openclaw-lark-multi-agent 1.8.14 → 1.8.16

package/dist/feishu-bot.d.ts

@@ -1,6 +1,12 @@
 import { BotConfig } from "./config.js";
 import { OpenClawClient } from "./openclaw-client.js";
 import { MessageStore } from "./message-store.js";
+/** Observation deadline, never a claim that the underlying SDK was cancelled. */
+export declare class SendDeadlineError extends Error {
+    readonly chatId: string;
+    readonly limit: number;
+    constructor(chatId: string, limit: number);
+}
 /**
  * Manages a single Feishu bot instance.
  *
@@ -32,6 +38,9 @@ export declare class FeishuBot {
     /** Per-chat processQueue lock to avoid duplicate concurrent chat.send runs */
     private queueRuns;
     private queueOwners;
+    /** Monotone local batch epoch: an empty owner map must not hide an
+     * intervening admission/finish (ABA) from an asynchronous public lookup. */
+    private queueAdmissionEpoch;
     /** Per-chat serial send queue to guarantee message order */
     private sendQueue;
     /** Per-chat delayed runtime failure notifications, canceled if a real reply arrives. */
@@ -47,18 +56,21 @@ export declare class FeishuBot {
      * fails restore their durable fallback. Fired in processQueueInner's
      * failure arms; dropped at each new batch top and on queue exit. */
     private runFailureObservers;
-    /** Steered messages admitted into the CURRENT batch (per chat). Flipped to
-     * DONE when that batch completes successfully; cleared (unflipped) when the
-     * batch scope ends any other way. */
+    /** Ephemeral batch-scoped acceptance bookkeeping, not commitment evidence.
+     * Ending the batch only drops these handles; durable insertion custody stays
+     * accepted and must not inherit the root's DONE. */
     private admittedSteerAcks;
-    /** Identity token of the CURRENT queue owner per chat. Steer acks carry
-     *  the token of the batch that admitted them; a completion path only flips
-     *  acks of its OWN batch, so a superseded inner can never DONE a newer
-     *  batch's steered inputs (2026-10-16 audit B9). */
+    /** Identity token of the CURRENT queue owner per chat. Acceptance bookkeeping
+     * carries its batch token so late old cleanup never takes a newer batch's
+     * handles (2026-10-16 audit B9); neither token proves input commitment. */
     private queueRunTokens;
     /** Go / Go-Checker supervision controller (per-bot instance). */
     private readonly goDeliveryReceipts;
     private readonly goReceiptApis;
+    private readonly sendEffectLeases;
+    /** A deadline releases the chat queue, NOT this exact operation's ownership. */
+    private readonly inFlightDeliveryWork;
+    private assertSendEffectLease;
     private installGoReceiptCapture;
     private goController;
     /** Per-chat durable outbox retry timer. */
@@ -82,6 +94,7 @@ export declare class FeishuBot {
     private adminOpenId;
     private locale;
     private configPath?;
+    private queuedPresentations;
     private static allBots;
     /** Chats where this bot app has actually received an event in this process. */
     private static seenBotChats;
@@ -118,13 +131,27 @@ export declare class FeishuBot {
     static getByName(name: string): FeishuBot | undefined;
     static findByOpenId(openId: string): FeishuBot | undefined;
     private handleMessage;
+    /** Separate guarded-admission proof. Aggregate busy never becomes idle. */
+    private observedFollowupGuard;
+    /** A positive refusal must be durable AND explained to the sender. */
+    private retainChangedFollowup;
+    private explainUnconfirmedFollowup;
+    /** Keep each input's first observed leaf: a fresh arrival must not borrow
+     * an obsolete scheduler leaf from before it was received. */
+    private pinDispatchFollowupProof;
     /** With no local owner, the Gateway can still have externally admitted work.
      * Read public activity and pin its exact root before choosing insertion. Missing
      * identity is durable unbound custody, never a fabricated run or blind send. */
     private reconcileCurrentInputActivity;
+    /** An ingress reservation can outlive an ACK-window owner which finished
+     * before learning its runId. It is still never-attempted custody, not a
+     * licence to retarget/steer a successor. Require the same guarded proof and
+     * bounded observation with NO replacement local scheduler at every await. */
+    private reconcileRetainedFollowup;
     /** CAS includes the actual batch, not merely the queue Promise, and excludes
      * local admission/RPC windows even if the host briefly reports idle. */
     private reconcileDispatchCustody;
+    private presentation;
     private stopGeneration;
     private reactionChecks;
     private receiptReaction;
@@ -160,11 +187,10 @@ export declare class FeishuBot {
     private fireRunFailureObservers;
     private processQueue;
     /**
-     * Force-release a stuck queue owner after the gateway authoritatively
-     * reported the session idle (no active run). The zombie owner's deep waits
-     * can otherwise hold chat custody forever: completion events routed through
-     * the proactive path are invisible to them. Steer-fallback triggers are
-     * restored via the failure observers so their input drains normally.
+     * Retire only the local queue scheduler after positive idle, trusted yield,
+     * or bounded guarded-followup proof. Never stop Gateway execution or infer
+     * a terminal outcome. Exact result recovery/target custody remains durable;
+     * attempted-unknown and accepted insertion records never enter replay.
      */
     private forceExpireQueueOwner;
     private processQueueInner;
@@ -258,6 +284,12 @@ export declare class FeishuBot {
      * No host proactive-send assumption, no fake platform receipt. */
     private deliverGoExecutorResult;
     private insertionNoticeCurrent;
+    private deliveryDeadlineReason;
+    /** Durable local obligation, separate from the platform retry budget. */
+    private retainLocalDelivery;
+    private isDeliverySettlementRevoked;
+    /** Also runs for a late accepted SDK receipt, without replaying the final. */
+    private settleConfirmedDelivery;
     private dispatchPendingDeliveries;
     private hasFreeModeBot;
     private mentionedBotNames;
@@ -277,6 +309,9 @@ export declare class FeishuBot {
     private buildLiveStatusCard;
     /** Minimal escaping so activity text does not break card markdown. */
     private escapeCardText;
+    /** Keep receipt ownership below sendOrdered's Promise.race. Nothing here
+     * changes business-message/outbox ordering or retries. */
+    private liveStatusCallbacks;
     private sendLiveStatusCard;
     private replyLiveStatusCard;
     private patchLiveStatusCard;
@@ -358,8 +393,10 @@ export declare class FeishuBot {
      * The chain must never wedge: a single hung Feishu call used to block every
      * later send in that chat forever (live-status patches fire per tool event),
      * which froze cards and stranded /stop confirmations. Each link is therefore
-     * raced against a deadline, so a stuck send is abandoned and ordering resumes.
-     * Prefer a larger OPENCLAW_LARK_MULTI_AGENT_SEND_TIMEOUT_MS on slow links.
+     * raced against an observation deadline. The queue advances, but an already
+     * attempted SDK request is NOT cancelled and can settle late. Its outbox keeps
+     * custody; the expired lease forbids any subsequent new SDK effect. This is
+     * not a strict platform-order guarantee for uncancellable in-flight requests.
      */
     private sendOrdered;
     /** One send link: resolve with fn(), or reject at the deadline so the chain advances. */