openclaw-lark-multi-agent 1.8.19 → 1.8.21

package/dist/go-controller.d.ts

@@ -75,6 +75,8 @@ export type GoClient = {
 export type GoControllerDeps = {
     botName: string;
     fallbackModel: string;
+    /** OpenClaw profile that owns this bot's sessions (default "main"). */
+    profile?: string;
     store: import("./message-store.js").MessageStore;
     client: GoClient;
     /** Executor session key for a chat (e.g. lma-<bot>-<chatId>). */

package/dist/go-controller.js

@@ -1,5 +1,14 @@
 /** Independent LMA supervision. MessageStore owns objective, criteria and completion. */
 import { goSnapshotBlocked } from "./go-runtime-gate.js";
+/** Logical (profile-free) part of a session key. */
+const withoutAgentPrefix = (key) => key.replace(/^agent:[^:]+:/, '');
+/** Physical session key for a logical executor key under this bot's profile. */
+const physicalKey = (key, profile) => {
+    if (/^agent:[^:]+:/.test(key))
+        return key;
+    const agent = String(profile || "main").trim() || "main";
+    return `agent:${agent}:${key}`;
+};
 const CHECK_DELAY_MS = Number(process.env.OPENCLAW_LARK_MULTI_AGENT_GO_CHECK_DELAY_MS || 20000);
 const CHECKER_TIMEOUT_MS = Number(process.env.OPENCLAW_LARK_MULTI_AGENT_GO_CHECKER_TIMEOUT_MS || 10 * 60 * 1000);
 const MAX_CONTINUES = Number(process.env.OPENCLAW_LARK_MULTI_AGENT_GO_MAX_CONTINUES || 10);
@@ -120,7 +129,7 @@ export class GoController {
             const executor = sessionKey === job.executorSessionKey;
             const result = executor ? await client.collectGoExecutorRun({ runId: receipt.runId, sessionKey, sessionId: expectedSessionId, timeoutMs: CHECKER_TIMEOUT_MS }) : null;
             if (result && (result.runId !== receipt.runId || result.sessionId !== expectedSessionId ||
-                (result.sessionKey !== sessionKey && result.sessionKey !== `agent:main:${sessionKey}`)))
+                (result.sessionKey !== sessionKey && result.sessionKey !== physicalKey(sessionKey, this.d.profile))))
                 throw new Error("Executor result identity mismatch");
             const text = result ? result.text : await client.collectGoRun({ runId: receipt.runId, sessionKey, sessionId: expectedSessionId, timeoutMs: CHECKER_TIMEOUT_MS });
             this.d.store.recordGoRunResult(jobId, actionKey, { state: "complete", runId: receipt.runId, text, ...(result ? { executorResult: result } : {}) });
@@ -204,7 +213,10 @@ export class GoController {
             await this.d.reply(messageId, `⚠️ 当前已有活动 Go #${existing.id}：\n目标：${existing.goal.slice(0, 200)}\n如需更换目标，请先 /go stop。`);
             return;
         }
-        const executorKey = this.d.executorSessionKeyFor(chatId);
+        // The Go supervision path talks to the Gateway directly, so it uses the
+        // PHYSICAL key throughout (profile included) exactly like the executor
+        // session itself.
+        const executorKey = physicalKey(this.d.executorSessionKeyFor(chatId), this.d.profile);
         if (await this.safetyUnavailable(executorKey)) {
             await this.d.reply(messageId, "❌ Go 未启动：当前运行时尚未验证 Checker 工具隔离、精确子孙任务/投递门禁及条件发送。不能仅凭提示词安全开启自动监督。独立模式无需原生 Goal；普通聊天不受影响。");
             return;
@@ -230,7 +242,10 @@ export class GoController {
             || (typeof session.model === "string" && session.model
                 ? (typeof session.modelProvider === "string" && session.modelProvider && !session.model.includes("/") ? `${session.modelProvider}/${session.model}` : session.model)
                 : this.d.fallbackModel);
-        const checkerKey = `${executorKey.replace(/^lma-/, "lma-go-")}-${crypto.randomUUID()}`;
+        // The checker session NAME stays profile-free (lma- -> lma-go-), exactly like
+        // every other logical key LMA stores. It is addressed under the bot's
+        // profile only when it is actually handed to the Gateway.
+        const checkerKey = physicalKey(`${withoutAgentPrefix(executorKey).replace(/^lma-/, "lma-go-")}-${crypto.randomUUID()}`, this.d.profile);
         try {
             await this.d.client.createSession({ key: checkerKey, model: resolvedModel, label: `Go Checker: ${this.d.botName} ${chatId.slice(-6)}` });
         }
@@ -349,7 +364,7 @@ export class GoController {
                     if (saved?.state !== "complete") {
                         const result = await this.d.client.readGoExecutorRunResult?.({ ...send, runId: receipt.runId });
                         if (!result || result.runId !== receipt.runId || result.sessionId !== job.executorSessionId ||
-                            ![job.executorSessionKey, `agent:main:${job.executorSessionKey}`].includes(result.sessionKey)) {
+                            ![job.executorSessionKey, physicalKey(job.executorSessionKey, this.d.profile)].includes(result.sessionKey)) {
                             this.d.store.recordGoRunResult(job.id, send.actionKey, { state: "unknown", runId: receipt.runId });
                             continue;
                         }
@@ -510,16 +525,17 @@ export class GoController {
     // ---------------- check cycle ----------------
     async executorBusy(chatId, job) {
         try {
-            if (await this.safetyUnavailable(job.executorSessionKey))
+            const executorPhysicalKey = job.executorSessionKey;
+            if (await this.safetyUnavailable(executorPhysicalKey))
                 return "运行时安全能力未验证";
-            const info = await (this.d.client.getGoSessionInfo?.bind(this.d.client) ?? this.d.client.getSessionInfo.bind(this.d.client))(job.executorSessionKey);
+            const info = await (this.d.client.getGoSessionInfo?.bind(this.d.client) ?? this.d.client.getSessionInfo.bind(this.d.client))(executorPhysicalKey);
             if (info?.session?.sessionId !== job.executorSessionId || info?.session?.archived)
                 return "执行会话代际已改变或归档";
             const identity = this.d.store.getGoNativeIdentity(job.id);
             if (!identity)
                 return "Missing independent run binding";
-            const snapshot = await this.d.client.readGoRuntimeSnapshot(job.executorSessionKey, job.executorSessionId);
-            const blocked = goSnapshotBlocked(snapshot, { sessionKey: job.executorSessionKey.startsWith("agent:") ? job.executorSessionKey : `agent:main:${job.executorSessionKey}`, sessionId: job.executorSessionId,
+            const snapshot = await this.d.client.readGoRuntimeSnapshot(executorPhysicalKey, job.executorSessionId);
+            const blocked = goSnapshotBlocked(snapshot, { sessionKey: executorPhysicalKey, sessionId: job.executorSessionId,
                 goalId: identity.nativeGoalId, goalRevision: identity.goalRevision, executorRunIds: identity.executorRunIds });
             if (blocked) {
                 if (blocked === "identity/version changed")

package/dist/input-status-display.d.ts

@@ -0,0 +1,45 @@
+/** Display-only references. Never read by admission, routing, reactions or replay. */
+export type InputHintKind = 'received' | 'queued' | 'submitting' | 'append_queued' | 'accepted' | 'processing' | 'waiting' | 'paused' | 'unconfirmed' | 'delivery_pending' | 'partial' | 'completed' | 'no_reply' | 'replied' | 'failed' | 'blocked';
+export type InputHint = {
+    rowId?: number;
+    messageId?: string;
+    kind: InputHintKind;
+    detail?: string;
+    at: number;
+    preview?: string;
+    previewSource?: 'visible';
+};
+export type InputStatusContext = {
+    botName?: string;
+    appId?: string;
+    chatId?: string;
+    stopEpoch?: number;
+    items: InputHint[];
+    note?: InputHint;
+};
+export type InputHintChange = {
+    kind: InputHintKind;
+    detail?: string;
+    ids?: number[];
+    at: number;
+};
+export type InputDisplayLimits = {
+    preview: number;
+    members: number;
+    activity: number;
+};
+export declare const LIVE_CARD_BYTES = 30000;
+export declare const INPUT_DISPLAY_LIMITS: InputDisplayLimits[];
+export declare function hintLabel(kind: InputHintKind, en: boolean): string;
+export declare function hintDetail(kind: InputHintKind, en: boolean): string;
+export declare function displayClip(value: string, max: number): string;
+/** Explicit visible human ingress: escaping/clipping only. Never infer media or
+ * generated prompts from text that merely looks like a system annotation. */
+export declare function visibleInputPreview(content: string, max: number, en: boolean): string;
+/** Legacy stored/hydrated body fallback; explicit visible ingress never uses it. */
+export declare function inputPreview(content: string, max: number, en: boolean): string;
+/** Use the existing markdown component as inert text, not as a user-authored
+ * card/mention/link language. Entity introducers/platform tags are neutralized
+ * before markdown punctuation is escaped. No media or URL is fetched. */
+export declare function inertInputText(value: string): string;
+export declare function selectInputHints(items: InputHint[], max: number): InputHint[];

package/dist/input-status-display.js

@@ -0,0 +1,67 @@
+export const LIVE_CARD_BYTES = 30_000;
+export const INPUT_DISPLAY_LIMITS = [
+    { preview: 160, members: 12, activity: 180 }, { preview: 96, members: 10, activity: 120 },
+    { preview: 48, members: 6, activity: 80 }, { preview: 20, members: 2, activity: 24 },
+];
+const labels = {
+    received: ['📥 已收件', '📥 Received'], queued: ['⏳ 本地排队', '⏳ Queued'], submitting: ['📨 提交待确认', '📨 Submission pending'],
+    append_queued: ['⏳ 追加排队', '⏳ Append queued'], accepted: ['✅ 已接收', '✅ Accepted'], processing: ['⚙️ 处理中', '⚙️ Processing'],
+    waiting: ['⏳ 等待后续', '⏳ Waiting'], paused: ['⏸️ 等待暂停', '⏸️ Wait paused'], unconfirmed: ['❔ 结果待确认', '❔ Result unconfirmed'],
+    delivery_pending: ['📨 投递待确认', '📨 Delivery pending'], partial: ['⚠️ 部分确认', '⚠️ Partial'], completed: ['✅ 本轮结束', '✅ Round ended'],
+    no_reply: ['💤 无正文', '💤 No content'], replied: ['💬 关联已回复', '💬 Linked reply'], failed: ['⚠️ 执行中断', '⚠️ Interrupted'], blocked: ['⛔ 尚未提交', '⛔ Not submitted'],
+};
+const details = {
+    received: ['尚未确认 Gateway 接收', 'Gateway acceptance unconfirmed'], queued: ['等待提交确认', 'Waiting for admission'],
+    submitting: ['已开始提交；Gateway 接收尚未确认', 'Submission started; Gateway acceptance unconfirmed'],
+    append_queued: ['实际接收方、提交及处理结果未确认', 'Actual receiver, commitment and result unconfirmed'],
+    accepted: ['Gateway 已接收；等待执行活动', 'Gateway accepted; waiting for activity'],
+    partial: ['root 结果仅覆盖普通输入；追加输入提交及处理仍未确认，不重放', 'Root result covers ordinary inputs only; appended commitment/result remain unconfirmed, no replay'],
+    waiting: ['保留后续结果观察；不自动重发输入', 'Continuing result observation; no input replay'],
+    paused: ['仅暂停等待；未因此停止任务或重发输入', 'Waiting paused only; no task stop or input replay'],
+    unconfirmed: ['最终结果尚未确认', 'Final result unconfirmed'], delivery_pending: ['平台投递回执尚未确认；不重复发送', 'Platform receipt unconfirmed; no duplicate send'],
+    completed: ['本轮结果仅覆盖实际普通输入', 'This round covers only its ordinary inputs'],
+    no_reply: ['本轮未产生用户可见正文', 'No user-visible content this round'],
+    replied: ['关联轮次回复已送达；不据此确认追加输入提交', 'Linked run reply delivered; input commitment remains separate'],
+    failed: ['本轮执行中断；不据此归因用户停止', 'Execution interrupted; no user-stop attribution'],
+    blocked: ['保留原输入；不迁移或自动重发', 'Input retained; no migration or automatic replay'],
+};
+export function hintLabel(kind, en) { return `【${(labels[kind] || labels.unconfirmed)[en ? 1 : 0]}】`; }
+export function hintDetail(kind, en) { return details[kind]?.[en ? 1 : 0] || ''; }
+export function displayClip(value, max) {
+    // Code-point safe, including malformed isolated surrogates; no split emoji
+    // surrogate, JSON fragment or half a UTF-8 sequence is emitted.
+    const points = Array.from(String(value), ch => { const n = ch.codePointAt(0); return n >= 0xd800 && n <= 0xdfff ? '�' : ch; });
+    return points.length > max ? points.slice(0, Math.max(0, max - 1)).join('') + '…' : points.join('');
+}
+/** Explicit visible human ingress: escaping/clipping only. Never infer media or
+ * generated prompts from text that merely looks like a system annotation. */
+export function visibleInputPreview(content, max, en) {
+    const text = String(content || '').replace(/\s+/g, ' ').trim();
+    return displayClip(text || (en ? '[Message body unavailable]' : '[消息正文暂不可用]'), max);
+}
+/** Legacy stored/hydrated body fallback; explicit visible ingress never uses it. */
+export function inputPreview(content, max, en) {
+    const filename = (value) => value.trim().split(/[\\/]/).at(-1) || (en ? 'file' : '文件');
+    const raw = String(content || '').trim();
+    if (raw === '请回复上面最近一条用户消息。')
+        return en ? '[Message body unavailable]' : '[消息正文暂不可用]';
+    const text = raw
+        .replace(/\n\n\[飞书文档已由 LMA 用机器人权限读取并转换为 Markdown 附件，OpenClaw 可直接读取附件内容。\][\s\S]*$/, '')
+        .replace(/\[(?:Image|Audio|Sticker)(?::[^\]]*)?\]/gi, match => /^\[Image/i.test(match) ? (en ? '[Image]' : '[图片]') : /^\[Audio/i.test(match) ? (en ? '[Audio]' : '[语音]') : (en ? '[Sticker]' : '[贴纸]'))
+        .replace(/\[File:\s*([^\]]*)\]/gi, (_all, value) => `[${en ? 'File' : '文件'}: ${filename(value.split(/\s+->\s+|\s+- download failed/)[0])}]`)
+        .replace(/\[(?:FeishuDoc|Attachment):[^\]]*\]/gi, en ? '[Document]' : '[文档]')
+        .replace(/\s+/g, ' ').trim();
+    return displayClip(text || (en ? '[Message body unavailable]' : '[消息正文暂不可用]'), max);
+}
+/** Use the existing markdown component as inert text, not as a user-authored
+ * card/mention/link language. Entity introducers/platform tags are neutralized
+ * before markdown punctuation is escaped. No media or URL is fetched. */
+export function inertInputText(value) {
+    return value.replace(/&/g, '＆').replace(/</g, '＜').replace(/>/g, '＞').replace(/[\\`*_{}\[\]()#+!|~]/g, '\\$&');
+}
+export function selectInputHints(items, max) {
+    if (items.length <= max)
+        return items;
+    const first = Math.max(1, Math.floor(max / 3));
+    return [...items.slice(0, first), ...items.slice(-(max - first))];
+}

package/dist/live-status.d.ts

@@ -1,3 +1,4 @@
+import type { InputHintChange, InputHintKind, InputStatusContext } from "./input-status-display.js";
 import type { ProgressEvent } from "./openclaw-client";
 /** One activity line shown in the card content area. */
 export type LiveStatusLine = {
@@ -5,9 +6,13 @@ export type LiveStatusLine = {
     text: string;
     /** Relative time (seconds since run start) when this line was produced. */
     at: number;
+    /** Delivery hint text is rendered through exact input references, not activity markdown. */
+    inputHint?: boolean;
 };
 /** Structured snapshot the renderer turns into a Feishu interactive card. */
 export type LiveStatusView = {
+    /** UI-only source references; bodies are resolved at the actual card boundary. */
+    inputStatus?: InputStatusContext;
     /** Card title, e.g. "Claude 正在执行" / "✅ Claude 已完成". */
     title: string;
     /** Activity lines (oldest first); when finished this holds a summary instead. */
@@ -35,6 +40,7 @@ export type LiveStatusFinalMeta = {
     thinkingLevel?: string;
     locale: "zh" | "en";
     noReply?: boolean;
+    inputStatus?: InputStatusContext;
 };
 /** Optional external presentation owner (e.g. the durable outbox). A local
  * execution outcome is NOT a platform delivery receipt. Once handed off, late
@@ -61,6 +67,8 @@ export declare class LiveStatusEffectRejectedError extends Error {
 export declare class LiveStatusEffectSuppressedError extends Error {
 }
 export type LiveStatusCallbacks = {
+    /** UI-only update/read; cannot grant admission, progress or input completion. */
+    inputStatus?: (change?: InputHintChange) => InputStatusContext | undefined;
     /** Create the status card; returns the new message id. */
     create: (view: LiveStatusView, effect: LiveStatusEffect<string | undefined>) => Promise<string | undefined>;
     /** Patch the existing status card. Reject with LiveStatusEffectRejectedError
@@ -73,6 +81,7 @@ export type LiveStatusCallbacks = {
     unconfirmedInputs?: (outcome: "done" | "failed") => {
         title: string;
         detail: string;
+        ordinaryIds?: number[];
     } | undefined;
 };
 export type LiveStatusOptions = {
@@ -116,6 +125,7 @@ export declare class LiveStatusController {
     private generation;
     /** Frozen/terminal presentation wins over every older progress snapshot. */
     private pinnedView?;
+    private pinnedInputGuard?;
     private terminalOwner?;
     private pendingEdit?;
     private editPump?;
@@ -136,17 +146,19 @@ export declare class LiveStatusController {
     private toolCallCount;
     /** True when finished via noReply(): show a "no content" summary. */
     private noReplyResult;
+    private fallbackInputHint?;
     constructor(callbacks: LiveStatusCallbacks, opts: LiveStatusOptions);
     /** Receipt is durable locally, NOT Gateway admission. */
-    received(detail: string): void;
+    received(detail: string, ids?: number[], kind?: InputHintKind): void;
     /** A proven never-attempted ordinary recovery may reuse its queued card.
      * Merely observing an expected root never calls this method. */
     resumeQueued(): void;
     /** Enqueue/local receipt remains waiting, not actual-owner/model evidence.
      * Keep one latest pinned view while allowing another input to coalesce. */
-    showInputWaiting(detail: string, title?: string): Promise<void>;
+    showInputWaiting(detail: string, title?: string, ids?: number[], kind?: InputHintKind): Promise<void>;
     /** Only the exact ACK owner calls this; admission is not model execution. */
     admitted(successor?: boolean): Promise<void>;
+    submitting(): void;
     get id(): string | undefined;
     start(initialDetail?: string): void;
     setMetadata(model?: string, thinkingLevel?: string): void;
@@ -156,7 +168,7 @@ export declare class LiveStatusController {
     showWaitingForResult(detail: string): Promise<void>;
     /** Release only local observation of a now-idle session, without claiming
      * the previous task succeeded or was aborted. Normal progress is unchanged. */
-    pauseForUnconfirmedResult(detail: string, title?: string): Promise<void>;
+    pauseForUnconfirmedResult(detail: string, title?: string, kind?: InputHintKind): Promise<void>;
     /** Close only the display after the associated run's original-chat reply is
      * platform-confirmed. This deliberately does not claim inserted-input commit. */
     linkedReplyDelivered(deliveredAt: number, preserveReplyPayload?: boolean, retryZeroEffect?: boolean): Promise<void>;
@@ -181,6 +193,10 @@ export declare class LiveStatusController {
      */
     noReply(): Promise<void>;
     dispose(): void;
+    /** Refresh only the existing UI-owned card after recall. Never create a
+     * card, restart ticking, change phase or invoke a business terminal owner.
+     * Unknown effects remain fenced; a later known receipt retains this guard. */
+    redactRecalledInput(effectGuard: () => boolean): Promise<void>;
     private pinView;
     private finishView;
     private reconcilePinnedView;
@@ -194,6 +210,9 @@ export declare class LiveStatusController {
     private appendText;
     private normalizeText;
     private clip;
+    private terminalInputHint;
+    private updateInputHint;
+    private inputSnapshot;
     private pushLine;
     private stopTimers;
     private ensureCreatedNow;

package/dist/live-status.js

@@ -47,6 +47,7 @@ export class LiveStatusController {
     generation = 0;
     /** Frozen/terminal presentation wins over every older progress snapshot. */
     pinnedView;
+    pinnedInputGuard;
     terminalOwner;
     pendingEdit;
     editPump;
@@ -67,6 +68,7 @@ export class LiveStatusController {
     toolCallCount = 0;
     /** True when finished via noReply(): show a "no content" summary. */
     noReplyResult = false;
+    fallbackInputHint;
     constructor(callbacks, opts) {
         this.callbacks = callbacks;
         this.opts = opts;
@@ -84,11 +86,13 @@ export class LiveStatusController {
                 this.noReplyResult = restored.view.noReply;
                 this.waitingForResult = restored.view.phase === "waiting";
                 this.updatesFrozen = this.waitingForResult;
-                if (restored.view.state === "replied") {
+                if (['done', 'failed', 'replied'].includes(restored.view.state)) {
                     this.finalized = true;
                     this.terminalOutcome = true;
                     this.updatesFrozen = true;
                 }
+                if (this.waitingForResult || this.terminalOutcome)
+                    this.pinnedView = restored.view;
             }
             // Attempted/unknown create survives process loss as a no-create fence.
             if (restored.blockCreate && !this.messageId)
@@ -96,10 +100,11 @@ export class LiveStatusController {
         }
     }
     /** Receipt is durable locally, NOT Gateway admission. */
-    received(detail) {
+    received(detail, ids, kind = "received") {
         if (this.finalized || this.disposed)
             return;
-        this.pushLine("lifecycle", detail);
+        this.updateInputHint(kind, detail, ids);
+        this.pushLine("lifecycle", detail, true);
         this.callbacks.desired?.(this.buildView());
         void this.safeEdit(this.buildView());
     }
@@ -113,6 +118,7 @@ export class LiveStatusController {
         this.waitingForResult = false;
         this.waitingCreateAllowed = false;
         this.state = "queued";
+        this.updateInputHint("queued");
         this.generation++;
         this.pinnedView = undefined;
         this.pendingEdit = undefined;
@@ -126,13 +132,14 @@ export class LiveStatusController {
     }
     /** Enqueue/local receipt remains waiting, not actual-owner/model evidence.
      * Keep one latest pinned view while allowing another input to coalesce. */
-    async showInputWaiting(detail, title) {
+    async showInputWaiting(detail, title, ids, kind = "waiting") {
         if (this.disposed || this.terminalOutcome)
             return;
         this.updatesFrozen = true;
         this.waitingForResult = true;
         this.waitingCreateAllowed = !this.messageId && !this.disabled;
-        this.pushLine("lifecycle", detail);
+        this.updateInputHint(kind, detail, ids);
+        this.pushLine("lifecycle", detail, true);
         this.stopTimers();
         const view = this.buildView();
         if (title)
@@ -152,10 +159,18 @@ export class LiveStatusController {
             return;
         this.waitingForResult = false;
         this.state = "admitted";
-        this.pushLine("lifecycle", this.opts.locale === "en" ? "Gateway accepted; waiting for activity" : "Gateway 已接收，等待执行活动");
+        this.updateInputHint("accepted");
+        this.pushLine("lifecycle", this.opts.locale === "en" ? "Gateway accepted; waiting for activity" : "Gateway 已接收，等待执行活动", true);
         this.callbacks.desired?.(this.buildView());
         await this.safeEdit(this.buildView());
     }
+    submitting() {
+        if (this.finalized || this.disposed)
+            return;
+        this.updateInputHint("submitting");
+        this.callbacks.desired?.(this.buildView());
+        void this.safeEdit(this.buildView());
+    }
     get id() { return this.messageId; }
     start(initialDetail) {
         if (this.createSuppressed) {
@@ -236,6 +251,7 @@ export class LiveStatusController {
         }
         this.waitingForResult = false;
         this.state = "running";
+        this.updateInputHint("processing");
         this.callbacks.desired?.(this.buildView());
         await this.ensureCreatedNow();
         await this.safeEdit(this.buildView());
@@ -247,16 +263,18 @@ export class LiveStatusController {
             return;
         this.updatesFrozen = true;
         this.waitingForResult = true;
-        this.pushLine("lifecycle", detail);
+        this.updateInputHint("waiting", detail);
+        this.pushLine("lifecycle", detail, true);
         this.stopTimers();
         await this.finishView(this.buildView());
     }
     /** Release only local observation of a now-idle session, without claiming
      * the previous task succeeded or was aborted. Normal progress is unchanged. */
-    async pauseForUnconfirmedResult(detail, title) {
+    async pauseForUnconfirmedResult(detail, title, kind = "unconfirmed") {
         if (this.finalized)
             return;
-        this.pushLine("lifecycle", detail);
+        this.updateInputHint(kind, detail);
+        this.pushLine("lifecycle", detail, true);
         this.waitingForResult = true;
         this.finalized = true;
         this.stopTimers();
@@ -271,6 +289,7 @@ export class LiveStatusController {
         if (this.disposed || this.terminalOutcome && !safeRetry || !Number.isFinite(deliveredAt) || deliveredAt < this.startedAt)
             return;
         this.state = "replied";
+        this.updateInputHint("replied");
         this.waitingForResult = false;
         this.updatesFrozen = true;
         this.finalized = true;
@@ -294,9 +313,9 @@ export class LiveStatusController {
     async complete() {
         if (this.disposed || this.terminalOutcome)
             return;
-        const pending = this.callbacks.unconfirmedInputs?.("done");
+        const pending = this.terminalInputHint("completed", "done");
         if (pending) {
-            await this.showInputWaiting(pending.detail, pending.title);
+            await this.showInputWaiting(pending.detail, pending.title, [], pending.ordinaryIds?.length ? "partial" : "queued");
             return;
         }
         this.terminalOutcome = true;
@@ -317,9 +336,9 @@ export class LiveStatusController {
     async prepareTerminalDelivery(noReply = false, owner) {
         if (this.disposed || (this.terminalOutcome && this.state !== "done"))
             return undefined;
-        const pending = this.callbacks.unconfirmedInputs?.("done");
+        const pending = this.terminalInputHint(noReply ? "no_reply" : "delivery_pending", "done");
         if (pending) {
-            await this.showInputWaiting(pending.detail, pending.title);
+            await this.showInputWaiting(pending.detail, pending.title, [], pending.ordinaryIds?.length ? "partial" : "queued");
             return undefined;
         }
         if (owner) {
@@ -350,6 +369,7 @@ export class LiveStatusController {
             thinkingLevel: this.opts.thinkingLevel,
             locale: this.opts.locale === "en" ? "en" : "zh",
             noReply: this.noReplyResult,
+            inputStatus: this.inputSnapshot(),
         };
     }
     async prepareFinalDelivery(owner) {
@@ -358,9 +378,9 @@ export class LiveStatusController {
     async fail() {
         if (this.disposed || this.terminalOutcome)
             return;
-        const pending = this.callbacks.unconfirmedInputs?.("failed");
+        const pending = this.terminalInputHint("failed", "failed");
         if (pending) {
-            await this.showInputWaiting(pending.detail, pending.title);
+            await this.showInputWaiting(pending.detail, pending.title, [], pending.ordinaryIds?.length ? "partial" : "queued");
             return;
         }
         this.terminalOutcome = true;
@@ -377,9 +397,9 @@ export class LiveStatusController {
     async noReply() {
         if (this.disposed || this.terminalOutcome)
             return;
-        const pending = this.callbacks.unconfirmedInputs?.("done");
+        const pending = this.terminalInputHint("no_reply", "done");
         if (pending) {
-            await this.showInputWaiting(pending.detail, pending.title);
+            await this.showInputWaiting(pending.detail, pending.title, [], pending.ordinaryIds?.length ? "partial" : "queued");
             return;
         }
         this.terminalOutcome = true;
@@ -396,7 +416,26 @@ export class LiveStatusController {
         this.pendingEdit = undefined;
         this.stopTimers();
     }
-    pinView(view) {
+    /** Refresh only the existing UI-owned card after recall. Never create a
+     * card, restart ticking, change phase or invoke a business terminal owner.
+     * Unknown effects remain fenced; a later known receipt retains this guard. */
+    async redactRecalledInput(effectGuard) {
+        if (this.disposed)
+            return;
+        this.lines = this.lines.filter(line => line.kind !== 'steer');
+        const base = this.pinnedView || this.buildView();
+        const view = { ...base, lines: base.lines.filter(line => line.kind !== 'steer'), inputStatus: this.inputSnapshot() };
+        if (this.terminalOwner) {
+            this.callbacks.desired?.(view);
+            return;
+        }
+        this.pinView(view, effectGuard);
+        if (!this.messageId || this.blockedEdits || this.unknownEdits.size || !effectGuard())
+            return;
+        await this.queueEdit(view, true, true, effectGuard);
+    }
+    pinView(view, effectGuard) {
+        this.pinnedInputGuard = effectGuard;
         this.generation++;
         this.callbacks.desired?.(view);
         this.pinnedView = view;
@@ -414,7 +453,7 @@ export class LiveStatusController {
         if (!this.pinnedView || this.disposed)
             return;
         if (!this.terminalOwner) {
-            await this.queueEdit(this.pinnedView, true, force);
+            await this.queueEdit(this.pinnedView, true, force, this.pinnedInputGuard);
             return;
         }
         const meta = this.finalMeta();
@@ -452,7 +491,35 @@ export class LiveStatusController {
         const maxChars = this.opts.maxChars ?? DEFAULT_MAX_CHARS;
         return text.length > maxChars ? `${text.slice(0, Math.max(0, maxChars - 1))}\u2026` : text;
     }
-    pushLine(kind, text) {
+    terminalInputHint(kind, outcome) {
+        const pending = this.callbacks.unconfirmedInputs?.(outcome);
+        // Existing custody decides membership FIRST. Presentation never invents
+        // an admitted run or upgrades an unconfirmed/appended input's outcome.
+        if (!pending)
+            this.updateInputHint(kind);
+        else if (pending.ordinaryIds?.length)
+            this.updateInputHint(kind, undefined, pending.ordinaryIds);
+        return pending;
+    }
+    updateInputHint(kind, detail, ids) {
+        const at = Math.max(0, Math.floor((Date.now() - this.startedAt) / 1000));
+        this.fallbackInputHint = { kind, detail, at };
+        try {
+            this.callbacks.inputStatus?.({ kind, detail, ids, at });
+        }
+        catch (err) {
+            this.callbacks.warn?.("input display checkpoint unavailable", err);
+        }
+    }
+    inputSnapshot() {
+        try {
+            return this.callbacks.inputStatus?.() || (this.fallbackInputHint ? { items: [this.fallbackInputHint] } : undefined);
+        }
+        catch {
+            return { items: [{ kind: "unconfirmed", at: 0 }] };
+        }
+    }
+    pushLine(kind, text, inputHint = false) {
         const clean = this.normalizeText(text);
         if (!clean)
             return;
@@ -462,7 +529,7 @@ export class LiveStatusController {
         if (last && last.kind === kind && last.text === clipped)
             return;
         const at = Math.max(0, Math.floor((Date.now() - this.startedAt) / 1000));
-        this.lines.push({ kind, text: clipped, at });
+        this.lines.push({ kind, text: clipped, at, ...(inputHint ? { inputHint: true } : {}) });
         const limit = this.opts.historySize ?? DEFAULT_HISTORY;
         if (this.lines.length > limit)
             this.lines = this.lines.slice(this.lines.length - limit);
@@ -559,7 +626,7 @@ export class LiveStatusController {
         await this.queueEdit(view, false);
     }
     /** One flight + one latest pending snapshot, regardless of tick/event rate. */
-    queueEdit(view, priority, force = false) {
+    queueEdit(view, priority, force = false, effectGuard) {
         this.callbacks.desired?.(view);
         if (this.blockedEdits)
             return Promise.resolve();
@@ -568,7 +635,7 @@ export class LiveStatusController {
             return Promise.resolve();
         if (!priority)
             this.generation++;
-        this.pendingEdit = { view, generation: this.generation, priority, force, started: false, settled: false, accepted: false };
+        this.pendingEdit = { view, generation: this.generation, priority, force, effectGuard, started: false, settled: false, accepted: false };
         return this.flushEdits();
     }
     canRunPendingEdit() {
@@ -628,7 +695,7 @@ export class LiveStatusController {
         };
         const effect = {
             run: async (send) => {
-                if (!current()) {
+                if (!current() || request.effectGuard && !request.effectGuard()) {
                     request.settled = true;
                     return;
                 }
@@ -689,7 +756,7 @@ export class LiveStatusController {
     /** Dedupe key includes elapsed so the footer timer ticks even without new
      *  activity, while identical content within the same second is still skipped. */
     signature(view) {
-        return `${view.state}|${view.title}|${view.elapsed}|${view.lines.map((l) => `${l.kind}@${l.at}:${l.text}`).join("|")}`;
+        return `${view.state}|${view.title}|${view.elapsed}|${JSON.stringify(view.inputStatus || null)}|${view.lines.map((l) => `${l.kind}@${l.at}:${l.text}`).join("|")}`;
     }
     isNoReplyText(text) {
         return text.trim().toUpperCase() === "NO_REPLY";
@@ -741,6 +808,7 @@ export class LiveStatusController {
         return {
             title,
             lines,
+            inputStatus: this.inputSnapshot(),
             elapsed: this.formatElapsed(),
             model: this.opts.model,
             thinkingLevel: this.opts.thinkingLevel,