@@ -21,6 +21,16 @@ export type ProgressEvent = {
 export declare class InactiveRunObservation extends Error {
     constructor();
 }
+/** The local collectReply observation was fenced because a newer batch took
+ *  over this session's queue custody. Purely local: no Gateway run was stopped,
+ *  and the superseded run's eventual reply still flows through the proactive
+ *  delivery path. Introduced for the 2026-10-16 stale-collector regression:
+ *  an alive old poller destructively consumed the replacement batch's frames
+ *  from the shared session bucket, starving the new collector's idle clock and
+ *  swallowing its final. */
+export declare class SupersededObservation extends Error {
+    constructor(reason?: string);
+}
 export type ChatAttachment = {
     type?: string;
     mimeType?: string;
@@ -59,6 +69,11 @@ export declare class OpenClawClient {
     private recentToolEventKeys;
     private sessionMessageCallbacks;
     private progressCallbacks;
+    /** Live collectReply fences per canonical session key. The most recent
+     *  collector for a session owns the shared event bucket; a new batch (or a
+     *  queue-custody revocation) fences stale ones synchronously so they cannot
+     *  steal frames from the replacement (2026-10-16 regression). */
+    private sessionCollectorFences;
     /** Per-session steered messages awaiting consumption confirmation. Each
      * accepted message is retained independently so identical/overlapping text
      * cannot overwrite another correlation. */
@@ -178,7 +193,7 @@ export declare class OpenClawClient {
      * the ambiguous public admission as a realtime-insertion success signal.
      */
     steer(sessionKey: string, text: string, displayText?: string): Promise<{
-        status: "steered" | "unavailable";
+        status: "steered" | "unavailable" | "no_active_run";
         runId?: string;
         /** Cancel provisional transcript correlation when LMA falls back to a normal run. */
         cancelPending?: () => void;
@@ -209,6 +224,11 @@ export declare class OpenClawClient {
      */
     /** Stop claiming an exact run's final output after observation has paused. */
     releasePausedWait(runId: string): void;
+    /** Synchronously fence every live collectReply observation for a session.
+     *  Local only — never aborts a Gateway run. Returns the number superseded.
+     *  Used when queue custody is revoked or a new chat.send takes over, so a
+     *  stale poller cannot steal the replacement batch's frames (2026-10-16). */
+    revokeSessionCollectors(sessionKey: string, reason: string): number;
     getSessionRuntimeStatus(sessionKey: string): Promise<SessionRuntimeStatus>;
     private classifyWaitTimeout;
     getSessionInfo(sessionKey: string): Promise<any>;

package/dist/openclaw-client.js

@@ -12,6 +12,19 @@ export class InactiveRunObservation extends Error {
         this.name = "InactiveRunObservation";
     }
 }
+/** The local collectReply observation was fenced because a newer batch took
+ *  over this session's queue custody. Purely local: no Gateway run was stopped,
+ *  and the superseded run's eventual reply still flows through the proactive
+ *  delivery path. Introduced for the 2026-10-16 stale-collector regression:
+ *  an alive old poller destructively consumed the replacement batch's frames
+ *  from the shared session bucket, starving the new collector's idle clock and
+ *  swallowing its final. */
+export class SupersededObservation extends Error {
+    constructor(reason = "本地观察已被更新的批次取代") {
+        super(`${reason}（未停止网关运行）`);
+        this.name = "SupersededObservation";
+    }
+}
 export const GATEWAY_PROTOCOL_MIN = 4;
 export const GATEWAY_PROTOCOL_MAX = 4;
 const REQUIRED_GATEWAY_METHODS = [
@@ -63,6 +76,11 @@ export class OpenClawClient {
     recentToolEventKeys = new Map();
     sessionMessageCallbacks = new Map();
     progressCallbacks = new Map();
+    /** Live collectReply fences per canonical session key. The most recent
+     *  collector for a session owns the shared event bucket; a new batch (or a
+     *  queue-custody revocation) fences stale ones synchronously so they cannot
+     *  steal frames from the replacement (2026-10-16 regression). */
+    sessionCollectorFences = new Map();
     /** Per-session steered messages awaiting consumption confirmation. Each
      * accepted message is retained independently so identical/overlapping text
      * cannot overwrite another correlation. */
@@ -1479,6 +1497,34 @@ export class OpenClawClient {
                 if (observationKey && this.runStateChecks.get(observationKey) === checkAfterNoActiveRun)
                     this.runStateChecks.delete(observationKey);
             };
+            // Fence registration: a newer batch on this session must be able to end
+            // THIS observation synchronously (local cleanup + superseded settlement)
+            // so the shared bucket is no longer destructively consumed by a stale
+            // poller. The Gateway run is never aborted by fencing.
+            const fenceSuperseded = () => {
+                if (observationClosed)
+                    return;
+                cleanupObservation();
+                reject(new SupersededObservation());
+            };
+            if (observationKey) {
+                let fences = this.sessionCollectorFences.get(observationKey);
+                if (!fences) {
+                    fences = new Set();
+                    this.sessionCollectorFences.set(observationKey, fences);
+                }
+                fences.add(fenceSuperseded);
+                const unregisterFence = () => {
+                    const current = this.sessionCollectorFences.get(observationKey);
+                    if (current) {
+                        current.delete(fenceSuperseded);
+                        if (current.size === 0)
+                            this.sessionCollectorFences.delete(observationKey);
+                    }
+                };
+                const baseCleanup = cleanupObservation;
+                cleanupObservation = () => { baseCleanup(); unregisterFence(); };
+            }
         }).finally(() => cleanupObservation());
     }
     /**
@@ -1628,6 +1674,10 @@ export class OpenClawClient {
                     console.warn(`[OpenClaw] lma.steer ${res.status} for ${key.slice(-8)}`);
                 }
                 cancelPending();
+                // Pass the gateway's authoritative "no active run" verdict through: the
+                // caller uses it to detect a zombie queue owner (2026-10-15 incident).
+                if (res?.status === "no_active_run")
+                    return { status: "no_active_run" };
                 return { status: "unavailable" };
             }
             return { status: "steered", cancelPending };
@@ -1783,6 +1833,25 @@ export class OpenClawClient {
         this.ownedDeliveryRunTimers.delete(runId);
         this.ownedDeliveryRuns.delete(runId);
     }
+    /** Synchronously fence every live collectReply observation for a session.
+     *  Local only — never aborts a Gateway run. Returns the number superseded.
+     *  Used when queue custody is revoked or a new chat.send takes over, so a
+     *  stale poller cannot steal the replacement batch's frames (2026-10-16). */
+    revokeSessionCollectors(sessionKey, reason) {
+        const key = this.canonicalSessionKey(sessionKey);
+        const fences = this.sessionCollectorFences.get(key);
+        if (!fences || fences.size === 0)
+            return 0;
+        const count = fences.size;
+        for (const fence of [...fences]) {
+            try {
+                fence();
+            }
+            catch { /* each fence is isolated */ }
+        }
+        console.warn(`[OpenClaw] superseded ${count} stale collector(s) for ${key.slice(-24)}: ${reason}`);
+        return count;
+    }
     async getSessionRuntimeStatus(sessionKey) {
         let timer;
         try {
@@ -2356,6 +2425,10 @@ export class OpenClawClient {
             let result;
             const sendStartedAt = Date.now();
             try {
+                // A stale collector from a previous batch must not steal this batch's
+                // frames from the shared session bucket (2026-10-16 regression). Fence
+                // any still-live local observation BEFORE issuing chat.send.
+                this.revokeSessionCollectors(sk, "new chat.send supersedes stale observation");
                 await params.onSendAttempt?.();
                 const sendChat = () => this.rpc("chat.send", {
                     sessionKey: this.canonicalSessionKey(sk),
@@ -2403,8 +2476,15 @@ export class OpenClawClient {
             // collectReply returns. Keep a short grace window so normal chat replies
             // are not delivered twice via the proactive-message path. Cron/LMA runs
             // are unaffected because they do not go through chatSend.
-            this.progressCallbacks.delete(sk);
-            this.progressCallbacks.delete(fullSessionKey);
+            // CAS: a superseded send's finally must not delete a newer send's
+            // progress callback (the fence settles the old promise after the new
+            // batch may already have registered its own callback).
+            if (params.onProgress) {
+                if (this.progressCallbacks.get(sk) === params.onProgress)
+                    this.progressCallbacks.delete(sk);
+                if (this.progressCallbacks.get(fullSessionKey) === params.onProgress)
+                    this.progressCallbacks.delete(fullSessionKey);
+            }
             if (waitPaused)
                 this.releasePausedWait(ownedRunId);
             else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-lark-multi-agent",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "Multi-bot Lark/Feishu bridge for OpenClaw, with per-bot model routing and isolated sessions",
   "type": "module",
   "scripts": {