sintbot 1.3.0 → 1.4.1

package/bin/sintbot-v2.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 'use strict'
 
-// Restricted macOS Feishu single-group entry. No legacy daemon or terminal
-// chat dispatch is reachable from this entry.
+// macOS Feishu entry. Each group has an independent durable authority;
+// the process owns one transport, writer lease and shared session store.
 const fs = require('node:fs')
 const path = require('node:path')
 const { parseArgs } = require('node:util')
@@ -11,293 +11,297 @@ const { secureDataDir } = require('../src/core/datadir')
 const { StateStore } = require('../src/core/store')
 const { createFeishuPlatform, feishuClient } = require('../src/platform/feishu')
 const { createMultiPlatform } = require('../src/platform/multi')
+const { isC2InputRejection, answerC2InputRejection } = require('../src/core/c2inputrejection')
+
+// Answers stream into the reply card while the model works. The card is
+// registered durably before any frame; feishu.card.streaming:false restores
+// the single final card.
+const streamFrames = cfg => cfg.feishu?.card?.streaming !== false
 
 async function startService(rest) {
   const { values } = parseArgs({ args: rest, allowPositionals: false,
-    options: { config: { type: 'string' }, ui: { type: 'boolean' },
+    options: { config: { type: 'string' }, 'data-dir': { type: 'string' }, ui: { type: 'boolean' },
       'no-open': { type: 'boolean' }, 'ui-port': { type: 'string' },
       'ui-host': { type: 'string' }, preflight: { type: 'boolean' } } })
   const preflightOnly = values.preflight === true
-  if (values.ui || values['no-open'] || values['ui-port'] || values['ui-host']) {
-    throw new Error('C2 v2 single-group service has no durable UI route; remove UI options')
+  const { loadInstallation, assertPrivateDirectory, assertInstallationJournals, assertJournalScope } = require('../src/c2install')
+  // Groups added to the configuration since the last start are registered
+  // below, after the writer lock is held; existing journals stay as mapped.
+  const installation = loadInstallation(values.config, { dataDir: values['data-dir'], allowAddedGroups: true })
+  const { stateDir, file, cfg, groups, routes, serviceChatId, provider } = installation
+  const uiEnabled = values.ui === true || cfg.ui?.enabled === true
+  const uiHost = values['ui-host'] || cfg.ui?.host || '127.0.0.1'
+  const uiPort = Number(values['ui-port'] || cfg.ui?.port || 4600)
+  if (uiEnabled && (!['127.0.0.1', 'localhost', '::1', '0.0.0.0'].includes(uiHost) ||
+      !Number.isSafeInteger(uiPort) || uiPort < 1 || uiPort > 65535)) {
+    throw new Error('Console address or port is invalid')
   }
-  const { loadInstallation, assertPrivateDirectory } = require('../src/c2install')
-  const { stateDir, file, cfg, groups, serviceChatId, provider } = loadInstallation(values.config)
-  assertPrivateDirectory(stateDir)
-  let journalStat
-  try { journalStat = fs.lstatSync(file) } catch {}
-  if (!journalStat?.isFile() || journalStat.isSymbolicLink()) {
-    throw new Error('No initialized journal; use sintbot init for a new installation. Existing state must be reviewed before migration.')
+  if (uiEnabled && uiHost === '0.0.0.0' && !cfg.ui?.auth) {
+    throw new Error('Set a console access password before enabling network access')
   }
-  applyProxyEnv(cfg)
-  const { spawnSync } = require('node:child_process')
-  const probe = spawnSync(provider.bin || 'codex', ['--version'], {
-    encoding: 'utf8', timeout: 10_000, maxBuffer: 64 * 1024,
-    env: { ...process.env, ...(provider.env || {}) },
-  })
-  if (probe.error || probe.status !== 0 || !/codex/i.test(probe.stdout || '')) {
-    throw new Error('Codex executable preflight failed; install and sign in to Codex, then check the configured executable.')
+  if (!uiEnabled && (values['ui-port'] || values['ui-host'])) {
+    throw new Error('Console options require --ui or ui.enabled:true')
   }
+  assertInstallationJournals(installation)
+  // Every installation, including one group, runs the multi-group service:
+  // chat commands, the console writer and per-group fault closing live there.
+  return startMultiGroupService({ installation, preflightOnly, uiEnabled, uiHost, uiPort })
+}
+
+async function startMultiGroupService({ installation, preflightOnly, uiEnabled = false, uiHost, uiPort }) {
+  const { stateDir, cfg, routes } = installation
+  const { assertPrivateDirectory, assertJournalScope } = require('../src/c2install')
+  const { C2DurableJournal } = require('../src/core/c2durablejournal')
+  const { validatePersistentState } = require('../src/core/c2persiststate')
+  const { validatePersistentReceipts, validatePersistentRelation } = require('../src/core/c2persistrelation')
+  const { createC2ServiceStartGate } = require('../src/core/c2servicestartgate')
+  const { C2PayloadHandles } = require('../src/core/c2payloadhandles')
+  const { createC2LocalEffectExecutor, resolveC2LocalEffectTurn } = require('../src/core/c2localeffectexecutor')
+  const { createFeishuRecoverySender } = require('../src/core/c2platformrecoverysender')
+  const { createC2V2SourceQuarantine } = require('../src/core/c2sourcequarantine')
+  const { Engine } = require('../src/core/v2engine')
+  const { createC2MultiGroupService } = require('../src/c2multigroupservice')
+  const { C2MultiGroupCapacity } = require('../src/c2multigroupcapacity')
+  const { routeBackend } = require('../src/agent/privatecore')
+  const { assertRunnerExecutable } = require('../src/c2install')
+  const { C2DurableRuntime } = require('../src/core/c2durableruntime')
+  // /hud reads the group's model quota; /issue appends to the console's log.
+  const usageProbe = require('../src/usage').createUsageProbe({
+    codexUsage: async () => { const status = require('../src/agent/codexstatus')
+      return status.formatUsage(await status.rateLimits('codex')) } })
+  const issues = require('../src/core/issues').createIssues(path.join(stateDir, 'issues.jsonl'),
+    { withFileLock: require('../src/core/store').withFileLock,
+      log: message => process.stderr.write(`C2 multi-group · ${message}\n`) })
   const runner = require('../src/agent/runner')
+  const validators = { validateState: validatePersistentState,
+    validateReceipts: validatePersistentReceipts, validateRelation: validatePersistentRelation }
+  assertPrivateDirectory(stateDir)
+  applyProxyEnv(cfg)
+  const adding = new Set((installation.addedRoutes || []).map(route => route.chatId))
+  for (const route of routes) {
+    if (adding.has(route.chatId)) {
+      if (!route.paused) assertRunnerExecutable(route.provider, cfg)
+      continue
+    }
+    const stat = fs.lstatSync(route.file)
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('C2 group journal is not a real initialized file')
+    if (route.paused) continue
+    assertRunnerExecutable(route.provider, cfg)
+  }
+  const capacity = new C2MultiGroupCapacity({ maxConcurrent: cfg.agent.maxConcurrent })
+  const quarantine = createC2V2SourceQuarantine([
+    process.env.SBOT_C2_V2_BLOCK_SOURCE_ID, process.env.SBOT_C2_V2_BLOCK_SOURCE_ID_2],
+    { required: process.env.SBOT_C2_V2_REQUIRE_BLOCK_SOURCE_ID === '1' })
+  if (process.env.SBOT_C2_V2_REQUIRE_BLOCK_SOURCE_ID !== undefined &&
+      !['0', '1'].includes(process.env.SBOT_C2_V2_REQUIRE_BLOCK_SOURCE_ID)) {
+    throw new Error('C2 source quarantine requirement must be 0 or 1')
+  }
   secureDataDir(stateDir)
   const lockFile = path.join(stateDir, 'daemon.lock')
   const lock = require('../src/core/instancelock').acquire(lockFile)
-  if (!lock.ok) throw new Error('C2 v2 development service cannot hold the single-writer lock')
+  if (!lock.ok) throw new Error('C2 multi-group service cannot hold the single-writer lock')
+  try {
+    const registered = require('../src/c2install').registerAddedGroups(installation)
+    if (registered.length) process.stderr.write(`C2 multi-group · registered ${registered.length} new group(s) with empty journals\n`)
+  } catch (error) { lock.release(); throw error }
+  const assertWriterLock = () => {
+    try { return fs.readFileSync(lockFile, 'utf8').trim() === String(process.pid) }
+    catch { return false }
+  }
   let running = false
+  let service
+  let ui
+  let configControl
+  let liveTransport
+  let onSigint, onSigterm
   try {
-    // The old daemon records interrupted work here and consumes it on restart.
-    // Starting v2 while such a file exists would leave that work invisible;
-    // never consume, delete, or reinterpret it without an explicit migration.
+    const migrationFence = require('../src/c2migration').loadC2MigrationFence({ stateDir, routes })
+    const incidentQuarantine = require('../src/core/c2sourcequarantine').loadC2IncidentQuarantine(stateDir)
+    const combinedQuarantine = { rejects: msg => !!quarantine?.rejects(msg) ||
+      !!migrationFence?.rejects(msg) || incidentQuarantine.rejects(msg) }
     for (const name of ['pending-turns.json', 'engine-receipts.json']) {
+      if (fs.existsSync(path.join(stateDir, name))) throw new Error('Legacy pending authority needs explicit migration')
+    }
+    // A journal that cannot be opened or audited holds only its own group.
+    const journals = new Map()
+    const holds = new Map()
+    for (const route of routes) {
       try {
-        fs.lstatSync(path.join(stateDir, name))
+        const journal = C2DurableJournal.open(route.file, validators)
+        assertJournalScope(journal, route.chatId, { requireSettled: preflightOnly || route.paused })
+        journals.set(route.chatId, journal)
       } catch (error) {
-        if (error.code === 'ENOENT') continue
-        throw error
+        if (!assertWriterLock()) throw error
+        holds.set(route.chatId, error?.message || String(error))
       }
-      throw new Error(`C2 v2 cannot start with legacy ${name}; preserve it and drain with the old service or use a reviewed migration`)
-    }
-    const { createC2V2SourceQuarantine } = require('../src/core/c2sourcequarantine')
-    const requireQuarantine = process.env.SBOT_C2_V2_REQUIRE_BLOCK_SOURCE_ID
-    if (requireQuarantine !== undefined &&
-        requireQuarantine !== '0' && requireQuarantine !== '1') {
-      throw new Error('C2 v2 source quarantine requirement must be 0 or 1')
     }
-    const sourceQuarantine = createC2V2SourceQuarantine([
-      process.env.SBOT_C2_V2_BLOCK_SOURCE_ID,
-      process.env.SBOT_C2_V2_BLOCK_SOURCE_ID_2],
-      { required: requireQuarantine === '1' })
-    const assertWriterLock = () => {
-      try { return fs.readFileSync(lockFile, 'utf8').trim() === String(process.pid) }
-      catch { return false }
-    }
-    const { C2DurableJournal } = require('../src/core/c2durablejournal')
-    const { validatePersistentState } = require('../src/core/c2persiststate')
-    const { validatePersistentReceipts, validatePersistentRelation } = require('../src/core/c2persistrelation')
-    const { createC2ServiceStartGate } = require('../src/core/c2servicestartgate')
-    const { C2PayloadHandles } = require('../src/core/c2payloadhandles')
-    const { createC2LocalEffectExecutor, resolveC2LocalEffectTurn } =
-      require('../src/core/c2localeffectexecutor')
-    const { createFeishuRecoverySender } = require('../src/core/c2platformrecoverysender')
-    const journal = C2DurableJournal.open(file, { validateState: validatePersistentState,
-      validateReceipts: validatePersistentReceipts,
-      validateRelation: validatePersistentRelation })
-    const beforeRecovery = journal.snapshot()
-    if (preflightOnly && (beforeRecovery.receipts.pending.length !== 0 ||
-        Object.keys(beforeRecovery.state.lanes).length !== 0 ||
-        [...beforeRecovery.effects.values()].some(status => status !== 'acked') ||
-        [...beforeRecovery.notices.values()].some(notice =>
-          notice.status === 'attempting' || notice.status === 'unknown'))) {
-      throw new Error('C2 v2 service preflight requires a settled journal; use recovery in a controlled service window')
-    }
-    const limits = { maxEventCount: 100_000,
-      maxJournalBytes: 64 * 1024 * 1024,
-      maxCompletionEvents: 1_000, maxCompletionBytes: 8 * 1024 * 1024 }
-    const { routeBackend } = require('../src/agent/privatecore')
-    const { C2DurableRuntime } = require('../src/core/c2durableruntime')
-    const { coordinateC2GlobalFault } = require('../src/core/c2globalfault')
+    // All group Engines must share this exact object: separate Store caches
+    // would overwrite sibling sessions when they save the same state file.
+    const store = new StateStore(path.join(stateDir, 'state.json'))
     const closeChecks = {
       claude: require('../src/agent/claudecode').isClosedRunnerResult,
       'codex-exec': require('../src/agent/codexcode').isClosedRunnerResult,
       'codex-app': require('../src/agent/codexapp').isClosedRunnerResult,
     }
-    const validators = { validateState: validatePersistentState,
-      validateReceipts: validatePersistentReceipts,
-      validateRelation: validatePersistentRelation }
-    const createTransport = () => {
-      const client = feishuClient(cfg.feishu.appId, cfg.feishu.appSecret)
-      const adapter = createFeishuPlatform({ appId: cfg.feishu.appId,
-        appSecret: cfg.feishu.appSecret, botOpenId: cfg.feishu.botOpenId,
-        onlyWhenMentioned: cfg.feishu.onlyWhenMentioned === true,
-        ws: cfg.feishu.ws || {}, card: cfg.feishu.card || {}, client })
-      const platform = createMultiPlatform({ adapters: { feishu: adapter },
-        resolve: chatId => chatPlatform(cfg, chatId) })
-      const sender = createFeishuRecoverySender({ cfg, platform, client })
-      for (const [chatId] of groups) sender.resolveTarget({ id: '0'.repeat(32),
-        chatId, source: 'message', sourceId: 'om_c2_service_probe' })
-      return { platform, sender, stopPlatform: () => adapter.stop({ strict: true }) }
-    }
-    const buildBinding = async authorityJournal => {
-      const { platform, sender, stopPlatform } = createTransport()
-      const gate = createC2ServiceStartGate({ enabled: true,
-        journal: authorityJournal, assertWriterLock,
-        resolveTarget: sender.resolveTarget, send: sender.send,
-        singleNoticePerGroup: true, ...limits })
-      try {
-        await gate.start()
-        const runtime = gate.runtime
-        if (!runtime || runtime.blocked || !assertWriterLock()) {
-          throw new Error('C2 v2 development service recovery did not open ingress')
-        }
-        const handles = new C2PayloadHandles({ journal: authorityJournal })
-        handles.reopenAfterRecovery()
-        if (handles.blocked || runtime.snapshot().cursor !== authorityJournal.snapshot().cursor) {
-          throw new Error('C2 v2 development service payload authority differs after recovery')
-        }
-        const store = new StateStore(path.join(stateDir, 'state.json'))
-        const closedResults = new WeakSet()
-        const startTurn = async input => {
-          const backend = routeBackend(input.provider?.runner, input.codexApp,
-            input.codexSteer, input.codexProjectDocFallback)
-          const result = await runner.runTurn(input)
-          if (closeChecks[backend]?.(result) === true) closedResults.add(result)
-          return result
-        }
-        let engine
-        const applyLocalEffect = createC2LocalEffectExecutor({
-          journal: authorityJournal, store,
-          verifyFile: path.join(stateDir, 'verify.json'), assertWriterLock,
-          resolveTurn: identity => resolveC2LocalEffectTurn(engine, identity) })
-        const { Engine } = require('../src/core/v2engine')
-        engine = new Engine(cfg, { runner, store, log: message =>
-          process.stderr.write(`C2 v2 · ${message}\n`),
-        durableV2Runtime: runtime, durableV2Payloads: handles,
-        durableV2StartTurn: startTurn, durableV2ApplyLocalEffect: applyLocalEffect,
-        durableV2VerifyRunnerClosed: ({ result }) => !!result &&
-          typeof result === 'object' && closedResults.has(result),
-        durableV2AssertWriterLock: assertWriterLock,
-        durableV2Journal: authorityJournal, durableV2NormalRoute: true })
-        return { journal: authorityJournal, platform, sender, stopPlatform, gate,
-          runtime, handles, store, engine }
-      } catch (error) { gate.stop(); throw error }
-    }
-    let active = await buildBinding(journal)
-    if (preflightOnly) {
-      active.gate.stop()
-      process.stdout.write('SintBot startup preflight passed; Feishu socket stayed disconnected\n')
-      return
+    // A runner that failed from its own exit event has closed; this frees its
+    // model permit but never proves the turn's outcome.
+    const closeErrorChecks = {
+      claude: require('../src/agent/claudecode').isClosedRunnerError,
+      'codex-exec': require('../src/agent/codexcode').isClosedRunnerError,
+      'codex-app': require('../src/agent/codexapp').isClosedRunnerError,
     }
-    let stopping = false
-    let rebuilds = 0
+    const limits = { maxEventCount: 100_000, maxJournalBytes: 64 * 1024 * 1024,
+      maxCompletionEvents: 1_000, maxCompletionBytes: 8 * 1024 * 1024 }
     let finishing = false
-    const finish = (reason, code, platformStopped, drained) => {
+    const finish = result => {
       if (finishing) return
       finishing = true
+      ui?.close()
       lock.release()
-      process.stderr.write(`C2 v2 · ${reason}; platform stopped=${platformStopped}; runner drained=${drained}\n`,
-        () => process.exit(code))
+      process.stderr.write(`C2 multi-group · ${result.reason}; platform stopped=${result.platformStopped}; runner drained=${result.drained}\n`,
+        () => process.exit(result.code))
     }
-    const activeTurns = snapshot => {
-      const lanes = snapshot.state.lanes
-      const turns = []
-      for (const chatId of new Set([...Object.keys(lanes.turn || {}),
-        ...Object.keys(lanes.handoff || {}),
-        ...Object.keys(lanes.lifecycle || {})])) {
-        const turn = lanes.turn?.[chatId]
-        const handoff = lanes.handoff?.[chatId]
-        const lifecycle = lanes.lifecycle?.[chatId]
-        if (turn?.active != null || handoff?.phase && handoff.phase !== 'idle' ||
-            lifecycle?.busy === true || lifecycle?.controller === true) {
-          turns.push({ chatId, turnToken: turn?.active ?? handoff?.turnToken ?? null })
+    service = createC2MultiGroupService({ routes, assertWriterLock, quarantine: combinedQuarantine,
+      holds, closeCapacity: () => capacity.close(),
+      // Faults in a shared resource stop every group; others hold one group.
+      sharedFault: () => capacity.snapshot().closed ? 'model concurrency closed' : null,
+      log: message => process.stderr.write(`C2 multi-group · ${message}\n`),
+      onFatal: (error, result) => {
+        process.stderr.write(`C2 multi-group failure: ${error?.message || String(error)}\n`)
+        finish(result)
+      },
+      createTransport: () => {
+        const client = feishuClient(cfg.feishu.appId, cfg.feishu.appSecret)
+        const adapter = createFeishuPlatform({ appId: cfg.feishu.appId,
+          appSecret: cfg.feishu.appSecret, botOpenId: cfg.feishu.botOpenId,
+          onlyWhenMentioned: cfg.feishu.onlyWhenMentioned === true,
+          ws: cfg.feishu.ws || {}, card: cfg.feishu.card || {}, client })
+        const platform = createMultiPlatform({ adapters: { feishu: adapter },
+          resolve: chatId => chatPlatform(cfg, chatId) })
+        const sender = createFeishuRecoverySender({ cfg, platform, client })
+        liveTransport = { platform, sender, stopPlatform: () => adapter.stop({ strict: true }) }
+        return liveTransport
+      },
+      createRecoveryAuthority: ({ route, transport, assertWriterLock: lock }) => {
+        const nextJournal = C2DurableJournal.open(route.file, validators)
+        const nextRuntime = new C2DurableRuntime({ journal: nextJournal,
+          resolveTarget: transport.sender.resolveTarget, send: transport.sender.send,
+          assertWriterLock: lock, singleNoticePerGroup: true, ...limits })
+        return { journal: nextJournal, runtime: nextRuntime }
+      },
+      createBinding: async ({ route, transport, journal: recoveredJournal = null }) => {
+        if (recoveredJournal) journals.set(route.chatId, recoveredJournal)
+        let journal = journals.get(route.chatId)
+        if (!journal) {
+          // A group added or resumed online opens its own mapped journal here.
+          const stat = fs.lstatSync(route.file)
+          if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('C2 group journal is not a real initialized file')
+          journal = C2DurableJournal.open(route.file, validators)
+          assertJournalScope(journal, route.chatId)
+          journals.set(route.chatId, journal)
         }
-      }
-      return turns.sort((a, b) => a.chatId.localeCompare(b.chatId))
+        const gate = createC2ServiceStartGate({ enabled: true, journal, assertWriterLock,
+          resolveTarget: transport.sender.resolveTarget, send: transport.sender.send,
+          singleNoticePerGroup: true, ...limits })
+        try {
+          await gate.start()
+          const runtime = gate.runtime
+          if (!runtime || runtime.blocked || !assertWriterLock()) throw new Error('C2 group recovery did not open ingress')
+          const handles = new C2PayloadHandles({ journal })
+          handles.reopenAfterRecovery()
+          if (handles.blocked) throw new Error('C2 group payload authority stayed closed')
+          let engine
+          const applyLocalEffect = createC2LocalEffectExecutor({ journal, store,
+            verifyFile: path.join(stateDir, 'verify.json'), assertWriterLock,
+            resolveTurn: identity => resolveC2LocalEffectTurn(engine, identity) })
+          const closedResults = new WeakSet()
+          const closedErrors = new WeakSet()
+          const startTurn = async input => {
+            const backend = routeBackend(input.provider?.runner, input.codexApp,
+              input.codexSteer, input.codexProjectDocFallback)
+            let result
+            try { result = await runner.runTurn(input) } catch (error) {
+              if (closeErrorChecks[backend]?.(error) === true) closedErrors.add(error)
+              throw error
+            }
+            if (closeChecks[backend]?.(result) === true) closedResults.add(result)
+            return result
+          }
+          engine = new Engine({ ...cfg, groups: { [route.chatId]: route.group } }, {
+            store, log: message => process.stderr.write(`C2 v2 · ${message}\n`),
+            durableV2Runtime: runtime, durableV2Payloads: handles,
+            durableV2StartTurn: startTurn, durableV2ApplyLocalEffect: applyLocalEffect,
+            durableV2VerifyRunnerClosed: ({ result, error }) => result
+              ? typeof result === 'object' && closedResults.has(result)
+              : !!error && typeof error === 'object' && closedErrors.has(error),
+            durableV2AssertWriterLock: assertWriterLock, durableV2Journal: journal,
+            durableV2AcquireCapacity: options => capacity.acquire(options),
+            // A route fault holds or recovers its group alone. Shared grants
+            // are sealed only when the process writer lease itself is gone.
+            durableV2SealCapacity: error => {
+              if (assertWriterLock() !== true) capacity.close(error)
+            },
+            durableV2SwitchProvider: (chatId, name) => {
+              if (chatId !== route.chatId) throw new Error('Model switch targets another group')
+              configControl.switchGroupProvider(chatId, name)
+            },
+            durableV2UsageProbe: usageProbe, durableV2Issues: issues,
+            durableV2Version: require('../package.json').version,
+            durableV2NormalRoute: true, durableV2StreamFrames: streamFrames(cfg) })
+          return { journal, gate, runtime, engine, handles }
+        } catch (error) { gate.stop(); throw error }
+      } })
+    // One configuration writer for the console and the chat /model command.
+    configControl = require('../src/c2configcontrol').createC2ConfigControl({
+      installation, getBindings: () => service.bindings, getHeld: () => service.held,
+      assertWriterLock, store,
+      activateRoute: route => service.addRoute(route),
+      log: message => process.stderr.write(`C2 multi-group · ${message}\n`) })
+    const stop = reason => { void service.stop(reason, 0).then(finish) }
+    onSigint = () => stop('SIGINT')
+    onSigterm = () => stop('SIGTERM')
+    process.on('SIGINT', onSigint)
+    process.on('SIGTERM', onSigterm)
+    if (uiEnabled && !preflightOnly) {
+      ui = require('../src/c2console').createC2Console({
+        configPath: cfg._path, stateDir, host: uiHost,
+        getConfig: () => cfg, getBindings: () => service.bindings,
+        getHeld: () => service.held, getCapacity: () => capacity.snapshot(),
+        getConnHealth: () => liveTransport?.platform.connHealth?.() || {},
+        assertWriterLock, ...configControl,
+        log: message => process.stderr.write(`Console · ${message}\n`) })
+      await new Promise((resolve, reject) => {
+        ui.server.once('error', reject)
+        ui.listen(uiPort, uiHost, () => { ui.server.off('error', reject); resolve() })
+      })
+      process.stderr.write(`SintBot console listening on port ${uiPort}\n`)
     }
-    const launch = async binding => {
-      const onFatal = createC2ReceiptIngressFatalHook({
-        log: message => process.stderr.write(`C2 v2 · ${message}\n`),
-        shutdown: reason => shutdown(binding, reason, 1) })
-      const unsupported = source => () => {
-        void onFatal(new Error(`C2 v2 unsupported Feishu ${source} source`))
-      }
-      await binding.platform.start((msg, sourceAdapter) => {
-        if (binding !== active || binding.gate.blocked || !assertWriterLock()) {
-          throw new Error('C2 v2 development service ingress lost durable authority')
-        }
-        if (msg?.chatId !== serviceChatId) {
-          throw new Error('C2 v2 development service received a message outside its single group')
-        }
-        if (sourceQuarantine?.rejects(msg)) {
-          process.stderr.write('C2 v2 · quarantined historical source message before receipt\n')
-          return { quarantined: true }
-        }
-        return binding.engine.runDurableV2Message(msg, sourceAdapter)
-      }, { onFatal, onRecall: unsupported('recall'),
-        onReaction: unsupported('reaction'),
-        onCardAction: unsupported('card action'),
-        onBoardUpdated: unsupported('board update') })
-      process.stderr.write('SintBot single-group Feishu ingress connected\n')
-    }
-    const shutdown = async (binding, reason, code = 1) => {
-      if (stopping || binding !== active) return
-      stopping = true
-      binding.gate.stop()
-      binding.engine.shutdown()
-      let stopTimer
-      const platformStopped = await Promise.race([
-        Promise.resolve().then(() => binding.stopPlatform()).then(value => value === true, () => false),
-        new Promise(resolve => {
-          stopTimer = setTimeout(() => resolve(false), 2_000)
-        }),
-      ])
-      clearTimeout(stopTimer)
-      const drained = await binding.engine.drainDurableV2(12_000).catch(() => false)
-      // A failed route may have already settled, leaving a closed child and
-      // active durable receipt for global-fault reconciliation. A still-live
-      // route or child cannot be replaced, even if the drain timer expired.
-      const quiescent = [...binding.engine.rts.values()].every(rt =>
-        !rt.v2Controller && !rt.v2NormalRouteActive)
-      if (code === 0 || !platformStopped || !quiescent || !assertWriterLock() ||
-          rebuilds >= 1) {
-        finish(reason, code === 0 && platformStopped && drained ? 0 : 1,
-          platformStopped, drained)
-        return
-      }
-      rebuilds++
-      try {
-        const current = binding.journal.snapshot()
-        const turns = activeTurns(current)
-        const proofs = turns.length
-          ? binding.engine.durableV2ActiveFaultProofs?.(turns) || null : null
-        const result = await coordinateC2GlobalFault({
-          runtime: binding.runtime, journal: binding.journal, assertWriterLock,
-          abortTurn: turn => binding.engine.abortDurableV2FaultTurn?.(turn) === true,
-          activeTurnProofs: proofs,
-          createAuthority: () => {
-            const nextJournal = C2DurableJournal.open(file, validators)
-            const nextRuntime = new C2DurableRuntime({ journal: nextJournal,
-              resolveTarget: binding.sender.resolveTarget,
-              send: binding.sender.send, assertWriterLock,
-              singleNoticePerGroup: true, ...limits })
-            return { journal: nextJournal, runtime: nextRuntime }
-          } })
-        if (result.status !== 'recovered' || !assertWriterLock()) {
-          finish(`C2 v2 recovery sealed: ${result.reason || 'writer lock lost'}`,
-            1, platformStopped, drained)
-          return
-        }
-        result.runtime.close()
-        const next = await buildBinding(result.journal)
-        active = next
-        // A fatal callback may arrive synchronously while the fresh platform
-        // starts. It must not be swallowed by the old binding's stop guard.
-        stopping = false
-        await launch(next)
-        process.stderr.write('C2 v2 process-local authority rebuilt\n')
-      } catch (error) {
-        finish(`C2 v2 recovery failed: ${error?.message || String(error)}`,
-          1, platformStopped, drained)
-      }
+    const started = await service.start({ preflightOnly })
+    if (preflightOnly) {
+      process.stdout.write(`SintBot startup preflight passed for ${started.groups} groups; Feishu socket stayed disconnected\n`)
+      return
     }
-    process.on('SIGINT', () => { void shutdown(active, 'SIGINT', 0) })
-    process.on('SIGTERM', () => { void shutdown(active, 'SIGTERM', 0) })
     process.on('exit', lock.release)
-    try {
-      await launch(active)
-      running = true
-    } catch (error) {
-      active.gate.stop()
-      active.engine.shutdown()
-      let timer
-      await Promise.race([
-        Promise.resolve().then(() => active.stopPlatform()).catch(() => false),
-        new Promise(resolve => { timer = setTimeout(resolve, 2_000) }),
-      ])
-      clearTimeout(timer)
-      await active.engine.drainDurableV2(12_000).catch(() => false)
-      throw error
+    running = true
+    process.stderr.write(`SintBot Feishu ingress connected for ${started.groups} groups\n`)
+    for (const item of started.held || []) {
+      process.stderr.write(`SintBot group ${item.chatId} is held: ${item.reason}\n`)
     }
-  } finally { if (!running) lock.release() }
+  } catch (error) {
+    ui?.close()
+    const stopped = await service?.stop('startup-failed', 1)
+    if (stopped && (!stopped.startupStopped || !stopped.platformStopped || !stopped.drained)) {
+      process.stderr.write('C2 multi-group startup cleanup was not confirmed; exiting with evidence preserved\n',
+        () => process.exit(1))
+    }
+    throw error
+  } finally {
+    if (!running) {
+      if (onSigint) process.off('SIGINT', onSigint)
+      if (onSigterm) process.off('SIGTERM', onSigterm)
+      capacity.close(); lock.release()
+    }
+  }
 }
 
 // The opt-in receipt authority cannot keep accepting Feishu messages after
@@ -321,16 +325,23 @@ function fail(message) {
   process.exitCode = 1
 }
 
-const HELP = `SintBot macOS Feishu single-group release
+const HELP = `SintBot macOS Feishu multi-group candidate
 Usage:
-  sintbot init [--config <absolute path>]
-  sintbot start [--config <absolute path>] [--preflight]
+  sintbot init [--config <absolute path>] [--data-dir <absolute path>]
+  sintbot start [--config <absolute path>] [--data-dir <absolute path>] [--preflight] [--ui] [--ui-host <address>] [--ui-port <port>] [--no-open]
+  sintbot incident seal --group <oc_…> [--config <absolute path>] [--data-dir <absolute path>] [--reason <text>]
   sintbot version
   sintbot help
 
-Supports one explicit Feishu group using Codex. Start runs in the foreground.
+Supports explicit Feishu groups using Codex or Claude Code. Start runs in the foreground.
 Initialization is for a new installation only; existing journals are never reset.
-Canvas, multiple groups, console, scheduled tasks, terminal chat and other platforms are unavailable.
+Console shows live groups, binds groups and switches models or projects of idle groups;
+in a group, /model lists or switches models. Unsupported actions stay disabled.
+Canvas, scheduled tasks, terminal chat and other platforms are unavailable.
+A group whose last result cannot be proven is held alone; the other groups keep serving.
+Restart first: a journal that can recover reopens on its own. If the group is still held,
+stop the service, run incident seal for that group, then start again.
+Sealing keeps the old journal unchanged; unknown effects are never replayed.
 `
 
 async function main(argv = process.argv.slice(2)) {
@@ -345,15 +356,32 @@ async function main(argv = process.argv.slice(2)) {
     process.stdout.write(HELP)
     return
   }
-  if (!['init', 'start'].includes(sub)) {
-    throw new Error(`${sub} is unavailable in this single-group release; use sintbot help`)
+  if (!['init', 'start', 'incident'].includes(sub)) {
+    throw new Error(`${sub} is unavailable in this release; use sintbot help`)
   }
   if (process.platform !== 'darwin') throw new Error('this release supports macOS only')
+  if (sub === 'incident') {
+    const [action, ...args] = rest
+    if (rest.some(arg => arg === '--help' || arg === '-h')) { process.stdout.write(HELP); return }
+    if (action !== 'seal') throw new Error('Usage: sintbot incident seal --group <oc_…> [--config <path>] [--data-dir <path>]')
+    const { values } = parseArgs({ args, allowPositionals: false, options: {
+      config: { type: 'string' }, 'data-dir': { type: 'string' },
+      group: { type: 'string' }, reason: { type: 'string' } } })
+    const installation = require('../src/c2install').loadInstallation(values.config,
+      { dataDir: values['data-dir'], allowAddedGroups: true })
+    const result = require('../src/c2incident').sealC2GroupIncident({ installation,
+      chatId: values.group, ...(values.reason !== undefined ? { reason: values.reason } : {}),
+      version: require('../package.json').version })
+    process.stdout.write(`Sealed the group's previous journal unchanged in ${result.incident}.\n` +
+      `${result.refusedSources} unsettled message(s) will not be processed again. ` +
+      'Start the service to reopen the group with a new journal.\n')
+    return
+  }
   if (sub === 'init') {
     const { values } = parseArgs({ args: rest, allowPositionals: false,
-      options: { config: { type: 'string' } } })
-    require('../src/c2install').initializeInstallation(values.config)
-    process.stdout.write('SintBot journal initialized; run sintbot start to connect the configured group.\n')
+      options: { config: { type: 'string' }, 'data-dir': { type: 'string' } } })
+    require('../src/c2install').initializeInstallation(values.config, { dataDir: values['data-dir'] })
+    process.stdout.write('SintBot journal initialized; run sintbot start to connect the configured groups.\n')
     return
   }
   await startService(rest)