sintbot 1.3.0 → 1.4.1

package/src/core/c2persiststate.js

@@ -145,13 +145,14 @@ function turnLane(raw) {
 function terminalLane(raw) {
   fields(raw, ['finalized', 'outcome'], 'terminal lane',
     { optional: ['finalEventId', 'pendingEffectIds', 'batchReceiptIds',
-      'replyTargetReceiptId'] })
+      'replyTargetReceiptId', 'steerReceiptIds'] })
   const finalized = bool(raw.finalized, 'terminal finalized')
   if (!finalized) {
     if (raw.outcome !== null || Object.hasOwn(raw, 'finalEventId') ||
         Object.hasOwn(raw, 'pendingEffectIds') ||
         Object.hasOwn(raw, 'batchReceiptIds') ||
-        Object.hasOwn(raw, 'replyTargetReceiptId')) throw new TypeError('unfinalized terminal outcome invalid')
+        Object.hasOwn(raw, 'replyTargetReceiptId') ||
+        Object.hasOwn(raw, 'steerReceiptIds')) throw new TypeError('unfinalized terminal outcome invalid')
     return { finalized, outcome: null }
   }
   if (!Object.hasOwn(raw, 'finalEventId') || !Object.hasOwn(raw, 'pendingEffectIds')) {
@@ -188,9 +189,33 @@ function terminalLane(raw) {
   } else if (Object.hasOwn(raw, 'replyTargetReceiptId')) {
     throw new TypeError('single receipt terminal has batch reply target')
   }
+  if (Object.hasOwn(raw, 'steerReceiptIds')) {
+    out.steerReceiptIds = unique(boundedArray(raw.steerReceiptIds, 32,
+      'steer terminal receipts').map(id => token(id, HEX_RECEIPT, 'steer receipt')), 'steer receipts')
+    if (!out.steerReceiptIds.length || out.steerReceiptIds.some(id => out.batchReceiptIds?.includes(id))) {
+      throw new TypeError('steer terminal receipts invalid')
+    }
+  }
   return out
 }
 
+function steerLane(raw) {
+  fields(raw, ['parentReceiptId', 'turnToken', 'generation', 'entries'], 'steer lane')
+  const parentReceiptId = token(raw.parentReceiptId, HEX_RECEIPT, 'steer parent')
+  const entries = boundedArray(raw.entries, 32, 'steer entries').map(entry => {
+    fields(entry, ['receiptId', 'effectId', 'status'], 'steer entry')
+    if (!['pending', 'accepted', 'landed'].includes(entry.status)) throw new TypeError('steer status invalid')
+    if (entry.receiptId === parentReceiptId) throw new TypeError('steer repeats parent')
+    return { receiptId: token(entry.receiptId, HEX_RECEIPT, 'steer receipt'),
+      effectId: token(entry.effectId, /^sbot-c2-effect-v1:[0-9]+:[A-Za-z0-9:_-]+:0$/, 'steer effect'), status: entry.status }
+  })
+  if (!entries.length) throw new TypeError('empty steer lane')
+  unique(entries.map(entry => entry.receiptId), 'steer receipts')
+  unique(entries.map(entry => entry.effectId), 'steer effects')
+  return { parentReceiptId, turnToken: integer(raw.turnToken, 'steer turn', { positive: true }),
+    generation: token(raw.generation, HEX_RECEIPT, 'steer generation'), entries }
+}
+
 function handoffLane(raw) {
   fields(raw, ['phase', 'turnToken', 'attempt', 'acceptedReceiptIds', 'nextJobId'], 'handoff lane')
   if (!['idle', 'running', 'releasing', 'handoff', 'sealed'].includes(raw.phase)) {
@@ -296,6 +321,7 @@ function cardCleanupLane(raw) {
 
 const LANE_VALIDATORS = Object.freeze({
   queue: queueLane,
+  steer: steerLane,
   lifecycle: lifecycleLane,
   turn: turnLane,
   terminal: terminalLane,

package/src/core/c2platformrecoverysender.js

@@ -5,7 +5,7 @@ const { chatPlatform } = require('../config')
 const RECEIPT_ID = /^[0-9a-f]{32}$/
 const FEISHU_CHAT_ID = /^oc_[A-Za-z0-9_-]{1,124}$/
 const FEISHU_MESSAGE_ID = /^om_[A-Za-z0-9_-]{1,124}$/
-const NOTICE_TEXT = '上一轮因服务中断未完成，请重新发送原请求。'
+const NOTICE_TEXT = '上一轮没有完成（模型出错或服务中断），请重新发送原请求。'
 
 // A deliberately narrow recovery sender for a previously accepted Feishu
 // message. The ordinary platform.reply() can fall back to a second send after

package/src/core/c2sourcequarantine.js

@@ -27,4 +27,59 @@ function createC2V2SourceQuarantine(value, { required = false } = {}) {
     rejects: message => sourceIds.includes(message?.msgId) })
 }
 
-module.exports = { createC2V2SourceQuarantine }
+// Every sealed incident under <data>/incidents/*/incident.json keeps its
+// unsettled source messages out of admission for that group, on every start.
+// A seal written by `sintbot incident seal` also lists the receipts its
+// journal had already settled, so the group's new journal never runs one of
+// those messages again. A malformed seal stops startup: an unreadable fence
+// cannot be skipped.
+const CHAT_ID = /^oc_[A-Za-z0-9_-]{1,124}$/
+const RECEIPT_ID = /^[0-9a-f]{32}$/
+function loadC2IncidentQuarantine(stateDir, { fs = require('node:fs'), path = require('node:path') } = {}) {
+  if (typeof stateDir !== 'string' || !path.isAbsolute(stateDir)) {
+    throw new TypeError('C2 incident quarantine needs the installation directory')
+  }
+  const root = path.join(stateDir, 'incidents')
+  // Loaded here so the source quarantine above stays a standalone module.
+  const { taskId } = require('./enginecheckpoint')
+  const byChat = new Map()
+  const settled = new Map()
+  const fail = name => { throw new Error(`Sealed incident record is invalid: ${name}; preserve it and review`) }
+  let entries = []
+  try { entries = fs.readdirSync(root, { withFileTypes: true }) }
+  catch (error) { if (error.code !== 'ENOENT') throw error }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue
+    const file = path.join(root, entry.name, 'incident.json')
+    let stat
+    try { stat = fs.lstatSync(file) } catch (error) { if (error.code === 'ENOENT') continue; throw error }
+    if (!stat.isFile() || stat.isSymbolicLink() ||
+        typeof process.getuid === 'function' && stat.uid !== process.getuid() ||
+        process.platform !== 'win32' && (stat.mode & 0o077)) fail(entry.name)
+    let record
+    try { record = JSON.parse(fs.readFileSync(file, 'utf8')) } catch { fail(entry.name) }
+    if (record?.schema !== 'sbot-c2-incident-seal-v1' || !CHAT_ID.test(record.chatId || '') ||
+        !Array.isArray(record.pending) ||
+        record.pending.some(item => !FEISHU_MESSAGE_ID.test(item?.sourceId || '')) ||
+        record.completedReceiptIds !== undefined && (!Array.isArray(record.completedReceiptIds) ||
+          record.completedReceiptIds.some(id => typeof id !== 'string' || !RECEIPT_ID.test(id)))) fail(entry.name)
+    const ids = byChat.get(record.chatId) || new Set()
+    for (const item of record.pending) ids.add(item.sourceId)
+    byChat.set(record.chatId, ids)
+    if (record.completedReceiptIds?.length) {
+      const done = settled.get(record.chatId) || new Set()
+      for (const id of record.completedReceiptIds) done.add(id)
+      settled.set(record.chatId, done)
+    }
+  }
+  const sourceIds = Object.freeze([...byChat.values()].flatMap(ids => [...ids]))
+  const settledBefore = message => {
+    const done = settled.get(message?.chatId)
+    if (!done || typeof message.msgId !== 'string' || !message.msgId) return false
+    return done.has(taskId({ source: 'message', chatId: message.chatId, sourceId: message.msgId }))
+  }
+  return Object.freeze({ sourceIds,
+    rejects: message => !!byChat.get(message?.chatId)?.has(message?.msgId) || settledBefore(message) })
+}
+
+module.exports = { createC2V2SourceQuarantine, loadC2IncidentQuarantine }

package/src/core/c2terminalprune.js

@@ -66,7 +66,8 @@ function pruneConfirmedTerminal({ journal, coordinator, scope } = {}) {
         settlement?.turnToken !== descriptor.turnToken ||
         completed?.settledAt !== settlement?.settledAt ||
         !isDeepStrictEqual(settlement?.batchReceiptIds, lane.batchReceiptIds) ||
-        (lane.batchReceiptIds || [descriptor.receiptId]).some(id =>
+        !isDeepStrictEqual(settlement?.steerReceiptIds, lane.steerReceiptIds) ||
+        [...(lane.batchReceiptIds || [descriptor.receiptId]), ...(lane.steerReceiptIds || [])].some(id =>
           !durable.receipts.completed.some(item =>
             item.id === id && item.settledAt === settlement?.settledAt)) ||
         !proof || !/^[0-9a-f]{32}$/.test(proof.generation || '') ||

package/src/core/engineslotsadapter.js

@@ -0,0 +1,108 @@
+'use strict'
+
+const { engineSlotsStep, resetBinaryCore } = require('../agent/privatecore')
+
+// Promise, AbortSignal and waiter handles belong to Node. The binary reducer
+// owns capacity, priority and grant order; no callback fires until its complete
+// transition has been validated and committed.
+class BinarySemaphore {
+  constructor(max, step = engineSlotsStep, resetCore = resetBinaryCore) {
+    this.state = { max: max > 0 ? max : 0, cur: 0, waiters: [] }
+    this.step = step
+    this.resetCore = resetCore
+    this.handles = new Map()
+    this.serial = 0
+  }
+
+  get max() { return this.state.max }
+  set max(value) { this._transition({ type: 'reload', max: value }) }
+  get cur() { return this.state.cur }
+  get waiters() { return this.state.waiters.map(waiter => this.handles.get(waiter.id)?.handle).filter(Boolean) }
+
+  _transition(event) {
+    let result
+    try {
+      result = this.step(this.state, event)
+      const next = result && result.state
+      if (!next || typeof next !== 'object' || Array.isArray(next) ||
+          !Number.isSafeInteger(next.cur) || next.cur < 0 || !Array.isArray(next.waiters) ||
+          !Array.isArray(result.effects) ||
+          (event.type === 'wouldBlock' && typeof result.wouldBlock !== 'boolean')) {
+        throw new Error('invalid binary slot transition')
+      }
+      const ids = new Set()
+      for (const waiter of next.waiters) {
+        if (!waiter || typeof waiter.id !== 'string' || !waiter.id ||
+            !Number.isSafeInteger(waiter.reserve) || waiter.reserve < 0 || ids.has(waiter.id) ||
+            (waiter.id !== event.id && !this.handles.has(waiter.id))) {
+          throw new Error('invalid binary slot waiter')
+        }
+        ids.add(waiter.id)
+      }
+      if (result.effects.length > 1 || result.effects.some(effect =>
+        !effect || !['grant', 'reject'].includes(effect.type) || typeof effect.id !== 'string' ||
+        (effect.id !== event.id && !this.handles.has(effect.id)))) {
+        throw new Error('invalid binary slot effect')
+      }
+      this.state = next
+      return result
+    } catch (error) {
+      try { this.resetCore(error) } catch { /* preserve the first failure */ }
+      throw error
+    }
+  }
+
+  wouldBlock(reserve = 0) { return this._transition({ type: 'wouldBlock', reserve }).wouldBlock }
+
+  async acquire(signal, reserve = 0, onWait = null) {
+    const id = `s${++this.serial}`
+    const result = this._transition({ type: 'acquire', id, reserve })
+    if (result.effects.some(effect => effect.type === 'grant' && effect.id === id)) return
+    return new Promise((resolve, reject) => {
+      const record = { resolve, reject, signal, onAbort: null, handle: null }
+      const handle = { id,
+        get reserve() { return record.reserve },
+        set reserve(value) {
+          if (value !== 0) throw new TypeError('slot waiter promotion must set reserve to zero')
+          if (record.done) { record.reserve = 0; return }
+          const changed = record.owner._transition({ type: 'promote', id })
+          if (changed.effects.length) throw new Error('slot promotion emitted an effect')
+          record.reserve = 0
+        } }
+      record.owner = this
+      record.reserve = reserve
+      record.handle = handle
+      this.handles.set(id, record)
+      if (onWait) onWait(handle)
+      const onAbort = () => {
+        try {
+          const changed = this._transition({ type: 'abort', id })
+          if (!changed.effects.some(effect => effect.type === 'reject' && effect.id === id)) return
+          record.done = true
+          this.handles.delete(id)
+          if (signal) signal.removeEventListener('abort', onAbort)
+          reject(new Error('aborted while waiting for a concurrency slot'))
+        } catch (error) { reject(error) }
+      }
+      record.onAbort = onAbort
+      if (signal) {
+        if (signal.aborted) onAbort()
+        else signal.addEventListener('abort', onAbort, { once: true })
+      }
+    })
+  }
+
+  release() {
+    const result = this._transition({ type: 'release' })
+    const granted = result.effects.find(effect => effect.type === 'grant')
+    if (!granted) return
+    const record = this.handles.get(granted.id)
+    if (!record) throw new Error('binary slot grant has no host waiter')
+    record.done = true
+    this.handles.delete(granted.id)
+    if (record.signal) record.signal.removeEventListener('abort', record.onAbort)
+    record.resolve()
+  }
+}
+
+module.exports = { BinarySemaphore }

package/src/core/issues.js

@@ -0,0 +1,185 @@
+// 群内反馈本(issue)—— 每台 sbot 一本,存在本机 `~/.sbot/issues.jsonl`。
+//
+// 为什么要有它:群成员(产品、运营、业务同事)是这套系统真正的使用者,但他们的反馈至今
+// 只能散在群消息里,靠 operator 事后翻聊天记录去捞 —— 2026-08-13 就丢过一次(4 条消息
+// 静默蒸发,靠用户贴截图才被发现)。给他们一个够得着的入口,反馈才不会蒸发。
+// ⚠ 与仓库托管平台上的 issue 无关,不同步、不关联:这是 sbot 自己的本地反馈本。
+//
+// 形态:**事件流 JSONL**,与 turns.jsonl / audit.jsonl 同族。open/close/reopen 各追加一行,
+// 读时按 id 折叠成当前态 —— 从不改写历史行(崩溃安全、无锁读、天然可审计:谁在什么时候
+// 关的、备注是什么,全留在文件里)。
+//
+// id 只在**本机**内递增(#7 这种短号,群里好念好报)。跨机汇总时用 `host` 字段区分,故
+// 两台各自编号撞车也不影响 —— 全局标识是 host + id,而群成员只在自己那台的语境里念它。
+
+const fs = require('node:fs')
+const path = require('node:path')
+const os = require('node:os')
+
+// 正文上限。⚠ 不是为了省空间(这本账一天几条),是防「顺手粘一整段日志/一屏报错」把
+// 单行撑到兆级 —— 而这本账是要被整本读进来做分析的,一条撑爆等于整本读不动。
+// 4000 字远超任何正常反馈的长度,截断处留标记,让人知道后面还有东西、别当成全文。
+const MAX_TEXT = 4000
+const TRUNC_MARK = '…(过长已截断)'
+
+// ── 纯逻辑(无 IO,可单测)──────────────────────────────────────────────────
+
+// 事件流 → 当前态。open 建档,close/reopen 只改状态与备注,其余字段一律以 open 那条为准
+// (后续事件不许改写正文 —— 反馈原话是证据,不能被后来的操作悄悄改掉)。
+// 未知 op 一律忽略:老版本读新文件时宁可少认几条,也不能整本读不出来。
+function foldEvents(events) {
+  const byId = new Map()
+  for (const e of events) {
+    if (!e || e.id == null) continue
+    if (e.op === 'open') {
+      byId.set(e.id, {
+        id: e.id,
+        ts: e.ts || 0,
+        chatId: e.chatId || null,
+        group: e.group || '',
+        sender: e.sender || '',
+        text: e.text || '',
+        version: e.version || '',
+        host: e.host || '',
+        turn: e.turn || null,
+        status: 'open',
+        note: '',
+        closedAt: 0,
+      })
+      continue
+    }
+    const cur = byId.get(e.id)
+    if (!cur) continue // close 一个不存在的 id:忽略(文件被截断/手工编辑过)
+    if (e.op === 'close') {
+      cur.status = 'closed'
+      cur.closedAt = e.ts || 0
+      if (e.note) cur.note = e.note
+    } else if (e.op === 'reopen') {
+      cur.status = 'open'
+      cur.closedAt = 0
+      if (e.note) cur.note = e.note
+    }
+  }
+  return [...byId.values()].sort((a, b) => a.id - b.id)
+}
+
+// 下一个本机序号。⚠ 取「历史最大 + 1」而不是「条数 + 1」:后者在文件被手工删过行之后
+// 会发出重复号,而重复号会让 close 打在错的那条上。
+function nextId(issues) {
+  let max = 0
+  for (const i of issues) if (typeof i.id === 'number' && i.id > max) max = i.id
+  return max + 1
+}
+
+// 正文规整:去首尾空白 + 封顶。截断只发生在超长时,正常反馈逐字保留(原话是证据)。
+function clampText(text) {
+  const s = String(text || '').trim()
+  return s.length > MAX_TEXT ? s.slice(0, MAX_TEXT) + TRUNC_MARK : s
+}
+
+// 解析一行 JSONL,坏行返回 null(整本不能因为一行坏掉就读不出来)。
+function parseLines(text) {
+  const out = []
+  for (const line of String(text || '').split('\n')) {
+    const s = line.trim()
+    if (!s) continue
+    try { out.push(JSON.parse(s)) } catch { /* 坏行跳过 */ }
+  }
+  return out
+}
+
+// 群里回执 / CLI 列表共用的单行摘要。⚠ 正文压成一行并截断 —— 反馈里常有换行,
+// 直接进列表会把一屏冲掉。
+function summarize(issue, { width = 60 } = {}) {
+  const t = String(issue.text || '').replace(/\s+/g, ' ').trim()
+  return t.length > width ? t.slice(0, width) + '…' : t
+}
+
+// 出问题那一轮的技术指纹 —— 这是整个反馈本最值钱的一个字段。
+// 群成员的原话通常是「它刚才没回我」,单靠这句没法查;带上那一轮的 status/耗时/token,
+// 一眼就能分辨「空轮」「超时」「模型报错」还是「它其实答了但没看见」。
+// ⚠ 只带指标不带**正常正文**:正文可能含群里的业务数据,而反馈本是要被跨机收集、集中分析的。
+// ⚠ **失败原因是例外,而且必须显示**:它不是业务正文,是「为什么没成」——「模型报错」这一类
+//   光看 status 只知道错了、不知道错在哪,拿到反馈的人还得再猜一遍(这正是本字段存在的理由)。
+//   ⭐ 只有在**上游保证 err 里装的是错误文本、不是模型的正常回答**时这条才成立(见 engine 的
+//   turnErrText:第一版就是拿正常正文冒充原因,那样带出去才真的破了上面那条规矩)。
+//   指纹是给人扫一眼的,故这里再收一次长度;全文在 `issue show` 里。
+function fingerprint(turn) {
+  if (!turn) return ''
+  const bits = []
+  if (turn.status) bits.push(turn.status)
+  if (turn.ms >= 0) bits.push(Math.round(turn.ms / 1000) + 's')
+  const tk = turn.tokens
+  if (tk) bits.push(`tokens{in:${tk.in ?? 0},out:${tk.out ?? 0}}`)
+  if (turn.provider) bits.push(turn.provider)
+  if (turn.err) bits.push(String(turn.err).replace(/\s+/g, ' ').trim().slice(0, 120))
+  return bits.join(' · ')
+}
+
+// ── 落盘层(薄壳)────────────────────────────────────────────────────────
+// withFileLock 从 store 注入而不是这里 require:core 里已有一份跨进程写锁实现,
+// 两份锁 = 两把不同的锁,等于没锁。
+
+function createIssues(file, { log = () => {}, withFileLock = (f, fn) => fn(), host = os.hostname().split('.')[0] } = {}) {
+  const readAll = () => {
+    try { return foldEvents(parseLines(fs.readFileSync(file, 'utf8'))) } catch { return [] }
+  }
+  const appendEvent = (ev) => {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 })
+    fs.appendFileSync(file, JSON.stringify(ev) + '\n', { mode: 0o600 }) // 反馈原文含群成员的话,同账本只给自己读
+  }
+  return {
+    file,
+    host,
+    // 新建。⚠ 「算号 + 追加」必须在同一把锁里:两个群同时提,分头算出的会是同一个号。
+    add({ chatId, group, sender, text, version, turn } = {}) {
+      let created = null
+      withFileLock(file, () => {
+        const id = nextId(readAll())
+        const ev = {
+          op: 'open',
+          id,
+          ts: Date.now(),
+          chatId: chatId || null,
+          group: group || '',
+          sender: sender || '',
+          text: clampText(text),
+          version: version || '',
+          host,
+          turn: turn || null,
+        }
+        appendEvent(ev)
+        created = { ...ev, status: 'open', note: '', closedAt: 0 }
+      })
+      return created
+    },
+    list({ all = false } = {}) {
+      const arr = readAll()
+      return all ? arr : arr.filter((i) => i.status === 'open')
+    },
+    get(id) {
+      return readAll().find((i) => i.id === Number(id)) || null
+    },
+    // close/reopen 返回**变更后**的那条(调用方要拿它的 chatId 去原群回一句)。
+    // 找不到 / 状态已经是目标态 ⇒ 返回 null,让调用方如实说「没这条」或「本来就是开着的」。
+    setStatus(id, op, note) {
+      const n = Number(id)
+      // 备注先验形再走 clampText:到得了这里的两个入口(CLI / 控制台 API)都是 operator 侧,
+      // 但 API 传来的可能不是字符串 —— 不拦就会以对象形态写进事件行,前端渲染时炸整页
+      // (整本账连坐);拦成 '[object Object]' 也一样是脏数据。非字符串一律当没写。
+      const clean = typeof note === 'string' ? clampText(note) : ''
+      let out = null
+      withFileLock(file, () => {
+        const cur = readAll().find((i) => i.id === n)
+        if (!cur) return
+        if (op === 'close' && cur.status === 'closed') return
+        if (op === 'reopen' && cur.status === 'open') return
+        appendEvent({ op, id: n, ts: Date.now(), note: clean })
+        out = { ...cur, status: op === 'close' ? 'closed' : 'open', note: clean || cur.note }
+      })
+      return out
+    },
+  }
+}
+
+module.exports = { createIssues, foldEvents, nextId, parseLines, summarize, fingerprint, clampText, MAX_TEXT }

package/src/core/ledger.js

@@ -0,0 +1,30 @@
+// Turn ledger — one JSONL line per finished turn, appended to disk:
+//   { ts, chatId, provider, sender, text, status, ms, tokens: { in, out, cr?, cw? }, err? }
+// err 只在 status 为 error/failed 时出现(v0.11.61):此前失败只记 status、一个字的原因都没有,
+// 而日志那边又没时间戳 ⇒ 线上失败事后无从查起。**字段缺席 = 旧行**,不是「这次没原因」。
+// tokens 是**本轮增量**(cr=缓存读 cw=缓存写,engine._settleUsage 归一;v0.11.17 前的旧行
+// claude 漏缓存、codex 记的是会话累计 —— 读历史数据时注意口径分界)。
+// The in-memory activity feed is just a view; this file is the durable record
+// and the data source for usage / cost accounting.
+// Best-effort by design: a ledger failure must never break a turn.
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+function createLedger(file, log = () => {}) {
+  let dirReady = false
+  return {
+    file,
+    append(rec) {
+      try {
+        if (!dirReady) { fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 }); dirReady = true }
+        // 账本里有发送者和消息正文:新建时只给自己读写(mode 只在创建时生效,旧文件由 core/datadir 启动时收紧)
+        fs.appendFile(file, JSON.stringify(rec) + '\n', { mode: 0o600 }, (e) => { if (e) log('ledger append failed: ' + e.message) })
+      } catch (e) {
+        log('ledger append failed: ' + (e && e.message))
+      }
+    },
+  }
+}
+
+module.exports = { createLedger }