sintbot 1.4.0 → 1.4.2

package/CHANGELOG.en.json

@@ -1,4 +1,42 @@
 [
+  {
+    "version": "1.4.2",
+    "date": "2026-11-09",
+    "name": "Check and install new versions from the console",
+    "items": [
+      {
+        "t": "Version checks in the console",
+        "d": "Software updates in Settings checks for stable releases at startup and daily and shows release notes when a new version is available."
+      },
+      {
+        "t": "One-click upgrade for background runs",
+        "d": "When a launchd agent runs SintBot, Upgrade now waits until every group is idle and settled, installs the new version into its own folder and switches to it; if it does not connect every group within 90 seconds, the previous version is restored. New messages wait about a minute during the switch and are asked to be resent."
+      },
+      {
+        "t": "Steps for foreground runs",
+        "d": "A foreground run shows how to stop, reinstall and start. Upgrades are not announced in groups."
+      }
+    ]
+  },
+  {
+    "version": "1.4.1",
+    "date": "2026-11-09",
+    "name": "A failing group stops only itself",
+    "items": [
+      {
+        "t": "One group's fault leaves the others working",
+        "d": "When a group's last task has an outcome that cannot be confirmed (for example a reply whose delivery is unknown, or a runner that exited without a result), only that group is paused; nothing is replayed or retried and the other groups keep working. A paused group answers new messages with a short notice."
+      },
+      {
+        "t": "One group no longer blocks startup",
+        "d": "If a group's records cannot be recovered, the other groups still start and the console marks that group Needs attention. The startup preflight fails and lists such groups."
+      },
+      {
+        "t": "Incident seal command",
+        "d": "Restart first; for a group that is still paused, stop the service and run sintbot incident seal --group <group ID>. The old records are kept unchanged, the group reopens with new records, and messages left unfinished before the seal are not processed again."
+      }
+    ]
+  },
   {
     "version": "1.4.0",
     "date": "2026-11-08",

package/CHANGELOG.json

@@ -1,4 +1,42 @@
 [
+  {
+    "version": "1.4.2",
+    "date": "2026-11-09",
+    "name": "在控制台查看和安装新版本",
+    "items": [
+      {
+        "t": "控制台检查新版本",
+        "d": "设置页的软件更新启动时和每天各检查一次正式版，有新版本时提示并附发布说明。"
+      },
+      {
+        "t": "后台运行时一键升级",
+        "d": "由 launchd 后台任务运行时，点「现在升级」会等所有群空闲、记录结清后，把新版本装到单独的目录再切换；新版本 90 秒内没连上全部群会自动换回旧版。切换期间约一分钟不处理新消息，会提示稍后重发。"
+      },
+      {
+        "t": "前台运行给出升级步骤",
+        "d": "前台运行时卡片说明如何停止、重新安装并启动。升级不在群里播报。"
+      }
+    ]
+  },
+  {
+    "version": "1.4.1",
+    "date": "2026-11-09",
+    "name": "一个群出问题，只停这个群",
+    "items": [
+      {
+        "t": "一个群出问题，其他群照常",
+        "d": "某个群上一个任务的结果无法确认时（例如回复是否送达不明，或执行器退出时没有结果），只暂停这个群，不重放、不重试，其他群继续处理。暂停的群收到新消息会回一句说明。"
+      },
+      {
+        "t": "启动时不再被一个群拖住",
+        "d": "某个群的记录恢复不了时，其他群照常启动，控制台把这个群标为「需要处理」。启动预检遇到这样的群会直接失败并列出原因。"
+      },
+      {
+        "t": "新增封存命令",
+        "d": "先重启服务；仍然暂停的群，在服务停止后运行 sintbot incident seal --group 群 ID。原记录原样封存，这个群换一份新记录重新开放，封存前未完成的消息不会再处理。"
+      }
+    ]
+  },
   {
     "version": "1.4.0",
     "date": "2026-11-08",

package/bin/sintbot-v2.js

@@ -112,6 +112,7 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
   let service
   let ui
   let configControl
+  let updater
   let liveTransport
   let onSigint, onSigterm
   try {
@@ -122,11 +123,18 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
     for (const name of ['pending-turns.json', 'engine-receipts.json']) {
       if (fs.existsSync(path.join(stateDir, name))) throw new Error('Legacy pending authority needs explicit migration')
     }
+    // A journal that cannot be opened or audited holds only its own group.
     const journals = new Map()
+    const holds = new Map()
     for (const route of routes) {
-      const journal = C2DurableJournal.open(route.file, validators)
-      assertJournalScope(journal, route.chatId, { requireSettled: preflightOnly || route.paused })
-      journals.set(route.chatId, journal)
+      try {
+        const journal = C2DurableJournal.open(route.file, validators)
+        assertJournalScope(journal, route.chatId, { requireSettled: preflightOnly || route.paused })
+        journals.set(route.chatId, journal)
+      } catch (error) {
+        if (!assertWriterLock()) throw error
+        holds.set(route.chatId, error?.message || String(error))
+      }
     }
     // All group Engines must share this exact object: separate Store caches
     // would overwrite sibling sessions when they save the same state file.
@@ -136,6 +144,13 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
       'codex-exec': require('../src/agent/codexcode').isClosedRunnerResult,
       'codex-app': require('../src/agent/codexapp').isClosedRunnerResult,
     }
+    // A runner that failed from its own exit event has closed; this frees its
+    // model permit but never proves the turn's outcome.
+    const closeErrorChecks = {
+      claude: require('../src/agent/claudecode').isClosedRunnerError,
+      'codex-exec': require('../src/agent/codexcode').isClosedRunnerError,
+      'codex-app': require('../src/agent/codexapp').isClosedRunnerError,
+    }
     const limits = { maxEventCount: 100_000, maxJournalBytes: 64 * 1024 * 1024,
       maxCompletionEvents: 1_000, maxCompletionBytes: 8 * 1024 * 1024 }
     let finishing = false
@@ -143,12 +158,15 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
       if (finishing) return
       finishing = true
       ui?.close()
+      updater?.close()
       lock.release()
       process.stderr.write(`C2 multi-group · ${result.reason}; platform stopped=${result.platformStopped}; runner drained=${result.drained}\n`,
         () => process.exit(result.code))
     }
     service = createC2MultiGroupService({ routes, assertWriterLock, quarantine: combinedQuarantine,
-      closeCapacity: () => capacity.close(),
+      holds, closeCapacity: () => capacity.close(),
+      // Faults in a shared resource stop every group; others hold one group.
+      sharedFault: () => capacity.snapshot().closed ? 'model concurrency closed' : null,
       log: message => process.stderr.write(`C2 multi-group · ${message}\n`),
       onFatal: (error, result) => {
         process.stderr.write(`C2 multi-group failure: ${error?.message || String(error)}\n`)
@@ -199,10 +217,15 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
             verifyFile: path.join(stateDir, 'verify.json'), assertWriterLock,
             resolveTurn: identity => resolveC2LocalEffectTurn(engine, identity) })
           const closedResults = new WeakSet()
+          const closedErrors = new WeakSet()
           const startTurn = async input => {
             const backend = routeBackend(input.provider?.runner, input.codexApp,
               input.codexSteer, input.codexProjectDocFallback)
-            const result = await runner.runTurn(input)
+            let result
+            try { result = await runner.runTurn(input) } catch (error) {
+              if (closeErrorChecks[backend]?.(error) === true) closedErrors.add(error)
+              throw error
+            }
             if (closeChecks[backend]?.(result) === true) closedResults.add(result)
             return result
           }
@@ -210,14 +233,15 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
             store, log: message => process.stderr.write(`C2 v2 · ${message}\n`),
             durableV2Runtime: runtime, durableV2Payloads: handles,
             durableV2StartTurn: startTurn, durableV2ApplyLocalEffect: applyLocalEffect,
-            durableV2VerifyRunnerClosed: ({ result }) => !!result &&
-              typeof result === 'object' && closedResults.has(result),
+            durableV2VerifyRunnerClosed: ({ result, error }) => result
+              ? typeof result === 'object' && closedResults.has(result)
+              : !!error && typeof error === 'object' && closedErrors.has(error),
             durableV2AssertWriterLock: assertWriterLock, durableV2Journal: journal,
             durableV2AcquireCapacity: options => capacity.acquire(options),
-            // A failed model turn is closed for its group alone; every other
-            // route error still seals shared grants before the process stops.
+            // A route fault holds or recovers its group alone. Shared grants
+            // are sealed only when the process writer lease itself is gone.
             durableV2SealCapacity: error => {
-              if (error?.code !== 'C2_V2_UNRESOLVED_TURN') capacity.close(error)
+              if (assertWriterLock() !== true) capacity.close(error)
             },
             durableV2SwitchProvider: (chatId, name) => {
               if (chatId !== route.chatId) throw new Error('Model switch targets another group')
@@ -231,9 +255,26 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
       } })
     // One configuration writer for the console and the chat /model command.
     configControl = require('../src/c2configcontrol').createC2ConfigControl({
-      installation, getBindings: () => service.bindings, assertWriterLock, store,
-      activateRoute: route => service.addRoute(route),
+      installation, getBindings: () => service.bindings, getHeld: () => service.held,
+      assertWriterLock, store,
+      activateRoute: route => service.addRoute(route), isFrozen: () => service.inMaintenance,
       log: message => process.stderr.write(`C2 multi-group · ${message}\n`) })
+    if (!preflightOnly) {
+      // Console software updates. Only a launchd job that starts this exact
+      // entry may upgrade, and only while every group is idle and settled.
+      const c2updates = require('../src/c2updater')
+      const pkg = require('../package.json')
+      const upgradeGate = c2updates.createC2UpgradeGate({ isRunning: () => running,
+        service: () => service, capacity, assertJournalScope })
+      updater = c2updates.createC2Updater({ currentVersion: pkg.version,
+        runMode: c2updates.detectRunMode({ privateBuild: pkg.private === true, entry: __filename }),
+        stateFile: path.join(stateDir, 'update.json'), dataDir: stateDir, configPath: cfg._path,
+        gate: upgradeGate, beginMaintenance: () => service.beginMaintenance(),
+        endMaintenance: () => service.endMaintenance(), expectedGroups: () => service.bindings.size,
+        registries: c2updates.registriesFromEnv(),
+        fetchImpl: require('../src/core/proxy').getProxyFetch() || globalThis.fetch,
+        autoCheck: uiEnabled, log: message => process.stderr.write(`C2 update · ${message}\n`) })
+    }
     const stop = reason => { void service.stop(reason, 0).then(finish) }
     onSigint = () => stop('SIGINT')
     onSigterm = () => stop('SIGTERM')
@@ -243,9 +284,9 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
       ui = require('../src/c2console').createC2Console({
         configPath: cfg._path, stateDir, host: uiHost,
         getConfig: () => cfg, getBindings: () => service.bindings,
-        getCapacity: () => capacity.snapshot(),
+        getHeld: () => service.held, getCapacity: () => capacity.snapshot(),
         getConnHealth: () => liveTransport?.platform.connHealth?.() || {},
-        assertWriterLock, ...configControl,
+        assertWriterLock, ...configControl, updater,
         log: message => process.stderr.write(`Console · ${message}\n`) })
       await new Promise((resolve, reject) => {
         ui.server.once('error', reject)
@@ -261,6 +302,13 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
     process.on('exit', lock.release)
     running = true
     process.stderr.write(`SintBot Feishu ingress connected for ${started.groups} groups\n`)
+    for (const item of started.held || []) {
+      process.stderr.write(`SintBot group ${item.chatId} is held: ${item.reason}\n`)
+    }
+    // A console upgrade that switched to this version is done once every
+    // group is connected; then the daily version check starts.
+    if (!started.held?.length) updater?.confirmStarted()
+    void updater?.start()
   } catch (error) {
     ui?.close()
     const stopped = await service?.stop('startup-failed', 1)
@@ -271,6 +319,7 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
     throw error
   } finally {
     if (!running) {
+      updater?.close()
       if (onSigint) process.off('SIGINT', onSigint)
       if (onSigterm) process.off('SIGTERM', onSigterm)
       capacity.close(); lock.release()
@@ -303,6 +352,7 @@ const HELP = `SintBot macOS Feishu multi-group candidate
 Usage:
   sintbot init [--config <absolute path>] [--data-dir <absolute path>]
   sintbot start [--config <absolute path>] [--data-dir <absolute path>] [--preflight] [--ui] [--ui-host <address>] [--ui-port <port>] [--no-open]
+  sintbot incident seal --group <oc_…> [--config <absolute path>] [--data-dir <absolute path>] [--reason <text>]
   sintbot version
   sintbot help
 
@@ -311,7 +361,10 @@ Initialization is for a new installation only; existing journals are never reset
 Console shows live groups, binds groups and switches models or projects of idle groups;
 in a group, /model lists or switches models. Unsupported actions stay disabled.
 Canvas, scheduled tasks, terminal chat and other platforms are unavailable.
-Group faults stop the shared process safely; unknown effects are never replayed.
+A group whose last result cannot be proven is held alone; the other groups keep serving.
+Restart first: a journal that can recover reopens on its own. If the group is still held,
+stop the service, run incident seal for that group, then start again.
+Sealing keeps the old journal unchanged; unknown effects are never replayed.
 `
 
 async function main(argv = process.argv.slice(2)) {
@@ -326,10 +379,35 @@ async function main(argv = process.argv.slice(2)) {
     process.stdout.write(HELP)
     return
   }
-  if (!['init', 'start'].includes(sub)) {
+  if (sub === 'upgrade-switch') {
+    // Internal: started detached by a console upgrade; never run it by hand.
+    const { values } = parseArgs({ args: rest, allowPositionals: false, options: { state: { type: 'string' } } })
+    if (!values.state || !path.isAbsolute(values.state)) throw new Error('upgrade-switch needs --state <absolute path>')
+    const outcome = await require('../src/c2upgradeswitch').runUpgradeSwitch({ stateFile: values.state })
+    process.exitCode = outcome === 'done' ? 0 : 1
+    return
+  }
+  if (!['init', 'start', 'incident'].includes(sub)) {
     throw new Error(`${sub} is unavailable in this release; use sintbot help`)
   }
   if (process.platform !== 'darwin') throw new Error('this release supports macOS only')
+  if (sub === 'incident') {
+    const [action, ...args] = rest
+    if (rest.some(arg => arg === '--help' || arg === '-h')) { process.stdout.write(HELP); return }
+    if (action !== 'seal') throw new Error('Usage: sintbot incident seal --group <oc_…> [--config <path>] [--data-dir <path>]')
+    const { values } = parseArgs({ args, allowPositionals: false, options: {
+      config: { type: 'string' }, 'data-dir': { type: 'string' },
+      group: { type: 'string' }, reason: { type: 'string' } } })
+    const installation = require('../src/c2install').loadInstallation(values.config,
+      { dataDir: values['data-dir'], allowAddedGroups: true })
+    const result = require('../src/c2incident').sealC2GroupIncident({ installation,
+      chatId: values.group, ...(values.reason !== undefined ? { reason: values.reason } : {}),
+      version: require('../package.json').version })
+    process.stdout.write(`Sealed the group's previous journal unchanged in ${result.incident}.\n` +
+      `${result.refusedSources} unsettled message(s) will not be processed again. ` +
+      'Start the service to reopen the group with a new journal.\n')
+    return
+  }
   if (sub === 'init') {
     const { values } = parseArgs({ args: rest, allowPositionals: false,
       options: { config: { type: 'string' }, 'data-dir': { type: 'string' } } })

package/docs/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.0 with an AI assistant
+# Install SintBot 1.4.2 with an AI assistant
 
 English · [简体中文](./zh-CN/AI-ASSISTED-INSTALL.md)
 
@@ -15,5 +15,5 @@ Use the terminal on the Mac that will run SintBot. A cloud shell cannot install
 ## Copyable request
 
 ```text
-Install SintBot 1.4.0 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
+Install SintBot 1.4.2 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
 ```

package/docs/install.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.0
+# Install SintBot 1.4.2
 
 English · [简体中文](./zh-CN/install.md)
 
@@ -10,7 +10,7 @@ You need a Mac, Node.js 22 or newer, and projects stored on that Mac. Install an
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-The installer checks the environment, installs `sintbot@1.4.0` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.0`. No sudo is needed.
+The installer checks the environment, installs `sintbot@1.4.2` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.2`. No sudo is needed.
 
 To preview, append `-s -- --dry-run`. To choose another location, set `SINTBOT_INSTALL_DIR` and adjust the executable paths below.
 
@@ -98,11 +98,13 @@ Any text message is a task. Replies arrive in a card that appears once the model
 | `/hud` | Quota of the current model and usage of this conversation |
 | `/issue text` | Log feedback; review and close it in the console overview |
 
-Messages sent while a task runs are added to that task in Codex groups (`codexSteer: true`) and queued in Claude Code groups. If a turn returns a model error or no result, only that group is asked to resend; there is no automatic retry and other groups are unaffected.
+Messages sent while a task runs are added to that task in Codex groups (`codexSteer: true`) and queued in Claude Code groups. If a turn returns a model error or no result, only that group is asked to resend; there is no automatic retry. If a group's last result cannot be confirmed, such as a reply whose delivery is unknown, only that group is paused and answers new messages with a short notice; other groups keep working. Nothing is replayed or retried.
 
 ## 6. Console
 
-With `--ui`, open `http://127.0.0.1:4600` on this Mac. The console shows each group, stops tasks, binds new groups, and switches the model or project folder of an idle group. For LAN access, set a console password in its settings first, then enable LAN access.
+With `--ui`, open `http://127.0.0.1:4600` on this Mac. The console shows each group (a paused group shows Needs attention), stops tasks, binds new groups, and switches the model or project folder of an idle group. For LAN access, set a console password in its settings first, then enable LAN access.
+
+Settings → Software updates checks for new releases. In the foreground setup above it shows the upgrade steps: press Ctrl-C and wait for exit, rerun the one-line installer, then start again with the same command. If your own launchd agent starts SintBot, Upgrade now waits until every group is idle and settled, installs the new version into `~/.local/share/sintbot/releases/<version>` and switches the agent to it; if the new version does not connect every group within 90 seconds, the previous one is restored. Upgrades are not announced in groups.
 
 You can also add a group without the console: add it to the configuration, stop the service and run `start` again; the new group is registered automatically. Bound groups cannot be removed or renamed by editing the configuration.
 
@@ -114,6 +116,12 @@ Press Ctrl-C and wait for exit. With the Feishu variables set, run:
 "$HOME/.local/share/sintbot/bin/sintbot" start --config "$HOME/.sbot/config.json" --ui
 ```
 
-If startup reports an unsettled receipt or a result is uncertain, keep the journals and check what actually happened; never delete journals or resend to get around it. Run only one connected process per Feishu app. This release does not register a background service.
+If a group stays paused, first restart: a group whose records can recover reopens on its own and is told once to resend. If it is still paused, check what actually happened in that group, then stop the service and seal the group's incident:
+
+```bash
+"$HOME/.local/share/sintbot/bin/sintbot" incident seal --config "$HOME/.sbot/config.json" --group oc_PAUSED_GROUP_ID
+```
+
+Sealing keeps the old journal unchanged under `incidents/` in the data directory and gives the group a new journal; messages left unfinished before the seal are never processed again. Start the service again to reopen the group. A preflight fails while any group would stay paused. Never delete journals or resend to get around a paused group. Run only one connected process per Feishu app. This release does not register a background service.
 
 [Illustrated website guide](https://sintbot.com/guide/install/) · [AI-assisted installation](./AI-ASSISTED-INSTALL.md)

package/docs/zh-CN/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# 用 AI 助手安装 SintBot 1.4.0
+# 用 AI 助手安装 SintBot 1.4.2
 
 [English](../AI-ASSISTED-INSTALL.md) · 简体中文
 
@@ -15,5 +15,5 @@
 ## 可复制的请求
 
 ```text
-按一行安装指南，在这台 Mac 安装 SintBot 1.4.0。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
+按一行安装指南，在这台 Mac 安装 SintBot 1.4.2。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
 ```

package/docs/zh-CN/install.md

@@ -1,4 +1,4 @@
-# 安装 SintBot 1.4.0
+# 安装 SintBot 1.4.2
 
 [English](../install.md) · 简体中文
 
@@ -10,7 +10,7 @@
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-安装器会自动检查环境，把 `sintbot@1.4.0` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.0` 就可以继续。不需要 sudo。
+安装器会自动检查环境，把 `sintbot@1.4.2` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.2` 就可以继续。不需要 sudo。
 
 可选预览：在命令末尾加 `-s -- --dry-run`。要自定义安装位置，设置 `SINTBOT_INSTALL_DIR` 环境变量，并同步修改后面的可执行文件路径。
 
@@ -98,11 +98,13 @@ SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
 | `/hud` | 当前模型的额度与本段对话的用量 |
 | `/issue 一句话` | 记下问题反馈，在控制台概览里查看和标记处理 |
 
-任务进行中再发的消息：Codex 群（`codexSteer: true`）会补充进当前任务，Claude Code 群会排队，等这一轮结束再处理。某一轮模型报错或没有结果时，只在本群提示重新发送，不会自动重试，也不影响其他群。
+任务进行中再发的消息：Codex 群（`codexSteer: true`）会补充进当前任务，Claude Code 群会排队，等这一轮结束再处理。某一轮模型报错或没有结果时，只在本群提示重新发送，不会自动重试。某个群上一轮的结果无法确认时（例如回复是否送达不明），只暂停这个群，它收到新消息会回一句说明，其他群照常；不重放、不重试。
 
 ## 6. 控制台
 
-带 `--ui` 启动后，在本机浏览器打开 `http://127.0.0.1:4600`。控制台可以查看各群状态、停止任务、绑定新群、给空闲的群切换模型或项目目录。要从局域网访问，先在控制台的设置里设访问密码，再开启局域网访问。
+带 `--ui` 启动后，在本机浏览器打开 `http://127.0.0.1:4600`。控制台可以查看各群状态（暂停的群显示「需要处理」）、停止任务、绑定新群、给空闲的群切换模型或项目目录。要从局域网访问，先在控制台的设置里设访问密码，再开启局域网访问。
+
+「设置 → 软件更新」会检查新版本。按上面前台方式运行时，卡片给出升级步骤：按 Ctrl-C 等待退出，重新运行一行安装命令，再用原来的命令启动。如果用你自己的 launchd 后台任务启动 SintBot，「现在升级」会等所有群空闲、记录结清后，把新版本装到 `~/.local/share/sintbot/releases/<版本>` 并切换过去；新版本 90 秒内没连上全部群会自动换回旧版。升级不在群里播报。
 
 不用控制台也能加群：在配置里加上新群，停止后重新 `start` 即可，新群会自动登记。已绑定的群不能通过改配置删除或改名。
 
@@ -114,6 +116,12 @@ SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
 "$HOME/.local/share/sintbot/bin/sintbot" start --config "$HOME/.sbot/config.json" --ui
 ```
 
-如果启动提示有未结收据，或任务结果不明，保留日志并核对实际结果；不要通过删除日志或重复发送来绕过。一个飞书应用同一时间只运行一个连接进程。本版不自动注册后台服务。
+某个群一直暂停时，先重启：记录能恢复的群会自己重新开放，并提示一次重新发送。重启后仍暂停，先核对这个群实际发生了什么，再停止服务，封存这个群的事故记录：
+
+```bash
+"$HOME/.local/share/sintbot/bin/sintbot" incident seal --config "$HOME/.sbot/config.json" --group oc_暂停的群ID
+```
+
+封存会把原日志原样留在数据目录的 `incidents/` 下，并给这个群换一份新日志；封存前没处理完的消息不会再处理。再次启动服务，这个群就重新开放。有群会保持暂停时，预检会失败。不要通过删除日志或重复发送来绕过暂停。一个飞书应用同一时间只运行一个连接进程。本版不自动注册后台服务。
 
 [带图示的官网指南](https://sintbot.com/zh/guide/install/) · [AI 辅助安装](./AI-ASSISTED-INSTALL.md)

package/install.sh

@@ -2,7 +2,7 @@
 # The function is parsed in full before installation starts, including when piped.
 sintbot_install() (
   set -eu
-  version=1.4.0
+  version=1.4.2
   prefix="${SINTBOT_INSTALL_DIR:-$HOME/.local/share/sintbot}"
   fail() { printf 'SintBot: %s\n' "$*" >&2; exit 1; }
   case "${1:-}" in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sintbot",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "private": false,
   "description": "Drive your Mac projects from Feishu groups with Codex or Claude Code, using a built-in agent core.",
   "bin": {
@@ -58,10 +58,13 @@
     "src/agent/winexec.js",
     "src/c2configcontrol.js",
     "src/c2console.js",
+    "src/c2incident.js",
     "src/c2install.js",
     "src/c2migration.js",
     "src/c2multigroupcapacity.js",
     "src/c2multigroupservice.js",
+    "src/c2updater.js",
+    "src/c2upgradeswitch.js",
     "src/cdp.js",
     "src/config.js",
     "src/core/c2cardeffectbridge.js",
@@ -128,6 +131,7 @@
     "src/ui/serverbase.js",
     "src/ui/sessions.js",
     "src/ui/takeover.js",
+    "src/updater.js",
     "src/usage.js"
   ],
   "scripts": {

package/src/agent/claudecode.js

@@ -29,6 +29,11 @@ const { IS_WIN, resolveSpawn } = require('./winexec')
 const { tagError } = require('./errtag') // 出错原话 → quota / sessionMissing / transient 之一(优先级只在那一处定),与 codex runner 共用
 const closedRunnerResults = new WeakSet()
 const isClosedRunnerResult = result => !!result && typeof result === 'object' && closedRunnerResults.has(result)
+// A rejection raised from the child's own 'close' event: the process has
+// exited even though the turn has no result. It never proves the turn's outcome.
+const closedRunnerErrors = new WeakSet()
+const isClosedRunnerError = error => !!error && typeof error === 'object' && closedRunnerErrors.has(error)
+const closedError = error => { closedRunnerErrors.add(error); return error }
 const PRE_INIT_HOOK_EVENTS = new Set(['hook_started', 'hook_response'])
 const DURABLE_EVENT_TYPES = new Set(['system', 'assistant', 'user', 'result', 'tool_result'])
 // Tool output is completion evidence only, never answer text.
@@ -451,7 +456,7 @@ function runTurn({
 
       const completeClose = (code) => finish(() => {
         if (code !== 0 && !lastResult && !aborted) {
-          return reject(new Error(`claude exited ${code}: ${stderr.trim().slice(0, 800) || '(no stderr)'}`))
+          return reject(closedError(new Error(`claude exited ${code}: ${stderr.trim().slice(0, 800) || '(no stderr)'}`)))
         }
         resolveRun({ sessionId: capturedSessionId, result: lastResult, code, aborted })
       })
@@ -524,4 +529,4 @@ function probeVersion(bin = 'claude') {
   })
 }
 
-module.exports = { runTurn, isClosedRunnerResult, buildEnv, normalizeEvent, probeVersion, supportsFlag, BASE_SKILL_ALLOWS }
+module.exports = { runTurn, isClosedRunnerResult, isClosedRunnerError, buildEnv, normalizeEvent, probeVersion, supportsFlag, BASE_SKILL_ALLOWS }

package/src/agent/codexapp.js

@@ -4,6 +4,11 @@
 const { spawn } = require('node:child_process')
 const closedRunnerResults = new WeakSet()
 const isClosedRunnerResult = result => !!result && typeof result === 'object' && closedRunnerResults.has(result)
+// A rejection raised from the child's own 'close' event: the process has
+// exited even though the turn has no result. It never proves the turn's outcome.
+const closedRunnerErrors = new WeakSet()
+const isClosedRunnerError = error => !!error && typeof error === 'object' && closedRunnerErrors.has(error)
+const closedError = error => { closedRunnerErrors.add(error); return error }
 const { IS_WIN, resolveSpawn } = require('./winexec')
 const { normalizeEvent, isEffortRejection } = require('./codexcode')
 const { coreFailedResult, isCoreFailure } = require('./errtag')
@@ -439,7 +444,7 @@ function runTurn(opts = {}) {
     })
     const completeClose = (code) => settle(() => {
       if (onDurableEvent && !completed && !aborted) {
-        reject(new Error(`codex app-server exited ${code} before a durable result`))
+        reject(closedError(new Error(`codex app-server exited ${code} before a durable result`)))
         return
       }
       if (!completed && !aborted) {
@@ -467,4 +472,4 @@ function runTurn(opts = {}) {
   })
 }
 
-module.exports = { runTurn, isClosedRunnerResult, usageFromTotal, itemEvent, failedTurnEvent }
+module.exports = { runTurn, isClosedRunnerResult, isClosedRunnerError, usageFromTotal, itemEvent, failedTurnEvent }

package/src/agent/codexcode.js

@@ -13,6 +13,11 @@
 const { spawn } = require('node:child_process')
 const closedRunnerResults = new WeakSet()
 const isClosedRunnerResult = result => !!result && typeof result === 'object' && closedRunnerResults.has(result)
+// A rejection raised from the child's own 'close' event: the process has
+// exited even though the turn has no result. It never proves the turn's outcome.
+const closedRunnerErrors = new WeakSet()
+const isClosedRunnerError = error => !!error && typeof error === 'object' && closedRunnerErrors.has(error)
+const closedError = error => { closedRunnerErrors.add(error); return error }
 const { StringDecoder } = require('node:string_decoder')
 const { IS_WIN, resolveSpawn } = require('./winexec')
 const { tagError } = require('./errtag') // 出错原话 → quota / sessionMissing / transient 之一(优先级只在那一处定),与 claude runner 共用
@@ -398,11 +403,11 @@ function runOnce(opts, effort) {
 
     const completeClose = (code) => {
       if (onDurableEvent && code !== 0 && !lastResult && !aborted) {
-        done(() => reject(new Error(`codex exited ${code} before a durable result`)))
+        done(() => reject(closedError(new Error(`codex exited ${code} before a durable result`))))
         return
       }
       if (durableStart && !acceptedStart && !aborted && !acceptanceFailed) {
-        done(() => reject(new Error('Codex exited before turn.started acceptance')))
+        done(() => reject(closedError(new Error('Codex exited before turn.started acceptance'))))
         return
       }
       // Watch the answer→close (rollout-flush) lag. Healthy = ~2–3s (real-machine verified),
@@ -450,4 +455,4 @@ function probeVersion(bin = 'codex') {
   })
 }
 
-module.exports = { runTurn, runOnce, isClosedRunnerResult, probeVersion, normalizeEvent, parseCodexError, isEffortRejection, sandboxMode, buildArgs, buildPrompt }
+module.exports = { runTurn, runOnce, isClosedRunnerResult, isClosedRunnerError, probeVersion, normalizeEvent, parseCodexError, isEffortRejection, sandboxMode, buildArgs, buildPrompt }

package/src/c2configcontrol.js

@@ -17,10 +17,11 @@ const RESET_KEYS = ['provider', 'model', 'workdir', 'codexApp']
 // model, project or backend clears its session before the new configuration
 // is written, so no later turn can resume a session from another backend.
 // It never moves a journal, settles a receipt or reconnects the platform.
-function createC2ConfigControl({ installation, getBindings, assertWriterLock,
-  store = null, activateRoute = null, probeRunner = assertRunnerExecutable,
-  log = () => {} } = {}) {
+function createC2ConfigControl({ installation, getBindings, getHeld = () => new Map(),
+  assertWriterLock, store = null, activateRoute = null, probeRunner = assertRunnerExecutable,
+  isFrozen = () => false, log = () => {} } = {}) {
   if (!installation?.cfg?._path || typeof getBindings !== 'function' ||
+      typeof getHeld !== 'function' || typeof isFrozen !== 'function' ||
       typeof assertWriterLock !== 'function' ||
       store !== null && typeof store.resetGroupSession !== 'function' ||
       activateRoute !== null && typeof activateRoute !== 'function' ||
@@ -46,6 +47,7 @@ function createC2ConfigControl({ installation, getBindings, assertWriterLock,
   function validateConfig(raw) {
     prepared = null
     held()
+    if (isFrozen()) throw new Error('SintBot is upgrading; settings cannot change until it restarts')
     const next = loadInstallationFromRaw(raw, cfg._path, { dataDir: stateDir,
       allowAddedGroups: !!activateRoute && !!store })
     const bindings = getBindings()
@@ -72,11 +74,19 @@ function createC2ConfigControl({ installation, getBindings, assertWriterLock,
       throw new Error('Changing global concurrency requires a service restart')
     }
     const resets = [], activations = [], changed = []
+    const heldGroups = getHeld()
     for (const route of routes) {
       const target = next.routes.find(item => item.chatId === route.chatId)
       if (route.group.platform !== target.group.platform) {
         throw new Error('Moving a group to another platform requires an explicit state migration')
       }
+      if (heldGroups.has(route.chatId)) {
+        // Edits elsewhere proceed; the held group keeps its exact settings.
+        if (!isDeepStrictEqual(route.group, target.group)) {
+          throw new Error('This group is held after an unresolved fault; seal its incident and restart before changing it')
+        }
+        continue
+      }
       if (!isDeepStrictEqual(route.group, target.group)) changed.push(route.chatId)
       if (RESET_KEYS.some(key => !isDeepStrictEqual(route.group[key], target.group[key]))) {
         if (!store) throw new Error('Changing model or project requires session reset authority')