openclaw-lark-multi-agent 1.8.13 → 1.8.15

package/dist/message-store.d.ts

@@ -61,6 +61,11 @@ export interface DeliveryOutboxItem {
     createdAt: number;
     updatedAt: number;
 }
+/** A resolved dispatcher promise is not a platform receipt. */
+export type DeliveryDispatchOutcome = {
+    state: "delivered" | "pending" | "unknown" | "failed" | "suppressed";
+    outboxIds: number[];
+};
 export interface PendingErrorNotice {
     botName: string;
     chatId: string;
@@ -107,6 +112,9 @@ export declare class MessageStore {
     /** LMA-owned recovery journal. Never edits OpenClaw state. Unknown attempts
      * remain durable and are never selected by the ordinary pending drain. */
     private initReliabilityTables;
+    savePresentation(bot: string, app: string, chat: string, cohort: string, record: object): void;
+    getPresentation(bot: string, app: string, chat: string, cohort: string): any;
+    listPresentations(bot: string, app: string, chat: string): any[];
     getStopGeneration(bot: string, chat: string): number;
     bumpStopGeneration(bot: string, chat: string): number;
     setReactionIntent(bot: string, chat: string, row: number, record: object): void;
@@ -129,6 +137,7 @@ export declare class MessageStore {
     listAdmissions(sessionKey: string): any[];
     stopExactRun(sessionKey: string, runId: string): void;
     isStoppedObservation(sessionKey: string, runId: string): boolean;
+    hasUnconfirmedRunDelivery(bot: string, chat: string, runId: string): boolean;
     settleRunReactionIntents(bot: string, chat: string, runId: string): void;
     cancelReactionIntents(bot: string, chat: string, epoch: number): void;
     saveRunObservation(sessionKey: string, runId: string, record: object, nextCheckAt?: number): void;
@@ -149,10 +158,17 @@ export declare class MessageStore {
     claimInsertionAttempt(bot: string, chat: string, row: number): boolean;
     getInsertion(bot: string, chat: string, row: number): any;
     listInsertions(bot: string, chat?: string): any[];
+    /** Legacy queue identities are not canonical host input receipts. Until a
+     * genuine host proof is supported, only an explicitly ordinary input may
+     * participate in ordinary completion/sync; never guess from text or root ID. */
+    isOrdinaryInput(bot: string, chat: string, row: number): boolean;
     isInsertionReserved(bot: string, chat: string, row: number): boolean;
     stopInsertionAtEpoch(bot: string, chat: string, row: number, epoch: number): void;
     stopInsertions(bot: string, chat: string): void;
     hasUnknownDeliveryOperation(outbox: number): boolean;
+    /** Includes non-visible uploads/doc creation: absence of a message_id is
+     * not proof that no SDK effect has been attempted or accepted. */
+    getDeliveryEffectState(outbox: number): 'not_attempted' | 'unknown' | 'accepted' | 'rejected';
     /** Retain the full known result BEFORE the fallible main-journal checkpoint.
      * The memory copy survives local SQLite failures while this process is alive;
      * the independent insert journal also survives an interrupted UPDATE/reopen. */
@@ -298,6 +314,10 @@ export declare class MessageStore {
     getDeliveryBySource(sessionKey: string, sourceType: string, sourceId: string): DeliveryOutboxItem | null;
     getDeliveryByKey(botName: string, chatId: string, deliveryKey: string): DeliveryOutboxItem | null;
     listDeliveriesByKeyPrefix(botName: string, chatId: string, prefix: string): DeliveryOutboxItem[];
+    bindDeliveryCompletionTriggers(bot: string, chat: string, key: string, ids: number[]): void;
+    /** Include stable correction/supplement rows: the first accepted body alone
+     * cannot settle a logical final whose remaining attachments are unknown. */
+    getDeliveryDispatchOutcome(bot: string, chat: string, key: string): DeliveryDispatchOutcome;
     getPendingDeliveries(chatId?: string, botName?: string, maxCount?: number): DeliveryOutboxItem[];
     markBotSeenInChat(botName: string, chatId: string): void;
     hasBotSeenInChat(botName: string, chatId: string): boolean;

package/dist/message-store.js

@@ -28,6 +28,10 @@ export class MessageStore {
       CREATE TABLE IF NOT EXISTS reaction_custody(bot_name TEXT NOT NULL,chat_id TEXT NOT NULL,row_id INTEGER NOT NULL,record_json TEXT NOT NULL,
         PRIMARY KEY(bot_name,chat_id,row_id));
       CREATE TABLE IF NOT EXISTS run_delivery_targets(bot_name TEXT NOT NULL,chat_id TEXT NOT NULL,run_id TEXT NOT NULL,record_json TEXT NOT NULL,PRIMARY KEY(bot_name,chat_id,run_id));
+      -- UI-only custody: never read by admission, dispatch or business replay.
+      CREATE TABLE IF NOT EXISTS presentation_custody (
+        bot_name TEXT NOT NULL,app_id TEXT NOT NULL,chat_id TEXT NOT NULL,cohort_id TEXT NOT NULL,
+        record_json TEXT NOT NULL,PRIMARY KEY(bot_name,app_id,chat_id,cohort_id));
       CREATE TABLE IF NOT EXISTS dispatch_custody(bot_name TEXT NOT NULL,chat_id TEXT NOT NULL,record_json TEXT NOT NULL,PRIMARY KEY(bot_name,chat_id));
       CREATE TABLE IF NOT EXISTS admission_custody(session_key TEXT NOT NULL,submission_id TEXT PRIMARY KEY,state TEXT NOT NULL,record_json TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS run_observations (
@@ -56,6 +60,18 @@ export class MessageStore {
         WHERE state='capability_blocked' AND json_extract(record_json,'$.attempted')=0;
     `);
     }
+    savePresentation(bot, app, chat, cohort, record) {
+        this.db.prepare(`INSERT OR REPLACE INTO presentation_custody VALUES(?,?,?,?,?)`).run(bot, app, chat, cohort, JSON.stringify(record));
+    }
+    getPresentation(bot, app, chat, cohort) {
+        const row = this.db.prepare(`SELECT record_json FROM presentation_custody WHERE bot_name=? AND app_id=? AND chat_id=? AND cohort_id=?`)
+            .get(bot, app, chat, cohort);
+        return row ? JSON.parse(row.record_json) : null;
+    }
+    listPresentations(bot, app, chat) {
+        return this.db.prepare(`SELECT record_json FROM presentation_custody WHERE bot_name=? AND app_id=? AND chat_id=?`)
+            .all(bot, app, chat).map(row => JSON.parse(row.record_json));
+    }
     getStopGeneration(bot, chat) {
         return this.db.prepare('SELECT stop_epoch FROM bridge_generations WHERE bot_name=? AND chat_id=?').get(bot, chat)?.stop_epoch || 0;
     }
@@ -148,14 +164,26 @@ export class MessageStore {
     isStoppedObservation(sessionKey, runId) {
         return !!this.db.prepare("SELECT 1 FROM run_observations WHERE session_key=? AND run_id=? AND state='stopped'").get(sessionKey, runId);
     }
+    hasUnconfirmedRunDelivery(bot, chat, runId) {
+        const rows = this.db.prepare(`SELECT delivery_key,source_type FROM delivery_outbox WHERE bot_name=? AND chat_id=?
+      AND json_extract(delivery_meta_json,'$.provenance.runId')=?`).all(bot, chat, runId);
+        const finals = rows.filter(row => row.source_type.startsWith('assistant_visible'));
+        return (finals.length ? finals : rows).some(row => this.getDeliveryDispatchOutcome(bot, chat, row.delivery_key).state !== 'delivered');
+    }
     settleRunReactionIntents(bot, chat, runId) {
-        this.db.prepare(`UPDATE insertion_custody SET state='committed' WHERE bot_name=? AND chat_id=? AND state='accepted'
-      AND json_extract(record_json,'$.expectedRunId')=? AND json_extract(record_json,'$.stopEpoch')=?`)
-            .run(bot, chat, runId, this.getStopGeneration(bot, chat));
+        if (this.hasUnconfirmedRunDelivery(bot, chat, runId))
+            return;
+        // A root outcome/visible reply proves nothing about a legacy SDK queue
+        // item's commitment or consumption. Only ordinary inputs belong to this
+        // bulk completion cohort; even historical committed rows are not repaired
+        // or reinterpreted here. No exact host input identity is available for them.
         this.db.prepare(`UPDATE reaction_custody SET record_json=json_set(record_json,'$.desired','DONE')
       WHERE bot_name=? AND chat_id=? AND json_extract(record_json,'$.runId')=?
       AND json_extract(record_json,'$.desired') IN ('Get','Typing')
-      AND json_extract(record_json,'$.stopEpoch')=?`).run(bot, chat, runId, this.getStopGeneration(bot, chat));
+      AND json_extract(record_json,'$.stopEpoch')=?
+      AND NOT EXISTS (SELECT 1 FROM insertion_custody i WHERE i.bot_name=reaction_custody.bot_name
+        AND i.chat_id=reaction_custody.chat_id AND i.message_row_id=reaction_custody.row_id AND i.state!='ordinary')`)
+            .run(bot, chat, runId, this.getStopGeneration(bot, chat));
     }
     cancelReactionIntents(bot, chat, epoch) {
         this.db.prepare(`UPDATE reaction_custody SET record_json=json_set(record_json,'$.desired','','$.stopEpoch',?)
@@ -235,6 +263,13 @@ export class MessageStore {
       AND state IN ('pending','accepted','unknown','dispatching') ORDER BY next_check_at LIMIT 100`).all(bot, ...(chat ? [chat] : []))
             .map(r => ({ ...JSON.parse(r.record_json), state: r.state, insertionId: r.insertion_id, rowId: r.message_row_id, chatId: r.chat_id, nextCheckAt: r.next_check_at }));
     }
+    /** Legacy queue identities are not canonical host input receipts. Until a
+     * genuine host proof is supported, only an explicitly ordinary input may
+     * participate in ordinary completion/sync; never guess from text or root ID. */
+    isOrdinaryInput(bot, chat, row) {
+        return !this.db.prepare(`SELECT 1 FROM insertion_custody WHERE bot_name=? AND chat_id=?
+      AND message_row_id=? AND state!='ordinary'`).get(bot, chat, row);
+    }
     isInsertionReserved(bot, chat, row) {
         const item = this.getInsertion(bot, chat, row);
         return !!item && !['ordinary', 'stopped'].includes(item.state);
@@ -250,6 +285,17 @@ export class MessageStore {
         return !!this.db.prepare(`SELECT 1 FROM delivery_operations o WHERE outbox_id=? AND state IN ('attempted','unknown')
       AND NOT EXISTS(SELECT 1 FROM delivery_receipt_custody k WHERE k.outbox_id=o.outbox_id AND k.operation_key=o.operation_key) LIMIT 1`).get(outbox);
     }
+    /** Includes non-visible uploads/doc creation: absence of a message_id is
+     * not proof that no SDK effect has been attempted or accepted. */
+    getDeliveryEffectState(outbox) {
+        if (this.hasUnknownDeliveryOperation(outbox))
+            return 'unknown';
+        if ([...this.knownDeliveryReceipts.values()].some(item => item.outbox === outbox) ||
+            this.db.prepare(`SELECT 1 FROM delivery_operations WHERE outbox_id=? AND state='accepted'
+        UNION ALL SELECT 1 FROM delivery_receipt_custody WHERE outbox_id=? LIMIT 1`).get(outbox, outbox))
+            return 'accepted';
+        return this.db.prepare('SELECT 1 FROM delivery_operations WHERE outbox_id=? LIMIT 1').get(outbox) ? 'rejected' : 'not_attempted';
+    }
     /** Retain the full known result BEFORE the fallible main-journal checkpoint.
      * The memory copy survives local SQLite failures while this process is alive;
      * the independent insert journal also survives an interrupted UPDATE/reopen. */
@@ -289,7 +335,9 @@ export class MessageStore {
             this.db.prepare(`INSERT INTO delivery_local_obligations VALUES(?,1,?,?) ON CONFLICT(outbox_id)
         DO UPDATE SET failures=failures+1,reason=excluded.reason,updated_at=excluded.updated_at`).run(id, reason, Date.now());
             // Local persistence and unknown audit custody consume no platform retry budget.
-            this.db.prepare("UPDATE delivery_outbox SET status='pending',attempts=MAX(0,attempts-1),updated_at=? WHERE id=? AND status='delivering'").run(Date.now(), id);
+            this.db.prepare(`UPDATE delivery_outbox SET status='pending',
+        attempts=CASE WHEN status='delivering' THEN MAX(0,attempts-1) ELSE attempts END,updated_at=?
+        WHERE id=? AND status IN ('delivering','delivered')`).run(Date.now(), id);
             return this.db.prepare('SELECT failures FROM delivery_local_obligations WHERE outbox_id=?').get(id).failures;
         })();
     }
@@ -1157,6 +1205,8 @@ export class MessageStore {
         return !!row;
     }
     markDeliveredReply(botName, chatId, triggerMessageRowId, replyMessageId = '') {
+        if (!this.isOrdinaryInput(botName, chatId, triggerMessageRowId))
+            return;
         this.db.prepare(`
       INSERT OR IGNORE INTO delivered_replies (bot_name, chat_id, trigger_message_row_id, delivered_at, reply_message_id)
       VALUES (?, ?, ?, ?, ?)
@@ -1200,6 +1250,29 @@ export class MessageStore {
     `).all(botName, chatId, `${prefix}%`);
         return rows.map((row) => this.mapDelivery(row));
     }
+    bindDeliveryCompletionTriggers(bot, chat, key, ids) {
+        const row = this.getDeliveryByKey(bot, chat, key);
+        if (!row)
+            return;
+        const meta = JSON.parse(row.deliveryMetaJson || '{}');
+        meta.completionTriggerIds = [...new Set([...(meta.completionTriggerIds || []), ...ids])];
+        this.db.prepare('UPDATE delivery_outbox SET delivery_meta_json=? WHERE id=?').run(JSON.stringify(meta), row.id);
+    }
+    /** Include stable correction/supplement rows: the first accepted body alone
+     * cannot settle a logical final whose remaining attachments are unknown. */
+    getDeliveryDispatchOutcome(bot, chat, key) {
+        const root = this.getDeliveryByKey(bot, chat, key);
+        const rows = [...(root ? [root] : []), ...this.listDeliveriesByKeyPrefix(bot, chat, `${key}:`).filter(row => ['authoritative:', 'attachments:', 'recovery:'].some(kind => row.deliveryKey.startsWith(`${key}:${kind}`)))];
+        const outboxIds = rows.map(row => row.id);
+        if (!rows.length)
+            return { state: 'unknown', outboxIds };
+        if (rows.some(row => this.hasUnknownDeliveryOperation(row.id)))
+            return { state: 'unknown', outboxIds };
+        const confirmed = rows.every(row => row.status === 'delivered' &&
+            (!row.content.trim() || this.listDeliveryReceipts(row.id).some(r => r.stage === 'body')) &&
+            JSON.parse(row.attachmentsJson || '[]').every((_, i) => this.listDeliveryReceipts(row.id).some(r => r.stage === `attachment:${i}`)));
+        return { state: confirmed ? 'delivered' : rows.some(row => row.status === 'failed') ? 'failed' : 'pending', outboxIds };
+    }
     getPendingDeliveries(chatId, botName, maxCount = 20) {
         if (chatId && botName) {
             const rows = this.db.prepare(`
@@ -1351,9 +1424,10 @@ export class MessageStore {
     `).run(pending ? 1 : 0, Date.now(), id);
     }
     markDeliveryDelivered(id) {
-        this.db.prepare(`
-      UPDATE delivery_outbox SET status = 'delivered', updated_at = ? WHERE id = ?
-    `).run(Date.now(), id);
+        this.db.transaction(() => {
+            this.db.prepare(`UPDATE delivery_outbox SET status = 'delivered', updated_at = ? WHERE id = ?`).run(Date.now(), id);
+            this.db.prepare('DELETE FROM delivery_local_obligations WHERE outbox_id=?').run(id);
+        })();
     }
     markDeliveryFailed(id) {
         this.db.prepare(`
@@ -1437,8 +1511,12 @@ export class MessageStore {
         AND messages.id <= ?
         AND recalled_messages.message_id IS NULL
         AND message_sync.message_row_id IS NULL
+        -- A held insertion must not be replayed later as group catch-up simply
+        -- because acceptance removed its pending trigger. Custody is not sync.
+        AND NOT EXISTS (SELECT 1 FROM insertion_custody i WHERE i.bot_name=?
+          AND i.chat_id=messages.chat_id AND i.message_row_id=messages.id AND i.state!='ordinary')
       ORDER BY messages.timestamp ASC
-    `).all(botName, chatId, triggerRowId);
+    `).all(botName, chatId, triggerRowId, botName);
         return rows.map((r) => ({
             id: r.id,
             chatId: r.chat_id,
@@ -1451,7 +1529,7 @@ export class MessageStore {
         }));
     }
     markMessagesSynced(botName, chatId, messageRowIds, syncBatchId = '') {
-        const ids = Array.from(new Set(messageRowIds.filter((id) => Number.isFinite(id) && id > 0)));
+        const ids = Array.from(new Set(messageRowIds.filter((id) => Number.isFinite(id) && id > 0 && this.isOrdinaryInput(botName, chatId, id))));
         if (ids.length === 0)
             return;
         const now = Date.now();

package/dist/openclaw-client.d.ts

@@ -31,6 +31,10 @@ export declare class InactiveRunObservation extends Error {
 export declare class SupersededObservation extends Error {
     constructor(reason?: string);
 }
+/** Local observer only: the exact background result remains owned by durable recovery. */
+export declare class CollectorStalledError extends Error {
+    constructor();
+}
 export declare class AdmissionUnconfirmed extends Error {
     readonly submissionId: string;
     constructor(submissionId: string, cause?: unknown);
@@ -57,9 +61,14 @@ export declare class OpenClawClient {
     private config;
     private ws;
     private pending;
+    private admissionResponseHooks;
     private connected;
     private connectPromise;
     private agentEvents;
+    private eventProgressSizes;
+    private runEventReaders;
+    private runEventReservations;
+    private completedRunEventCustody;
     private reconnectDelay;
     private maxReconnectDelay;
     private shouldReconnect;
@@ -72,10 +81,12 @@ export declare class OpenClawClient {
      * `stream=item` mirrors when a runtime emits both representations. */
     private recentToolEventKeys;
     private privateInputToolCalls;
+    private publicToolCalls;
     private sessionSettlementCallbacks;
     private sessionMessageCallbacks;
     private progressCallbacks;
     private progressGenerations;
+    private progressRuns;
     /** Live collectReply fences per canonical session key. The most recent
      *  collector for a session owns the shared event bucket; a new batch (or a
      *  queue-custody revocation) fences stale ones synchronously so they cannot
@@ -134,7 +145,18 @@ export declare class OpenClawClient {
     bindRecoveryStore(store: MessageStore): void;
     private scheduleRecovery;
     private recoverExactRuns;
+    private runEventKey;
+    private retainRunEventCustody;
+    private retireCompletedRunEvents;
+    private isTerminalBufferedEvent;
+    /** Buffers are observation indexes, not raw tool-output/transcript caches.
+     * Presentation/evidence callbacks still see the already privacy-filtered wire
+     * payload. Keep only the fields collectReply actually consumes here. */
+    private projectBufferedEvent;
+    private progressEventBytes;
+    private enforceEventProgressBudget;
     private bufferEvent;
+    private dispatchBufferedEvents;
     constructor(config: OpenClawConfig);
     connect(): Promise<void>;
     private _doConnect;
@@ -146,11 +168,20 @@ export declare class OpenClawClient {
     private isInputRecord;
     private extractVisibleAssistantText;
     private isVerboseTranscriptEnabled;
+    private progressKey;
+    private progressForRun;
     private clearVerboseAssistantState;
-    /** Internal message tools carry private input, not assistant narration.
-     * Redact before buffering as well as progress callbacks (including failure
-     * summaries). Preserve tool identity/phase for activity and acceptance logic. */
+    private canonicalToolName;
+    /** Inspect supported public wrappers recursively, including JSON arguments.
+     * A wrapper containing any private coordination call has private results too;
+     * do not try to salvage arbitrary echoed result/error strings. */
+    private isPrivateCoordination;
+    private knownPublicWrapper;
+    /** Redact BEFORE event buffers, logging, observers, cards and verbose sinks.
+     * Call custody is session+run+id scoped, so item/command/result mirrors stay
+     * private even after the original wrapper arguments have disappeared. */
     private redactPrivateInputTool;
+    private redactPrivateTranscriptTools;
     /** Render protocol-4 structured tool args/results without `[object Object]`.
      * Prefer useful, non-secret fields and keep the fallback bounded. */
     private formatToolValue;
@@ -161,13 +192,11 @@ export declare class OpenClawClient {
     private handleProactiveSessionMessage;
     private scheduleReconnect;
     private rpc;
-    /**
-     * Collect agent reply by polling accumulated events.
-     * Matches by initial runId OR sessionKey to handle multi-turn tool calling
-     * where OpenClaw creates new runIds for each tool-call round.
-     * Existing event/anchor matching is retained. Foreground effective silence
-     * triggers read-only reconciliation, never a task-lifetime cutoff or draft final.
-     * Explicit terminal/error/disconnect paths keep their existing behavior.
+    /** Exact admitted-root observation with non-destructive event cursors.
+     * Gateway maps runtime continuations to its public client runId; an unrelated
+     * session lifecycle start is not lineage. Separate requester/task continuation
+     * lineage remains owned by handoffLinkedContinuation + exact root recovery.
+     * Effective silence prompts read-only reconciliation, never a lifetime cutoff.
      */
     private collectReply;
     /**
@@ -183,7 +212,6 @@ export declare class OpenClawClient {
     private formatTerminalRunError;
     private formatDurationSeconds;
     private isRecoverableAgentError;
-    private pickBestCollectedText;
     createSession(params: {
         key: string;
         model: string;