openclaw-lark-multi-agent 1.8.12 → 1.8.14

package/dist/feishu-bot.d.ts

@@ -354,8 +354,16 @@ export declare class FeishuBot {
     /**
      * Enqueue a message send to guarantee ordering per chat.
      * All sends for a chat are serialized through this.
+     *
+     * The chain must never wedge: a single hung Feishu call used to block every
+     * later send in that chat forever (live-status patches fire per tool event),
+     * which froze cards and stranded /stop confirmations. Each link is therefore
+     * raced against a deadline, so a stuck send is abandoned and ordering resumes.
+     * Prefer a larger OPENCLAW_LARK_MULTI_AGENT_SEND_TIMEOUT_MS on slow links.
      */
     private sendOrdered;
+    /** One send link: resolve with fn(), or reject at the deadline so the chain advances. */
+    private withSendDeadline;
     /**
      * Add a reaction (emoji) to a message.
      */

package/dist/feishu-bot.js

@@ -29,6 +29,9 @@ const SESSION_HEALTH_POLL_MS = Number(process.env.OPENCLAW_LARK_MULTI_AGENT_SESS
 const SESSION_HEALTH_CONFIRM_MS = Number(process.env.OPENCLAW_LARK_MULTI_AGENT_SESSION_HEALTH_CONFIRM_MS || 2_000);
 const DELIVERY_MAX_ATTEMPTS = Number(process.env.OPENCLAW_LARK_MULTI_AGENT_DELIVERY_MAX_ATTEMPTS || 5);
 const DELIVERY_RETRY_BASE_MS = Number(process.env.OPENCLAW_LARK_MULTI_AGENT_DELIVERY_RETRY_BASE_MS || 1_000);
+// Per-chat send serialization deadline. A hung Feishu call must not block the
+// chain forever, otherwise live-status patches and /stop confirmations strand.
+const SEND_DEADLINE_MS = Number(process.env.OPENCLAW_LARK_MULTI_AGENT_SEND_TIMEOUT_MS || 30_000);
 // Auto-retry: when a reply looks truncated/incomplete, ask the same session
 // whether it finished. If it did not, let it continue; loop until it confirms
 // completion or the retry budget is spent. Off by setting AUTO_RETRY=0.
@@ -1361,10 +1364,20 @@ export class FeishuBot {
             return;
         }
         const identified = compatible && !!activity.activeRunId && !!activity.sessionId && !activity.archived && !status.archived;
+        // Bounded retention (2026-10-17 deadlock): an input that has stayed
+        // activity-unbound for over 60s despite re-checks must not be held forever.
+        // Hand it to the ordinary queue — the gateway's own chat.send admission is
+        // the authoritative answer and admission custody already dedups.
+        const unboundSince = current?.activityUnbound ? (current.unboundSince || 0) : 0;
+        if (!identified && unboundSince && Date.now() - unboundSince > 60_000) {
+            this.store.saveInsertion(this.config.name, chatId, rowId, current.insertionId, 'ordinary', { ...current, activityUnbound: false, reason: 'gateway state unconfirmable over 60s; ordinary admission is authoritative' });
+            return;
+        }
         this.store.saveInsertion(this.config.name, chatId, rowId, current?.insertionId || JSON.stringify([this.config.appId, chatId, messageId]), 'pending', {
             messageId, text, stopEpoch: epoch, sessionKey: this.getSessionKey(chatId), sessionId: identified ? activity.sessionId : status.sessionId,
             expectedRunId: identified ? activity.activeRunId : '', ownerId: identified ? `external:${activity.activeRunId}` : undefined,
             batchId: identified ? activity.activeRunId : undefined, activityUnbound: !identified, attempted: false,
+            ...(identified ? {} : { unboundSince: unboundSince || Date.now() }),
             reason: identified ? 'current Gateway run observed; insertion custody only' : 'current Gateway activity/run identity unavailable; retained without admission',
         }, Date.now() + (identified ? 0 : 5000));
     }
@@ -1576,6 +1589,21 @@ export class FeishuBot {
                     }
                     else if (state === 'target_ended')
                         state = 'pending';
+                    else if (state === 'pending') {
+                        // Safe recovery for a NON-INSERTABLE target (audit P1 #2
+                        // 2026-10-17): this branch only runs for EXPLICIT no-effect
+                        // receipts (attempted===false, definitively not inserted — the
+                        // outer guard). If the exact target run has settled, or the
+                        // target has refused insertion for over 60s (e.g. a long-lived
+                        // maintenance run), hand the input to the ordinary queue: the
+                        // gateway queues it behind whatever currently holds the session
+                        // instead of parking it in bridge-side limbo forever. Unknown
+                        // receipts never enter this branch and are never replayed.
+                        const boundSince = Number.isFinite(item.boundSince) ? item.boundSince : Date.now();
+                        item.boundSince = boundSince;
+                        if (originalRunEnded || Date.now() - boundSince > 60_000)
+                            state = 'ordinary';
+                    }
                 }
                 if (state === 'target_ended')
                     state = 'rejected'; // prior explicit backend refusal; never silently move it to a successor
@@ -4628,13 +4656,46 @@ export class FeishuBot {
     /**
      * Enqueue a message send to guarantee ordering per chat.
      * All sends for a chat are serialized through this.
+     *
+     * The chain must never wedge: a single hung Feishu call used to block every
+     * later send in that chat forever (live-status patches fire per tool event),
+     * which froze cards and stranded /stop confirmations. Each link is therefore
+     * raced against a deadline, so a stuck send is abandoned and ordering resumes.
+     * Prefer a larger OPENCLAW_LARK_MULTI_AGENT_SEND_TIMEOUT_MS on slow links.
      */
     sendOrdered(chatId, fn) {
         const prev = this.sendQueue.get(chatId) || Promise.resolve();
-        const next = prev.then(fn, fn); // run even if previous failed
+        const run = () => this.withSendDeadline(fn, chatId);
+        const next = prev.then(run, run); // run even if previous failed
         this.sendQueue.set(chatId, next.then(() => undefined, () => undefined));
         return next;
     }
+    /** One send link: resolve with fn(), or reject at the deadline so the chain advances. */
+    async withSendDeadline(fn, chatId) {
+        const limit = SEND_DEADLINE_MS;
+        let work;
+        try {
+            work = Promise.resolve(fn());
+        }
+        catch (err) {
+            return Promise.reject(err);
+        }
+        // A late rejection from an abandoned send must never become an unhandled
+        // rejection; the caller already moved on with the timeout error.
+        work.catch(() => { });
+        let timer;
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`send deadline ${limit}ms exceeded for ${chatId.slice(-8)}`)), limit);
+            timer.unref?.();
+        });
+        try {
+            return await Promise.race([work, deadline]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
     /**
      * Add a reaction (emoji) to a message.
      */

package/dist/openclaw-client.js

@@ -2177,8 +2177,8 @@ export class OpenClawClient {
         let timer;
         try {
             const value = await Promise.race([
-                this.rpc("sessions.describe", { key: this.canonicalSessionKey(sessionKey) }, 1500),
-                new Promise((_, reject) => { timer = setTimeout(() => reject(new Error("status lookup timeout")), 1500); }),
+                this.rpc("sessions.describe", { key: this.canonicalSessionKey(sessionKey) }, 5000),
+                new Promise((_, reject) => { timer = setTimeout(() => reject(new Error("status lookup timeout")), 5000); }),
             ]);
             return normalizeSessionRuntimeStatus(value);
         }
@@ -2194,7 +2194,7 @@ export class OpenClawClient {
      * terminal caches. Unknown/missing fields never authorize scheduling. */
     async getSessionDispatchStatus(sessionKey) {
         let timer;
-        const key = this.canonicalSessionKey(sessionKey), deadline = Date.now() + 1500;
+        const key = this.canonicalSessionKey(sessionKey), deadline = Date.now() + 8000;
         // One budget covers the entire public pending scan, not 1500ms per page.
         // Retained interrupted/cancelled inputs are recovery records, NOT runnable
         // queue entries. Never delete, mutate or replay them to prove schedulability.
@@ -2286,8 +2286,11 @@ export class OpenClawClient {
             return unknown();
         };
         try {
+            // The outer race must honor the SAME total budget as the scan itself
+            // (audit P1 2026-10-17: an 8000ms scan raced against a 1500ms timer was
+            // still killed at 1500ms — three real 650ms pages never got to finish).
             return await Promise.race([scan(), new Promise((_, reject) => {
-                    timer = setTimeout(() => reject(new Error('activity lookup timeout')), 1500);
+                    timer = setTimeout(() => reject(new Error('activity lookup timeout')), 8000);
                 })]);
         }
         catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-lark-multi-agent",
-  "version": "1.8.12",
+  "version": "1.8.14",
   "description": "Multi-bot Lark/Feishu bridge for OpenClaw, with per-bot model routing and isolated sessions",
   "type": "module",
   "scripts": {
@@ -83,4 +83,4 @@
   "publishConfig": {
     "access": "public"
   }
-}
+}